Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259105 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.259105 - https://vuldb.com/?ctiid.259105 - https://vuldb.com/?submit.309217 - https://github.com/thisissuperann/Vul/blob/main/Internship-Portal-Management-System-06
CVE ID: CVE-2024-3257 State: PUBLISHED Published: 2024-04-03T13:00:04.668Z Last Updated: 2024-08-01T20:05:08.338Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Internship Portal Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Internship Portal Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file admin/edit_activity_query.php. The manipulation of the argument title/description/start/end leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-259106 is the identifier assigned
e launched remotely. The exploit has been disclosed to the public and may be used. VDB-259106 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.259106 - https://vuldb.com/?ctiid.259106 - https://vuldb.com/?submit.309218 - https://github.com/thisissuperann/Vul/blob/main/Internship-Portal-Management-System-07
CVE ID: CVE-2024-3258 State: PUBLISHED Published: 2024-04-03T13:00:06.107Z Last Updated: 2024-08-01T20:05:08.479Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Internship Portal Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Internship Portal Management System 1.0. It has been classified as critical. This affects an unknown part of the file admin/add_activity.php. The manipulation of the argument title/description/start/end leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability
remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259107. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.259107 - https://vuldb.com/?ctiid.259107 - https://vuldb.com/?submit.309219 - https://github.com/thisissuperann/Vul/blob/main/Internship-Portal-Management-System-08
CVE ID: CVE-2024-3259 State: PUBLISHED Published: 2024-04-03T13:31:05.141Z Last Updated: 2024-08-01T20:05:08.323Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Internship Portal Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Internship Portal Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file admin/delete_activity.php. The manipulation of the argument activity_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259108. Additional
exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259108. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.259108 - https://vuldb.com/?ctiid.259108 - https://vuldb.com/?submit.309220 - https://github.com/thisissuperann/Vul/blob/main/Internship-Portal-Management-System-09
CVE ID: CVE-2024-3260 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:05:18.926Z Description: No description available.
CVE ID: CVE-2024-3261 State: PUBLISHED Published: 2024-04-24T05:00:03.121Z Last Updated: 2024-08-01T20:05:08.497Z Vendors: Unknown Products: Strong Testimonials Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Strong Testimonials WordPress plugin before 3.1.12 does not validate and escape some of its Testimonial fields before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. The attack requires a specific view to be performed Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/5a0d5922-eefc-48e1-9681-b63e420bb8b
ulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/5a0d5922-eefc-48e1-9681-b63e420bb8b3/
CVE ID: CVE-2024-3262 State: PUBLISHED Published: 2024-04-04T09:21:34.682Z Last Updated: 2025-11-03T19:29:47.007Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Best Practical Solutions Products: Request Tracker Problem Types: CWE-200 Description: Information exposure vulnerability in RT software affecting version 4.4.1. This vulnerability allows an attacker with local access to the device to retrieve sensitive information about the application, such as vulnerability tickets, because the application stores the information in the browser cache, leading to information exposure despite session termination. Additional Analyst Notes: - CISA ADP Vulnrichment: - C
che, leading to information exposure despite session termination. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/incibe-cert/alerta-temprana/avisos/vulnerabilidad-de-exposicion-de-informacion-en-request-tracker-rt
CVE ID: CVE-2024-3263 State: PUBLISHED Published: 2024-05-13T09:17:12.216Z Last Updated: 2024-08-01T20:05:08.248Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: YMS Products: VIS Pro Problem Types: CWE-521, CWE-287 Description: YMS VIS Pro is an information system for veterinary and food administration, veterinarians and farm. Due to a combination of improper method for system credentials generation and weak password policy, passwords can be easily guessed and enumerated through brute force attacks. Successful attacks can lead to unauthorised access and execution of operations based on assigned user permissions. This vulnerability affects VIS Pro in versi
rised access and execution of operations based on assigned user permissions. This vulnerability affects VIS Pro in versions <= 3.3.0.6. This vulnerability has been mitigated by changes in authentication mechanisms and implementation of additional authentication layer and strong password policies. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.svps.sk/vis/ - https://remediata.com/blog/cve-2024-3263-improper-authentication-in-yms-vis-pro/
CVE ID: CVE-2024-3264 State: PUBLISHED Published: 2024-06-24T12:45:13.204Z Last Updated: 2024-08-01T20:05:08.373Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Mia Technology Inc. Products: Mia-Med Health Aplication Problem Types: CWE-327 Description: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Mia Technology Inc. Mia-Med Health Aplication allows Signature Spoofing by Improper Validation.This issue affects Mia-Med Health Aplication: before 1.0.14. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-24-0765
