Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
s with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/be0c29a3-0b78-4259-a514-c3674d9d5d55?source=cve - https://themeforest.net/item/dwt-listing-directory-listing-wordpress-theme/21976132
CVE ID: CVE-2025-0170 State: PUBLISHED Published: 2025-01-16T01:49:03.466Z Last Updated: 2025-01-16T15:31:37.362Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: scriptsbundle Products: DWT - Directory & Listing WordPress Theme Problem Types: CWE-79 Description: The DWT - Directory & Listing WordPress Theme is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping on the 'sort_by' and 'token' parameters. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an actio
ers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d607e7c0-7812-4c77-a763-6095677b3525?source=cve - https://scriptsbundle.gitbook.io/dwt-directory-and-listing-wordpress-theme
CVE ID: CVE-2025-0171 State: PUBLISHED Published: 2025-01-02T15:00:20.814Z Last Updated: 2025-01-02T17:55:37.665Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Chat System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in code-projects Chat System 1.0. Affected is an unknown function of the file /admin/deleteuser.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289938 - https://vuldb.com/?c
ed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289938 - https://vuldb.com/?ctiid.289938 - https://vuldb.com/?submit.473143 - https://github.com/Sinon2003/cve/blob/main/sql_inject1.md - https://code-projects.org/
CVE ID: CVE-2025-0172 State: PUBLISHED Published: 2025-01-02T15:31:05.818Z Last Updated: 2025-01-02T17:52:15.641Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Chat System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in code-projects Chat System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/deleteroom.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289939 - https
c and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289939 - https://vuldb.com/?ctiid.289939 - https://vuldb.com/?submit.473153 - https://github.com/Sinon2003/cve/blob/main/chatsystem/sql_inject2.md - https://code-projects.org/
CVE ID: CVE-2025-0173 State: PUBLISHED Published: 2025-01-02T17:31:05.618Z Last Updated: 2025-01-02T17:39:56.126Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Eyewear Shop Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in SourceCodester Online Eyewear Shop 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /orders/view_order.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289940
he public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289940 - https://vuldb.com/?ctiid.289940 - https://vuldb.com/?submit.473163 - https://github.com/listlonely/cve/blob/main/sql.md - https://www.sourcecodester.com/
CVE ID: CVE-2025-0174 State: PUBLISHED Published: 2025-01-03T00:31:05.153Z Last Updated: 2025-02-18T21:55:03.173Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Point of Sales and Inventory Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Point of Sales and Inventory Management System 1.0. It has been classified as critical. This affects an unknown part of the file /user/search_result2.php of the component Parameter Handler. The manipulation of the argument search leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Addi
tion. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290103 - https://vuldb.com/?ctiid.290103 - https://vuldb.com/?submit.473330 - https://gist.github.com/Masamuneee/ca3f96ac0ec34bb7c1dd4bfd180f11bb - https://code-projects.org/
CVE ID: CVE-2025-0175 State: PUBLISHED Published: 2025-01-03T01:00:08.536Z Last Updated: 2025-02-18T21:26:20.048Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: code-projects Products: Online Shop Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in code-projects Online Shop 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /view.php. The manipulation of the argument name/details leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290104 - https://vuldb.c
be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290104 - https://vuldb.com/?ctiid.290104 - https://vuldb.com/?submit.473333 - https://gist.github.com/th4s1s/fc65dafa7237cc66a18ef6005075c31b - https://code-projects.org/
