Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
d output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/03ad3677-1b02-4f22-af50-e88b2ec83f54?source=cve - https://drive.google.com/file/d/1SFQXlRUQw7THm_Vay_pFH3pIX1cjH4AY/view?usp=sharing - https://plugins.trac.wordpress.org/browser/cost-calculator-builder/trunk/templates/frontend/fields/cost-text.php#L15 - https://plugins.trac.wordpress.org/browser/cost-calculator-builder/trunk/templates
s/frontend/fields/cost-text.php#L15 - https://plugins.trac.wordpress.org/browser/cost-calculator-builder/trunk/templates/frontend/fields/cost-text.php#L26 - https://plugins.trac.wordpress.org/changeset/3108606/
CVE ID: CVE-2024-6012 State: PUBLISHED Published: 2024-07-02T09:32:10.221Z Last Updated: 2024-08-01T21:25:03.191Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: stylemix Products: Cost Calculator Builder Problem Types: CWE-862 Missing Authorization Description: The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'embed-create-page' and 'embed-insert-pages' functions in all versions up to, and including, 3.2.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary posts and append arbitrary content to existing po
attackers, with Subscriber-level access and above, to create arbitrary posts and append arbitrary content to existing posts. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fd7da039-f6b8-46b7-a43a-145e9f8844c3?source=cve - https://plugins.trac.wordpress.org/browser/cost-calculator-builder/trunk/frontend/dist/admin.js - https://plugins.trac.wordpress.org/changeset/3108606/
CVE ID: CVE-2024-6013 State: PUBLISHED Published: 2024-06-15T16:00:04.655Z Last Updated: 2024-08-01T21:25:03.190Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: Online Book Store Problem Types: CWE-89 Description: A vulnerability was found in itsourcecode Online Book Store 1.0. It has been rated as critical. This issue affects some unknown processing of the file admin_delete.php. The manipulation of the argument bookisbn leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-268721 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: -
used. The identifier VDB-268721 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.268721 - https://vuldb.com/?ctiid.268721 - https://vuldb.com/?submit.357075 - https://github.com/gabriel202212/cve/issues/1
CVE ID: CVE-2024-6014 State: PUBLISHED Published: 2024-06-15T16:31:04.254Z Last Updated: 2024-08-01T21:25:03.206Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: Document Management System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in itsourcecode Document Management System 1.0. Affected is an unknown function of the file edithis.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-268722 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: -
used. VDB-268722 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.268722 - https://vuldb.com/?ctiid.268722 - https://vuldb.com/?submit.357246 - https://github.com/gabriel202212/cve/issues/2
CVE ID: CVE-2024-6015 State: PUBLISHED Published: 2024-06-15T17:00:04.461Z Last Updated: 2024-08-01T21:25:03.175Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: Online House Rental System Problem Types: CWE-89 Description: A vulnerability classified as critical was found in itsourcecode Online House Rental System 1.0. Affected by this vulnerability is an unknown functionality of the file manage_user.php. The manipulation of the argument month_of leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-268723. Additional Analyst Notes: -
o the public and may be used. The associated identifier of this vulnerability is VDB-268723. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.268723 - https://vuldb.com/?ctiid.268723 - https://vuldb.com/?submit.357462 - https://github.com/chenwulin-bit/cve/issues/1
CVE ID: CVE-2024-6016 State: PUBLISHED Published: 2024-06-15T18:31:04.133Z Last Updated: 2024-08-01T21:25:03.207Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: Online Laundry Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in itsourcecode Online Laundry Management System 1.0. Affected by this issue is some unknown functionality of the file admin_class.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-268724. Additional Analyst No
been disclosed to the public and may be used. The identifier of this vulnerability is VDB-268724. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.268724 - https://vuldb.com/?ctiid.268724 - https://vuldb.com/?submit.357463 - https://github.com/chenwulin-bit/cve/issues/2
