Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-6393 State: PUBLISHED Published: 2024-11-25T06:00:06.473Z Last Updated: 2024-11-25T13:59:53.746Z Vendors: Unknown Products: Photo Gallery, Sliders, Proofing and Themes Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.5 does not sanitise and escape some of its Images settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/126d1dd7-d332-47c8-ad25-5fbe211313b0/
CVE ID: CVE-2024-6394 State: PUBLISHED Published: 2024-09-30T08:09:10.169Z Last Updated: 2024-10-01T14:30:23.314Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: parisneo Products: parisneo/lollms-webui Problem Types: CWE-29 Description: A Local File Inclusion vulnerability exists in parisneo/lollms-webui versions below v9.8. The vulnerability is due to unverified path concatenation in the `serve_js` function in `app.py`, which allows attackers to perform path traversal attacks. This can lead to unauthorized access to arbitrary files on the server, potentially exposing sensitive information such as private SSH keys, configuration files, and source code. Additi
erver, potentially exposing sensitive information such as private SSH keys, configuration files, and source code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/6df4f990-b632-4791-b3ea-f40c9ea905bf
CVE ID: CVE-2024-6395 State: PUBLISHED Published: 2024-07-16T21:27:10.901Z Last Updated: 2024-08-01T21:41:03.389Z Vendors: GitHub Products: GitHub Enterprise Server Problem Types: CWE-200 Description: An exposure of sensitive information vulnerability in GitHub Enterprise Server would allow an attacker to enumerate the names of private repositories that utilize deploy keys. This vulnerability did not allow unauthorized access to any repository content besides the name. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.13.1, 3.12.6, 3.11.12, 3.10.14, and 3.9.17. This vulnerability was reported via the GitHub Bug Bounty program. Addi
ns 3.13.1, 3.12.6, 3.11.12, 3.10.14, and 3.9.17. This vulnerability was reported via the GitHub Bug Bounty program. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://help.github.com/enterprise-server@3.10/admin/release-notes#3.10.15 - https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.12 - https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.6 - https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.1 - https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.17
CVE ID: CVE-2024-6396 State: PUBLISHED Published: 2024-07-12T00:00:14.599Z Last Updated: 2024-08-01T21:41:03.285Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: aimhubio Products: aimhubio/aim Problem Types: CWE-29 Description: A vulnerability in the `_backup_run` function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any file on the host server and exfiltrate arbitrary data. The vulnerability arises due to improper handling of the `run_hash` and `repo.path` parameters, which can be manipulated to create and write to arbitrary file paths. This can lead to denial of service by overwriting critical system files, loss of private data, a
o arbitrary file paths. This can lead to denial of service by overwriting critical system files, loss of private data, and potential remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/c1b17afd-4656-47bb-8310-686a9e1b04a0
CVE ID: CVE-2024-6397 State: PUBLISHED Published: 2024-07-11T03:33:19.573Z Last Updated: 2024-08-01T21:41:03.350Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: instawp Products: InstaWP Connect – 1-click WP Staging & Migration Problem Types: CWE-288 Authentication Bypass Using an Alternate Path or Channel Description: The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 0.1.0.44. This is due to insufficient verification of the API key. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, i
makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username, and to perform a variety of other administrative tasks. NOTE: This vulnerability was partially fixed in 0.1.0.44, but was still exploitable via Cross-Site Request Forgery. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/963f2485-3afa-4e17-8278-b75415af3915?source=cve - https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.0.43/includes/class-instawp-hooks.php#L28 - https://plugins.trac.wordpress.org/browser/instawp-connect/tag