CVE ID: CVE-2025-0176 State: PUBLISHED Published: 2025-01-03T02:00:22.098Z Last Updated: 2025-01-03T14:33:15.223Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Point of Sales and Inventory Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Point of Sales and Inventory Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /user/add_cart.php. The manipulation of the argument id/qty leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichm
d remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290105 - https://vuldb.com/?ctiid.290105 - https://vuldb.com/?submit.473347 - https://gist.github.com/Masamuneee/9c539b89dad40033a5037b744e394ae0 - https://code-projects.org/
CVE ID: CVE-2025-0177 State: PUBLISHED Published: 2025-03-08T08:22:57.176Z Last Updated: 2025-03-10T15:55:37.070Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: javothemes Products: Javo Core Problem Types: CWE-269 Description: The Javo Core plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.0.0.080. This is due to the plugin allowing users who are registering new accounts to set their own role. This makes it possible for unauthenticated attackers to gain elevated privileges by creating an account with the administrator role. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfe
account with the administrator role. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7d636768-37b4-4343-9028-30e7b1f997f2?source=cve - https://themeforest.net/item/javo-directory-wordpress-theme/8390513#item-description__update-history
CVE ID: CVE-2025-0178 State: PUBLISHED Published: 2025-02-14T13:22:22.237Z Last Updated: 2025-02-14T14:01:35.532Z Vendors: WatchGuard Products: Fireware OS Problem Types: CWE-20 Description: Improper Input Validation vulnerability in WatchGuard Fireware OS allows an attacker to manipulate the value of the HTTP Host header in requests sent to the Web UI. An attacker could exploit this vulnerability to redirect users to malicious websites, poison the web cache, or inject malicious JavaScript into responses sent by the Web UI. This issue affects Fireware OS: from 12.0 up to and including 12.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.watchguard.com/wgrd-psir
d including 12.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00003
CVE ID: CVE-2025-0180 State: PUBLISHED Published: 2025-02-11T06:54:33.911Z Last Updated: 2025-02-11T15:28:13.763Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Chimpstudio Products: WP Foodbakery Problem Types: CWE-269 Description: The WP Foodbakery plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.3. This is due to the plugin not properly restricting what user meta can be updated during profile registration. This makes it possible for unauthenticated attackers to register on the site as an administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-inte
an administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d7140a6e-a528-428e-850e-5e4a481c5d7d?source=cve - https://themeforest.net/item/food-bakery-restaurant-bakery-responsive-wordpress-theme/18970331
CVE ID: CVE-2025-0181 State: PUBLISHED Published: 2025-02-11T06:54:34.607Z Last Updated: 2025-02-11T15:27:43.777Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Chimpstudio Products: WP Foodbakery Problem Types: CWE-288 Description: The WP Foodbakery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.7. This is due to the plugin not properly validating a user's identity prior to setting the current user and their authentication cookie. This makes it possible for unauthenticated attackers to gain access to a target user's (e.g. administrators) account. Additional Analyst Notes: - CISA ADP
nticated attackers to gain access to a target user's (e.g. administrators) account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d722ec8d-bfca-4da1-8eb0-8d33735c5e44?source=cve - https://themeforest.net/item/food-bakery-restaurant-bakery-responsive-wordpress-theme/18970331
CVE ID: CVE-2025-0182 State: PUBLISHED Published: 2025-03-20T10:10:00.892Z Last Updated: 2025-10-15T12:50:03.590Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: danswer-ai Products: danswer-ai/danswer Problem Types: CWE-770 Description: A vulnerability in danswer-ai/danswer version 0.9.0 allows for denial of service through memory exhaustion. The issue arises from the use of a vulnerable version of the starlette package (<=0.49) via fastapi, which was patched in fastapi version 0.115.3. The vulnerability can be exploited by sending multiple requests to the /auth/saml/callback endpoint, leading to uncontrolled memory consumption and eventual denial of service.
