Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-10267 State: PUBLISHED Published: 2025-03-20T10:09:43.452Z Last Updated: 2025-03-20T18:35:34.840Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: transformeroptimus Products: transformeroptimus/superagi Problem Types: CWE-359 Description: An information disclosure vulnerability exists in the latest version of transformeroptimus/superagi. An attacker can leak sensitive user information, including names, emails, and passwords, by attempting to register a new account with an email that is already in use. The server returns all information associated with the existing account. The vulnerable endpoint is located in the user registration functionali
nformation associated with the existing account. The vulnerable endpoint is located in the user registration functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/13da8366-4670-4d46-9f5a-ba3f642b692e
CVE ID: CVE-2024-10268 State: PUBLISHED Published: 2024-11-19T07:35:25.742Z Last Updated: 2024-11-19T15:16:33.730Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: sonaar Products: MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar Problem Types: CWE-79 Description: The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sonaar_audioplayer shortcode in all versions up to, and including, 5.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-leve
d output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/861d0218-0f0f-4299-a0ff-854832348457?source=cve - https://wordpress.org/plugins/mp3-music-player-by-sonaar/#developers - https://plugins.trac.wordpress.org/changeset/3188034/
CVE ID: CVE-2024-10269 State: PUBLISHED Published: 2024-11-08T06:39:59.186Z Last Updated: 2024-11-08T14:05:49.129Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: benjamin_zekavica Products: Easy SVG Support Problem Types: CWE-79 Description: The Easy SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 3.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst
ve, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5fbc0866-1e9d-457a-8ef3-fb046c89c1dd?source=cve - https://wordpress.org/plugins/easy-svg/#developers - https://plugins.trac.wordpress.org/changeset/3181757/
CVE ID: CVE-2024-10270 State: PUBLISHED Published: 2024-11-25T07:37:04.542Z Last Updated: 2025-11-11T16:08:34.510Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat build of Keycloak 24, Red Hat build of Keycloak 24.0.9, Red Hat build of Keycloak 26.0, Red Hat build of Keycloak 26.0.6, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat Single Sign-On 7 Problem Types: CWE-1333 Description: A vulnerability was found in the Keycloak-services package. If untrusted data is passed to the SearchQueryUtils method, it could lead to a denial of service (DoS) scenario by exhaust
untrusted data is passed to the SearchQueryUtils method, it could lead to a denial of service (DoS) scenario by exhausting system resources due to a Regex complexity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:10175 - https://access.redhat.com/errata/RHSA-2024:10176 - https://access.redhat.com/errata/RHSA-2024:10177 - https://access.redhat.com/errata/RHSA-2024:10178 - https://access.redhat.com/security/cve/CVE-2024-10270 - https://bugzilla.redhat.com/show_bug.cgi?id=2321214
CVE ID: CVE-2024-10272 State: PUBLISHED Published: 2025-03-20T10:11:06.828Z Last Updated: 2025-10-15T12:49:23.325Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-862 Description: lunary-ai/lunary is vulnerable to broken access control in the latest version. An attacker can view the content of any dataset without any kind of authorization by sending a GET request to the /v1/datasets endpoint without a valid authorization token. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/3de48a54-b5c9-40a1-b794-d59c36d58fb6 - https://github.com/lunary-ai/lunary/commit/35dd4a
s: - https://huntr.com/bounties/3de48a54-b5c9-40a1-b794-d59c36d58fb6 - https://github.com/lunary-ai/lunary/commit/35dd4af0001a54ccb14276a1546eb977f82c0c5e
CVE ID: CVE-2024-10273 State: PUBLISHED Published: 2025-03-20T10:08:48.120Z Last Updated: 2025-10-15T12:49:24.444Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-863 Description: In lunary-ai/lunary v1.5.0, improper privilege management in the models.ts file allows users with viewer roles to modify models owned by others. The PATCH endpoint for models does not have appropriate privilege checks, enabling low-privilege users to update models they should not have access to modify. This vulnerability could lead to unauthorized changes in critical resources, affecting the integrity and reliability of the sy
