Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
osed to the public and may be used. The identifier of this vulnerability is VDB-257072. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.257072 - https://vuldb.com/?ctiid.257072 - https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Employee%20Task%20Management%20System/Execution%20After%20Redirect%20-%20admin-manage-user.php.md
CVE ID: CVE-2024-2570 State: PUBLISHED Published: 2024-03-18T00:00:09.516Z Last Updated: 2024-08-22T19:10:16.168Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Employee Task Management System Problem Types: CWE-698 Description: A vulnerability was found in SourceCodester Employee Task Management System 1.0. It has been classified as critical. This affects an unknown part of the file /edit-task.php. The manipulation leads to execution after redirect. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257073 was assigned to this vulnerability. Additional Analyst Notes: - CVE Pr
public and may be used. The identifier VDB-257073 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.257073 - https://vuldb.com/?ctiid.257073 - https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Employee%20Task%20Management%20System/Execution%20After%20Redirect%20-%20edit-task.php.md
CVE ID: CVE-2024-2571 State: PUBLISHED Published: 2024-03-18T00:31:04.252Z Last Updated: 2024-08-22T19:09:28.497Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Employee Task Management System Problem Types: CWE-698 Description: A vulnerability was found in SourceCodester Employee Task Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /manage-admin.php. The manipulation leads to execution after redirect. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-257074 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE P
e public and may be used. VDB-257074 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.257074 - https://vuldb.com/?ctiid.257074 - https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Employee%20Task%20Management%20System/Execution%20After%20Redirect%20-%20manage-admin.php.md
CVE ID: CVE-2024-2572 State: PUBLISHED Published: 2024-03-18T01:00:08.249Z Last Updated: 2024-08-01T19:18:47.978Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Employee Task Management System Problem Types: CWE-698 Description: A vulnerability was found in SourceCodester Employee Task Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /task-details.php. The manipulation leads to execution after redirect. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257075. Additional Analyst Notes: - CIS
e public and may be used. The associated identifier of this vulnerability is VDB-257075. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.257075 - https://vuldb.com/?ctiid.257075 - https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Employee%20Task%20Management%20System/Execution%20After%20Redirect%20-%20task-details.php.md
CVE ID: CVE-2024-2573 State: PUBLISHED Published: 2024-03-18T01:00:09.843Z Last Updated: 2024-08-01T19:18:48.187Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Employee Task Management System Problem Types: CWE-698 Description: A vulnerability classified as critical has been found in SourceCodester Employee Task Management System 1.0. Affected is an unknown function of the file /task-info.php. The manipulation leads to execution after redirect. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257076. Additional Analyst Notes: - CISA ADP Vulnrichment:
and may be used. The identifier of this vulnerability is VDB-257076. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.257076 - https://vuldb.com/?ctiid.257076 - https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Employee%20Task%20Management%20System/Execution%20After%20Redirect%20-%20task-info.php.md
CVE ID: CVE-2024-2574 State: PUBLISHED Published: 2024-03-18T01:31:03.864Z Last Updated: 2024-08-22T19:49:02.609Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Employee Task Management System Problem Types: CWE-639 Description: A vulnerability classified as critical was found in SourceCodester Employee Task Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /edit-task.php. The manipulation of the argument task_id leads to authorization bypass. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257077 was assigned to this vulnerability. Addition
has been disclosed to the public and may be used. The identifier VDB-257077 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.257077 - https://vuldb.com/?ctiid.257077 - https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Employee%20Task%20Management%20System/IDOR%20-%20edit-task.php.md
CVE ID: CVE-2024-2575 State: PUBLISHED Published: 2024-03-18T02:00:09.261Z Last Updated: 2024-08-08T20:45:02.184Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Employee Task Management System Problem Types: CWE-639 Description: A vulnerability, which was classified as critical, has been found in SourceCodester Employee Task Management System 1.0. Affected by this issue is some unknown functionality of the file /task-details.php. The manipulation of the argument task_id leads to authorization bypass. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-257078 is the identifier assigned to this vulnerabil
