Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-13115 State: PUBLISHED Published: 2025-02-04T06:00:03.687Z Last Updated: 2025-02-04T18:25:53.273Z Vendors: Unknown Products: WP Projects Portfolio with Client Testimonials Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP Projects Portfolio with Client Testimonials WordPress plugin through 3.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/76e46727-3995-4442-bbcb-04e793d72108/
CVE ID: CVE-2024-13116 State: PUBLISHED Published: 2025-01-27T06:00:11.682Z Last Updated: 2025-02-03T14:23:12.703Z Vendors: Unknown Products: Crelly Slider Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Crelly Slider WordPress plugin before 1.4.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1755c8ad-7620-4b12-bba0-013e80c2691b/
CVE ID: CVE-2024-13117 State: PUBLISHED Published: 2025-01-27T06:00:12.163Z Last Updated: 2025-02-03T14:29:29.172Z Vendors: Unknown Products: Social Share Buttons for WordPress Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The Social Share Buttons for WordPress plugin through 2.7 allows an unauthenticated user to upload arbitrary images and change the path where they are uploaded Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/3234cdac-f328-4f1e-a1de-31fbd86aefb9/
CVE ID: CVE-2024-13118 State: PUBLISHED Published: 2025-03-25T06:00:12.234Z Last Updated: 2025-03-25T13:50:48.275Z Vendors: Unknown Products: IP Based Login Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The IP Based Login WordPress plugin before 2.4.1 does not have CSRF checks in some places, which could allow attackers to make logged in users delete all logs via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/eba6f98e-b931-4f02-b190-ca855a674839/
CVE ID: CVE-2024-13119 State: PUBLISHED Published: 2025-02-13T06:00:05.649Z Last Updated: 2025-02-13T14:49:34.879Z Vendors: Unknown Products: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Ana
cripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/32600a45-a8cd-446c-9aa2-0621a02a9754/
CVE ID: CVE-2024-13120 State: PUBLISHED Published: 2025-02-13T06:00:11.655Z Last Updated: 2025-03-22T14:39:00.625Z Vendors: Unknown Products: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Ana
cripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5b70798c-c30d-42e6-ac72-821c5568b9b5/
CVE ID: CVE-2024-13121 State: PUBLISHED Published: 2025-02-13T06:00:11.784Z Last Updated: 2025-02-19T21:33:46.205Z Vendors: Unknown Products: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Ana
cripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/59ee8fe5-4820-4d52-b17a-7044631c40c1/
CVE ID: CVE-2024-13122 State: PUBLISHED Published: 2025-03-25T06:00:12.535Z Last Updated: 2025-03-25T13:49:16.284Z Vendors: Unknown Products: AFI Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The AFI WordPress plugin before 1.100.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/512721cb-e544-4d26-87ca-43d83e77f8e4/
CVE ID: CVE-2024-13123 State: PUBLISHED Published: 2025-03-25T06:00:12.871Z Last Updated: 2025-03-25T13:44:04.881Z Vendors: Unknown Products: AFI Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The AFI WordPress plugin before 1.100.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/417178de-17ff-438c-a36c-b90db6486a46/
CVE ID: CVE-2024-13124 State: PUBLISHED Published: 2025-03-24T06:00:07.091Z Last Updated: 2025-03-24T18:08:14.408Z Vendors: Unknown Products: Photo Gallery by 10Web Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Photo Gallery by 10Web WordPress plugin before 1.8.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5b3bf87b-73a1-47e8-bb00-0dfded07b191/
CVE ID: CVE-2024-13125 State: PUBLISHED Published: 2025-02-13T06:00:12.331Z Last Updated: 2025-02-19T21:32:23.670Z Vendors: Unknown Products: Everest Forms Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Everest Forms WordPress plugin before 3.0.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f60a8358-1765-4cae-9c89-0d75c5e394ec/
CVE ID: CVE-2024-13126 State: PUBLISHED Published: 2025-03-16T06:00:04.512Z Last Updated: 2025-03-17T18:14:06.778Z Vendors: Unknown Products: Download Manager Problem Types: CWE-552 Files or Directories Accessible to External Parties Description: The Download Manager WordPress plugin before 3.3.07 doesn't prevent directory listing on web servers that don't use htaccess, allowing unauthorized access of files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c2c69a44-4ecc-41d1-a10c-cfe9c875b803/
CVE ID: CVE-2024-13127 State: PUBLISHED Published: 2025-05-15T20:06:58.966Z Last Updated: 2025-05-20T19:29:20.161Z Vendors: Unknown Products: LearnPress Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/003ac248-74db-4b83-af0b-aa37ffb9b3d3/
CVE ID: CVE-2024-13128 State: PUBLISHED Published: 2025-05-15T20:06:59.197Z Last Updated: 2025-05-20T19:29:09.079Z Vendors: Unknown Products: LearnPress Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1506a339-f85a-408a-8efa-ca83eb3b3ffb/
CVE ID: CVE-2024-13129 State: PUBLISHED Published: 2025-01-03T21:31:06.704Z Last Updated: 2025-08-28T14:41:10.652Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: n/a Products: Roxy-WI Problem Types: CWE-78, CWE-77 Description: A vulnerability was found in Roxy-WI up to 8.1.3. It has been declared as critical. Affected by this vulnerability is the function action_service of the file app/modules/roxywi/roxy.py. The manipulation of the argument action/service leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 8.1.4 is able to address this issue. The identifier of the patch is 32313928
ublic and may be used. Upgrading to version 8.1.4 is able to address this issue. The identifier of the patch is 32313928eb9ce906887b8a30bf7b9a3d5c0de1be. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290149 - https://vuldb.com/?ctiid.290149 - https://vuldb.com/?submit.468530 - https://github.com/roxy-wi/roxy-wi/pull/410 - https://github.com/roxy-wi/roxy-wi/pull/410#issuecomment-2561289700 - https://github.com/0xs1ash/Exploits/tree/main/CVE-EXPLOIT - https://github.com/roxy-wi/roxy-wi/pull/410/commits/32313928eb9ce906887b8a30bf7b9a3d5c0de1be - https://github.com/roxy-wi/roxy-wi/releases/tag/v8.1.4
CVE ID: CVE-2024-13130 State: PUBLISHED Published: 2025-01-05T01:00:12.751Z Last Updated: 2025-04-08T04:19:53.063Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Dahua Products: IPC-HFW1200S, IPC-HFW2300R-Z, IPC-HFW5220E-Z, IPC-HDW1200S Problem Types: CWE-24, CWE-23 Description: A vulnerability was found in Dahua IPC-HFW1200S, IPC-HFW2300R-Z, IPC-HFW5220E-Z and IPC-HDW1200S up to 20241222. It has been rated as problematic. Affected by this issue is some unknown functionality of the file ../mtd/Config/Sha1Account1 of the component Web Interface. The manipulation leads to path traversal: '../filedir'. The attack may be launched remotely. The exploit has been
face. The manipulation leads to path traversal: '../filedir'. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290204 - https://vuldb.com/?ctiid.290204 - https://vuldb.com/?submit.464260 - https://netsecfish.notion.site/Path-Traversal-Vulnerability-in-IntelBras-IP-Cameras-mtd-Config-Sha1Account1-and-mtd-Confi-15e6b683e67c80809442ee3425f753b7?pvs=4
CVE ID: CVE-2024-13131 State: REJECTED Published: 2025-01-05T03:00:14.594Z Last Updated: 2025-01-14T13:35:54.086Z Description: No description available.
CVE ID: CVE-2024-13132 State: PUBLISHED Published: 2025-01-05T04:31:04.880Z Last Updated: 2025-01-06T15:03:41.220Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: n/a Products: Emlog Pro Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic was found in Emlog Pro up to 2.4.3. This vulnerability affects unknown code of the file /admin/article.php of the component Subpage Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290206 - https://vuldb.com/?ctiid.290206
al Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290206 - https://vuldb.com/?ctiid.290206 - https://vuldb.com/?submit.467912 - https://github.com/emlog/emlog/issues/309 - https://github.com/emlog/emlog/issues/309#issue-2755317359
CVE ID: CVE-2024-13133 State: PUBLISHED Published: 2025-01-05T05:00:11.551Z Last Updated: 2025-01-06T14:48:05.621Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: ZeroWdd Products: studentmanager Problem Types: CWE-434, CWE-284 Description: A vulnerability, which was classified as critical, has been found in ZeroWdd studentmanager 1.0. This issue affects the function addStudent/editStudent of the file src/main/Java/com/wdd/studentmanager/controller/StudentController. java. The manipulation of the argument file leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vuln
tiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290207 - https://vuldb.com/?ctiid.290207 - https://github.com/ZeroWdd/studentmanager/issues/16 - https://github.com/ZeroWdd/studentmanager/issues/16#issue-2755347097
CVE ID: CVE-2024-13134 State: PUBLISHED Published: 2025-01-05T08:00:12.439Z Last Updated: 2025-01-06T15:58:47.645Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: ZeroWdd Products: studentmanager Problem Types: CWE-434, CWE-284 Description: A vulnerability, which was classified as critical, was found in ZeroWdd studentmanager 1.0. Affected is the function addTeacher/editTeacher of the file src/main/Java/com/wdd/studentmanager/controller/TeacherController. java. The manipulation of the argument file leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrich
ck remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290208 - https://vuldb.com/?ctiid.290208 - https://vuldb.com/?submit.467916 - https://github.com/ZeroWdd/studentmanager/issues/16 - https://github.com/ZeroWdd/studentmanager/issues/16#issue-2755347097
CVE ID: CVE-2024-13135 State: PUBLISHED Published: 2025-01-05T08:31:04.864Z Last Updated: 2025-01-06T15:58:24.165Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: n/a Products: Emlog Pro Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in Emlog Pro 2.4.3 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/twitter.php of the component Subpage Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290209 - https://vul
may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290209 - https://vuldb.com/?ctiid.290209 - https://vuldb.com/?submit.467929 - https://github.com/emlog/emlog/issues/311 - https://github.com/emlog/emlog/issues/311#issue-2755404584
CVE ID: CVE-2024-13136 State: PUBLISHED Published: 2025-01-05T09:00:15.361Z Last Updated: 2025-01-06T15:56:04.087Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: wangl1989 Products: mysiteforme Problem Types: CWE-502, CWE-20 Description: A vulnerability was found in wangl1989 mysiteforme 1.0 and classified as critical. Affected by this issue is the function rememberMeManager of the file src/main/java/com/mysiteforme/admin/config/ShiroConfig.java. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290210
