Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-3038 State: PUBLISHED Published: 2023-10-04T11:11:44.513Z Last Updated: 2024-09-19T19:19:40.424Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: HelpDezk Products: HelpDezk Community Problem Types: CWE-89 Description: SQL injection vulnerability in HelpDezk Community affecting version 1.1.10. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the rows parameter of the jsonGrid route and extract all the information stored in the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabiliti
tainer: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-helpdezk-community
CVE ID: CVE-2023-3039 State: PUBLISHED Published: 2023-09-12T06:06:06.635Z Last Updated: 2024-09-26T14:21:48.941Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Dell Products: SD ROM Utility Problem Types: CWE-284 Description: SD ROM Utility, versions prior to 1.0.2.0 contain an Improper Access Control vulnerability. A low-privileged malicious user may potentially exploit this vulnerability to perform arbitrary code execution with limited access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000216282/dsa-2023-274
CVE ID: CVE-2023-3040 State: PUBLISHED Published: 2023-06-14T11:54:51.131Z Last Updated: 2025-01-02T19:21:32.890Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Cloudflare Products: lua-resty-json Problem Types: CWE-125 Description: A debug function in the lua-resty-json package, up to commit id 3ef9492bd3a44d9e51301d6adc3cd1789c8f534a (merged in PR #14) contained an out of bounds access bug that could have allowed an attacker to launch a DoS if the function was used to parse untrusted input data. It is important to note that because this debug function was only used in tests and demos, it was not exploitable in a normal environment. Additional Analyst Notes:
ug function was only used in tests and demos, it was not exploitable in a normal environment. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cloudflare/lua-resty-json/pull/14 - https://github.com/cloudflare/lua-resty-json/security/advisories/GHSA-h8rp-9622-83pg
CVE ID: CVE-2023-3041 State: PUBLISHED Published: 2023-07-17T13:29:50.069Z Last Updated: 2025-05-05T15:56:01.124Z Vendors: Unknown Products: Autochat Automatic Conversation Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Autochat Automatic Conversation WordPress plugin through 1.1.7 does not sanitise and escape user input before outputting it back on the page, leading to a cross-site Scripting attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/93cad990-b6be-4ee1-9cdf-0211a7fe6c96
CVE ID: CVE-2023-3042 State: PUBLISHED Published: 2023-10-17T22:52:05.453Z Last Updated: 2025-06-12T15:05:44.260Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: dotCMS Products: dotCMS core Problem Types: CWE-79 Description: In dotCMS, versions mentioned, a flaw in the NormalizationFilter does not strip double slashes (//) from URLs, potentially enabling bypasses for XSS and access controls. An example affected URL is https://demo.dotcms.com//html/portlet/ext/files/edit_text_inc.jsp , which should return a 404 response but didn't. The oversight in the default invalid URL character list can be viewed at the provided GitHub link https://github.com/dotCMS/core
sight in the default invalid URL character list can be viewed at the provided GitHub link https://github.com/dotCMS/core/blob/master/dotCMS/src/main/java/com/dotcms/filters/NormalizationFilter.java#L37 . To mitigate, users can block URLs with double slashes at firewalls or utilize dotCMS config variables. Specifically, they can use the DOT_URI_NORMALIZATION_FORBIDDEN_STRINGS environmental variable to add // to the list of invalid strings. Additionally, the DOT_URI_NORMALIZATION_FORBIDDEN_REGEX variable offers more detailed control, for instance, to block //html.* URLs. Fix Version:23.06+, LTS 22.03.7+, LTS 23.01.4+ Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: R
Version:23.06+, LTS 22.03.7+, LTS 23.01.4+ Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dotcms.com/security/SI-68
CVE ID: CVE-2023-3043 State: PUBLISHED Published: 2024-01-09T22:15:43.375Z Last Updated: 2025-06-17T20:39:16.299Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: AMI Products: MegaRAC_SPx Problem Types: CWE-121 Description: AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a stack-based buffer overflow via an adjacent network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023010.pdf
CVE ID: CVE-2023-3044 State: PUBLISHED Published: 2023-06-02T22:32:31.677Z Last Updated: 2025-01-08T17:53:11.882Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: Xpdf Products: Xpdf Problem Types: CWE-369 Description: An excessively large PDF page size (found in fuzz testing, unlikely in normal PDF files) can result in a divide-by-zero in Xpdf's text extraction code. This is related to CVE-2022-30524, but the problem here is caused by a very large page size, rather than by a very large character coordinate. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.xpdfreader.com/security-bug/CVE-2023-3044.html - https
ram Container: - CISA ADP Vulnrichment: References: - https://www.xpdfreader.com/security-bug/CVE-2023-3044.html - https://github.com/baker221/poc-xpdf
