Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-2242 State: PUBLISHED Published: 2024-03-13T21:32:56.042Z Last Updated: 2024-08-01T19:03:39.453Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: takayukister Products: Contact Form 7 Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘active-tab’ parameter in all versions up to, and including, 5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can succes
makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d5bf4972-424a-4470-a0bc-7dcc95378e0e?source=cve - https://plugins.trac.wordpress.org/changeset/3049594/contact-form-7/trunk/admin/edit-contact-form.php
CVE ID: CVE-2024-2243 State: PUBLISHED Published: 2024-04-10T10:14:47.671Z Last Updated: 2025-11-04T22:05:38.828Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Problem Types: CWE-78 Description: A vulnerability was found in csmock where a regular user of the OSH service (anyone with a valid Kerberos ticket) can use the vulnerability to disclose the confidential Snyk authentication token and to run arbitrary commands on OSH workers. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2024-2243 - https://bugzilla.redhat.com/show_bug.cgi?id=2267336
CVE ID: CVE-2024-2244 State: PUBLISHED Published: 2024-03-27T01:16:43.344Z Last Updated: 2024-08-06T20:48:55.300Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Hitachi Energy Products: Asset Suite EAM Problem Types: CWE-287 Description: REST service authentication anomaly with “valid username/no password” credential combination for batch job processing resulting in successful service invocation. The anomaly doesn’t exist with other credential combinations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://publisher.hitachienergy.com/preview?DocumentId=8DBD000195&languageCode=en&Preview=true
CVE ID: CVE-2024-2245 State: PUBLISHED Published: 2024-03-07T13:10:55.947Z Last Updated: 2024-08-01T19:03:39.451Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: moziloCMS Products: moziloCMS Problem Types: CWE-79 Description: Cross-Site Scripting vulnerability in moziloCMS version 2.0. By sending a POST request to the '/install.php' endpoint, a JavaScript payload could be executed in the 'username' parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-mozilocms
CVE ID: CVE-2024-2247 State: PUBLISHED Published: 2024-03-13T14:06:57.151Z Last Updated: 2024-08-01T19:03:39.114Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: JFrog Products: Artifactory Problem Types: CWE-79 Description: JFrog Artifactory versions below 7.77.7, 7.82.1, are vulnerable to DOM-based cross-site scripting due to improper handling of the import override mechanism. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://jfrog.com/help/r/jfrog-release-information/jfrog-security-advisories
CVE ID: CVE-2024-2248 State: PUBLISHED Published: 2024-05-15T13:13:29.213Z Last Updated: 2024-08-01T19:03:39.335Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H) Vendors: JFrog Products: Artifactory Problem Types: CWE-20 Description: A Header Injection vulnerability in the JFrog platform in versions below 7.85.0 (SaaS) and 7.84.7 (Self-Hosted) may allow threat actors to take over the end user's account when clicking on a specially crafted URL sent to the victim’s user email. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://jfrog.com/help/r/jfrog-release-information/jfrog-security-advisories
CVE ID: CVE-2024-2249 State: PUBLISHED Published: 2024-03-14T21:33:39.329Z Last Updated: 2024-08-01T19:03:39.165Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: choijun Products: LA-Studio Element Kit for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the LinkWrapper attribute found in several widgets in all versions up to, and including, 1.3.7.4 due to insufficient input sanitization and output escaping the user supplied attribute. This makes it possible for authenti
to insufficient input sanitization and output escaping the user supplied attribute. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5113170a-5a53-4e53-84e6-56d9ba0740ed?source=cve - https://plugins.trac.wordpress.org/changeset/3050316/lastudio-element-kit/trunk/includes/extensions/elementor/wrapper-link.php
CVE ID: CVE-2024-2250 State: PUBLISHED Published: 2024-03-29T07:31:02.328Z Last Updated: 2024-08-01T19:03:39.183Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: xpro Products: 140+ Widgets | Best Addons For Elementor – FREE Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The 130+ Widgets | Best Addons For Elementor – FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attac
cient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/07e7f03e-0d5d-4405-a0e7-9547fc762f0e?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3059693%40xpro-elementor-addons&new=3059693%40xpro-elementor-addons&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2252 State: PUBLISHED Published: 2024-03-13T15:27:22.628Z Last Updated: 2024-08-01T19:03:39.232Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: droitthemes Products: Droit Elementor Addons – Widgets, Blocks, Templates Library For Elementor Builder Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Droit Elementor Addons – Widgets, Blocks, Templates Library For Elementor Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 3.1.5 due to insufficient input sanitization and output escaping