he public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290210 - https://vuldb.com/?ctiid.290210 - https://vuldb.com/?submit.468391 - https://github.com/wangl1989/mysiteforme/issues/52 - https://github.com/wangl1989/mysiteforme/issues/52#issue-2757682365
CVE ID: CVE-2024-13137 State: PUBLISHED Published: 2025-01-05T10:00:15.436Z Last Updated: 2025-01-06T15:55:08.406Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: wangl1989 Products: mysiteforme Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in wangl1989 mysiteforme 1.0. It has been classified as problematic. This affects the function RestResponse of the file src/main/java/com/mysiteforme/admin/controller/system/SiteController. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vu
een disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290211 - https://vuldb.com/?ctiid.290211 - https://vuldb.com/?submit.468473 - https://github.com/wangl1989/mysiteforme/issues/54 - https://github.com/wangl1989/mysiteforme/issues/54#issue-2757765372
CVE ID: CVE-2024-13138 State: PUBLISHED Published: 2025-01-05T10:31:04.404Z Last Updated: 2025-01-06T15:54:18.624Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: wangl1989 Products: mysiteforme Problem Types: CWE-434, CWE-284 Description: A vulnerability was found in wangl1989 mysiteforme 1.0. It has been declared as critical. This vulnerability affects the function upload of the file src/main/java/com/mysiteform/admin/service/ipl/LocalUploadServiceImpl. The manipulation of the argument test leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
he exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290212 - https://vuldb.com/?ctiid.290212 - https://vuldb.com/?submit.468511 - https://github.com/wangl1989/mysiteforme/issues/55 - https://github.com/wangl1989/mysiteforme/issues/55#issue-2757868654
CVE ID: CVE-2024-13139 State: PUBLISHED Published: 2025-01-05T11:00:16.777Z Last Updated: 2025-01-06T15:53:26.788Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: wangl1989 Products: mysiteforme Problem Types: CWE-918 Description: A vulnerability was found in wangl1989 mysiteforme 1.0. It has been rated as critical. This issue affects the function doContent of the file src/main/java/com/mysiteform/admin/controller/system/FileController. The manipulation of the argument content leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
it has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290213 - https://vuldb.com/?ctiid.290213 - https://vuldb.com/?submit.468513 - https://github.com/wangl1989/mysiteforme/issues/56 - https://github.com/wangl1989/mysiteforme/issues/56#issue-2757876365
CVE ID: CVE-2024-13140 State: PUBLISHED Published: 2025-01-05T11:31:04.832Z Last Updated: 2025-01-06T15:52:12.955Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: n/a Products: Emlog Pro Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic has been found in Emlog Pro up to 2.4.3. Affected is an unknown function of the file /admin/article.php?action=upload_cover of the component Cover Upload Handler. The manipulation of the argument image leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vul
en disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290214 - https://vuldb.com/?ctiid.290214 - https://vuldb.com/?submit.468753 - https://github.com/emlog/emlog/issues/312 - https://github.com/emlog/emlog/issues/312#issue-2758546837
CVE ID: CVE-2024-13141 State: PUBLISHED Published: 2025-01-05T14:31:04.572Z Last Updated: 2025-01-06T15:50:35.321Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: osuuu Products: LightPicture Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic was found in osuuu LightPicture up to 1.2.2. This vulnerability affects unknown code of the file /api/upload of the component SVG File Upload Handler. The manipulation of the argument file leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.29022
the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290224 - https://vuldb.com/?ctiid.290224 - https://vuldb.com/?submit.468645 - https://github.com/Hebing123/cve/issues/83
CVE ID: CVE-2024-13142 State: PUBLISHED Published: 2025-01-05T23:00:14.617Z Last Updated: 2025-01-06T14:47:31.167Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: ZeroWdd Products: studentmanager Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in ZeroWdd studentmanager 1.0. It has been declared as problematic. This vulnerability affects the function submitAddRole of the file src/main/java/com/zero/system/controller/RoleController. java. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290230 - https://vuldb.com/?cti
. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290230 - https://vuldb.com/?ctiid.290230 - https://vuldb.com/?submit.469213 - https://github.com/ZeroWdd/manager-system/issues/6
CVE ID: CVE-2024-13143 State: PUBLISHED Published: 2025-01-05T23:31:04.583Z Last Updated: 2025-01-06T14:47:00.646Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: ZeroWdd Products: studentmanager Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in ZeroWdd studentmanager 1.0. It has been rated as problematic. This issue affects the function submitAddPermission of the file src/main/java/com/zero/system/controller/PermissionController. java. The manipulation of the argument url leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional A