Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-12875 State: PUBLISHED Published: 2024-12-21T11:22:44.638Z Last Updated: 2024-12-28T00:48:38.764Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: smub Products: Easy Digital Downloads – eCommerce Payments and Subscriptions made easy Problem Types: CWE-73 Description: The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.2 via the file download functionality. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which can contai
kers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ec065da7-b8aa-414d-9673-5caf87ad45b5?source=cve - https://plugins.trac.wordpress.org/changeset/3131805/easy-digital-downloads/tags/3.3.3/includes/process-download.php
CVE ID: CVE-2024-12876 State: PUBLISHED Published: 2025-03-07T08:21:28.125Z Last Updated: 2025-03-07T15:04:12.690Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: uxper Products: Golo - City Travel Guide WordPress Theme Problem Types: CWE-862 Description: The Golo - City Travel Guide WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6.10. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that t
ssible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e6cb81e5-61a4-4b67-a668-d8a7d46b2cea?source=cve - https://themeforest.net/item/golo-directory-listing-travel-wordpress-theme/25397810
CVE ID: CVE-2024-12877 State: PUBLISHED Published: 2025-01-11T07:21:53.510Z Last Updated: 2025-01-13T17:12:05.279Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: webdevmattcrom Products: GiveWP – Donation Plugin and Fundraising Platform Problem Types: CWE-502 Description: The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.2 via deserialization of untrusted input from the donation form like 'firstName'. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary
henticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files on the server that makes remote code execution possible. Please note this was only partially patched in 3.19.3, a fully sufficient patch was not released until 3.19.4. However, another CVE was assigned by another CNA for version 3.19.3 so we will leave this as affecting 3.19.2 and before. We have recommended the vendor use JSON encoding to prevent any further deserialization vulnerabilities from being present. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b2143edf-5423-4e79-8638-a5b98490d292
lnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b2143edf-5423-4e79-8638-a5b98490d292?source=cve - https://plugins.trac.wordpress.org/changeset/3212723/give/tags/3.19.3/src/Helpers/Utils.php
CVE ID: CVE-2024-12878 State: PUBLISHED Published: 2025-02-26T06:00:07.209Z Last Updated: 2025-02-26T16:02:27.112Z Vendors: Unknown Products: Custom Block Builder Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Custom Block Builder WordPress plugin before 3.8.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/827444d1-87cb-4057-827a-d802eac82cf8/
CVE ID: CVE-2024-12879 State: PUBLISHED Published: 2025-01-22T05:23:04.823Z Last Updated: 2025-02-12T19:18:41.428Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: QuantumCloud Products: WPBot Pro Wordpress Chatbot Problem Types: CWE-862 Description: The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'qc_wp_latest_update_check_pro' function in all versions up to, and including, 13.5.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create Simple Text Responses to chat queries. Additional Analyst Notes: - CISA ADP Vulnri
ber-level access and above, to create Simple Text Responses to chat queries. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/91427e3e-fedb-407e-8af6-8f4411a4166a?source=cve - https://www.wpbot.pro/
CVE ID: CVE-2024-12880 State: PUBLISHED Published: 2025-03-20T10:09:37.911Z Last Updated: 2025-10-15T12:49:33.719Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) Vendors: infiniflow Products: infiniflow/ragflow Problem Types: CWE-639 Description: A vulnerability in infiniflow/ragflow version RAGFlow-0.13.0 allows for partial account takeover via insecure data querying. The issue arises from the way tenant IDs are handled in the application. If a user has access to multiple tenants, they can manipulate their tenant access to query and access API tokens of other tenants. This vulnerability affects the following endpoints: /v1/system/token_list, /v1/system/new_token, /v1
s of other tenants. This vulnerability affects the following endpoints: /v1/system/token_list, /v1/system/new_token, /v1/api/token_list, /v1/api/new_token, and /v1/api/rm. An attacker can exploit this to access other tenants' API tokens, perform actions on behalf of other tenants, and access their data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/c41c7eaa-554a-408c-96be-9dba56113970
CVE ID: CVE-2024-12881 State: PUBLISHED Published: 2024-12-24T09:21:51.310Z Last Updated: 2024-12-24T14:41:01.068Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: giuse Products: PlugVersions – Easily rollback to previous versions of your plugins Problem Types: CWE-862 Description: The PlugVersions – Easily rollback to previous versions of your plugins plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the eos_plugin_reviews_restore_version() function in all versions up to, and including, 0.0.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary files le
This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary files leveraging files included locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/eb06c43c-bf8c-412b-8b1d-fee004d728d2?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3211805%40plugversions&new=3211805%40plugversions&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12882 State: PUBLISHED Published: 2025-03-20T10:10:31.200Z Last Updated: 2025-03-20T18:20:26.580Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: comfyanonymous Products: comfyanonymous/comfyui Problem Types: CWE-918 Description: comfyanonymous/comfyui version v0.2.4 suffers from a non-blind Server-Side Request Forgery (SSRF) vulnerability. This vulnerability can be exploited by combining the REST APIs `POST /internal/models/download` and `GET /view`, allowing attackers to abuse the victim server's credentials to access unauthorized web resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/e8768
