Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-55239 State: PUBLISHED Published: 2024-12-18T00:00:00 Last Updated: 2024-12-25T02:27:40.576Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected Cross-Site Scripting vulnerability in the standard documentation upload functionality in Portabilis i-Educar 2.9 allows attacker to craft malicious urls with arbitrary javascript in the 'titulo_documento' parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/RegularUs3r/CVE-Research/blob/main/CVE-2024/Portabilis%20-%20iEducar/CVE-2024-55649%20-%20Reflected%20Cross-Site%20Scripting.md - https://github.com/RegularUs3r/CVE-Research/blob/main/CVE-2024/Portabilis%20-%20iEducar/C
%20Cross-Site%20Scripting.md - https://github.com/RegularUs3r/CVE-Research/blob/main/CVE-2024/Portabilis%20-%20iEducar/CVE-2024-55239%20-%20Reflected%20Cross-Site%20Scripting.md
CVE ID: CVE-2024-55241 State: PUBLISHED Published: 2025-02-06T00:00:00.000Z Last Updated: 2025-02-11T14:32:47.706Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in deep-diver LLM-As-Chatbot before commit 99c2c03 allows a remote attacker to execute arbitrary code via the modelsbyom.py component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://diamond-bath-fd4.notion.site/Remote-Code-Execution-vulnerability-in-load_model-in-deep-diver-LLM-As-Chatbot-14d4a5b4bb28806795e8e5e8ef9ae27b
CVE ID: CVE-2024-55268 State: PUBLISHED Published: 2024-12-06T00:00:00 Last Updated: 2024-12-11T16:45:46.948Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Reflected Cross Site Scripting (XSS) vulnerability was found in /covidtms/registered-user-testing.php in PHPGurukul COVID 19 Testing Management System 1.0 which allows remote attackers to execute arbitrary code via the regmobilenumber parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Santoshcyber1/CVE-wirteup/blob/main/Phpgurukul/COVID19/Reflected%20Cross%20Site%20reg.pdf
CVE ID: CVE-2024-55272 State: PUBLISHED Published: 2025-02-07T00:00:00.000Z Last Updated: 2025-03-15T15:18:05.110Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Brainasoft Braina v2.8 allows a remote attacker to obtain sensitive information via the chat window function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/soursec/CVEs/tree/main/CVE-2024-55272
CVE ID: CVE-2024-55279 State: PUBLISHED Published: 2025-03-24T00:00:00.000Z Last Updated: 2025-04-01T18:06:38.362Z Vendors: n/a Products: n/a Problem Types: n/a Description: Uguu through 1.8.9 allows Cross Site Scripting (XSS) via JavaScript in XML files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nokonoko/Uguu/ - https://codeberg.org/zypressen/CVE-2024-55279
CVE ID: CVE-2024-55341 State: PUBLISHED Published: 2024-12-20T00:00:00 Last Updated: 2024-12-20T19:53:37.105Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in Piranha CMS 11.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by creating a page via the /manager/pages and then adding a markdown content with the XSS payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/PiranhaCMS/piranha.core - https://sec-fortress.github.io/posts/articles/posts/CVE-2024-55341.html
CVE ID: CVE-2024-55342 State: PUBLISHED Published: 2024-12-20T00:00:00 Last Updated: 2024-12-20T19:59:14.577Z Vendors: n/a Products: n/a Problem Types: n/a Description: A file upload functionality in Piranha CMS 11.1 allows authenticated remote attackers to upload a crafted PDF file to /manager/media. This PDF can contain malicious JavaScript code, which is executed when a victim user opens or interacts with the PDF in their web browser, leading to a XSS vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/PiranhaCMS/piranha.core - https://sec-fortress.github.io/posts/articles/posts/CVE-2024-55342.html
CVE ID: CVE-2024-55354 State: PUBLISHED Published: 2025-04-08T00:00:00.000Z Last Updated: 2025-04-14T14:51:59.128Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Lucee Products: Lucee Server Problem Types: CWE-807 Description: Lucee before 5.4.7.3 LTS and 6 before 6.1.1.118, when an attacker can place files on the server, is vulnerable to a protection mechanism failure that can let an attacker run code that would be expected to be blocked and access resources that would be expected to be protected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://dev.lucee.org/t/lucee-cve-2024-55354-security-advisory-april-2025/14963
CVE ID: CVE-2024-55355 State: REJECTED Published: N/A Last Updated: 2025-01-08T00:26:48.770113 Description: No description available.