CVE ID: CVE-2023-3045 State: PUBLISHED Published: 2023-07-09T16:16:57.421Z Last Updated: 2024-11-12T19:42:52.262Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Tise Technology Products: Parking Web Report Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tise Technology Parking Web Report allows SQL Injection.This issue affects Parking Web Report: before 2.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0387
CVE ID: CVE-2023-3046 State: PUBLISHED Published: 2023-07-25T05:46:30.462Z Last Updated: 2024-10-23T19:06:56.491Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Biltay Technology Products: Scienta Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Biltay Technology Scienta allows SQL Injection.This issue affects Scienta: before 20230630.1953. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0418
CVE ID: CVE-2023-3047 State: PUBLISHED Published: 2023-06-13T11:41:05.006Z Last Updated: 2025-01-03T15:21:47.721Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: TMT Products: Lockcell Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMT Lockcell allows SQL Injection.This issue affects Lockcell: before 15. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0345 - https://fordefence.com/cve-2023-3047-tmt-lockcell-sql-injection/
CVE ID: CVE-2023-3048 State: PUBLISHED Published: 2023-06-13T11:44:32.696Z Last Updated: 2025-01-03T15:21:08.731Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: TMT Products: Lockcell Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in TMT Lockcell allows Authentication Abuse, Authentication Bypass.This issue affects Lockcell: before 15. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0345 - https://fordefence.com/cve-2023-3048-authorization-bypass-through-user-controlled-key-vulnerability-allows-authentication-abuse-authentic
e.com/cve-2023-3048-authorization-bypass-through-user-controlled-key-vulnerability-allows-authentication-abuse-authentication-bypass/
CVE ID: CVE-2023-3049 State: PUBLISHED Published: 2023-06-13T11:47:56.294Z Last Updated: 2025-01-03T15:17:59.745Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: TMT Products: Lockcell Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in TMT Lockcell allows Command Injection.This issue affects Lockcell: before 15. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0345 - https://fordefence.com/cve-2023-3049-unrestricted-upload-of-file-with-dangerous-type-vulnerability-allows-command-injection/
CVE ID: CVE-2023-3050 State: PUBLISHED Published: 2023-06-13T11:50:27.709Z Last Updated: 2025-01-03T14:44:15.871Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: TMT Products: Lockcell Problem Types: CWE-784 Description: Reliance on Cookies without Validation and Integrity Checking in a Security Decision vulnerability in TMT Lockcell allows Privilege Abuse, Authentication Bypass.This issue affects Lockcell: before 15. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0345 - https://fordefence.com/cve-2023-3050-reliance-on-cookies-without-validation-and-integrity-checking-in-a-se
/tr-23-0345 - https://fordefence.com/cve-2023-3050-reliance-on-cookies-without-validation-and-integrity-checking-in-a-security-decision-vulnerability-in-tmt-lockcell-allows-privilege-abuse-authentication-bypass/
CVE ID: CVE-2023-3051 State: PUBLISHED Published: 2023-06-02T23:37:55.112Z Last Updated: 2024-12-20T23:59:47.829Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: azexo Products: Page Builder with Image Map by AZEXO Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Page Builder by AZEXO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'azh_post' shortcode in versions up to, and including, 1.27.133 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers to inject arbitrary web scripts in pages that will execu
scaping. This makes it possible for contributor-level attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/24486605-9324-4f19-9ca3-340d006432db?source=cve - https://plugins.trac.wordpress.org/browser/page-builder-by-azexo/trunk/azexo_html.php#L2856 - https://plugins.trac.wordpress.org/browser/page-builder-by-azexo/trunk/azexo_html.php#L2845
CVE ID: CVE-2023-3052 State: PUBLISHED Published: 2023-06-02T23:37:56.053Z Last Updated: 2024-12-20T23:59:25.553Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: azexo Products: Page Builder with Image Map by AZEXO Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Page Builder by AZEXO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.27.133. This is due to missing or incorrect nonce validation on the 'azh_add_post', 'azh_duplicate_post', 'azh_update_post' and 'azh_remove_post' functions. This makes it possible for unauthenticated attackers to create, modify, and delete a post via a f
emove_post' functions. This makes it possible for unauthenticated attackers to create, modify, and delete a post via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a4e26035-ce4e-4b4b-aa3c-cd86b29b199a?source=cve - https://plugins.trac.wordpress.org/browser/page-builder-by-azexo/trunk/azexo_html.php#L4137 - https://plugins.trac.wordpress.org/browser/page-builder-by-azexo/trunk/azexo_html.php#L4159 - https://plugins.trac.wordpress.org/browser/page-builder-by-azexo/trunk/azexo_html.
