Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-2459 State: PUBLISHED Published: 2024-03-20T06:48:24.250Z Last Updated: 2024-08-02T16:22:12.568Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: wpvncom Products: UX Flat Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The UX Flat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button' shortcode in all versions up to, and including, 4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary
es. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1d93db2c-7baf-42d8-9b4a-be91b27221a7?source=cve - https://wordpress.org/plugins/ux-flat/
CVE ID: CVE-2024-2460 State: PUBLISHED Published: 2024-03-20T02:35:41.153Z Last Updated: 2024-08-05T19:26:58.394Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: rubengc Products: GamiPress – Button Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The GamiPress – Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gamipress_button' shortcode in all versions up to, and including, 1.0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and ab
t escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/af39e563-5d88-460d-b02d-1aaa111c89dd?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3051778%40gamipress-button&new=3051778%40gamipress-button&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2461 State: PUBLISHED Published: 2024-06-11T12:57:04.498Z Last Updated: 2024-08-01T19:11:53.616Z Vendors: Hitachi Energy Products: FOX61x, XMC20 Problem Types: CWE-23 Description: If exploited an attacker could traverse the file system to access files or directories that would otherwise be inaccessible Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://publisher.hitachienergy.com/preview?DocumentId=8DBD000202&languageCode=en&Preview=true
CVE ID: CVE-2024-2462 State: PUBLISHED Published: 2024-06-11T12:48:57.963Z Last Updated: 2024-08-01T19:11:53.576Z Vendors: Hitachi Energy Products: FOXMAN-UN, FOX61x, FOXCST, UNEM, XMC20, ECST Problem Types: CWE-297 Description: Allow attackers to intercept or falsify data exchanges between the client and the server Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://publisher.hitachienergy.com/preview?DocumentId=8DBD000198&languageCode=en&Preview=true
CVE ID: CVE-2024-2463 State: PUBLISHED Published: 2024-03-21T14:50:02.541Z Last Updated: 2024-08-01T21:13:30.394Z Vendors: CDeX PSA Products: CDeX Problem Types: CWE-640 Description: Weak password recovery mechanism in CDeX application allows to retrieve password reset token.This issue affects CDeX application versions through 5.7.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2024/03/CVE-2024-2463/ - https://cert.pl/posts/2024/03/CVE-2024-2463/ - https://cdex.cloud/
CVE ID: CVE-2024-2464 State: PUBLISHED Published: 2024-03-21T14:50:13.935Z Last Updated: 2024-10-30T18:14:24.971Z Vendors: CDeX PSA Products: CDeX Problem Types: CWE-203 Description: This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.This issue affects CDeX application versions through 5.7.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2024/03/CVE-2024-2463/ - https://cert.pl/posts/2024/03/CVE-2024-2463/ - https://cdex.cloud/
CVE ID: CVE-2024-2465 State: PUBLISHED Published: 2024-03-21T14:50:26.900Z Last Updated: 2024-10-31T14:00:42.384Z Vendors: CDeX PSA Products: CDeX Problem Types: CWE-601 Description: Open redirection vulnerability in CDeX application allows to redirect users to arbitrary websites via a specially crafted URL.This issue affects CDeX application versions through 5.7.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2024/03/CVE-2024-2463/ - https://cert.pl/posts/2024/03/CVE-2024-2463/ - https://cdex.cloud/
CVE ID: CVE-2024-2466 State: PUBLISHED Published: 2024-03-27T07:58:24.520Z Last Updated: 2025-02-13T17:40:16.744Z Vendors: curl Products: curl Problem Types: CWE-297 Improper Validation of Certificate with Host Mismatch Description: libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Referenc
S, FTPS, IMAPS, POPS3, SMTPS, etc). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://curl.se/docs/CVE-2024-2466.json - https://curl.se/docs/CVE-2024-2466.html - https://hackerone.com/reports/2416725 - http://www.openwall.com/lists/oss-security/2024/03/27/4 - https://security.netapp.com/advisory/ntap-20240503-0010/ - https://support.apple.com/kb/HT214119 - https://support.apple.com/kb/HT214118 - https://support.apple.com/kb/HT214120 - http://seclists.org/fulldisclosure/2024/Jul/20 - http://seclists.org/fulldisclosure/2024/Jul/18 - http://seclists.org/fulldisclosure/2024/Jul/19
CVE ID: CVE-2024-2467 State: PUBLISHED Published: 2024-04-25T16:45:02.948Z Last Updated: 2025-11-20T18:56:02.243Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-203 Description: A timing-based side-channel flaw exists in the perl-Crypt-OpenSSL-RSA package, which could be sufficient to recover plaintext across a network in a Bleichenbacher-style attack. To achieve successful decryption, an attacker would have to be able to send a large number of trial messages. The vulnerability affects the legacy PKCS#1v1.5 RSA
ker would have to be able to send a large number of trial messages. The vulnerability affects the legacy PKCS#1v1.5 RSA encryption padding mode. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2024-2467 - https://bugzilla.redhat.com/show_bug.cgi?id=2269567 - https://github.com/toddr/Crypt-OpenSSL-RSA/issues/42 - https://people.redhat.com/~hkario/marvin/
