Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-5218 State: PUBLISHED Published: 2024-05-25T03:30:47.881Z Last Updated: 2024-08-01T21:03:11.078Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: designextreme Products: Reviews and Rating – Google Reviews Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The Reviews and Rating – Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file upload feature in all versions up to, and including, 5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above
sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/71408e0b-aed8-4077-add2-7f3b249e85f5?source=cve - https://plugins.trac.wordpress.org/browser/g-business-reviews-rating/tags/5.1/index.php#L804 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3092202%40g-business-reviews-rating%2Ftrunk&old=3076444%40g-business-reviews-rating%2Ftrunk&sfp_email=
il=&reponame=&new=3092202%40g-business-reviews-rating%2Ftrunk&old=3076444%40g-business-reviews-rating%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-5219 State: PUBLISHED Published: 2024-07-02T06:49:43.750Z Last Updated: 2024-08-01T21:03:10.995Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: supsysticcom Products: Easy Google Maps Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Easy Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file upload feature in all versions up to, and including, 1.11.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web sc
ping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4af9c623-1539-4afc-9dcd-3f97d29aa4f3?source=cve - https://plugins.trac.wordpress.org/browser/google-maps-easy/tags/1.11.15/modules/icons/mod.php - https://plugins.trac.wordpress.org/changeset/3105921/
CVE ID: CVE-2024-5220 State: PUBLISHED Published: 2024-05-25T01:51:00.452Z Last Updated: 2024-08-01T21:03:11.064Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: nicdark Products: ND Shortcodes Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The ND Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's upload feature in all versions up to, and including, 7.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will ex
e for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5cbd6040-0446-41fe-8fef-c9065beeaa3a?source=cve - https://plugins.trac.wordpress.org/browser/nd-shortcodes/tags/7.3/nd-shortcodes.php#L63 - https://plugins.trac.wordpress.org/changeset/3091778/nd-shortcodes/trunk/nd-shortcodes.php
CVE ID: CVE-2024-5221 State: PUBLISHED Published: 2024-06-06T08:33:04.612Z Last Updated: 2024-08-01T21:03:11.116Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: qodeinteractive Products: Qi Blocks Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Qi Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file uploader in all versions up to, and including, 1.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that
possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bdf00861-e31e-485c-a562-12dba56af1c7?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3097241%40qi-blocks%2Ftrunk&old=3094374%40qi-blocks%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-5222 State: PUBLISHED Published: 2024-06-05T06:50:29.186Z Last Updated: 2024-08-01T21:03:11.108Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: cyberchimps Products: Responsive Addons – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme. Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Responsive Addons – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file uploader in all versions up to, and including, 3.0.5 due to insu
le to Stored Cross-Site Scripting via the plugin's file uploader in all versions up to, and including, 3.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e1af37ed-fcc6-479c-8c53-25ccb9a8659f?source=cve - https://plugins.trac.wordpress.org/browser/responsive-add-ons/tags/3.0.4/includes/class-responsive-add-ons.php#L131 - https://plugins.trac.word
rdpress.org/browser/responsive-add-ons/tags/3.0.4/includes/class-responsive-add-ons.php#L131 - https://plugins.trac.wordpress.org/browser/responsive-add-ons/tags/3.0.4/includes/importers/wxr-importer/class-responsive-ready-sites-wxr-importer.php#L57 - https://plugins.trac.wordpress.org/changeset/3094256/responsive-add-ons/trunk/includes/importers/wxr-importer/class-responsive-ready-sites-wxr-importer.php
CVE ID: CVE-2024-5223 State: PUBLISHED Published: 2024-05-30T03:34:27.682Z Last Updated: 2024-08-01T21:03:11.109Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpxpo Products: Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file uploading feature in all versions up to, and including, 4.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticate
and including, 4.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7234d4b9-a575-428a-9d08-2dc62ba41c30?source=cve - https://plugins.trac.wordpress.org/browser/ultimate-post/tags/4.0.4/addons/custom_font/Custom_Font.php#L13 - https://plugins.trac.wordpress.org/changeset/3093051/ultimate-post/trunk/addons/custom_font/Custom_Font.php
CVE ID: CVE-2024-5224 State: PUBLISHED Published: 2024-06-06T02:02:59.620Z Last Updated: 2024-08-01T21:03:11.087Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: johnnash1975 Products: Easy Social Like Box – Popup – Sidebar Widget Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Easy Social Like Box – Popup – Sidebar Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cardoza_facebook_like_box' shortcode in all versions up to, and including, 4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it