requests to the /auth/saml/callback endpoint, leading to uncontrolled memory consumption and eventual denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/969b8056-b66c-4d70-8f77-04c1cbdc1d1a
CVE ID: CVE-2025-0183 State: PUBLISHED Published: 2025-03-20T10:10:24.705Z Last Updated: 2025-03-20T18:21:58.409Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: binary-husky Products: binary-husky/gpt_academic Problem Types: CWE-79 Description: A stored cross-site scripting (XSS) vulnerability exists in the Latex Proof-Reading Module of binary-husky/gpt_academic version 3.9.0. This vulnerability allows an attacker to inject malicious scripts into the `debug_log.html` file generated by the module. When an admin visits this debug report, the injected scripts can execute, potentially leading to unauthorized actions and data access. Additional Analyst Notes: -
injected scripts can execute, potentially leading to unauthorized actions and data access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/53bced90-64a9-4ca2-8f2f-282c4ce84d1f
CVE ID: CVE-2025-0184 State: PUBLISHED Published: 2025-03-20T10:11:38.385Z Last Updated: 2025-03-20T18:05:10.075Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: langgenius Products: langgenius/dify Problem Types: CWE-918 Description: A Server-Side Request Forgery (SSRF) vulnerability was identified in langgenius/dify version 0.10.2. The vulnerability occurs in the 'Create Knowledge' section when uploading DOCX files. If an external relationship exists in the DOCX file, the reltype value is requested as a URL using the 'requests' module instead of the 'ssrf_proxy', leading to an SSRF vulnerability. This issue was fixed in version 0.11.0. Additional Analyst N
tead of the 'ssrf_proxy', leading to an SSRF vulnerability. This issue was fixed in version 0.11.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/a7eac4ae-5d5e-4ac1-894b-7a8cce5cba9b - https://github.com/langgenius/dify/commit/c135ec4b08d946a1a1d3a198a1d72c1ccf47250f
CVE ID: CVE-2025-0185 State: PUBLISHED Published: 2025-03-20T10:09:11.882Z Last Updated: 2025-03-20T14:24:59.572Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: langgenius Products: langgenius/dify Problem Types: CWE-94 Description: A vulnerability in the Dify Tools' Vanna module of the langgenius/dify repository allows for a Pandas Query Injection in the latest version. The vulnerability occurs in the function `vn.get_training_plan_generic(df_information_schema)`, which does not properly sanitize user inputs before executing queries using the Pandas library. This can potentially lead to Remote Code Execution (RCE) if exploited. Additional Analyst Notes: - CI
he Pandas library. This can potentially lead to Remote Code Execution (RCE) if exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/7d9eb9b2-7b86-45ed-89bd-276c1350db7e
CVE ID: CVE-2025-0187 State: PUBLISHED Published: 2025-03-20T10:10:42.759Z Last Updated: 2025-03-20T18:17:54.814Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: gradio-app Products: gradio-app/gradio Problem Types: CWE-400 Description: A Denial of Service (DoS) vulnerability was discovered in the file upload feature of gradio-app/gradio version 0.39.1. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. By sending a payload with an excessively large filename, the server becomes overwhelmed and unresponsive, leading to unavailability for legitimate users. Additional Analyst Notes: - CISA ADP Vulnrichment
lmed and unresponsive, leading to unavailability for legitimate users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/77f3ed54-9e1c-4d9f-948f-ee6f82e2fe24
CVE ID: CVE-2025-0188 State: PUBLISHED Published: 2025-03-20T10:09:09.391Z Last Updated: 2025-10-15T12:50:48.138Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: gaizhenbiao Products: gaizhenbiao/chuanhuchatgpt Problem Types: CWE-918 Description: A Server-Side Request Forgery (SSRF) vulnerability was discovered in gaizhenbiao/chuanhuchatgpt version 20240914. The vulnerability allows an attacker to construct a response link by saving the response in a folder named after the SHA-1 hash of the target URL. This enables the attacker to access the response directly, potentially leading to unauthorized access to internal systems, data theft, service disruption, or
e response directly, potentially leading to unauthorized access to internal systems, data theft, service disruption, or further attacks such as port scanning and accessing metadata endpoints. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/879d2470-eca5-49c0-b3d1-57469cfff412
CVE ID: CVE-2025-0189 State: PUBLISHED Published: 2025-03-20T10:10:54.858Z Last Updated: 2025-10-15T12:50:04.149Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: aimhubio Products: aimhubio/aim Problem Types: CWE-770 Description: In version 3.25.0 of aimhubio/aim, the tracking server is vulnerable to a denial of service attack. The server overrides the maximum size for websocket messages, allowing very large images to be tracked. This causes the server to become unresponsive to other requests while processing the large image, leading to a denial of service condition. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/e4
ial of service condition. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/e4c9bf41-72cf-4d04-baaf-8f12b5b7926e
CVE ID: CVE-2025-0190 State: PUBLISHED Published: 2025-03-20T10:08:48.087Z Last Updated: 2025-03-20T19:03:20.216Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: aimhubio Products: aimhubio/aim Problem Types: CWE-1049 Description: In version 3.25.0 of aimhubio/aim, a denial of service vulnerability exists. By tracking a large number of `Text` objects and then querying them simultaneously through the web API, the Aim web server becomes unresponsive to other requests for an extended period while processing and returning these objects. This vulnerability can be exploited repeatedly, leading to a complete denial of service. Additional Analyst Notes: - CISA ADP Vul
erability can be exploited repeatedly, leading to a complete denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/38d151f1-abb4-443a-86b0-6c26f0c6cb70
CVE ID: CVE-2025-0191 State: PUBLISHED Published: 2025-03-20T10:10:46.084Z Last Updated: 2025-03-20T18:17:02.569Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: gaizhenbiao Products: gaizhenbiao/chuanhuchatgpt Problem Types: CWE-400 Description: A Denial of Service (DoS) vulnerability exists in the file upload feature of gaizhenbiao/chuanhuchatgpt version 20240914. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. By sending a payload with an excessively large filename, the server becomes overwhelmed and unresponsive, leading to unavailability for legitimate users. Additional Analyst Notes: - CISA A
becomes overwhelmed and unresponsive, leading to unavailability for legitimate users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/c89a1dfd-a733-41b3-af20-6ef6024361eb
CVE ID: CVE-2025-0192 State: PUBLISHED Published: 2025-03-20T10:10:22.264Z Last Updated: 2025-03-20T18:22:32.167Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: wandb Products: wandb/openui Problem Types: CWE-79 Description: A stored Cross-site Scripting (XSS) vulnerability exists in the latest version of wandb/openui. The vulnerability is present in the edit HTML functionality, where an attacker can inject malicious scripts. When the modified HTML is shared with another user, the XSS payload executes, potentially leading to the theft of user prompt history and other sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
ser prompt history and other sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/5f82c722-b674-456a-8691-a6565bf90e39
CVE ID: CVE-2025-0193 State: PUBLISHED Published: 2025-01-15T11:05:11.594Z Last Updated: 2025-01-15T14:35:22.364Z Vendors: Moxa Products: MGate 5121 Series, MGate 5122 Series, MGate 5123 Series Problem Types: CWE-79 Description: A stored Cross-site Scripting (XSS) vulnerability exists in the MGate 5121/5122/5123 Series firmware version v1.0 because of insufficient sanitization and encoding of user input in the "Login Message" functionality. An authenticated attacker with administrative access can exploit this vulnerability to inject malicious scripts that are continuously stored on the device. These scripts are executed when other users access the login page, potentially resulting in unautho
tored on the device. These scripts are executed when other users access the login page, potentially resulting in unauthorized actions or other impacts, depending on the user's privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-247733-cve-2025-0193-stored-cross-site-scripting-(xss)-vulnerability-in-the-mgate-5121-5122-5123-series
CVE ID: CVE-2025-0194 State: PUBLISHED Published: 2025-01-08T20:02:01.498Z Last Updated: 2025-01-09T06:35:12.315Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-538 Description: An issue was discovered in GitLab CE/EE affecting all versions starting from 17.4 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. Under certain conditions, access tokens may have been logged when API requests were made in a specific manner. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/489459 - https://about.gitlab.com/releases/2025
ulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/489459 - https://about.gitlab.com/releases/2025/01/08/patch-release-gitlab-17-7-1-released/#possible-access-token-exposure-in-gitlab-logs
CVE ID: CVE-2025-0195 State: PUBLISHED Published: 2025-01-03T18:00:14.784Z Last Updated: 2025-01-03T18:33:48.701Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Point of Sales and Inventory Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Point of Sales and Inventory Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /user/del_product.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP V
launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290132 - https://vuldb.com/?ctiid.290132 - https://vuldb.com/?submit.473349 - https://gist.github.com/Masamuneee/1ac717728823d58ef365a418c8f39810 - https://code-projects.org/