CVE ID: CVE-2024-3265 State: PUBLISHED Published: 2024-04-25T21:25:07.990Z Last Updated: 2024-08-01T20:05:08.327Z Vendors: Unknown Products: Advanced Search Problem Types: CWE-89 SQL Injection Description: The Advanced Search WordPress plugin through 1.1.6 does not properly escape parameters appended to an SQL query, making it possible for users with the administrator role to conduct SQL Injection attacks in the context of a multisite WordPress configurations. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/ecb74622-eeed-48b6-a944-4e3494d6594d/
CVE ID: CVE-2024-3266 State: PUBLISHED Published: 2024-04-09T18:58:38.187Z Last Updated: 2024-08-01T20:05:08.407Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: boldthemes Products: Bold Page Builder Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attribute of widgets in all versions up to, and including, 4.8.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above,
n user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/21fed5a3-1bb2-4581-95b4-badff98bed42?source=cve - https://plugins.trac.wordpress.org/changeset/3064413/bold-page-builder
CVE ID: CVE-2024-3267 State: PUBLISHED Published: 2024-04-09T18:59:32.395Z Last Updated: 2024-08-01T20:05:08.478Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: boldthemes Products: Bold Page Builder Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bt_bb_price_list shortcode in all versions up to, and including, 4.8.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access
escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/eed667d2-e53e-47b9-8012-2b9b46022f3a?source=cve - https://plugins.trac.wordpress.org/changeset/3064413/bold-page-builder
CVE ID: CVE-2024-3268 State: PUBLISHED Published: 2024-05-21T11:33:17.396Z Last Updated: 2024-08-01T20:05:08.218Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: emarket-design Products: YouTube Video Gallery by YouTube Showcase – Video Gallery Plugin for WordPress Problem Types: CWE-862 Missing Authorization Description: The YouTube Video Gallery by YouTube Showcase – Video Gallery Plugin for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the emd_form_builder_lite_submit_form function in all versions up to, and including, 3.3.6. This makes it possible for unauthenticated attackers to cr
it_form function in all versions up to, and including, 3.3.6. This makes it possible for unauthenticated attackers to create arbitrary posts or pages. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0e9d5382-d37d-4a40-8f22-e32b8ee98859?source=cve - https://plugins.trac.wordpress.org/changeset/3088363/youtube-showcase
CVE ID: CVE-2024-3269 State: PUBLISHED Published: 2024-05-30T03:34:29.217Z Last Updated: 2024-08-01T20:05:08.405Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: wpchill Products: Download Monitor Problem Types: CWE-285 Improper Authorization Description: The Download Monitor plugin for WordPress is vulnerable to unauthorized access to functionality due to a missing capability check on the dlm_uninstall_plugin function in all versions up to, and including, 4.9.13. This makes it possible for authenticated attackers to uninstall the plugin and delete its data. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www
d delete its data. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c454a958-91c4-4847-91f6-dedebf857964?source=cve - https://plugins.trac.wordpress.org/changeset/3092928/download-monitor/trunk?contextall=1&old=3070504&old_path=%2Fdownload-monitor%2Ftrunk
CVE ID: CVE-2024-3270 State: PUBLISHED Published: 2024-04-03T23:00:06.494Z Last Updated: 2024-08-27T13:27:22.349Z Severity: N/A (CVSS 4.7 AV:N/AC:L/Au:M/C:N/I:P/A:P) Vendors: n/a Products: ThingsBoard Problem Types: CWE-284 Description: A vulnerability classified as problematic was found in ThingsBoard up to 3.6.2. This vulnerability affects unknown code of the component AdvancedFeature. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-259282 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure and replied to be planning to fix thi
to this vulnerability. NOTE: The vendor was contacted early about this disclosure and replied to be planning to fix this issue in version 3.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.259282 - https://vuldb.com/?ctiid.259282 - https://vuldb.com/?submit.301359 - https://drive.google.com/file/d/1w9iSMpyKDuapH9wjsgTe8AYPn8Z30u2Z/view?usp=drive_link
CVE ID: CVE-2024-3271 State: PUBLISHED Published: 2024-04-16T00:00:15.108Z Last Updated: 2024-08-01T20:05:08.348Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: run-llama Products: run-llama/llama_index Problem Types: CWE-77 Description: A command injection vulnerability exists in the run-llama/llama_index repository, specifically within the safe_eval function. Attackers can bypass the intended security mechanism, which checks for the presence of underscores in code generated by LLM, to execute arbitrary code. This is achieved by crafting input that does not contain an underscore but still results in the execution of OS commands. The vulnerability allows
g input that does not contain an underscore but still results in the execution of OS commands. The vulnerability allows for remote code execution (RCE) on the server hosting the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/9b32490e-7cf9-470e-8d49-ba083ae7a279 - https://github.com/run-llama/llama_index/commit/5fbcb5a8b9f20f81b791c7fc8849e352613ab475
CVE ID: CVE-2024-3272 State: PUBLISHED Published: 2024-04-04T01:00:05.740Z Last Updated: 2025-10-21T23:05:22.378Z Severity: N/A (CVSS 10 AV:N/AC:L/Au:N/C:C/I:C/A:C) Vendors: D-Link Products: DNS-320L, DNS-325, DNS-327L, DNS-340L Problem Types: CWE-798 Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. This issue affects some unknown processing of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument user with the input messagebus leads to hard-coded credentials. The attack may be initiated remotely. The exp
