Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-37568 State: PUBLISHED Published: 2023-07-13T01:48:09.334Z Last Updated: 2024-11-05T15:24:15.634Z Vendors: ELECOM CO.,LTD. Products: WRC-1167GHBK-S, WRC-1167GEBK-S Problem Types: Arbitrary command execution Description: ELECOM wireless LAN routers WRC-1167GHBK-S v1.03 and earlier, and WRC-1167GEBK-S v1.03 and earlier allow a network-adjacent authenticated attacker to execute an arbitrary command by sending a specially crafted request to the web management page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.elecom.co.jp/news/security/20230711-01/ - https://jvn.jp/en/vu/JVNVU91850798/
CVE ID: CVE-2023-37569 State: PUBLISHED Published: 2023-08-08T08:04:22.979Z Last Updated: 2025-02-13T17:01:29.769Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ESDS Products: Emagic Data Center Management Suite Problem Types: CWE-78 Description: This vulnerability exists in ESDS Emagic Data Center Management Suit due to lack of input sanitization in its Ping component. A remote authenticated attacker could exploit this by injecting OS commands on the targeted system. Successful exploitation of this vulnerability could allow the attacker to execute arbitrary code on targeted system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
execute arbitrary code on targeted system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0226 - http://packetstormsecurity.com/files/174084/Emagic-Data-Center-Management-Suite-6.0-Remote-Command-Execution.html
CVE ID: CVE-2023-37570 State: PUBLISHED Published: 2023-08-08T08:11:08.948Z Last Updated: 2024-10-10T17:58:16.654Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: ESDS Products: Emagic Data Center Management Suite Problem Types: CWE-613 Description: This vulnerability exists in ESDS Emagic Data Center Management Suit due to non-expiry of session cookie. By reusing the stolen cookie, a remote attacker could gain unauthorized access to the targeted system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0226
CVE ID: CVE-2023-37571 State: PUBLISHED Published: 2024-01-30T00:00:00.000Z Last Updated: 2025-06-20T19:49:31.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: Softing TH SCOPE through 3.70 allows XSS. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://industrial.softing.com - https://industrial.softing.com/fileadmin/psirt/downloads/2024/syt-2024-1.html
CVE ID: CVE-2023-37572 State: PUBLISHED Published: 2023-12-05T00:00:00 Last Updated: 2024-10-11T18:05:27.694Z Vendors: n/a Products: n/a Problem Types: n/a Description: Softing OPC Suite version 5.25 and before has Incorrect Access Control, allows attackers to obtain sensitive information via weak permissions in OSF_discovery service. The service executable could be changed or the service could be deleted. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://industrial.softing.com/fileadmin/psirt/downloads/2023/syt-2023-5.html
CVE ID: CVE-2023-37573 State: PUBLISHED Published: 2024-01-08T14:47:51.260Z Last Updated: 2025-11-04T18:15:40.885Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GTKWave Products: GTKWave Problem Types: CWE-416 Description: Multiple use-after-free vulnerabilities exist in the VCD get_vartoken realloc functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the use-after-free when triggered via the GUI's recoder (default) VCD parsing code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichmen
the GUI's recoder (default) VCD parsing code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1806 - https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE ID: CVE-2023-37574 State: PUBLISHED Published: 2024-01-08T14:47:51.369Z Last Updated: 2025-11-04T18:15:42.099Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GTKWave Products: GTKWave Problem Types: CWE-416 Description: Multiple use-after-free vulnerabilities exist in the VCD get_vartoken realloc functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the use-after-free when triggered via the GUI's legacy VCD parsing code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Referenc
the GUI's legacy VCD parsing code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1806 - https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE ID: CVE-2023-37575 State: PUBLISHED Published: 2024-01-08T14:47:51.477Z Last Updated: 2025-11-04T18:15:43.372Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GTKWave Products: GTKWave Problem Types: CWE-416 Description: Multiple use-after-free vulnerabilities exist in the VCD get_vartoken realloc functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the use-after-free when triggered via the GUI's interactive VCD parsing code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Ref
the GUI's interactive VCD parsing code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1806 - https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE ID: CVE-2023-37576 State: PUBLISHED Published: 2024-01-08T14:47:51.560Z Last Updated: 2025-11-04T18:15:44.600Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GTKWave Products: GTKWave Problem Types: CWE-416 Description: Multiple use-after-free vulnerabilities exist in the VCD get_vartoken realloc functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the use-after-free when triggered via the vcd2vzt conversion utility. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
the vcd2vzt conversion utility. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1806 - https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE ID: CVE-2023-37577 State: PUBLISHED Published: 2024-01-08T14:47:51.642Z Last Updated: 2025-11-04T18:15:45.775Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GTKWave Products: GTKWave Problem Types: CWE-416 Description: Multiple use-after-free vulnerabilities exist in the VCD get_vartoken realloc functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the use-after-free when triggered via the vcd2lxt2 conversion utility. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References
the vcd2lxt2 conversion utility. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1806 - https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE ID: CVE-2023-37578 State: PUBLISHED Published: 2024-01-08T14:47:51.743Z Last Updated: 2025-11-04T18:15:47.034Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GTKWave Products: GTKWave Problem Types: CWE-416 Description: Multiple use-after-free vulnerabilities exist in the VCD get_vartoken realloc functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the use-after-free when triggered via the vcd2lxt conversion utility. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
the vcd2lxt conversion utility. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1806 - https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE ID: CVE-2023-37579 State: PUBLISHED Published: 2023-07-12T09:05:24.408Z Last Updated: 2024-10-08T13:35:12.605Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: Apache Software Foundation Products: Apache Pulsar Function Worker Problem Types: CWE-863 Description: Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar Function Worker. This issue affects Apache Pulsar: before 2.10.4, and 2.11.0. Any authenticated user can retrieve a source's configuration or a sink's configuration without authorization. Many sources and sinks contain credentials in the configuration, which could lead to leaked credentials. This vulnerability is mitig
and sinks contain credentials in the configuration, which could lead to leaked credentials. This vulnerability is mitigated by the fact that there is not a known way for an authenticated user to enumerate another tenant's sources or sinks, meaning the source or sink name would need to be guessed in order to exploit this vulnerability. The recommended mitigation for impacted users is to upgrade the Pulsar Function Worker to a patched version. 2.10 Pulsar Function Worker users should upgrade to at least 2.10.4. 2.11 Pulsar Function Worker users should upgrade to at least 2.11.1. 3.0 Pulsar Function Worker users are unaffected. Any users running the Pulsar Function Worker for 2.9.* and earlier
1.1. 3.0 Pulsar Function Worker users are unaffected. Any users running the Pulsar Function Worker for 2.9.* and earlier should upgrade to one of the above patched versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/0dmn3cb5n2p08o3cpj3ycfhzfqs2ppwz
CVE ID: CVE-2023-37580 State: PUBLISHED Published: 2023-07-31T00:00:00.000Z Last Updated: 2025-10-30T18:26:19.400Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wiki.zimbra.com/wiki/Security_Center - https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy - http://www.openwall.com/lists/oss-security/2023/11/17/2
CVE ID: CVE-2023-37581 State: PUBLISHED Published: 2023-08-06T07:21:04.307Z Last Updated: 2024-10-01T18:19:40.307Z Vendors: Apache Software Foundation Products: Apache Roller Problem Types: CWE-79 Description: Insufficient input validation and sanitation in Weblog Category name, Website About and File Upload features in all versions of Apache Roller on all platforms allows an authenticated user to perform an XSS attack. Mitigation: if you do not have Roller configured for untrusted users, then you need to do nothing because you trust your users to author raw HTML and other web content. If you are running with untrusted users then you should upgrade to Roller 6.1.2 and you should disable Roll
web content. If you are running with untrusted users then you should upgrade to Roller 6.1.2 and you should disable Roller's File Upload feature. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/n9mjhhlm7z7b7to646tkvf3otkf21flp - https://www.openwall.com/lists/oss-security/2023/08/16/1
CVE ID: CVE-2023-37582 State: PUBLISHED Published: 2023-07-12T09:26:18.652Z Last Updated: 2025-04-23T16:20:32.805Z Vendors: Apache Software Foundation Products: Apache RocketMQ Problem Types: CWE-94 Description: The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1. When NameServer address are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function on the NameServer component to execute commands as the system users that RocketMQ is running as. It is recommended for users to upgrade their NameServer version
mmands as the system users that RocketMQ is running as. It is recommended for users to upgrade their NameServer version to 5.1.2 or above for RocketMQ 5.x or 4.9.7 or above for RocketMQ 4.x to prevent these attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/m614czxtpvlztd7mfgcs2xcsg36rdbnc - http://www.openwall.com/lists/oss-security/2023/07/12/1
