Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
closed to the public and may be used. The associated identifier of this vulnerability is VDB-230799. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.230799 - https://vuldb.com/?ctiid.230799 - https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/Service%20Provider%20Management%20System%20-%20multiple%20vulnerabilities.md
CVE ID: CVE-2023-3121 State: PUBLISHED Published: 2023-06-06T11:00:05.120Z Last Updated: 2024-08-02T06:48:07.341Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Dahua Products: Smart Parking Management Problem Types: CWE-918 Description: A vulnerability has been found in Dahua Smart Parking Management up to 20230528 and classified as problematic. This vulnerability affects unknown code of the file /ipms/imageConvert/image. The manipulation of the argument fileUrl leads to server-side request forgery. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-230800. NOTE: The vendor was contacted early about this
ic and may be used. The identifier of this vulnerability is VDB-230800. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.230800 - https://vuldb.com/?ctiid.230800 - https://github.com/RCEraser/cve/blob/main/DaHua..md
CVE ID: CVE-2023-3122 State: PUBLISHED Published: 2023-07-12T04:38:42.099Z Last Updated: 2025-02-05T19:41:44.836Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: gdragon Products: GD Mail Queue Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The GD Mail Queue plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 3.9.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected pa
thenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0b668f45-c7fb-481b-bc8e-115e5b7248c9?source=cve - https://plugins.trac.wordpress.org/changeset/2923988/gd-mail-queue
CVE ID: CVE-2023-3123 State: REJECTED Published: N/A Last Updated: 2023-06-06T13:14:53.643Z Description: No description available.
CVE ID: CVE-2023-3124 State: PUBLISHED Published: 2023-06-07T01:51:20.759Z Last Updated: 2024-12-23T16:22:16.547Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: https://elementor.com/ Products: Elementor Website Builder Pro Problem Types: CWE-862 Missing Authorization Description: The Elementor Pro plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the update_page_option function in versions up to, and including, 3.11.6. This makes it possible for authenticated attackers with subscriber-level capabilities to update arbitrary site options, which can lead to privilege escalation. Additional Analyst Notes: -
level capabilities to update arbitrary site options, which can lead to privilege escalation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/570474f2-c118-45e1-a237-c70b849b2d3c?source=cve - https://blog.nintechnet.com/high-severity-vulnerability-fixed-in-wordpress-elementor-pro-plugin/
CVE ID: CVE-2023-3125 State: PUBLISHED Published: 2023-06-07T01:51:40.160Z Last Updated: 2024-12-20T23:51:00.398Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: webwizardsdev Products: B2BKing — Ultimate WooCommerce Wholesale and B2B Solution Problem Types: CWE-862 Missing Authorization Description: The B2BKing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'b2bking_save_price_import' function in versions up to, and including, 4.6.00. This makes it possible for Authenticated attackers with subscriber or customer-level permissions to modify the pricing of any product on the site. Additional An
attackers with subscriber or customer-level permissions to modify the pricing of any product on the site. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b3f2c4c3-73d6-4b3b-8eb3-c494f52dc183?source=cve - https://blog.nintechnet.com/vulnerabilities-fixed-in-wordpress-b2bking-plugin/ - https://woocommerce-b2b-plugin.com/changelog/
CVE ID: CVE-2023-3126 State: PUBLISHED Published: 2023-06-07T01:51:44.695Z Last Updated: 2024-12-20T23:50:30.946Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: webwizardsdev Products: B2BKing — Ultimate WooCommerce Wholesale and B2B Solution Problem Types: CWE-862 Missing Authorization Description: The B2BKing plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'b2bkingdownloadpricelist' function in versions up to, and including, 4.6.00. This makes it possible for Authenticated attackers with subscriber or customer-level permissions to retrieve the full pricing list of all products on the site. Additio
ers with subscriber or customer-level permissions to retrieve the full pricing list of all products on the site. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d2e3ac14-1421-49f0-9c60-7f7d5c9d7654?source=cve - https://blog.nintechnet.com/vulnerabilities-fixed-in-wordpress-b2bking-plugin/ - https://woocommerce-b2b-plugin.com/changelog/
CVE ID: CVE-2023-3127 State: PUBLISHED Published: 2023-07-11T21:06:29.003Z Last Updated: 2024-10-22T20:31:09.969Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L) Vendors: Sensormatic Electronics, a subsidiary of Johnson Controls, Inc. Products: iSTAR Ultra, iSTAR Ultra LT, iSTAR Ultra G2, iSTAR Edge G2 Problem Types: CWE-287 Description: An unauthenticated user could log into iSTAR Ultra, iSTAR Ultra LT, iSTAR Ultra G2, and iSTAR Edge G2 with administrator rights. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.johnsoncontrols.com/cyber-solutions/security-advisories - https://www.cisa.gov/news-events/ics-advisories/
- https://www.johnsoncontrols.com/cyber-solutions/security-advisories - https://www.cisa.gov/news-events/ics-advisories/icsa-23-192-02
CVE ID: CVE-2023-3128 State: PUBLISHED Published: 2023-06-22T20:14:00.805Z Last Updated: 2025-02-13T16:49:48.654Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: Grafana Products: Grafana, Grafana Enterprise Problem Types: CWE-290 Description: Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://grafana.com/security/security-advisories/cve-2023-3128/ - htt
Container: - CISA ADP Vulnrichment: References: - https://grafana.com/security/security-advisories/cve-2023-3128/ - https://github.com/grafana/bugbounty/security/advisories/GHSA-gxh2-6vvc-rrgp - https://security.netapp.com/advisory/ntap-20230714-0004/
CVE ID: CVE-2023-3129 State: PUBLISHED Published: 2023-07-10T12:40:04.686Z Last Updated: 2024-11-12T14:09:31.155Z Vendors: Unknown Products: URL Shortify Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The URL Shortify WordPress plugin before 1.7.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5717d729-c24b-4415-bb99-fcdd259328c4
CVE ID: CVE-2023-3130 State: PUBLISHED Published: 2023-07-31T09:37:34.152Z Last Updated: 2024-10-21T14:35:30.997Z Vendors: Unknown Products: Short URL Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Short URL WordPress plugin before 1.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/6e167864-c304-402e-8b2d-d47b5a3767d1
CVE ID: CVE-2023-3131 State: PUBLISHED Published: 2023-07-10T12:41:17.016Z Last Updated: 2024-11-12T17:02:28.231Z Vendors: Unknown Products: MStore API Problem Types: CWE-862 Missing Authorization Description: The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/970735f1-24bb-441c-89b6-5a0959246d6c
CVE ID: CVE-2023-3132 State: PUBLISHED Published: 2023-06-27T02:54:08.748Z Last Updated: 2024-11-06T21:44:11.670Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: mainwp Products: MainWP Child – Securely Connects Sites to the MainWP WordPress Manager Dashboard Problem Types: CWE-200 Information Exposure Description: The MainWP Child plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.4.1.1 due to insufficient controls on the storage of back-up files. This makes it possible for unauthenticated attackers to extract sensitive data including the entire installations database if a backup occurs and the deletion
ted attackers to extract sensitive data including the entire installations database if a backup occurs and the deletion of the back-up files fail. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a1fadba1-674f-4f3d-997f-d29d3a887414?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2923512%40mainwp-child&new=2923512%40mainwp-child&sfp_email=&sfph_mail=
CVE ID: CVE-2023-3133 State: PUBLISHED Published: 2023-07-04T07:23:24.882Z Last Updated: 2024-11-21T15:05:21.758Z Vendors: Unknown Products: Tutor LMS Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The Tutor LMS WordPress plugin before 2.2.1 does not implement adequate permission checks for REST API endpoints, allowing unauthenticated attackers to access information from Lessons that should not be publicly available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/3b6969a7-5cbc-4e16-8f27-5dde481237f5 - https://plugins.trac.wordpress.org/browser/tutor/tags/2.2.0/classes/RestAPI.php
y/3b6969a7-5cbc-4e16-8f27-5dde481237f5 - https://plugins.trac.wordpress.org/browser/tutor/tags/2.2.0/classes/RestAPI.php#L253 - https://wordpress.org/plugins/tutor/
CVE ID: CVE-2023-3134 State: PUBLISHED Published: 2023-07-31T09:37:34.911Z Last Updated: 2024-08-02T06:48:07.875Z Vendors: Unknown Products: Forminator Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Forminator WordPress plugin before 1.24.4 does not properly escape values that are being reflected inside form fields that use pre-populated query parameters, which could lead to reflected XSS attacks. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/6d50d3cc-7563-42c4-977b-f834fee711da - https://www.onvio.nl/nieuws/research-day-discovering-vulnerabilities-in-wordpress-plugins
CVE ID: CVE-2023-3135 State: PUBLISHED Published: 2023-07-12T04:38:43.927Z Last Updated: 2025-02-05T19:41:24.516Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: oacstudio Products: Mailtree Log Mail Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Mailtree Log Mail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an
ble for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/24d0229c-0f1b-42df-b89a-ce0b8a3fda7e?source=cve - https://plugins.trac.wordpress.org/changeset/2928716/mailtree-log-mail
CVE ID: CVE-2023-3136 State: PUBLISHED Published: 2023-08-30T08:28:12.297Z Last Updated: 2025-02-05T19:34:39.054Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: pierrelannoy Products: MailArchiver Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The MailArchiver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injec
r unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ce330cae-c2f8-42f3-822b-ca24bf46e433?source=cve - https://plugins.trac.wordpress.org/changeset/2937545/mailarchiver
CVE ID: CVE-2023-3138 State: PUBLISHED Published: 2023-06-28T00:00:00 Last Updated: 2024-08-02T06:48:07.359Z Vendors: n/a Products: libX11 Problem Types: CWE-119 Description: A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that the values provided for the Request, Event, or Error IDs are within the bounds of the arrays that those functions write to, using those IDs as array indexes. They trust that they were called with values provided by an Xserver adhering to the bounds specified in the X11 protocol, as all X servers provided by X.Org do. As the protocol only specifies a single byte for these values, an out-of-boun
ol, as all X servers provided by X.Org do. As the protocol only specifies a single byte for these values, an out-of-bounds value provided by a malicious server (or a malicious proxy-in-the-middle) can only overwrite other portions of the Display structure and not write outside the bounds of the Display structure itself, possibly causing the client to crash with this memory corruption. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2023-3138 - https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/304a654a0d57bf0f00d8998185f0360332cfa36c - https://lists.x.org/archives/xorg-announce/2023-June/003406.html - https://lists.x.org/archiv
00d8998185f0360332cfa36c - https://lists.x.org/archives/xorg-announce/2023-June/003406.html - https://lists.x.org/archives/xorg-announce/2023-June/003407.html - https://security.netapp.com/advisory/ntap-20231208-0008/
CVE ID: CVE-2023-3139 State: PUBLISHED Published: 2023-07-04T07:23:27.209Z Last Updated: 2024-11-22T15:31:30.308Z Vendors: Unknown Products: Protect WP Admin Problem Types: CWE-203: Observable Discrepancy Description: The Protect WP Admin WordPress plugin before 4.0 discloses the URL of the admin panel via a redirection of a crafted URL, bypassing the protection offered. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f8a29aee-19cd-4e62-b829-afc9107f69bd - https://magos-securitas.com/txt/CVE-2023-3139.txt
CVE ID: CVE-2023-3140 State: PUBLISHED Published: 2023-06-07T09:15:00.112Z Last Updated: 2025-01-06T21:27:10.274Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: KNIME Products: KNIME Business Hub Problem Types: CWE-1021 Description: Missing HTTP headers (X-Frame-Options, Content-Security-Policy) in KNIME Business Hub before 1.4.0 has left users vulnerable to click jacking. Clickjacking is an attack that occurs when an attacker uses a transparent iframe in a window to trick a user into clicking on an actionable item, such as a button or link, to another server in which they have an identical webpage. The attacker essentially hijacks the user activity intende
k, to another server in which they have an identical webpage. The attacker essentially hijacks the user activity intended for the original server and sends them to the other server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.knime.com/security/advisories#CVE-2023-3140
CVE ID: CVE-2023-3141 State: PUBLISHED Published: 2023-06-09T00:00:00.000Z Last Updated: 2025-03-11T14:56:02.248Z Vendors: n/a Products: Kernel Problem Types: CWE-416 Description: A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. This flaw allows a local attacker to crash the system at device disconnect, possibly leading to a kernel information leak. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lore.kernel.org/lkml/CAPDyKFoV9aZObZ5GBm0U_-UVeVkBN_rAG-kH3BKoP4EXdYM4bw%40mail.gmail.com/t/ - https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.4 - https://git.kernel.org/pu
4EXdYM4bw%40mail.gmail.com/t/ - https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.4 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=63264422785021704c39b38f65a78ab9e4a186d7 - https://security.netapp.com/advisory/ntap-20230706-0004/ - https://lists.debian.org/debian-lts-announce/2023/07/msg00030.html - https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html
CVE ID: CVE-2023-3142 State: PUBLISHED Published: 2023-06-07T00:00:00 Last Updated: 2025-01-06T21:10:08.975Z Severity: LOW (CVSS 3.8 CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: microweber Products: microweber/microweber Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 2.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/d00686b0-f89a-4e14-98d7-b8dd3f92a6e5 - https://github.com/microweber/microweber/commit/42efa981a2239d042d910069952d6276497bdcf1
CVE ID: CVE-2023-3143 State: PUBLISHED Published: 2023-06-07T14:31:02.866Z Last Updated: 2024-08-02T06:48:07.353Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Online Discussion Forum Site Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in SourceCodester Online Discussion Forum Site 1.0. Affected is an unknown function of the file admin\posts\manage_post.php. The manipulation of the argument content leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231012. Additional Analyst Notes
en disclosed to the public and may be used. The identifier of this vulnerability is VDB-231012. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.231012 - https://vuldb.com/?ctiid.231012 - https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/Online%20Discussion%20Forum%20Site%20-%20multiple%20vulnerabilities.md#11xss-vulnerability-in-adminpostsmanage_postphpcontent
CVE ID: CVE-2023-3144 State: PUBLISHED Published: 2023-06-07T15:00:04.657Z Last Updated: 2024-08-02T06:48:07.680Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Online Discussion Forum Site Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in SourceCodester Online Discussion Forum Site 1.0. Affected by this vulnerability is an unknown functionality of the file admin\posts\manage_post.php. The manipulation of the argument title leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231013 was assigned to this vulnerability. Add
loit has been disclosed to the public and may be used. The identifier VDB-231013 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.231013 - https://vuldb.com/?ctiid.231013 - https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/Online%20Discussion%20Forum%20Site%20-%20multiple%20vulnerabilities.md#10xss-vulnerability-in-adminpostsmanage_postphptitle
CVE ID: CVE-2023-3145 State: PUBLISHED Published: 2023-06-07T15:00:05.675Z Last Updated: 2024-08-02T06:48:07.334Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Discussion Forum Site Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in SourceCodester Online Discussion Forum Site 1.0. Affected by this issue is some unknown functionality of the file classes\Users.php?f=registration. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-231014 is the identifier assigned to this vulnerab
ly. The exploit has been disclosed to the public and may be used. VDB-231014 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.231014 - https://vuldb.com/?ctiid.231014 - https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/Online%20Discussion%20Forum%20Site%20-%20multiple%20vulnerabilities.md#9sql-injection-vulnerability-in-classesusersphppost
CVE ID: CVE-2023-3146 State: PUBLISHED Published: 2023-06-07T15:31:03.632Z Last Updated: 2024-11-22T15:39:49.425Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Discussion Forum Site Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in SourceCodester Online Discussion Forum Site 1.0. This affects an unknown part of the file admin\categories\manage_category.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231015. Additional
been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231015. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.231015 - https://vuldb.com/?ctiid.231015 - https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/Online%20Discussion%20Forum%20Site%20-%20multiple%20vulnerabilities.md#8sql-injection-vulnerability-in-admincategoriesmanage_categoryphp