Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-5077 State: PUBLISHED Published: 2024-07-13T06:00:09.142Z Last Updated: 2024-08-01T21:03:10.588Z Vendors: Unknown Products: wp-eMember Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The wp-eMember WordPress plugin before 10.6.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/00fcbcf3-41ee-45e7-a0a9-0d46cb7ef859/
CVE ID: CVE-2024-5079 State: PUBLISHED Published: 2024-07-13T06:00:09.333Z Last Updated: 2024-08-01T21:03:10.553Z Vendors: Unknown Products: wp-eMember Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The wp-eMember WordPress plugin before 10.6.7 does not sanitise and escape some of the fields when members register, which allows unauthenticated users to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/bdb5509e-80ab-4e47-83a4-9347796eec40/
CVE ID: CVE-2024-5080 State: PUBLISHED Published: 2024-07-13T06:00:09.543Z Last Updated: 2024-08-01T21:03:10.803Z Vendors: Unknown Products: wp-eMember Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The wp-eMember WordPress plugin before 10.6.6 does not validate files to be uploaded, which could allow admins to upload arbitrary files such as PHP on the server Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/15f78aad-001c-4219-aa7e-46537e1357a2/
CVE ID: CVE-2024-5081 State: PUBLISHED Published: 2024-08-05T06:00:07.283Z Last Updated: 2024-08-05T14:41:43.350Z Vendors: Unknown Products: wp-eMember Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The wp-eMember WordPress plugin before v10.7.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/4f02bdb5-5cf6-4519-9586-fd4fb3d45dea/
CVE ID: CVE-2024-5082 State: PUBLISHED Published: 2024-11-14T02:58:44.472Z Last Updated: 2024-11-21T16:12:13.436Z Vendors: Sonatype Products: Nexus Repository Problem Types: CWE-94 Description: A Remote Code Execution vulnerability has been discovered in Sonatype Nexus Repository 2. This issue affects Nexus Repository 2 OSS/Pro versions up to and including 2.15.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.sonatype.com/hc/en-us/articles/30694125380755
CVE ID: CVE-2024-5083 State: PUBLISHED Published: 2024-11-14T01:31:20.538Z Last Updated: 2024-11-21T16:12:30.873Z Vendors: Sonatype Products: Nexus Repository Problem Types: CWE-79 Description: A stored Cross-site Scripting vulnerability has been discovered in Sonatype Nexus Repository 2 This issue affects Nexus Repository 2 OSS/Pro versions up to and including 2.15.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.sonatype.com/hc/en-us/articles/30693989411987
CVE ID: CVE-2024-5084 State: PUBLISHED Published: 2024-05-23T14:31:38.633Z Last Updated: 2024-08-01T21:03:10.657Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: hashthemes Products: Hash Form – Drag & Drop Form Builder Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'file_upload_action' function in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code exec
le for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/eef9e2fa-d8f0-42bf-95ac-ee4cafff0b14?source=cve - https://plugins.trac.wordpress.org/browser/hash-form/trunk/admin/classes/HashFormBuilder.php#L764 - https://plugins.trac.wordpress.org/changeset/3090341/
CVE ID: CVE-2024-5085 State: PUBLISHED Published: 2024-05-23T14:31:38.023Z Last Updated: 2024-08-01T21:03:10.672Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: hashthemes Products: Hash Form – Drag & Drop Form Builder Problem Types: CWE-502 Deserialization of Untrusted Data Description: The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.0 via deserialization of untrusted input in the 'process_entry' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present v
attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0166a2b2-24e2-4dd6-8842-d3e8dd7bb0dc?source=cve - https://plugins.trac.wordpress.org/browser/hash-form/trunk/admin/classes/HashFormEntry.php#L353 - https://plugins.trac.wordpress.org/changeset/3090341/
CVE ID: CVE-2024-5086 State: PUBLISHED Published: 2024-05-29T07:33:52.613Z Last Updated: 2024-08-01T21:03:10.655Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Essential Addons Products: Essential Addons for Elementor Pro Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Essential Addons for Elementor PRO – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Team Member Carousel widget in all Pro versions up to, and including, 5.8.14 due to insufficient input sanitization and output escaping
ousel widget in all Pro versions up to, and including, 5.8.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f7773b98-537f-4f4e-98d6-db61d2bffe8c?source=cve - https://essential-addons.com/changelog/
CVE ID: CVE-2024-5087 State: PUBLISHED Published: 2024-06-08T05:44:29.781Z Last Updated: 2024-08-01T21:03:10.622Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: webfactory Products: Minimal Coming Soon – Coming Soon Page Problem Types: CWE-862 Missing Authorization Description: The Minimal Coming Soon – Coming Soon Page plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the validate_ajax, deactivate_ajax, and save_ajax functions in all versions up to, and including, 2.38. This makes it possible for authenticated attackers, with Subscriber-level access and above, to edit the license key, which could d