by-azexo/trunk/azexo_html.php#L4159 - https://plugins.trac.wordpress.org/browser/page-builder-by-azexo/trunk/azexo_html.php#L4174 - https://plugins.trac.wordpress.org/browser/page-builder-by-azexo/trunk/azexo_html.php#L4190 - https://plugins.trac.wordpress.org/browser/page-builder-by-azexo/trunk/azexo_html.php#L4085
CVE ID: CVE-2023-3053 State: PUBLISHED Published: 2023-06-02T23:37:56.460Z Last Updated: 2024-12-20T23:59:16.392Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: azexo Products: Page Builder with Image Map by AZEXO Problem Types: CWE-862 Missing Authorization Description: The Page Builder by AZEXO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'azh_add_post' function in versions up to, and including, 1.27.133. This makes it possible for authenticated attackers to create a post with any post type and post status. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refere
t with any post type and post status. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dd56cb73-1c40-44b1-b713-c0291832d988?source=cve - https://plugins.trac.wordpress.org/browser/page-builder-by-azexo/trunk/azexo_html.php#L4137 - https://plugins.trac.wordpress.org/browser/page-builder-by-azexo/trunk/azexo_html.php#L4085
CVE ID: CVE-2023-3055 State: PUBLISHED Published: 2023-06-02T23:37:55.642Z Last Updated: 2024-12-20T23:59:34.921Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: azexo Products: Page Builder with Image Map by AZEXO Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Page Builder by AZEXO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.27.133. This is due to missing or incorrect nonce validation on the 'azh_save' function. This makes it possible for unauthenticated attackers to update the post content and inject malicious JavaScript via a forged request, granted they can trick a site a
tackers to update the post content and inject malicious JavaScript via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2efeffa2-b21a-4aa1-93b0-51c775758ab1?source=cve - https://plugins.trac.wordpress.org/browser/page-builder-by-azexo/trunk/azexo_html.php#L2721
CVE ID: CVE-2023-3056 State: PUBLISHED Published: 2023-06-02T12:00:04.473Z Last Updated: 2025-01-08T18:05:31.705Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: YFCMF Problem Types: CWE-24 Description: A vulnerability was found in YFCMF up to 3.0.4. It has been declared as problematic. This vulnerability affects unknown code of the file index.php. The manipulation leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-230542 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Referenc
ier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.230542 - https://vuldb.com/?ctiid.230542 - https://github.com/HuBenLab/HuBenVulList/blob/main/YFCMF-TP6-3.0.4%20has%20a%20Remote%20Command%20Execution%20(RCE)%20vulnerability%201.md
CVE ID: CVE-2023-3057 State: PUBLISHED Published: 2023-06-02T12:31:03.252Z Last Updated: 2024-08-02T06:41:04.179Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: YFCMF Problem Types: CWE-24 Description: A vulnerability was found in YFCMF up to 3.0.4. It has been rated as problematic. This issue affects some unknown processing of the file app/admin/controller/Ajax.php. The manipulation of the argument controllername leads to path traversal: '../filedir'. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-230543. Additional Analyst Notes: - CVE
e public and may be used. The associated identifier of this vulnerability is VDB-230543. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.230543 - https://vuldb.com/?ctiid.230543 - https://github.com/HuBenLab/HuBenVulList/blob/main/YFCMF-TP6-3.0.4%20has%20a%20Remote%20Command%20Execution%20(RCE)%20vulnerability%202.md
CVE ID: CVE-2023-3058 State: PUBLISHED Published: 2023-06-02T13:00:04.613Z Last Updated: 2025-01-08T17:57:52.617Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: 07FLY Products: CRM Problem Types: CWE-79 Description: A vulnerability was found in 07FLY CRM up to 1.2.0. It has been declared as problematic. This vulnerability affects unknown code of the component User Profile Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-230560. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.
is VDB-230560. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.230560 - https://vuldb.com/?ctiid.230560 - https://gitee.com/07fly/FLY-CRM/issues/I76K4N
CVE ID: CVE-2023-3059 State: PUBLISHED Published: 2023-06-02T13:00:05.607Z Last Updated: 2024-08-02T06:41:04.377Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Exam Form Submission Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in SourceCodester Online Exam Form Submission 1.0. This affects an unknown part of the file /admin/update_s6.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-230565 was assigned to this vulnerability. Additional Analyst Notes: - CV
the public and may be used. The identifier VDB-230565 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.230565 - https://vuldb.com/?ctiid.230565 - https://github.com/Aiiimer/requestCVE/blob/main/SQL.md
CVE ID: CVE-2023-3060 State: PUBLISHED Published: 2023-06-02T13:31:03.690Z Last Updated: 2024-08-02T06:41:04.174Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: code-projects Products: Agro-School Management System Problem Types: CWE-79 Description: A vulnerability has been found in code-projects Agro-School Management System 1.0 and classified as problematic. This vulnerability affects the function doAddQuestion of the file btn_functions.php. The manipulation of the argument Question leads to cross site scripting. The attack can be initiated remotely. VDB-230566 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Con
6 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.230566 - https://vuldb.com/?ctiid.230566 - https://github.com/hotencode/CveHub/blob/main/agricultural%20school%20management%20system%20has%20cross-site%20script%20vulnerability.pdf
CVE ID: CVE-2023-3061 State: PUBLISHED Published: 2023-06-02T14:00:04.355Z Last Updated: 2024-08-02T06:41:04.080Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Agro-School Management System Problem Types: CWE-434 Description: A vulnerability was found in code-projects Agro-School Management System 1.0 and classified as critical. This issue affects some unknown processing of the file btn_functions.php of the component Attachment Image Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-230567. Additional Analyst Notes: - CVE Program Container: References: - h
iated identifier of this vulnerability is VDB-230567. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.230567 - https://vuldb.com/?ctiid.230567 - https://github.com/hotencode/CveHub/blob/main/Agro-School%20Management%20System%20has%20a%20file%20upload%20(RCE)%20vulnerability.pdf
CVE ID: CVE-2023-3062 State: PUBLISHED Published: 2023-06-02T14:00:05.404Z Last Updated: 2024-08-02T06:41:04.197Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Agro-School Management System Problem Types: CWE-89 Description: A vulnerability was found in code-projects Agro-School Management System 1.0. It has been classified as critical. Affected is an unknown function of the file index.php. The manipulation of the argument password leads to sql injection. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-230568. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.230568 - https:/
y is VDB-230568. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.230568 - https://vuldb.com/?ctiid.230568 - https://github.com/hotencode/CveHub/blob/main/Agro-School%20Management%20System%20index.php%20has%20Sqlinjection.pdf
CVE ID: CVE-2023-3063 State: PUBLISHED Published: 2023-06-30T01:56:17.054Z Last Updated: 2024-11-26T16:13:16.272Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: smartypants Products: SP Project & Document Manager Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The SP Project & Document Manager plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 4.67. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for authenticated attackers with subscriber privileges or above,
ion and access system resources. This makes it possible for authenticated attackers with subscriber privileges or above, to change user passwords and potentially take over administrator accounts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6dc2e720-85d9-42d9-94ef-eb172425993d?source=cve - https://plugins.trac.wordpress.org/browser/sp-client-document-manager/trunk/classes/ajax.php#L149