Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-56901 State: PUBLISHED Published: 2025-02-03T00:00:00.000Z Last Updated: 2025-03-04T21:43:46.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) vulnerability in Geovision GV-ASWeb application with the version 6.1.1.0 or less that allows attackers to arbitrarily create Administrator accounts via a crafted GET request method. This vulnerability is used in chain with CVE-2024-56903 for a successful CSRF attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/DRAGOWN/CVE-2024-56901
CVE ID: CVE-2024-56902 State: PUBLISHED Published: 2025-02-03T00:00:00.000Z Last Updated: 2025-03-04T21:40:25.468Z Vendors: n/a Products: n/a Problem Types: n/a Description: Information disclosure vulnerability in Geovision GV-ASManager web application with the version v6.1.0.0 or less, which discloses account information, including cleartext password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/DRAGOWN/CVE-2024-56902
CVE ID: CVE-2024-56903 State: PUBLISHED Published: 2025-02-03T00:00:00.000Z Last Updated: 2025-03-04T21:37:39.237Z Vendors: n/a Products: n/a Problem Types: n/a Description: Geovision GV-ASWeb with the version 6.1.1.0 or less allows attackers to modify POST request method with the GET against critical functionalities, such as account management. This vulnerability is used in chain with CVE-2024-56901 for a successful CSRF attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/DRAGOWN/CVE-2024-56903
CVE ID: CVE-2024-56908 State: PUBLISHED Published: 2025-02-13T00:00:00.000Z Last Updated: 2025-03-17T18:48:25.965Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Perfex Crm < 3.2.1, an authenticated attacker can send a crafted HTTP POST request to the affected upload_sales_file endpoint. By providing malicious input in the rel_id parameter, combined with improper input validation, the attacker can bypass restrictions and upload arbitrary files to directories of their choice, potentially leading to remote code execution or server compromise. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/JuyLang/7406077e3e5e6b2ff35c80f1853e298f
CVE ID: CVE-2024-56914 State: PUBLISHED Published: 2025-01-22T00:00:00.000Z Last Updated: 2025-01-23T17:06:32.923Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DSL-3782 v1.01 is vulnerable to Buffer Overflow in /New_GUI/ParentalControl.asp. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/2664521593/mycve/blob/main/BOF_in_D-Link_DSL-3782_1.pdf
CVE ID: CVE-2024-56915 State: PUBLISHED Published: 2025-06-26T00:00:00.000Z Last Updated: 2025-06-26T15:18:35.229Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netbox Community v4.1.7 and fixed in v.4.2.2 is vulnerable to Cross Site Scripting (XSS) via the RSS feed widget. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/netbox-community/netbox/releases/tag/v4.1.7 - https://youtu.be/n_5w0WVP8zE - https://github.com/noxlumens/Vulnerability-Research/tree/main/CVE-2024-56915
CVE ID: CVE-2024-56916 State: PUBLISHED Published: 2025-06-24T00:00:00.000Z Last Updated: 2025-06-24T19:19:26.650Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Netbox Community 4.1.7, once authenticated, Configuration History > Add`is vulnerable to cross-site scripting (XSS) due to the `current value` field rendering user supplied html. An authenticated attacker can leverage this to add malicious JavaScript to the any banner field. Once a victim edits a Configuration History version or attempts to Add a new version, the XSS payload will trigger. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/netbox-community/netbox/releases/tag/v4.1.7 - h
Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/netbox-community/netbox/releases/tag/v4.1.7 - https://www.youtube.com/watch?v=GC8-PUlu2i8 - https://github.com/noxlumens/Vulnerability-Research/tree/main/CVE-2024-56916
CVE ID: CVE-2024-56917 State: PUBLISHED Published: 2025-06-24T00:00:00.000Z Last Updated: 2025-06-24T19:40:58.461Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netbox Community 4.1.7 is vulnerable to Cross Site Scripting (XSS) via the maintenance banner` in maintenance mode. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/netbox-community/netbox/releases/tag/v4.1.7 - https://youtu.be/GC8-PUlu2i8?si=eoScOk8IUJdwPDc_&t=172 - https://github.com/noxlumens/Vulnerability-Research/tree/main/CVE-2024-56917
