Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-6246 State: PUBLISHED Published: 2024-11-22T20:05:40.747Z Last Updated: 2024-12-04T21:43:36.425Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Wyze Products: Cam v3 Problem Types: CWE-122 Description: Wyze Cam v3 Realtek Wi-Fi Driver Heap-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Wyze Cam v3 IP cameras. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Realtek Wi-Fi kernel module. The issue results from the lack of proper validation of the length of user-supplied data
he Realtek Wi-Fi kernel module. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the kernel. Was ZDI-CAN-22310. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-837/
CVE ID: CVE-2024-6247 State: PUBLISHED Published: 2024-11-22T20:05:41.877Z Last Updated: 2024-12-04T21:43:24.007Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Wyze Products: Cam v3 Problem Types: CWE-78 Description: Wyze Cam v3 Wi-Fi SSID OS Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Wyze Cam v3 IP cameras. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of SSIDs embedded in scanned QR codes. The issue results from the lack of proper validation of a user-supplied string before
IDs embedded in scanned QR codes. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-22337. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-838/ - https://forums.wyze.com/t/security-advisory/289256
CVE ID: CVE-2024-6248 State: PUBLISHED Published: 2024-11-22T20:05:42.870Z Last Updated: 2024-12-04T21:43:13.028Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Wyze Products: Cam v3 Problem Types: CWE-287 Description: Wyze Cam v3 Cloud Infrastructure Improper Authentication Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Wyze Cam v3 IP cameras. Authentication is not required to exploit this vulnerability. The specific flaw exists within the run_action_batch endpoint of the cloud infrastructure. The issue results from the use of the device's MAC address as a sole
action_batch endpoint of the cloud infrastructure. The issue results from the use of the device's MAC address as a sole credential for authentication. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-22393. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-839/ - https://forums.wyze.com/t/security-advisory/289256
CVE ID: CVE-2024-6249 State: PUBLISHED Published: 2024-11-22T20:05:46.118Z Last Updated: 2024-12-04T21:35:15.193Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Wyze Products: Cam v3 Problem Types: CWE-121 Description: Wyze Cam v3 TCP Traffic Handling Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Wyze Cam v3 IP cameras. Authentication is not required to exploit this vulnerability. The specific flaw exists within the TUTK P2P library. The issue results from the lack of proper validation of the length of user-supplied data prior to copy
TUTK P2P library. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-22419. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-840/ - https://forums.wyze.com/t/security-advisory/289256
CVE ID: CVE-2024-6250 State: PUBLISHED Published: 2024-06-27T18:41:41.259Z Last Updated: 2024-08-01T21:33:05.318Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: parisneo Products: parisneo/lollms-webui Problem Types: CWE-36 Description: An absolute path traversal vulnerability exists in parisneo/lollms-webui v9.6, specifically in the `open_file` endpoint of `lollms_advanced.py`. The `sanitize_path` function with `allow_absolute_path=True` allows an attacker to access arbitrary files and directories on a Windows system. This vulnerability can be exploited to read any file and list arbitrary directories on the affected system. Additional Analyst Notes: - CISA A
be exploited to read any file and list arbitrary directories on the affected system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/11a8bf9d-16f3-49b3-b5fc-ad36d8993c73
CVE ID: CVE-2024-6251 State: PUBLISHED Published: 2024-06-22T11:31:03.392Z Last Updated: 2024-08-01T21:33:05.179Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: n/a Products: playSMS Problem Types: CWE-80 Description: A vulnerability, which was classified as problematic, was found in playSMS 1.4.3. Affected is an unknown function of the file /index.php?app=main&inc=feature_phonebook&op=phonebook_list of the component New Phonebook Handler. The manipulation of the argument name/email leads to basic cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-269418 is the identifier assigned to this vulnera
ely. The exploit has been disclosed to the public and may be used. VDB-269418 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.269418 - https://vuldb.com/?ctiid.269418 - https://vuldb.com/?submit.355495
CVE ID: CVE-2024-6252 State: PUBLISHED Published: 2024-06-22T12:00:09.896Z Last Updated: 2024-08-01T21:33:05.336Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: Zorlan Products: SkyCaiji Problem Types: CWE-79 Description: A vulnerability has been found in Zorlan SkyCaiji up to 2.8 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Task Handler. The manipulation of the argument onerror leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269419. Additional Analyst Notes: - CISA ADP Vulnrichment
e used. The associated identifier of this vulnerability is VDB-269419. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.269419 - https://vuldb.com/?ctiid.269419 - https://vuldb.com/?submit.355783 - https://fushuling.com/index.php/2024/06/13/test2/
CVE ID: CVE-2024-6253 State: PUBLISHED Published: 2024-06-22T14:00:04.365Z Last Updated: 2024-08-01T21:33:05.507Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: itsourcecode Products: Online Food Ordering System Problem Types: CWE-89 Description: A vulnerability was found in itsourcecode Online Food Ordering System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /purchase.php. The manipulation of the argument customer leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-269420. Additional Analyst Notes: - CISA ADP Vul
the public and may be used. The identifier of this vulnerability is VDB-269420. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.269420 - https://vuldb.com/?ctiid.269420 - https://vuldb.com/?submit.361840 - https://github.com/Desenchanted/cve/issues/1
CVE ID: CVE-2024-6254 State: PUBLISHED Published: 2024-08-08T03:30:45.320Z Last Updated: 2024-08-08T13:11:38.209Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: themefusecom Products: Brizy – Page Builder Problem Types: CWE-20 Description: The Brizy – Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.1. This is due to missing or incorrect nonce validation on form submissions. This makes it possible for unauthenticated attackers to submit forms intended for public use as another user via a forged request granted they can trick a site administrator into performing an action such as clicking
another user via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. On sites where unfiltered_html is enabled, this can lead to the admin unknowingly adding a Stored Cross-Site Scripting payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/75ec04f1-8bea-4514-b1d0-da5b305219d7?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3129495%40brizy%2Ftrunk&old=3125955%40brizy%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-6255 State: PUBLISHED Published: 2024-07-31T00:00:15.258Z Last Updated: 2024-08-30T15:29:49.126Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: gaizhenbiao Products: gaizhenbiao/chuanhuchatgpt Problem Types: CWE-22 Description: A vulnerability in the JSON file handling of gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to delete any JSON file on the server, including critical configuration files such as `config.json` and `ds_config_chatbot.json`. This issue arises due to improper validation of file paths, enabling directory traversal attacks. An attacker can exploit this vulnerability to disrupt the functioning of the system, mani
g directory traversal attacks. An attacker can exploit this vulnerability to disrupt the functioning of the system, manipulate settings, or potentially cause data loss or corruption. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/48f3e370-6dcd-4f38-9350-d0419b3a7f82
CVE ID: CVE-2024-6256 State: PUBLISHED Published: 2024-07-11T06:43:12.663Z Last Updated: 2024-08-01T21:33:05.342Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: smub Products: Feeds for YouTube (YouTube video, channel, and gallery plugin) Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Feeds for YouTube (YouTube video, channel, and gallery plugin) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'youtube-feed' shortcode in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping on user supplied attributes.
ions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/228fab65-e5c2-41d1-ad41-fac4862894f2?source=cve - https://plugins.trac.wordpress.org/browser/feeds-for-youtube/trunk/js/sb-youtube.js - https://plugins.trac.wordpress.org/changeset/3107577/
CVE ID: CVE-2024-6257 State: PUBLISHED Published: 2024-06-25T16:31:03.882Z Last Updated: 2024-08-01T21:33:05.245Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: HashiCorp Products: Shared library Problem Types: CWE-77 Description: HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://discuss.hashicorp.com/t/hcsec-2024-13-hashicorp-go-getter-vulnerable-to-code-execution-on-git-update-via-git-config-manipulation/68081
CVE ID: CVE-2024-6258 State: PUBLISHED Published: 2024-09-13T19:05:53.783Z Last Updated: 2025-09-17T05:19:33.852Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: zephyrproject-rtos Products: Zephyr Problem Types: CWE-122, CWE-191 Description: BT: Missing length checks of net_buf in rfcomm_handle_data Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-7833-fcpm-3ggm
CVE ID: CVE-2024-6259 State: PUBLISHED Published: 2024-09-13T20:17:58.827Z Last Updated: 2025-09-17T14:07:02.900Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: zephyrproject-rtos Products: Zephyr Problem Types: CWE-787, CWE-122 Description: BT: HCI: adv_ext_report Improper discarding in adv_ext_report Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-p5j7-v26w-wmcp
CVE ID: CVE-2024-6260 State: PUBLISHED Published: 2024-11-22T20:05:47.059Z Last Updated: 2024-12-05T14:43:46.511Z Severity: HIGH (CVSS 7 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Malwarebytes Products: Anti-Malware Problem Types: CWE-59 Description: Malwarebytes Antimalware Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Malwarebytes Antimalware. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Malwarebytes service. By creating a symbolic link, an attacker ca
his vulnerability. The specific flaw exists within the Malwarebytes service. By creating a symbolic link, an attacker can abuse the service to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22321. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1195/ - https://www.malwarebytes.com/secure/cves