plugin's widgets in all versions up to, and including, 3.1.5 due to insufficient input sanitization and output escaping on user supplied attributes such as URL. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ed0a9db6-24bd-48ba-befa-ce537304ab52?source=cve - https://wordpress.org/plugins/droit-elementor-addons/
CVE ID: CVE-2024-2253 State: PUBLISHED Published: 2024-05-30T03:34:29.705Z Last Updated: 2024-08-01T19:03:39.193Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: uapp Products: Testimonial Carousel For Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Testimonial Carousel For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via URL values the plugin's carousel widgets in all versions up to, and including, 10.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers
input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d559b862-ee07-4207-8c64-81961516a046?source=cve - https://plugins.trac.wordpress.org/browser/testimonials-carousel-elementor/trunk/widgets/testimonials-carousel/class-testimonialscarousel-employees.php
CVE ID: CVE-2024-2254 State: PUBLISHED Published: 2024-08-24T02:32:19.763Z Last Updated: 2024-08-26T12:56:56.724Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: risetheme Products: RT Easy Builder – Advanced addons for Elementor Problem Types: CWE-79 Description: The RT Easy Builder – Advanced addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts
es it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a5fb289e-bd38-42ea-86a4-7816b59bd0b2?source=cve - https://plugins.trac.wordpress.org/browser/rt-easy-builder-advanced-addons-for-elementor/trunk/modules/elementor/widgets/pricing-table/template.php#L19
CVE ID: CVE-2024-2255 State: PUBLISHED Published: 2024-03-20T03:20:32.539Z Last Updated: 2024-08-05T18:06:30.752Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpdevteam Products: Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 4.5.2 due to insufficient input sanitization and output escaping on user supplied attribu
versions up to, and including, 4.5.2 due to insufficient input sanitization and output escaping on user supplied attributes such as listStyle. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cfcd59ae-085f-47d2-a4d2-2d1239f035d2?source=cve - https://plugins.trac.wordpress.org/browser/essential-blocks/tags/4.5.2/blocks/TableOfContents.php#L120 - https://plugins.trac.wordpress.org/changeset/3053199/ess
r/essential-blocks/tags/4.5.2/blocks/TableOfContents.php#L120 - https://plugins.trac.wordpress.org/changeset/3053199/essential-blocks/trunk/blocks/TableOfContents.php
CVE ID: CVE-2024-2256 State: PUBLISHED Published: 2024-03-14T20:34:20.689Z Last Updated: 2024-08-01T19:03:39.467Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bobbingwide Products: oik Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The oik plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes such as bw_contact_button and bw_button shortcodes in all versions up to, and including, 4.10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-leve
nd output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1266c6df-214b-4b6b-8f1d-a67385469bf5?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3049746%40oik&new=3049746%40oik&sfp_email=&sfph_mail= - https://www.oik-plugins.com/shortcode_example/bw_contact_button-security-fix/
CVE ID: CVE-2024-2257 State: PUBLISHED Published: 2024-05-10T13:26:08.205Z Last Updated: 2024-08-01T19:03:39.410Z Vendors: Digisol Products: Digisol Router DG-GR1321 Problem Types: CWE-20 Description: This vulnerability exists in Digisol Router (DG-GR1321: Hardware version 3.7L; Firmware version : v3.2.02) due to improper implementation of password policies. An attacker with physical access could exploit this by creating password that do not adhere to the defined security standards/policy on the vulnerable system. Successful exploitation of this vulnerability could allow the attacker to expose the router to potential security threats. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE
e attacker to expose the router to potential security threats. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0158
CVE ID: CVE-2024-2258 State: PUBLISHED Published: 2024-04-27T03:33:35.216Z Last Updated: 2024-08-01T19:03:39.193Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: 10web Products: Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user's display name autofilled into forms in all versions up to, and including, 1.15.24 due to insufficient input sanitization and output escaping. Th
into forms in all versions up to, and including, 1.15.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/af1075a5-9efa-4b86-9798-6dbafcba4db5?source=cve - https://plugins.trac.wordpress.org/changeset/3071515