CVE ID: CVE-2024-56918 State: PUBLISHED Published: 2025-06-24T00:00:00.000Z Last Updated: 2025-06-24T19:17:26.988Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Netbox Community 4.1.7, the login page is vulnerable to cross-site scripting (XSS), which allows a privileged, authenticated attacker to exfiltrate user input from the login form. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/netbox-community/netbox/releases/tag/v4.1.7 - https://youtu.be/GC8-PUlu2i8?si=cd_dSVno93pCisr-&t=103 - https://youtu.be/zBbjNNK79pg - https://github.com/noxlumens/Vulnerability-Research/tree/main/CVE-2024-56918
CVE ID: CVE-2024-56921 State: PUBLISHED Published: 2025-02-03T00:00:00.000Z Last Updated: 2025-03-22T13:30:33.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Open5gs v2.7.2. InitialUEMessage, Registration request sent at a specific time can crash AMF due to incorrect error handling of gmm_state_exception() function upon receipt of the Nausf_UEAuthentication_Authenticate response. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/open5gs/open5gs/issues/3608 - https://github.com/open5gs/open5gs/commit/f780f9af45c27b6f49987d96ba71dedb3dd85840
CVE ID: CVE-2024-56923 State: PUBLISHED Published: 2025-01-22T00:00:00.000Z Last Updated: 2025-01-28T22:17:20.238Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stored Cross-Site Scripting (XSS) Vulnerability in the Categorization Option of My Subscriptions Functionality in Silverpeas Core 6.3.1 <= 6.4.1 allows a remote attacker to execute arbitrary JavaScript code. This is achieved by injecting a malicious payload into the Name field of a subscription. The attack can lead to session hijacking, data theft, or unauthorized actions when an admin user views the affected subscription. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Mohamed-Saqib-C
fected subscription. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Mohamed-Saqib-C/CVEs/blob/main/CVE-2024-56923/README.md
CVE ID: CVE-2024-56924 State: PUBLISHED Published: 2025-01-22T00:00:00.000Z Last Updated: 2025-01-23T16:25:10.746Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Request Forgery (CSRF) vulnerability in Code Astro Internet banking system 2.0.0 allows remote attackers to execute arbitrary JavaScript on the admin page (pages_account), potentially leading to unauthorized actions such as changing account settings or stealing sensitive user information. This vulnerability occurs due to improper validation of user requests, which enables attackers to exploit the system by tricking the admin user into executing malicious scripts. Additional Analyst Notes: - CISA ADP Vulnrich
it the system by tricking the admin user into executing malicious scripts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ipratheep/CVE-2024-56924
CVE ID: CVE-2024-56938 State: PUBLISHED Published: 2025-02-12T00:00:00.000Z Last Updated: 2025-02-14T19:38:54.169Z Vendors: n/a Products: n/a Problem Types: n/a Description: LearnDash v6.7.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the materials-content class. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nikolas-ch/CVEs/tree/main/LearnDash_v6.7.1
CVE ID: CVE-2024-56939 State: PUBLISHED Published: 2025-02-12T00:00:00.000Z Last Updated: 2025-02-14T19:22:59.850Z Vendors: n/a Products: n/a Problem Types: n/a Description: LearnDash v6.7.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the ld-comment-body class. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nikolas-ch/CVEs/tree/main/LearnDash_v6.7.1
CVE ID: CVE-2024-56940 State: PUBLISHED Published: 2025-02-12T00:00:00.000Z Last Updated: 2025-03-13T14:21:20.406Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the profile image upload function of LearnDash v6.7.1 allows attackers to cause a Denial of Service (DoS) via excessive file uploads. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nikolas-ch/CVEs/tree/main/LearnDash_v6.7.1
CVE ID: CVE-2024-56946 State: PUBLISHED Published: 2025-02-03T00:00:00.000Z Last Updated: 2025-03-13T15:17:15.614Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AC:L/AV:N/A:L/C:N/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Denial of service in DNS-over-QUIC in Technitium DNS Server <= v13.2.2 allows remote attackers to permanently stop the server from accepting new DNS-over-QUIC connections by triggering unhandled exceptions in listener threads. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TechnitiumSoftware/DnsServer/blob/master/CHANGELOG.md#version-133 - https://github.com/TechnitiumSoftware/DnsServer/commit/a7d1cfb6e836798ef91
