Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-12769 State: PUBLISHED Published: 2025-03-25T06:00:12.005Z Last Updated: 2025-03-25T13:51:56.806Z Vendors: Unknown Products: Simple Banner Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Simple Banner WordPress plugin before 3.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/02b5c1a8-cf2a-4378-bfda-84d841d88a18/
CVE ID: CVE-2024-12770 State: PUBLISHED Published: 2025-05-15T20:06:56.733Z Last Updated: 2025-05-20T19:30:22.660Z Vendors: Unknown Products: WP ULike Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP ULike WordPress plugin before 4.7.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e21f6a4e-f385-411b-8d91-0f38f9e6cdd3/
CVE ID: CVE-2024-12771 State: PUBLISHED Published: 2024-12-21T07:02:59.391Z Last Updated: 2024-12-28T00:50:54.754Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: implecode Products: eCommerce Product Catalog Plugin for WordPress Problem Types: CWE-352 Description: The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.43. This is due to missing or incorrect nonce validation on the 'customer_panel_password_reset' function. This makes it possible for unauthenticated attackers to reset the password of any administrator or customer account via a forged request g
ible for unauthenticated attackers to reset the password of any administrator or customer account via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3513ec24-0b1b-4528-9f89-eee5654e4e98?source=cve - https://plugins.trac.wordpress.org/browser/ecommerce-product-catalog/trunk/modules/cart/includes/customers/includes/transactions/customer-panel.php#L44 - https://plugins.trac.wordpress.org/browser/ecommerce-product-catalog/trunk/modules/cart/includes/customers/includes/transactions/customer-panel.php#L108 - h
rowser/ecommerce-product-catalog/trunk/modules/cart/includes/customers/includes/transactions/customer-panel.php#L108 - https://plugins.trac.wordpress.org/changeset/3210939/
CVE ID: CVE-2024-12772 State: PUBLISHED Published: 2025-01-31T06:00:05.538Z Last Updated: 2025-03-20T14:22:24.654Z Vendors: Unknown Products: Ninja Tables Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Ninja Tables WordPress plugin before 5.0.17 does not sanitize and escape a parameter before outputting it back in the page when importing a CSV, leading to a Cross Site Scripting vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7b6d0f95-6632-4079-8c1b-517a8d02c330/
CVE ID: CVE-2024-12773 State: PUBLISHED Published: 2025-01-27T06:00:06.982Z Last Updated: 2025-01-27T16:50:54.725Z Vendors: Unknown Products: Altra Side Menu Problem Types: CWE-89 SQL Injection Description: The Altra Side Menu WordPress plugin through 2.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/fab64105-599f-49a4-b01d-c873ff34b590/
CVE ID: CVE-2024-12774 State: PUBLISHED Published: 2025-01-27T06:00:09.084Z Last Updated: 2025-01-27T14:34:00.429Z Vendors: Unknown Products: Altra Side Menu Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Altra Side Menu WordPress plugin through 2.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete arbitrary menu via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8decbef5-f106-488b-925c-42b3b280460a/
CVE ID: CVE-2024-12775 State: PUBLISHED Published: 2025-03-20T10:09:23.407Z Last Updated: 2025-03-20T18:55:41.104Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: langgenius Products: langgenius/dify Problem Types: CWE-918 Description: langgenius/dify version 0.10.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the test functionality for the Create Custom Tool option via the REST API `POST /console/api/workspaces/current/tool-provider/api/test/pre`. Attackers can set the `url` in the `servers` dictionary in OpenAI's schema with arbitrary URL targets, allowing them to abuse the victim server's credentials to access unauthorized web resources.
with arbitrary URL targets, allowing them to abuse the victim server's credentials to access unauthorized web resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/e90e929a-9bc9-46ad-a5e5-1f6f124d0f12
CVE ID: CVE-2024-12776 State: PUBLISHED Published: 2025-03-20T10:10:42.717Z Last Updated: 2025-03-20T18:18:01.777Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: langgenius Products: langgenius/dify Problem Types: CWE-305 Description: In langgenius/dify v0.10.1, the `/forgot-password/resets` endpoint does not verify the password reset code, allowing an attacker to reset the password of any user, including administrators. This vulnerability can lead to a complete compromise of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/00a8b403-7da5-431e-afa3-40339cf734bf
CVE ID: CVE-2024-12777 State: PUBLISHED Published: 2025-03-20T10:11:15.212Z Last Updated: 2025-03-20T13:30:19.041Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: aimhubio Products: aimhubio/aim Problem Types: CWE-1088 Description: A vulnerability in aimhubio/aim version 3.25.0 allows for a denial of service through the misuse of the sshfs-client. The tracking server, which is single-threaded, can be made unresponsive by requesting it to connect to an unresponsive socket via sshfs. The lack of an additional timeout setting in the sshfs-client causes the server to hang for a significant amount of time, preventing it from responding to other requests. Addition
nt causes the server to hang for a significant amount of time, preventing it from responding to other requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/cdf8db79-c290-4fe5-9383-4c518bfba4a8
CVE ID: CVE-2024-12778 State: PUBLISHED Published: 2025-03-20T10:10:10.394Z Last Updated: 2025-10-15T12:49:31.683Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: aimhubio Products: aimhubio/aim Problem Types: CWE-770 Description: A vulnerability in aimhubio/aim version 3.25.0 allows for a denial of service (DoS) attack. The issue arises when a large number of tracked metrics are retrieved simultaneously from the Aim web API, causing the web server to become unresponsive. The root cause is the lack of a limit on the number of metrics that can be requested per call, combined with the server's single-threaded nature, leading to excessive resource consumption and
be requested per call, combined with the server's single-threaded nature, leading to excessive resource consumption and blocking of the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/892a9eee-0251-4e57-94a4-dad2e7f32715
CVE ID: CVE-2024-12779 State: PUBLISHED Published: 2025-03-20T10:11:28.705Z Last Updated: 2025-03-20T13:03:06.470Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: infiniflow Products: infiniflow/ragflow Problem Types: CWE-918 Description: A Server-Side Request Forgery (SSRF) vulnerability exists in infiniflow/ragflow version 0.12.0. The vulnerability is present in the `POST /v1/llm/add_llm` and `POST /v1/conversation/tts` endpoints. Attackers can specify an arbitrary URL as the `api_base` when adding an `OPENAITTS` model, and subsequently access the `tts` REST API endpoint to read contents from the specified URL. This can lead to unauthorized access to inter
ccess the `tts` REST API endpoint to read contents from the specified URL. This can lead to unauthorized access to internal web resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/3cc748ba-2afb-4bfe-8553-10eb6d6dd4f0
CVE ID: CVE-2024-12781 State: PUBLISHED Published: 2025-01-07T06:40:59.272Z Last Updated: 2025-01-07T16:11:45.728Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Laborator Products: Aurum - WordPress & WooCommerce Shopping Theme Problem Types: CWE-862 Description: The Aurum - WordPress & WooCommerce Shopping Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'lab_1cl_demo_install_package_content' function in all versions up to, and including, 4.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite content with imported demo content. Add
or authenticated attackers, with Subscriber-level access and above, to overwrite content with imported demo content. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cd132aa5-d30a-41de-aa8d-aefae6c95c47?source=cve - https://documentation.laborator.co/kb/aurum/aurum-release-notes/
CVE ID: CVE-2024-12782 State: PUBLISHED Published: 2024-12-19T12:31:07.155Z Last Updated: 2025-02-28T06:36:15.948Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Fujifilm Business Innovation Products: Apeos C3070, Apeos C5570, Apeos C6580 Problem Types: CWE-285, CWE-266 Description: A vulnerability has been found in Fujifilm Business Innovation Apeos C3070, Apeos C5570 and Apeos C6580 up to 24.8.28 and classified as critical. This vulnerability affects unknown code of the file /home/index.html#hashHome of the component Web Interface. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be us
improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor explains that "during technical verification it is not possible to reproduce any active actions like reboots which were mentioned in the original researcher disclosure." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.288958 - https://vuldb.com/?ctiid.288958 - https://vuldb.com/?submit.458897 - https://www.fujifilm.com/fbglobal/eng/company/news/notice/2024/1226_announce.html
CVE ID: CVE-2024-12783 State: PUBLISHED Published: 2024-12-19T12:31:09.545Z Last Updated: 2024-12-20T22:01:48.194Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: itsourcecode Products: Vehicle Management System Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in itsourcecode Vehicle Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file /billaction.php. The manipulation of the argument extra-cost leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?
osed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.288959 - https://vuldb.com/?ctiid.288959 - https://vuldb.com/?submit.462628 - https://github.com/FinleyTang/Vehicle-Management-System/blob/main/Vehicle%20Management%20System%20billaction.php%20has%20Cross-site%20Scripting%20(XSS).pdf - https://itsourcecode.com/
CVE ID: CVE-2024-12784 State: PUBLISHED Published: 2024-12-19T14:00:16.507Z Last Updated: 2024-12-19T15:10:48.663Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: Vehicle Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in itsourcecode Vehicle Management System 1.0. It has been classified as critical. Affected is an unknown function of the file editbill.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.288960 - h
ublic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.288960 - https://vuldb.com/?ctiid.288960 - https://vuldb.com/?submit.462629 - https://github.com/FinleyTang/Vehicle-Management-System/blob/main/Vehicle%20Management%20System%20editbill.php%20has%20Sqlinjection.pdf - https://itsourcecode.com/
CVE ID: CVE-2024-12785 State: PUBLISHED Published: 2024-12-19T14:31:05.634Z Last Updated: 2024-12-19T14:50:31.958Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: Vehicle Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in itsourcecode Vehicle Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file sendmail.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.co
sclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.288961 - https://vuldb.com/?ctiid.288961 - https://vuldb.com/?submit.462631 - https://github.com/FinleyTang/Vehicle-Management-System/blob/main/Vehicle%20Management%20System%20sendmail.php%20has%20Sqlinjection.pdf - https://itsourcecode.com/
CVE ID: CVE-2024-12786 State: PUBLISHED Published: 2024-12-19T15:00:22.547Z Last Updated: 2024-12-20T20:18:23.612Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: X1a0He Products: Adobe Downloader Problem Types: CWE-269, CWE-266 Description: A vulnerability, which was classified as critical, was found in X1a0He Adobe Downloader up to 1.3.1 on macOS. Affected is the function shouldAcceptNewConnection of the file com.x1a0he.macOS.Adobe-Downloader.helper of the component XPC Service. The manipulation leads to improper privilege management. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. This product is not aff
tack has to be approached locally. The exploit has been disclosed to the public and may be used. This product is not affiliated with the company Adobe. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.288966 - https://vuldb.com/?ctiid.288966 - https://vuldb.com/?submit.464685 - https://winslow1984.com/books/cve-collection/page/adobe-downloader-131-local-privilege-escalation
CVE ID: CVE-2024-12787 State: PUBLISHED Published: 2024-12-19T15:31:04.873Z Last Updated: 2024-12-19T16:16:20.174Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: 1000 Projects Products: Attendance Tracking Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in 1000 Projects Attendance Tracking Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /student/check_student_login.php. The manipulation of the argument student_emailid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes
attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.288967 - https://vuldb.com/?ctiid.288967 - https://vuldb.com/?submit.465082 - https://github.com/AFK-cmd/CVE/issues/1 - https://1000projects.org/
CVE ID: CVE-2024-12788 State: PUBLISHED Published: 2024-12-19T16:31:04.825Z Last Updated: 2024-12-20T17:20:52.189Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Codezips Products: Technical Discussion Forum Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Codezips Technical Discussion Forum 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file signinpost.php. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.28896
the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.288968 - https://vuldb.com/?ctiid.288968 - https://vuldb.com/?submit.465094 - https://github.com/laowuzi/cve/tree/main/Technical_Discussion_Forum
CVE ID: CVE-2024-12789 State: PUBLISHED Published: 2024-12-19T16:31:06.205Z Last Updated: 2024-12-20T17:19:50.397Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: PbootCMS Problem Types: CWE-94, CWE-74 Description: A vulnerability was found in PbootCMS up to 3.2.3. It has been classified as critical. This affects an unknown part of the file apps/home/controller/IndexController.php. The manipulation of the argument tag leads to code injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.2.4 is able to address this issue. It is recommended to upgrade the affected component. Addit
ed. Upgrading to version 3.2.4 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.288969 - https://vuldb.com/?ctiid.288969 - https://vuldb.com/?submit.465122 - https://gist.github.com/J1rrY-learn/8e52bf055fd1806ada81ae1ff25dd817
CVE ID: CVE-2024-12790 State: PUBLISHED Published: 2024-12-19T17:00:14.821Z Last Updated: 2024-12-20T17:16:48.625Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: code-projects Products: Hostel Management Site Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in code-projects Hostel Management Site 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file room-details.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.288970 - https://vuldb.
be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.288970 - https://vuldb.com/?ctiid.288970 - https://vuldb.com/?submit.465224 - https://github.com/asd1238525/cve/blob/main/xss.md - https://code-projects.org/
CVE ID: CVE-2024-12791 State: PUBLISHED Published: 2024-12-19T17:31:09.646Z Last Updated: 2024-12-20T17:50:09.693Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Codezips Products: E-Commerce Site Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Codezips E-Commerce Site 1.0. It has been rated as critical. This issue affects some unknown processing of the file signin.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.288971 - https://vuldb.com/?ctiid.28897
onal Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.288971 - https://vuldb.com/?ctiid.288971 - https://vuldb.com/?submit.465711 - https://github.com/laowuzi/cve/blob/main/E-commerce/E-commerce-signin.md
CVE ID: CVE-2024-12792 State: PUBLISHED Published: 2024-12-19T17:31:11.530Z Last Updated: 2024-12-20T17:48:23.647Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Codezips Products: E-Commerce Site Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in Codezips E-Commerce Site 1.0. Affected by this vulnerability is an unknown functionality of the file newadmin.php. The manipulation of the argument email leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.288973 - https://vuldb.com/?ct
d. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.288973 - https://vuldb.com/?ctiid.288973 - https://vuldb.com/?submit.465715 - https://github.com/laowuzi/cve/blob/main/E-commerce/E-commerce-newadmin.md
CVE ID: CVE-2024-12793 State: PUBLISHED Published: 2024-12-19T18:00:17.798Z Last Updated: 2024-12-20T17:39:03.490Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: PbootCMS Problem Types: CWE-22 Description: A vulnerability, which was classified as problematic, has been found in PbootCMS up to 5.2.3. Affected by this issue is some unknown functionality of the file apps/home/controller/IndexController.php. The manipulation of the argument tag leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.2.4 is able to address this issue. It is recommended to upgr
losed to the public and may be used. Upgrading to version 5.2.4 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.288974 - https://vuldb.com/?ctiid.288974 - https://vuldb.com/?submit.465779 - https://gist.github.com/J1rrY-learn/b939899001b2c6b59632d82df11da001
CVE ID: CVE-2024-12794 State: PUBLISHED Published: 2024-12-19T18:00:19.939Z Last Updated: 2024-12-20T17:36:24.827Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Codezips Products: E-Commerce Site Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in Codezips E-Commerce Site 1.0. This affects an unknown part of the file /admin/editorder.php. The manipulation of the argument dstatus/quantity/ddate leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.288975 - htt
lic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.288975 - https://vuldb.com/?ctiid.288975 - https://vuldb.com/?submit.466241 - https://github.com/laowuzi/cve/blob/main/E-commerce/E-commerce_editorder.md
CVE ID: CVE-2024-12796 State: PUBLISHED Published: 2025-09-16T13:37:43.778Z Last Updated: 2025-09-17T12:38:49.238Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Holistic IT, Consultancy Coop. Products: Workcube ERP Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Holistic IT, Consultancy Coop. Workcube ERP allows Reflected XSS.This issue affects Workcube ERP: from V12 - V14 before Cognitive. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0256