CVE ID: CVE-2024-6017 State: PUBLISHED Published: 2024-09-12T06:00:03.280Z Last Updated: 2024-09-12T18:08:36.897Z Vendors: Unknown Products: Music Request Manager Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The Music Request Manager WordPress plugin through 1.3 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/06d0559e-4389-4280-bbef-d100c0e07903/
CVE ID: CVE-2024-6018 State: PUBLISHED Published: 2024-09-12T06:00:03.607Z Last Updated: 2024-09-12T18:24:13.541Z Vendors: Unknown Products: Music Request Manager Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Music Request Manager WordPress plugin through 1.3 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c3f50e30-c7c5-4e7e-988c-ab884d75870b/
CVE ID: CVE-2024-6019 State: PUBLISHED Published: 2024-09-12T06:00:03.903Z Last Updated: 2024-09-12T18:26:41.695Z Vendors: Unknown Products: Music Request Manager Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Music Request Manager WordPress plugin through 1.3 does not sanitise and escape incoming music requests, which could allow unauthenticated users to perform Cross-Site Scripting attacks against administrators Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5899c5c9-a550-4c86-a41d-7fcc1e84a7d3/
CVE ID: CVE-2024-6020 State: PUBLISHED Published: 2024-09-04T06:00:02.532Z Last Updated: 2024-09-04T14:23:36.656Z Vendors: Unknown Products: Sign-up Sheets Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Sign-up Sheets WordPress plugin before 2.2.13 does not escape some generated URLs, as well as the $_SERVER['REQUEST_URI'] parameter before outputting them back in attributes, which could lead to Reflected Cross-Site Scripting. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f3526320-3abd-4ddb-8f73-778741bd9c48/
CVE ID: CVE-2024-6021 State: PUBLISHED Published: 2024-07-30T06:00:09.678Z Last Updated: 2024-08-01T21:25:03.197Z Vendors: Unknown Products: Donation Block For PayPal Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Donation Block For PayPal WordPress plugin through 2.1.0 does not sanitise and escape form submissions, leading to a stored cross-site scripting vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/9d83cffd-7dcd-4301-8d4d-3043b14e05b5/
CVE ID: CVE-2024-6022 State: PUBLISHED Published: 2024-07-12T06:00:06.639Z Last Updated: 2024-08-01T21:25:03.198Z Vendors: Unknown Products: ContentLock Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The ContentLock WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/871a93b5-ec67-4fe0-bc39-e5485477fbeb/
CVE ID: CVE-2024-6023 State: PUBLISHED Published: 2024-07-12T06:00:06.958Z Last Updated: 2024-08-01T21:25:03.160Z Vendors: Unknown Products: ContentLock Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The ContentLock WordPress plugin through 1.0.3 does not have CSRF check in place when adding emails, which could allow attackers to make a logged in admin perform such action via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/6e812189-2980-453d-931d-1f785e8dbcc0/
CVE ID: CVE-2024-6024 State: PUBLISHED Published: 2024-07-12T06:00:07.258Z Last Updated: 2024-08-01T21:25:03.203Z Vendors: Unknown Products: ContentLock Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The ContentLock WordPress plugin through 1.0.3 does not have CSRF check in place when deleting groups or emails, which could allow attackers to make a logged in admin remove them via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/3d2cdb4f-b7e1-4691-90d1-cddde7f5858e/
CVE ID: CVE-2024-6025 State: PUBLISHED Published: 2024-07-11T06:00:04.031Z Last Updated: 2024-08-01T21:25:03.195Z Vendors: Unknown Products: Quiz and Survey Master (QSM) Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Quiz and Survey Master (QSM) WordPress plugin before 9.0.5 does not sanitise and escape some of its Quiz settings, which could allow contributors and higher to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/15abc7dd-95b1-4dad-ba25-eb65105d3925/
CVE ID: CVE-2024-6026 State: PUBLISHED Published: 2024-07-11T06:00:04.304Z Last Updated: 2024-08-01T21:25:03.207Z Vendors: Unknown Products: Slider by 10Web Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Slider by 10Web WordPress plugin before 1.2.56 does not sanitise and escape some of its Slide options, which could allow authenticated users with access to the Sliders (by default Administrator, however this can be changed via the Slider by 10Web WordPress plugin before 1.2.56's options) and the ability to add images (Editor+) to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wps
Scripting attacks Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/01609d84-e9eb-46a9-b2cc-fe7e0c982984/
CVE ID: CVE-2024-6027 State: PUBLISHED Published: 2024-06-21T09:39:38.125Z Last Updated: 2024-08-01T21:25:03.171Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: themifyme Products: Themify – WooCommerce Product Filter Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Themify – WooCommerce Product Filter plugin for WordPress is vulnerable to time-based SQL Injection via the ‘conditions’ parameter in all versions up to, and including, 1.4.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f
ng on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/451db756-9d62-4c8e-b735-e5e5207b81e3?source=cve - https://plugins.trac.wordpress.org/browser/themify-wc-product-filter/trunk/public/class-wpf-public.php#L604 - https://themify.org/changelogs/themify-wc-product-filter.txt - https://plugins.trac.wordpress.org/changeset?sfp
p#L604 - https://themify.org/changelogs/themify-wc-product-filter.txt - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3104239%40themify-wc-product-filter%2Ftrunk&old=3100861%40themify-wc-product-filter%2Ftrunk&sfp_email=&sfph_mail=#file2
CVE ID: CVE-2024-6028 State: PUBLISHED Published: 2024-06-25T08:35:15.965Z Last Updated: 2024-08-01T21:25:03.200Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ays-pro Products: Quiz Maker Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Quiz Maker plugin for WordPress is vulnerable to time-based SQL Injection via the 'ays_questions' parameter in all versions up to, and including, 6.5.8.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional
ficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ab340c65-35eb-4a85-8150-3119b46c7f35?source=cve - https://plugins.trac.wordpress.org/browser/quiz-maker/tags/6.5.7.5/public/class-quiz-maker-public.php#L4904 - https://plugins.trac.wordpress.org/browser/quiz-maker/tags/6.5.7.5/public/class-quiz-maker-public.php#L6901 - https://wordpress.org/plugins/quiz-maker/#develope
er/quiz-maker/tags/6.5.7.5/public/class-quiz-maker-public.php#L6901 - https://wordpress.org/plugins/quiz-maker/#developers - https://plugins.trac.wordpress.org/changeset/3103402/quiz-maker/tags/6.5.8.2/public/class-quiz-maker-public.php?old=3102679&old_path=quiz-maker%2Ftags%2F6.5.8.1%2Fpublic%2Fclass-quiz-maker-public.php - https://plugins.trac.wordpress.org/changeset/3105555/quiz-maker/tags/6.5.8.4/public/class-quiz-maker-public.php?old=3104323&old_path=quiz-maker%2Ftags%2F6.5.8.3%2Fpublic%2Fclass-quiz-maker-public.php
CVE ID: CVE-2024-6029 State: PUBLISHED Published: 2025-04-30T20:00:25.966Z Last Updated: 2025-04-30T20:13:33.588Z Severity: MEDIUM (CVSS 5 CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Tesla Products: Model S Problem Types: CWE-367 Description: Tesla Model S Iris Modem Race Condition Firewall Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass the firewall on the Iris modem in affected Tesla Model S vehicles. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firewall service. The issue results from a failure to obtain the xtables lock. An attacker can leverage this vulnerability to bypass firewall rules
results from a failure to obtain the xtables lock. An attacker can leverage this vulnerability to bypass firewall rules. Was ZDI-CAN-23197. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-260/
CVE ID: CVE-2024-6030 State: PUBLISHED Published: 2025-04-30T20:00:36.899Z Last Updated: 2025-04-30T20:16:23.726Z Severity: HIGH (CVSS 7 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Tesla Products: Model S Problem Types: CWE-250 Description: Tesla Model S oFono Unnecessary Privileges Sandbox Escape Vulnerability. This vulnerability allows local attackers to escape the sandbox on affected Tesla Model S vehicles. An attacker must first obtain the ability to execute code within the sandbox on the target system in order to exploit this vulnerability. The specific flaw exists within the oFono process. The process allows an attacker to modify interfaces. An attacker can leverage this vul
exists within the oFono process. The process allows an attacker to modify interfaces. An attacker can leverage this vulnerability to bypass the iptables network sandbox. Was ZDI-CAN-23200. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-263/
CVE ID: CVE-2024-6031 State: PUBLISHED Published: 2025-04-30T20:00:29.921Z Last Updated: 2025-04-30T20:12:28.649Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Tesla Products: Model S Problem Types: CWE-122 Description: Tesla Model S oFono AT Command Heap-based Buffer Overflow Code Execution Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected Tesla Model S vehicles. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of responses from AT commands. The issue results from the lack of proper validation of the l