CVE ID: CVE-2024-55356 State: REJECTED Published: N/A Last Updated: 2025-01-08T00:26:07.666945 Description: No description available.
CVE ID: CVE-2024-55371 State: PUBLISHED Published: 2025-04-16T00:00:00.000Z Last Updated: 2025-04-17T13:51:15.090Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wallos <= 2.38.2 has a file upload vulnerability in the restore backup function, which allows authenticated users to restore backups by uploading a ZIP file. The contents of the ZIP file are extracted on the server. This functionality enables an authenticated attacker (being an administrator is not required) to upload malicious files to the server. Once a web shell is installed, the attacker gains the ability to execute arbitrary commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dataf
bility to execute arbitrary commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.datafarm.co.th/blog/CVE-2024-55371-and-CVE-2024-55372-Malicious-File-Upload-to-RCE-in-Wallos-Application
CVE ID: CVE-2024-55372 State: PUBLISHED Published: 2025-04-16T00:00:00.000Z Last Updated: 2025-04-17T13:49:52.977Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wallos <=2.38.2 has a file upload vulnerability in the restore database function, which allows unauthenticated users to restore database by uploading a ZIP file. The contents of the ZIP file are extracted on the server. This functionality enables an unauthenticated attacker to upload malicious files to the server. Once a web shell is installed, the attacker gains the ability to execute arbitrary commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.datafarm.co.th/blog/CVE-2024-55371-and-C
s. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.datafarm.co.th/blog/CVE-2024-55371-and-CVE-2024-55372-Malicious-File-Upload-to-RCE-in-Wallos-Application
CVE ID: CVE-2024-55398 State: PUBLISHED Published: 2025-08-06T00:00:00.000Z Last Updated: 2025-08-06T20:39:24.153Z Vendors: n/a Products: n/a Problem Types: n/a Description: 4C Strategies Exonaut before v22.4 was discovered to contain insecure permissions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://exonaut.com - https://gist.github.com/Jowu73/27fc259bf1355e1c557f0f54d630f9ca
CVE ID: CVE-2024-55399 State: PUBLISHED Published: 2025-08-06T00:00:00.000Z Last Updated: 2025-08-06T20:38:30.274Z Vendors: n/a Products: n/a Problem Types: n/a Description: 4C Strategies Exonaut before v21.6.2.1-1 was discovered to contain a Server-Side Request Forgery (SSRF). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://exonaut.com - https://gist.github.com/Jowu73/1e8cb2a5c73a79eb36f2c6b3d9eb1b83
CVE ID: CVE-2024-55401 State: PUBLISHED Published: 2025-08-07T00:00:00.000Z Last Updated: 2025-08-07T20:26:37.163Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in 4C Strategies Exonaut before v22.4 allows attackers to execute a directory traversal. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://exonaut.com - https://gist.github.com/Jowu73/d157080aea62075a4d2c9bcf7a2e399c
CVE ID: CVE-2024-55402 State: PUBLISHED Published: 2025-08-06T00:00:00.000Z Last Updated: 2025-08-06T20:37:50.153Z Vendors: n/a Products: n/a Problem Types: n/a Description: 4C Strategies Exonaut before v22.4 was discovered to contain an access control issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://exonaut.com - https://gist.github.com/Jowu73/762f2240dcc56352c1e95da78ffff094
CVE ID: CVE-2024-55407 State: PUBLISHED Published: 2025-01-06T00:00:00 Last Updated: 2025-01-07T16:04:37.215Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the DeviceloControl function of ITE Tech. Inc ITE IO Access v1.0.0.0 allows attackers to perform arbitrary port read and write actions via supplying crafted IOCTL requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://ite.com - https://github.com/heyheysky/vulnerable-driver/blob/master/CVE-2024-55407/CVE-2024-55407_Winio64.sys_README.md
CVE ID: CVE-2024-55408 State: PUBLISHED Published: 2025-01-06T00:00:00 Last Updated: 2025-02-11T00:54:34.836Z Vendors: ASUS Products: ASCI Problem Types: CWE-862 Description: An improper access control vulnerability in the AsusSAIO.sys driver may lead to the misuse of software functionality utilizing the driver when crafted IOCTL requests are supplied. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.asus.com/tw/support/myasus-deeplink/ - https://github.com/heyheysky/vulnerable-driver/blob/master/CVE-2024-55408/CVE-2024-55408_AsusSAIO.sys_README.md
CVE ID: CVE-2024-55410 State: REJECTED Published: 2025-01-07T00:00:00.000Z Last Updated: 2025-01-23T01:26:52.333Z Description: No description available.
