Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-45965 State: PUBLISHED Published: 2024-10-02T00:00:00.000Z Last Updated: 2025-08-27T21:27:09.128Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Contao Products: Contao Problem Types: CWE-434 Description: Contao before 5.5.6 allows XSS via an SVG document. This affects (in contao/core-bundle in Composer) 4.x before 4.13.54, 5.0.x through 5.3.x before 5.3.30, and 5.4.x and 5.5..x before 5.5.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://grimthereaperteam.medium.com/contao-5-4-1-malicious-file-upload-xss-in-svg-30edb8820ecb - https://contao.org/en/security-advisories/cross-site-scripting-through-svg-uploads
CVE ID: CVE-2024-45967 State: PUBLISHED Published: 2024-10-01T00:00:00 Last Updated: 2024-10-01T14:44:11.624Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pagekit 1.0.18 is vulnerable to Cross Site Scripting (XSS) in index.php/admin/site/widget. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yingning620/test123/blob/main/Pagekit%20CMS/Pagekit%20CMS%20v1.0.18%20%E5%AD%98%E5%82%A8%E5%9E%8BXSS.md
CVE ID: CVE-2024-45969 State: PUBLISHED Published: 2024-11-15T00:00:00 Last Updated: 2024-11-15T18:48:40.067Z Vendors: n/a Products: n/a Problem Types: n/a Description: NULL pointer dereference in the MMS Client in MZ Automation LibIEC1850 before commit 7afa40390b26ad1f4cf93deaa0052fe7e357ef33 allows a malicious server to Cause a Denial-of-Service via the MMS InitiationResponse message. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mz-automation/libiec61850/commit/7afa40390b26ad1f4cf93deaa0052fe7e357ef33 - https://encs.eu/news/critical-security-vulnerabilities-discovered-in-mz-automations-mms-client/
CVE ID: CVE-2024-45970 State: PUBLISHED Published: 2024-11-15T00:00:00 Last Updated: 2024-11-15T18:50:02.669Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple Buffer overflows in the MMS Client in MZ Automation LibIEC61850 before commit ac925fae8e281ac6defcd630e9dd756264e9c5bc allow a malicious server to cause a stack-based buffer overflow via the MMS FileDirResponse message. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mz-automation/libiec61850/commit/ac925fae8e281ac6defcd630e9dd756264e9c5bc - https://encs.eu/news/critical-security-vulnerabilities-discovered-in-mz-automations-mms-client/
CVE ID: CVE-2024-45971 State: PUBLISHED Published: 2024-11-15T00:00:00 Last Updated: 2024-11-15T18:50:55.953Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple Buffer overflows in the MMS Client in MZ Automation LibIEC61850 before commit 1f52be9ddeae00e69cd43e4cac3cb4f0c880c4f0 allow a malicious server to cause a stack-based buffer overflow via the MMS IdentifyResponse message. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mz-automation/libiec61850/commit/1f52be9ddeae00e69cd43e4cac3cb4f0c880c4f0 - https://encs.eu/news/critical-security-vulnerabilities-discovered-in-mz-automations-mms-client/
CVE ID: CVE-2024-45979 State: PUBLISHED Published: 2024-09-26T00:00:00 Last Updated: 2024-09-26T18:24:26.757Z Vendors: n/a Products: n/a Problem Types: n/a Description: A host header injection vulnerability in Lines Police CAD 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This allows attackers to arbitrarily reset other users' passwords and compromise their accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/soursec/CVEs/tree/main/CVE-2024-45979
CVE ID: CVE-2024-45980 State: PUBLISHED Published: 2024-09-26T00:00:00 Last Updated: 2024-09-26T18:24:09.222Z Vendors: n/a Products: n/a Problem Types: n/a Description: A host header injection vulnerability in MEANStore 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This allows attackers to arbitrarily reset other users' passwords and compromise their accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/soursec/CVEs/tree/main/CVE-2024-45980
CVE ID: CVE-2024-45981 State: PUBLISHED Published: 2024-09-26T00:00:00 Last Updated: 2024-09-26T18:24:17.370Z Vendors: n/a Products: n/a Problem Types: n/a Description: A host header injection vulnerability in BookReviewLibrary 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/soursec/CVEs/tree/main/CVE-2024-45981
CVE ID: CVE-2024-45982 State: PUBLISHED Published: 2024-09-26T00:00:00 Last Updated: 2024-09-26T20:20:33.532Z Vendors: n/a Products: n/a Problem Types: n/a Description: A host header injection vulnerability in scheduleR v0.0.18 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This allows attackers to arbitrarily reset other users' passwords and compromise their accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/soursec/CVEs/tree/main/CVE-2024-45982
