Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-54795 State: PUBLISHED Published: 2025-01-21T00:00:00.000Z Last Updated: 2025-10-17T15:12:33.608Z Vendors: n/a Products: n/a Problem Types: n/a Description: SpagoBI v3.5.1 contains multiple Stored Cross-Site Scripting (XSS) vulnerabilities in the create/edit forms of the worksheet designer function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MarioTesoro/CVE-2024-54795 - https://github.com/MarioTesoro/vulnerability-research/tree/main/CVE-2024-54795
CVE ID: CVE-2024-54802 State: PUBLISHED Published: 2025-03-31T00:00:00.000Z Last Updated: 2025-04-02T14:27:20.979Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Netgear WNR854T 1.5.2 (North America), the UPNP service (/usr/sbin/upnp) is vulnerable to stack-based buffer overflow in the M-SEARCH Host header. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://faultpoint.com/post/2025-03-25-8-cves-on-the-wnr854t-junkyard/#802
CVE ID: CVE-2024-54803 State: PUBLISHED Published: 2025-03-31T00:00:00.000Z Last Updated: 2025-04-02T14:15:48.341Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netgear WNR854T 1.5.2 (North America) is vulnerable to Command Injection. An attacker can send a specially crafted request to post.cgi, updating the nvram parameter pppoe_peer_mac and forcing a reboot. This will result in command injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://faultpoint.com/post/2025-03-25-8-cves-on-the-wnr854t-junkyard/#803
CVE ID: CVE-2024-54804 State: PUBLISHED Published: 2025-03-31T00:00:00.000Z Last Updated: 2025-04-02T14:13:02.109Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netgear WNR854T 1.5.2 (North America) is vulnerable to Command Injection. An attacker can send a specially crafted request to post.cgi, updating the nvram parameter wan_hostname and forcing a reboot. This will result in command injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://faultpoint.com/post/2025-03-25-8-cves-on-the-wnr854t-junkyard/#804
CVE ID: CVE-2024-54805 State: PUBLISHED Published: 2025-03-31T00:00:00.000Z Last Updated: 2025-04-02T14:09:30.194Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netgear WNR854T 1.5.2 (North America) is vulnerable to Command Injection. An attacker can send a specially crafted request to post.cgi, updating the nvram parameter get_email. After which, they can visit the send_log.cgi endpoint which uses the parameter in a system call to achieve command execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://faultpoint.com/post/2025-03-25-8-cves-on-the-wnr854t-junkyard/#805
CVE ID: CVE-2024-54806 State: PUBLISHED Published: 2025-03-31T00:00:00.000Z Last Updated: 2025-04-02T14:07:09.674Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netgear WNR854T 1.5.2 (North America) is vulnerable to Arbitrary command execution in cmd.cgi which allows for the execution of system commands via the web interface. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://faultpoint.com/post/2025-03-25-8-cves-on-the-wnr854t-junkyard/#806
CVE ID: CVE-2024-54807 State: PUBLISHED Published: 2025-03-31T00:00:00.000Z Last Updated: 2025-04-02T14:04:38.356Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Netgear WNR854T 1.5.2 (North America), the UPNP service is vulnerable to command injection in the function addmap_exec which parses the NewInternalClient parameter of the AddPortMapping SOAPAction into a system call without sanitation. An attacker can send a specially crafted SOAPAction request for AddPortMapping via the router's WANIPConn1 service to achieve arbitrary command execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://faultpoint.com/post/2025-03-25-8-cves-on-the-wnr854t-junkya
nalyst Notes: - CISA ADP Vulnrichment: References: - https://faultpoint.com/post/2025-03-25-8-cves-on-the-wnr854t-junkyard/#807
