Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/718d12fe-31e4-4fa1-ba9a-8626df8ddbfe?source=cve - https://memberpress.com/change-log/#1.11.30
CVE ID: CVE-2024-5025 State: PUBLISHED Published: 2024-05-22T08:31:23.337Z Last Updated: 2024-08-01T21:03:09.682Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: MemberPress Products: Memberpress Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Memberpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘arglist’ parameter in all versions up to, and including, 1.11.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages
possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f147641a-f430-4743-901e-539373dc10b7?source=cve - https://memberpress.com/change-log/
CVE ID: CVE-2024-5026 State: PUBLISHED Published: 2025-05-15T20:07:05.629Z Last Updated: 2025-05-20T19:25:28.986Z Vendors: Unknown Products: CM Tooltip Glossary Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The CM Tooltip Glossary WordPress plugin before 4.3.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a86584f6-119b-45c3-bc6e-dc18e3501db7/
CVE ID: CVE-2024-5028 State: PUBLISHED Published: 2024-07-13T06:00:07.447Z Last Updated: 2024-08-01T21:03:09.657Z Vendors: Unknown Products: CM WordPress Search And Replace Plugin Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The CM WordPress Search And Replace Plugin WordPress plugin before 1.3.9 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/0bae8494-7b01-4203-a4f7-ccc60efbdda7/
CVE ID: CVE-2024-5029 State: PUBLISHED Published: 2024-11-21T06:00:07.135Z Last Updated: 2024-11-21T21:48:56.832Z Vendors: Unknown Products: CM Table Of Contents Problem Types: CWE-352 Cross-Site Request Forgery (CSRF), CWE-79 Cross-Site Scripting (XSS) Description: The CM Table Of Contents WordPress plugin before 1.2.4 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f0f4a33c-9dd2-45ee-82e7-4b8bc2c20094/
CVE ID: CVE-2024-5030 State: PUBLISHED Published: 2024-11-18T06:00:01.043Z Last Updated: 2024-11-18T13:57:03.418Z Vendors: Unknown Products: CM Table Of Contents Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The CM Table Of Contents WordPress plugin before 1.2.3 does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admin perform such action via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2c2e994c-31bd-4de4-9480-b86f980d4130/
CVE ID: CVE-2024-5031 State: PUBLISHED Published: 2024-05-22T08:31:22.401Z Last Updated: 2024-08-01T21:03:09.667Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) Vendors: MemberPress Products: Memberpress Problem Types: CWE-918 Server-Side Request Forgery (SSRF) Description: The Memberpress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.11.29 via the 'mepr-user-file' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from inte
ts to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/80064e3b-6996-49eb-a475-0ffe0e894f9e?source=cve - https://memberpress.com/change-log/
CVE ID: CVE-2024-5032 State: PUBLISHED Published: 2024-07-13T06:00:07.731Z Last Updated: 2024-08-01T21:03:09.647Z Vendors: Unknown Products: SULly Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The SULly WordPress plugin before 4.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/4bb92693-23b3-4250-baee-af38b7e615e0/
CVE ID: CVE-2024-5033 State: PUBLISHED Published: 2024-07-13T06:00:08.044Z Last Updated: 2024-08-01T21:03:09.723Z Vendors: Unknown Products: SULly Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The SULly WordPress plugin before 4.3.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/dd42765a-1300-453f-9835-6e646c87e496/
CVE ID: CVE-2024-5034 State: PUBLISHED Published: 2024-07-13T06:00:08.319Z Last Updated: 2024-08-01T21:03:09.640Z Vendors: Unknown Products: SULly Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The SULly WordPress plugin before 4.3.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/31f3a3b5-07bf-4cb3-b358-8488808733e0/
CVE ID: CVE-2024-5035 State: PUBLISHED Published: 2024-05-27T07:22:59.959Z Last Updated: 2024-08-01T21:03:10.451Z Vendors: TP-Link Products: Archer C4500X Problem Types: CWE-77 Description: The affected device expose a network service called "rftest" that is vulnerable to unauthenticated command injection on ports TCP/8888, TCP/8889, and TCP/8890. By successfully exploiting this flaw, remote unauthenticated attacker can gain arbitrary command execution on the device with elevated privileges.This issue affects Archer C4500X: through 1_1.1.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://onekey.com/blog/security-advisory-remote-command-execut
ADP Vulnrichment: - CVE Program Container: References: - https://onekey.com/blog/security-advisory-remote-command-execution-on-tp-link-archer-c5400x/ - https://www.tp-link.com/en/support/download/archer-c5400x/#Firmware
CVE ID: CVE-2024-5036 State: PUBLISHED Published: 2024-06-20T11:06:02.167Z Last Updated: 2024-08-01T21:03:09.656Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: shaonsina Products: Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in a
ts & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 3.5.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/64f11bc9-88b5-43d5-bc76-129dc5909210?source=cve - https://plugins.trac.wordpress.org/browser/sina-extension-for-elementor/trunk/widgets/b
5-bc76-129dc5909210?source=cve - https://plugins.trac.wordpress.org/browser/sina-extension-for-elementor/trunk/widgets/basic/sina-counter.php#L687 - https://plugins.trac.wordpress.org/changeset/3104601/
CVE ID: CVE-2024-5037 State: PUBLISHED Published: 2024-06-05T18:03:23.194Z Last Updated: 2025-11-11T15:22:22.936Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: Red Hat OpenShift Container Platform 4.12, Red Hat OpenShift Container Platform 4.13, Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 4.15, Red Hat OpenShift Container Platform 4.16, Logging Subsystem for Red Hat OpenShift, Red Hat OpenShift distributed tracing 2, Red Hat OpenShift distributed tracing 3 Problem Types: CWE-290 Description: A flaw was found in OpenShift's Telemeter. If certain conditions are in place, an attacker can use a forged token t
ion: A flaw was found in OpenShift's Telemeter. If certain conditions are in place, an attacker can use a forged token to bypass the issue ("iss") check during JSON web token (JWT) authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:4151 - https://access.redhat.com/errata/RHSA-2024:4156 - https://access.redhat.com/errata/RHSA-2024:4329 - https://access.redhat.com/errata/RHSA-2024:4484 - https://access.redhat.com/errata/RHSA-2024:5200 - https://access.redhat.com/security/cve/CVE-2024-5037 - https://bugzilla.redhat.com/show_bug.cgi?id=2272339 - https://github.com/kubernetes/kubernetes/pull/123540 -
2024-5037 - https://bugzilla.redhat.com/show_bug.cgi?id=2272339 - https://github.com/kubernetes/kubernetes/pull/123540 - https://github.com/openshift/telemeter/blob/a9417a6062c3a31ed78c06ea3a0613a52f2029b2/pkg/authorize/jwt/client_authorizer.go#L78
CVE ID: CVE-2024-5038 State: PUBLISHED Published: 2024-06-06T11:03:02.821Z Last Updated: 2024-08-01T21:03:10.411Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: extendthemes Products: Colibri Page Builder Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.0.276 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and
aping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/08159865-1411-4a07-b5db-f4ba5bf2d633?source=cve - https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/shortcodes/blog/post-item.php#L132 - https://plugins.trac.wordpress.org/changeset/3097694/
CVE ID: CVE-2024-5039 State: PUBLISHED Published: 2024-05-29T12:43:41.730Z Last Updated: 2024-08-01T21:03:10.631Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: realmag777 Products: HUSKY – Products Filter Professional for WooCommerce Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.3.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible
1.3.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0f6e7fcd-f5f5-47a0-9d8a-74e2f67d10b5?source=cve - https://plugins.trac.wordpress.org/browser/woocommerce-products-filter/trunk/views/woof.php#L525 - https://plugins.trac.wordpress.org/changeset/3093324/
CVE ID: CVE-2024-5040 State: PUBLISHED Published: 2024-05-21T20:19:19.456Z Last Updated: 2024-08-01T21:03:10.607Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: LCDS Products: LAquis SCADA Problem Types: CWE-22 Description: There are multiple ways in LCDS LAquis SCADA for an attacker to access locations outside of their own directory. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-142-01
CVE ID: CVE-2024-5041 State: PUBLISHED Published: 2024-05-31T09:31:41.018Z Last Updated: 2024-08-01T21:03:10.766Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: thehappymonster Products: Happy Addons for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ha-ia-content-button’ parameter in all versions up to, and including, 3.10.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and ab
nitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fb037c9f-5d20-46f6-b1ff-34b9d192bad2?source=cve - https://plugins.trac.wordpress.org/browser/happy-elementor-addons/trunk/widgets/image-accordion/widget.php#L1462 - https://plugins.trac.wordpress.org/changeset/3095128/
CVE ID: CVE-2024-5042 State: PUBLISHED Published: 2024-05-17T13:12:00.551Z Last Updated: 2025-11-11T15:56:04.725Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N) Vendors: Red Hat Products: RHODF-4.16-RHEL-9, Red Hat Advanced Cluster Management for Kubernetes 2 Problem Types: CWE-250 Description: A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - h
entially the entire cluster. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:4591 - https://access.redhat.com/security/cve/CVE-2024-5042 - https://bugzilla.redhat.com/show_bug.cgi?id=2280921 - https://github.com/advisories/GHSA-2rhx-qhxp-5jpw
CVE ID: CVE-2024-5043 State: PUBLISHED Published: 2024-05-17T11:31:04.286Z Last Updated: 2024-08-01T21:03:09.683Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: n/a Products: Emlog Pro Problem Types: CWE-434 Description: A vulnerability was found in Emlog Pro 2.3.4 and classified as critical. Affected by this issue is some unknown functionality of the file admin/setting.php. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264740. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst
B-264740. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.264740 - https://vuldb.com/?ctiid.264740 - https://vuldb.com/?submit.331854 - https://github.com/ssteveez/emlog/blob/main/emlog%20pro%20version%202.3.4%20Admin%20side%20can%20upload%20arbitrary%20files%20and%20getshell.md
CVE ID: CVE-2024-5044 State: PUBLISHED Published: 2024-05-17T11:31:05.730Z Last Updated: 2024-08-01T21:03:10.566Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: Emlog Pro Problem Types: CWE-287 Description: A vulnerability was found in Emlog Pro 2.3.4. It has been classified as problematic. This affects an unknown part of the component Cookie Handler. The manipulation of the argument AuthCookie leads to improper authentication. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-26474
tability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-264741 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.264741 - https://vuldb.com/?ctiid.264741 - https://vuldb.com/?submit.331857 - https://github.com/ssteveez/emlog/blob/main/emlog%20pro%20version%202.3.4%20has%20session(AuthCookie)%20persistence%20and%20any%20user%20login%20vulnerability.md
CVE ID: CVE-2024-5045 State: PUBLISHED Published: 2024-05-17T12:31:03.558Z Last Updated: 2024-08-01T21:03:10.644Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SourceCodester Products: Online Birth Certificate Management System Problem Types: CWE-552 Description: A vulnerability was found in SourceCodester Online Birth Certificate Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /admin. The manipulation leads to files or directories accessible. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-264742 is the identifier assigned to this vulner
tely. The exploit has been disclosed to the public and may be used. VDB-264742 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.264742 - https://vuldb.com/?ctiid.264742 - https://vuldb.com/?submit.335384 - https://github.com/HuoMingZ/aoligei/blob/main/yuzu.md
CVE ID: CVE-2024-5046 State: PUBLISHED Published: 2024-05-17T13:00:06.517Z Last Updated: 2024-08-01T21:03:10.435Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Examination System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Online Examination System 1.0. It has been rated as critical. This issue affects some unknown processing of the file registeracc.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-264743. Additional Analyst Notes: - CISA AD
blic and may be used. The associated identifier of this vulnerability is VDB-264743. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.264743 - https://vuldb.com/?ctiid.264743 - https://vuldb.com/?submit.335527 - https://github.com/CveSecLook/cve/issues/32
CVE ID: CVE-2024-5047 State: PUBLISHED Published: 2024-05-17T13:31:04.469Z Last Updated: 2024-08-01T21:03:09.674Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Student Management System Problem Types: CWE-434 Description: A vulnerability classified as critical has been found in SourceCodester Student Management System 1.0. Affected is an unknown function of the file /student/controller.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264744. Additional Analyst Notes: - CISA ADP
to the public and may be used. The identifier of this vulnerability is VDB-264744. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.264744 - https://vuldb.com/?ctiid.264744 - https://vuldb.com/?submit.335633 - https://github.com/I-Schnee-I/cev/blob/main/SourceCodester%20Student%20Management%20System%201.0%20controller.php%20Unrestricted%20Upload.md
CVE ID: CVE-2024-5048 State: PUBLISHED Published: 2024-05-17T13:31:06.135Z Last Updated: 2024-08-01T21:03:09.734Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Budget Management Problem Types: CWE-89 Description: A vulnerability classified as critical was found in code-projects Budget Management 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument edit leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-264745 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: -
sed. The identifier VDB-264745 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.264745 - https://vuldb.com/?ctiid.264745 - https://vuldb.com/?submit.335666 - https://github.com/BurakSevben/CVEs/blob/main/Budget%20Management%20App/Budget%20Management%20App%20-%20SQL%20Injection%20-%201.md
CVE ID: CVE-2024-5049 State: PUBLISHED Published: 2024-05-17T14:00:05.805Z Last Updated: 2024-08-01T21:03:10.601Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Codezips Products: E-Commerce Site Problem Types: CWE-434 Description: A vulnerability, which was classified as critical, has been found in Codezips E-Commerce Site 1.0. Affected by this issue is some unknown functionality of the file admin/editproduct.php. The manipulation of the argument profilepic leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-264746 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA
e public and may be used. VDB-264746 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.264746 - https://vuldb.com/?ctiid.264746 - https://vuldb.com/?submit.335838 - https://github.com/polaris0x1/CVE/issues/2