Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-40393 State: PUBLISHED Published: 2024-07-16T00:00:00.000Z Last Updated: 2025-03-18T19:40:46.132Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Clinic Management System In PHP With Free Source code v1.0 was discovered to contain a SQL injection vulnerability via the user parameter at login.php. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/CveSecLook/cve/issues/47
CVE ID: CVE-2024-40394 State: PUBLISHED Published: 2024-07-16T00:00:00 Last Updated: 2024-08-02T04:33:11.608Z Vendors: n/a Products: n/a Problem Types: n/a Description: Simple Library Management System Project Using PHP/MySQL v1.0 was discovered to contain an arbitrary file upload vulnerability via the component ajax.php. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/CveSecLook/cve/issues/48
CVE ID: CVE-2024-40395 State: PUBLISHED Published: 2024-08-27T00:00:00.000Z Last Updated: 2025-03-25T16:20:43.892Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Insecure Direct Object Reference (IDOR) in PTC ThingWorx v9.5.0 allows attackers to view sensitive information, including PII, regardless of access level. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://pastebin.com/9dc4LYGA
CVE ID: CVE-2024-40400 State: PUBLISHED Published: 2024-07-19T00:00:00 Last Updated: 2024-08-02T04:33:11.642Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the image upload function of Automad v2.0.0 allows attackers to execute arbitrary code via a crafted file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/marcantondahmen/automad/issues/106
CVE ID: CVE-2024-40402 State: PUBLISHED Published: 2024-07-17T00:00:00 Last Updated: 2024-08-02T04:33:11.667Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability was found in 'ajax.php' of Sourcecodester Simple Library Management System 1.0. This vulnerability stems from insufficient user input validation of the 'username' parameter, allowing attackers to inject malicious SQL queries. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/CveSecLook/cve/issues/49
CVE ID: CVE-2024-40404 State: PUBLISHED Published: 2024-11-13T00:00:00 Last Updated: 2024-11-25T19:45:52.006Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain an access control issue in the API endpoint where Web Sockets connections are established. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://blog.cybelesoft.com/thinfinity-workspace-security-bulletin-nov-2024/
CVE ID: CVE-2024-40405 State: PUBLISHED Published: 2024-11-13T00:00:00 Last Updated: 2024-11-25T19:46:55.256Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in Cybele Software Thinfinity Workspace before v7.0.3.109 allows attackers to gain access to a secondary broker via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://blog.cybelesoft.com/thinfinity-workspace-security-bulletin-nov-2024/
CVE ID: CVE-2024-40407 State: PUBLISHED Published: 2024-11-13T00:00:00 Last Updated: 2024-11-25T19:48:09.385Z Vendors: n/a Products: n/a Problem Types: n/a Description: A full path disclosure in Cybele Software Thinfinity Workspace before v7.0.2.113 allows attackers to obtain the root path of the application via unspecified vectors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://blog.cybelesoft.com/thinfinity-workspace-security-bulletin-nov-2024/
CVE ID: CVE-2024-40408 State: PUBLISHED Published: 2024-11-13T00:00:00 Last Updated: 2024-11-25T19:49:16.131Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain an access control issue in the Create Profile section. This vulnerability allows attackers to create arbitrary user profiles with elevated privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://blog.cybelesoft.com/thinfinity-workspace-security-bulletin-nov-2024/
CVE ID: CVE-2024-40410 State: PUBLISHED Published: 2024-11-13T00:00:00 Last Updated: 2024-11-25T19:50:46.834Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain a hardcoded cryptographic key used for encryption. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://blog.cybelesoft.com/thinfinity-workspace-security-bulletin-nov-2024/