CVE ID: CVE-2024-45983 State: PUBLISHED Published: 2024-09-26T00:00:00 Last Updated: 2024-09-26T18:54:08.531Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) vulnerability exists in kishan0725's Hospital Management System version 6.3.5. The vulnerability allows an attacker to craft a malicious HTML form that submits a request to delete a doctor record. By enticing an authenticated admin user to visit the specially crafted web page, the attacker can leverage the victim's browser to make unauthorized requests to the vulnerable endpoint, effectively allowing the attacker to perform actions on behalf of the admin without their consent. Additional An
dpoint, effectively allowing the attacker to perform actions on behalf of the admin without their consent. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/soursec/CVEs/tree/main/CVE-2024-45983
CVE ID: CVE-2024-45984 State: PUBLISHED Published: 2024-09-26T00:00:00 Last Updated: 2024-09-26T18:48:31.027Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting (XSS) vulnerability in add_donor.php of Blood Bank And Donation Management System 1.0 allows an attacker to inject malicious scripts that will be executed when the Donor List is viewed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/soursec/CVEs/tree/main/CVE-2024-45984
CVE ID: CVE-2024-45985 State: PUBLISHED Published: 2024-09-26T00:00:00 Last Updated: 2024-09-26T17:55:04.908Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting (XSS) vulnerability in update_contact.php of Blood Bank and Donation Management System v1.0 allows an attacker to inject malicious scripts via the name parameter of the update_contact.php Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/soursec/CVEs/tree/main/CVE-2024-45985
CVE ID: CVE-2024-45986 State: PUBLISHED Published: 2024-09-26T00:00:00 Last Updated: 2024-09-26T20:48:18.055Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored Cross-Site Scripting (XSS) vulnerability was identified in Projectworld Online Voting System 1.0 that occurs when an account is registered with a malicious javascript payload. The payload is stored and subsequently executed in the voter.php and profile.php pages whenever the account information is accessed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/soursec/CVEs/tree/main/CVE-2024-45986
CVE ID: CVE-2024-45987 State: PUBLISHED Published: 2024-09-26T00:00:00.000Z Last Updated: 2025-03-25T16:30:46.718Z Vendors: n/a Products: n/a Problem Types: n/a Description: Projectworld Online Voting System Version 1.0 is vulnerable to Cross Site Request Forgery (CSRF) via voter.php. This vulnerability allows an attacker to craft a malicious link that, when clicked by an authenticated user, automatically submits a vote for a specified party without the user's consent or knowledge. The attack leverages the user's active session to perform the unauthorized action, compromising the integrity of the voting process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.
ng the integrity of the voting process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/soursec/CVEs/tree/main/CVE-2024-45987
CVE ID: CVE-2024-45989 State: PUBLISHED Published: 2024-09-26T00:00:00 Last Updated: 2024-09-27T14:55:41.032Z Vendors: n/a Products: n/a Problem Types: n/a Description: Monica AI Assistant desktop application v2.3.0 is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor. A prompt injection allows an attacker to modify chatbot answer with an unloaded image that exfiltrates the user's sensitive chat data of the current session to a malicious third-party or attacker-controlled server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://monica.im/desktop - https://github.com/soursec/CVEs/tree/main/CVE-2024-45989
CVE ID: CVE-2024-45993 State: PUBLISHED Published: 2024-09-30T00:00:00 Last Updated: 2024-09-30T18:41:36.515Z Vendors: n/a Products: n/a Problem Types: n/a Description: Giflib Project v5.2.2 is vulnerable to a heap buffer overflow via gif2rgb. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://giflib.com - https://gitlab.com/mthandazo/project-pov
