Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-28269 State: PUBLISHED Published: 2024-04-30T00:00:00 Last Updated: 2024-08-02T00:48:49.763Z Vendors: n/a Products: n/a Problem Types: n/a Description: ReCrystallize Server 5.10.0.0 allows administrators to upload files to the server. The file upload is not restricted, leading to the ability to upload of malicious files. This could result in a Remote Code Execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.recrystallize.com/merchant/ReCrystallize-Server-for-Crysta - https://sensepost.com/blog/2024/from-discovery-to-disclosure-recrystallize-server-vulnerabilities/
CVE ID: CVE-2024-28270 State: PUBLISHED Published: 2024-04-08T00:00:00 Last Updated: 2024-08-02T00:48:49.707Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue discovered in web-flash v3.0 allows attackers to reset passwords for arbitrary users via crafted POST request to /prod-api/user/resetPassword. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/bcvgh/web-flash-Broken-Access-Control-vulnerability/
CVE ID: CVE-2024-28275 State: PUBLISHED Published: 2024-04-03T00:00:00 Last Updated: 2024-08-02T00:48:49.669Z Vendors: n/a Products: n/a Problem Types: n/a Description: Puwell Cloud Tech Co, Ltd 360Eyes Pro v3.9.5.16(3090516) was discovered to transmit sensitive information in cleartext. This vulnerability allows attackers to intercept and access sensitive information, including users' credentials and password change requests. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://paste.sr.ht/~edaigle/0b4a037fbd3166c8c72fee18efaa7decaf75b0ab - https://paste.sr.ht/~edaigle/c9637d682b65e6501efb1324bba7787a2f775ff4
CVE ID: CVE-2024-28276 State: PUBLISHED Published: 2024-05-13T19:57:05.257Z Last Updated: 2025-02-13T15:47:34.695Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester School Task Manager 1.0 is vulnerable to Cross Site Scripting (XSS) via add-task.php?task_name=. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/download-code?nid=16877&title=School+Task+Manager+Using+PHP+with+Source+Code - https://github.com/unrealjbr/CVE-2024-28276
CVE ID: CVE-2024-28277 State: PUBLISHED Published: 2024-05-13T19:51:05.163Z Last Updated: 2025-03-27T19:51:30.129Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Sourcecodester School Task Manager v1.0, a vulnerability was identified within the subject_name= parameter, enabling Stored Cross-Site Scripting (XSS) attacks. This vulnerability allows attackers to manipulate the subject's name, potentially leading to the execution of malicious JavaScript payloads. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.sourcecodester.com/download-code?nid=16877&title=School+Task+Manager+Using+PHP+with+Source+Code - https://github.com/unr
sourcecodester.com/download-code?nid=16877&title=School+Task+Manager+Using+PHP+with+Source+Code - https://github.com/unrealjbr/CVE-2024-28277
CVE ID: CVE-2024-28279 State: PUBLISHED Published: 2024-05-13T19:54:12.353Z Last Updated: 2025-02-13T15:47:35.771Z Vendors: n/a Products: n/a Problem Types: n/a Description: Code-projects Computer Book Store 1.0 is vulnerable to SQL Injection via book.php?bookisbn=. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://code-projects.org/computer-book-store-in-php-with-source-code/ - https://github.com/unrealjbr/CVE-2024-28279
CVE ID: CVE-2024-28283 State: PUBLISHED Published: 2024-03-19T00:00:00 Last Updated: 2024-08-06T15:26:51.258Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is stack-based buffer overflow vulnerability in pc_change_act function in Linksys E1000 router firmware version v.2.1.03 and before, leading to remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://d05004.notion.site/Linksys-E1000-BOF-37b98eec45ea4fc991b9b5bea3db091d?pvs=4
CVE ID: CVE-2024-28285 State: PUBLISHED Published: 2024-05-13T19:07:16.320Z Last Updated: 2025-02-13T15:47:36.779Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Fault Injection vulnerability in the SymmetricDecrypt function in cryptopp/elgamal.h of Cryptopp Crypto++ 8.9, allows an attacker to co-reside in the same system with a victim process to disclose information and escalate privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/liang-junkai/3e91f58070812ea76c1b8c126c3e28c7
