Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-3600 State: PUBLISHED Published: 2024-04-19T02:34:44.234Z Last Updated: 2024-08-01T20:12:08.181Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: ays-pro Products: Poll Maker – Best WordPress Poll Plugin Problem Types: CWE-862 Missing Authorization Description: The Poll Maker – Best WordPress Poll Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to a missing capability check on the ays_poll_maker_quick_start AJAX action in addition to insufficient escaping and sanitization in all versions up to, and including, 5.1.8. This makes it possible for unauthenticated attackers to create quizzes and inject malicious web scrip
including, 5.1.8. This makes it possible for unauthenticated attackers to create quizzes and inject malicious web scripts into them that execute when a user visits the page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fec015e1-7f64-4917-a242-90bd1135f680?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3071296%40poll-maker&new=3071296%40poll-maker&sfp_email=&sfph_mail=
CVE ID: CVE-2024-3601 State: PUBLISHED Published: 2024-05-02T16:52:54.169Z Last Updated: 2024-08-01T20:12:07.969Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: ays-pro Products: Poll Maker – Best WordPress Poll Plugin Problem Types: CWE-862 Missing Authorization Description: The Poll Maker – Best WordPress Poll Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ays_poll_create_author function in all versions up to, and including, 5.1.8. This makes it possible for unauthenticated attackers to extract email addresses by enumerating them one character at a time. Additional Analyst Notes: - CISA AD
ed attackers to extract email addresses by enumerating them one character at a time. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fc0505a1-c7c4-4cf1-97cd-123a4dddcea3?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3071296%40poll-maker&new=3071296%40poll-maker&sfp_email=&sfph_mail=
CVE ID: CVE-2024-3602 State: PUBLISHED Published: 2024-06-20T02:08:19.025Z Last Updated: 2024-08-01T20:12:08.142Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: promolayerpopupbuilder Products: Pop ups, Exit intent popups, email popups, banners, bars, countdowns and cart savers – Promolayer Problem Types: CWE-862 Missing Authorization Description: The Pop ups, Exit intent popups, email popups, banners, bars, countdowns and cart savers – Promolayer plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the disconnect_promolayer function in all versions up to, and including, 1.1.0. This makes it possible
pability check on the disconnect_promolayer function in all versions up to, and including, 1.1.0. This makes it possible for authenticated attackers, with subscriber access or higher, to remove the Promolayer connection. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/05b051bc-3b1c-412e-b3d0-98ff2c8bc06e?source=cve - https://plugins.trac.wordpress.org/browser/promolayer-popup-builder/trunk/admin/class-promolayer-admin.php#L208
CVE ID: CVE-2024-3603 State: PUBLISHED Published: 2024-07-09T08:33:07.241Z Last Updated: 2024-08-01T20:12:07.999Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: photoweblog Products: OSM – OpenStreetMap Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The OSM – OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'osm_map' shortcode in all versions up to, and including, 6.0.2 due to insufficient input sanitization and output escaping on user supplied attributes such as 'theme'. This makes it possible for authenticated attackers, with contributo
scaping on user supplied attributes such as 'theme'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/845cea77-ea74-4459-817b-cfbdb877b75a?source=cve - https://wordpress.org/plugins/osm/
CVE ID: CVE-2024-3604 State: PUBLISHED Published: 2024-07-09T08:33:11.994Z Last Updated: 2024-08-01T20:12:08.142Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: photoweblog Products: OSM – OpenStreetMap Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The OSM – OpenStreetMap plugin for WordPress is vulnerable to SQL Injection via the 'tagged_filter' attribute of the 'osm_map_v3' shortcode in all versions up to, and including, 6.0.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authent
user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c8eebc67-e590-4d7f-8925-e5e5090cedf0?source=cve - https://wordpress.org/plugins/osm/
CVE ID: CVE-2024-3605 State: PUBLISHED Published: 2024-06-20T02:08:22.137Z Last Updated: 2024-08-01T20:12:08.108Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: thimpress Products: WP Hotel Booking Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The WP Hotel Booking plugin for WordPress is vulnerable to SQL Injection via the 'room_type' parameter of the /wphb/v1/rooms/search-rooms REST API endpoint in all versions up to, and including, 2.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f
ng on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5931ad4e-7de3-41ac-b783-f7e58aaef569?source=cve - https://wordpress.org/plugins/wp-hotel-booking/
CVE ID: CVE-2024-3606 State: PUBLISHED Published: 2024-05-02T16:52:33.934Z Last Updated: 2024-08-01T20:12:07.965Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: metagauss Products: ProfileGrid – User Profiles, Memberships, Groups and Communities Problem Types: CWE-862 Missing Authorization Description: The ProfileGrid – User Profiles, Memberships, Groups and Communities plugin for WordPress is vulnerable to unauthorized deletion of data due to a missing capability check on the pm_upload_cover_image function in all versions up to, and including, 5.8.3. This makes it possible for authenticated attackers, with subscriber access or higher, to delete attachments
