Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-11651 State: PUBLISHED Published: 2024-11-25T02:31:24.797Z Last Updated: 2024-11-25T20:14:34.678Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: EnGenius Products: ENH1350EXT, ENS500-AC, ENS620EXT Problem Types: CWE-77, CWE-74 Description: A vulnerability was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. It has been classified as critical. Affected is an unknown function of the file /admin/network/wifi_schedule. The manipulation of the argument wifi_schedule_day_em_5 leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about
the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.285972 - https://vuldb.com/?ctiid.285972 - https://vuldb.com/?submit.446623 - https://k9u7kv33ub.feishu.cn/wiki/XIepwv7goiCcYxk5QAgc8Q2LnMc?from=from_copylink
CVE ID: CVE-2024-11652 State: PUBLISHED Published: 2024-11-25T03:00:34.348Z Last Updated: 2024-11-25T20:13:27.837Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: EnGenius Products: ENH1350EXT, ENS500-AC, ENS620EXT Problem Types: CWE-77, CWE-74 Description: A vulnerability was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/sn_package/sn_https. The manipulation of the argument https_enable leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early ab
an be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.285973 - https://vuldb.com/?ctiid.285973 - https://vuldb.com/?submit.446629 - https://k9u7kv33ub.feishu.cn/wiki/Rf7wwXMpQiJkp8kp4pmcZb2tnPe
CVE ID: CVE-2024-11653 State: PUBLISHED Published: 2024-11-25T03:31:30.271Z Last Updated: 2024-11-26T15:51:27.284Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: EnGenius Products: ENH1350EXT, ENS500-AC, ENS620EXT Problem Types: CWE-77, CWE-74 Description: A vulnerability was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/network/diag_traceroute. The manipulation of the argument diag_traceroute leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early abou
be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.285974 - https://vuldb.com/?ctiid.285974 - https://vuldb.com/?submit.446633 - https://k9u7kv33ub.feishu.cn/wiki/AHPnwdCaoiaQ3fkrdeUcqPfLnEd
CVE ID: CVE-2024-11654 State: PUBLISHED Published: 2024-11-25T04:00:27.286Z Last Updated: 2024-11-26T15:48:44.903Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: EnGenius Products: ENH1350EXT, ENS500-AC, ENS620EXT Problem Types: CWE-77, CWE-74 Description: A vulnerability classified as critical has been found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. This affects an unknown part of the file /admin/network/diag_traceroute6. The manipulation of the argument diag_traceroute6 leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclos
emotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.285975 - https://vuldb.com/?ctiid.285975 - https://vuldb.com/?submit.446637 - https://k9u7kv33ub.feishu.cn/wiki/YrKfwHqLjijPeYkMTQfcdhrBnyg?from=from_copylink
CVE ID: CVE-2024-11655 State: PUBLISHED Published: 2024-11-25T04:31:23.693Z Last Updated: 2024-11-26T15:46:43.301Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: EnGenius Products: ENH1350EXT, ENS500-AC, ENS620EXT Problem Types: CWE-77, CWE-74 Description: A vulnerability classified as critical was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. This vulnerability affects unknown code of the file /admin/network/diag_pinginterface. The manipulation of the argument diag_ping leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but d
The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.285976 - https://vuldb.com/?ctiid.285976 - https://vuldb.com/?submit.446638 - https://k9u7kv33ub.feishu.cn/wiki/PpM6w3TF8ilK3Ek5RLqcLPUrn6c
CVE ID: CVE-2024-11656 State: PUBLISHED Published: 2024-11-25T05:00:28.655Z Last Updated: 2024-11-26T15:45:02.709Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: EnGenius Products: ENH1350EXT, ENS500-AC, ENS620EXT Problem Types: CWE-77, CWE-74 Description: A vulnerability, which was classified as critical, has been found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. This issue affects some unknown processing of the file /admin/network/diag_ping6. The manipulation of the argument diag_ping6 leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this dis
ed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.285977 - https://vuldb.com/?ctiid.285977 - https://vuldb.com/?submit.446639 - https://k9u7kv33ub.feishu.cn/wiki/FBJCwjFPZiY4aakElh6cwF25nff
CVE ID: CVE-2024-11657 State: PUBLISHED Published: 2024-11-25T05:31:25.482Z Last Updated: 2024-11-26T15:25:02.758Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: EnGenius Products: ENH1350EXT, ENS500-AC, ENS620EXT Problem Types: CWE-77, CWE-74 Description: A vulnerability, which was classified as critical, was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. Affected is an unknown function of the file /admin/network/diag_nslookup. The manipulation of the argument diag_nslookup leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this discl
remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.285978 - https://vuldb.com/?ctiid.285978 - https://vuldb.com/?submit.446640 - https://k9u7kv33ub.feishu.cn/wiki/RURswTkepiuKCzkGMd2cA1M2nNc
CVE ID: CVE-2024-11658 State: PUBLISHED Published: 2024-11-25T06:00:26.332Z Last Updated: 2024-11-26T15:51:23.057Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: EnGenius Products: ENH1350EXT, ENS500-AC, ENS620EXT Problem Types: CWE-77, CWE-74 Description: A vulnerability has been found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/network/ajax_getChannelList. The manipulation of the argument countryCode leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted ear
ack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.285979 - https://vuldb.com/?ctiid.285979 - https://vuldb.com/?submit.446641 - https://k9u7kv33ub.feishu.cn/wiki/VyKHwBhydiyeuDkATo9cFZTDnHb
CVE ID: CVE-2024-11659 State: PUBLISHED Published: 2024-11-25T06:31:24.416Z Last Updated: 2024-11-25T21:02:10.204Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: EnGenius Products: ENH1350EXT, ENS500-AC, ENS620EXT Problem Types: CWE-77, CWE-74 Description: A vulnerability was found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/network/diag_iperf. The manipulation of the argument iperf leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure b
ly. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.285980 - https://vuldb.com/?ctiid.285980 - https://vuldb.com/?submit.446642 - https://k9u7kv33ub.feishu.cn/wiki/OhR6w0THjiFeV1kSfZncaCxTn7f?from=from_copylink
CVE ID: CVE-2024-11660 State: PUBLISHED Published: 2024-11-25T07:00:18.844Z Last Updated: 2024-11-25T20:59:37.334Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: code-projects Products: Farmacia Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in code-projects Farmacia 1.0. It has been classified as problematic. This affects an unknown part of the file usuario.php. The manipulation of the argument name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuld
ther parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.285981 - https://vuldb.com/?ctiid.285981 - https://vuldb.com/?submit.446925 - https://github.com/evo-ose/cve/blob/main/xss9.md - https://code-projects.org/
CVE ID: CVE-2024-11661 State: PUBLISHED Published: 2024-11-25T07:31:04.446Z Last Updated: 2024-11-25T15:56:19.755Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Codezips Products: Free Exam Hall Seating Management System Problem Types: CWE-434, CWE-284 Description: A vulnerability was found in Codezips Free Exam Hall Seating Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file profile.php of the component Profile Image Handler. The manipulation of the argument image leads to unrestricted upload. The attack can be initiated remotely. The researcher submit confuses the vulnerability class of this iss
tricted upload. The attack can be initiated remotely. The researcher submit confuses the vulnerability class of this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.285982 - https://vuldb.com/?ctiid.285982 - https://vuldb.com/?submit.447115 - https://github.com/anqi12301/CVE/issues/1
CVE ID: CVE-2024-11662 State: PUBLISHED Published: 2024-11-25T08:00:12.726Z Last Updated: 2024-11-26T15:32:45.235Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: welliamcao Products: OpsManage Problem Types: CWE-502, CWE-20 Description: A vulnerability was found in welliamcao OpsManage 3.0.1/3.0.2/3.0.3/3.0.4/3.0.5. It has been rated as critical. This issue affects the function deploy_host_vars of the file /apps/api/views/deploy_api.py of the component API Endpoint. The manipulation leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond
s been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.285983 - https://vuldb.com/?ctiid.285983 - https://vuldb.com/?submit.447290 - https://github.com/Sp1d3rL1/OpsManage_RCE - https://github.com/Sp1d3rL1/OpsManage_RCE/blob/main/OpsManage%20RCE.md
CVE ID: CVE-2024-11663 State: PUBLISHED Published: 2024-11-25T08:31:04.498Z Last Updated: 2024-11-26T15:29:37.830Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Codezips Products: E-Commerce Site Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in Codezips E-Commerce Site 1.0. Affected by this vulnerability is an unknown functionality of the file search.php. The manipulation of the argument keywords leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.285985 - https://vuldb.com/?c
ed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.285985 - https://vuldb.com/?ctiid.285985 - https://vuldb.com/?submit.447297 - https://github.com/disinroot/CVE/issues/1
CVE ID: CVE-2024-11664 State: PUBLISHED Published: 2024-11-25T09:00:16.439Z Last Updated: 2024-11-26T15:27:19.624Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: n/a Products: eNMS Problem Types: CWE-22 Description: A vulnerability, which was classified as critical, has been found in eNMS up to 4.2. Affected by this issue is the function multiselect_filtering of the file eNMS/controller.py of the component TGZ File Handler. The manipulation leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The patch is identified as 22b0b443acca740fc83b5544165c1f53eff3f529. It is recommended to apply a patch to fix this iss
The patch is identified as 22b0b443acca740fc83b5544165c1f53eff3f529. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.285986 - https://vuldb.com/?ctiid.285986 - https://vuldb.com/?submit.447374 - https://github.com/eNMS-automation/eNMS/pull/419 - https://github.com/eNMS-automation/eNMS/pull/419#issuecomment-2495640750 - https://mega.nz/folder/ZhIiDQaI#TUJCRV-XN41L-WEVAu0sWg - https://github.com/eNMS-automation/eNMS/pull/419/commits/22b0b443acca740fc83b5544165c1f53eff3f529 - https://www.youtube.com/watch?v=FJVFtNb4_qA
CVE ID: CVE-2024-11665 State: PUBLISHED Published: 2024-11-24T22:32:43.427Z Last Updated: 2024-11-25T01:30:24.409Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: hardy-barth Products: cph2_echarge_firmware Problem Types: CWE-77 Description: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in hardy-barth cph2_echarge_firmware allows OS Command Injection.This issue affects cph2_echarge_firmware: through 2.0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.onekey.com/resource/critical-vulnerabilities-in-ev-charging-stations-analysis-of-echarge-controllers
CVE ID: CVE-2024-11666 State: PUBLISHED Published: 2024-11-24T22:36:59.989Z Last Updated: 2024-11-25T01:28:57.027Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: hardy-barth Products: cph2_echarge_firmware Problem Types: CWE-345 Description: Affected devices beacon to eCharge cloud infrastructure asking if there are any command they should run. This communication is established over an insecure channel since peer verification is disabled everywhere. Therefore, remote unauthenticated users suitably positioned on the network between an EV charger controller and eCharge infrastructure can execute arbitrary commands with elevated privileges on affected devices.
arger controller and eCharge infrastructure can execute arbitrary commands with elevated privileges on affected devices. This issue affects cph2_echarge_firmware: through 2.0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.onekey.com/resource/critical-vulnerabilities-in-ev-charging-stations-analysis-of-echarge-controllers
CVE ID: CVE-2024-11667 State: PUBLISHED Published: 2024-11-27T09:39:41.691Z Last Updated: 2025-10-21T22:55:34.999Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Zyxel Products: ATP series firmware, USG FLEX series firmware, USG FLEX 50(W) series firmware, USG20(W)-VPN series firmware Problem Types: CWE-22 Description: A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.10 through V5.38, and USG20(W)-VPN series firmware versions V5.10 through V5.38 could allow an attacker to download or up
0 through V5.38, and USG20(W)-VPN series firmware versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-protecting-against-recent-firewall-threats-11-27-2024
CVE ID: CVE-2024-11668 State: PUBLISHED Published: 2024-11-26T18:30:45.846Z Last Updated: 2024-11-26T18:42:38.028Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-613 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 16.11 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. Long-lived connections could potentially bypass authentication controls, allowing unauthorized access to streaming results. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/456922
CVE ID: CVE-2024-11669 State: PUBLISHED Published: 2024-11-26T18:41:09.488Z Last Updated: 2024-11-30T04:55:54.926Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-863 Description: An issue was discovered in GitLab CE/EE affecting all versions from 16.9.8 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. Certain API endpoints could potentially allow unauthorized access to sensitive data due to overly broad application of token scopes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/501528
CVE ID: CVE-2024-11670 State: PUBLISHED Published: 2024-11-25T14:46:58.455Z Last Updated: 2024-11-25T15:50:11.300Z Vendors: Devolutions Products: Remote Desktop Manager Problem Types: CWE-863 Description: Incorrect authorization in the permission validation component of Devolutions Remote Desktop Manager 2024.2.21 and earlier on Windows allows a malicious authenticated user to bypass the "View Password" permission via specific actions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2024-0015
CVE ID: CVE-2024-11671 State: PUBLISHED Published: 2024-11-25T14:46:42.687Z Last Updated: 2024-11-25T16:47:10.705Z Vendors: Devolutions Products: Remote Desktop Manager Problem Types: CWE-287 Description: Improper authentication in SQL data source MFA validation in Devolutions Remote Desktop Manager 2024.3.17 and earlier on Windows allows an authenticated user to bypass the MFA validation via data source switching. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2024-0016
CVE ID: CVE-2024-11672 State: PUBLISHED Published: 2024-11-25T14:46:20.186Z Last Updated: 2024-11-25T16:47:53.171Z Vendors: Devolutions Products: Remote Desktop Manager Problem Types: CWE-863 Description: Incorrect authorization in the add permission component in Devolutions Remote Desktop Manager 2024.2.21 and earlier on Windows allows an authenticated malicious user to bypass the "Add" permission via the import in vault feature. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2024-0016
CVE ID: CVE-2024-11673 State: PUBLISHED Published: 2024-11-25T23:00:14.123Z Last Updated: 2024-11-26T15:21:45.286Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: 1000 Projects Products: Bookstore Management System Problem Types: CWE-352, CWE-862 Description: A vulnerability, which was classified as problematic, has been found in 1000 Projects Bookstore Management System 1.0. This issue affects some unknown processing. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286013 - https://vuldb.co
e used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286013 - https://vuldb.com/?ctiid.286013 - https://vuldb.com/?submit.448470 - https://github.com/Hacker0xone/CVE/issues/16 - https://1000projects.org/
CVE ID: CVE-2024-11674 State: PUBLISHED Published: 2024-11-25T23:31:05.332Z Last Updated: 2024-11-26T15:35:38.853Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: CodeAstro Products: Hospital Management System Problem Types: CWE-434, CWE-284 Description: A vulnerability, which was classified as critical, was found in CodeAstro Hospital Management System 1.0. Affected is an unknown function of the file /backend/doc/his_doc_update-account.php. The manipulation of the argument doc_dpic leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References
exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286014 - https://vuldb.com/?ctiid.286014 - https://vuldb.com/?submit.448705 - https://github.com/EmilGallajov/zero-day/blob/main/codeastro_hms_rce.md - https://codeastro.com/
CVE ID: CVE-2024-11675 State: PUBLISHED Published: 2024-11-26T00:00:14.822Z Last Updated: 2024-11-26T15:33:47.856Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: CodeAstro Products: Hospital Management System Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in CodeAstro Hospital Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /backend/admin/his_admin_register_patient.php of the component Add Patient Details Page. The manipulation of the argument pat_fname/pat_ailment/pat_lname/pat_age/pat_dob/pat_number/pat_phone/pat_type/pat_addr leads to cross site scripting. The attack can be l
ment/pat_lname/pat_age/pat_dob/pat_number/pat_phone/pat_type/pat_addr leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286015 - https://vuldb.com/?ctiid.286015 - https://github.com/EmilGallajov/zero-day/blob/main/codeastro_hms_stored_xss.md - https://www.youtube.com/watch?v=UsScmd8Xzuw - https://codeastro.com/