CVE ID: CVE-2024-40412 State: PUBLISHED Published: 2024-07-10T00:00:00 Last Updated: 2024-08-02T04:33:11.687Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AX12 v1.0 v22.03.01.46 contains a stack overflow in the deviceList parameter of the sub_42E410 function. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://static.tenda.com.cn/tdcweb/download/uploadfile/AX12/V22.03.01.46.zip - https://github.com/Feng-ZZ-pwn/IOT/blob/main/Tenda%20AX12/1/README.md
CVE ID: CVE-2024-40414 State: PUBLISHED Published: 2024-07-15T00:00:00 Last Updated: 2024-08-02T04:33:11.687Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in /goform/SetNetControlList in the sub_656BC function in Tenda AX1806 1.0.0.1 firmware leads to stack-based buffer overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Feng-ZZ-pwn/IOT/blob/main/Tenda%20AX_1806/2/SetNetControlList.md
CVE ID: CVE-2024-40415 State: PUBLISHED Published: 2024-07-15T00:00:00 Last Updated: 2024-08-02T04:33:11.678Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in /goform/SetStaticRouteCfg in the sub_519F4 function in Tenda AX1806 1.0.0.1 firmware leads to stack-based buffer overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Feng-ZZ-pwn/IOT/blob/main/Tenda%20AX_1806/4/SetStaticRouteCfg.md
CVE ID: CVE-2024-40416 State: PUBLISHED Published: 2024-07-15T00:00:00 Last Updated: 2024-08-02T04:33:11.622Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in /goform/SetVirtualServerCfg in the sub_6320C function in Tenda AX1806 1.0.0.1 firmware leads to stack-based buffer overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Feng-ZZ-pwn/IOT/blob/main/Tenda%20AX_1806/3/SetVirtualServerCfg.md
CVE ID: CVE-2024-40417 State: PUBLISHED Published: 2024-07-10T00:00:00 Last Updated: 2024-08-02T04:33:11.659Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability was found in Tenda AX1806 1.0.0.1. Affected by this issue is the function formSetRebootTimer of the file /goform/SetIpMacBind. The manipulation of the argument list leads to stack-based buffer overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Feng-ZZ-pwn/IOT/blob/main/Tenda%20AX_1806/1/SetIpMacBind.md
CVE ID: CVE-2024-40420 State: REJECTED Published: 2024-07-17T00:00:00 Last Updated: 2024-12-18T19:39:52.454236Z Description: No description available.
CVE ID: CVE-2024-40422 State: PUBLISHED Published: 2024-07-24T00:00:00.000Z Last Updated: 2025-01-29T21:07:57.896Z Vendors: n/a Products: n/a Problem Types: n/a Description: The snapshot_path parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack. An attacker can manipulate the snapshot_path parameter to traverse directories and access sensitive files on the server. This can potentially lead to unauthorized access to critical system files and compromise the confidentiality and integrity of the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/stitionai/devika - htt
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/stitionai/devika - https://github.com/stitionai/devika/pull/619 - https://github.com/alpernae/CVE-2024-40422 - https://medium.com/@alpernae/uncovering-path-traversal-in-devika-v1-a-deep-dive-into-cve-2024-40422-f8ce81398b99
CVE ID: CVE-2024-40425 State: PUBLISHED Published: 2024-07-16T00:00:00 Last Updated: 2024-08-02T04:33:11.731Z Vendors: n/a Products: n/a Problem Types: n/a Description: File Upload vulnerability in Nanjin Xingyuantu Technology Co Sparkshop (Spark Mall B2C Mall v.1.1.6 and before allows a remote attacker to execute arbitrary code via the contorller/common.php component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/J1rrY-learn/26524d4714a81cf2d64583069e96f765
CVE ID: CVE-2024-40427 State: PUBLISHED Published: 2025-01-07T00:00:00 Last Updated: 2025-01-08T18:09:23.137Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack Buffer Overflow in PX4-Autopilot v1.14.3, which allows attackers to execute commands to exploit this vulnerability and cause the program to refuse to execute Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-55wq-2hgm-75m4 - https://github.com/PX4/PX4-Autopilot/commit/e03e0261a1a0c82f545e66a1e3795956c886db71
CVE ID: CVE-2024-40430 State: REJECTED Published: 2024-07-22T00:00:00 Last Updated: 2024-09-13T20:25:30.956707 Description: No description available.
CVE ID: CVE-2024-40431 State: PUBLISHED Published: 2024-10-23T00:00:00 Last Updated: 2024-10-24T17:43:32.664Z Vendors: n/a Products: n/a Problem Types: n/a Description: A lack of input validation in Realtek SD card reader driver before 10.0.26100.21374 through the implementation of the IOCTL_SCSI_PASS_THROUGH control of the SD card reader driver allows an attacker to write to predictable kernel memory locations, even as a low-privileged user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://zwclose.github.io/2024/10/14/rtsper1.html
CVE ID: CVE-2024-40432 State: PUBLISHED Published: 2024-10-23T00:00:00 Last Updated: 2024-10-24T16:02:25.189Z Vendors: n/a Products: n/a Problem Types: n/a Description: A lack of input validation in Realtek SD card reader driver before 10.0.26100.21374 through the implementation of the IOCTL_SFFDISK_DEVICE_COMMAND control of the SD card reader driver allows a privileged attacker to crash the OS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://zwclose.github.io/2024/10/14/rtsper1.html
CVE ID: CVE-2024-40433 State: PUBLISHED Published: 2024-07-26T00:00:00 Last Updated: 2024-08-02T04:33:11.623Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure Permissions vulnerability in Tencent wechat v.8.0.37 allows an attacker to escalate privileges via the web-view component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/yikaikkk/CookieShareInWebView/blob/master/README.md
CVE ID: CVE-2024-40441 State: PUBLISHED Published: 2024-09-23T00:00:00 Last Updated: 2024-09-24T16:02:12.013Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Doccano Open source annotation tools for machine learning practitioners v.1.8.4 and Doccano Auto Labeling Pipeline module to annotate a document automatically v.0.1.23 allows a remote attacker to escalate privileges via the model_attribs parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/doccano/doccano/releases/tag/v1.8.4 - https://github.com/doccano/auto-labeling-pipeline/releases/tag/v0.1.23 - https://github.com/gian2dchris/CVEs/tree/main/CVE-2024-40441
CVE ID: CVE-2024-40442 State: PUBLISHED Published: 2024-09-23T00:00:00 Last Updated: 2024-09-24T15:58:16.940Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Doccano Open source annotation tools for machine learning practitioners v.1.8.4 and Doccano Auto Labeling Pipeline module to annotate a document automatically v.0.1.23 allows a remote attacker to escalate privileges via a crafted REST Request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/doccano/doccano/releases/tag/v1.8.4 - https://github.com/doccano/auto-labeling-pipeline/releases/tag/v0.1.23 - https://github.com/gian2dchris/CVEs/tree/main/CVE-2024-40442
CVE ID: CVE-2024-40443 State: PUBLISHED Published: 2024-11-13T00:00:00.000Z Last Updated: 2025-03-13T13:37:45.487Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in Simple Laboratory Management System using PHP and MySQL v.1.0 allows a remote attacker to cause a denial of service via the delete_users function in the Useres.php Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/Yuma-Tsushima07/32bb887b791fec5c805557bedfec55c7 - https://github.com/Yuma-Tsushima07/CVE-2024-40443
CVE ID: CVE-2024-40445 State: PUBLISHED Published: 2025-04-22T00:00:00.000Z Last Updated: 2025-04-30T15:38:33.378Z Vendors: n/a Products: n/a Problem Types: n/a Description: A directory traversal vulnerability in forkosh Mime TeX before version 1.77 allows attackers on Windows systems to read or append arbitrary files by manipulating crafted input paths. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Oefenweb/mimetex/blob/master/mimetex.c#L12414-L12423 - https://youtu.be/W2KPHFNfgrg - https://youtu.be/OII16TteaJw - https://github.com/TaiYou-TW/CVE-2024-40445_CVE-2024-40446/
CVE ID: CVE-2024-40446 State: PUBLISHED Published: 2025-04-22T00:00:00.000Z Last Updated: 2025-04-23T14:51:22.252Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in forkosh Mime Tex before v.1.77 allows an attacker to execute arbitrary code via a crafted script Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://youtu.be/S3cmZkWIi6o - https://github.com/TaiYou-TW/CVE-2024-40445_CVE-2024-40446/
CVE ID: CVE-2024-40453 State: PUBLISHED Published: 2024-08-21T00:00:00 Last Updated: 2024-08-23T16:42:42.511Z Vendors: n/a Products: n/a Problem Types: n/a Description: squirrellyjs squirrelly v9.0.0 and fixed in v.9.0.1 was discovered to contain a code injection vulnerability via the component options.varName. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/squirrellyjs/squirrelly - https://samuzora.com/posts/cve-2024-40453 - https://github.com/squirrellyjs/squirrelly/pull/262
CVE ID: CVE-2024-40455 State: PUBLISHED Published: 2024-07-16T00:00:00.000Z Last Updated: 2025-03-13T14:31:31.650Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file deletion vulnerability in ThinkSAAS v3.7 allows attackers to delete arbitrary files via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gold-textbook-8ff.notion.site/ThinkSAAS-Arbitrary-folder-deletion-vulnerability-f992ed6124bc46ccaa8c2982274b17e2?pvs=25
CVE ID: CVE-2024-40456 State: PUBLISHED Published: 2024-07-16T00:00:00 Last Updated: 2024-08-02T04:33:11.578Z Vendors: n/a Products: n/a Problem Types: n/a Description: ThinkSAAS v3.7.0 was discovered to contain a SQL injection vulnerability via the name parameter at \system\action\update.php. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.notion.so/ThinkSAAS-administrator-backend-SQL-injection-3a5c8c72fc374446892f8dc81ec94923?pvs=4
CVE ID: CVE-2024-40457 State: PUBLISHED Published: 2024-09-12T00:00:00 Last Updated: 2024-10-31T19:43:08.722743 Vendors: n/a Products: n/a Problem Types: n/a Description: No-IP Dynamic Update Client (DUC) v3.x uses cleartext credentials that may occur on a command line or in a file. NOTE: the vendor's position is that cleartext in /etc/default/noip-duc is recommended and is the intentional behavior. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.noip.com/support/knowledgebase/install-linux-3-x-dynamic-update-client-duc - https://www.noip.com/support/knowledgebase/running-linux-duc-v3-0-startup-2 - https://github.com/jeppojeps/CVE-2024-40457-PoC
CVE ID: CVE-2024-40458 State: PUBLISHED Published: 2025-05-22T00:00:00.000Z Last Updated: 2025-05-22T20:31:28.115Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Ocuco Innovation Tracking.exe v.2.10.24.51 allows a local attacker to escalate privileges via the modification of TCP packets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://drive.google.com/file/d/1E8dxLt2LnvmLcCEUyp6qtnG-yZjyvMji/view?usp=drive_link - https://gist.githubusercontent.com/john0x186/1d9cc7fcc8386480d2bdaa9fdcfa914b/raw/d2d3d74ccaa939127ee2b03139061509a7dd238c/full-disclosure.md
CVE ID: CVE-2024-40459 State: PUBLISHED Published: 2025-05-22T00:00:00.000Z Last Updated: 2025-05-23T13:58:52.250Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Ocuco Innovation APPMANAGER.EXE v.2.10.24.51 allows a local attacker to escalate privileges via the application manager function Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://drive.google.com/file/d/1J2PsjRc6u2q4Teo3eVnBVmTEFjOgaPzX/view?usp=drive_link - https://gist.githubusercontent.com/john0x186/1d9cc7fcc8386480d2bdaa9fdcfa914b/raw/d2d3d74ccaa939127ee2b03139061509a7dd238c/full-disclosure.md
CVE ID: CVE-2024-40460 State: PUBLISHED Published: 2025-05-22T00:00:00.000Z Last Updated: 2025-05-23T14:49:44.622Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Ocuco Innovation v.2.10.24.51 allows a local attacker to escalate privileges via the JOBENTRY.EXE Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://drive.google.com/file/d/10M4x2jL_l-kPSZOOE_tUmBzCTCr0tMiF/view?usp=drive_link - https://gist.githubusercontent.com/john0x186/1d9cc7fcc8386480d2bdaa9fdcfa914b/raw/d2d3d74ccaa939127ee2b03139061509a7dd238c/full-disclosure.md
CVE ID: CVE-2024-40461 State: PUBLISHED Published: 2025-05-22T00:00:00.000Z Last Updated: 2025-05-23T15:52:47.939Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Ocuco Innovation v.2.10.24.51 allows a local attacker to escalate privileges via the STOCKORDERENTRY.EXE component Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://drive.google.com/file/d/1DyiyLQRvTRAZD8gn2BT7oDzX1NQ7wmFT/view?usp=drive_link - https://gist.githubusercontent.com/john0x186/1d9cc7fcc8386480d2bdaa9fdcfa914b/raw/d2d3d74ccaa939127ee2b03139061509a7dd238c/full-disclosure.md
