Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
role. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://knowledge.hitachivantara.com/Security/System_Management_Unit_(SMU)_versions_prior_to_14.8.7825.01%2C_used_to_manage_Hitachi_Vantara_NAS_products_are_susceptible_to_unintended_information_disclosure_via_unprivileged_access_to_HNAS_configuration_backup_and_diagnostic_data.
CVE ID: CVE-2023-5809 State: PUBLISHED Published: 2023-12-04T21:29:58.534Z Last Updated: 2024-08-02T08:14:24.307Z Vendors: Unknown Products: Popup box Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f1eb05e8-1b7c-45b1-912d-f668bd68e265
CVE ID: CVE-2023-5810 State: PUBLISHED Published: 2023-10-27T00:31:05.032Z Last Updated: 2024-09-09T15:28:04.862Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: flusity Products: CMS Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in flusity CMS. This issue affects the function loadPostAddForm of the file core/tools/posts.php. The manipulation of the argument edit_post_id leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected
product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The identifier of the patch is 6943991c62ed87c7a57989a0cb7077316127def8. It is recommended to apply a patch to fix this issue. The identifier VDB-243641 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.243641 - https://vuldb.com/?ctiid.243641 - https://github.com/flusity/flusity-CMS/issues/2 - https://github.com/flusity/flusity-CMS/commit/6943991c62ed87c7a57989a0cb7077316127def8
CVE ID: CVE-2023-5811 State: PUBLISHED Published: 2023-10-27T00:31:06.093Z Last Updated: 2024-08-02T08:14:24.029Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: flusity Products: CMS Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in flusity CMS. Affected is the function loadPostAddForm of the file core/tools/posts.php. The manipulation of the argument menu_id leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are
livery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as 6943991c62ed87c7a57989a0cb7077316127def8. It is recommended to apply a patch to fix this issue. VDB-243642 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.243642 - https://vuldb.com/?ctiid.243642 - https://github.com/flusity/flusity-CMS/issues/3 - https://github.com/flusity/flusity-CMS/commit/6943991c62ed87c7a57989a0cb7077316127def8
CVE ID: CVE-2023-5812 State: PUBLISHED Published: 2023-10-27T01:31:05.296Z Last Updated: 2024-08-02T08:14:24.284Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: flusity Products: CMS Problem Types: CWE-434 Description: A vulnerability has been found in flusity CMS and classified as critical. Affected by this vulnerability is the function handleFileUpload of the file core/tools/upload.php. The manipulation of the argument uploaded_file leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The associated identifier of this vulnerability is VDB-243643. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.243643 - https://vuldb.com/?ctiid.243643 - https://github.com/flusity/flusity-CMS/issues/4
CVE ID: CVE-2023-5813 State: PUBLISHED Published: 2023-10-27T01:31:06.415Z Last Updated: 2024-09-05T22:15:38.840Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Task Reminder System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Task Reminder System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /classes/Master.php?f=delete_reminder. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The identifier of this vulnerability is VDB-243644. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http
nerability is VDB-243644. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.243644 - https://vuldb.com/?ctiid.243644
CVE ID: CVE-2023-5814 State: PUBLISHED Published: 2023-10-27T02:00:06.670Z Last Updated: 2024-09-05T22:15:20.029Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Task Reminder System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Task Reminder System 1.0. It has been classified as critical. This affects an unknown part of the file /classes/Master.php?f=save_reminder. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The identifier VDB-243645 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
signed to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.243645 - https://vuldb.com/?ctiid.243645
CVE ID: CVE-2023-5815 State: PUBLISHED Published: 2023-11-22T15:33:22.472Z Last Updated: 2025-06-10T13:32:30.526Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: infornweb Products: News & Blog Designer Pack – WordPress Blog Plugin — (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post Ticker, Blog Post Masonry) Problem Types: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') Description: The News & Blog Designer Pack – WordPress Blog Plugin — (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post Ticker, Blog Post Masonry) plugin for WordPress is vulnerable to Remote Code Execu
Slider, Blog Post Carousel, Blog Post Ticker, Blog Post Masonry) plugin for WordPress is vulnerable to Remote Code Execution via Local File Inclusion in all versions up to, and including, 3.4.1 via the bdp_get_more_post function hooked via a nopriv AJAX. This is due to function utilizing an unsafe extract() method to extract values from the POST variable and passing that input to the include() function. This makes it possible for unauthenticated attackers to include arbitrary PHP files and achieve remote code execution. On vulnerable Docker configurations it may be possible for an attacker to create a PHP file and then subsequently include it to achieve RCE. Additional Analyst Notes: - CISA
for an attacker to create a PHP file and then subsequently include it to achieve RCE. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2f2bdf11-401a-48af-b1dc-aeeb40b9a384?source=cve - https://wordpress.org/plugins/blog-designer-pack/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2984052%40blog-designer-pack&new=2984052%40blog-designer-pack&sfp_email=&sfph_mail= - https://www.leavesongs.com/PENETRATION/docker-php-include-getshell.html#0x06-pearcmdphp
CVE ID: CVE-2023-5816 State: PUBLISHED Published: 2024-10-30T02:04:35.541Z Last Updated: 2024-10-30T14:59:31.112Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: qriouslad Products: Code Explorer Problem Types: CWE-73 Description: The Code Explorer plugin for WordPress is vulnerable to arbitrary external file reading in all versions up to, and including, 1.4.5. This is due to the fact that the plugin does not restrict accessing files to those outside of the WordPress instance, though the intention of the plugin is to only access WordPress related files. This makes it possible for authenticated attackers, with administrator-level access, to read files outside
elated files. This makes it possible for authenticated attackers, with administrator-level access, to read files outside of the WordPress instance. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/42ecc4e5-d660-472f-823d-a29b84cdf041?source=cve - https://wordpress.org/plugins/code-explorer/#developers
CVE ID: CVE-2023-5817 State: PUBLISHED Published: 2023-10-27T10:59:12.922Z Last Updated: 2025-02-05T18:57:28.643Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: freeben Products: Neon text Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Neon text plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's neontext_box shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes (color). This makes it possible for authenticated attackers with contributor-level and above permissions to
d attributes (color). This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f9998485-e272-48fc-b2f1-9e30158d0d16?source=cve - https://drive.google.com/file/d/125xS3GVMr7_qo5HjWvXaXixuE_R-q_u3/view?usp=sharing - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2984188%40neon-text&new=2984188%40neon-text&sfp_email=&sfph_mail=
CVE ID: CVE-2023-5818 State: PUBLISHED Published: 2023-11-07T19:31:33.680Z Last Updated: 2025-01-22T15:55:20.999Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: garykeorkunian Products: Amazonify Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Amazonify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.8.1. This is due to missing or incorrect nonce validation on the amazonifyOptionsPage() function. This makes it possible for unauthenticated attackers to update the plugins settings, including the Amazon Tracking ID, via a forged request granted they can trick a site administrato
the plugins settings, including the Amazon Tracking ID, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/33f3c466-bdeb-402f-bf34-bc703f35e1e2?source=cve - https://plugins.trac.wordpress.org/browser/amazonify/trunk/amazonify.php#L142
CVE ID: CVE-2023-5819 State: PUBLISHED Published: 2023-11-07T19:31:34.227Z Last Updated: 2024-08-02T08:14:24.064Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: garykeorkunian Products: Amazonify Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Amazonify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that
authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. However, please note that this can also be combined with CVE-2023-5818 for CSRF to XSS. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/41adfb58-d79f-40a3-8a7e-f3f08f64659f?source=cve - https://wordpress.org/plugins/amazonify/ - https://plugins.trac.wordpress.org/browser/amazonify/trunk/amazonify.php#L142
CVE ID: CVE-2023-5820 State: PUBLISHED Published: 2023-10-27T11:28:45.091Z Last Updated: 2025-02-05T18:56:59.446Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: nik00726 Products: Thumbnail Slider With Lightbox Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing or incorrect nonce validation on the addedit functionality. This makes it possible for unauthenticated attackers to upload arbitrary files via a forged request granted they can trick a site administrator into performing an action such as click
arbitrary files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e51e1cd2-6de9-4820-8bba-1c6b5053e2c1?source=cve - https://wordpress.org/plugins/wp-responsive-slider-with-lightbox - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=1263536%40wp-responsive-slider-with-lightbox&new=1263536%40wp-responsive-slider-with-lightbox&sfp_email=&sfph_mail=
CVE ID: CVE-2023-5821 State: PUBLISHED Published: 2023-10-27T11:28:44.618Z Last Updated: 2025-02-05T18:57:08.694Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: nik00726 Products: Thumbnail carousel slider Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Thumbnail carousel slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing nonce validation on the deleteselected function. This makes it possible for unauthenticated attackers to delete sliders in bulk via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Addition
orged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bde75c5a-b0b7-4f26-91e9-dd4816e276c9?source=cve - https://wordpress.org/plugins/wp-responsive-thumbnail-slider - https://plugins.trac.wordpress.org/changeset/1263536/wp-responsive-slider-with-lightbox/trunk/wp-responsive-slider-with-lightbox.php
CVE ID: CVE-2023-5822 State: PUBLISHED Published: 2023-11-22T15:33:21.106Z Last Updated: 2024-08-02T08:14:24.711Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: glenwpcoder Products: Drag and Drop Multiple File Upload – Contact Form 7 Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The Drag and Drop Multiple File Upload - Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads to insufficient file type validation in the 'dnd_upload_cf7_upload' function in versions up to, and including, 1.3.7.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server wh
1.3.7.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. This can be exploited if a user authorized to edit form, which means editor privileges or above, has added a 'multiple file upload' form field with '*' acceptable file types. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1b3be300-5b7f-4844-8637-1bb8c939ed4c?source=cve - https://plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-contact-form-7/tags/1.3.7.2/inc/dnd-upload-cf7.php#L828 - https://plugins.trac.wordpress.org/browser/drag-and
ile-upload-contact-form-7/tags/1.3.7.2/inc/dnd-upload-cf7.php#L828 - https://plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-contact-form-7/tags/1.3.7.2/inc/dnd-upload-cf7.php#L855 - https://plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-contact-form-7/tags/1.3.7.2/inc/dnd-upload-cf7.php#L904 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2987252%40drag-and-drop-multiple-file-upload-contact-form-7%2Ftrunk&old=2968538%40drag-and-drop-multiple-file-upload-contact-form-7%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-5823 State: PUBLISHED Published: 2023-11-06T11:21:53.681Z Last Updated: 2025-02-19T21:21:20.713Z Vendors: ThemeKraft Products: TK Google Fonts GDPR Compliant Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in ThemeKraft TK Google Fonts GDPR Compliant plugin <= 2.2.11 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/tk-google-fonts/wordpress-tk-google-fonts-gdpr-compliant-plugin-2-2-11-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-5824 State: PUBLISHED Published: 2023-11-03T07:56:36.369Z Last Updated: 2025-11-06T20:51:27.614Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux
x 8.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Extended Update Support, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-755 Description: A flaw was found in Squid. The limits applied for validation of HTTP response headers are applied before caching. However, Squid may grow a cached HTTP response header beyond the configured maximum size, causing a stall or crash of the worker process when a large header is retrieved from the disk cache, resulting in a deni
causing a stall or crash of the worker process when a large header is retrieved from the disk cache, resulting in a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:7465 - https://access.redhat.com/errata/RHSA-2023:7668 - https://access.redhat.com/errata/RHSA-2024:0072 - https://access.redhat.com/errata/RHSA-2024:0397 - https://access.redhat.com/errata/RHSA-2024:0771 - https://access.redhat.com/errata/RHSA-2024:0772 - https://access.redhat.com/errata/RHSA-2024:0773 - https://access.redhat.com/errata/RHSA-2024:1153 - https://access.redhat.com/security/cve/CVE-2023-5824 - https://bugzilla.redhat.com/show_bug.cgi?id=2
ta/RHSA-2024:1153 - https://access.redhat.com/security/cve/CVE-2023-5824 - https://bugzilla.redhat.com/show_bug.cgi?id=2245914 - https://github.com/squid-cache/squid/security/advisories/GHSA-543m-w2m2-g255
CVE ID: CVE-2023-5825 State: PUBLISHED Published: 2023-11-06T10:30:38.334Z Last Updated: 2025-11-20T04:10:53.260Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-835 Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.2 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. A low-privileged attacker can point a CI/CD Component to an incorrect path and cause the server to exhaust all available memory through an infinite loop and cause Denial of Service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program C
through an infinite loop and cause Denial of Service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/428984 - https://hackerone.com/reports/2218566
CVE ID: CVE-2023-5826 State: PUBLISHED Published: 2023-10-27T17:31:04.504Z Last Updated: 2024-08-02T08:14:24.123Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Netentsec Products: NS-ASG Application Security Gateway Problem Types: CWE-89 Description: A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/list_onlineuser.php. The manipulation of the argument SessionId leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-243716. NOTE: We tried to contact the ve
osed to the public and may be used. The identifier of this vulnerability is VDB-243716. NOTE: We tried to contact the vendor early about the disclosure but the official mail address was not working properly. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.243716 - https://vuldb.com/?ctiid.243716 - https://github.com/Cubi123123123/cve/blob/main/NS-ASG-sql-list_onlineuser.md
CVE ID: CVE-2023-5827 State: PUBLISHED Published: 2023-10-27T17:31:05.656Z Last Updated: 2025-06-12T14:45:24.682Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Shanghai CTI Navigation Products: CTI Monitoring and Early Warning System Problem Types: CWE-89 Description: A vulnerability was found in Shanghai CTI Navigation CTI Monitoring and Early Warning System 2.2. It has been classified as critical. This affects an unknown part of the file /Web/SysManage/UserEdit.aspx. The manipulation of the argument ID leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-243717 was assigned to this vulnerability. Additi
t has been disclosed to the public and may be used. The identifier VDB-243717 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.243717 - https://vuldb.com/?ctiid.243717 - https://github.com/Ox1dq/cve/blob/main/rce.md