nect/tags/0.1.0.43/includes/class-instawp-hooks.php#L28 - https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.0.43/includes/class-instawp-hooks.php#L40 - https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.0.43/includes/apis/class-instawp-rest-api.php#L256 - https://plugins.trac.wordpress.org/changeset/3109305/ - https://plugins.trac.wordpress.org/changeset/3114674/
CVE ID: CVE-2024-6398 State: PUBLISHED Published: 2024-07-15T08:52:24.973Z Last Updated: 2024-08-01T21:41:03.325Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Skyhigh Products: Secure Web Gateway Problem Types: CWE-200 Description: An information disclosure vulnerability in SWG in versions 12.x prior to 12.2.10 and 11.x prior to 11.2.24 allows information stored in a customizable block page to be disclosed to third-party websites due to Same Origin Policy Bypass of browsers in certain scenarios. The risk is low, because other recommended default security policies such as URL categorization and GTI are in place in most policies to block access to uncategor
default security policies such as URL categorization and GTI are in place in most policies to block access to uncategorized/high risk websites. Any information disclosed depends on how the customers have customized the block pages. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://thrive.trellix.com/s/article/000013694
CVE ID: CVE-2024-6400 State: PUBLISHED Published: 2024-10-04T11:12:30.441Z Last Updated: 2025-10-14T12:55:46.692Z Vendors: Finrota Products: Netahsilat Problem Types: CWE-312, CWE-202 Description: Cleartext Storage of Sensitive Information, Exposure of Sensitive Information Through Data Queries vulnerability in Finrota Netahsilat allows Retrieve Embedded Sensitive Data, Authentication Bypass, IMAP/SMTP Command Injection, Collect Data from Common Resource Locations. This issue solved in versions 1.21.10, 1.23.01, 1.23.08, 1.23.11 and 1.24.03. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1611
CVE ID: CVE-2024-6401 State: PUBLISHED Published: 2024-09-16T14:55:26.359Z Last Updated: 2024-09-16T15:19:30.834Z Vendors: SFS Consulting Products: InsureE GL Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SFS Consulting InsureE GL allows SQL Injection.This issue affects InsureE GL: before 4.6.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1475
CVE ID: CVE-2024-6402 State: PUBLISHED Published: 2024-06-28T17:00:05.443Z Last Updated: 2024-08-01T21:41:03.185Z Severity: N/A (CVSS 6.8 AV:N/AC:L/Au:S/C:N/I:N/A:C) Vendors: Tenda Products: A301 Problem Types: CWE-121 Description: A vulnerability classified as critical was found in Tenda A301 15.13.08.12. Affected by this vulnerability is the function fromSetWirelessRepeat of the file /goform/SetOnlineDevName. The manipulation of the argument devName leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269947. NOTE: The vendor was contacted early about t
may be used. The associated identifier of this vulnerability is VDB-269947. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.269947 - https://vuldb.com/?ctiid.269947 - https://vuldb.com/?submit.360696 - https://github.com/General-Offensive/iot_vuldb/blob/main/Tenda/A301/formSetDeviceName_devName.md
CVE ID: CVE-2024-6403 State: PUBLISHED Published: 2024-06-28T17:00:07.083Z Last Updated: 2024-08-01T21:41:03.307Z Severity: N/A (CVSS 6.8 AV:N/AC:L/Au:S/C:N/I:N/A:C) Vendors: Tenda Products: A301 Problem Types: CWE-121 Description: A vulnerability, which was classified as critical, has been found in Tenda A301 15.13.08.12. Affected by this issue is the function formWifiBasicSet of the file /goform/SetOnlineDevName. The manipulation of the argument devName leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-269948. NOTE: The vendor was contacted early about this dis
and may be used. The identifier of this vulnerability is VDB-269948. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.269948 - https://vuldb.com/?ctiid.269948 - https://vuldb.com/?submit.360752 - https://github.com/General-Offensive/iot_vuldb/blob/main/Tenda/A301/formSetDeviceName_devName.md
CVE ID: CVE-2024-6405 State: PUBLISHED Published: 2024-06-29T02:02:57.630Z Last Updated: 2024-08-01T21:41:03.309Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: bhagirath25 Products: Floating Social Buttons Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Floating Social Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the floating_social_buttons_option() function. This makes it possible for unauthenticated attackers to update the plugins settings and inject malicious web scripts via a forged request granted the
authenticated attackers to update the plugins settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/befe5e99-204e-470e-bbbb-285b5ba0b1fb?source=cve - https://plugins.trac.wordpress.org/browser/floating-social-buttons/trunk/floating-social-buttons.php#L230
CVE ID: CVE-2024-6406 State: PUBLISHED Published: 2024-09-18T11:44:17.558Z Last Updated: 2025-10-14T12:58:15.338Z Vendors: Yordam Information Technology Products: Mobile Library Application Problem Types: CWE-306, CWE-862 Description: Missing Authentication for Critical Function, Missing Authorization vulnerability in Yordam Information Technology Mobile Library Application allows Retrieve Embedded Sensitive Data.This issue affects Mobile Library Application: before 5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1496
CVE ID: CVE-2024-6407 State: PUBLISHED Published: 2024-07-11T09:07:40.422Z Last Updated: 2024-08-01T21:41:03.280Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: Wiser Home Controller WHC-5918A Problem Types: CWE-200 Description: CWE-200: Information Exposure vulnerability exists that could cause disclosure of credentials when a specially crafted message is sent to the device. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-191-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-191-01.pdf
CVE ID: CVE-2024-6408 State: PUBLISHED Published: 2024-07-31T06:00:03.358Z Last Updated: 2024-07-31T13:30:13.727Z Vendors: Unknown Products: Slider by 10Web Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Slider by 10Web WordPress plugin before 1.2.57 does not sanitise and escape its Slider Title, which could allow high privilege users such as editors and above to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/31aaeffb-a752-4941-9d0f-1b374fbc7abb/
CVE ID: CVE-2024-6409 State: PUBLISHED Published: 2024-07-08T17:57:10.517Z Last Updated: 2025-11-11T16:04:08.572Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat OpenShift Container Platform 4.13, Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 4.15, Red Hat OpenShift Container Platform 4.16, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 Problem Types: CWE-364 Description: A race condition vulnera
x 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 Problem Types: CWE-364 Description: A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). As a consequence of a successful attack, in the worst case scenario, an attacker may be able to perform a remote code execution (RCE) as an unprivileged user running the sshd server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: -
user running the sshd server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:4457 - https://access.redhat.com/errata/RHSA-2024:4613 - https://access.redhat.com/errata/RHSA-2024:4716 - https://access.redhat.com/errata/RHSA-2024:4910 - https://access.redhat.com/errata/RHSA-2024:4955 - https://access.redhat.com/errata/RHSA-2024:4960 - https://access.redhat.com/errata/RHSA-2024:5444 - https://access.redhat.com/security/cve/CVE-2024-6409 - https://bugzilla.redhat.com/show_bug.cgi?id=2295085
CVE ID: CVE-2024-6410 State: PUBLISHED Published: 2024-07-10T04:31:30.743Z Last Updated: 2024-08-01T21:41:03.305Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: metagauss Products: ProfileGrid – User Profiles, Groups and Communities Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.8.9 via the 'pm_upload_image' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and abov
tion on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the profile picture of any user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8679f4cd-2cb8-48ad-a531-a00c1b85ed2e?source=cve - https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/public/js/profile-magic-admin-power.js#L361 - https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/public/js/profile-magic-admin-power.js#L390 - https://plugins.trac.wordpress.org/changeset/311
ups-and-communities/trunk/public/js/profile-magic-admin-power.js#L390 - https://plugins.trac.wordpress.org/changeset/3111609/profilegrid-user-profiles-groups-and-communities/trunk/public/partials/crop.php
CVE ID: CVE-2024-6411 State: PUBLISHED Published: 2024-07-10T04:31:30.117Z Last Updated: 2024-08-01T21:41:03.291Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: metagauss Products: ProfileGrid – User Profiles, Groups and Communities Problem Types: CWE-269 Improper Privilege Management Description: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.8.9. This is due to a lack of validation on user-supplied data in the 'pm_upload_image' AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update their user