it possible for authenticated attackers, with Subscriber-level access and above, to edit the license key, which could disable features of the plugin. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/affdaf63-2098-4ad6-b15b-990d1941fecb?source=cve - https://plugins.trac.wordpress.org/browser/minimal-coming-soon-maintenance-mode/tags/2.38/framework/wf-licensing.php#L51 - https://plugins.trac.wordpress.org/browser/minimal-coming-soon-maintenance-mode/tags/2.38/framework/wf-licensing.php#L52 - https://plugins.trac.wordpress.org/browser/minimal-coming-soon-maintenance-mode/tags/2.38/framework/wf-li
sing.php#L52 - https://plugins.trac.wordpress.org/browser/minimal-coming-soon-maintenance-mode/tags/2.38/framework/wf-licensing.php#L54 - https://plugins.trac.wordpress.org/browser/minimal-coming-soon-maintenance-mode/tags/2.38/framework/wf-licensing.php#L561 - https://plugins.trac.wordpress.org/browser/minimal-coming-soon-maintenance-mode/tags/2.38/framework/wf-licensing.php#L585 - https://plugins.trac.wordpress.org/browser/minimal-coming-soon-maintenance-mode/tags/2.38/framework/wf-licensing.php#L596 - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/CRLF%20Injection/README.md - https://plugins.trac.wordpress.org/changeset/3099123/
CVE ID: CVE-2024-5088 State: PUBLISHED Published: 2024-05-18T11:35:59.688Z Last Updated: 2024-08-01T21:03:10.668Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: thehappymonster Products: Happy Addons for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_id’ parameter in all versions up to, and including, 3.10.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject ar
tput escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/203ab09f-7344-4cab-86bf-0c1ec545d78f?source=cve - https://plugins.trac.wordpress.org/browser/happy-elementor-addons/trunk/widgets/skills/widget.php#L360 - https://plugins.trac.wordpress.org/changeset/3087575/happy-elementor-addons/trunk/widgets/skills/widget.php
CVE ID: CVE-2024-5089 State: REJECTED Published: N/A Last Updated: 2024-06-06T09:05:46.752Z Description: No description available.
CVE ID: CVE-2024-5090 State: PUBLISHED Published: 2024-06-11T02:01:54.264Z Last Updated: 2024-08-01T21:03:10.748Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: gpriday Products: SiteOrigin Widgets Bundle Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's SiteOrigin Blog Widget in all versions up to, and including, 1.61.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-le
and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2878de45-0123-4e07-bfec-015b36b11d01?source=cve - https://plugins.trac.wordpress.org/changeset/3098819/so-widgets-bundle
CVE ID: CVE-2024-5091 State: PUBLISHED Published: 2024-06-08T06:54:37.503Z Last Updated: 2024-08-01T21:03:10.626Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: sonalsinha21 Products: SKT Addons for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The SKT Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Age Gate and Creative Slider widgets in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with co
anitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dc8d63ee-4929-4940-bc6a-931524e20272?source=cve - https://plugins.trac.wordpress.org/changeset/3098599/skt-addons-for-elementor
CVE ID: CVE-2024-5092 State: PUBLISHED Published: 2024-05-22T05:32:47.983Z Last Updated: 2024-08-01T21:03:10.809Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: aruphash Products: Elegant Addons for elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Elegant Addons for elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Switcher, Slider, and Iconbox widgets in all versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers
t input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7ab3e286-05db-430e-bbe7-bfaa31134c3c?source=cve - https://plugins.trac.wordpress.org/browser/elegant-addons-for-elementor/trunk/widgets/eae-switcher.php#L516 - https://plugins.trac.wordpress.org/browser/elegant-addons-for-elementor/trunk/widgets/eae-slider.php#L1091 - https://plugins.tr
/plugins.trac.wordpress.org/browser/elegant-addons-for-elementor/trunk/widgets/eae-slider.php#L1091 - https://plugins.trac.wordpress.org/browser/elegant-addons-for-elementor/trunk/widgets/eae-iconbox.php#L1667
CVE ID: CVE-2024-5093 State: PUBLISHED Published: 2024-05-18T18:31:04.271Z Last Updated: 2024-08-01T21:03:10.821Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Best House Rental Management System Problem Types: CWE-89 Description: A vulnerability has been found in SourceCodester Best House Rental Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file login.php. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-265072. Additional Analyst Not
been disclosed to the public and may be used. The identifier of this vulnerability is VDB-265072. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.265072 - https://vuldb.com/?ctiid.265072 - https://vuldb.com/?submit.335712 - https://github.com/BurakSevben/CVEs/blob/main/House%20Rental%20Management%20System/House%20Rental%20Management%20System%20-%20Authentication%20Bypass.md
CVE ID: CVE-2024-5094 State: PUBLISHED Published: 2024-05-18T20:00:05.131Z Last Updated: 2024-08-01T21:03:10.755Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Best House Rental Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Best House Rental Management System 1.0 and classified as critical. This issue affects some unknown processing of the file view_payment.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-265073 was assigned to this vulnerability. Additional Analyst Not