ulnerability could lead to unauthorized changes in critical resources, affecting the integrity and reliability of the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/883d9fe2-5730-41e1-a5c2-59972489876e - https://github.com/lunary-ai/lunary/commit/8ba1b8ba2c2c30b1cec30eb5777c1fda670cbbfc
CVE ID: CVE-2024-10274 State: PUBLISHED Published: 2025-03-20T10:09:05.537Z Last Updated: 2025-10-15T12:49:24.935Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-862 Description: An improper authorization vulnerability exists in lunary-ai/lunary version 1.5.5. The /users/me/org endpoint lacks adequate access control mechanisms, allowing unauthorized users to access sensitive information about all team members in the current organization. This vulnerability can lead to the disclosure of sensitive information such as names, roles, or emails to users without sufficient privileges, resulting in privacy vio
f sensitive information such as names, roles, or emails to users without sufficient privileges, resulting in privacy violations and potential reconnaissance for targeted attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/506459c1-da60-45c5-a10d-8bd540a4b4c1 - https://github.com/lunary-ai/lunary/commit/8ba1b8ba2c2c30b1cec30eb5777c1fda670cbbfc
CVE ID: CVE-2024-10275 State: PUBLISHED Published: 2025-03-20T10:09:15.334Z Last Updated: 2025-10-15T12:49:25.441Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-863 Description: In version 1.5.5 of lunary-ai/lunary, a vulnerability exists where admins, who do not have direct permissions to access billing resources, can change the permissions of existing users to include billing permissions. This can lead to a privilege escalation scenario where an administrator can manage billing, effectively bypassing the intended role-based access control. Only users with the 'owner' role should be allowed to invite m
ctively bypassing the intended role-based access control. Only users with the 'owner' role should be allowed to invite members with billing permissions. This flaw allows admins to circumvent those restrictions, gaining unauthorized access and control over billing information, posing a risk to the organization’s financial resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/863ee34b-c4c6-4325-bf7a-82a7feebf88f - https://github.com/lunary-ai/lunary/commit/8ba1b8ba2c2c30b1cec30eb5777c1fda670cbbfc
CVE ID: CVE-2024-10276 State: PUBLISHED Published: 2024-10-23T11:00:05.855Z Last Updated: 2024-10-29T17:22:22.799Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Telestream Products: Sentry Problem Types: CWE-79 Description: A vulnerability has been found in Telestream Sentry 6.0.9 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /?page=reports of the component Reports Page. The manipulation of the argument z leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.28155
the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281551 - https://vuldb.com/?ctiid.281551 - https://vuldb.com/?submit.423695
CVE ID: CVE-2024-10277 State: PUBLISHED Published: 2024-10-23T11:31:21.609Z Last Updated: 2024-10-23T13:31:12.536Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: ESAFENET Products: CDG Problem Types: CWE-89 Description: A vulnerability was found in ESAFENET CDG 5 and classified as critical. Affected by this issue is some unknown functionality of the file /com/esafenet/servlet/ajax/UsbKeyAjax.java. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vuln
ndor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281552 - https://vuldb.com/?ctiid.281552 - https://vuldb.com/?submit.423830 - https://flowus.cn/share/510c9ef1-8bb9-4c8f-9648-2ea6ee726b06?code=G8A6P3
CVE ID: CVE-2024-10278 State: PUBLISHED Published: 2024-10-23T13:00:11.967Z Last Updated: 2024-10-23T13:15:15.911Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: ESAFENET Products: CDG Problem Types: CWE-89 Description: A vulnerability was found in ESAFENET CDG 5. It has been classified as critical. This affects an unknown part of the file /com/esafenet/servlet/user/ReUserOrganiseService.java. The manipulation of the argument userId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CI