CVE ID: CVE-2024-55411 State: PUBLISHED Published: 2025-01-07T00:00:00 Last Updated: 2025-01-08T19:42:45.512Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the snxpcamd.sys component of SUNIX Multi I/O Card v10.1.0.0 allows attackers to perform arbitrary read and write actions via supplying crafted IOCTL requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sunix.com/tw/ - https://github.com/heyheysky/vulnerable-driver/blob/master/CVE-2024-55411/CVE-2024-55411_snxpcamd.sys_README.md
CVE ID: CVE-2024-55412 State: PUBLISHED Published: 2025-01-07T00:00:00 Last Updated: 2025-01-08T15:35:19.177Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability exits in driver snxpsamd.sys in SUNIX Serial Driver x64 - 10.1.0.0, which allows low-privileged users to read and write arbitary i/o port via specially crafted IOCTL requests . This can be exploited for privilege escalation, code execution under high privileges, and information disclosure. These signed drivers can also be used to bypass the Microsoft driver-signing policy to deploy malicious code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sunix.com/tw/ - https://github.com/he
code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sunix.com/tw/ - https://github.com/heyheysky/vulnerable-driver/blob/master/CVE-2024-55412/CVE-2024-55412_snxpsamd.sys_README.md
CVE ID: CVE-2024-55413 State: PUBLISHED Published: 2025-01-07T00:00:00 Last Updated: 2025-01-08T15:33:13.125Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability exits in driver snxppamd.sys in SUNIX Parallel Driver x64 - 10.1.0.0, which allows low-privileged users to read and write arbitary i/o port via specially crafted IOCTL requests . This can be exploited for privilege escalation, code execution under high privileges, and information disclosure. These signed drivers can also be used to bypass the Microsoft driver-signing policy to deploy malicious code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sunix.com/tw/ - https://github.com/
s code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sunix.com/tw/ - https://github.com/heyheysky/vulnerable-driver/blob/master/CVE-2024-55413/CVE-2024-55413_snxppamd.sys_README.md
CVE ID: CVE-2024-55414 State: PUBLISHED Published: 2025-01-07T00:00:00 Last Updated: 2025-01-08T15:26:42.619Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability exits in driver SmSerl64.sys in Motorola SM56 Modem WDM Driver v6.12.23.0, which allows low-privileged users to mapping physical memory via specially crafted IOCTL requests . This can be exploited for privilege escalation, code execution under high privileges, and information disclosure. These signed drivers can also be used to bypass the Microsoft driver-signing policy to deploy malicious code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://us.motorola.com/ - https://github.com/heyhe
de. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://us.motorola.com/ - https://github.com/heyheysky/vulnerable-driver/blob/master/CVE-2024-55414/CVE-2024-55414_SmSerl64.sys_README.md
CVE ID: CVE-2024-55415 State: PUBLISHED Published: 2025-01-30T00:00:00.000Z Last Updated: 2025-02-06T14:40:50.378Z Vendors: n/a Products: n/a Problem Types: n/a Description: DevDojo Voyager through 1.8.0 is vulnerable to path traversal at the /admin/compass. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/thedevdojo/voyager/blob/1.6/src/Http/Controllers/VoyagerCompassController.php#L44 - https://github.com/thedevdojo/voyager/blob/1.6/src/Http/Controllers/VoyagerCompassController.php#L213 - https://www.sonarsource.com/blog/the-tainted-voyage-uncovering-voyagers-vulnerabilities/
CVE ID: CVE-2024-55416 State: PUBLISHED Published: 2025-01-30T00:00:00.000Z Last Updated: 2025-02-06T14:55:34.341Z Vendors: n/a Products: n/a Problem Types: n/a Description: DevDojo Voyager through version 1.8.0 is vulnerable to reflected XSS via /admin/compass. By manipulating an authenticated user to click on a link, arbitrary Javascript can be executed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/thedevdojo/voyager/blob/1.6/src/Http/Controllers/VoyagerCompassController.php#L44 - https://github.com/thedevdojo/voyager/blob/1.6/resources/views/master.blade.php#L132 - https://www.sonarsource.com/blog/the-tainted-voyage-uncovering-voyagers-vulnerabilitie
ces/views/master.blade.php#L132 - https://www.sonarsource.com/blog/the-tainted-voyage-uncovering-voyagers-vulnerabilities/
