Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-6382 State: PUBLISHED Published: 2024-06-01T04:30:32.590Z Last Updated: 2024-08-02T08:28:21.816Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: averta Products: Master Slider – Responsive Touch Slider Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ms_slide' shortcode in all versions up to, and including, 3.9.9 due to insufficient input sanitization and output escaping on user supplied 'css_class' attribute. This makes it possible for authentic
ient input sanitization and output escaping on user supplied 'css_class' attribute. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2d2fc926-6f9f-4ed9-9598-e39b5e6c6544?source=cve - https://plugins.trac.wordpress.org/browser/master-slider/trunk/includes/msp-shortcodes.php#L55 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3065917%40master-slider&new=3065917%40mast
ps://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3065917%40master-slider&new=3065917%40master-slider&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3084860%40master-slider&new=3084860%40master-slider&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6383 State: PUBLISHED Published: 2024-01-08T19:00:34.142Z Last Updated: 2025-04-17T18:07:00.271Z Vendors: Unknown Products: Debug Log Manager Problem Types: CWE-200 Information Exposure Description: The Debug Log Manager WordPress plugin before 2.3.0 contains a Directory listing vulnerability was discovered, which allows you to download the debug log without authorization and gain access to sensitive data Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/eae63103-3de6-4100-8f48-2bcf9a5c91fb
CVE ID: CVE-2023-6384 State: PUBLISHED Published: 2024-01-22T19:14:24.990Z Last Updated: 2025-06-11T16:36:59.472Z Vendors: Unknown Products: WP User Profile Avatar Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The WP User Profile Avatar WordPress plugin before 1.0.1 does not properly check for authorisation, allowing authors to delete and update arbitrary avatar Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/fbdefab4-614b-493b-a9ae-c5aeff8323ef/
CVE ID: CVE-2023-6385 State: PUBLISHED Published: 2024-04-10T05:00:02.214Z Last Updated: 2025-03-14T16:01:34.786Z Vendors: Unknown Products: WordPress Ping Optimizer Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WordPress Ping Optimizer WordPress plugin through 2.35.1.3.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as clearing logs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/362c56ff-85eb-480f-a825-9670d4c0e3d0/
CVE ID: CVE-2023-6386 State: PUBLISHED Published: 2025-02-05T09:31:10.106Z Last Updated: 2025-02-05T14:45:32.989Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-770 Description: A denial of service vulnerability was identified in GitLab CE/EE, affecting all versions from 15.11 prior to 16.6.7, 16.7 prior to 16.7.5 and 16.8 prior to 16.8.2 which allows an attacker to spike the GitLab instance resource usage resulting in service degradation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/433147 - https://hackerone.com/reports/2261581
CVE ID: CVE-2023-6387 State: PUBLISHED Published: 2024-02-02T15:18:13.169Z Last Updated: 2025-05-15T19:50:07.897Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: silabs.com Products: GSDK Problem Types: CWE-787, CWE-125 Description: A potential buffer overflow exists in the Bluetooth LE HCI CPC sample application in the Gecko SDK which may result in a denial of service or remote code execution Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/SiliconLabs/gecko_sdk/releases/tag/v4.4.0 - https://community.silabs.com/069Vm000000WNKuIAO
CVE ID: CVE-2023-6388 State: PUBLISHED Published: 2024-02-07T02:47:59.391Z Last Updated: 2025-09-29T18:05:47.532Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N) Vendors: Suite CRM Products: Suite CRM Problem Types: CWE-918 Description: Suite CRM version 7.14.2 allows making arbitrary HTTP requests through the vulnerable server. This is possible because the application is vulnerable to SSRF. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fluidattacks.com/advisories/leon/ - https://github.com/salesagility/SuiteCRM/ - https://docs.suitecrm.com/admin/releases/7.14.x/#_7_14_4
CVE ID: CVE-2023-6389 State: PUBLISHED Published: 2024-01-29T14:44:16.273Z Last Updated: 2025-06-20T19:43:33.210Z Vendors: Unknown Products: WordPress Toolbar Problem Types: CWE-601 URL Redirection to Untrusted Site ('Open Redirect') Description: The WordPress Toolbar WordPress plugin through 2.2.6 redirects to any URL via the "wptbto" parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/04dafc55-3a8d-4dd2-96da-7a8b100e5a81/ - https://magos-securitas
