Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-43305 State: PUBLISHED Published: 2023-12-08T00:00:00 Last Updated: 2024-08-02T19:37:23.771Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in studio kent mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/syz913/CVE-reports/blob/main/CVE-2023-43305.md
CVE ID: CVE-2023-43309 State: PUBLISHED Published: 2023-09-21T00:00:00 Last Updated: 2024-09-24T18:21:30.242Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a stored cross-site scripting (XSS) vulnerability in Webmin 2.002 and below via the Cluster Cron Job tab Input field, which allows attackers to run malicious scripts by injecting a specially crafted payload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/TishaManandhar/Webmin_xss_POC/blob/main/XSS
CVE ID: CVE-2023-43314 State: PUBLISHED Published: 2023-09-27T00:00:00 Last Updated: 2024-08-02T19:37:23.720Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Zyxel Products: PMG2005-T20B Problem Types: CWE-120 Description: ** UNSUPPORTED WHEN ASSIGNED **The buffer overflow vulnerability in the Zyxel PMG2005-T20B firmware version V1.00(ABNK.2)b11_C0 could allow an unauthenticated attacker to cause a denial of service condition via a crafted uid. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Rumble00/Rumble/issues/1
CVE ID: CVE-2023-43317 State: PUBLISHED Published: 2024-01-24T00:00:00.000Z Last Updated: 2025-06-20T19:21:09.817Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Coign CRM Portal v.06.06 allows a remote attacker to escalate privileges via the userPermissionsList parameter in Session Storage component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/amjadali-110/CVE-2023-43317/
CVE ID: CVE-2023-43318 State: PUBLISHED Published: 2024-03-05T00:00:00.000Z Last Updated: 2025-11-04T18:17:22.460Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP-Link JetStream Smart Switch TL-SG2210P 5.0 Build 20211201 allows attackers to escalate privileges via modification of the 'tid' and 'usrlvl' values in GET requests. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/str2ver/CVE-2023-43318/tree/main - https://seclists.org/fulldisclosure/2024/Mar/9 - https://seclists.org/fulldisclosure/2024/Mar/9
CVE ID: CVE-2023-43319 State: PUBLISHED Published: 2023-09-25T00:00:00 Last Updated: 2024-09-24T17:50:28.549Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in the Sign-In page of IceWarp WebClient 10.3.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://medium.com/%40muthumohanprasath.r/reflected-cross-site-scripting-on-icewarp-webclient-product-cve-2023-43319-c2ad758ac2bc
CVE ID: CVE-2023-43320 State: PUBLISHED Published: 2023-09-27T00:00:00 Last Updated: 2024-11-26T20:22:30.047Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Proxmox Server Solutions GmbH Proxmox VE v.5.4 thru v.8.0, Proxmox Backup Server v.1.1 thru v.3.0, and Proxmox Mail Gateway v.7.1 thru v.8.0 allows a remote authenticated attacker to escalate privileges via bypassing the two-factor authentication component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.proxmox.com/show_bug.cgi?id=4579 - https://bugzilla.proxmox.com/show_bug.cgi?id=4584 - https://github.com/proxmox/proxmox-rs/commit/50b793db8d3421bbfe2bce
https://bugzilla.proxmox.com/show_bug.cgi?id=4584 - https://github.com/proxmox/proxmox-rs/commit/50b793db8d3421bbfe2bce060a486263f18a90cb - http://packetstormsecurity.com/files/176967/Proxmox-VE-7.4-1-TOTP-Brute-Force.html
CVE ID: CVE-2023-43321 State: PUBLISHED Published: 2023-10-04T00:00:00 Last Updated: 2024-09-19T19:21:08.111Z Vendors: n/a Products: n/a Problem Types: n/a Description: File Upload vulnerability in Digital China Networks DCFW-1800-SDC v.3.0 allows an authenticated attacker to execute arbitrary code via the wget function in the /sbin/cloudadmin.sh component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Push3AX/vul/blob/main/DCN/DCFW_1800_SDC_CommandInjection.md - https://www.dcnetworks.com.cn/goods/61.html
CVE ID: CVE-2023-43322 State: PUBLISHED Published: 2023-10-28T00:00:00 Last Updated: 2024-09-05T20:47:33.814Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZPE Systems, Inc Nodegrid OS v5.0.0 to v5.0.17, v5.2.0 to v5.2.19, v5.4.0 to v5.4.16, v5.6.0 to v5.6.13, v5.8.0 to v5.8.10, and v5.10.0 to v5.10.3 was discovered to contain a command injection vulnerability via the endpoint /v1/system/toolkit/files/. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://psirt.zpesystems.com/portal/en/kb/articles/security-advisory-zpe-ng-2023-001-12-10-2023