CVE ID: CVE-2024-54808 State: PUBLISHED Published: 2025-03-31T00:00:00.000Z Last Updated: 2025-04-02T13:57:20.705Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netgear WNR854T 1.5.2 (North America) contains a stack-based buffer overflow vulnerability in the SetDefaultConnectionService function due to an unconstrained use of sscanf. The vulnerability allows for control of the program counter and can be utilized to achieve arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://faultpoint.com/post/2025-03-25-8-cves-on-the-wnr854t-junkyard/#808
CVE ID: CVE-2024-54809 State: PUBLISHED Published: 2025-03-31T00:00:00.000Z Last Updated: 2025-04-02T13:55:32.964Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netgear Inc WNR854T 1.5.2 (North America) contains a stack-based buffer overflow vulnerability in the parse_st_header function due to use of a request header parameter in a strncpy where size is determined based on the input specified. By sending a specially crafted packet, an attacker can take control of the program counter and hijack control flow of the program to execute arbitrary system commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://faultpoint.com/post/2025-03-25-8-cves-on-the-wnr8
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://faultpoint.com/post/2025-03-25-8-cves-on-the-wnr854t-junkyard/#809
CVE ID: CVE-2024-54810 State: PUBLISHED Published: 2024-12-12T00:00:00 Last Updated: 2024-12-13T18:05:57.683Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability was found in /preschool/admin/password-recovery.php in PHPGurukul Pre-School Enrollment System Project v1.0, which allows remote attackers to execute arbitrary code via the mobileno parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Santoshcyber1/CVE-wirteup/blob/main/Phpgurukul/Pre-School%20Enrollment/SQL%20Injection%20pre-school%20pa.pdf
CVE ID: CVE-2024-54811 State: PUBLISHED Published: 2024-12-12T00:00:00 Last Updated: 2024-12-13T18:06:30.757Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in /index.php in PHPGurukul Park Ticketing Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "login" parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Santoshcyber1/CVE-wirteup/blob/main/Phpgurukul/Park%20ticket/report%20sql.pdf
CVE ID: CVE-2024-54818 State: PUBLISHED Published: 2025-01-08T00:00:00 Last Updated: 2025-01-08T19:15:26.757Z Vendors: n/a Products: n/a Problem Types: n/a Description: SourceCodester Computer Laboratory Management System 1.0 is vulnerable to Incorrect Access Control. via /php-lms/admin/?page=user/list. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portswigger.net/web-security/access-control#how-to-prevent-access-control-vulnerabilities - https://github.com/CloseC4ll/vulnerability-research/tree/main/CVE-2024-54818
CVE ID: CVE-2024-54819 State: PUBLISHED Published: 2025-01-07T00:00:00 Last Updated: 2025-01-08T15:02:09.566Z Vendors: n/a Products: n/a Problem Types: n/a Description: I, Librarian before and including 5.11.1 is vulnerable to Server-Side Request Forgery (SSRF) due to improper input validation in classes/security/validation.php Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mkucej/i-librarian-free/commit/ed36f6f258392fa2ec72f9820661ded75d91accc - https://github.com/partywavesec/CVE-2024-55557
CVE ID: CVE-2024-54820 State: PUBLISHED Published: 2025-02-24T00:00:00.000Z Last Updated: 2025-02-24T17:49:05.135Z Vendors: n/a Products: n/a Problem Types: n/a Description: XOne Web Monitor v02.10.2024.530 framework 1.0.4.9 was discovered to contain a SQL injection vulnerability in the login page. This vulnerability allows attackers to extract all usernames and passwords via a crafted input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://xone.es/ - https://github.com/jcarabantes/CVE-2024-54820
CVE ID: CVE-2024-54840 State: PUBLISHED Published: 2025-02-03T00:00:00.000Z Last Updated: 2025-02-19T22:51:45.709Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: CyberArk Products: Privileged Access Manager Problem Types: CWE-348 Description: PVWA (Password Vault Web Access) in CyberArk Privileged Access Manager Self-Hosted before 14.4 does not properly address environment issues that can contribute to Host header injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.cyberark.com/pam-self-hosted/latest/en/content/release%20notes/rn-whatsnew14-4.htm#Securitybugfixes - https://gist.github.com/Hurdano/8244855ef8ec364fd98a2693
