Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
, with author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dc024183-0244-4ef9-9171-057ecd1c3e1d?source=cve - https://plugins.trac.wordpress.org/browser/auto-post-thumbnail/tags/3.9.18/includes/class-apt.php#L947
CVE ID: CVE-2023-7074 State: PUBLISHED Published: 2024-01-29T14:44:15.496Z Last Updated: 2025-06-17T14:30:10.077Z Vendors: Unknown Products: WP SOCIAL BOOKMARK MENU Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP SOCIAL BOOKMARK MENU WordPress plugin through 1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7906c349-97b0-4d82-aef0-97a1175ae88e/ - https://magos-securitas.com/txt/CVE-2023-7074.txt
CVE ID: CVE-2023-7075 State: PUBLISHED Published: 2023-12-22T12:00:07.412Z Last Updated: 2024-08-02T08:50:07.948Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: code-projects Products: Point of Sales and Inventory Management System Problem Types: CWE-79 Description: A vulnerability was found in code-projects Point of Sales and Inventory Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /main/checkout.php. The manipulation of the argument pt leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-248846 is the identifier assigned to this
ed remotely. The exploit has been disclosed to the public and may be used. VDB-248846 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.248846 - https://vuldb.com/?ctiid.248846 - https://github.com/Glunko/vulnerability/blob/main/Point-of-Sales-And-Inventory-Management-System.md
CVE ID: CVE-2023-7076 State: PUBLISHED Published: 2023-12-22T14:00:05.523Z Last Updated: 2024-11-21T14:15:13.612Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: slawkens Products: MyAAC Problem Types: CWE-79 Description: A vulnerability was found in slawkens MyAAC up to 0.8.13. It has been declared as problematic. This vulnerability affects unknown code of the file system/pages/bugtracker.php. The manipulation of the argument bug[2]['subject']/bug[2]['text']/report['subject'] leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 0.8.14 is able to address this issue. The name of the patch is 83a91ec540072d319dd338abff45f8d5ebf48190. It is recomm
on 0.8.14 is able to address this issue. The name of the patch is 83a91ec540072d319dd338abff45f8d5ebf48190. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-248848. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.248848 - https://vuldb.com/?ctiid.248848 - https://github.com/otsoft/myaac/commit/83a91ec540072d319dd338abff45f8d5ebf48190 - https://github.com/slawkens/myaac/releases/tag/v0.8.14
CVE ID: CVE-2023-7077 State: PUBLISHED Published: 2024-02-05T06:57:45.928Z Last Updated: 2025-05-15T19:47:34.457Z Vendors: Sharp NEC Display Solutions, Ltd. Products: P403, P463, P553, P703, P801, X554UN, X464UN, X554UNS, X464UNV, X474HB, X464UNS, X554UNV, X555UNS, X555UNV, X754HB, X554HB, E705, E805, E905, UN551S, UN551VS, X551UHD, X651UHD, X841UHD, X981UHD, MD551C8 Problem Types: CWE-22 Description: Sharp NEC Displays (P403, P463, P553, P703, P801, X554UN, X464UN, X554UNS, X464UNV, X474HB, X464UNS, X554UNV, X555UNS, X555UNV, X754HB, X554HB, E705, E805, E905, UN551S, UN551VS, X551UHD, X651UHD, X841UHD, X981UHD, MD551C8) allows an attacker execute remote code by sending unintended parameters
VS, X551UHD, X651UHD, X841UHD, X981UHD, MD551C8) allows an attacker execute remote code by sending unintended parameters in http request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sharp-nec-displays.com/global/support/info/A4_vulnerability.html
CVE ID: CVE-2023-7078 State: PUBLISHED Published: 2023-12-29T11:53:06.669Z Last Updated: 2024-08-26T20:31:04.794Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: Cloudflare Products: miniflare Problem Types: CWE-918 Description: Sending specially crafted HTTP requests to Miniflare's server could result in arbitrary HTTP and WebSocket requests being sent from the server. If Miniflare was configured to listen on external network interfaces (as was the default in wrangler until 3.19.0), an attacker on the local network could access other local servers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/clo
ervers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-fwvg-2739-22v7 - https://github.com/cloudflare/workers-sdk/pull/4532
CVE ID: CVE-2023-7079 State: PUBLISHED Published: 2023-12-29T11:54:08.925Z Last Updated: 2024-08-02T08:50:07.936Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N) Vendors: Cloudflare Products: wrangler Problem Types: CWE-287 Description: Sending specially crafted HTTP requests and inspector messages to Wrangler's dev server could result in any file on the user's computer being accessible over the local network. An attacker that could trick any user on the local network into opening a malicious website could also read any file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-cfph-4qqh-w
s: - CVE Program Container: References: - https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-cfph-4qqh-w828 - https://github.com/cloudflare/workers-sdk/pull/4532 - https://github.com/cloudflare/workers-sdk/pull/4535
CVE ID: CVE-2023-7080 State: PUBLISHED Published: 2023-12-29T11:58:36.214Z Last Updated: 2024-08-02T08:50:07.794Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: Cloudflare Products: wrangler Problem Types: CWE-269 Description: The V8 inspector intentionally allows arbitrary code execution within the Workers sandbox for debugging. wrangler dev would previously start an inspector server listening on all network interfaces. This would allow an attacker on the local network to connect to the inspector and run arbitrary code. Additionally, the inspector server did not validate Origin/Host headers, granting an attacker that can trick any user on the local network i
spector server did not validate Origin/Host headers, granting an attacker that can trick any user on the local network into opening a malicious website the ability to run code. If wrangler dev --remote was being used, an attacker could access production resources if they were bound to the worker. This issue was fixed in wrangler@3.19.0 and wrangler@2.20.2. Whilst wrangler dev's inspector server listens on local interfaces by default as of wrangler@3.16.0, an SSRF vulnerability in miniflare https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-fwvg-2739-22v7 (CVE-2023-7078) allowed access from the local network until wrangler@3.18.0. wrangler@3.19.0 and wrangler@2.20.2 introduced
E-2023-7078) allowed access from the local network until wrangler@3.18.0. wrangler@3.19.0 and wrangler@2.20.2 introduced validation for the Origin/Host headers. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-f8mp-x433-5wpf - https://github.com/cloudflare/workers-sdk/issues/4430 - https://github.com/cloudflare/workers-sdk/pull/4437 - https://github.com/cloudflare/workers-sdk/pull/4535 - https://github.com/cloudflare/workers-sdk/pull/4550
CVE ID: CVE-2023-7081 State: PUBLISHED Published: 2024-02-15T15:31:57.211Z Last Updated: 2024-08-28T14:24:23.339Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: POSTAHSİL Products: Online Payment System Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in POSTAHSİL Online Payment System allows SQL Injection.This issue affects Online Payment System: before 14.02.2024. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-0103
CVE ID: CVE-2023-7082 State: PUBLISHED Published: 2024-01-22T19:14:29.189Z Last Updated: 2025-06-20T18:38:15.695Z Vendors: Unknown Products: Import any XML or CSV File to WordPress Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The Import any XML or CSV File to WordPress plugin before 3.7.3 accepts all zip files and automatically extracts the zip file into a publicly accessible directory without sufficiently validating the extracted file type. This may allows high privilege users such as administrator to upload an executable file type leading to remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
ading to remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7f947305-7a72-4c59-9ae8-193f437fd04e/
CVE ID: CVE-2023-7083 State: PUBLISHED Published: 2024-01-16T15:57:04.021Z Last Updated: 2025-06-02T15:09:24.504Z Vendors: Unknown Products: Voting Record Problem Types: CWE-352 Cross-Site Request Forgery (CSRF), CWE-79 Cross-Site Scripting (XSS) Description: The Voting Record WordPress plugin through 2.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ba77704a-32a1-494b-b2c0-e1c2a3f98adc/ - https://magos-securitas.com/txt/CVE-2023-7083.
https://wpscan.com/vulnerability/ba77704a-32a1-494b-b2c0-e1c2a3f98adc/ - https://magos-securitas.com/txt/CVE-2023-7083.txt
CVE ID: CVE-2023-7084 State: PUBLISHED Published: 2024-01-16T15:57:03.277Z Last Updated: 2025-06-20T17:23:27.788Z Vendors: Unknown Products: Voting Record Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Voting Record WordPress plugin through 2.0 is missing sanitisation as well as escaping, which could allow any authenticated users, such as subscriber to perform Stored XSS attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5e51e239-919b-4e74-a7ee-195f3817f907/ - https://magos-securitas.com/txt/CVE-2023-7084.txt
CVE ID: CVE-2023-7085 State: PUBLISHED Published: 2024-03-18T19:05:50.838Z Last Updated: 2024-08-28T15:36:59.154Z Vendors: Unknown Products: Scalable Vector Graphics (SVG) Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Scalable Vector Graphics (SVG) WordPress plugin through 3.4 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a2ec1308-75a0-49d0-9288-33c6d9ee4328/
CVE ID: CVE-2023-7086 State: PUBLISHED Published: 2025-05-15T20:09:21.852Z Last Updated: 2025-05-17T02:49:29.724Z Vendors: Unknown Products: SVG Uploads Support Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The SVG Uploads Support WordPress plugin through 2.1.1 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/94954e1a-dc09-4811-b57d-b12bf69a767d/
CVE ID: CVE-2023-7088 State: PUBLISHED Published: 2025-05-15T20:09:22.054Z Last Updated: 2025-05-17T02:46:32.359Z Vendors: Unknown Products: Add SVG Support for Media Uploader | inventivo Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Add SVG Support for Media Uploader | inventivo WordPress plugin through 1.0.5 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8f515e36-9072-4fc4-9d2f-d50f1adde626/
CVE ID: CVE-2023-7089 State: PUBLISHED Published: 2024-01-29T14:44:24.539Z Last Updated: 2025-06-20T19:44:48.459Z Vendors: Unknown Products: Easy SVG Allow Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Easy SVG Allow WordPress plugin through 1.0 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/3b8ba734-7764-4ab6-a7e2-8de55bd46bed/
CVE ID: CVE-2023-7090 State: PUBLISHED Published: 2023-12-23T22:33:13.530Z Last Updated: 2024-08-02T08:50:07.937Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L) Vendors: n/a, Red Hat, Fedora Products: sudo, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Fedora Problem Types: CWE-269 Description: A flaw was found in sudo in the handling of ipa_hostname, where ipa_hostname from /etc/sssd/sssd.conf was not propagated in sudo. Therefore, it leads to privilege mismanagement vulnerability in applications, where client hosts retain privileges even after retracting them. Additional Analyst Notes: - CVE Program
n applications, where client hosts retain privileges even after retracting them. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2023-7090 - https://bugzilla.redhat.com/show_bug.cgi?id=2255723 - https://lists.debian.org/debian-lts-announce/2024/02/msg00002.html - https://security.netapp.com/advisory/ntap-20240208-0001/ - https://www.sudo.ws/releases/legacy/#1.8.28
CVE ID: CVE-2023-7091 State: PUBLISHED Published: 2023-12-24T21:00:05.391Z Last Updated: 2024-08-02T08:50:07.846Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Dreamer Products: CMS Problem Types: CWE-434 Description: A vulnerability was found in Dreamer CMS 4.1.3. It has been declared as problematic. This vulnerability affects unknown code of the file /upload/uploadFile. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-248938 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in
tifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.248938 - https://vuldb.com/?ctiid.248938 - https://github.com/sweatxi/BugHub/blob/main/Dreamer-CMS.pdf
CVE ID: CVE-2023-7092 State: PUBLISHED Published: 2023-12-24T23:00:05.416Z Last Updated: 2024-08-02T08:50:07.955Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: Uniway Products: UW-302VP Problem Types: CWE-352 Description: A vulnerability was found in Uniway UW-302VP 2.0. It has been rated as problematic. This issue affects some unknown processing of the file /boaform/wlan_basic_set.cgi of the component Admin Web Interface. The manipulation of the argument wlanssid/password leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248939. NOTE: The
s been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248939. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.248939 - https://vuldb.com/?ctiid.248939 - https://drive.google.com/file/d/15Wr3EL4cpAS_H_Vp7TuIftssxAuzb4SL/view
CVE ID: CVE-2023-7093 State: PUBLISHED Published: 2023-12-24T23:31:04.019Z Last Updated: 2024-08-28T14:21:49.923Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: KylinSoft Products: kylin-system-updater Problem Types: CWE-78 Description: A vulnerability classified as critical has been found in KylinSoft kylin-system-updater up to 2.0.5.16-0k2.33. Affected is an unknown function of the file /usr/share/kylin-system-updater/SystemUpdater/UpgradeStrategiesDbus.py of the component com.kylin.systemupgrade Service. The manipulation of the argument SetDownloadspeedMax leads to os command injection. The attack needs to be approached locally. The exploit has been disc
SetDownloadspeedMax leads to os command injection. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248940. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.248940 - https://vuldb.com/?ctiid.248940 - https://note.zhaoj.in/share/L1hGe9BDlbnt
CVE ID: CVE-2023-7094 State: PUBLISHED Published: 2023-12-25T00:00:06.687Z Last Updated: 2025-04-23T16:09:43.761Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Netentsec Products: NS-ASG Application Security Gateway Problem Types: CWE-200 Description: A vulnerability classified as problematic was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected by this vulnerability is an unknown functionality of the file /protocol/nsasg6.0.tgz. The manipulation leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248941 was assigned to this vulnerability.
exploit has been disclosed to the public and may be used. The identifier VDB-248941 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.248941 - https://vuldb.com/?ctiid.248941 - https://www.yuque.com/wangjie-0l1rh/prbq8b/iyxa0t8rntyve4s0?singleDoc#%20%E3%80%8AThe%20information%20disclosure%20vulnerability%20in%20the%20Netentsec%20NS-ASG%20Application%20Security%20Gateway%E3%80%8B
CVE ID: CVE-2023-7095 State: PUBLISHED Published: 2023-12-25T00:31:04.022Z Last Updated: 2024-08-02T08:50:07.933Z Severity: N/A (CVSS 10 AV:N/AC:L/Au:N/C:C/I:C/A:C) Vendors: Totolink Products: A7100RU Problem Types: CWE-120 Description: A vulnerability, which was classified as critical, has been found in Totolink A7100RU 7.4cu.2313_B20191024. Affected by this issue is the function main of the file /cgi-bin/cstecgi.cgi?action=login of the component HTTP POST Request Handler. The manipulation of the argument flag leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-248942 is the identifier assigned to this vulnerabilit
The exploit has been disclosed to the public and may be used. VDB-248942 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.248942 - https://vuldb.com/?ctiid.248942 - https://github.com/unpWn4bL3/iot-security/blob/main/2.md
CVE ID: CVE-2023-7096 State: PUBLISHED Published: 2023-12-25T01:00:06.137Z Last Updated: 2024-08-02T08:50:07.911Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: code-projects Products: Faculty Management System Problem Types: CWE-89 Description: A vulnerability was found in code-projects Faculty Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/php/crud.php. The manipulation of the argument fieldname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248948. Additional Analyst Notes: - CVE
losed to the public and may be used. The identifier of this vulnerability is VDB-248948. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.248948 - https://vuldb.com/?ctiid.248948 - https://github.com/Glunko/vulnerability/blob/main/Faculty-Management-System_sql.md
CVE ID: CVE-2023-7097 State: PUBLISHED Published: 2023-12-25T01:31:03.664Z Last Updated: 2024-09-09T19:52:50.593Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Water Billing System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in code-projects Water Billing System 1.0. This affects an unknown part of the file /addbill.php. The manipulation of the argument owners_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248949 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - C
ed. The identifier VDB-248949 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.248949 - https://vuldb.com/?ctiid.248949 - https://github.com/Glunko/vulnerability/blob/main/Water-Billing-System_sql.md
CVE ID: CVE-2023-7098 State: PUBLISHED Published: 2023-12-25T02:00:05.851Z Last Updated: 2024-08-26T20:31:43.900Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: icret Products: EasyImages Problem Types: CWE-24 Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic was found in icret EasyImages 2.8.3. This vulnerability affects unknown code of the file app/hide.php. The manipulation of the argument key leads to path traversal: '../filedir'. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-24
her high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-248950 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.248950 - https://vuldb.com/?ctiid.248950 - https://note.zhaoj.in/share/MHnV2WLY9rxU
CVE ID: CVE-2023-7099 State: PUBLISHED Published: 2023-12-25T02:31:04.313Z Last Updated: 2024-08-02T08:50:08.289Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: PHPGurukul Products: Nipah Virus Testing Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in PHPGurukul Nipah Virus Testing Management System 1.0. This issue affects some unknown processing of the file bwdates-report-result.php. The manipulation of the argument fromdate leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-24895