CVE ID: CVE-2023-43323 State: PUBLISHED Published: 2023-09-28T00:00:00 Last Updated: 2024-09-24T14:00:35.597Z Vendors: n/a Products: n/a Problem Types: n/a Description: mooSocial 3.1.8 is vulnerable to external service interaction on post function. When executed, the server sends a HTTP and DNS request to external server. The Parameters effected are multiple - messageText, data[wall_photo], data[userShareVideo] and data[userShareLink]. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ahrixia/CVE-2023-43323
CVE ID: CVE-2023-43325 State: PUBLISHED Published: 2023-09-25T00:00:00 Last Updated: 2024-09-24T17:46:48.155Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability in the data[redirect_url] parameter of mooSocial v3.1.8 allows attackers to steal user's session cookies and impersonate their account via a crafted URL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://moosocial.com/ - https://travel.moosocial.com/ - https://github.com/ahrixia/CVE-2023-43325
CVE ID: CVE-2023-43326 State: PUBLISHED Published: 2023-09-25T00:00:00 Last Updated: 2024-09-24T15:59:07.388Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability exisits in multiple url of mooSocial v3.1.8 allows attackers to steal user's session cookies and impersonate their account via a crafted URL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://moosocial.com/ - https://github.com/ahrixia/CVE-2023-43326
CVE ID: CVE-2023-43331 State: PUBLISHED Published: 2023-09-26T00:00:00 Last Updated: 2024-09-23T19:50:24.549Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the Add User function of Small CRM v3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Kartikhunter/CVE/blob/main/CVE-2023-43331
CVE ID: CVE-2023-43336 State: PUBLISHED Published: 2023-11-02T00:00:00 Last Updated: 2024-09-17T13:14:25.445Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sangoma Technologies FreePBX before cdr 15.0.18, 16.0.40, 15.0.16, and 16.0.17 was discovered to contain an access control issue via a modified parameter value, e.g., changing extension=self to extension=101. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://freepbx.com - http://sangoma.com - https://medium.com/%40janirudransh/security-disclosure-of-vulnerability-cve-2023-23336-4429d416f826
CVE ID: CVE-2023-43338 State: PUBLISHED Published: 2023-09-22T00:00:00 Last Updated: 2024-09-24T15:50:41.470Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cesanta mjs v2.20.0 was discovered to contain a function pointer hijacking vulnerability via the function mjs_get_ptr(). This vulnerability allows attackers to execute arbitrary code via a crafted input. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cesanta/mjs/issues/250
CVE ID: CVE-2023-43339 State: PUBLISHED Published: 2023-09-25T00:00:00 Last Updated: 2024-09-24T15:58:07.857Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Scripting (XSS) vulnerability in cmsmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted payload injected into the Database Name, DataBase User or Database Port components. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.cmsmadesimple.org/ - https://github.com/sromanhu/Cmsmadesimple-CMS-Stored-XSS/blob/main/README.md - https://github.com/sromanhu/CVE-2023-43339-CMSmadesimple-Reflected-XSS---Installation/blob/main/README.md
CVE ID: CVE-2023-43340 State: PUBLISHED Published: 2023-10-19T00:00:00 Last Updated: 2024-09-12T20:16:25.243Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in evolution v.3.2.3 allows a local attacker to execute arbitrary code via a crafted payload injected into the cmsadmin, cmsadminemail, cmspassword and cmspasswordconfim parameters Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sromanhu/Evolution-Reflected-XSS---Installation-Admin-Options - https://github.com/sromanhu/-CVE-2023-43340-Evolution-Reflected-XSS---Installation-Admin-Options
CVE ID: CVE-2023-43341 State: PUBLISHED Published: 2023-10-19T00:00:00 Last Updated: 2024-09-12T19:56:14.975Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in evolution evo v.3.2.3 allows a local attacker to execute arbitrary code via a crafted payload injected uid parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sromanhu/Evolution-Reflected-XSS---Installation-Connection- - https://github.com/sromanhu/CVE-2023-43341-Evolution-Reflected-XSS---Installation-Connection-
CVE ID: CVE-2023-43342 State: PUBLISHED Published: 2023-10-19T00:00:00 Last Updated: 2024-09-12T19:59:48.244Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to the Languages Menu component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sromanhu/Quick-CMS-Stored-XSS---Languages-Frontend - https://github.com/sromanhu/CVE-2023-43342-Quick-CMS-Stored-XSS---Languages-Frontend
