Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-10176 State: PUBLISHED Published: 2024-10-24T11:03:16.823Z Last Updated: 2024-10-24T19:34:41.639Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: mra13 Products: Compact WP Audio Player Problem Types: CWE-79 Description: The Compact WP Audio Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sc_embed_player shortcode in all versions up to, and including, 1.9.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenev
ed attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bba90659-09a8-470a-91d3-d1986562672a?source=cve - https://plugins.trac.wordpress.org/browser/compact-wp-audio-player/trunk/shortcodes-functions.php#L79 - https://wordpress.org/plugins/compact-wp-audio-player/#developers - https://plugins.trac.wordpress.org/changeset/3173541/
CVE ID: CVE-2024-10177 State: PUBLISHED Published: 2024-11-21T02:06:48.785Z Last Updated: 2024-11-21T11:30:09.571Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: markkinchin Products: Beds24 Online Booking Problem Types: CWE-79 Description: The Beds24 Online Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's beds24-link shortcode in all versions up to, and including, 2.0.26 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever
attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e2a6d017-93e4-40c6-a7d1-07e00faecf36?source=cve - https://wordpress.org/plugins/beds24-online-booking/#developers
CVE ID: CVE-2024-10178 State: PUBLISHED Published: 2024-12-05T04:23:53.349Z Last Updated: 2024-12-05T11:13:25.292Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: gutentor Products: Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor Problem Types: CWE-79 Description: The Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and including, 3.3.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and
aping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/17ecebfd-b07f-415f-892f-e069ab84031a?source=cve - https://wordpress.org/plugins/gutentor/#developers - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3199233%40gutentor%2Ftrunk&old=3179242%40gutentor%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-10179 State: PUBLISHED Published: 2024-11-12T06:48:14.450Z Last Updated: 2024-11-12T11:21:59.199Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpslickstream Products: Slickstream: Engagement and Conversions Problem Types: CWE-79 Description: The Slickstream: Engagement and Conversions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's slick-grid shortcode in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts
makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/28216197-20b4-4d12-a610-661dca6fbbf2?source=cve - https://wordpress.org/plugins/slick-engagement/#developers - https://plugins.trac.wordpress.org/changeset/3184136/
CVE ID: CVE-2024-10180 State: PUBLISHED Published: 2024-10-24T12:32:58.112Z Last Updated: 2024-10-24T13:39:37.489Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: felipeelia Products: Contact Form 7 – Repeatable Fields Problem Types: CWE-79 Description: The Contact Form 7 – Repeatable Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's field_group shortcode in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages th
ssible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0782bc16-7d21-4205-af01-97e3ad3db40b?source=cve - https://wordpress.org/plugins/cf7-repeatable-fields/#developers - https://plugins.trac.wordpress.org/changeset/3173935/
CVE ID: CVE-2024-10181 State: PUBLISHED Published: 2024-10-29T11:32:51.705Z Last Updated: 2024-10-29T14:26:59.007Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: contrid Products: Newsletters Problem Types: CWE-79 Description: The Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's newsletters_video shortcode in all versions up to, and including, 4.9.9.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses
contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/915c46f9-a342-4cc6-a726-2f1581a5d481?source=cve - https://wordpress.org/plugins/newsletters-lite/#developers - https://plugins.trac.wordpress.org/changeset/3175816/
CVE ID: CVE-2024-10182 State: PUBLISHED Published: 2024-12-12T04:23:13.149Z Last Updated: 2024-12-12T16:03:25.275Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Cognito Apps Products: Cognito Forms Problem Types: CWE-79 Description: The Cognito Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 2.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes:
ct arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/80b1d728-b5aa-4811-b92a-9ce36abc2b80?source=cve - https://wordpress.org/plugins/cognito-forms/#developers - https://plugins.trac.wordpress.org/browser/cognito-forms/trunk/cognito-forms.php#L51 - https://plugins.trac.wordpress.org/browser/cognito-forms/trunk/cognito-forms.php#L193 - https://plugins.trac.wordpress.org/browser/cognito-forms/trunk/api.php#L46 - https://plugins.trac.wordpress.org/browser/cognito-forms/trunk/api.php#L50
CVE ID: CVE-2024-10183 State: PUBLISHED Published: 2024-10-22T17:50:53.752Z Last Updated: 2024-10-22T18:11:54.102Z Vendors: Jamf Products: Pro Problem Types: CWE-276 Description: A vulnerability in Jamf Pro's Jamf Remote Assist tool allows a local, non-privileged user to escalate their privileges to root on MacOS systems. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://learn.jamf.com/en-US/bundle/jamf-remote-assist-release-notes/page/Jamf_Remote_Assist_Release_History.html#ariaid-title4