Server/blob/master/CHANGELOG.md#version-133 - https://github.com/TechnitiumSoftware/DnsServer/commit/a7d1cfb6e836798ef9171677bf8919cf99d9dcb0
CVE ID: CVE-2024-56947 State: PUBLISHED Published: 2025-01-27T00:00:00.000Z Last Updated: 2025-01-28T19:44:06.152Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Xiamen Meitu Technology Co., Ltd. BeautyCam iOS v12.3.60 allows attackers to access sensitive user information via supplying a crafted link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ZhouZiyi1/Vuls/blob/main/241208-BeautyCam/241208-BeautyCam.pdf
CVE ID: CVE-2024-56948 State: PUBLISHED Published: 2025-01-27T00:00:00.000Z Last Updated: 2025-01-28T19:43:54.401Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in KuGou Technology CO. LTD KuGou Music iOS v20.0.0 allows attackers to access sensitive user information via supplying a crafted link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ZhouZiyi1/Vuls/blob/main/241211-KuGouMusic/241211-KuGouMusic.pdf
CVE ID: CVE-2024-56949 State: PUBLISHED Published: 2025-01-27T00:00:00.000Z Last Updated: 2025-01-28T19:43:41.636Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Guangzhou Polar Future Culture Technology Co., Ltd University Search iOS 2.27.0 allows attackers to access sensitive user information via supplying a crafted link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ZhouZiyi1/Vuls/blob/main/241212-UniversitySearch/241212-UniversitySearch.pdf
CVE ID: CVE-2024-56950 State: PUBLISHED Published: 2025-01-27T00:00:00.000Z Last Updated: 2025-01-28T19:43:30.258Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in KuGou Technology Co., Ltd KuGou Concept iOS 4.0.61 allows attackers to access sensitive user information via supplying a crafted link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ZhouZiyi1/Vuls/blob/main/241213-KuGouConcept/241213-KuGouConcept.pdf
CVE ID: CVE-2024-56951 State: PUBLISHED Published: 2025-01-27T00:00:00.000Z Last Updated: 2025-01-28T19:43:20.197Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Hangzhou Bobo Technology Co Ltd UU Game Booster iOS 10.6.13 allows attackers to access sensitive user information via supplying a crafted link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ZhouZiyi1/Vuls/blob/main/241216-UUGameBooster/241216-UUGameBooster.pdf
CVE ID: CVE-2024-56952 State: PUBLISHED Published: 2025-01-27T00:00:00.000Z Last Updated: 2025-01-28T19:43:09.636Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Beijing Baidu Netcom Science & Technology Co Ltd Baidu Lite app (iOS version) 6.40.0 allows attackers to access user information via supplying a crafted link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ZhouZiyi1/Vuls/blob/main/241217-BaiduLite/241217-BaiduLite.pdf
CVE ID: CVE-2024-56953 State: PUBLISHED Published: 2025-01-27T00:00:00.000Z Last Updated: 2025-01-28T19:42:58.642Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Baidu (China) Co Ltd Baidu Input Method (iOS version) v12.6.13 allows attackers to access user information via supplying a crafted link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ZhouZiyi1/Vuls/blob/main/241217-BaiduInput/241217-BaiduInput.pdf
CVE ID: CVE-2024-56954 State: PUBLISHED Published: 2025-01-27T00:00:00.000Z Last Updated: 2025-01-28T19:42:48.553Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Beijing Baidu Netcom Science & Technology Co Ltd Haokan Video iOS 7.70.0 allows attackers to access sensitive user information via supplying a crafted link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ZhouZiyi1/Vuls/blob/main/241219-HaokanVideo/241219-HaokanVideo.pdf
CVE ID: CVE-2024-56955 State: PUBLISHED Published: 2025-01-27T00:00:00.000Z Last Updated: 2025-01-28T19:42:37.909Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Tencent Technology (Shenzhen) Company Limited QQMail iOS 6.6.4 allows attackers to access sensitive user information via supplying a crafted link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ZhouZiyi1/Vuls/blob/main/241220-QQMail/241220-QQMail.pdf
CVE ID: CVE-2024-56957 State: PUBLISHED Published: 2025-01-27T00:00:00.000Z Last Updated: 2025-01-28T19:42:26.521Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Kingsoft Office Software Corporation Limited WPS Office iOS 12.20.0 allows attackers to access sensitive user information via supplying a crafted link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ZhouZiyi1/Vuls/blob/main/241222-WPSOffice/241222-WPSOffice.pdf
CVE ID: CVE-2024-56959 State: PUBLISHED Published: 2025-01-27T00:00:00.000Z Last Updated: 2025-01-28T19:42:14.638Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Mashang Consumer Finance Co., Ltd Anyihua iOS 3.6.2 allows attackers to access sensitive user information via supplying a crafted link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ZhouZiyi1/Vuls/blob/main/241225-Anyihua/241225-Anyihua.pdf
CVE ID: CVE-2024-56960 State: PUBLISHED Published: 2025-01-27T00:00:00.000Z Last Updated: 2025-01-28T19:42:03.558Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Tianjin Xiaowu Information technology Co., Ltd BeiKe Holdings iOS 1.3.50 allows attackers to access sensitive user information via supplying a crafted link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ZhouZiyi1/Vuls/blob/main/241226-BeiKeHoldings/241226-BeiKeHoldings.pdf
CVE ID: CVE-2024-56962 State: PUBLISHED Published: 2025-01-27T00:00:00.000Z Last Updated: 2025-01-28T19:41:53.246Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Tencent Technology (Shanghai) Co., Ltd WeSing iOS v9.3.39 allows attackers to access sensitive user information via supplying a crafted link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ZhouZiyi1/Vuls/blob/main/241227-WeSing/241227-WeSing.pdf
CVE ID: CVE-2024-56963 State: PUBLISHED Published: 2025-01-27T00:00:00.000Z Last Updated: 2025-01-28T19:41:40.925Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Beijing Sogou Technology Development Co., Ltd Sogou Input iOS 12.2.0 allows attackers to access sensitive user information via supplying a crafted link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ZhouZiyi1/Vuls/blob/main/241228-SogouInput/241228-SogouInput.pdf
CVE ID: CVE-2024-56964 State: PUBLISHED Published: 2025-01-27T00:00:00.000Z Last Updated: 2025-01-28T19:41:27.846Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Che Hao Duo Used Automobile Agency (Beijing) Co., Ltd Guazi Used Car iOS 10.15.1 allows attackers to access sensitive user information via supplying a crafted link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ZhouZiyi1/Vuls/blob/main/241229-GuaziUsedCar/241229-GuaziUsedCar.pdf
CVE ID: CVE-2024-56965 State: PUBLISHED Published: 2025-01-27T00:00:00.000Z Last Updated: 2025-01-28T19:41:16.702Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Shanghai Shizhi Information Technology Co., Ltd Shihuo iOS 8.16.0 allows attackers to access sensitive user information via supplying a crafted link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ZhouZiyi1/Vuls/blob/main/241230-Shihuo/241230-Shihuo.pdf
CVE ID: CVE-2024-56966 State: PUBLISHED Published: 2025-01-27T00:00:00.000Z Last Updated: 2025-01-28T19:41:03.897Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Shanghai Xuan Ting Entertainment Information & Technology Co., Ltd Qidian Reader iOS 5.9.384 allows attackers to access sensitive user information via supplying a crafted link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ZhouZiyi1/Vuls/blob/main/241231-QidianReader/241231-QidianReader.pdf
CVE ID: CVE-2024-56967 State: PUBLISHED Published: 2025-01-27T00:00:00.000Z Last Updated: 2025-01-28T19:40:53.454Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Cloud Whale Interactive Technology LLC. PolyBuzz iOS 2.0.20 allows attackers to access sensitive user information via supplying a crafted link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ZhouZiyi1/Vuls/blob/main/250103-PolyBuzz/250103-PolyBuzz.pdf
CVE ID: CVE-2024-56968 State: PUBLISHED Published: 2025-01-27T00:00:00.000Z Last Updated: 2025-01-28T19:40:42.595Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Shenzhen Intellirocks Tech Co. Ltd Govee Home iOS 6.5.01 allows attackers to access sensitive user information via supplying a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ZhouZiyi1/Vuls/blob/main/250106-GoveeHome/250106-GoveeHome.pdf
CVE ID: CVE-2024-56969 State: PUBLISHED Published: 2025-01-27T00:00:00.000Z Last Updated: 2025-01-28T19:40:32.874Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Pixocial Technology (Singapore) Pte. Ltd BeautyPlus iOS 7.8.010 allows attackers to access sensitive user information via supplying a crafted link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ZhouZiyi1/Vuls/blob/main/250107-BeautyPlus/250107-BeautyPlus.pdf
CVE ID: CVE-2024-56971 State: PUBLISHED Published: 2025-01-27T00:00:00.000Z Last Updated: 2025-01-28T19:40:21.094Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Zhiyuan Yuedu (Guangzhou) Literature Information Technology Co., Ltd Shuqi Novel iOS 5.3.8 allows attackers to access sensitive user information via supplying a crafted link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ZhouZiyi1/Vuls/blob/main/250108-ShuqiNovel/250108-ShuqiNovel.pdf
CVE ID: CVE-2024-56972 State: PUBLISHED Published: 2025-01-27T00:00:00.000Z Last Updated: 2025-01-28T19:40:11.318Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Midea Group Co., Ltd Midea Home iOS 9.3.12 allows attackers to access sensitive user information via supplying a crafted link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ZhouZiyi1/Vuls/blob/main/250109-MideaHome/250109-MideaHome.pdf
CVE ID: CVE-2024-56973 State: PUBLISHED Published: 2025-02-14T00:00:00.000Z Last Updated: 2025-02-28T17:07:34.308Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure Permissions vulnerability in Alvaria, Inc Unified IP Unified Director before v.7.2SP2 allows a remote attacker to execute arbitrary code via the source and filename parameters to the ProcessUploadFromURL.jsp component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/VAMorales/1092a29ac7d0b4b80d5c853b9a22a65d
CVE ID: CVE-2024-56975 State: PUBLISHED Published: 2025-03-28T00:00:00.000Z Last Updated: 2025-04-01T20:05:40.258Z Vendors: n/a Products: n/a Problem Types: n/a Description: InvoicePlane (all versions tested as of December 2024) v.1.6.11 and before contains a remote code execution vulnerability in the upload_file method of the Upload controller. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/InvoicePlane/InvoicePlane/pull/1166 - https://github.com/InvoicePlane/InvoicePlane/pull/1127
CVE ID: CVE-2024-56990 State: PUBLISHED Published: 2025-01-21T00:00:00.000Z Last Updated: 2025-02-04T15:21:16.480Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPGurukul Hospital Management System 4.0 is vulnerable to Cross Site Scripting (XSS) in /view-medhistory.php and /admin/view-patient.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kirito999/HMS_stored_XSS/blob/main/stored%20XSS1%20%20in%20HMS4.0/stored%20XSS%20%20in%20HMS.md
CVE ID: CVE-2024-56997 State: PUBLISHED Published: 2025-01-21T00:00:00 Last Updated: 2025-01-21T19:51:55.805Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPGurukul Hospital Management System 4.0 is vulnerable to Cross Site Scripting (XSS) in /doctor/index.php via the 'Email' parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kirito999/HMS_stored_XSS/blob/main/stored%20XSS5%20in%20HMS4.0/stored%20XSS5%20in%20HMS.md
CVE ID: CVE-2024-56998 State: PUBLISHED Published: 2025-01-21T00:00:00 Last Updated: 2025-01-21T19:46:45.149Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPGurukul Hospital Management System 4.0 is vulnerable to Cross Site Scripting (XSS) in /edit-profile.php via the parameter $address. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kirito999/HMS_stored_XSS/blob/main/stored%20XSS2%20in%20HMS4.0/stored%20XSS2%20in%20HMS.md
CVE ID: CVE-2024-57000 State: REJECTED Published: 2025-02-11T00:00:00.000Z Last Updated: 2025-02-14T17:39:58.804Z Description: No description available.
CVE ID: CVE-2024-57004 State: PUBLISHED Published: 2025-02-03T00:00:00.000Z Last Updated: 2025-02-12T19:18:08.984Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail 1.6.9 allows remote authenticated users to upload a malicious file as an email attachment, leading to the triggering of the XSS by visiting the SENT session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/roundcube/roundcubemail/releases/tag/1.6.9 - https://github.com/riya98241/CVE/blob/main/CVE-2024-57004
CVE ID: CVE-2024-57011 State: PUBLISHED Published: 2025-01-15T00:00:00.000Z Last Updated: 2025-03-17T16:36:55.357Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "minute" parameters in setScheduleCfg. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.totolink.net/ - https://github.com/tiger5671/Vulnerabilities/blob/main/TOTOLINK%20X5000R/setScheduleCfg/setScheduleCfg.md