CVE ID: CVE-2024-45999 State: PUBLISHED Published: 2024-10-01T00:00:00 Last Updated: 2024-10-01T19:56:03.076Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability was discovered in Cloudlog 2.6.15, specifically within the get_station_info()function located in the file /application/models/Oqrs_model.php. The vulnerability is exploitable via the station_id parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chiggerlor.substack.com/p/cve-2024-45999
CVE ID: CVE-2024-46040 State: PUBLISHED Published: 2024-10-07T00:00:00 Last Updated: 2024-11-04T21:32:06.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: IoT Haat Smart Plug IH-IN-16A-S IH-IN-16A-S v5.16.1 suffers from Insufficient Session Expiration. The lack of validation of the authentication token at the IoT Haat during the Access Point Pairing mode leads the attacker to replay the Wi-Fi packets and forcefully turn off the access point after the authentication token has expired. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Anonymous120386/Anonymous - https://www.iothaat.com/
CVE ID: CVE-2024-46041 State: PUBLISHED Published: 2024-10-07T00:00:00 Last Updated: 2024-10-07T19:45:26.593Z Vendors: n/a Products: n/a Problem Types: n/a Description: IoT Haat Smart Plug IH-IN-16A-S v5.16.1 is vulnerable to Authentication Bypass by Capture-replay. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Anonymous120386/Anonymous - https://www.iothaat.com/
CVE ID: CVE-2024-46044 State: PUBLISHED Published: 2024-09-13T00:00:00 Last Updated: 2024-10-15T13:42:51.148Z Vendors: n/a Products: n/a Problem Types: n/a Description: CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the fromqossetting function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/BenJpopo/V/blob/main/Tenda/CH22/fromqossetting.md
CVE ID: CVE-2024-46045 State: PUBLISHED Published: 2024-09-13T00:00:00 Last Updated: 2024-10-15T13:42:33.766Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the frmL7PlotForm function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/BenJpopo/V/blob/main/Tenda/CH22/frmL7PlotForm.md
CVE ID: CVE-2024-46046 State: PUBLISHED Published: 2024-09-13T00:00:00 Last Updated: 2024-09-13T15:43:12.641Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH451 v1.0.0.9 has a stack overflow vulnerability located in the RouteStatic function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/BenJpopo/V/blob/main/Tenda/FH451/RouteStatic.md
CVE ID: CVE-2024-46047 State: PUBLISHED Published: 2024-09-13T00:00:00 Last Updated: 2024-09-13T15:40:54.053Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH451 v1.0.0.9 has a stack overflow vulnerability in the fromDhcpListClient function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/BenJpopo/V/blob/main/Tenda/FH451/DhcpListClient.md
CVE ID: CVE-2024-46048 State: PUBLISHED Published: 2024-09-13T00:00:00 Last Updated: 2024-09-13T15:45:54.151Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH451 v1.0.0.9 has a command injection vulnerability in the formexeCommand function i Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/BenJpopo/V/blob/main/Tenda/FH451/formexeCommand.md
CVE ID: CVE-2024-46049 State: PUBLISHED Published: 2024-09-13T00:00:00 Last Updated: 2024-10-15T13:42:05.283Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda O6 V3.0 firmware V1.0.0.7(2054) contains a stack overflow vulnerability in the formexeCommand function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/BenJpopo/V/blob/main/Tenda/O6/formexeCommand.md
CVE ID: CVE-2024-46054 State: PUBLISHED Published: 2024-11-27T00:00:00 Last Updated: 2024-12-02T17:01:25.939Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenVidReview 1.0 is vulnerable to Incorrect Access Control. The /upload route is accessible without authentication, allowing any user to upload files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/davidguva/OpenVidReview - https://github.com/davidguva/OpenVidReview/blob/main/routes/upload.js - https://github.com/b1d0ws/CVEs/blob/main/CVE-2024-46054.md
CVE ID: CVE-2024-46055 State: PUBLISHED Published: 2024-11-27T00:00:00 Last Updated: 2024-11-27T17:15:55.337Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenVidReview 1.0 is vulnerable to Cross Site Scripting (XSS) in review names. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/davidguva/OpenVidReview - https://github.com/davidguva/OpenVidReview/blob/main/views/admin.ejs - https://github.com/b1d0ws/CVEs/blob/main/CVE-2024-46055.md
CVE ID: CVE-2024-46073 State: PUBLISHED Published: 2025-01-06T00:00:00 Last Updated: 2025-01-06T20:05:27.742Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected Cross-Site Scripting (XSS) vulnerability exists in the login page of IceHRM v32.4.0.OS. The vulnerability is due to improper sanitization of the "next" parameter, which is included in the application's response without adequate escaping. An attacker can exploit this flaw by tricking a user into visiting a specially crafted URL, causing the execution of arbitrary JavaScript code in the context of the victim's browser. The issue occurs even though the application has sanitization mechanisms in place. Additional Anal
the victim's browser. The issue occurs even though the application has sanitization mechanisms in place. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gamonoid/icehrm - https://github.com/manisashank/CVE-Publish/blob/main/CVE-2024-46073.md
CVE ID: CVE-2024-46076 State: PUBLISHED Published: 2024-10-07T00:00:00 Last Updated: 2024-10-07T19:35:57.200Z Vendors: n/a Products: n/a Problem Types: n/a Description: RuoYi v4.7.9 and before has a security flaw that allows escaping from comments within the code generation feature, enabling the injection of malicious code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yangzongzhuan/RuoYi - https://gist.github.com/kkll5875/f237f200bae6db6b47eea3236d82ad0d
CVE ID: CVE-2024-46077 State: PUBLISHED Published: 2024-10-04T00:00:00 Last Updated: 2024-10-04T22:17:24.224Z Vendors: n/a Products: n/a Problem Types: n/a Description: itsourcecode Online Tours and Travels Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via a crafted payload to the val-username, val-email, val-suggestions, val-digits and state_name parameters in travellers.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://packetstormsecurity.com - https://github.com/n00bS3cLe4rner/CVE-s/blob/main/CVE-2024-46077.md
CVE ID: CVE-2024-46078 State: PUBLISHED Published: 2024-10-04T00:00:00 Last Updated: 2024-10-04T22:17:14.571Z Vendors: n/a Products: n/a Problem Types: n/a Description: itsourcecode Sports Management System Project 1.0 is vulnerable to SQL Injection in the function delete_category of the file sports_scheduling/player.php via the argument id. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/n00bS3cLe4rner/CVE-s/blob/main/CVE-2024-46078.md
CVE ID: CVE-2024-46079 State: PUBLISHED Published: 2024-10-01T00:00:00 Last Updated: 2024-10-01T19:36:09.793Z Vendors: n/a Products: n/a Problem Types: n/a Description: Scriptcase v9.10.023 and before is vulnerable to Cross Site Scripting (XSS) in proj_new.php via the Descricao parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://blog.hawktesters.com/zero-day-alert-scriptcase-vulnerabilities-xss/
CVE ID: CVE-2024-46080 State: PUBLISHED Published: 2024-10-01T00:00:00 Last Updated: 2024-10-02T15:53:39.121Z Vendors: n/a Products: n/a Problem Types: n/a Description: Scriptcase v9.10.023 and before is vulnerable to Remote Code Execution (RCE) via the nm_zip function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://blog.hawktesters.com/zero-day-alert-scriptcase-vulnerabilities-rce/
CVE ID: CVE-2024-46081 State: PUBLISHED Published: 2024-10-01T00:00:00 Last Updated: 2024-10-01T19:34:03.512Z Vendors: n/a Products: n/a Problem Types: n/a Description: Scriptcase v9.10.023 and before is vulnerable to Cross Site Scripting (XSS). An authenticated user can craft malicious payloads in the To-Do List. The assigned user will trigger a stored XSS, which is particularly dangerous because tasks are assigned to various users on the platform. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://blog.hawktesters.com/zero-day-alert-scriptcase-vulnerabilities-xss/
CVE ID: CVE-2024-46082 State: PUBLISHED Published: 2024-10-01T00:00:00 Last Updated: 2024-10-02T15:46:59.633Z Vendors: n/a Products: n/a Problem Types: n/a Description: Scriptcase v.9.10.023 and before is vulnerable to Cross Site Scripting (XSS) in nm_cor.php via the form and field parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://blog.hawktesters.com/zero-day-alert-scriptcase-vulnerabilities-xss/ - https://blog.hawktesters.com/zero-day-alert-scriptcase-vulnerabilities-rce/
CVE ID: CVE-2024-46083 State: PUBLISHED Published: 2024-10-01T00:00:00 Last Updated: 2024-10-01T19:36:23.417Z Vendors: n/a Products: n/a Problem Types: n/a Description: Scriptcase v9.10.023 and before is vulnerable to Cross Site Scripting (XSS). An authenticated user can craft malicious payloads using the messages feature, which allows the injection of malicious code into any user's account on the platform. It is important to note that regular users can trigger actions for administrator users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://blog.hawktesters.com/zero-day-alert-scriptcase-vulnerabilities-xss/
CVE ID: CVE-2024-46084 State: PUBLISHED Published: 2024-10-01T00:00:00 Last Updated: 2024-10-02T15:59:47.279Z Vendors: n/a Products: n/a Problem Types: n/a Description: Scriptcase 9.10.023 and before is vulnerable to Remote Code Execution (RCE) via the nm_unzip function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://blog.hawktesters.com/zero-day-alert-scriptcase-vulnerabilities-rce/ - http://scriptcase.com
CVE ID: CVE-2024-46085 State: PUBLISHED Published: 2024-09-17T00:00:00 Last Updated: 2024-09-17T17:56:04.815Z Vendors: n/a Products: n/a Problem Types: n/a Description: FrogCMS V0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/plugin/file_manager/rename Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/RainingSEC/cms/tree/main/11/readme.md
CVE ID: CVE-2024-46086 State: PUBLISHED Published: 2024-09-18T00:00:00 Last Updated: 2024-09-18T18:57:32.057Z Vendors: n/a Products: n/a Problem Types: n/a Description: FrogCMS V0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/plugin/file_manager/delete/123 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/PG2Stom/cms/tree/main/12/readme.md
CVE ID: CVE-2024-46088 State: PUBLISHED Published: 2024-10-11T00:00:00 Last Updated: 2024-10-11T17:16:23.467Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the ProductAction.entphone interface of Zhejiang University Entersoft Customer Resource Management System v2002 to v2024 allows attackers to execute arbitrary code via uploading a crafted file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://zhejiang.com - https://periwinkle-brother-031.notion.site/Analysis-of-any-file-upload-vulnerability-of-Zhejiang-University-Entersoft-Customer-Resource-Managem-0f88a0e77d6f4f638bc3c4e508a1e0ed - https://www.entersoft.cn/
CVE ID: CVE-2024-46089 State: PUBLISHED Published: 2025-04-18T00:00:00.000Z Last Updated: 2025-04-18T13:50:50.006Z Vendors: n/a Products: n/a Problem Types: n/a Description: 74cms <=3.33 is vulnerable to remote code execution (RCE) in the background interface apiadmin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/Q16G/laravel_bug/blob/master/74cms.md - https://github.com/Q16G/cve_detail/blob/main/74cms/unzipRCE.md
CVE ID: CVE-2024-46097 State: PUBLISHED Published: 2024-09-27T00:00:00 Last Updated: 2024-09-27T19:42:29.536Z Vendors: n/a Products: n/a Problem Types: n/a Description: TestLink 1.9.20 is vulnerable to Incorrect Access Control in the TestPlan editing section. When a new TestPlan is created, an ID with an incremental value is automatically generated. Using the edit function you can change the tplan_id parameter to another ID. The application does not carry out a check on the user's permissions maing it possible to recover the IDs of all the TestPlans (even the administrative ones) and modify them even with minimal privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
ones) and modify them even with minimal privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Alkatraz97/CVEs/blob/main/CVE-2024-46097.md
CVE ID: CVE-2024-46101 State: PUBLISHED Published: 2024-09-20T00:00:00 Last Updated: 2024-09-23T15:35:20.237Z Vendors: n/a Products: n/a Problem Types: n/a Description: GDidees CMS <= v3.9.1 has a file upload vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/N0zoM1z0/MY-CVE/blob/main/CVE-2024-46101.md
CVE ID: CVE-2024-46103 State: PUBLISHED Published: 2024-09-20T00:00:00 Last Updated: 2024-09-23T15:40:11.247Z Vendors: n/a Products: n/a Problem Types: n/a Description: SEMCMS 4.8 is vulnerable to SQL Injection via SEMCMS_Main.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/N0zoM1z0/MY-CVE/blob/main/CVE-2024-46103.md
CVE ID: CVE-2024-46209 State: PUBLISHED Published: 2025-01-06T00:00:00 Last Updated: 2025-01-07T15:44:03.591Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the component /media/test.html of REDAXO CMS v5.17.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the password parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/h4ckr4v3n/research_redaxo_5_17_1.git - https://github.com/h4ckr4v3n/CVE-2024-46209/blob/main/REDAXO%20Stored%20XSS%20%2B%20RCE.pdf