CVE ID: CVE-2024-40462 State: PUBLISHED Published: 2025-05-22T00:00:00.000Z Last Updated: 2025-05-23T15:51:57.646Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Ocuco Innovation v.2.10.24.51 allows a local attacker to escalate privileges via the SETTINGSVATIGATOR.EXE component Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://drive.google.com/file/d/1MDU9FGo36U83yQy55nnVj1syWVy9WLm5/view?usp=drive_link - https://gist.githubusercontent.com/john0x186/1d9cc7fcc8386480d2bdaa9fdcfa914b/raw/d2d3d74ccaa939127ee2b03139061509a7dd238c/full-disclosure.md
CVE ID: CVE-2024-40464 State: PUBLISHED Published: 2024-07-31T00:00:00 Last Updated: 2024-08-06T17:58:28.660Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the sendMail function located in beego/core/logs/smtp.go file Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/nyxfqq/b53b0148b9aa040de63f58a68fd11445
CVE ID: CVE-2024-40465 State: PUBLISHED Published: 2024-07-31T00:00:00 Last Updated: 2024-08-02T18:17:18.236Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the getCacheFileName function in file.go file Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/nyxfqq/a5a2fc5147a1b34538e1ac05a3e56910
CVE ID: CVE-2024-40472 State: PUBLISHED Published: 2024-08-09T00:00:00 Last Updated: 2024-08-09T15:17:13.501Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Daily Calories Monitoring Tool v1.0 is vulnerable to SQL Injection via "delete-calorie.php." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php/17445/daily-calories-monitoring-tool-using-php-and-mysql-source-code.html - https://github.com/takekaramey/CVE_Writeup/blob/main/Sourcecodester/Daily%20Calories%20Monitoring%20Tool%20v1.0/SQL%20Injection.pdf
CVE ID: CVE-2024-40473 State: PUBLISHED Published: 2024-08-08T00:00:00 Last Updated: 2024-09-03T18:20:45.666Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross Site Scripting (XSS) vulnerability was found in "manage_houses.php" in SourceCodester Best House Rental Management System v1.0. It allows remote attackers to execute arbitrary code via "House_no" and "Description" parameter fields. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php/17375/best-courier-management-system-project-php.html - https://github.com/takekaramey/CVE_Writeup/blob/main/Sourcecodester/Best%20House%20Rental%20Management%20System%20v1.0/Stored%20
github.com/takekaramey/CVE_Writeup/blob/main/Sourcecodester/Best%20House%20Rental%20Management%20System%20v1.0/Stored%20XSS.pdf
CVE ID: CVE-2024-40474 State: PUBLISHED Published: 2024-08-08T00:00:00 Last Updated: 2024-08-09T17:47:02.990Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Reflected Cross Site Scripting (XSS) vulnerability was found in "edit-cate.php" in SourceCodester House Rental Management System v1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php/17375/best-courier-management-system-project-php.html - https://github.com/takekaramey/CVE_Writeup/blob/main/Sourcecodester/Best%20House%20Rental%20Management%20System%20v1.0/Reflected%20XSS.pdf
CVE ID: CVE-2024-40475 State: PUBLISHED Published: 2024-08-08T00:00:00 Last Updated: 2024-08-09T14:59:46.678Z Vendors: n/a Products: n/a Problem Types: n/a Description: SourceCodester Best House Rental Management System v1.0 is vulnerable to Incorrect Access Control via /rental/payment_report.php, /rental/balance_report.php, /rental/invoices.php, /rental/tenants.php, and /rental/users.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php/17375/best-courier-management-system-project-php.html - https://github.com/takekaramey/CVE_Writeup/blob/main/Sourcecodester/Best%20House%20Rental%20Management%20System%20v1.0/Broken%20Access%20Control%20-%20
CVE_Writeup/blob/main/Sourcecodester/Best%20House%20Rental%20Management%20System%20v1.0/Broken%20Access%20Control%20-%20Deep%20URL.pdf
CVE ID: CVE-2024-40476 State: PUBLISHED Published: 2024-08-08T00:00:00 Last Updated: 2024-08-09T17:48:49.815Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) vulnerability was found in SourceCodester Best House Rental Management System v1.0. This could lead to an attacker tricking the administrator into adding/modifying/deleting valid tenant data via a crafted HTML page, as demonstrated by a Delete Tenant action at the /rental/ajax.php?action=delete_tenant. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php/17375/best-courier-management-system-project-php.html - https://github.com/takekaramey/CVE_
//www.sourcecodester.com/php/17375/best-courier-management-system-project-php.html - https://github.com/takekaramey/CVE_Writeup/blob/main/Sourcecodester/Best%20House%20Rental%20Management%20System%20v1.0/CSRF.pdf