ding, 5.8.3. This makes it possible for authenticated attackers, with subscriber access or higher, to delete attachments. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c039d2fe-7518-4724-a025-6380a53fb58c?source=cve - https://plugins.trac.wordpress.org/changeset/3069928/profilegrid-user-profiles-groups-and-communities/trunk?contextall=1&old=3068943&old_path=%2Fprofilegrid-user-profiles-groups-and-communities%2Ftrunk
CVE ID: CVE-2024-3607 State: PUBLISHED Published: 2024-05-02T16:52:44.991Z Last Updated: 2024-08-01T20:12:07.919Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: propertyhive Products: PropertyHive Problem Types: CWE-862 Missing Authorization Description: The PropertyHive plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_key_date() function in all versions up to, and including, 2.0.12. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary posts Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https:/
delete arbitrary posts Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d8d52ced-807b-48c0-bb7a-e40d143ae5d3?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3075163%40propertyhive&new=3075163%40propertyhive&sfp_email=&sfph_mail=#file11
CVE ID: CVE-2024-3608 State: PUBLISHED Published: 2024-07-09T08:33:04.165Z Last Updated: 2024-11-01T18:13:24.545Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: pickplugins Products: Product Designer Problem Types: CWE-862 Missing Authorization Description: The Product Designer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the product_designer_ajax_delete_attach_id() function in all versions up to, and including, 1.0.33. This makes it possible for unauthenticated attackers to delete arbitrary attachments. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://w
bitrary attachments. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2f127fe5-67b8-40e1-a916-c607410b08b3?source=cve - https://plugins.trac.wordpress.org/browser/product-designer/trunk/includes/designer-function.php#L412
CVE ID: CVE-2024-3609 State: PUBLISHED Published: 2024-05-16T20:31:04.842Z Last Updated: 2024-08-01T20:19:58.893Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: reviewx Products: ReviewX – Multi-criteria Rating & Reviews for WooCommerce Problem Types: CWE-862 Missing Authorization Description: The ReviewX – Multi-criteria Rating & Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized deletion of data due to a missing capability check on the reviewx_remove_guest_image function in all versions up to, and including, 1.6.27. This makes it possible for authenticated attackers, with subscriber access and above, to delete attachments. Addition
7. This makes it possible for authenticated attackers, with subscriber access and above, to delete attachments. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f8152adf-1ca9-4a19-b539-39e257ab94c8?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3086273%40reviewx%2Ftrunk&old=3054184%40reviewx%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-3610 State: PUBLISHED Published: 2024-06-21T02:05:42.362Z Last Updated: 2024-08-01T20:19:59.609Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: wen-solutions Products: WP Child Theme Generator Problem Types: CWE-862 Missing Authorization Description: The WP Child Theme Generator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wctg_easy_child_theme() function in all versions up to, and including, 1.1.1. This makes it possible for unauthenticated attackers to create a blank child theme and activate it cause the site to whitescreen. Additional Analyst Notes: - CISA ADP Vulnrichme
reate a blank child theme and activate it cause the site to whitescreen. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/581e6686-a103-43f6-aa99-6a9862d98837?source=cve - https://plugins.trac.wordpress.org/browser/wp-child-theme-generator/trunk/wp-easy-child/wp-easy-child.php#L60 - https://plugins.trac.wordpress.org/changeset?old_path=/wp-child-theme-generator/tags/1.1.1&new_path=/wp-child-theme-generator/tags/1.1.2&sfp_email=&sfph_mail=
CVE ID: CVE-2024-3611 State: PUBLISHED Published: 2024-05-22T05:32:47.483Z Last Updated: 2024-08-01T20:19:58.901Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: daveshine Products: Toolbar Extras for Elementor & More – WordPress Admin Bar Enhanced Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Toolbar Extras for Elementor & More – WordPress Admin Bar Enhanced plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tbex-version' shortcode in all versions up to, and including, 1.4.9 due to insufficient input sanitization and output escaping on user supplie
e in all versions up to, and including, 1.4.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/50631f6c-de8b-408e-ab1f-ef74d3180e7f?source=cve - https://wordpress.org/plugins/toolbar-extras/#developers
CVE ID: CVE-2024-3612 State: PUBLISHED Published: 2024-04-10T23:31:04.256Z Last Updated: 2024-08-01T20:19:59.894Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Warehouse Management System Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Warehouse Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file barang.php. The manipulation of the argument nama_barang/merek leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260269 was assigned to this vulnerability.