horized web resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/e8768cb1-6a80-40c1-9cdf-bcd21f01f85a
CVE ID: CVE-2024-12883 State: PUBLISHED Published: 2024-12-21T13:00:16.029Z Last Updated: 2024-12-24T16:57:31.035Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: code-projects Products: Job Recruitment Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in code-projects Job Recruitment 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /_email.php. The manipulation of the argument email leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.28
to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289141 - https://vuldb.com/?ctiid.289141 - https://vuldb.com/?submit.466393 - https://github.com/su-co/cve/blob/main/xss-su-co.md - https://code-projects.org/
CVE ID: CVE-2024-12884 State: PUBLISHED Published: 2024-12-21T14:00:09.828Z Last Updated: 2024-12-24T02:27:59.098Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Codezips Products: E-Commerce Website Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Codezips E-Commerce Website 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289142 - https://vuldb.c
be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289142 - https://vuldb.com/?ctiid.289142 - https://vuldb.com/?submit.466519 - https://geochen.medium.com/sqli-in-login-php-of-e-commerce-website-using-php-1abacb5e2ccd
CVE ID: CVE-2024-12885 State: PUBLISHED Published: 2025-01-25T07:24:14.745Z Last Updated: 2025-01-27T15:37:15.979Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) Vendors: shazahm1hotmailcom Products: Connections Business Directory Problem Types: CWE-22 Description: The Connections Business Directory plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation when deleting a connections image directory in all versions up to, and including, 10.4.66. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary folders on the server and all their content. Additional Ana
th Administrator-level access and above, to delete arbitrary folders on the server and all their content. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/25e0c269-55c2-49f0-96bb-ae2696e2cea8?source=cve - https://wordpress.org/plugins/connections/
CVE ID: CVE-2024-12886 State: PUBLISHED Published: 2025-03-20T10:10:28.146Z Last Updated: 2025-10-15T12:49:34.228Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ollama Products: ollama/ollama Problem Types: CWE-409 Description: An Out-Of-Memory (OOM) vulnerability exists in the `ollama` server version 0.3.14. This vulnerability can be triggered when a malicious API server responds with a gzip bomb HTTP response, leading to the `ollama` server crashing. The vulnerability is present in the `makeRequestWithRetry` and `getAuthorizationToken` functions, which use `io.ReadAll` to read the response body. This can result in excessive memory usage and a Denial of Ser
nctions, which use `io.ReadAll` to read the response body. This can result in excessive memory usage and a Denial of Service (DoS) condition. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/f115fe52-58af-4844-ad29-b1c25f7245df
CVE ID: CVE-2024-12890 State: PUBLISHED Published: 2024-12-22T06:00:11.940Z Last Updated: 2024-12-25T02:31:36.122Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Online Exam Mastering System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Online Exam Mastering System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /update.php?q=quiz&step=2. The manipulation of the argument eid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuld
n disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289151 - https://vuldb.com/?ctiid.289151 - https://vuldb.com/?submit.467123 - https://hackmd.io/@salt9487/B1gWdeXrkx - https://code-projects.org/
CVE ID: CVE-2024-12891 State: PUBLISHED Published: 2024-12-22T06:31:06.289Z Last Updated: 2024-12-25T02:32:11.282Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Online Exam Mastering System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in code-projects Online Exam Mastering System 1.0. Affected is an unknown function of the file /account.php?q=quiz&step=2. The manipulation of the argument eid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com
closed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289152 - https://vuldb.com/?ctiid.289152 - https://vuldb.com/?submit.467124 - https://hackmd.io/@salt9487/BkeSOxQSye - https://code-projects.org/
CVE ID: CVE-2024-12892 State: PUBLISHED Published: 2024-12-22T07:31:06.776Z Last Updated: 2024-12-25T02:32:59.459Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: code-projects Products: Online Exam Mastering System Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic was found in code-projects Online Exam Mastering System 1.0. Affected by this vulnerability is an unknown functionality of the file /sign.php?q=account.php. The manipulation of the argument name/gender/college leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichmen
remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289153 - https://vuldb.com/?ctiid.289153 - https://vuldb.com/?submit.467125 - https://hackmd.io/@salt9487/BJpKplmrJe - https://code-projects.org/
CVE ID: CVE-2024-12893 State: PUBLISHED Published: 2024-12-22T08:00:13.237Z Last Updated: 2024-12-25T02:34:36.819Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: Portabilis Products: i-Educar Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar up to 2.9. Affected by this issue is some unknown functionality of the file /usuarios/tipos/2 of the component Tipo de Usuário Page. The manipulation of the argument name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but d