CVE ID: CVE-2024-6261 State: PUBLISHED Published: 2025-02-27T05:23:05.160Z Last Updated: 2025-02-27T18:44:14.030Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpchill Products: Image Photo Gallery Final Tiles Grid Problem Types: CWE-79 Description: The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'FinalTilesGallery' shortcode in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in
es it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8d945c4b-3eb1-4bab-b355-117b7fd06553?source=cve - https://plugins.trac.wordpress.org/browser/final-tiles-grid-gallery-lite/trunk/lightbox/lightbox2/js/script.js - https://plugins.trac.wordpress.org/changeset/3123808/
CVE ID: CVE-2024-6262 State: PUBLISHED Published: 2024-06-27T11:03:35.358Z Last Updated: 2024-08-01T21:33:05.175Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: awordpresslife Products: Portfolio Gallery – Image Gallery Plugin Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Portfolio Gallery – Image Gallery Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'PFG' shortcode in all versions up to, and including, 1.6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated a
ufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/adf6b34b-a362-4cfe-b062-8bbe11584581?source=cve - https://plugins.trac.wordpress.org/browser/portfolio-filter-gallery/trunk/lightbox/ld-lightbox/js/lightbox.js - https://plugins.trac.wordpress.org/changeset/3107963/
CVE ID: CVE-2024-6263 State: PUBLISHED Published: 2024-07-03T07:32:38.112Z Last Updated: 2024-08-01T21:33:05.332Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: smub Products: WP Lightbox 2 Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WP Lightbox 2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 3.0.6.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that
ble for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fe275351-a547-440d-9e8c-c464ed333aa9?source=cve - https://plugins.trac.wordpress.org/browser/wp-lightbox-2/trunk/wp-lightbox-2.js - https://plugins.trac.wordpress.org/changeset?new=3108386%40wp-lightbox-2&old=3046989%40wp-lightbox-2
CVE ID: CVE-2024-6264 State: PUBLISHED Published: 2024-07-02T11:01:36.324Z Last Updated: 2024-08-01T21:33:05.211Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: gandhihitesh9 Products: Post Meta Data Manager Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Post Meta Data Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘$meta_key’ parameter in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitra
escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9dd6828b-6235-4284-bce6-be23b79ac70e?source=cve - https://plugins.trac.wordpress.org/browser/post-meta-data-manager/trunk/includes/admin/html/pmdm_wp_display_post_metadata_html.php#L23 - https://plugins.trac.wordpress.org/browser/post-meta-data-manager/trunk/includes/admin/html/pmdm_wp_display_term_metadata_html.php#L32 - https://plugins.trac.wo
er/post-meta-data-manager/trunk/includes/admin/html/pmdm_wp_display_term_metadata_html.php#L32 - https://plugins.trac.wordpress.org/browser/post-meta-data-manager/trunk/includes/admin/html/pmdm_wp_display_user_metadata_html.php#L31 - https://plugins.trac.wordpress.org/changeset/3109558/
CVE ID: CVE-2024-6265 State: PUBLISHED Published: 2024-06-29T04:33:28.424Z Last Updated: 2024-08-01T21:33:05.206Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: stiofansisland Products: UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘uwp_sort_by’ parameter in all versions up to, and including, 1.2.10 due
vulnerable to time-based SQL Injection via the ‘uwp_sort_by’ parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/37fd0582-5baf-4ced-a798-dc0970e90a3e?source=cve - https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.10/admin/settings/
-5baf-4ced-a798-dc0970e90a3e?source=cve - https://plugins.trac.wordpress.org/browser/userswp/tags/1.2.10/admin/settings/class-uwp-settings-user-sorting.php#L45 - https://plugins.trac.wordpress.org/changeset/3106884/
CVE ID: CVE-2024-6266 State: PUBLISHED Published: 2024-06-23T02:00:10.066Z Last Updated: 2024-08-01T21:33:05.370Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: Pear Admin Boot Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in Pear Admin Boot up to 2.0.2. Affected is an unknown function of the file /system/dictData/loadDictItem. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-269478 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: -
ssigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.269478 - https://vuldb.com/?ctiid.269478 - https://gitee.com/pear-admin/Pear-Admin-Boot/issues/IA5K2M
CVE ID: CVE-2024-6267 State: PUBLISHED Published: 2024-06-23T06:00:06.027Z Last Updated: 2024-08-01T21:33:05.333Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: SourceCodester Products: Service Provider Management System Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in SourceCodester Service Provider Management System 1.0. Affected by this vulnerability is an unknown functionality of the file system_info/index.php of the component System Info Page. The manipulation of the argument System Name/System Short Name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269479. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.269479 - https://vuldb.com/?ctiid.269479 - https://vuldb.com/?submit.362661 - https://docs.google.com/document/d/1upC4101Ob9UW7fGC_valsEa45Q5xuBgcKZhs1Q-WoBM/edit?usp=sharing - https://github.com/sgr-xd/CVEs/blob/main/CVE-2024-6267.md