osed to the public and may be used. The identifier VDB-265073 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.265073 - https://vuldb.com/?ctiid.265073 - https://vuldb.com/?submit.335714 - https://github.com/BurakSevben/CVEs/blob/main/House%20Rental%20Management%20System/House%20Rental%20Management%20System%20-%20SQL%20Injection%20-%202.md
CVE ID: CVE-2024-5095 State: PUBLISHED Published: 2024-05-19T01:31:03.948Z Last Updated: 2024-08-01T21:03:10.481Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Victor Products: Zsviot Camera Problem Types: CWE-404 Description: A vulnerability classified as problematic has been found in Victor Zsviot Camera 8.26.31. This affects an unknown part of the component MQTT Packet Handler. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-265077 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but
dentifier VDB-265077 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.265077 - https://vuldb.com/?ctiid.265077 - https://vuldb.com/?submit.332461 - https://github.com/kzLiu2017/Tuya_Cam_CVE_Doc/blob/main/zsviot%20camera.pdf
CVE ID: CVE-2024-5096 State: PUBLISHED Published: 2024-05-19T02:00:04.610Z Last Updated: 2024-08-01T21:03:10.454Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Hipcam Products: Device Problem Types: CWE-200 Description: A vulnerability classified as problematic was found in Hipcam Device up to 20240511. This vulnerability affects unknown code of the file /log/wifi.mac of the component MAC Address Handler. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-265078 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about t
d may be used. VDB-265078 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.265078 - https://vuldb.com/?ctiid.265078 - https://vuldb.com/?submit.332785 - https://netsecfish.notion.site/Unauthorized-Access-to-MAC-Address-in-Hipcam-Device-a9a8daeeda954e83af847eb27805dc99?pvs=4
CVE ID: CVE-2024-5097 State: PUBLISHED Published: 2024-05-19T03:00:04.179Z Last Updated: 2024-08-01T21:03:10.627Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: SourceCodester Products: Simple Inventory System Problem Types: CWE-352 Description: A vulnerability, which was classified as problematic, was found in SourceCodester Simple Inventory System 1.0. Affected is an unknown function of the file /tableedit.php#page=editprice. The manipulation of the argument itemnumber leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-265080. Additional Anal
it has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-265080. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.265080 - https://vuldb.com/?ctiid.265080 - https://vuldb.com/?submit.337055 - https://github.com/rockersiyuan/CVE/blob/main/SourceCodester%20Simple%20Inventory%20System%20CSRF.md
CVE ID: CVE-2024-5098 State: PUBLISHED Published: 2024-05-19T06:00:04.313Z Last Updated: 2024-08-01T21:03:10.606Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Simple Inventory System Problem Types: CWE-89 Description: A vulnerability has been found in SourceCodester Simple Inventory System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file login.php. The manipulation of the argument username leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-265081 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnri
d may be used. The identifier VDB-265081 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.265081 - https://vuldb.com/?ctiid.265081 - https://vuldb.com/?submit.337056 - https://github.com/rockersiyuan/CVE/blob/main/SourceCodester%20Simple%20Inventory%20System%20Sql%20Inject-1.md
CVE ID: CVE-2024-5099 State: PUBLISHED Published: 2024-05-19T08:00:04.860Z Last Updated: 2024-08-01T21:03:10.664Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Simple Inventory System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Simple Inventory System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file updateprice.php. The manipulation of the argument ITEM leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-265082 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP
blic and may be used. VDB-265082 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.265082 - https://vuldb.com/?ctiid.265082 - https://vuldb.com/?submit.337057 - https://github.com/rockersiyuan/CVE/blob/main/SourceCodester%20Simple%20Inventory%20System%20Sql%20Inject-2.md
CVE ID: CVE-2024-5100 State: PUBLISHED Published: 2024-05-19T11:31:03.831Z Last Updated: 2024-08-01T21:03:10.745Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Simple Inventory System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Simple Inventory System 1.0. It has been classified as critical. This affects an unknown part of the file tableedit.php. The manipulation of the argument from/to leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-265083. Additional Analyst Notes: - CISA ADP V
c and may be used. The associated identifier of this vulnerability is VDB-265083. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.265083 - https://vuldb.com/?ctiid.265083 - https://vuldb.com/?submit.337058 - https://github.com/rockersiyuan/CVE/blob/main/SourceCodester%20Simple%20Inventory%20System%20Sql%20Inject-3.md
CVE ID: CVE-2024-5101 State: PUBLISHED Published: 2024-05-19T14:00:04.720Z Last Updated: 2024-08-01T21:03:10.667Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Simple Inventory System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Simple Inventory System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file updateproduct.php. The manipulation of the argument ITEM leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-265084. Additional Analyst Notes: - CISA ADP Vulnrichment