The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289154 - https://vuldb.com/?ctiid.289154 - https://vuldb.com/?submit.459903 - https://github.com/RegularUs3r/CVE-Research/blob/main/CVE-2024/Portabilis%20-%20iEducar/Stored%20Cross-Site%20Scripting.md
CVE ID: CVE-2024-12894 State: PUBLISHED Published: 2024-12-22T12:00:13.449Z Last Updated: 2024-12-24T16:30:50.191Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: TreasureHuntGame Products: TreasureHunt Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in TreasureHuntGame TreasureHunt up to 963e0e0. Affected is an unknown function of the file TreasureHunt/acesso.php. The manipulation of the argument usuario leads to sql injection. It is possible to launch the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. T
release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The name of the patch is 8bcc649abc35b7734951be084bb522a532faac4e. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289164 - https://vuldb.com/?ctiid.289164 - https://github.com/TreasureHuntGame/TreasureHunt/commit/8bcc649abc35b7734951be084bb522a532faac4e
CVE ID: CVE-2024-12895 State: PUBLISHED Published: 2024-12-22T14:00:13.671Z Last Updated: 2024-12-24T16:25:32.559Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: TreasureHuntGame Products: TreasureHunt Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in TreasureHuntGame TreasureHunt up to 963e0e0 and classified as critical. Affected by this vulnerability is the function console_log of the file TreasureHunt/checkflag.php. The manipulation of the argument problema leads to sql injection. The attack can be launched remotely. The identifier of the patch is 8bcc649abc35b7734951be084bb522a532faac4e. It is recommended to apply a patch to fix this issue. Additi
r of the patch is 8bcc649abc35b7734951be084bb522a532faac4e. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289165 - https://vuldb.com/?ctiid.289165 - https://github.com/TreasureHuntGame/TreasureHunt/commit/8bcc649abc35b7734951be084bb522a532faac4e
CVE ID: CVE-2024-12896 State: PUBLISHED Published: 2024-12-22T23:00:12.200Z Last Updated: 2024-12-24T16:07:59.581Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Intelbras Products: VIP S3020 G2, VIP S4020 G2, VIP S4020 G3, VIP S4320 G2 Problem Types: CWE-200, CWE-284 Description: A vulnerability was found in Intelbras VIP S3020 G2, VIP S4020 G2, VIP S4020 G3 and VIP S4320 G2 up to 20241222 and classified as problematic. Affected by this issue is some unknown functionality of the file /web_caps/webCapsConfig of the component Web Interface. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed t
The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor assesses that "the information disclosed in the URL is not sensitive or poses any risk to the user". Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289166 - https://vuldb.com/?ctiid.289166 - https://vuldb.com/?submit.464258 - https://netsecfish.notion.site/IntelBras-IP-Camera-Information-Disclosure-15e6b683e67c80a89f89daf59daa9ea8?pvs=73
CVE ID: CVE-2024-12897 State: PUBLISHED Published: 2024-12-22T23:31:05.102Z Last Updated: 2024-12-27T08:51:42.245Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Intelbras Products: VIP S3020 G2, VIP S4020 G2, VIP S4020 G3, VIP S4320 G2 Problem Types: CWE-24, CWE-23 Description: A vulnerability was found in Intelbras VIP S3020 G2, VIP S4020 G2, VIP S4020 G3 and VIP S4320 G2 up to 20241222. It has been classified as critical. This affects an unknown part of the file ../mtd/Config/Sha1Account1 of the component Web Interface. The manipulation leads to path traversal: '../filedir'. It is possible to initiate the attack remotely. The exploit has been disclosed t
leads to path traversal: '../filedir'. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289167 - https://vuldb.com/?ctiid.289167 - https://vuldb.com/?submit.464260 - https://netsecfish.notion.site/Path-Traversal-Vulnerability-in-IntelBras-IP-Cameras-mtd-Config-Sha1Account1-and-mtd-Confi-15e6b683e67c80809442ee3425f753b7?pvs=4
CVE ID: CVE-2024-12898 State: PUBLISHED Published: 2024-12-23T00:00:21.643Z Last Updated: 2024-12-24T02:08:52.195Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: 1000 Projects Products: Attendance Tracking Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in 1000 Projects Attendance Tracking Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/faculty_action.php. The manipulation of the argument faculty_course_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. A
ed remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289168 - https://vuldb.com/?ctiid.289168 - https://vuldb.com/?submit.467424 - https://github.com/onupset/CVE/issues/1 - https://1000projects.org/
CVE ID: CVE-2024-12899 State: PUBLISHED Published: 2024-12-23T00:31:04.662Z Last Updated: 2024-12-24T02:07:27.415Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: 1000 Projects Products: Attendance Tracking Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in 1000 Projects Attendance Tracking Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/course_action.php. The manipulation of the argument course_code leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: R
tely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289169 - https://vuldb.com/?ctiid.289169 - https://vuldb.com/?submit.467628 - https://github.com/Murrayzed/CVE/issues/1 - https://1000projects.org/
CVE ID: CVE-2024-12900 State: PUBLISHED Published: 2024-12-23T01:31:05.891Z Last Updated: 2024-12-24T02:05:11.393Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: FoxCMS Problem Types: CWE-94, CWE-74 Description: A vulnerability classified as critical has been found in FoxCMS up to 1.2. Affected is an unknown function of the file /install/installdb.php of the component Configuration File Handler. The manipulation of the argument database password leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.28
to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289170 - https://vuldb.com/?ctiid.289170 - https://vuldb.com/?submit.467658 - https://note.zhaoj.in/share/iDCwOv9vfDTI