/content/release%20notes/rn-whatsnew14-4.htm#Securitybugfixes - https://gist.github.com/Hurdano/8244855ef8ec364fd98a2693de6e30c5
CVE ID: CVE-2024-54842 State: PUBLISHED Published: 2024-12-12T00:00:00 Last Updated: 2024-12-12T17:56:17.945Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability was found in phpgurukul Online Nurse Hiring System v1.0 in /admin/password-recovery.php via the mobileno parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/achchhelalchauhan/phpgurukul/blob/main/SQL%20injection%20ONHP-forgetpass-mobileno.pdf
CVE ID: CVE-2024-54846 State: PUBLISHED Published: 2025-01-10T00:00:00 Last Updated: 2025-01-13T20:28:12.941Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in CP Plus CP-VNR-3104 B3223P22C02424 allows attackers to obtain the EC private key and access sensitive data or execute a man-in-the-middle attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://nvd.nist.gov/vuln/detail/CVE-2020-15522 - https://payatu.com/blog/solving-the-problem-of-encrypted-firmware/ - https://github.com/Yashodhanvivek/CP-VNR-3104-NVR-Vulnerabilties/blob/main/CPPlus_CP-VNR-3104_Security_Assessment.pdf
CVE ID: CVE-2024-54847 State: PUBLISHED Published: 2025-01-10T00:00:00 Last Updated: 2025-01-13T20:26:29.925Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in CP Plus CP-VNR-3104 B3223P22C02424 allows attackers to access the Diffie-Hellman (DH) parameters and access sensitive data or execute a man-in-the-middle attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://payatu.com/blog/solving-the-problem-of-encrypted-firmware/ - https://nvd.nist.gov/vuln/detail/CVE-2023-3817 - https://github.com/Yashodhanvivek/CP-VNR-3104-NVR-Vulnerabilties/blob/main/CPPlus_CP-VNR-3104_Security_Assessment.pdf
CVE ID: CVE-2024-54848 State: PUBLISHED Published: 2025-01-10T00:00:00 Last Updated: 2025-01-13T20:21:01.204Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper handling and storage of certificates in CP Plus CP-VNR-3104 B3223P22C02424 allow attackers to decrypt communications or execute a man-in-the-middle attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://payatu.com/blog/solving-the-problem-of-encrypted-firmware/ - https://capec.mitre.org/data/definitions/233 - https://nvd.nist.gov/vuln/detail/CVE-2021-21551 - https://github.com/Yashodhanvivek/CP-VNR-3104-NVR-Vulnerabilties/blob/main/CPPlus_CP-VNR-3104_Security_Assessment.pdf
CVE ID: CVE-2024-54849 State: PUBLISHED Published: 2025-01-10T00:00:00 Last Updated: 2025-01-13T20:16:37.016Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in CP Plus CP-VNR-3104 B3223P22C02424 allows attackers to obtain the second RSA private key and access sensitive data or execute a man-in-the-middle attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://nvd.nist.gov/vuln/detail/CVE-2020-15522 - https://payatu.com/blog/solving-the-problem-of-encrypted-firmware/
CVE ID: CVE-2024-54851 State: PUBLISHED Published: 2025-01-29T00:00:00.000Z Last Updated: 2025-01-30T16:48:20.198Z Vendors: n/a Products: n/a Problem Types: n/a Description: Teedy <= 1.12 is vulnerable to Cross Site Request Forgery (CSRF), due to the lack of CSRF protection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Tanguy-Boisset/CVE/blob/master/CVE-2024-54851/README.md
CVE ID: CVE-2024-54852 State: PUBLISHED Published: 2025-01-29T00:00:00.000Z Last Updated: 2025-02-10T22:11:34.342Z Vendors: n/a Products: n/a Problem Types: n/a Description: When LDAP connection is activated in Teedy versions between 1.9 to 1.12, the username field of the login form is vulnerable to LDAP injection. Due to improper sanitization of user input, an unauthenticated attacker is then able to perform various malicious actions, such as creating arbitrary accounts and spraying passwords. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Tanguy-Boisset/CVE/blob/master/CVE-2024-54852/README.md