CVE ID: CVE-2023-43343 State: PUBLISHED Published: 2023-10-05T00:00:00 Last Updated: 2024-09-12T20:00:05.384Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to the Files - Description parameter in the Pages Menu component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sromanhu/Quick-CMS-Stored-XSS---Pages-Files - https://github.com/sromanhu/CVE-2023-43343-Quick-CMS-Stored-XSS---Pages-Files
CVE ID: CVE-2023-43344 State: PUBLISHED Published: 2023-10-19T00:00:00 Last Updated: 2024-09-12T19:59:56.685Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to the SEO - Meta description parameter in the Pages Menu component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sromanhu/CVE-2023-43344-Quick-CMS-Stored-XSS---SEO-Meta-description
CVE ID: CVE-2023-43345 State: PUBLISHED Published: 2023-10-19T00:00:00 Last Updated: 2024-09-12T19:54:18.731Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to the Content - Name parameter in the Pages Menu component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sromanhu/CVE-2023-43345-Quick-CMS-Stored-XSS---Pages-Content
CVE ID: CVE-2023-43346 State: PUBLISHED Published: 2023-10-20T00:00:00 Last Updated: 2024-09-12T14:59:50.799Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to the Backend - Dashboard parameter in the Languages Menu component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sromanhu/Quick-CMS-Stored-XSS---Languages-Backend - https://github.com/sromanhu/CVE-2023-43346-Quick-CMS-Stored-XSS---Languages-Backend
CVE ID: CVE-2023-43352 State: PUBLISHED Published: 2023-10-26T00:00:00 Last Updated: 2024-09-12T14:16:54.036Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted payload to the Content Manager Menu component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sromanhu/CMSmadesimple-SSTI--Content - https://github.com/sromanhu/CVE-2023-43352-CMSmadesimple-SSTI--Content
CVE ID: CVE-2023-43353 State: PUBLISHED Published: 2023-10-20T00:00:00 Last Updated: 2024-09-12T14:58:33.559Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the extra parameter in the news menu component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sromanhu/CVE-2023-43353-CMSmadesimple-Stored-XSS---News---Extra
CVE ID: CVE-2023-43354 State: PUBLISHED Published: 2023-10-20T00:00:00 Last Updated: 2024-09-12T14:56:56.384Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Profiles parameter in the Extensions -MicroTiny WYSIWYG editor component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sromanhu/CVE-2023-43354-CMSmadesimple-Stored-XSS---MicroTIny-extension
CVE ID: CVE-2023-43355 State: PUBLISHED Published: 2023-10-20T00:00:00 Last Updated: 2024-09-12T14:54:03.401Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the password and password again parameters in the My Preferences - Add user component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sromanhu/CMSmadesimple-Reflected-XSS---Add-user - https://github.com/sromanhu/CVE-2023-43355-CMSmadesimple-Reflected-XSS---Add-user
CVE ID: CVE-2023-43356 State: PUBLISHED Published: 2023-10-20T00:00:00 Last Updated: 2024-09-12T14:52:19.299Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Global Meatadata parameter in the Global Settings Menu component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sromanhu/CVE-2023-43356-CMSmadesimple-Stored-XSS---Global-Settings
CVE ID: CVE-2023-43357 State: PUBLISHED Published: 2023-10-20T00:00:00 Last Updated: 2024-09-12T14:50:18.286Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Title parameter in the Manage Shortcuts component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sromanhu/CVE-2023-43357-CMSmadesimple-Stored-XSS---Shortcut
CVE ID: CVE-2023-43358 State: PUBLISHED Published: 2023-10-23T00:00:00 Last Updated: 2024-09-12T15:39:51.927Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Title parameter in the News Menu component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sromanhu/CMSmadesimple-Stored-XSS---News - https://github.com/sromanhu/CVE-2023-43358-CMSmadesimple-Stored-XSS---News
CVE ID: CVE-2023-43359 State: PUBLISHED Published: 2023-10-19T00:00:00 Last Updated: 2024-09-12T19:52:44.832Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Page Specific Metadata and Smarty data parameters in the Content Manager Menu component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sromanhu/CVE-2023-43359-CMSmadesimple-Stored-XSS----Content-Manager
CVE ID: CVE-2023-43360 State: PUBLISHED Published: 2023-10-24T00:00:00 Last Updated: 2024-09-11T18:19:27.553Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Top Directory parameter in the File Picker Menu component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sromanhu/CMSmadesimple-Stored-XSS---File-Picker-extension - https://github.com/sromanhu/CVE-2023-43360-CMSmadesimple-Stored-XSS---File-Picker-extension
CVE ID: CVE-2023-43361 State: PUBLISHED Published: 2023-10-02T00:00:00.000Z Last Updated: 2025-11-04T22:04:59.092Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute arbitrary code and cause a denial of service during the conversion of wav files to ogg files. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xiph/vorbis-tools/issues/41 - https://github.com/xiph/vorbis-tools - https://github.com/xiph/vorbis - https://xiph.org/vorbis/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GJKTWQXOZDMCXVEFCQZVH3F3FQYMNYLI/
sts.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GJKTWQXOZDMCXVEFCQZVH3F3FQYMNYLI/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T47YXGRUCUKN7WEOHUEIUNJ2KZ2C2IDN/
CVE ID: CVE-2023-43364 State: PUBLISHED Published: 2023-12-12T00:00:00 Last Updated: 2024-10-09T13:30:12.973Z Vendors: n/a Products: n/a Problem Types: n/a Description: main.py in Searchor before 2.4.2 uses eval on CLI input, which may cause unexpected code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ArjunSharda/Searchor/pull/130 - https://github.com/nexis-nexis/Searchor-2.4.0-POC-Exploit- - https://github.com/nikn0laty/Exploit-for-Searchor-2.4.0-Arbitrary-CMD-Injection - https://github.com/advisories/GHSA-66m2-493m-crh2 - https://github.com/ArjunSharda/Searchor/commit/16016506f7bf92b0f21f51841d599126d6fcd15b
CVE ID: CVE-2023-43371 State: PUBLISHED Published: 2023-09-20T00:00:00 Last Updated: 2024-09-24T18:00:09.521Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the numcaselle parameter at /hoteldruid/creaprezzi.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://flashy-lemonade-192.notion.site/SQL-injection-in-hoteldruid-version-3-0-5-via-numcaselle-parameter-e1e3d6938a464a8db1ca18ee66b7e66e?pvs=4
CVE ID: CVE-2023-43373 State: PUBLISHED Published: 2023-09-20T00:00:00 Last Updated: 2024-09-24T17:59:27.505Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the n_utente_agg parameter at /hoteldruid/interconnessioni.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://flashy-lemonade-192.notion.site/SQL-injection-in-hoteldruid-version-3-0-5-via-n_utente_agg-parameter-948a6d724b5348f3867ee6d780f98f1a?pvs=4
CVE ID: CVE-2023-43374 State: PUBLISHED Published: 2023-09-20T00:00:00 Last Updated: 2024-09-24T17:58:44.163Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the id_utente_log parameter at /hoteldruid/personalizza.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://flashy-lemonade-192.notion.site/SQL-injection-in-hoteldruid-version-3-0-5-via-id_utente_log-parameter-8b89f014004947e7bd2ecdacf1610cf9?pvs=4
CVE ID: CVE-2023-43375 State: PUBLISHED Published: 2023-09-20T00:00:00 Last Updated: 2024-09-24T17:57:45.996Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hoteldruid v3.0.5 was discovered to contain multiple SQL injection vulnerabilities at /hoteldruid/clienti.php via the annonascita, annoscaddoc, giornonascita, giornoscaddoc, lingua_cli, mesenascita, and mesescaddoc parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://flashy-lemonade-192.notion.site/Cross-site-scripting-in-hoteldruid-version-3-0-5-via-multiple-post-parameter-ddbd9a9011744ed2b8fc995bbc9de56d?pvs=4
CVE ID: CVE-2023-43376 State: PUBLISHED Published: 2023-09-20T00:00:00 Last Updated: 2024-09-24T17:50:35.963Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in /hoteldruid/clienti.php of Hoteldruid v3.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the nometipotariffa1 parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://flashy-lemonade-192.notion.site/Cross-site-scripting-in-hoteldruid-version-3-0-5-via-nometipotariffa1-post-parameter-703fde27462c43a1aaa1097fb3416cdc?pvs=4
CVE ID: CVE-2023-43377 State: PUBLISHED Published: 2023-09-20T00:00:00 Last Updated: 2024-09-24T17:49:47.785Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in /hoteldruid/visualizza_contratto.php of Hoteldruid v3.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the destinatario_email1 parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://flashy-lemonade-192.notion.site/Cross-site-scripting-in-hoteldruid-version-3-0-5-via-destinatario_email1-post-parameter-0ac6596d5b534dd1b2a49987ad065d1c?pvs=4
CVE ID: CVE-2023-43378 State: PUBLISHED Published: 2025-04-22T00:00:00.000Z Last Updated: 2025-04-23T14:47:32.234Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in Hoteldruid v3.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the commento1_1 parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://flashy-lemonade-192.notion.site/Cross-site-scripting-in-hoteldruid-version-3-0-5-via-commento1_1-post-parameter-44ff18cb61cd4a80bbba75d5e4360ee4