CVE ID: CVE-2024-10184 State: PUBLISHED Published: 2024-10-29T11:01:33.824Z Last Updated: 2024-10-29T14:28:31.699Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: streamweasels Products: StreamWeasels Kick Integration Problem Types: CWE-79 Description: The StreamWeasels Kick Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sw-kick-embed shortcode in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that
ble for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/077a31e7-de4b-418f-ac90-5c51a690bc65?source=cve - https://wordpress.org/plugins/streamweasels-kick-integration/#developers - https://plugins.trac.wordpress.org/changeset/3176023
CVE ID: CVE-2024-10185 State: PUBLISHED Published: 2024-10-29T11:01:34.508Z Last Updated: 2024-10-29T15:20:53.590Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: streamweasels Products: StreamWeasels YouTube Integration Problem Types: CWE-79 Description: The StreamWeasels YouTube Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sw-youtube-embed shortcode in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pa
it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/41f6b12e-49bb-4bee-bbde-ce4e5ebd4cad?source=cve - https://wordpress.org/plugins/streamweasels-youtube-integration/#developers - https://plugins.trac.wordpress.org/changeset/3176030
CVE ID: CVE-2024-10186 State: PUBLISHED Published: 2024-11-06T12:43:13.684Z Last Updated: 2024-11-06T13:19:57.726Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bastho Products: Event post Problem Types: CWE-79 Description: The Event post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's events_cal shortcode in all versions up to, and including, 5.9.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected
level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f3ae1c32-18a7-4109-a7ea-dfd18fa3a8e2?source=cve - https://wordpress.org/plugins/event-post/#developers - https://plugins.trac.wordpress.org/changeset/3182549/
CVE ID: CVE-2024-10187 State: PUBLISHED Published: 2024-11-08T09:29:33.990Z Last Updated: 2024-11-08T14:05:11.113Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpexpertsio Products: myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification Problem Types: CWE-79 Description: The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mycred_li
ce credits for Gamification plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mycred_link shortcode in all versions up to, and including, 2.7.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/23a081d4-443d-4b3b-8c89-9eb0e23c961e?source=cve - https://wordpress.org/plugins/mycred/#developers - https://plugins.
id/23a081d4-443d-4b3b-8c89-9eb0e23c961e?source=cve - https://wordpress.org/plugins/mycred/#developers - https://plugins.trac.wordpress.org/changeset/3183178/
CVE ID: CVE-2024-10188 State: PUBLISHED Published: 2025-03-20T10:10:48.124Z Last Updated: 2025-03-20T18:16:28.780Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: berriai Products: berriai/litellm Problem Types: CWE-400 Description: A vulnerability in BerriAI/litellm, as of commit 26c03c9, allows unauthenticated users to cause a Denial of Service (DoS) by exploiting the use of ast.literal_eval to parse user input. This function is not safe and is prone to DoS attacks, which can crash the litellm Python server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/96a32812-213c-4819-ba4e-36143d35e95b - https://github.com/be
ADP Vulnrichment: References: - https://huntr.com/bounties/96a32812-213c-4819-ba4e-36143d35e95b - https://github.com/berriai/litellm/commit/21156ff5d0d84a7dd93f951ca033275c77e4f73c
CVE ID: CVE-2024-10189 State: PUBLISHED Published: 2024-10-22T09:32:10.182Z Last Updated: 2024-10-22T13:09:03.367Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: jeswd Products: Anchor Episodes Index (Spotify for Podcasters) Problem Types: CWE-79 Description: The Anchor Episodes Index (Spotify for Podcasters) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's anchor_episodes shortcode in all versions up to, and including, 2.1.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary
ibutes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8c8e37f8-708e-41d5-a6b8-3ba587437532?source=cve - https://wordpress.org/plugins/anchor-episodes-index/#developers - https://plugins.trac.wordpress.org/changeset/3171752/
CVE ID: CVE-2024-10190 State: PUBLISHED Published: 2025-03-20T10:09:52.689Z Last Updated: 2025-10-15T12:50:07.797Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: horovod Products: horovod/horovod Problem Types: CWE-502 Description: Horovod versions up to and including v0.28.1 are vulnerable to unauthenticated remote code execution. The vulnerability is due to improper handling of base64-encoded data in the `ElasticRendezvousHandler`, a subclass of `KVStoreHandler`. Specifically, the `_put_value` method in `ElasticRendezvousHandler` calls `codec.loads_base64(value)`, which eventually invokes `cloudpickle.loads(decoded)`. This allows an attacker to send a m
`codec.loads_base64(value)`, which eventually invokes `cloudpickle.loads(decoded)`. This allows an attacker to send a malicious pickle object via a PUT request, leading to arbitrary code execution on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/3e398d1f-70c2-4e05-ae22-f5d66b19a754