sed. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281553 - https://vuldb.com/?ctiid.281553 - https://vuldb.com/?submit.423831 - https://flowus.cn/share/cdfbea40-da0c-4fe7-a4b8-86631f0fd796?code=G8A6P3
CVE ID: CVE-2024-10279 State: PUBLISHED Published: 2024-10-23T13:00:17.328Z Last Updated: 2024-10-23T13:12:49.712Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: ESAFENET Products: CDG Problem Types: CWE-89 Description: A vulnerability was found in ESAFENET CDG 5. It has been declared as critical. This vulnerability affects unknown code of the file /com/esafenet/servlet/policy/PrintPolicyService.java. The manipulation of the argument policyId leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CI
sed. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281554 - https://vuldb.com/?ctiid.281554 - https://vuldb.com/?submit.423832 - https://flowus.cn/share/b04c63c7-5b3c-47d2-9159-43943aecc342?code=G8A6P3
CVE ID: CVE-2024-10280 State: PUBLISHED Published: 2024-10-23T13:31:07.315Z Last Updated: 2024-10-23T17:41:57.370Z Severity: N/A (CVSS 6.8 AV:N/AC:L/Au:S/C:N/I:N/A:C) Vendors: Tenda Products: AC6, AC7, AC8, AC9, AC10, AC10U, AC15, AC18, AC500, AC1206 Problem Types: CWE-476 Description: A vulnerability was found in Tenda AC6, AC7, AC8, AC9, AC10, AC10U, AC15, AC18, AC500 and AC1206 up to 20241022. It has been rated as problematic. This issue affects the function websReadEvent of the file /goform/GetIPTV. The manipulation of the argument Content-Length leads to null pointer dereference. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Addition
ereference. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281555 - https://vuldb.com/?ctiid.281555 - https://vuldb.com/?submit.426417 - https://github.com/JohenanLi/router_vuls/blob/main/websReadEvent/websReadEvent.md - https://www.tenda.com.cn/
CVE ID: CVE-2024-10281 State: PUBLISHED Published: 2024-10-23T14:00:24.603Z Last Updated: 2024-10-23T18:20:52.773Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: RX9, RX9 Pro Problem Types: CWE-121 Description: A vulnerability classified as critical has been found in Tenda RX9 and RX9 Pro 22.03.02.10/22.03.02.20. Affected is the function sub_42EEE0 of the file /goform/SetStaticRouteCfg. The manipulation of the argument list leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281556 - ht
blic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281556 - https://vuldb.com/?ctiid.281556 - https://vuldb.com/?submit.427065 - https://gitee.com/GXB0_0/iot-vul/blob/master/Tenda/RX9/20/SetStaticRouteCfg.md - https://www.tenda.com.cn/
CVE ID: CVE-2024-10282 State: PUBLISHED Published: 2024-10-23T14:31:24.051Z Last Updated: 2024-10-23T17:51:56.577Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: RX9, RX9 Pro Problem Types: CWE-121 Description: A vulnerability classified as critical was found in Tenda RX9 and RX9 Pro 22.03.02.10/22.03.02.20. Affected by this vulnerability is the function sub_42EA38 of the file /goform/SetVirtualServerCfg. The manipulation of the argument list leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.2
to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281557 - https://vuldb.com/?ctiid.281557 - https://vuldb.com/?submit.427066 - https://gitee.com/GXB0_0/iot-vul/blob/master/Tenda/RX9/20/SetVirtualServerCfg.md - https://www.tenda.com.cn/
CVE ID: CVE-2024-10283 State: PUBLISHED Published: 2024-10-23T15:00:12.454Z Last Updated: 2024-10-23T17:33:05.674Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: RX9, RX9 Pro Problem Types: CWE-121 Description: A vulnerability, which was classified as critical, has been found in Tenda RX9 and RX9 Pro 22.03.02.20. Affected by this issue is the function sub_4337EC of the file /goform/SetNetControlList. The manipulation of the argument list leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281558
he public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281558 - https://vuldb.com/?ctiid.281558 - https://vuldb.com/?submit.427064 - https://gitee.com/GXB0_0/iot-vul/blob/master/Tenda/RX9/20/SetNetControlList.md - https://www.tenda.com.cn/
CVE ID: CVE-2024-10284 State: PUBLISHED Published: 2024-11-09T02:32:00.635Z Last Updated: 2024-11-12T17:11:52.545Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ce21com Products: CE21 Suite Problem Types: CWE-288 Description: The CE21 Suite plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.2.0. This is due to hardcoded encryption key in the 'ce21_authentication_phrase' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.