e argument user with the input messagebus leads to hard-coded credentials. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259283. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.259283 - https://vuldb.com/?ctiid.259283 - https://github.com/netsecfish/dlink - https://supportannouncement.us.dlink.com/securi
https://vuldb.com/?ctiid.259283 - https://github.com/netsecfish/dlink - https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383
CVE ID: CVE-2024-3273 State: PUBLISHED Published: 2024-04-04T01:00:06.842Z Last Updated: 2025-10-21T23:05:22.196Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: D-Link Products: DNS-320L, DNS-325, DNS-327L, DNS-340L Problem Types: CWE-77 Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument system leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and
ds to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259284. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.259284 - https://vuldb.com/?ctiid.259284 - https://vuldb.com/?submit.304661 - https://github.com/netsecfish/dlink - https://supportannouncement.us.dlink.com/security/publication.asp
?submit.304661 - https://github.com/netsecfish/dlink - https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383
CVE ID: CVE-2024-3274 State: PUBLISHED Published: 2024-04-04T01:31:04.758Z Last Updated: 2024-08-26T20:56:27.162Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: D-Link Products: DNS-320L, DNS-320LW, DNS-327L Problem Types: CWE-200 Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in D-Link DNS-320L, DNS-320LW and DNS-327L up to 20240403 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/info.cgi of the component HTTP GET Request Handler. The manipulation leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and m
leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259285 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.259285 - https://vuldb.com/?ctiid.259285 - https://vuldb.com/?submit.304706 - https://github.com/netsecfish/info_cgi - https://supportannouncement.us.dlink.com/security/pub
uldb.com/?submit.304706 - https://github.com/netsecfish/info_cgi - https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383
CVE ID: CVE-2024-3275 State: PUBLISHED Published: 2024-05-02T16:52:09.413Z Last Updated: 2024-08-13T13:51:35.454Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: stylemix Products: eRoom – Zoom Meetings & Webinars Problem Types: CWE-862 Missing Authorization Description: The eRoom – Zoom Meetings & Webinars plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.18 via the search_posts function. This makes it possible for authenticated attackers, with subscriber access and higher, to obtain post excerpts including those of draft and pending posts. Additional Analyst Notes: - CVE Program Container: - CISA
tain post excerpts including those of draft and pending posts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/60e0fd59-a69c-4ddf-80cd-4312d2689397?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3068855%40eroom-zoom-meetings-webinar%2Ftrunk&old=3039151%40eroom-zoom-meetings-webinar%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-3276 State: PUBLISHED Published: 2024-06-18T06:00:02.054Z Last Updated: 2024-08-01T20:05:08.383Z Vendors: Unknown Products: Lightbox & Modal Popup WordPress Plugin , foobox-image-lightbox-premium Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Lightbox & Modal Popup WordPress Plugin WordPress plugin before 2.7.28, foobox-image-lightbox-premium WordPress plugin before 2.7.28 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichmen
iltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/996d3247-ebdd-49d1-a1a3-ceedcf9f2f95/
CVE ID: CVE-2024-3277 State: PUBLISHED Published: 2024-05-30T04:31:57.554Z Last Updated: 2024-08-01T20:05:08.438Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N) Vendors: yumpu Products: Yumpu ePaper publishing Problem Types: CWE-862 Missing Authorization Description: The Yumpu ePaper publishing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_handler function in all versions up to, and including, 2.0.24. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload PDF files and publish them, as well as modify the API key. Additional Analyst Notes: - CISA ADP V
s and above, to upload PDF files and publish them, as well as modify the API key. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ed507ac7-6732-4315-99dd-0a8636cc9cc3?source=cve - https://plugins.trac.wordpress.org/browser/yumpu-epaper-publishing/trunk/yumpu.php#L259
CVE ID: CVE-2024-3279 State: PUBLISHED Published: 2024-08-09T00:00:14.589Z Last Updated: 2025-10-15T12:49:36.521Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: mintplex-labs Products: mintplex-labs/anything-llm Problem Types: CWE-306 Description: An improper access control vulnerability exists in the mintplex-labs/anything-llm application, specifically within the import endpoint. This vulnerability allows an anonymous attacker, without an account in the application, to import their own database file, leading to the deletion or spoofing of the existing `anythingllm.db` file. By exploiting this vulnerability, attackers can serve malicious data to users or
of the existing `anythingllm.db` file. By exploiting this vulnerability, attackers can serve malicious data to users or collect information about them. The vulnerability stems from the application's failure to properly restrict access to the data-import functionality, allowing unauthorized database manipulation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/303c5145-2c14-4945-914a-936be74dd04e - https://github.com/mintplex-labs/anything-llm/commit/08d33cfd8fc47c5052b6ea29597c964a9da641e2