CVE ID: CVE-2024-10191 State: PUBLISHED Published: 2024-10-20T05:31:05.194Z Last Updated: 2024-10-21T18:01:56.678Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: PHPGurukul Products: Boat Booking System Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in PHPGurukul Boat Booking System 1.0. This affects an unknown part of the file /admin/book-details.php of the component Booking Details Page. The manipulation of the argument Official Remark leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Re
ely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280965 - https://vuldb.com/?ctiid.280965 - https://vuldb.com/?submit.426734 - https://github.com/jadu101/CVE/blob/main/phpgurukul_boat_booking_system_booking_details_xss.md - https://phpgurukul.com/
CVE ID: CVE-2024-10192 State: PUBLISHED Published: 2024-10-20T07:00:07.825Z Last Updated: 2024-10-21T18:02:38.373Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: PHPGurukul Products: IFSC Code Finder Project Problem Types: CWE-79 Description: A vulnerability has been found in PHPGurukul IFSC Code Finder Project 1.0 and classified as problematic. This vulnerability affects unknown code of the file search.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280966 - https://vuldb.com/?ctiid.280966
al Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280966 - https://vuldb.com/?ctiid.280966 - https://vuldb.com/?submit.426759 - https://github.com/jadu101/CVE/blob/main/phpgurukul_ifsc_code_finder_search_xss.md - https://phpgurukul.com/
CVE ID: CVE-2024-10193 State: PUBLISHED Published: 2024-10-20T07:31:05.305Z Last Updated: 2024-10-21T16:16:50.003Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: WAVLINK Products: WN530H4, WN530HG4, WN572HG3 Problem Types: CWE-77 Description: A vulnerability was found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028 and classified as critical. This issue affects the function ping_ddns of the file internet.cgi. The manipulation of the argument DDNS leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional An
blic and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280967 - https://vuldb.com/?ctiid.280967 - https://vuldb.com/?submit.422811 - https://docs.google.com/document/d/13XWnFITW31u5J8HeQj8Zm-7oLt-M1DtQ/
CVE ID: CVE-2024-10194 State: PUBLISHED Published: 2024-10-20T08:00:06.181Z Last Updated: 2024-10-21T19:54:26.267Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: WAVLINK Products: WN530H4, WN530HG4, WN572HG3 Problem Types: CWE-121 Description: A vulnerability was found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028. It has been classified as critical. Affected is the function Goto_chidx of the file login.cgi of the component Front-End Authentication Page. The manipulation of the argument wlanUrl leads to stack-based buffer overflow. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be use
. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280968 - https://vuldb.com/?ctiid.280968 - https://vuldb.com/?submit.422834 - https://docs.google.com/document/d/1PodIMRe1f0Ql83jUXV5VIoc-Xsf9VC1K
CVE ID: CVE-2024-10195 State: PUBLISHED Published: 2024-10-20T08:31:03.986Z Last Updated: 2024-10-21T19:28:34.492Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: Tecno Products: 4G Portable WiFi TR118 Problem Types: CWE-89 Description: A vulnerability was found in Tecno 4G Portable WiFi TR118 V008-20220830. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /goform/goform_get_cmd_process of the component SMS Check. The manipulation of the argument order_by leads to sql injection. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes:
remotely. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280969 - https://vuldb.com/?ctiid.280969 - https://vuldb.com/?submit.422994 - https://asciinema.org/a/2mwkmDqRZfeAYTu5hHre1r4QB
CVE ID: CVE-2024-10196 State: PUBLISHED Published: 2024-10-21T00:00:07.378Z Last Updated: 2024-10-21T19:13:38.953Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Pharmacy Management System Problem Types: CWE-89 Description: A vulnerability was found in code-projects Pharmacy Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /add_new_invoice.php. The manipulation of the argument text leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281021 - h
ublic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281021 - https://vuldb.com/?ctiid.281021 - https://vuldb.com/?submit.426862 - https://gist.github.com/higordiego/be616d2853a9f1820d8558fc00e97e24 - https://code-projects.org/
CVE ID: CVE-2024-10197 State: PUBLISHED Published: 2024-10-21T00:31:03.601Z Last Updated: 2024-10-21T18:58:20.306Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: code-projects Products: Pharmacy Management System Problem Types: CWE-79 Description: A vulnerability was found in code-projects Pharmacy Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file /manage_supplier.php of the component Manage Supplier Page. The manipulation of the argument address leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as we
attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281022 - https://vuldb.com/?ctiid.281022 - https://vuldb.com/?submit.426884 - https://gist.github.com/higordiego/bc051be4a8c6b6641578cad533742aab - https://code-projects.org/