. The exploit has been disclosed to the public and may be used. VDB-257078 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.257078 - https://vuldb.com/?ctiid.257078 - https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Employee%20Task%20Management%20System/IDOR%20-%20task-details.php.md
CVE ID: CVE-2024-2576 State: PUBLISHED Published: 2024-03-18T02:00:10.656Z Last Updated: 2024-08-08T20:44:23.946Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Employee Task Management System Problem Types: CWE-639 Description: A vulnerability, which was classified as critical, was found in SourceCodester Employee Task Management System 1.0. This affects an unknown part of the file /update-admin.php. The manipulation of the argument admin_id leads to authorization bypass. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257079. Additional
been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257079. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.257079 - https://vuldb.com/?ctiid.257079 - https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Employee%20Task%20Management%20System/IDOR%20-%20update-admin.php.md
CVE ID: CVE-2024-2577 State: PUBLISHED Published: 2024-03-18T02:31:04.259Z Last Updated: 2024-08-12T15:47:09.578Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Employee Task Management System Problem Types: CWE-639 Description: A vulnerability has been found in SourceCodester Employee Task Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /update-employee.php. The manipulation of the argument admin_id leads to authorization bypass. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257080. Additional Analyst N
s been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257080. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.257080 - https://vuldb.com/?ctiid.257080 - https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Employee%20Task%20Management%20System/IDOR%20-%20update-employee.php.md
CVE ID: CVE-2024-2578 State: PUBLISHED Published: 2024-03-21T16:52:33.345Z Last Updated: 2024-08-01T19:18:47.068Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: WPCoder Products: WP Coder Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPCoder WP Coder allows Stored XSS.This issue affects WP Coder: from n/a through 3.5. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-coder/wordpress-wp-coder-plugin-3-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-2579 State: PUBLISHED Published: 2024-03-21T16:50:18.335Z Last Updated: 2024-08-01T19:18:47.074Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Data443 Products: Tracking Code Manager Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Data443 Tracking Code Manager.This issue affects Tracking Code Manager: from n/a through 2.0.16. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/tracking-code-manager/wordpress-tracking-code-manager-plugin-2-0-16-cross-site-scripting-xss-v
om/database/vulnerability/tracking-code-manager/wordpress-tracking-code-manager-plugin-2-0-16-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-2580 State: PUBLISHED Published: 2024-03-21T16:48:23.199Z Last Updated: 2024-08-01T19:18:48.205Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: FunnelKit Products: Automation By Autonami Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FunnelKit Automation By Autonami allows Stored XSS.This issue affects Automation By Autonami: from n/a through 2.8.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-marketing-automations/wordpress-recover-woocommerce-cart-abandonmen
: - https://patchstack.com/database/vulnerability/wp-marketing-automations/wordpress-recover-woocommerce-cart-abandonment-newsletter-email-marketing-marketing-automation-by-funnelkit-plugin-2-8-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-2581 State: PUBLISHED Published: 2024-03-18T03:00:06.600Z Last Updated: 2024-08-02T15:29:50.674Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: AC10 Problem Types: CWE-121 Description: A vulnerability was found in Tenda AC10 16.03.10.13 and classified as critical. This issue affects the function fromSetRouteStatic of the file /goform/SetStaticRouteCfg. The manipulation of the argument list leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257081 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP
identifier VDB-257081 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.257081 - https://vuldb.com/?ctiid.257081 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC10/V16.03.10.13/fromSetRouteStatic.md
CVE ID: CVE-2024-2583 State: PUBLISHED Published: 2024-04-13T05:00:02.273Z Last Updated: 2024-08-01T19:18:47.959Z Vendors: Unknown Products: WP Shortcodes Plugin — Shortcodes Ultimate Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.0.5 does not properly escape some of its shortcodes attributes before they are echoed back to users, making it possible for users with the contributor role to conduct Stored XSS attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/98d8c713-e8cd-4fad-a8fb-7a40db2742a2/
CVE ID: CVE-2024-2584 State: PUBLISHED Published: 2024-03-18T13:52:12.853Z Last Updated: 2024-08-01T19:18:47.891Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Amssplus Products: AMSS++ Problem Types: CWE-89 Description: Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/book/main/select_send.php, in the 'sd_index' parameter. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multipl
CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss
CVE ID: CVE-2024-2585 State: PUBLISHED Published: 2024-03-18T13:52:42.024Z Last Updated: 2024-08-15T14:10:27.669Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Amssplus Products: AMSS++ Problem Types: CWE-89 Description: Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/book/main/select_send_2.php, in the 'sd_index' parameter. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multi
- CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss
CVE ID: CVE-2024-2586 State: PUBLISHED Published: 2024-03-18T13:53:16.296Z Last Updated: 2025-04-10T20:24:43.888Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Amssplus Products: AMSS++ Problem Types: CWE-89 Description: Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/index.php, in the 'username' parameter. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amsspl
CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss
CVE ID: CVE-2024-2587 State: PUBLISHED Published: 2024-03-18T13:53:50.031Z Last Updated: 2024-08-01T19:18:48.231Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Amssplus Products: AMSS++ Problem Types: CWE-89 Description: Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/book/main/bookdetail_khet_person.php, in multiple parameters. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/m
es: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss
CVE ID: CVE-2024-2588 State: PUBLISHED Published: 2024-03-18T13:54:35.108Z Last Updated: 2024-08-12T20:44:46.265Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Amssplus Products: AMSS++ Problem Types: CWE-89 Description: Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/admin/index.php, in the 'id' parameter. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amsspl
CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss
CVE ID: CVE-2024-2589 State: PUBLISHED Published: 2024-03-18T13:56:17.433Z Last Updated: 2024-08-02T15:28:06.165Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Amssplus Products: AMSS++ Problem Types: CWE-89 Description: Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/book/main/bookdetail_school_person.php, in multiple parameters. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso
otes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss
CVE ID: CVE-2024-2590 State: PUBLISHED Published: 2024-03-18T13:56:46.326Z Last Updated: 2024-08-12T20:45:12.288Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Amssplus Products: AMSS++ Problem Types: CWE-89 Description: Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/mail/main/select_send.php, in the 'sd_index' parameter. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multipl
CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss
CVE ID: CVE-2024-2591 State: PUBLISHED Published: 2024-03-18T13:57:12.990Z Last Updated: 2024-08-26T14:12:27.707Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Amssplus Products: AMSS++ Problem Types: CWE-89 Description: Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/book/main/bookdetail_group.php, in multiple parameters. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multipl
CVE ID: CVE-2024-2592 State: PUBLISHED Published: 2024-03-18T13:57:36.960Z Last Updated: 2024-08-28T15:39:21.612Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Amssplus Products: AMSS++ Problem Types: CWE-89 Description: Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/person/pic_show.php, in the 'person_id' parameter. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vul
rogram Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss
CVE ID: CVE-2024-2593 State: PUBLISHED Published: 2024-03-18T14:00:20.308Z Last Updated: 2024-08-01T19:18:48.177Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Amssplus Products: AMSS++ Problem Types: CWE-79 Description: Vulnerability in AMSS++ version 4.31, which does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability through /amssplus/modules/book/main/bookdetail_group.php, in the 'b_id' parameter. This vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Pro
henticated user and steal their session cookie credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss
CVE ID: CVE-2024-2594 State: PUBLISHED Published: 2024-03-18T14:00:56.678Z Last Updated: 2024-08-01T19:18:47.918Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Amssplus Products: AMSS++ Problem Types: CWE-79 Description: Vulnerability in AMSS++ version 4.31, which does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability through /amssplus/admin/index.php, in multiple parameters. This vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Referenc
l their session cookie credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss
CVE ID: CVE-2024-2595 State: PUBLISHED Published: 2024-03-18T14:01:29.372Z Last Updated: 2024-08-01T19:18:48.206Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Amssplus Products: AMSS++ Problem Types: CWE-79 Description: Vulnerability in AMSS++ version 4.31, which does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability through /amssplus/modules/book/main/bookdetail_khet_person.php, in the 'b_id' parameter. This vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: - C
an authenticated user and steal their session cookie credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss