Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-36527 State: PUBLISHED Published: 2022-08-25T18:46:06 Last Updated: 2024-08-03T10:07:34.455Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the post title text field under the publish blog module. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jflyfox/jfinal_cms/issues/45
CVE ID: CVE-2022-36529 State: PUBLISHED Published: 2022-08-26T18:10:34 Last Updated: 2024-08-03T10:07:34.472Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kensite CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities via the name and oldname parameters at /framework/mod/db/DBMapper.xml. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/seeyoui/kensite_cms - https://github.com/xdon9/xdon/blob/main/kensite_cms
CVE ID: CVE-2022-36530 State: PUBLISHED Published: 2022-08-16T12:39:36 Last Updated: 2024-08-03T10:07:34.461Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in rageframe2 2.6.37. There is a XSS vulnerability in the user agent related parameters of the info.php page. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jianyan74/rageframe2 - http://rageframe2.com - https://github.com/jianyan74/rageframe2/issues/106 - https://github.com/jianyan74/rageframe2/issues/106?by=xboy%28Topsec%29
CVE ID: CVE-2022-36532 State: PUBLISHED Published: 2022-09-16T02:26:31 Last Updated: 2024-08-03T10:07:34.445Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bolt CMS contains a vulnerability in version 5.1.12 and below that allows an authenticated user with the ROLE_EDITOR privileges to upload and rename a malicious file to achieve remote code execution. Additional Analyst Notes: - CVE Program Container: References: - http://bolt.com - https://lutrasecurity.com/en/articles/cve-2022-36532/
CVE ID: CVE-2022-36533 State: PUBLISHED Published: 2022-09-16T02:33:02 Last Updated: 2024-08-03T10:07:34.429Z Vendors: n/a Products: n/a Problem Types: n/a Description: Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below was discovered to contain a cross-site scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://super.com - http://syncovery.com - https://www.mgm-sp.com/en/multiple-vulnerabilities-in-syncovery-for-linux/
CVE ID: CVE-2022-36534 State: PUBLISHED Published: 2022-09-16T00:00:00 Last Updated: 2024-08-03T10:07:34.436Z Vendors: n/a Products: n/a Problem Types: n/a Description: Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below was discovered to contain multiple remote code execution (RCE) vulnerabilities via the Job_ExecuteBefore and Job_ExecuteAfter parameters at post_profilesettings.php. Additional Analyst Notes: - CVE Program Container: References: - http://super.com - http://syncovery.com - https://www.mgm-sp.com/en/multiple-vulnerabilities-in-syncovery-for-linux/ - http://packetstormsecurity.com/files/170245/Syncovery-For-Linux-Web-GUI-Authenticated-Remote-Command-Exe
ry-for-linux/ - http://packetstormsecurity.com/files/170245/Syncovery-For-Linux-Web-GUI-Authenticated-Remote-Command-Execution.html
CVE ID: CVE-2022-36536 State: PUBLISHED Published: 2022-09-16T02:37:07 Last Updated: 2024-08-03T10:07:34.471Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the component post_applogin.php of Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below allows attackers to escalate privileges via creating crafted session tokens. Additional Analyst Notes: - CVE Program Container: References: - http://super.com - http://syncovery.com - https://www.mgm-sp.com/en/multiple-vulnerabilities-in-syncovery-for-linux/
CVE ID: CVE-2022-36537 State: PUBLISHED Published: 2022-08-26T00:00:00.000Z Last Updated: 2025-10-21T23:15:36.123Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tracker.zkoss.org/browse/ZK-5150 - https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-zk-java-framework-rce-flaw/
CVE ID: CVE-2022-36539 State: PUBLISHED Published: 2022-09-07T16:22:41 Last Updated: 2024-08-03T10:07:34.440Z Vendors: n/a Products: n/a Problem Types: n/a Description: WeDayCare B.V Ouderapp before v1.1.22 allows attackers to alter the ID value within intercepted calls to gain access to data of other parents and children. Additional Analyst Notes: - CVE Program Container: References: - https://apps.apple.com/nl/app/eigen-wijzer-ouderapp/id1331059326 - https://github.com/Fopje/CVE-2022-36539
CVE ID: CVE-2022-36542 State: PUBLISHED Published: 2022-08-26T20:37:48 Last Updated: 2024-08-03T10:07:34.466Z Vendors: n/a Products: n/a Problem Types: n/a Description: An access control issue in the component /ip/admin/ of Edoc-doctor-appointment-system v1.0.1 allows attackers to arbitrarily edit, read, and delete Administrator data. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/onEpAth936/cve/blob/master/bug_e/edoc-doctor-appointment-system - https://github.com/HashenUdara/edoc-doctor-appointment-system
CVE ID: CVE-2022-36543 State: PUBLISHED Published: 2022-08-26T20:37:50 Last Updated: 2024-08-03T10:07:34.455Z Vendors: n/a Products: n/a Problem Types: n/a Description: Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/doctors.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/HashenUdara/edoc-doctor-appointment-system - https://github.com/onEpAth936/cve/blob/master/bug_e/edoc-doctor-appointment-system/Multiple%20SQL%20injection.md
CVE ID: CVE-2022-36544 State: PUBLISHED Published: 2022-08-26T20:37:50 Last Updated: 2024-08-03T10:07:34.467Z Vendors: n/a Products: n/a Problem Types: n/a Description: Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/booking.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/HashenUdara/edoc-doctor-appointment-system - https://github.com/onEpAth936/cve/blob/master/bug_e/edoc-doctor-appointment-system/Multiple%20SQL%20injection.md
CVE ID: CVE-2022-36545 State: PUBLISHED Published: 2022-08-26T20:37:51 Last Updated: 2024-08-03T10:07:34.498Z Vendors: n/a Products: n/a Problem Types: n/a Description: Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/settings.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/HashenUdara/edoc-doctor-appointment-system - https://github.com/onEpAth936/cve/blob/master/bug_e/edoc-doctor-appointment-system/Multiple%20SQL%20injection.md
CVE ID: CVE-2022-36546 State: PUBLISHED Published: 2022-08-26T20:37:52 Last Updated: 2024-08-03T10:07:34.478Z Vendors: n/a Products: n/a Problem Types: n/a Description: Edoc-doctor-appointment-system v1.0.1 was discovered to contain a Cross-Site Request Forgery (CSRF) via /patient/settings.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/HashenUdara/edoc-doctor-appointment-system - https://github.com/onEpAth936/cve/blob/master/bug_e/edoc-doctor-appointment-system/Multiple%20SQL%20injection.md
CVE ID: CVE-2022-36547 State: PUBLISHED Published: 2022-08-26T20:37:52 Last Updated: 2024-08-03T10:07:34.403Z Vendors: n/a Products: n/a Problem Types: n/a Description: Edoc-doctor-appointment-system v1.0.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability at /patient/index.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/HashenUdara/edoc-doctor-appointment-system - https://github.com/onEpAth936/cve/blob/master/bug_e/edoc-doctor-appointment-system/Reflected%20Cross%20Site%20Scripting%20%28XSS%29
hub.com/onEpAth936/cve/blob/master/bug_e/edoc-doctor-appointment-system/Reflected%20Cross%20Site%20Scripting%20%28XSS%29.md
CVE ID: CVE-2022-36548 State: PUBLISHED Published: 2022-08-26T20:37:53 Last Updated: 2024-08-03T10:07:34.457Z Vendors: n/a Products: n/a Problem Types: n/a Description: Edoc-doctor-appointment-system v1.0.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability at /patient/settings.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name text field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/HashenUdara/edoc-doctor-appointment-system - https://github.com/onEpAth936/cve/blob/master/bug_e/edoc-doctor-appointment-system/Stored%20Cross%20Site%20Scripting%20%28XSS%29
github.com/onEpAth936/cve/blob/master/bug_e/edoc-doctor-appointment-system/Stored%20Cross%20Site%20Scripting%20%28XSS%29.md
CVE ID: CVE-2022-36551 State: PUBLISHED Published: 2022-10-03T00:00:00 Last Updated: 2024-08-03T10:07:34.479Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Server Side Request Forgery (SSRF) in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.0 and earlier allows an authenticated user to access arbitrary files on the system. Furthermore, self-registration is enabled by default in these versions of Label Studio enabling a remote attacker to create a new account and then exploit the SSRF. Additional Analyst Notes: - CVE Program Container: References: - http://heartex.com - http://labelstud.io - https://github.com/heartexlabs/label-studio/pull/2840
ntainer: References: - http://heartex.com - http://labelstud.io - https://github.com/heartexlabs/label-studio/pull/2840 - http://packetstormsecurity.com/files/171548/Label-Studio-1.5.0-Server-Side-Request-Forgery.html
CVE ID: CVE-2022-36552 State: PUBLISHED Published: 2022-08-30T15:07:39 Last Updated: 2024-08-03T10:07:34.477Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC6(AC1200) v5.0 Firmware v02.03.01.114 and below contains an issue in the component /cgi-bin/DownloadFlash which allows attackers to steal all data such as source code and system files via a crafted GET request. Additional Analyst Notes: - CVE Program Container: References: - http://tenda.com - http://ac6ac1200.com - https://drive.google.com/drive/folders/1VxR4lhaWNWLuAPdJK2aRF6zfo_mRyiFO?usp=sharing
CVE ID: CVE-2022-36553 State: PUBLISHED Published: 2022-08-29T22:46:17 Last Updated: 2024-08-03T10:07:34.487Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hytec Inter HWL-2511-SS v1.05 and below was discovered to contain a command injection vulnerability via the component /www/cgi-bin/popen.cgi. Additional Analyst Notes: - CVE Program Container: References: - https://hytec.co.jp/eng/products/our-brand/hwl-2511-ss.html - https://hytec.co.jp/eng/wordpress/wp-content/uploads/2019/09/hwl-2511-ss-ds.3.0.pdf - https://gist.github.com/Nwqda/b27418ab801eb0b9cdbe8d042cb0249b
CVE ID: CVE-2022-36554 State: PUBLISHED Published: 2022-08-29T22:46:18 Last Updated: 2024-08-03T10:07:34.467Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection vulnerability in the CLI (Command Line Interface) implementation of Hytec Inter HWL-2511-SS v1.05 and below allows attackers to execute arbitrary commands with root privileges. Additional Analyst Notes: - CVE Program Container: References: - https://hytec.co.jp/eng/products/our-brand/hwl-2511-ss.html - https://hytec.co.jp/eng/wordpress/wp-content/uploads/2019/09/hwl-2511-ss-ds.3.0.pdf - https://gist.github.com/Nwqda/b27418ab801eb0b9cdbe8d042cb0249b
CVE ID: CVE-2022-36555 State: PUBLISHED Published: 2022-08-29T22:46:18 Last Updated: 2024-08-03T10:07:34.481Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hytec Inter HWL-2511-SS v1.05 and below implements a SHA512crypt hash for the root account which can be easily cracked via a brute-force attack. Additional Analyst Notes: - CVE Program Container: References: - https://hytec.co.jp/eng/products/our-brand/hwl-2511-ss.html - https://hytec.co.jp/eng/wordpress/wp-content/uploads/2019/09/hwl-2511-ss-ds.3.0.pdf - https://gist.github.com/Nwqda/b27418ab801eb0b9cdbe8d042cb0249b
CVE ID: CVE-2022-36556 State: PUBLISHED Published: 2022-08-29T22:46:19 Last Updated: 2024-08-03T10:07:34.530Z Vendors: n/a Products: n/a Problem Types: n/a Description: Seiko SkyBridge MB-A100/A110 v4.2.0 and below was discovered to contain a command injection vulnerability via the ipAddress parameter at 07system08execute_ping_01. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/Nwqda/88232102fed50b54c43871e88e993b54 - https://www.seiko-sol.co.jp/products/skybridge/lineup/mb-a100/
CVE ID: CVE-2022-36557 State: PUBLISHED Published: 2022-08-29T22:46:20 Last Updated: 2024-08-03T10:07:34.470Z Vendors: n/a Products: n/a Problem Types: n/a Description: Seiko SkyBridge MB-A100/A110 v4.2.0 and below was discovered to contain an arbitrary file upload vulnerability via the restore backup function. This vulnerability allows attackers to execute arbitrary code via a crafted html file. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/Nwqda/88232102fed50b54c43871e88e993b54 - https://www.seiko-sol.co.jp/products/skybridge/lineup/mb-a100/
CVE ID: CVE-2022-36558 State: PUBLISHED Published: 2022-08-29T22:46:21 Last Updated: 2024-08-03T10:07:34.473Z Vendors: n/a Products: n/a Problem Types: n/a Description: Seiko SkyBridge MB-A100/A110 v4.2.0 and below implements a hard-coded passcode for the root account. Attackers are able to access the passcord via the file /etc/ciel.cfg. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/Nwqda/88232102fed50b54c43871e88e993b54 - https://www.seiko-sol.co.jp/products/skybridge/lineup/mb-a100/
CVE ID: CVE-2022-36559 State: PUBLISHED Published: 2022-08-29T22:46:21 Last Updated: 2024-08-03T10:07:34.470Z Vendors: n/a Products: n/a Problem Types: n/a Description: Seiko SkyBridge MB-A200 v01.00.04 and below was discovered to contain a command injection vulnerability via the Ping parameter at ping_exec.cgi. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/Nwqda/0db1fc6cfa39d7f0592d44e18c40146e - https://www.seiko-sol.co.jp/products/skybridge/lineup/mb-a200/
CVE ID: CVE-2022-36560 State: PUBLISHED Published: 2022-08-29T22:46:22 Last Updated: 2024-08-03T10:07:34.482Z Vendors: n/a Products: n/a Problem Types: n/a Description: Seiko SkyBridge MB-A200 v01.00.04 and below was discovered to contain multiple hard-coded passcodes for root. Attackers are able to access the passcodes at /etc/srapi/config/system.conf and /usr/sbin/ssol-sshd.sh. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/Nwqda/0db1fc6cfa39d7f0592d44e18c40146e - https://www.seiko-sol.co.jp/products/skybridge/lineup/mb-a200/
CVE ID: CVE-2022-36561 State: PUBLISHED Published: 2022-08-30T20:05:52 Last Updated: 2024-08-03T10:07:34.482Z Vendors: n/a Products: n/a Problem Types: n/a Description: XPDF v4.0.4 was discovered to contain a segmentation violation via the component /xpdf/AcroForm.cc:538. Additional Analyst Notes: - CVE Program Container: References: - https://forum.xpdfreader.com/viewtopic.php?f=3&t=42308
CVE ID: CVE-2022-36562 State: PUBLISHED Published: 2022-08-30T20:05:53 Last Updated: 2024-08-03T10:07:34.473Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the install directory (C:\Ruby31-x64) of Rubyinstaller2 v3.1.2 and below allows authenticated attackers to execute arbitrary code via overwriting binaries located in the directory. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ycdxsb/Vuln/blob/main/RubyInstaller2-Vuln
CVE ID: CVE-2022-36563 State: PUBLISHED Published: 2022-08-30T20:05:54 Last Updated: 2024-08-03T10:07:34.468Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the install directory (C:\RailsInstaller) of Rubyinstaller2 v3.1.2 and below allows authenticated attackers to execute arbitrary code via overwriting binaries located in the directory. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ycdxsb/Vuln/blob/main/Railsinstaller-Vuln/Railsinstaller-Vuln.md
CVE ID: CVE-2022-36564 State: PUBLISHED Published: 2022-08-30T20:05:54 Last Updated: 2024-08-03T10:07:34.508Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the install directory (C:\Strawberry) of StrawberryPerl v5.32.1.1 and below allows authenticated attackers to execute arbitrary code via overwriting binaries located in the directory. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ycdxsb/Vuln/blob/main/StrawberryPerl-Vuln/StrawberryPerl-Vuln.md
CVE ID: CVE-2022-36565 State: PUBLISHED Published: 2022-08-30T20:05:56 Last Updated: 2024-08-03T10:07:34.517Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the install directory (C:\Wamp64) of Wamp v3.2.6 and below allows authenticated attackers to execute arbitrary code via overwriting binaries located in the directory. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ycdxsb/Vuln/blob/main/Wamp-Vuln/Wamp-Vuln.md
CVE ID: CVE-2022-36566 State: PUBLISHED Published: 2022-08-31T17:12:13 Last Updated: 2024-08-03T10:07:34.470Z Vendors: n/a Products: n/a Problem Types: n/a Description: Rengine v1.3.0 was discovered to contain a command injection vulnerability via the scan engine function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zongdeiqianxing/rengine/issues/2
CVE ID: CVE-2022-36568 State: PUBLISHED Published: 2022-08-31T19:03:24 Last Updated: 2024-08-03T10:07:34.499Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC9 V15.03.05.19 was discovered to contain a stack overflow via the list parameter at /goform/setPptpUserList. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/CyberUnicornIoT/IoTvuln/blob/main/Tenda_ac9/3/tenda_ac9_setPptpUserList.md
CVE ID: CVE-2022-36569 State: PUBLISHED Published: 2022-08-31T19:03:25 Last Updated: 2024-08-03T10:07:34.465Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC9 V15.03.05.19 was discovered to contain a stack overflow via the deviceList parameter at /goform/setMacFilterCfg. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/CyberUnicornIoT/IoTvuln/blob/main/Tenda_ac9/4/tenda_ac9_setMacFilterCfg.md