exploit has been disclosed to the public and may be used. The identifier VDB-260269 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.260269 - https://vuldb.com/?ctiid.260269 - https://vuldb.com/?submit.312700 - https://github.com/fubxx/CVE/blob/main/WarehouseManagementSystemXSS.md
CVE ID: CVE-2024-3613 State: PUBLISHED Published: 2024-04-11T00:00:05.362Z Last Updated: 2024-08-08T20:23:54.414Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Warehouse Management System Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Warehouse Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file supplier.php. The manipulation of the argument nama_supplier/alamat_supplier/notelp_supplier leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-260270 is the identifier assigned to
aunched remotely. The exploit has been disclosed to the public and may be used. VDB-260270 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.260270 - https://vuldb.com/?ctiid.260270 - https://vuldb.com/?submit.312701 - https://github.com/fubxx/CVE/blob/main/WarehouseManagementSystemXSS2.md
CVE ID: CVE-2024-3614 State: PUBLISHED Published: 2024-04-11T00:31:05.022Z Last Updated: 2024-08-21T21:02:30.092Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Warehouse Management System Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in SourceCodester Warehouse Management System 1.0. This affects an unknown part of the file customer.php. The manipulation of the argument nama_customer/alamat_customer/notelp_customer leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-2
. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-260271. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.260271 - https://vuldb.com/?ctiid.260271 - https://vuldb.com/?submit.312703 - https://github.com/fubxx/CVE/blob/main/WarehouseManagementSystemXSS3.md
CVE ID: CVE-2024-3615 State: PUBLISHED Published: 2024-04-19T02:34:42.674Z Last Updated: 2024-08-01T20:19:59.860Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: maxfoundry Products: Media Library Folders Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Media Library Folders plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 8.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can s
This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5f550bac-b047-4276-bde5-c15bfd4ceb49?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3072498%40media-library-plus&new=3072498%40media-library-plus&sfp_email=&sfph_mail=
CVE ID: CVE-2024-3616 State: PUBLISHED Published: 2024-04-11T01:31:04.076Z Last Updated: 2024-08-21T21:01:58.937Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Warehouse Management System Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in SourceCodester Warehouse Management System 1.0. This vulnerability affects unknown code of the file pengguna.php. The manipulation of the argument admin_user/admin_nama/admin_alamat/admin_telepon leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-260272. Addit
The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-260272. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.260272 - https://vuldb.com/?ctiid.260272 - https://vuldb.com/?submit.312704 - https://github.com/fubxx/CVE/blob/main/WarehouseManagementSystemXSS4.md
CVE ID: CVE-2024-3617 State: PUBLISHED Published: 2024-04-11T02:00:05.385Z Last Updated: 2024-08-01T20:19:59.824Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: SourceCodester Products: Kortex Lite Advocate Office Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in SourceCodester Kortex Lite Advocate Office Management System 1.0. This issue affects some unknown processing of the file /control/deactivate_case.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260273 was assigned
nitiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260273 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.260273 - https://vuldb.com/?ctiid.260273 - https://vuldb.com/?submit.312804 - https://github.com/zyairelai/CVE-submissions/blob/main/kortex-deactivate_case-sqli.md
CVE ID: CVE-2024-3618 State: PUBLISHED Published: 2024-04-11T02:31:05.131Z Last Updated: 2024-08-01T20:19:59.639Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: SourceCodester Products: Kortex Lite Advocate Office Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in SourceCodester Kortex Lite Advocate Office Management System 1.0. Affected is an unknown function of the file /control/activate_case.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-260274 is the identifier assigned to this vul
emotely. The exploit has been disclosed to the public and may be used. VDB-260274 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.260274 - https://vuldb.com/?ctiid.260274 - https://vuldb.com/?submit.312807 - https://github.com/zyairelai/CVE-submissions/blob/main/kortex-activate_case-sqli.md
CVE ID: CVE-2024-3619 State: PUBLISHED Published: 2024-04-11T03:00:05.077Z Last Updated: 2024-08-09T14:25:42.051Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: SourceCodester Products: Kortex Lite Advocate Office Management System Problem Types: CWE-89 Description: A vulnerability has been found in SourceCodester Kortex Lite Advocate Office Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /control/addcase_stage.php. The manipulation of the argument cname leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of th
can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-260275. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.260275 - https://vuldb.com/?ctiid.260275 - https://vuldb.com/?submit.312813 - https://github.com/zyairelai/CVE-submissions/blob/main/kortex-addcase_stage-sqli.md
CVE ID: CVE-2024-3620 State: PUBLISHED Published: 2024-04-11T03:00:06.478Z Last Updated: 2024-08-01T20:19:58.908Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: SourceCodester Products: Kortex Lite Advocate Office Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Kortex Lite Advocate Office Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /control/adds.php. The manipulation of the argument name/gender/dob/email/mobile/address leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of th
The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-260276. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.260276 - https://vuldb.com/?ctiid.260276 - https://vuldb.com/?submit.312815 - https://github.com/zyairelai/CVE-submissions/blob/main/kortex-adds-sqli.md