w exists within the parsing of responses from AT commands. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23198. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-261/
CVE ID: CVE-2024-6032 State: PUBLISHED Published: 2025-04-30T20:00:40.719Z Last Updated: 2025-04-30T20:17:09.792Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Tesla Products: Model S Problem Types: CWE-78 Description: Tesla Model S Iris Modem ql_atfwd Command Injection Code Execution Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected Tesla Model S vehicles. An attacker must first obtain the ability to execute code on the target system in order to exploit this vulnerability. The specific flaw exists within the ql_atfwd process. The issue results from the lack of proper validation of a user-supplied string before us
ts within the ql_atfwd process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code on the target modem in the context of root. Was ZDI-CAN-23201. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-264/
CVE ID: CVE-2024-6033 State: PUBLISHED Published: 2024-07-17T06:45:07.709Z Last Updated: 2024-08-01T21:25:03.214Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: themewinter Products: Event Manager, Events Calendar, Tickets, Registrations – Eventin Problem Types: CWE-862 Missing Authorization Description: The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized data importation due to a missing capability check on the 'import_file' function in all versions up to, and including, 4.0.4. This makes it possible for authenticated attackers, with Contributor-level access and above, to import events, sp
4.0.4. This makes it possible for authenticated attackers, with Contributor-level access and above, to import events, speakers, schedules and attendee data. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1725c7f3-2fac-4714-a63e-6c43694483fc?source=cve - https://plugins.trac.wordpress.org/browser/wp-event-solution/trunk/core/admin/hooks.php#L135 - https://plugins.trac.wordpress.org/changeset/3117477/
CVE ID: CVE-2024-6035 State: PUBLISHED Published: 2024-07-11T10:41:27.535Z Last Updated: 2024-08-01T21:25:03.110Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: gaizhenbiao Products: gaizhenbiao/chuanhuchatgpt Problem Types: CWE-79 Description: A Stored Cross-Site Scripting (XSS) vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240410. This vulnerability allows an attacker to inject malicious JavaScript code into the chat history file. When a victim uploads this file, the malicious script is executed in the victim's browser. This can lead to user data theft, session hijacking, malware distribution, and phishing attacks. Additional Analyst Notes: -
can lead to user data theft, session hijacking, malware distribution, and phishing attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/e4e8da71-53a9-4540-8d70-6b670b076987
CVE ID: CVE-2024-6036 State: PUBLISHED Published: 2024-07-10T22:57:33.930Z Last Updated: 2024-08-01T21:25:03.176Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: gaizhenbiao Products: gaizhenbiao/chuanhuchatgpt Problem Types: CWE-400 Description: A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to restart the server at will by sending a specific request to the `/queue/join?` endpoint with `"fn_index":66`. This unrestricted server restart capability can severely disrupt service availability, cause data loss or corruption, and potentially compromise system integrity. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program C
ruption, and potentially compromise system integrity. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/e9eaaea9-5750-4955-9142-2f12ad4b06db
CVE ID: CVE-2024-6037 State: PUBLISHED Published: 2024-07-10T22:43:22.785Z Last Updated: 2025-10-15T12:49:45.163Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: gaizhenbiao Products: gaizhenbiao/chuanhuchatgpt Problem Types: CWE-770 Description: A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240410 allows an attacker to create arbitrary folders at any location on the server, including the root directory (C: dir). This can lead to uncontrolled resource consumption, resulting in resource exhaustion, denial of service (DoS), server unavailability, and potential data loss or corruption. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Con
vailability, and potential data loss or corruption. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/eca6904f-f9fd-40c8-9e85-96f54daf405e - https://github.com/gaizhenbiao/chuanhuchatgpt/commit/71cb89c4c948dae5aaa0ae64b98f98e3965bdb37