CVE ID: CVE-2024-55417 State: PUBLISHED Published: 2025-01-30T00:00:00.000Z Last Updated: 2025-02-06T14:06:59.928Z Vendors: n/a Products: n/a Problem Types: n/a Description: DevDojo Voyager through version 1.8.0 is vulnerable to bypassing the file type verification when an authenticated user uploads a file via /admin/media/upload. An authenticated user can upload a web shell causing arbitrary code execution on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/thedevdojo/voyager/blob/1.6/src/Http/Controllers/VoyagerMediaController.php#L238 - https://www.sonarsource.com/blog/the-tainted-voyage-uncovering-voyagers-vulnerabilities/
CVE ID: CVE-2024-55451 State: PUBLISHED Published: 2024-12-16T00:00:00 Last Updated: 2024-12-17T16:56:32.250Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-Site Scripting (XSS) vulnerability exists in authenticated SVG file upload and viewing functionality in UJCMS 9.6.3. The vulnerability arises from insufficient sanitization of embedded attributes in uploaded SVG files. When a maliciously crafted SVG file is viewed by other backend users, it allows authenticated attackers to execute arbitrary JavaScript in the context of other backend users' browsers, potentially leading to the theft of sensitive tokens. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
owsers, potentially leading to the theft of sensitive tokens. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dromara/ujcms - https://github.com/cydtseng/Vulnerability-Research/blob/main/ujcms/StoredXSS-SVGUpload.md
CVE ID: CVE-2024-55452 State: PUBLISHED Published: 2024-12-16T00:00:00 Last Updated: 2024-12-17T14:42:59.416Z Vendors: n/a Products: n/a Problem Types: n/a Description: A URL redirection vulnerability exists in UJCMS 9.6.3 due to improper validation of URLs in the upload and rendering of new block / carousel items. This vulnerability allows authenticated attackers to redirect unprivileged users to an arbitrary, attacker-controlled webpage. When an authenticated user clicks on the malicious block item, they are redirected to the arbitrary untrusted domains, where sensitive tokens, such as JSON Web Tokens, can be stolen via a crafted webpage. Additional Analyst Notes: - CISA ADP Vulnrichment:
okens, such as JSON Web Tokens, can be stolen via a crafted webpage. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dromara/ujcms - https://github.com/cydtseng/Vulnerability-Research/blob/main/ujcms/OpenRedirect-BlockItemUpload.md
CVE ID: CVE-2024-55456 State: PUBLISHED Published: 2025-02-03T00:00:00.000Z Last Updated: 2025-03-18T20:31:14.972Z Vendors: n/a Products: n/a Problem Types: n/a Description: lunasvg v3.0.1 was discovered to contain a segmentation violation via the component gray_find_cell Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sammycage/lunasvg/issues/199
CVE ID: CVE-2024-55457 State: PUBLISHED Published: 2025-02-20T00:00:00.000Z Last Updated: 2025-02-20T19:40:46.477Z Vendors: n/a Products: n/a Problem Types: n/a Description: MasterSAM Star Gate 11 is vulnerable to directory traversal via /adama/adama/downloadService. An attacker can exploit this vulnerability by manipulating the file parameter to access arbitrary files on the server, potentially exposing sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/h13nh04ng/CVE-2024-55457-PoC
CVE ID: CVE-2024-55459 State: PUBLISHED Published: 2025-01-08T00:00:00 Last Updated: 2025-01-09T14:44:48.850Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in keras 3.7.0 allows attackers to write arbitrary files to the user's machine via downloading a crafted tar file through the get_file function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/keras-team/keras - https://keras.io - https://river-bicycle-f1e.notion.site/Arbitrary-File-Write-Vulnerability-in-get_file-function-11888e31952580179224e50892976d32
CVE ID: CVE-2024-55460 State: PUBLISHED Published: 2025-02-18T00:00:00.000Z Last Updated: 2025-02-19T14:47:18.742Z Vendors: n/a Products: n/a Problem Types: n/a Description: A time-based SQL injection vulnerability in the login page of BoardRoom Limited Dividend Distribution Tax Election System Version v2.0 allows attackers to execute arbitrary code via a crafted input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sgsrs.boardroomlimited.com/taxelection/login.aspx - https://github.com/Ap0k4L1p5/CVE-research/tree/master/CVE-2024-55460