CVE ID: CVE-2022-36570 State: PUBLISHED Published: 2022-08-31T19:03:26 Last Updated: 2024-08-03T10:07:34.528Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC9 V15.03.05.19 was discovered to contain a stack overflow via the time parameter at /goform/SetLEDCfg. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/CyberUnicornIoT/IoTvuln/blob/main/Tenda_ac9/1/tenda_ac9_SetLEDCfg.md
CVE ID: CVE-2022-36571 State: PUBLISHED Published: 2022-08-31T19:03:27 Last Updated: 2024-08-03T10:07:34.530Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC9 V15.03.05.19 was discovered to contain a stack overflow via the mask parameter at /goform/WanParameterSetting. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/CyberUnicornIoT/IoTvuln/blob/main/Tenda_ac9/2/tenda_ac9_WanParameterSetting.md
CVE ID: CVE-2022-36572 State: PUBLISHED Published: 2022-08-28T23:06:48 Last Updated: 2024-08-03T10:07:34.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sinsiu Sinsiu Enterprise Website System v1.1.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /upload/admin.php?/deal/. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BreakALegCml/try/blob/main/SinSiuEnterpriseWebsiteSystem
CVE ID: CVE-2022-36573 State: PUBLISHED Published: 2022-08-28T23:06:49 Last Updated: 2024-08-03T10:07:34.497Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in Pagekit CMS v1.0.18 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Markdown text box under /blog/post/edit. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pagekit/pagekit/issues/968
CVE ID: CVE-2022-36577 State: PUBLISHED Published: 2022-08-19T16:49:40 Last Updated: 2024-08-03T10:07:34.496Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in jizhicms v2.3.1. There is a CSRF vulnerability that can add a admin. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Cherry-toto/jizhicms/issues/77
CVE ID: CVE-2022-36578 State: PUBLISHED Published: 2022-08-19T16:51:55 Last Updated: 2024-08-03T10:07:34.520Z Vendors: n/a Products: n/a Problem Types: n/a Description: jizhicms v2.3.1 has SQL injection in the background. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Cherry-toto/jizhicms/issues/78
CVE ID: CVE-2022-36579 State: PUBLISHED Published: 2022-08-19T16:58:31 Last Updated: 2024-08-03T10:07:34.537Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wellcms 2.2.0 is vulnerable to Cross Site Request Forgery (CSRF). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wellcms/wellcms/issues/11
CVE ID: CVE-2022-36580 State: PUBLISHED Published: 2022-08-31T19:44:14 Last Updated: 2024-08-03T10:07:34.483Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the component /admin/products/controller.php?action=add of Online Ordering System v2.3.2 allows attackers to execute arbitrary code via a crafted PHP file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zerrr0/Zerrr0_Vulnerability/blob/main/Online-Ordering-System/Arbitrary-File-Upload-Vulnerability.md
CVE ID: CVE-2022-36581 State: PUBLISHED Published: 2022-08-31T19:44:16 Last Updated: 2024-08-03T10:07:34.479Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via the user_email parameter at /admin/login.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zerrr0/Zerrr0_Vulnerability/blob/main/Online-Ordering-System/SQL-Injection-Vulnerability.md
CVE ID: CVE-2022-36582 State: PUBLISHED Published: 2022-08-31T19:44:17 Last Updated: 2024-08-03T10:07:34.517Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the component /php_action/createProduct.php of Garage Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zerrr0/Zerrr0_Vulnerability/blob/main/Garage-Management-System/Arbitrary-File-Upload-Vulnerability.md
CVE ID: CVE-2022-36583 State: PUBLISHED Published: 2022-09-01T17:50:47 Last Updated: 2024-08-03T10:07:34.566Z Vendors: n/a Products: n/a Problem Types: n/a Description: DedeCMS V5.7.97 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities at /dede/co_do.php via the dopost, rpok, and aid parameters. Additional Analyst Notes: - CVE Program Container: References: - https://blog.csdn.net/weixin_45996361/article/details/125882580