CVE ID: CVE-2024-2468 State: PUBLISHED Published: 2024-03-23T02:32:56.446Z Last Updated: 2024-08-01T19:11:53.521Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpdevteam Products: EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the EmbedPress widget
ts in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the EmbedPress widget 'embedpress_pro_twitch_theme ' attribute in all versions up to, and including, 3.9.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ce3f1310-4d2e-45aa-a3ee-3972a6a31c2e?source=cve - https://pl
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ce3f1310-4d2e-45aa-a3ee-3972a6a31c2e?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3055856%40embedpress&new=3055856%40embedpress&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2469 State: PUBLISHED Published: 2024-03-20T22:56:03.451Z Last Updated: 2025-04-10T20:16:44.625Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: GitHub Products: Enterprise Server Problem Types: CWE-20 Description: An attacker with an Administrator role in GitHub Enterprise Server could gain SSH root access via remote code execution. This vulnerability affected GitHub Enterprise Server version 3.8.0 and above and was fixed in version 3.8.17, 3.9.12, 3.10.9, 3.11.7 and 3.12.1. This vulnerability was reported via the GitHub Bug Bounty program. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.gi
ounty program. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.17 - https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.12 - https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.9 - https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.7 - https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.1
CVE ID: CVE-2024-2470 State: PUBLISHED Published: 2024-06-04T06:00:02.220Z Last Updated: 2024-08-01T19:11:53.531Z Vendors: Unknown Products: Simple Ajax Chat Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Simple Ajax Chat WordPress plugin before 20240412 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/8514b8ce-ff23-4aba-b2f1-fd36beb7d2ff/
CVE ID: CVE-2024-2471 State: PUBLISHED Published: 2024-04-06T05:37:15.277Z Last Updated: 2024-08-01T19:11:53.584Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bradvin Products: Best WordPress Gallery Plugin – FooGallery Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image attachment fields (such as 'Title', 'Alt Text', 'Custom URL', 'Custom Class', and 'Override Type') in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for a
ns up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d5d4aeb1-0a4f-49f1-b5a9-b582e271eae1?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3061049%40foogallery&old=3039399%40foogallery&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2472 State: PUBLISHED Published: 2024-06-14T09:36:37.719Z Last Updated: 2024-08-01T19:11:53.521Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: latepoint Products: LatePoint Plugin Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The LatePoint Plugin plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'start_or_use_session_for_customer' function in all versions up to and including 4.9.9. This makes it possible for unauthenticated attackers to view other customer's cabinets, including the ability to view PII such as email add
ble for unauthenticated attackers to view other customer's cabinets, including the ability to view PII such as email addresses and to change their LatePoint user password, which may or may not be associated with a WordPress account. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6215fa9f-06bc-4dc8-b1f5-a3bb75749f1d?source=cve - https://aramhairchitects.nl/ - https://wpdocs.latepoint.com/changelog/
CVE ID: CVE-2024-2473 State: PUBLISHED Published: 2024-06-11T02:01:58.830Z Last Updated: 2024-08-01T19:11:53.674Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: tabrisrp Products: WPS Hide Login Problem Types: CWE-863 Incorrect Authorization Description: The WPS Hide Login plugin for WordPress is vulnerable to Login Page Disclosure in all versions up to, and including, 1.9.15.2. This is due to a bypass that is created when the 'action=postpass' parameter is supplied. This makes it possible for attackers to easily discover any login page that may have been hidden by the plugin. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Refer
at may have been hidden by the plugin. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fd21c7d3-a5f1-4c3a-b6ab-0a979f070a62?source=cve - https://plugins.trac.wordpress.org/changeset/3099109/wps-hide-login
CVE ID: CVE-2024-2474 State: PUBLISHED Published: 2024-03-20T04:32:15.154Z Last Updated: 2024-08-05T15:27:18.457Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: jp2112 Products: Standout Color Boxes and Buttons Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Standout Color Boxes and Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'color-button' shortcode in all versions up to, and including, 0.7.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with c
sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a826dff8-60ae-4e25-9d3e-be93f192aaca?source=cve - https://wordpress.org/plugins/standout-color-boxes-and-buttons/
CVE ID: CVE-2024-2475 State: PUBLISHED Published: 2024-03-29T04:31:33.577Z Last Updated: 2024-08-01T19:11:53.675Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: dglingren Products: Media Library Assistant Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and a
ing on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/63ed73c9-2b61-4811-ba7f-1803982f17bc?source=cve - https://plugins.trac.wordpress.org/browser/media-library-assistant/trunk/includes/class-mla-shortcode-support.php#L1517 - https://plugins.trac.wordpress.org/browser/media-library-assistant/trunk/includes/class-mla-shortcode-support.php#L2166 - https://plugins.trac.wordpress
rg/browser/media-library-assistant/trunk/includes/class-mla-shortcode-support.php#L2166 - https://plugins.trac.wordpress.org/browser/media-library-assistant/trunk/includes/class-mla-shortcode-support.php#L1535
CVE ID: CVE-2024-2476 State: PUBLISHED Published: 2024-03-29T06:44:00.109Z Last Updated: 2025-03-25T14:40:24.079Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: oceanwp Products: OceanWP Problem Types: CWE-862 Missing Authorization Description: The OceanWP theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the load_theme_panel_pane function in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to expose sensitive information such as system/environment data and API keys. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE
itive information such as system/environment data and API keys. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5ec2743d-0d96-4056-8fdf-dc81d4e9b76f?source=cve - https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=222387%40oceanwp&new=222387%40oceanwp&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2477 State: PUBLISHED Published: 2024-04-23T13:50:40.649Z Last Updated: 2024-08-01T19:11:53.534Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: advancedcoding Products: Comments – wpDiscuz Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The wpDiscuz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Alternative Text' field of an uploaded image in all versions up to, and including, 7.6.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arb
d output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3eddc03d-ecff-4b50-a574-7b6b62e53af0?source=cve - https://plugins.trac.wordpress.org/changeset/3060040/wpdiscuz/trunk/utils/class.WpdiscuzHelperUpload.php
CVE ID: CVE-2024-2478 State: PUBLISHED Published: 2024-03-15T05:31:04.776Z Last Updated: 2024-08-02T19:25:22.626Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: BradWenqiang Products: HR Problem Types: CWE-89 Description: A vulnerability was found in BradWenqiang HR 2.0. It has been rated as critical. Affected by this issue is the function selectAll of the file /bishe/register of the component Background Management. The manipulation of the argument userName leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-256886 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early abo
c and may be used. VDB-256886 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.256886 - https://vuldb.com/?ctiid.256886 - https://github.com/zuizui35/cve/blob/main/cve.md
CVE ID: CVE-2024-2479 State: PUBLISHED Published: 2024-03-15T05:31:06.110Z Last Updated: 2024-08-27T19:46:29.372Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: MHA Sistemas Products: arMHAzena Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in MHA Sistemas arMHAzena 9.6.0.0. This affects an unknown part of the component Cadastro Page. The manipulation of the argument Query leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256887. NOTE: The vendor was contacted early about this disclosure but
sociated identifier of this vulnerability is VDB-256887. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.256887 - https://vuldb.com/?ctiid.256887 - https://johnermac.github.io/cve/xss/
CVE ID: CVE-2024-2480 State: PUBLISHED Published: 2024-03-15T06:00:05.377Z Last Updated: 2024-08-02T18:07:10.355Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: MHA Sistemas Products: arMHAzena Problem Types: CWE-89 Description: A vulnerability classified as critical was found in MHA Sistemas arMHAzena 9.6.0.0. This vulnerability affects unknown code of the component Executa Page. The manipulation of the argument Companhia/Planta/Agente de/Agente até leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256888. NOTE: The vendor was contacted early about this disclos
may be used. The identifier of this vulnerability is VDB-256888. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.256888 - https://vuldb.com/?ctiid.256888 - https://johnermac.github.io/cve/sqli/
CVE ID: CVE-2024-2481 State: PUBLISHED Published: 2024-03-15T06:00:06.838Z Last Updated: 2024-08-28T16:27:49.021Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Surya2Developer Products: Hostel Management System Problem Types: CWE-284 Description: A vulnerability, which was classified as critical, was found in Surya2Developer Hostel Management System 1.0. Affected is an unknown function of the file /admin/manage-students.php. The manipulation of the argument del leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-256890 is the identifier assigned to this vulnerabi
y. The exploit has been disclosed to the public and may be used. VDB-256890 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.256890 - https://vuldb.com/?ctiid.256890 - https://github.com/blackslim3/cve_sidequest/blob/main/poc/Broken_Access_Control%20on%20Hostel%20Management%20System%20using%20PHP%20and%20MySQL%201.0.md