CVE ID: CVE-2024-55461 State: PUBLISHED Published: 2024-12-18T00:00:00 Last Updated: 2024-12-31T19:32:05.206Z Vendors: n/a Products: n/a Problem Types: n/a Description: SeaCMS <=13.0 is vulnerable to command execution in phome.php via the function Ebak_RepPathFiletext(). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/FengFu01/sea/issues/IB8S1N
CVE ID: CVE-2024-55466 State: PUBLISHED Published: 2025-05-12T00:00:00.000Z Last Updated: 2025-05-13T15:56:01.549Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the Image Gallery of ThingsBoard Community, ThingsBoard Cloud and ThingsBoard Professional v3.8.1 allows attackers to execute arbitrary code via uploading a crafted file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/thingsboard/thingsboard/releases/tag/v3.8.1 - https://github.com/cybsecsid/ThingsBoard-IoT-Platform-CVE-2024-55466
CVE ID: CVE-2024-55470 State: PUBLISHED Published: 2024-12-20T00:00:00 Last Updated: 2024-12-20T17:25:33.514Z Vendors: n/a Products: n/a Problem Types: n/a Description: Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. By manipulating the entityid parameter, attackers can bypass passcode validation and successfully log into the application or access restricted data without proper authorization. The lack of server-side validation exacerbates the issue, as the application relies on client-side information for authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/oqtane/oqtane.framework/pull/4878/files - https://gist.github.com/Kaush
P Vulnrichment: References: - https://github.com/oqtane/oqtane.framework/pull/4878/files - https://gist.github.com/Kaushikjoshi/2d8ad350ba5e72030fcee2536498cfe4
CVE ID: CVE-2024-55471 State: PUBLISHED Published: 2024-12-20T00:00:00 Last Updated: 2024-12-20T17:28:59.145Z Vendors: n/a Products: n/a Problem Types: n/a Description: Oqtane Framework is vulnerable to Insecure Direct Object Reference (IDOR) in Oqtane.Controllers.UserController. This allows unauthorized users to access sensitive information of other users by manipulating the id parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/oqtane/oqtane.framework/pull/4880/files - https://medium.com/@Rudra_2158/cve-2024-55471-breaking-down-the-idor-vulnerability-in-oqtane-framework-c0f4b02f12fc
CVE ID: CVE-2024-55488 State: PUBLISHED Published: 2025-01-22T00:00:00.000Z Last Updated: 2025-02-12T22:28:19.105Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. NOTE: This has been disputed by the vendor since this potential attack is only possible via authenticated users who have been manually allowed access to the CMS. There was a deliberate decision made not to apply HTML sanitization at the product level. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://umbraco.com - https://www.nccgroup.com/us/resear
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://umbraco.com - https://www.nccgroup.com/us/research-blog/technical-advisory-cross-site-scripting-in-umbraco-rich-text-display/
CVE ID: CVE-2024-55492 State: PUBLISHED Published: 2024-12-18T00:00:00 Last Updated: 2024-12-18T18:41:45.207568Z Vendors: n/a Products: n/a Problem Types: n/a Description: Winmail Server 4.4 is vulnerable to f_user=%22%3E%3Csvg%20onload Cross Site Scripting (XSS). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/qtxz54/Vul/blob/main/XSS/Winmail-Server.md
CVE ID: CVE-2024-55494 State: PUBLISHED Published: 2025-01-09T00:00:00 Last Updated: 2025-01-13T21:14:38.437242Z Vendors: n/a Products: n/a Problem Types: n/a Description: A PHP Code Injection vulnerability that can lead to Remote Code Execution (RCE) and XSS in Opencode Mobile Collect Call v5.4.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the op_func parameter at /occontrolpanel/index.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/hassan-mohammed/security-findings/tree/main/CVEs/CVE-2024-55494
CVE ID: CVE-2024-55496 State: PUBLISHED Published: 2024-12-17T00:00:00 Last Updated: 2024-12-20T20:56:21.487Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability has been found in the 1000projects Bookstore Management System PHP MySQL Project 1.0. This issue affects some unknown functionality of add_company.php. Actions on the delete parameter result in SQL injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wpc1122/CVE/issues/1 - https://1000projects.org/bookstore-management-system-php-mysql-project.html