CVE ID: CVE-2024-28286 State: PUBLISHED Published: 2024-03-20T00:00:00 Last Updated: 2024-08-05T18:27:51.310Z Vendors: n/a Products: n/a Problem Types: n/a Description: In mz-automation libiec61850 v1.4.0, a NULL Pointer Dereference was detected in the mmsServer_handleFileCloseRequest.c function of src/mms/iso_mms/server/mms_file_service.c. The vulnerability manifests as SEGV and causes the application to crash Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mz-automation/libiec61850/issues/496
CVE ID: CVE-2024-28287 State: PUBLISHED Published: 2024-04-02T00:00:00 Last Updated: 2024-08-27T19:45:51.547Z Vendors: n/a Products: n/a Problem Types: n/a Description: A DOM-based open redirection in the returnUrl parameter of INSTINCT UI Web Client 6.5.0 allows attackers to redirect users to malicious sites via a crafted URL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://medium.com/%40rajput.thakur/dom-based-malicious-redirection-cve-2024-28287-304ac8e7f992
CVE ID: CVE-2024-28288 State: PUBLISHED Published: 2024-03-30T00:00:00 Last Updated: 2024-11-04T14:13:51.015Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ruijie RG-NBR700GW 10.3(4b12) router lacks cookie verification when resetting the password, resulting in an administrator password reset vulnerability. An attacker can use this vulnerability to log in to the device and disrupt the business of the enterprise. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://pan.baidu.com/s/1H4J_eA6wSCnDEsUSAWIzsg?pwd=CVE1 - https://github.com/adminquit/CVE-2024-28288/blob/d8223c6d45af877669c27fa0a95adfe51924fa86/CVE-2024-28288/CVE-2024-28288.md
CVE ID: CVE-2024-28294 State: PUBLISHED Published: 2024-04-29T00:00:00 Last Updated: 2024-08-27T14:21:41.986Z Vendors: n/a Products: n/a Problem Types: n/a Description: Limbas up to v5.2.14 was discovered to contain a SQL injection vulnerability via the ftid parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/lx39214/248dc58c6d05455d4bd06c4d3df8e2d0
CVE ID: CVE-2024-28297 State: PUBLISHED Published: 2024-08-02T00:00:00 Last Updated: 2024-08-03T19:12:57.736Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in AzureSoft MyHorus 4.3.5 allows authenticated users to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.azursoft.com/ - https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2024-28297_MYHorus%28AzureSoft%29_Pre-Authenticated%20SQLI.pdf
CVE ID: CVE-2024-28298 State: PUBLISHED Published: 2024-08-02T00:00:00 Last Updated: 2024-08-23T15:36:43.809Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in BM SOFT BMPlanning 1.0.0.1 allows authenticated users to execute arbitrary SQL commands via the SEC_IDF, LIE_IDF, PLANF_IDF, CLI_IDF, DOS_IDF, and possibly other parameters to /BMServerR.dll/BMRest. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.e-bmsoft.com/ - https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2024-28298_BMPlanning%28BM-Soft%29_Authenticated%20SQLI.pdf
CVE ID: CVE-2024-28303 State: PUBLISHED Published: 2024-03-19T00:00:00 Last Updated: 2024-10-31T18:59:17.843Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open Source Medicine Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the date parameter at /admin/reports/index.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/onurkarasalihoglu/vulnerability-disclosures/blob/main/omos-sql-injection.md - https://github.com/onurkarasalihoglu/vulnerability-disclosures/blob/main/omos_sqli_exploit.py
CVE ID: CVE-2024-28318 State: PUBLISHED Published: 2024-03-15T00:00:00 Last Updated: 2024-08-29T16:52:55.631Z Vendors: n/a Products: n/a Problem Types: n/a Description: gpac 2.3-DEV-rev921-g422b78ecf-master was discovered to contain a out of boundary write vulnerability via swf_get_string at scene_manager/swf_parse.c:325 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gpac/gpac/issues/2764
CVE ID: CVE-2024-28319 State: PUBLISHED Published: 2024-03-15T00:00:00.000Z Last Updated: 2025-03-28T23:16:10.688Z Vendors: n/a Products: n/a Problem Types: n/a Description: gpac 2.3-DEV-rev921-g422b78ecf-master was discovered to contain an out of boundary read vulnerability via gf_dash_setup_period media_tools/dash_client.c:6374 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gpac/gpac/issues/2763
CVE ID: CVE-2024-28320 State: PUBLISHED Published: 2024-04-29T00:00:00 Last Updated: 2024-08-02T00:48:49.655Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure Direct Object References (IDOR) vulnerability in Hospital Management System 1.0 allows attackers to manipulate user parameters for unauthorized access and modifications via crafted POST request to /patient/edit-user.php. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://packetstormsecurity.com/files/177326/Hospital-Management-System-1.0-Insecure-Direct-Object-Reference-Account-Takeover.html - https://sospiro014.github.io/Hospital-Management-System-1.0-Insecure-Direct-Ob
-Object-Reference-Account-Takeover.html - https://sospiro014.github.io/Hospital-Management-System-1.0-Insecure-Direct-Object-Reference-+-Account-Takeover
CVE ID: CVE-2024-28322 State: PUBLISHED Published: 2024-04-26T00:00:00 Last Updated: 2024-08-02T00:48:49.666Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in /event-management-master/backend/register.php in PuneethReddyHC Event Management 1.0 allows attackers to run arbitrary SQL commands via the event_id parameter in a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Sospiro014/zday1/blob/main/event-managment.md - https://packetstormsecurity.com/files/177841/Event-Management-1.0-SQL-Injection.html
CVE ID: CVE-2024-28323 State: PUBLISHED Published: 2024-03-14T00:00:00 Last Updated: 2024-08-26T19:17:03.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: The bwdates-report-result.php file in Phpgurukul User Registration & Login and User Management System 3.1 contains a potential security vulnerability related to user input validation. The script retrieves user-provided date inputs without proper validation, making it susceptible to SQL injection attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://packetstormsecurity.com/files/177168/User-Registration-And-Login-And-User-Management-System-3.1-SQL-Injection.html - https://so
tormsecurity.com/files/177168/User-Registration-And-Login-And-User-Management-System-3.1-SQL-Injection.html - https://sospiro014.github.io/User-Registration-And-Login-And-User-Management-System-3.1-SQL-Injection
CVE ID: CVE-2024-28325 State: PUBLISHED Published: 2024-04-26T00:00:00 Last Updated: 2024-08-02T00:48:49.772Z Vendors: n/a Products: n/a Problem Types: n/a Description: Asus RT-N12+ B1 router stores credentials in cleartext, which could allow local attackers to obtain unauthorized access and modify router settings. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://asus.com - https://github.com/ShravanSinghRathore/ASUS-RT-N300-B1/wiki/Credentials-Stored-in-Cleartext-CVE%E2%80%902024%E2%80%9028325
CVE ID: CVE-2024-28326 State: PUBLISHED Published: 2024-04-26T00:00:00 Last Updated: 2024-12-16T22:51:29.213790Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect Access Control in ASUS RT-N12+ B1 and RT-N12 D1 routers allows local attackers to obtain root terminal access via the the UART interface. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://asus.com - https://github.com/ShravanSinghRathore/ASUS-RT-N300-B1/wiki/Privilege-Escalation-CVE%E2%80%902024%E2%80%9028326
CVE ID: CVE-2024-28327 State: PUBLISHED Published: 2024-04-26T00:00:00 Last Updated: 2024-11-04T14:21:04.785Z Vendors: n/a Products: n/a Problem Types: n/a Description: Asus RT-N12+ B1 router stores user passwords in plaintext, which could allow local attackers to obtain unauthorized access and modify router settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://asus.com - https://github.com/ShravanSinghRathore/ASUS-RT-N300-B1/wiki/Insecure-Credential-Storage-CVE%E2%80%902024%E2%80%9028327
CVE ID: CVE-2024-28328 State: PUBLISHED Published: 2024-04-26T00:00:00 Last Updated: 2024-08-02T00:48:49.858Z Vendors: n/a Products: n/a Problem Types: n/a Description: CSV Injection vulnerability in the Asus RT-N12+ router allows administrator users to inject arbitrary commands or formulas in the client name parameter which can be triggered and executed in a different user session upon exporting to CSV format. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://asus.com - https://github.com/ShravanSinghRathore/ASUS-RT-N300-B1/wiki/CSV-Injection-CVE%E2%80%902024%E2%80%9028328
CVE ID: CVE-2024-28335 State: PUBLISHED Published: 2024-03-27T00:00:00 Last Updated: 2024-08-06T15:08:26.792Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lektor before 3.3.11 does not sanitize DB path traversal. Thus, shell commands might be executed via a file that is added to the templates directory, if the victim's web browser accesses an untrusted website that uses JavaScript to send requests to localhost port 5000, and the web browser is running on the same machine as the "lektor server" command. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/lektor/lektor/pull/1179/commits/8f38b9713d152622b69ff5e3b1e6a0d7bb7fa
ADP Vulnrichment: References: - https://github.com/lektor/lektor/pull/1179/commits/8f38b9713d152622b69ff5e3b1e6a0d7bb7fa800 - https://github.com/lektor/lektor/releases/tag/v3.3.11 - https://cxsecurity.com/issue/WLB-2024030043 - https://packetstormsecurity.com/files/177708/Lektor-Static-CMS-3.3.10-Arbitrary-File-Upload-Remote-Code-Execution.html - https://getlektor.com/docs/quickstart - https://brave.com/privacy-updates/27-localhost-permission/
CVE ID: CVE-2024-28338 State: PUBLISHED Published: 2024-03-12T00:00:00 Last Updated: 2024-08-28T18:35:31.634Z Vendors: n/a Products: n/a Problem Types: n/a Description: A login bypass in TOTOLINK A8000RU V7.1cu.643_B20200521 allows attackers to login to Administrator accounts via providing a crafted session cookie. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/funny-mud-peee/IoT-vuls/blob/main/TOTOLINK%20A8000RU/TOTOlink%20A8000RU%20login%20bypass.md
CVE ID: CVE-2024-28339 State: PUBLISHED Published: 2024-03-12T00:00:00 Last Updated: 2024-08-28T13:46:30.889Z Vendors: n/a Products: n/a Problem Types: n/a Description: An information leak in the debuginfo.htm component of Netgear CBR40 2.5.0.28, Netgear CBK40 2.5.0.28, and Netgear CBK43 2.5.0.28 allows attackers to obtain sensitive information without any authentication required. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.netgear.com/about/security/ - https://github.com/funny-mud-peee/IoT-vuls/blob/main/Netgear%20CBR40%5CCBK40%5CCBK43/Info%20Leak%20in%20Netgear-CBR40%E3%80%81CBK40%E3%80%81CBK43%20Router%EF%BC%88debuginfo.htm%EF%BC%8
BR40%5CCBK40%5CCBK43/Info%20Leak%20in%20Netgear-CBR40%E3%80%81CBK40%E3%80%81CBK43%20Router%EF%BC%88debuginfo.htm%EF%BC%89.md
CVE ID: CVE-2024-28340 State: PUBLISHED Published: 2024-03-12T00:00:00 Last Updated: 2024-08-21T15:27:42.129Z Vendors: n/a Products: n/a Problem Types: n/a Description: An information leak in the currentsetting.htm component of Netgear CBR40 2.5.0.28, Netgear CBK40 2.5.0.28, and Netgear CBK43 2.5.0.28 allows attackers to obtain sensitive information without any authentication required. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.netgear.com/about/security/ - https://github.com/funny-mud-peee/IoT-vuls/blob/main/Netgear%20CBR40%5CCBK40%5CCBK43/Info%20Leak%20in%20Netgear-CBR40%E3%80%81CBK40%E3%80%81CBK43%20Router%EF%BC%88currentsetting.h
r%20CBR40%5CCBK40%5CCBK43/Info%20Leak%20in%20Netgear-CBR40%E3%80%81CBK40%E3%80%81CBK43%20Router%EF%BC%88currentsetting.htm%EF%BC%89.md
CVE ID: CVE-2024-28344 State: PUBLISHED Published: 2024-04-10T00:00:00 Last Updated: 2024-08-02T00:56:56.449Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Open Redirect vulnerability was found in Sipwise C5 NGCP Dashboard below mr11.5.1. The Open Redirect vulnerability allows attackers to control the "back" parameter in the URL through a double encoded URL. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securitycafe.ro/2024/03/21/cve-2024-28344-cve-2024-28345-in-sipwise-c5/
CVE ID: CVE-2024-28345 State: PUBLISHED Published: 2024-04-10T00:00:00 Last Updated: 2024-12-06T21:09:40.899Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue discovered in Sipwise C5 NGCP Dashboard below mr11.5.1 allows a low privileged user to access the Journal endpoint by directly visit the URL. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securitycafe.ro/2024/03/21/cve-2024-28344-cve-2024-28345-in-sipwise-c5/
CVE ID: CVE-2024-28353 State: PUBLISHED Published: 2024-03-15T00:00:00 Last Updated: 2024-08-27T19:59:39.703Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a command injection vulnerability in the TRENDnet TEW-827DRU router with firmware version 2.10B01. An attacker can inject commands into the post request parameters usapps.config.smb_admin_name in the apply.cgi interface, thereby gaining root shell privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://warp-desk-89d.notion.site/TEW-827DRU-5c40fb20572148f0b00f329d69273791
CVE ID: CVE-2024-28354 State: PUBLISHED Published: 2024-03-15T00:00:00 Last Updated: 2024-08-02T20:20:36.382Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a command injection vulnerability in the TRENDnet TEW-827DRU router with firmware version 2.10B01. An attacker can inject commands into the post request parameters usapps.@smb[%d].username in the apply.cgi interface, thereby gaining root shell privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://warp-desk-89d.notion.site/TEW-827DRU-c732df50b2454ecaa5451b02f3adda6a
CVE ID: CVE-2024-28383 State: PUBLISHED Published: 2024-03-14T00:00:00 Last Updated: 2024-08-14T13:52:52.859Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AX12 v1.0 v22.03.01.16 was discovered to contain a stack overflow via the ssid parameter in the sub_431CF0 function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cvdyfbwa/IoT-Tenda-Router/blob/main/sub_431CF0.md
CVE ID: CVE-2024-28386 State: PUBLISHED Published: 2024-03-25T00:00:00.000Z Last Updated: 2025-04-10T18:32:48.201Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Home-Made.io fastmagsync v.1.7.51 and before allows a remote attacker to execute arbitrary code via the getPhpBin() component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://fastmagsync.com - http://home-madeio.com - https://reference1.example.com/modules/fastmagsync/crons/cron_mutualise_job_queue.php?hosting=.%20%26%20%20echo%20%27%3C%3Fphp%20echo%20%2242ovh%22%3B%27%20%3E%20a.php%3B%23&syncway=tofastmag - https://www.home-made.io/module-fastmag-sync-prestash
20echo%20%2242ovh%22%3B%27%20%3E%20a.php%3B%23&syncway=tofastmag - https://www.home-made.io/module-fastmag-sync-prestashop/ - https://security.friendsofpresta.org/modules/2024/03/19/fastmagsync.html
CVE ID: CVE-2024-28387 State: PUBLISHED Published: 2024-03-25T00:00:00 Last Updated: 2024-08-02T00:56:56.446Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in axonaut v.3.1.23 and before allows a remote attacker to obtain sensitive information via the log.txt component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://axonaut.com/integration/detail/prestashop - https://security.friendsofpresta.org/modules/2024/03/19/axonaut.html
CVE ID: CVE-2024-28388 State: PUBLISHED Published: 2024-03-14T00:00:00 Last Updated: 2024-08-26T19:19:32.178Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in SunnyToo stproductcomments module for PrestaShop v.1.0.5 and before, allows a remote attacker to escalate privileges and obtain sensitive information via the StProductCommentClass::getListcomments method. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.friendsofpresta.org/modules/2024/03/12/stproductcomments.html
CVE ID: CVE-2024-28389 State: PUBLISHED Published: 2024-03-19T00:00:00 Last Updated: 2024-08-02T15:18:57.676Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in KnowBand spinwheel v.3.0.3 and before allows a remote attacker to gain escalated privileges and obtain sensitive information via the SpinWheelFrameSpinWheelModuleFrontController::sendEmail() method. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.friendsofpresta.org/modules/2024/03/12/spinwheel.html
CVE ID: CVE-2024-28390 State: PUBLISHED Published: 2024-03-14T00:00:00 Last Updated: 2024-08-22T20:27:47.371Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Advanced Plugins ultimateimagetool module for PrestaShop before v.2.2.01, allows a remote attacker to escalate privileges and obtain sensitive information via Improper Access Control. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.friendsofpresta.org/modules/2024/03/12/ultimateimagetool.html
CVE ID: CVE-2024-28391 State: PUBLISHED Published: 2024-03-14T00:00:00.000Z Last Updated: 2025-04-10T20:32:56.016Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in FME Modules quickproducttable module for PrestaShop v.1.2.1 and before, allows a remote attacker to escalate privileges and obtain information via the readCsv(), displayAjaxProductChangeAttr, displayAjaxProductAddToCart, getSearchProducts, and displayAjaxProductSku methods. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.friendsofpresta.org/modules/2024/03/12/quickproducttable.html