CVE ID: CVE-2024-54853 State: PUBLISHED Published: 2025-02-05T00:00:00.000Z Last Updated: 2025-02-06T15:20:56.734Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-Site Scripting (XSS) vulnerability was identified affecting Skybox Change Manager versions 13.2.170 and earlier that allows remote authenticated users to store malicious payloads in the affected field that would then execute in an unsuspecting victim's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/KoratSec/CVEs/blob/main/CVE-2024-54853.txt
CVE ID: CVE-2024-54879 State: PUBLISHED Published: 2025-01-06T00:00:00 Last Updated: 2025-01-07T20:17:30.876Z Vendors: n/a Products: n/a Problem Types: n/a Description: SeaCMS V13.1 is vulnerable to Incorrect Access Control. A logic flaw can be exploited by an attacker to allow any user to recharge members indefinitely. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://seacms.com - https://blog.csdn.net/weixin_46686336/article/details/144797242
CVE ID: CVE-2024-54880 State: PUBLISHED Published: 2025-01-06T00:00:00 Last Updated: 2025-01-07T20:18:20.943Z Vendors: n/a Products: n/a Problem Types: n/a Description: SeaCMS V13.1 is vulnerable to Incorrect Access Control. A logic flaw can be exploited by an attacker to allow any user to register accounts in bulk. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.seacms.net/ - https://blog.csdn.net/weixin_46686336/article/details/144797063
CVE ID: CVE-2024-54887 State: PUBLISHED Published: 2025-01-09T00:00:00 Last Updated: 2025-01-15T20:26:04.335Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP-Link TL-WR940N V3 and V4 with firmware 3.16.9 and earlier contain a buffer overflow via the dnsserver1 and dnsserver2 parameters at /userRpm/Wan6to4TunnelCfgRpm.htm. This vulnerability allows an authenticated attacker to execute arbitrary code on the remote device in the context of the root user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://tp-link.com - https://github.com/JBince/vulnerability-research/tree/main/CVE-2024-54887
CVE ID: CVE-2024-54907 State: PUBLISHED Published: 2024-12-26T00:00:00 Last Updated: 2024-12-26T19:24:54.793Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3002R V4.0.0-B20230531.1404 is vulnerable to Remote Code Execution in /bin/boa via formWsc. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MnrikSrins/totolink_A3002R_RCE
CVE ID: CVE-2024-54909 State: PUBLISHED Published: 2025-02-06T00:00:00.000Z Last Updated: 2025-02-12T14:12:46.825Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability has been identified in GoldPanKit eva-server v4.1.0. It affects the path parameter of the /api/resource/local/download endpoint, where manipulation of this parameter can lead to arbitrary file download. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/goldpankit/eva-springboot2/issues/2
CVE ID: CVE-2024-54910 State: PUBLISHED Published: 2025-01-10T00:00:00 Last Updated: 2025-01-14T15:54:05.441Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hasleo Backup Suite Free v4.9.4 and before is vulnerable to Insecure Permissions via the File recovery function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.easyuefi.com/backup-software/backup-suite-free.html - https://github.com/KrakenEU/CVE-2024-54910
CVE ID: CVE-2024-54916 State: PUBLISHED Published: 2025-02-11T00:00:00.000Z Last Updated: 2025-03-18T14:38:40.077Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the SharedConfig class of Telegram Android APK v.11.7.0 allows a physically proximate attacker to bypass authentication and escalate privileges by manipulating the return value of the checkPasscode method. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://drive.google.com/file/d/1knf8-_fFUSLd3ZmbEpy0_OVzSN1UR1JR/view?usp=sharing - https://github.com/SAHALLL/CVE-2024-54916
CVE ID: CVE-2024-54918 State: PUBLISHED Published: 2024-12-09T00:00:00 Last Updated: 2024-12-12T17:27:10.898Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kashipara E-learning Management System v1.0 is vulnerable to Remote Code Execution via File Upload in /teacher_avatar.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/RCE%20by%20File%20Upload%20-%20Update%20Avatar.pdf
CVE ID: CVE-2024-54919 State: PUBLISHED Published: 2024-12-09T00:00:00 Last Updated: 2024-12-10T17:10:37.987Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross Site Scripting (XSS ) was found in /teacher_avatar.php of kashipara E-learning Management System v1.0. This vulnerability allows remote attackers to execute arbitrary java script via the filename parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/XSS%20by%20File%20Upload%20-%20Update%20Avatar.pdf
CVE ID: CVE-2024-54920 State: PUBLISHED Published: 2024-12-09T00:00:00.000Z Last Updated: 2025-03-20T20:25:04.378Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability was found in /teacher_signup.php of kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL command to get unauthorized database access via the firstname, lastname, and class_id parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/SQL%20Injection%20-%20Signup%20teacher.pdf
CVE ID: CVE-2024-54921 State: PUBLISHED Published: 2024-12-09T00:00:00 Last Updated: 2024-12-11T15:41:33.291Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection was found in /student_signup.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the username, firstname, lastname, and class_id parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/SQL%20Injection%20-%20Signup%20Student.pdf
CVE ID: CVE-2024-54922 State: PUBLISHED Published: 2024-12-09T00:00:00 Last Updated: 2024-12-12T17:30:46.224Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection was found in /admin/edit_user.php of kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the firstname, lastname, and username parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/SQL%20Injection%20-%20edit_user.pdf
CVE ID: CVE-2024-54923 State: PUBLISHED Published: 2024-12-09T00:00:00 Last Updated: 2024-12-11T15:39:54.348Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability was found in /admin/edit_teacher.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the department parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/SQL%20Injection%20-%20edit_teacher.pdf
CVE ID: CVE-2024-54924 State: PUBLISHED Published: 2024-12-09T00:00:00 Last Updated: 2024-12-11T15:37:15.222Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection was found in /admin/edit_content.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the title and content parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/SQL%20Injection%20-%20edit%20content.pdf
CVE ID: CVE-2024-54925 State: PUBLISHED Published: 2024-12-09T00:00:00 Last Updated: 2024-12-12T17:25:11.132Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection was found in /remove_sent_message.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the id parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/SQL%20Injection%20-%20remove_sent_message.pdf
CVE ID: CVE-2024-54926 State: PUBLISHED Published: 2024-12-09T00:00:00 Last Updated: 2024-12-11T15:52:39.241Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability was found in /search_class.php of kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the school_year parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/SQL%20Injection%20-%20search_class.pdf
CVE ID: CVE-2024-54927 State: PUBLISHED Published: 2024-12-09T00:00:00 Last Updated: 2024-12-11T15:50:54.415Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_users.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/SQL%20Injection%20-%20delete%20user.pdf
CVE ID: CVE-2024-54928 State: PUBLISHED Published: 2024-12-09T00:00:00 Last Updated: 2024-12-11T15:35:32.970Z Vendors: n/a Products: n/a Problem Types: n/a Description: kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_teacher.php, Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/SQL%20Injection%20-%20delete%20teacher.pdf
CVE ID: CVE-2024-54929 State: PUBLISHED Published: 2024-12-09T00:00:00.000Z Last Updated: 2025-03-18T14:49:37.663Z Vendors: n/a Products: n/a Problem Types: n/a Description: KASHIPARA E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_subject.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/SQL%20Injection%20-%20delete%20subject.pdf