action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update their user capabilities to Administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2ef3c7fb-27f5-4829-8cb6-d3a52778a689?source=cve - https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/public/js/profile-magic-admin-power.js#L361 - https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/public/js/profile-magic-admin-power.js#L390 - https://plugins.trac.wordpress.org/browser/profilegrid-user-pr
ities/trunk/public/js/profile-magic-admin-power.js#L390 - https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/public/partials/crop.php - https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/public/partials/coverimg_crop.php - https://plugins.trac.wordpress.org/changeset/3111609/
CVE ID: CVE-2024-6412 State: PUBLISHED Published: 2024-07-31T06:00:04.014Z Last Updated: 2024-08-01T17:41:48.337Z Vendors: Unknown Products: HTML Forms Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The HTML Forms WordPress plugin before 1.3.34 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/9eb0dad6-3c19-4fe4-a20d-d45b51410444/
CVE ID: CVE-2024-6413 State: REJECTED Published: N/A Last Updated: 2024-11-15T15:14:52.065Z Description: No description available.
CVE ID: CVE-2024-6414 State: PUBLISHED Published: 2024-06-30T03:00:05.780Z Last Updated: 2024-08-01T21:41:03.179Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Parsec Automation Products: TrakSYS Problem Types: CWE-425 Description: A vulnerability classified as problematic has been found in Parsec Automation TrakSYS 11.x.x. Affected is an unknown function of the file TS/export/contentpage of the component Export Page. The manipulation of the argument ID leads to direct request. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-270000. NOTE: The vendor was
been disclosed to the public and may be used. The identifier of this vulnerability is VDB-270000. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.270000 - https://vuldb.com/?ctiid.270000 - https://vuldb.com/?submit.361518 - https://kiwiyumi.com/post/traksys-export-page-code/
CVE ID: CVE-2024-6415 State: PUBLISHED Published: 2024-06-30T04:00:05.417Z Last Updated: 2024-08-01T21:41:03.212Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: Ingenico Products: Estate Manager Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in Ingenico Estate Manager 2023. Affected by this vulnerability is an unknown functionality of the file /emgui/rest/preferences/PREF_HOME_PAGE/sponsor/3/ of the component New Widget Handler. The manipulation of the argument URL leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-270001 was assigned to this
d remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-270001 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.270001 - https://vuldb.com/?ctiid.270001 - https://vuldb.com/?submit.362344 - https://gentle-khaan-c53.notion.site/Self-Reflected-XSS-in-Ingenico-The-Estate-Manager-94b4c85ffe074c6b870a6454f73edaf4?pvs=4
CVE ID: CVE-2024-6416 State: PUBLISHED Published: 2024-06-30T22:00:09.723Z Last Updated: 2024-08-01T21:41:03.341Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: SeaCMS Problem Types: CWE-89 Description: A vulnerability was found in SeaCMS 12.9. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /js/player/dmplayer/dmku/?ac=edit. The manipulation of the argument cid with the input (select(0)from(select(sleep(10)))v) leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-270007. Additional An
en disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-270007. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.270007 - https://vuldb.com/?ctiid.270007 - https://vuldb.com/?submit.363407 - https://fushuling.com/index.php/2024/06/24/test4/
CVE ID: CVE-2024-6417 State: PUBLISHED Published: 2024-06-30T22:31:04.420Z Last Updated: 2024-08-01T21:41:03.347Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Simple Online Bidding System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/ajax.php?action=delete_user. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-270008. Additional Anal
it has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-270008. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.270008 - https://vuldb.com/?ctiid.270008 - https://vuldb.com/?submit.365234 - https://github.com/xyj123a/cve/blob/main/sql.md