richment: References: - https://wpscan.com/vulnerability/04dafc55-3a8d-4dd2-96da-7a8b100e5a81/ - https://magos-securitas.com/txt/CVE-2023-6389.txt
CVE ID: CVE-2023-6390 State: PUBLISHED Published: 2024-01-29T14:44:29.371Z Last Updated: 2025-06-20T19:44:08.525Z Vendors: Unknown Products: WordPress Users Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WordPress Users WordPress plugin through 1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a0ca68d3-f885-46c9-9f6b-b77ad387d25d/ - https://magos-securitas.com/txt/2023-6390.txt
CVE ID: CVE-2023-6391 State: PUBLISHED Published: 2024-01-29T14:44:27.602Z Last Updated: 2025-05-29T15:09:36.413Z Vendors: Unknown Products: Custom User CSS Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Custom User CSS WordPress plugin through 0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/4098b18d-6ff3-462c-af05-48adb6599cf3/ - https://magos-securitas.com/txt/CVE-2023-6391.txt
CVE ID: CVE-2023-6393 State: PUBLISHED Published: 2023-12-06T16:58:54.230Z Last Updated: 2025-11-20T18:05:48.597Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: Red Hat build of Quarkus 2.13.9.Final, Red Hat build of Quarkus Problem Types: CWE-200 Description: A flaw was found in the Quarkus Cache Runtime. When request processing utilizes a Uni cached using @CacheResult and the cached Uni reuses the initial "completion" context, the processing switches to the cached Uni instead of the request context. This is a problem if the cached Uni context contains sensitive information, and could allow a malicious user to benefit from a POST request
the cached Uni context contains sensitive information, and could allow a malicious user to benefit from a POST request returning the response that is meant for another user, gaining access to sensitive data. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:7700 - https://access.redhat.com/security/cve/CVE-2023-6393 - https://bugzilla.redhat.com/show_bug.cgi?id=2253113
CVE ID: CVE-2023-6394 State: PUBLISHED Published: 2023-12-09T01:26:52.908Z Last Updated: 2025-11-20T07:07:24.077Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Red Hat Products: Red Hat build of Quarkus 2.13.9.Final, Red Hat build of Quarkus 3.2.9.Final Problem Types: CWE-862 Description: A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the request without authentication despite the endpoint being secured. This can allow an attacker to access information and functionality outside of normal granted API permissions. Additional Analyst Notes
an attacker to access information and functionality outside of normal granted API permissions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2023:7612 - https://access.redhat.com/errata/RHSA-2023:7700 - https://access.redhat.com/security/cve/CVE-2023-6394 - https://bugzilla.redhat.com/show_bug.cgi?id=2252197
CVE ID: CVE-2023-6395 State: PUBLISHED Published: 2024-01-16T14:33:02.308Z Last Updated: 2025-02-13T17:26:22.188Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a, Red Hat, Fedora Products: mock, Red Hat Enterprise Linux 6, Extra Packages for Enterprise Linux, Fedora Problem Types: CWE-20 Description: The Mock software contains a vulnerability wherein an attacker could potentially exploit privilege escalation, enabling the execution of arbitrary code with root user privileges. This weakness stems from the absence of proper sandboxing during the expansion and execution of Jinja2 templates, which may be included in certain configuration parameters. While th
ing the expansion and execution of Jinja2 templates, which may be included in certain configuration parameters. While the Mock documentation advises treating users added to the mock group as privileged, certain build systems invoking mock on behalf of users might inadvertently permit less privileged users to define configuration tags. These tags could then be passed as parameters to mock during execution, potentially leading to the utilization of Jinja2 templates for remote privilege escalation and the execution of arbitrary code as the root user on the build server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/c
onal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-6395 - https://bugzilla.redhat.com/show_bug.cgi?id=2252206 - https://github.com/xsuchy/templated-dictionary/commit/0740bd0ca8d487301881541028977d120f8b8933 - https://github.com/xsuchy/templated-dictionary/commit/bcd90f0dafa365575c4b101e6f5d98c4ef4e4b69 - http://www.openwall.com/lists/oss-security/2024/01/16/1 - http://www.openwall.com/lists/oss-security/2024/01/16/3 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NBFYREAJH4T7GXXQZ4GJEREN4Q3AHS3K/ - https://lists.fedoraproject.org/archives/list/package-announce@lis
oject.org/message/NBFYREAJH4T7GXXQZ4GJEREN4Q3AHS3K/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/62SP2BJC2AFLFJJAEHPGZ3ZINTBTI7AN/
CVE ID: CVE-2023-6397 State: PUBLISHED Published: 2024-02-20T01:19:27.475Z Last Updated: 2024-08-02T08:28:21.794Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Zyxel Products: ATP series firmware, USG FLEX series firmware Problem Types: CWE-476 Description: A null pointer dereference vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1 and USG FLEX series firmware versions from 4.50 through 5.37 Patch 1 could allow a LAN-based attacker to cause denial-of-service (DoS) conditions by downloading a crafted RAR compressed file onto a LAN-side host if the firewall has the “Anti-Malware” feature enabled. Additional Analyst Notes: -
ompressed file onto a LAN-side host if the firewall has the “Anti-Malware” feature enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps-02-20-2024
CVE ID: CVE-2023-6398 State: PUBLISHED Published: 2024-02-20T01:34:32.229Z Last Updated: 2024-08-25T15:46:49.897Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Zyxel Products: ATP series firmware, USG FLEX series firmware, USG FLEX 50(W) series firmware, USG20(W)-VPN series firmware, NWA50AX firmware, WAC500 firmware, WAX300H firmware, WBE660S firmware, USG FLEX H series firmware Problem Types: CWE-78 Description: A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware v
through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1, USG FLEX H series firmware versions from 1.10 through 1.10 Patch 1, NWA50AX firmware versions through 6.29(ABYW.3), WAC500 firmware versions through 6.65(ABVS.1), WAX300H firmware versions through 6.60(ACHF.1), and WBE660S firmware versions through 6.65(ACGG.1) could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device via FTP. Additional Analyst Notes: - CVE Program Container: - CISA ADP
ating system (OS) commands on an affected device via FTP. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps-02-20-2024
CVE ID: CVE-2023-6399 State: PUBLISHED Published: 2024-02-20T01:42:21.027Z Last Updated: 2024-08-02T08:28:21.797Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Zyxel Products: ATP series firmware, USG FLEX series firmware, USG FLEX 50(W) series firmware, USG20(W)-VPN series firmware, USG FLEX H series firmware Problem Types: CWE-134 Description: A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1, and USG
versions from 4.16 through 5.37 Patch 1, USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1, and USG FLEX H series firmware versions from 1.10 through 1.10 Patch 1 could allow an authenticated IPSec VPN user to cause DoS conditions against the “deviceid” daemon by sending a crafted hostname to an affected device if it has the “Device Insight” feature enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps-02-20-2024
CVE ID: CVE-2023-6400 State: PUBLISHED Published: 2024-03-27T12:30:11.235Z Last Updated: 2024-08-15T19:47:34.090Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: OpenText™ Products: ZENworks Configuration Management (ZCM) Problem Types: CWE-863 Description: Incorrect Authorization vulnerability in OpenText™ ZENworks Configuration Management (ZCM) allows Unauthorized Use of Device Resources.This issue affects ZENworks Configuration Management (ZCM) versions: 2020 update 3, 23.3, and 23.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://portal.microfocus.com/s/article/KM000027630?language=en_US
CVE ID: CVE-2023-6401 State: PUBLISHED Published: 2023-11-30T14:31:04.006Z Last Updated: 2024-08-02T08:28:21.819Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: NotePad++ Problem Types: CWE-427 Description: A vulnerability classified as problematic was found in NotePad++ up to 8.1. Affected by this vulnerability is an unknown functionality of the file dbghelp.exe. The manipulation leads to uncontrolled search path. An attack has to be approached locally. The identifier VDB-246421 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program
vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.246421 - https://vuldb.com/?ctiid.246421
CVE ID: CVE-2023-6402 State: PUBLISHED Published: 2023-11-30T15:00:05.748Z Last Updated: 2025-05-29T14:18:19.041Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: PHPGurukul Products: Nipah Virus Testing Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in PHPGurukul Nipah Virus Testing Management System 1.0. This affects an unknown part of the file add-phlebotomist.php. The manipulation of the argument empid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-246423. Additional Ana
n disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-246423. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.246423 - https://vuldb.com/?ctiid.246423 - https://github.com/dhabaleshwar/niv_testing_sqli/blob/main/exploit.md
CVE ID: CVE-2023-6407 State: PUBLISHED Published: 2023-12-14T05:02:30.242Z Last Updated: 2024-08-02T08:28:21.777Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: Schneider Electric Products: Easy UPS Online Monitoring Software Problem Types: CWE-22 Description: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause arbitrary file deletion upon service restart when accessed by a local and low-privileged attacker. Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-346-03&p_enDocType=Security+and+Safety+Notice&p
ces: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-346-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-346-03.pdf
CVE ID: CVE-2023-6408 State: PUBLISHED Published: 2024-02-14T16:52:24.805Z Last Updated: 2024-08-02T08:28:21.776Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: Modicon M340 CPU (part numbers BMXP34*), Modicon M580 CPU (part numbers BMEP* and BMEH*, excluding M580 CPU Safety), Modicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S), EcoStruxure Control Expert, EcoStruxure Process Expert Problem Types: CWE-924 Description: CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause a denial of service and loss of confidentiality, integrity of controlle
on Channel vulnerability exists that could cause a denial of service and loss of confidentiality, integrity of controllers when conducting a Man in the Middle attack. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-044-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-044-01.pdf
CVE ID: CVE-2023-6409 State: PUBLISHED Published: 2024-02-14T16:47:05.519Z Last Updated: 2025-05-12T14:07:03.007Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Schneider Electric Products: EcoStruxure Control Expert, EcoStruxure Process Expert Problem Types: CWE-798 Description: CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause unauthorized access to a project file protected with application password when opening the file with EcoStruxure Control Expert. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-044-01&p_enDocType=Secur
P Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-044-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-044-01.pdf
CVE ID: CVE-2023-6410 State: PUBLISHED Published: 2023-11-30T13:09:58.800Z Last Updated: 2024-08-02T08:28:21.828Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Voovi Social Networking Script Products: Voovi Social Networking Script Problem Types: CWE-89 Description: A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via editprofile.php in multiple parameters. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the application. Additional Analyst Notes: - CVE Program Container
the server and retrieve all the information stored in the application. Additional Analyst Notes: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-voovi-social-networking-script
CVE ID: CVE-2023-6411 State: PUBLISHED Published: 2023-11-30T13:10:57.573Z Last Updated: 2024-11-21T19:34:14.279Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Voovi Social Networking Script Products: Voovi Social Networking Script Problem Types: CWE-89 Description: A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via home.php in the update parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the application. Additional Analyst Notes: - CVE Program Container: - CI
rver and retrieve all the information stored in the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-voovi-social-networking-script
CVE ID: CVE-2023-6412 State: PUBLISHED Published: 2023-11-30T13:11:34.854Z Last Updated: 2024-08-02T08:28:21.805Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Voovi Social Networking Script Products: Voovi Social Networking Script Problem Types: CWE-89 Description: A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via photo.php in multiple parameters. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the application. Additional Analyst Notes: - CVE Program Container: Refe
rver and retrieve all the information stored in the application. Additional Analyst Notes: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-voovi-social-networking-script