CVE ID: CVE-2023-37596 State: PUBLISHED Published: 2023-07-11T00:00:00 Last Updated: 2024-11-13T21:37:34.916Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to cause a denial of service via a crafted script to the deleteuser function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://reference1.example.com/index.php?menu=userlist - https://github.com/sahiloj/CVE-2023-37596/blob/main/README.md
CVE ID: CVE-2023-37597 State: PUBLISHED Published: 2023-07-11T00:00:00 Last Updated: 2024-11-13T20:53:27.378Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to cause a denial of service via the delete user grouplist function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://reference2.example.com/index.php?menu=grouplist - https://github.com/sahiloj/CVE-2023-37597/blob/main/README.md
CVE ID: CVE-2023-37598 State: PUBLISHED Published: 2023-07-13T00:00:00 Last Updated: 2024-11-05T20:27:44.694Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to cause a denial of service via the delete new virtual fax function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sahiloj/CVE-2023-37598
CVE ID: CVE-2023-37599 State: PUBLISHED Published: 2023-07-13T00:00:00 Last Updated: 2024-11-05T16:45:56.318Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in issabel-pbx v.4.0.0-6 allows a remote attacker to obtain sensitive information via the modules directory Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sahiloj/CVE-2023-37599
CVE ID: CVE-2023-37600 State: PUBLISHED Published: 2023-07-20T00:00:00 Last Updated: 2024-10-24T16:47:58.290Z Vendors: n/a Products: n/a Problem Types: n/a Description: Office Suite Premium Version v10.9.1.42602 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the id parameter at /api?path=profile. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://packetstormsecurity.com/files/173143/Office-Suite-Premium-10.9.1.42602-Cross-Site-Scripting.html
CVE ID: CVE-2023-37601 State: PUBLISHED Published: 2023-07-20T00:00:00 Last Updated: 2024-10-24T16:47:15.577Z Vendors: n/a Products: n/a Problem Types: n/a Description: Office Suite Premium v10.9.1.42602 was discovered to contain a local file inclusion (LFI) vulnerability via the component /etc/hosts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://packetstormsecurity.com/files/173146/Office-Suite-Premium-10.9.1.42602-Local-File-Inclusion.html
CVE ID: CVE-2023-37602 State: PUBLISHED Published: 2023-07-20T00:00:00 Last Updated: 2024-10-24T19:47:29.504Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the component /workplace#!explorer of Alkacon OpenCMS v15.0 allows attackers to execute arbitrary code via uploading a crafted PNG file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/51564
CVE ID: CVE-2023-37605 State: PUBLISHED Published: 2023-10-02T00:00:00 Last Updated: 2024-09-23T16:29:00.173Z Vendors: n/a Products: n/a Problem Types: n/a Description: Weak Exception Handling vulnerability in baramundi software GmbH EMM Agent 23.1.50 and before allows an attacker to cause a denial of service via a crafted request to the password parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://medium.com/%40david_42/complex-password-vs-buffer-overflow-and-the-winner-is-decbc56db5e3
CVE ID: CVE-2023-37607 State: PUBLISHED Published: 2024-01-03T00:00:00.000Z Last Updated: 2025-06-03T14:44:44.640Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal in Automatic Systems SOC FL9600 FirstLane V06 lego_T04E00 allows a remote attacker to obtain sensitive information via csvServer.php?file= with a .. in the dir parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/CQURE/CVEs/blob/main/CVE-2023-37607/README.md - https://www.automatic-systems.com/range/
CVE ID: CVE-2023-37608 State: PUBLISHED Published: 2024-01-03T00:00:00.000Z Last Updated: 2025-06-03T14:44:49.494Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Automatic Systems SOC FL9600 FirstLane V06 lego_T04E00 allows a remote attacker to obtain sensitive information because there is an automaticsystems super admin account with astech as its hardcoded password. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/CQURE/CVEs/tree/main/CVE-2023-37608 - https://www.automatic-systems.com/range/
CVE ID: CVE-2023-37611 State: PUBLISHED Published: 2023-09-18T00:00:00 Last Updated: 2024-08-02T17:16:30.857Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in Neos CMS 8.3.3 allows a remote authenticated attacker to execute arbitrary code via a crafted SVG file to the neos/management/media component. Additional Analyst Notes: - CVE Program Container: References: - https://rodelllemit.medium.com/stored-xss-in-neo-cms-8-3-3-9bd1cb973c5b - https://github.com/neos/neos-development-collection/pull/4812
CVE ID: CVE-2023-37613 State: PUBLISHED Published: 2023-07-24T00:00:00 Last Updated: 2024-10-30T14:45:26.982Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in Assembly Software Trialworks v11.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the asset src parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/HeidiSecurities/CVEs/blob/main/Trialworks.md - https://github.com/HeidiSecurities/CVEs/blob/main/CVE-2023-37613/Trialworks.md
CVE ID: CVE-2023-37621 State: REJECTED Published: N/A Last Updated: 2024-04-16T14:57:48.206212 Description: No description available.
CVE ID: CVE-2023-37623 State: PUBLISHED Published: 2023-07-26T00:00:00 Last Updated: 2024-10-23T15:44:55.218Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netdisco before v2.063000 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /Web/TypeAhead.pm. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/benjaminpsinclair/Netdisco-CVE - https://github.com/netdisco/netdisco/commit/9f4401f2fb00c84210cd551b97c8ad60e78c71e0 - https://github.com/netdisco/netdisco/commit/39562e0633a2472d50f7f33e69c36da4ad1fbfa3 - https://github.com/benjaminpsinclair/Netdisco-2023-Advisory
CVE ID: CVE-2023-37624 State: PUBLISHED Published: 2023-07-26T00:00:00 Last Updated: 2024-10-23T15:44:19.651Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netdisco before v2.063000 was discovered to contain an open redirect vulnerability. An attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/benjaminpsinclair/Netdisco-CVE - https://github.com/netdisco/netdisco/commit/a2da6a7a046c1c0fd41072dd6991eec7614293f8 - https://github.com/benjaminpsinclair/Netdisco-2023-Advisory
CVE ID: CVE-2023-37625 State: PUBLISHED Published: 2023-08-10T00:00:00 Last Updated: 2024-08-02T17:16:30.972Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in Netbox v3.4.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Link templates. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/benjaminpsinclair/Netbox-CVE - https://github.com/netbox-community/netbox/issues/12205 - https://github.com/benjaminpsinclair/Netbox-CVE-2023-37625
CVE ID: CVE-2023-37627 State: PUBLISHED Published: 2023-07-12T00:00:00 Last Updated: 2024-11-07T19:19:50.297Z Vendors: n/a Products: n/a Problem Types: n/a Description: Code-projects Online Restaurant Management System 1.0 is vulnerable to SQL Injection. Through SQL injection, an attacker can bypass the admin panel and view order records, add items, delete items etc. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://code-projects.org/online-restaurant-management-system-in-php-with-source-code/ - https://gist.github.com/1337kid/d3e7702bd19cc9355a6b3f153eb2fe8e
CVE ID: CVE-2023-37628 State: PUBLISHED Published: 2023-07-12T00:00:00 Last Updated: 2024-11-07T19:18:48.738Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Piggery Management System 1.0 is vulnerable to SQL Injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php/11814/online-pig-management-system-basic-free-version.html - https://github.com/1337kid/Piggery_CMS_multiple_vulns_PoC/tree/main/CVE-2023-37628
CVE ID: CVE-2023-37629 State: PUBLISHED Published: 2023-07-12T00:00:00 Last Updated: 2024-11-07T19:17:46.213Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Piggery Management System 1.0 is vulnerable to File Upload. An unauthenticated user can upload a php file by sending a POST request to "add-pig.php." Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php/11814/online-pig-management-system-basic-free-version.html - https://github.com/1337kid/Piggery_CMS_multiple_vulns_PoC/tree/main/CVE-2023-37629 - http://packetstormsecurity.com/files/173656/Online-Piggery-Management-System-1.0-Shell-Upload.html
CVE ID: CVE-2023-37630 State: PUBLISHED Published: 2023-07-12T00:00:00 Last Updated: 2024-11-07T18:24:04.152Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Piggery Management System 1.0 is vulnerable to Cross Site Scripting (XSS). An unauthenticated user can POST JavaScript code to "manage-breed.php" resulting in Persistent XSS. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php/11814/online-pig-management-system-basic-free-version.html - https://github.com/1337kid/Piggery_CMS_multiple_vulns_PoC/tree/main/CVE-2023-37630