Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/33a366d9-6c81-4957-a101-768487aae735/
CVE ID: CVE-2024-4622 State: PUBLISHED Published: 2024-05-15T16:54:08.150Z Last Updated: 2025-03-27T16:07:24.605Z Vendors: alpitronic Products: Hypercharger EV Charger Problem Types: CWE-1392 Description: If misconfigured, alpitronic Hypercharger EV charging devices can expose a web interface protected by authentication. If the default credentials are not changed, an attacker can use public knowledge to access the device as an administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-130-02
CVE ID: CVE-2024-4623 State: PUBLISHED Published: 2024-06-19T03:12:32.508Z Last Updated: 2024-08-01T20:47:41.219Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: auburnforest Products: Blogmentor – Blog Layouts for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Blogmentor – Blog Layouts for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pagination_style’ parameter in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-lev
ficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b0925ceb-581c-4748-abfb-9962e53b7db9?source=cve - https://plugins.trac.wordpress.org/browser/blogmentor/trunk/includes/elements/blogmentor-blog-posts.php#L977
CVE ID: CVE-2024-4624 State: PUBLISHED Published: 2024-05-14T11:33:10.571Z Last Updated: 2024-08-01T20:47:41.209Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpdevteam Products: Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugins for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eael_ext_toc_title_tag’ parameter in versions up to, and including, 5.9.20 due to insufficie
oss-Site Scripting via the ‘eael_ext_toc_title_tag’ parameter in versions up to, and including, 5.9.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bedad627-0ccb-41c1-be8d-753f57be618f?source=cve - https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/5.9.19/includes/Traits/Elements.php#L550 - https://plug
c.wordpress.org/browser/essential-addons-for-elementor-lite/tags/5.9.19/includes/Traits/Elements.php#L550 - https://plugins.trac.wordpress.org/changeset/3085420/
CVE ID: CVE-2024-4625 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:05:08.730Z Description: No description available.
CVE ID: CVE-2024-4626 State: PUBLISHED Published: 2024-06-20T02:08:21.467Z Last Updated: 2024-08-01T20:47:41.222Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: jetmonsters Products: JetWidgets For Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘layout_type’ and 'id' parameters in all versions up to, and including, 1.0.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to
ion and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4457d15e-2c01-498d-b94a-a6e93adcf70c?source=cve - https://plugins.trac.wordpress.org/changeset/3103042/jetwidgets-for-elementor/tags/1.0.18/includes/addons/jet-widgets-image-comparison.php - https://plugins.trac.wordpress.org/changeset/3103042/jetwidgets-for-elementor/tags/1.0.18/includes/addons/jet-widgets-images-layout.php
CVE ID: CVE-2024-4627 State: PUBLISHED Published: 2024-07-02T06:00:02.905Z Last Updated: 2024-08-01T20:47:41.192Z Vendors: Unknown Products: Rank Math SEO Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Rank Math SEO WordPress plugin before 1.0.219 does not sanitise and escape some of its settings, which could allow users with access to the General Settings (by default admin, however such access can be given to lower roles via the Role Manager feature of the Rank Math SEO WordPress plugin before 1.0.219) to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP
when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/c0058fcc-36f6-40bf-9848-fbe2d751d754/
CVE ID: CVE-2024-4629 State: PUBLISHED Published: 2024-09-03T19:42:01.318Z Last Updated: 2025-11-21T06:53:31.008Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Red Hat Products: Red Hat Build of Keycloak, Red Hat build of Keycloak 22, Red Hat Single Sign-On 7, Red Hat Single Sign-On 7.6 for RHEL 7, Red Hat Single Sign-On 7.6 for RHEL 8, Red Hat Single Sign-On 7.6 for RHEL 9, RHEL-8 based Middleware Containers, Red Hat JBoss Enterprise Application Platform 8 Problem Types: CWE-837 Description: A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple
aw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:6493 - https://access.redhat.com/errata/RHSA-2024:6494 - https://access.redhat.com/errata/RHSA-2024:6495 - https://access.redhat.com/errata/RHSA-2024:6497 - https://acc
4:6494 - https://access.redhat.com/errata/RHSA-2024:6495 - https://access.redhat.com/errata/RHSA-2024:6497 - https://access.redhat.com/errata/RHSA-2024:6499 - https://access.redhat.com/errata/RHSA-2024:6500 - https://access.redhat.com/errata/RHSA-2024:6501 - https://access.redhat.com/security/cve/CVE-2024-4629 - https://bugzilla.redhat.com/show_bug.cgi?id=2276761
CVE ID: CVE-2024-4630 State: PUBLISHED Published: 2024-05-11T04:30:18.299Z Last Updated: 2024-08-01T20:47:41.208Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: brainstormforce Products: Starter Templates — Elementor, WordPress & Beaver Builder Templates Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Starter Templates — Elementor, WordPress & Beaver Builder Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘custom_upload_mimes’ function in versions up to, and including, 4.2.0 due to insufficient input sanitization and output escaping. This makes it
nction in versions up to, and including, 4.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/25edb9e8-65ea-41d1-a95f-09be110ec1d2?source=cve - https://plugins.trac.wordpress.org/browser/astra-sites/tags/4.2.0/inc/importers/wxr-importer/class-astra-wxr-importer.php#L416 - https://plugins.trac.wordpress.org/changeset/3084334/
CVE ID: CVE-2024-4631 State: REJECTED Published: N/A Last Updated: 2024-05-10T15:16:06.505Z Description: No description available.
CVE ID: CVE-2024-4632 State: PUBLISHED Published: 2024-06-19T08:33:57.677Z Last Updated: 2024-08-01T20:47:41.429Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: cartflowswp Products: WooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘custom_upload_mimes’ function in versions up to, and including, 2.0.7 due to insuffic
ored Cross-Site Scripting via the ‘custom_upload_mimes’ function in versions up to, and including, 2.0.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e9a89613-cfd9-4a96-b8eb-4b17376be433?source=cve - https://plugins.trac.wordpress.org/browser/cartflows/tags/2.0.7/classes/importer/batch-process/class-cartflows-batch-process.php#L247 - h
rac.wordpress.org/browser/cartflows/tags/2.0.7/classes/importer/batch-process/class-cartflows-batch-process.php#L247 - https://plugins.trac.wordpress.org/changeset/3087760/
CVE ID: CVE-2024-4633 State: PUBLISHED Published: 2024-12-06T13:45:20.274Z Last Updated: 2024-12-06T15:40:46.147Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: averta Products: Slider & Popup Builder by Depicter – Add Image Slider, Carousel Slider, Exit Intent Popup, Popup Modal, Coupon Popup, Post Slider Carousel Problem Types: CWE-79 Description: The Slider and Carousel slider by Depicter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘addExtraMimeType’ function in versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-leve
nsufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/965cacd3-1786-4e7d-8209-eea293b161d3?source=cve - https://plugins.trac.wordpress.org/browser/depicter/tags/2.1.11/app/src/WordPress/SVGServiceProvider.php#L52 - https://plugins.trac.wordpress.org/changeset/3134888/
CVE ID: CVE-2024-4634 State: PUBLISHED Published: 2024-05-16T11:05:29.590Z Last Updated: 2024-08-01T20:47:41.292Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: brainstormforce Products: Elementor Header & Footer Builder Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘hfe_svg_mime_types’ function in versions up to, and including, 1.6.28 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permis
nput sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f44bb823-bbf3-413b-82b5-a351609270bf?source=cve - https://plugins.trac.wordpress.org/browser/header-footer-elementor/tags/1.6.28/inc/widgets-manager/class-widgets-loader.php#L156 - https://plugins.trac.wordpress.org/changeset/3086402/
CVE ID: CVE-2024-4635 State: PUBLISHED Published: 2024-05-16T05:33:27.125Z Last Updated: 2024-08-01T20:47:41.202Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themeisle Products: Menu Icons by ThemeIsle Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Menu Icons by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘add_mime_type’ function in versions up to, and including, 0.13.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level permissions and above, to inject arbitrar
scaping. This makes it possible for authenticated attackers, with author-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/90284576-6570-4e4c-8eb3-743bc402ea1b?source=cve - https://plugins.trac.wordpress.org/browser/menu-icons/tags/0.13.13/vendor/codeinwp/icon-picker/includes/types/svg.php#L69 - https://plugins.trac.wordpress.org/changeset/3086753/
CVE ID: CVE-2024-4636 State: PUBLISHED Published: 2024-05-15T06:51:55.715Z Last Updated: 2024-08-01T20:47:41.559Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: optimole Products: Image Optimization by Optimole – Lazy Load, CDN, Convert WebP & AVIF Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Image Optimization by Optimole – Lazy Load, CDN, Convert WebP & AVIF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘allow_meme_types’ function in versions up to, and including, 3.12.10 due to insufficient input sanitization and output escaping. This makes it possi
n versions up to, and including, 3.12.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/be88566d-fc84-442d-bb34-834ad9f4465b?source=cve - https://plugins.trac.wordpress.org/browser/optimole-wp/tags/3.12.10/inc/admin.php#L1828 - https://plugins.trac.wordpress.org/changeset/3086306/
CVE ID: CVE-2024-4637 State: PUBLISHED Published: 2024-06-04T09:31:47.483Z Last Updated: 2024-08-01T20:47:41.443Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Revolution Slider Products: Slider Revolution Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 6.7.10 due to insufficient input sanitization and output escaping on the user supplied Elementor 'wrapperid' and 'zindex' display attributes. This makes it possible for authenticated attackers, with contributor-l
ntor 'wrapperid' and 'zindex' display attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/457b5066-da37-4877-9abe-c912bc201f29?source=cve - https://www.sliderrevolution.com/documentation/changelog/