nd including, 4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bc22a8df-44be-477e-a3b6-67960bf442d3?source=cve - https://plugins.trac.wordpress.org/browser/cardoza-facebook-like-box/trunk/cardoza_facebook_like_box.php#L839
CVE ID: CVE-2024-5225 State: PUBLISHED Published: 2024-06-06T18:19:48.938Z Last Updated: 2024-08-01T21:03:11.039Z Severity: MEDIUM (CVSS 6.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: berriai Products: berriai/litellm Problem Types: CWE-89 Description: An SQL Injection vulnerability exists in the berriai/litellm repository, specifically within the `/global/spend/logs` endpoint. The vulnerability arises due to improper neutralization of special elements used in an SQL command. The affected code constructs an SQL query by concatenating an unvalidated `api_key` parameter directly into the query, making it susceptible to SQL Injection if the `api_key` contains malicious data. This is
ameter directly into the query, making it susceptible to SQL Injection if the `api_key` contains malicious data. This issue affects the latest version of the repository. Successful exploitation of this vulnerability could lead to unauthorized access, data manipulation, exposure of confidential information, and denial of service (DoS). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/491e4884-0306-4cd4-8fe2-9a19de33bf5c
CVE ID: CVE-2024-5226 State: PUBLISHED Published: 2024-08-08T05:31:44.875Z Last Updated: 2024-08-08T14:00:56.626Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: daniyalahmedk Products: Fuse Social Floating Sidebar Problem Types: CWE-79 Description: The Fuse Social Floating Sidebar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the file upload functionality in all versions up to, and including, 5.4.10 due to insufficient validation of SVG files. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page
l access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1a3137a1-8e46-44c6-8edd-ad9fc4d66e0b?source=cve - https://plugins.trac.wordpress.org/browser/fuse-social-floating-sidebar/tags/5.4.10/framework/redux-core/inc/extensions/custom_fonts/class-redux-extension-custom-fonts.php#L126 - https://plugins.trac.wordpress.org/changeset/3131828/ - https://wordpress.org/plugins/fuse-social-floating-sidebar/#developers
CVE ID: CVE-2024-5227 State: PUBLISHED Published: 2024-05-23T21:55:48.347Z Last Updated: 2024-09-03T16:05:33.661Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: TP-Link Products: Omada ER605 Problem Types: CWE-78 Description: TP-Link Omada ER605 PPTP VPN username Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. Authentication is not required to exploit this vulnerability. However, devices are only vulnerable if configured to use a PPTP VPN with LDAP authentication. The specific flaw exists within the handling of the us
nerable if configured to use a PPTP VPN with LDAP authentication. The specific flaw exists within the handling of the username parameter provided to the /usr/bin/pppd endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-22446. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-499/
CVE ID: CVE-2024-5228 State: PUBLISHED Published: 2024-05-23T21:55:55.391Z Last Updated: 2024-08-01T21:03:11.112Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: TP-Link Products: Omada ER605 Problem Types: CWE-122 Description: TP-Link Omada ER605 Comexe DDNS Response Handling Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. Authentication is not required to exploit this vulnerability. However, devices are vulnerable only if configured to use the Comexe DDNS service. The specific flaw exists within the handling
, devices are vulnerable only if configured to use the Comexe DDNS service. The specific flaw exists within the handling of DNS responses. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-22383. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-500/
CVE ID: CVE-2024-5229 State: PUBLISHED Published: 2024-05-25T02:34:22.401Z Last Updated: 2024-08-01T21:03:11.104Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: nicheaddons Products: Primary Addon for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Primary Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Pricing Table widget in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contribut
tion and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d6ea95b5-9e1c-41b1-9bc5-5fd5cecef65d?source=cve - https://plugins.trac.wordpress.org/browser/primary-addon-for-elementor/trunk/elementor/widgets/basic/nabasic-pricing-table.php#L775 - https://plugins.trac.wordpress.org/changeset/3092073/primary-addon-for-elementor/trunk/elementor/widgets/basic/nabasic-
https://plugins.trac.wordpress.org/changeset/3092073/primary-addon-for-elementor/trunk/elementor/widgets/basic/nabasic-pricing-table.php - https://plugins.trac.wordpress.org/changeset/3092073/#file366 - https://wordpress.org/plugins/primary-addon-for-elementor/#developers
CVE ID: CVE-2024-5230 State: PUBLISHED Published: 2024-05-23T02:00:04.720Z Last Updated: 2024-08-01T21:03:11.030Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: EnvaySoft Products: FleetCart Problem Types: CWE-200 Description: A vulnerability has been found in EnvaySoft FleetCart up to 4.1.1 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation of the argument razorpayKeyId leads to information disclosure. The attack can be launched remotely. It is recommended to upgrade the affected component. The identifier VDB-265981 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment
mponent. The identifier VDB-265981 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.265981 - https://vuldb.com/?ctiid.265981 - https://vuldb.com/?submit.333519
CVE ID: CVE-2024-5231 State: PUBLISHED Published: 2024-05-23T03:00:04.303Z Last Updated: 2024-08-01T21:03:11.116Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Campcodes Products: Complete Web-Based School Management System Problem Types: CWE-89 Description: A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /view/teacher_salary_details.php. The manipulation of the argument index leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-265982 is the identifier assigned to this vuln
motely. The exploit has been disclosed to the public and may be used. VDB-265982 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.265982 - https://vuldb.com/?ctiid.265982 - https://vuldb.com/?submit.339807 - https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20sql/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2021.pdf
CVE ID: CVE-2024-5232 State: PUBLISHED Published: 2024-05-23T03:31:03.710Z Last Updated: 2024-08-01T21:03:11.072Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Campcodes Products: Complete Web-Based School Management System Problem Types: CWE-89 Description: A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been classified as critical. This affects an unknown part of the file /view/teacher_salary_details2.php. The manipulation of the argument index leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VD
ely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-265983. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.265983 - https://vuldb.com/?ctiid.265983 - https://vuldb.com/?submit.339808 - https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20sql/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2022.pdf
CVE ID: CVE-2024-5233 State: PUBLISHED Published: 2024-05-23T04:31:03.834Z Last Updated: 2024-08-01T21:03:11.032Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Campcodes Products: Complete Web-Based School Management System Problem Types: CWE-89 Description: A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /view/teacher_salary_details3.php. The manipulation of the argument index leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-265984. Ad
ly. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-265984. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.265984 - https://vuldb.com/?ctiid.265984 - https://vuldb.com/?submit.339809 - https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20sql/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2023.pdf
CVE ID: CVE-2024-5234 State: PUBLISHED Published: 2024-05-23T04:31:05.190Z Last Updated: 2024-08-01T21:03:11.010Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Campcodes Products: Complete Web-Based School Management System Problem Types: CWE-89 Description: A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /view/teacher_salary_history1.php. The manipulation of the argument index leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-265985 was assigned to this vulnera
ly. The exploit has been disclosed to the public and may be used. The identifier VDB-265985 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.265985 - https://vuldb.com/?ctiid.265985 - https://vuldb.com/?submit.339810 - https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20sql/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2024.pdf
CVE ID: CVE-2024-5235 State: PUBLISHED Published: 2024-05-23T05:00:05.167Z Last Updated: 2024-08-01T21:03:11.052Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Campcodes Products: Complete Web-Based School Management System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in Campcodes Complete Web-Based School Management System 1.0. Affected is an unknown function of the file /view/teacher_salary_invoice.php. The manipulation of the argument teacher_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-265986 is the identifier assigned to this vulnerabil
. The exploit has been disclosed to the public and may be used. VDB-265986 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.265986 - https://vuldb.com/?ctiid.265986 - https://vuldb.com/?submit.339811 - https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20sql/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2025.pdf
CVE ID: CVE-2024-5236 State: PUBLISHED Published: 2024-05-23T05:00:06.727Z Last Updated: 2024-08-01T21:03:11.123Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Campcodes Products: Complete Web-Based School Management System Problem Types: CWE-89 Description: A vulnerability classified as critical was found in Campcodes Complete Web-Based School Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /view/teacher_salary_invoice1.php. The manipulation of the argument date leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability