Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-11624 State: PUBLISHED Published: 2025-01-03T03:28:22.231Z Last Updated: 2025-01-03T22:52:26.983Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: there is a possible to add apps to bypass VPN due to Undeclared Permission . This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-12-01
CVE ID: CVE-2024-11625 State: PUBLISHED Published: 2025-01-07T07:48:32.620Z Last Updated: 2025-01-07T15:38:00.465Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: Progress Software Corporation Products: Sitefinity Problem Types: CWE-209 Description: Information Exposure Through an Error Message vulnerability in Progress Software Corporation Sitefinity.This issue affects Sitefinity: from 4.0 through 14.4.8142, from 15.0.8200 through 15.0.8229, from 15.1.8300 through 15.1.8327, from 15.2.8400 through 15.2.8421. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.progress.com/sitefinity-cms - https://community.progress.com/s/article/Sitef
ADP Vulnrichment: References: - https://www.progress.com/sitefinity-cms - https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2024-11625-and-CVE-2024-11626-January-2025
CVE ID: CVE-2024-11626 State: PUBLISHED Published: 2025-01-07T07:49:01.805Z Last Updated: 2025-01-07T15:37:28.107Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: Progress Software Corporation Products: Sitefinity Problem Types: CWE-79 Description: Improper Neutralization of Input During CMS Backend (adminstrative section) Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Progress Sitefinity.This issue affects Sitefinity: from 4.0 through 14.4.8142, from 15.0.8200 through 15.0.8229, from 15.1.8300 through 15.1.8327, from 15.2.8400 through 15.2.8421. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.progress.com/sit
.2.8400 through 15.2.8421. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.progress.com/sitefinity-cms - https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2024-11625-and-CVE-2024-11626-January-2025
CVE ID: CVE-2024-11627 State: PUBLISHED Published: 2025-01-07T07:49:29.209Z Last Updated: 2025-01-07T15:36:18.738Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Progress Products: Sitefinity Problem Types: CWE-613 Description: : Insufficient Session Expiration vulnerability in Progress Sitefinity allows : Session Fixation.This issue affects Sitefinity: from 4.0 through 14.4.8142, from 15.0.8200 through 15.0.8229, from 15.1.8300 through 15.1.8327, from 15.2.8400 through 15.2.8421. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.progress.com/sitefinity-cms - https://community.progress.com/s/article/Sitefinity-Security-Advisory-fo
es: - https://www.progress.com/sitefinity-cms - https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2024-11625-and-CVE-2024-11626-January-2025
CVE ID: CVE-2024-11628 State: PUBLISHED Published: 2025-02-12T16:17:38.869Z Last Updated: 2025-02-12T19:06:31.802Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: Progress Software Products: Progress® Telerik® Kendo UI for Vue Problem Types: CWE-1321 Description: In Progress® Telerik® Kendo UI for Vue versions v2.4.0 through v6.0.1, an attacker can introduce or modify properties within the global prototype chain which can result in denial of service or command injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.telerik.com/kendo-vue-ui/components/knowledge-base/kb-security-protoype-pollution-2024-11628
CVE ID: CVE-2024-11629 State: PUBLISHED Published: 2025-02-12T16:21:52.058Z Last Updated: 2025-02-12T19:05:31.058Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) Vendors: Progress Software Products: Progress® Telerik® Document Processing Libraries Problem Types: CWE-552 Description: In Progress® Telerik® Document Processing Libraries, versions prior to 2025 Q1 (2025.1.205), using .NET Standard 2.0, the contents of a file at an arbitrary path can be exported to RTF. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.telerik.com/devtools/document-processing/knowledge-base/kb-security-rtf-filecontent-export-cve-2024-11629
CVE ID: CVE-2024-11630 State: PUBLISHED Published: 2024-11-22T22:00:07.324Z Last Updated: 2024-11-25T21:23:06.245Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: E-Lins Products: H685, H685f, H700, H720, H750, H820, H820Q, H820Q0, H900 Problem Types: CWE-798, CWE-259 Description: A vulnerability has been found in E-Lins H685, H685f, H700, H720, H750, H820, H820Q, H820Q0 and H900 up to 3.2 and classified as critical. This vulnerability affects unknown code of the component OEM Backend. The manipulation leads to hard-coded credentials. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration
d remotely. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.285916 - https://vuldb.com/?ctiid.285916 - https://vuldb.com/?submit.444738 - https://github.com/I3eg1nner/iot-vuln/blob/main/E-lins/Hard-Coded%20Credential%20Vulnerability%20in%20E-Lins%20Routers.md
CVE ID: CVE-2024-11631 State: PUBLISHED Published: 2024-11-23T11:31:04.878Z Last Updated: 2024-11-26T15:55:44.469Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: Tailoring Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in itsourcecode Tailoring Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /expedit.php. The manipulation of the argument expcat leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.285917 -
public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.285917 - https://vuldb.com/?ctiid.285917 - https://vuldb.com/?submit.446290 - https://github.com/sil3n/cve/issues/1 - https://itsourcecode.com/
CVE ID: CVE-2024-11632 State: PUBLISHED Published: 2024-11-23T13:31:03.961Z Last Updated: 2024-11-26T16:11:24.862Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: code-projects Products: Simple Car Rental System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Simple Car Rental System 1.0. It has been classified as critical. Affected is an unknown function of the file /book_car.php. The manipulation of the argument fname/id_no/gender/email/phone/location leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory only mentions the parameter
he exploit has been disclosed to the public and may be used. The initial researcher advisory only mentions the parameter "fname" to be affected. Further analysis indicates that other arguments might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.285918 - https://vuldb.com/?ctiid.285918 - https://vuldb.com/?submit.446308 - https://github.com/sil3n/cve/issues/2 - https://code-projects.org/
CVE ID: CVE-2024-11633 State: PUBLISHED Published: 2024-12-10T18:47:55.575Z Last Updated: 2024-12-14T04:55:15.649Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: Connect Secure Problem Types: CWE-88 Description: Argument injection in Ivanti Connect Secure before version 22.7R2.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/December-2024-Security-Advisory-Ivanti-Connect-Secure-ICS-and-Ivanti-Policy-Secure-IPS-Multiple-CVEs
CVE ID: CVE-2024-11634 State: PUBLISHED Published: 2024-12-10T18:48:29.024Z Last Updated: 2024-12-14T04:55:16.905Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: Connect Secure, Policy Secure Problem Types: CWE-77 Description: Command injection in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin privileges to achieve remote code execution. (Not applicable to 9.1Rx) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/December-2024-Security-Advisory-Ivanti-Connect-Secure-ICS-and-Ivanti-Policy-Secur
- https://forums.ivanti.com/s/article/December-2024-Security-Advisory-Ivanti-Connect-Secure-ICS-and-Ivanti-Policy-Secure-IPS-Multiple-CVEs
CVE ID: CVE-2024-11635 State: PUBLISHED Published: 2025-01-08T07:18:38.747Z Last Updated: 2025-01-08T14:17:39.138Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: nickboss Products: WordPress File Upload Problem Types: CWE-94 Description: The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.24.12 via the 'wfu_ABSPATH' cookie parameter. This makes it possible for unauthenticated attackers to execute code on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b5165f60-6515-4a2c-a124-cc88155eaf01?source=cv
: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b5165f60-6515-4a2c-a124-cc88155eaf01?source=cve - https://plugins.svn.wordpress.org/wp-file-upload/trunk/wfu_file_downloader.php
CVE ID: CVE-2024-11636 State: PUBLISHED Published: 2025-01-13T06:00:00.902Z Last Updated: 2025-01-13T14:56:40.111Z Vendors: Unknown Products: Email Subscribers by Icegram Express Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of its Text Block options, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/da616c20-3d74-4d3a-95f5-2d71d9ada094/
CVE ID: CVE-2024-11637 State: REJECTED Published: N/A Last Updated: 2025-01-14T01:10:43.297Z Description: No description available.
CVE ID: CVE-2024-11638 State: PUBLISHED Published: 2025-03-10T06:00:01.257Z Last Updated: 2025-08-27T12:00:28.365Z Vendors: Unknown Products: Gtbabel Problem Types: CWE-201 Insertion of Sensitive Information Into Sent Data Description: The Gtbabel WordPress plugin before 6.6.9 does not ensure that the URL to perform code analysis upon belongs to the blog which could allow unauthenticated attackers to retrieve a logged in user (such as admin) cookies by making them open a crafted URL as the request made to analysed the URL contains such cookies. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2f20336f-e12e-4b09-bcaf-45f7249f6495/
CVE ID: CVE-2024-11639 State: PUBLISHED Published: 2024-12-10T18:54:43.368Z Last Updated: 2024-12-14T04:55:11.739Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: Cloud Services Application Problem Types: CWE-288 Description: An authentication bypass in the admin web console of Ivanti CSA before 5.0.3 allows a remote unauthenticated attacker to gain administrative access Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Services-Application-CSA-CVE-2024-11639-CVE-2024-11772-CVE-2024-11773
CVE ID: CVE-2024-11640 State: PUBLISHED Published: 2025-03-08T11:16:40.090Z Last Updated: 2025-03-11T16:07:21.672Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: e4jvikwp Products: VikRentCar Car Rental Management System Problem Types: CWE-352 Description: The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.2. This is due to missing or incorrect nonce validation on the 'save' function. This makes it possible for unauthenticated attackers to change plugin access privileges via a forged request granted they can trick a site administrator into performing an action
nge plugin access privileges via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Successful exploitation allows attackers with subscriber-level privileges and above to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4a4c085a-1601-4c1a-ac17-0f2cf5d02489?source=cve - https://plugins.trac.wordpress.org/changeset/3225040/vikrentcar
CVE ID: CVE-2024-11641 State: PUBLISHED Published: 2025-01-26T11:09:44.807Z Last Updated: 2025-01-27T15:32:00.248Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: e4jvikwp Products: VikBooking Hotel Booking Engine & PMS Problem Types: CWE-352 Description: The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.2. This is due to missing or incorrect nonce validation on the 'save' function. This makes it possible for unauthenticated attackers to change plugin access privileges via a forged request granted they can trick a site administrator into performing an action such
plugin access privileges via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Successful exploitation allows attackers with subscriber-level privileges and above to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6eb6611d-7a4b-4ca8-b9cc-c156437e89b5?source=cve - https://plugins.trac.wordpress.org/changeset/3225861/vikbooking
CVE ID: CVE-2024-11642 State: PUBLISHED Published: 2025-01-09T11:11:03.716Z Last Updated: 2025-01-09T14:29:18.616Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: mdshuvo Products: Post Grid Master – Custom Post Types, Taxonomies & Ajax Filter Everything with Infinite Scroll, Load More, Pagination & Shortcode Builder Problem Types: CWE-22 Description: The Post Grid Master – Custom Post Types, Taxonomies & Ajax Filter Everything with Infinite Scroll, Load More, Pagination & Shortcode Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.4.12 via the 'locate_template' function. This makes it possible for u
Inclusion in all versions up to, and including, 3.4.12 via the 'locate_template' function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. The file included must have a .php extension. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b299a932-8167-4547-845b-637c4971360d?source=cve - https://plugins.trac.wordpress.org/browser/ajax-filter
nerabilities/id/b299a932-8167-4547-845b-637c4971360d?source=cve - https://plugins.trac.wordpress.org/browser/ajax-filter-posts/tags/3.4.12/inc/Shortcode.php#L624
CVE ID: CVE-2024-11643 State: PUBLISHED Published: 2024-12-04T15:22:21.468Z Last Updated: 2024-12-04T16:45:07.627Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: allaccessible Products: Accessibility by AllAccessible Problem Types: CWE-862 Description: The Accessibility by AllAccessible plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'AllAccessible_save_settings' function in all versions up to, and including, 1.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. T
or authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bb65d916-7d9e-4562-ab9b-c7ba012a08fb?source=cve - https://plugins.trac.wordpress.org/browser/allaccessible/trunk/allaccessible.php#L249 - https://plugins.trac.wordpress.org/changeset/3202017/
CVE ID: CVE-2024-11644 State: PUBLISHED Published: 2024-12-27T06:00:10.039Z Last Updated: 2024-12-27T18:29:14.978Z Vendors: Unknown Products: WP-SVG Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP-SVG WordPress plugin through 0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5b6a80f1-369c-4dd2-877e-60b724084819/
CVE ID: CVE-2024-11645 State: PUBLISHED Published: 2024-12-27T06:00:13.190Z Last Updated: 2024-12-27T18:27:44.874Z Vendors: Unknown Products: float block Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The float block WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7771a76b-bc8c-426f-a125-5bd74ccf2845/
CVE ID: CVE-2024-11646 State: PUBLISHED Published: 2024-11-24T23:31:04.333Z Last Updated: 2024-11-26T15:54:50.717Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: 1000 Projects Products: Beauty Parlour Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in 1000 Projects Beauty Parlour Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/edit-services.php. The manipulation of the argument sername leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
he exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.285967 - https://vuldb.com/?ctiid.285967 - https://vuldb.com/?submit.446575 - https://github.com/ppp-src/CVE/issues/33 - https://1000projects.org/
CVE ID: CVE-2024-11647 State: PUBLISHED Published: 2024-11-25T00:31:06.139Z Last Updated: 2024-11-26T15:54:08.727Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: 1000 Projects Products: Beauty Parlour Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in 1000 Projects Beauty Parlour Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/view-appointment.php. The manipulation of the argument viewid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichm
d remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.285968 - https://vuldb.com/?ctiid.285968 - https://vuldb.com/?submit.446576 - https://github.com/ppp-src/CVE/issues/34 - https://1000projects.org/
CVE ID: CVE-2024-11648 State: PUBLISHED Published: 2024-11-25T01:00:14.754Z Last Updated: 2024-11-26T15:52:49.193Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: 1000 Projects Products: Beauty Parlour Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in 1000 Projects Beauty Parlour Management System 1.0. This affects an unknown part of the file /admin/add-customer.php. The manipulation of the argument name leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https
has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.285969 - https://vuldb.com/?ctiid.285969 - https://vuldb.com/?submit.447291 - https://github.com/Calmgh/CVE/issues/1 - https://1000projects.org/
CVE ID: CVE-2024-11649 State: PUBLISHED Published: 2024-11-25T01:31:04.325Z Last Updated: 2024-11-26T21:30:48.630Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: 1000 Projects Products: Beauty Parlour Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in 1000 Projects Beauty Parlour Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/search-appointment.php. The manipulation of the argument searchdata leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
e exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.285970 - https://vuldb.com/?ctiid.285970 - https://vuldb.com/?submit.451245 - https://github.com/zgaz/CVE/issues/1 - https://1000projects.org/
CVE ID: CVE-2024-11650 State: PUBLISHED Published: 2024-11-25T02:00:15.883Z Last Updated: 2024-11-25T19:18:13.718Z Severity: N/A (CVSS 6.8 AV:N/AC:L/Au:S/C:N/I:N/A:C) Vendors: Tenda Products: i9 Problem Types: CWE-476, CWE-404 Description: A vulnerability was found in Tenda i9 1.0.0.8(3828) and classified as critical. This issue affects the function websReadEvent of the file /goform/GetIPTV. The manipulation leads to null pointer dereference. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.285971 - https://vuldb.com/?ctiid.285971 - https://vuldb.com/?subm
ADP Vulnrichment: References: - https://vuldb.com/?id.285971 - https://vuldb.com/?ctiid.285971 - https://vuldb.com/?submit.446592 - https://github.com/xiaobor123/tenda-vul-i9 - https://www.tenda.com.cn/