strator, if they have access to the email. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/45d66743-300e-480d-98b8-99dc30b6e786?source=cve - https://plugins.trac.wordpress.org/browser/ce21-suite/trunk/single-sign-on-ce21.php?rev=3097700#L242
CVE ID: CVE-2024-10285 State: PUBLISHED Published: 2024-11-09T02:32:01.740Z Last Updated: 2024-11-12T17:11:06.632Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ce21com Products: CE21 Suite Problem Types: CWE-200 Description: The CE21 Suite plugin for WordPress is vulnerable to sensitive information disclosure via the plugin-log.txt in versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to log in the user associated with the JWT token. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/618a9ad7-3a13-43e6-84f4-35287f07e1c0?source=cve - https://pl
- https://www.wordfence.com/threat-intel/vulnerabilities/id/618a9ad7-3a13-43e6-84f4-35287f07e1c0?source=cve - https://plugins.trac.wordpress.org/browser/ce21-suite/trunk/single-sign-on-ce21.php?rev=3097700#L237 - https://plugins.trac.wordpress.org/browser/ce21-suite/trunk/single-sign-on-ce21.php?rev=3097700#L281
CVE ID: CVE-2024-10286 State: PUBLISHED Published: 2024-10-23T12:01:40.766Z Last Updated: 2024-10-23T13:00:28.820Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: LocalServer Products: LocalServer Problem Types: CWE-79 Description: Cross-Site Scripting (XSS) vulnerability affecting LocalServer 1.0.9 that could allow a remote user to send a specially crafted query to an authenticated user and steal their session details through /testmail/index.php, parameter to. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-xss-vulnerabilities-localserver
CVE ID: CVE-2024-10287 State: PUBLISHED Published: 2024-10-23T12:02:44.915Z Last Updated: 2024-10-23T13:00:10.603Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: LocalServer Products: LocalServer Problem Types: CWE-79 Description: Cross-Site Scripting (XSS) vulnerability affecting LocalServer 1.0.9 that could allow a remote user to send a specially crafted query to an authenticated user and steal their session details through /mlss/ForgotPassword, parameter ListName. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-xss-vulnerabilities-localserver
CVE ID: CVE-2024-10288 State: PUBLISHED Published: 2024-10-23T12:03:10.937Z Last Updated: 2024-10-23T12:59:41.430Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: LocalServer Products: LocalServer Problem Types: CWE-79 Description: Cross-Site Scripting (XSS) vulnerability affecting LocalServer 1.0.9 that could allow a remote user to send a specially crafted query to an authenticated user and steal their session details through /mlss/SubscribeToList, parameter ListName. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-xss-vulnerabilities-localserver
CVE ID: CVE-2024-10289 State: PUBLISHED Published: 2024-10-23T12:03:48.367Z Last Updated: 2024-10-23T12:59:03.838Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: LocalServer Products: LocalServer Problem Types: CWE-79 Description: Cross-Site Scripting (XSS) vulnerability affecting LocalServer 1.0.9 that could allow a remote user to send a specially crafted query to an authenticated user and steal their session details through /mlss/ManageSubscription, parameter MSubListName. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-xss-vulnerabilities-localserver
CVE ID: CVE-2024-10290 State: PUBLISHED Published: 2024-10-23T15:00:14.138Z Last Updated: 2024-10-23T15:48:37.149Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: ZZCMS Problem Types: CWE-200 Description: A vulnerability, which was classified as problematic, was found in ZZCMS 2023. This affects an unknown part of the file 3/qq-connect2.0/API/com/inc.php. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281559 - https://vuldb.com/?ctiid.281559 - http
lyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281559 - https://vuldb.com/?ctiid.281559 - https://vuldb.com/?submit.427069 - https://github.com/LvZCh/zzcms2023/issues/1
CVE ID: CVE-2024-10291 State: PUBLISHED Published: 2024-10-23T15:31:04.202Z Last Updated: 2024-10-23T18:33:55.352Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: ZZCMS Problem Types: CWE-89 Description: A vulnerability has been found in ZZCMS 2023 and classified as critical. This vulnerability affects the function Ebak_DoExecSQL/Ebak_DotranExecutSQL of the file 3/Ebak5.1/upload/phome.php. The manipulation of the argument phome leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281560 - https://vuldb.com/?ct
d. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281560 - https://vuldb.com/?ctiid.281560 - https://vuldb.com/?submit.427101 - https://github.com/LvZCh/zzcms2023/issues/3
CVE ID: CVE-2024-10292 State: PUBLISHED Published: 2024-10-23T15:31:05.877Z Last Updated: 2024-10-23T18:24:33.568Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: ZZCMS Problem Types: CWE-434 Description: A vulnerability was found in ZZCMS 2023 and classified as critical. This issue affects some unknown processing of the file 3/Ebak5.1/upload/ChangeTable.php. The manipulation of the argument savefilename leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281561 - https://vuldb.com/?ctiid.281561 - https
yst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281561 - https://vuldb.com/?ctiid.281561 - https://vuldb.com/?submit.427136 - https://github.com/LvZCh/zzcms2023/issues/5