CVE ID: CVE-2024-4638 State: PUBLISHED Published: 2024-06-25T08:49:24.910Z Last Updated: 2024-08-01T20:47:41.421Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: Moxa Products: OnCell G3470A-LTE Series Problem Types: CWE-77 Description: OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to a lack of neutralized inputs in the web key upload function. An attacker could modify the intended commands sent to target functions, which could cause malicious users to execute unauthorized commands. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.moxa.com/en/support/produ
nal Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-242550-oncell-g3470a-lte-series-multiple-web-application-vulnerabilities
CVE ID: CVE-2024-4639 State: PUBLISHED Published: 2024-06-25T09:15:03.229Z Last Updated: 2024-08-01T20:47:41.194Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: Moxa Products: OnCell G3150A-LTE Series Problem Types: CWE-77 Description: OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to a lack of neutralized inputs in IPSec configuration. An attacker could modify the intended commands sent to target functions, which could cause malicious users to execute unauthorized commands. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.moxa.com/en/support/product-suppo
yst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-242550-oncell-g3470a-lte-series-multiple-web-application-vulnerabilities
CVE ID: CVE-2024-4640 State: PUBLISHED Published: 2024-06-25T09:19:08.712Z Last Updated: 2024-08-01T20:47:41.484Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: Moxa Products: OnCell G3150A-LTE Series Problem Types: CWE-120 Description: OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to missing bounds checking on buffer operations. An attacker could write past the boundaries of allocated buffer regions in memory, causing a program crash. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-242550-oncell
VE Program Container: References: - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-242550-oncell-g3470a-lte-series-multiple-web-application-vulnerabilities
CVE ID: CVE-2024-4641 State: PUBLISHED Published: 2024-06-25T09:23:30.502Z Last Updated: 2024-08-01T20:47:41.226Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Moxa Products: OnCell G3150A-LTE Series Problem Types: CWE-134 Description: OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to accepting a format string from an external source as an argument. An attacker could modify an externally controlled format string to cause a memory leak and denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.moxa.com/en/support/product-support/security-adv
SA ADP Vulnrichment: - CVE Program Container: References: - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-242550-oncell-g3470a-lte-series-multiple-web-application-vulnerabilities
CVE ID: CVE-2024-4642 State: REJECTED Published: 2024-05-16T09:03:48.575Z Last Updated: 2024-05-20T16:28:53.419Z Description: No description available.
CVE ID: CVE-2024-4643 State: PUBLISHED Published: 2024-08-02T09:29:44.103Z Last Updated: 2024-08-02T14:36:41.187Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bdthemes Products: Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) Problem Types: CWE-79 Description: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘end_redirect_link’ parameter in versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authent
to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0f281ef5-bb2e-42f9-be51-6f7bd3069f59?source=cve - https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/trunk/modules/countdown/widgets/countdown.php#L2501
CVE ID: CVE-2024-4644 State: PUBLISHED Published: 2024-05-08T11:31:03.760Z Last Updated: 2024-08-01T20:47:41.450Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Prison Management System Problem Types: CWE-79 Description: A vulnerability has been found in SourceCodester Prison Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /Employee/changepassword.php. The manipulation of the argument txtold_password/txtnew_password/txtconfirm_password leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerabilit
be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263488. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263488 - https://vuldb.com/?ctiid.263488 - https://vuldb.com/?submit.330021 - https://github.com/yylmm/CVE/blob/main/Prison%20Management%20System/xss3.md
CVE ID: CVE-2024-4645 State: PUBLISHED Published: 2024-05-08T12:31:04.798Z Last Updated: 2024-08-21T21:01:07.948Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Prison Management System Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Prison Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file /Admin/changepassword.php. The manipulation of the argument txtold_password/txtnew_password/txtconfirm_password leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263489 was assigned t