CVE ID: CVE-2024-2259 State: PUBLISHED Published: 2024-08-13T10:18:24.658Z Last Updated: 2024-08-13T14:19:41.149Z Vendors: Meddiff Technologies Products: InstaRISPACS Problem Types: CWE-79 Description: This vulnerability exists in InstaRISPACS software due to insufficient validation of user supplied input for the loginTo parameter in user login module of the web interface of the application. A remote attacker could exploit this vulnerability by sending a specially crafted input to the vulnerable parameter to perform reflected Cross Site Scripting (XSS) attacks on the targeted system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pa
ed system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0241
CVE ID: CVE-2024-2260 State: PUBLISHED Published: 2024-04-16T00:00:14.951Z Last Updated: 2024-08-01T19:03:39.351Z Severity: MEDIUM (CVSS 4.2 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: zenml-io Products: zenml-io/zenml Problem Types: CWE-384 Description: A session fixation vulnerability exists in the zenml-io/zenml application, where JWT tokens used for user authentication are not invalidated upon logout. This flaw allows an attacker to bypass authentication mechanisms by reusing a victim's JWT token. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/2d0856ec-ed73-477a-8ea2-d5d4f15cf167 - https://github.com/zenml-i
am Container: References: - https://huntr.com/bounties/2d0856ec-ed73-477a-8ea2-d5d4f15cf167 - https://github.com/zenml-io/zenml/commit/68bcb3ba60cba9729c9713a49c39502d40fb945e
CVE ID: CVE-2024-2261 State: PUBLISHED Published: 2024-04-09T18:58:41.029Z Last Updated: 2024-08-01T19:03:39.190Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: theeventscalendar Products: Event Tickets and Registration Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The Event Tickets and Registration plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.8.2 via the RSVP functionality. This makes it possible for authenticated attackers, with contributor access and above, to extract sensitive data including emails and street addresses. Additional Analyst Notes: - CISA
utor access and above, to extract sensitive data including emails and street addresses. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2e42dd1c-adf7-471a-a14a-9038c56413a2?source=cve - https://plugins.trac.wordpress.org/changeset?old_path=/event-tickets/tags/5.8.2&old=3059268&new_path=/event-tickets/tags/5.8.3&new=3059268&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2262 State: PUBLISHED Published: 2024-04-01T05:00:01.688Z Last Updated: 2024-08-21T22:39:32.516Z Vendors: Unknown Products: Themify Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: Themify WordPress plugin before 1.4.4 does not have CSRF check in its bulk action, which could allow attackers to make logged in users delete arbitrary filters via CSRF attack, granted they know the related filter slugs Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/30544377-b90d-4762-b38a-ec89bda0dfdc/
CVE ID: CVE-2024-2263 State: PUBLISHED Published: 2024-04-01T05:00:02.150Z Last Updated: 2024-08-27T15:43:13.886Z Vendors: Unknown Products: Themify Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: Themify WordPress plugin before 1.4.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ec092ed9-eb3e-40a7-a878-ab854104e290/
CVE ID: CVE-2024-2264 State: PUBLISHED Published: 2024-03-07T21:00:06.751Z Last Updated: 2024-08-12T18:10:23.449Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: keerti1924 Products: PHP-MYSQL-User-Login-System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in keerti1924 PHP-MYSQL-User-Login-System 1.0. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-256034 is the identifier assigned to this vulnerability. NOTE: The vendor was contact
to the public and may be used. VDB-256034 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.256034 - https://vuldb.com/?ctiid.256034 - https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/keerti1924%20PHP-MYSQL-User-Login-System/SQLI%20Auth.md
CVE ID: CVE-2024-2265 State: PUBLISHED Published: 2024-03-07T21:31:05.029Z Last Updated: 2024-08-01T19:03:39.312Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: keerti1924 Products: PHP-MYSQL-User-Login-System Problem Types: CWE-540 Description: A vulnerability, which was classified as problematic, was found in keerti1924 PHP-MYSQL-User-Login-System 1.0. This affects an unknown part of the file login.sql. The manipulation leads to inclusion of sensitive information in source code. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256035. NOTE:
has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256035. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.256035 - https://vuldb.com/?ctiid.256035 - https://github.com/smurf-reigz/security/blob/main/proof-of-concepts/keerti1924%20publicly%20exposed%20password%20hashes.md
CVE ID: CVE-2024-2266 State: PUBLISHED Published: 2024-03-07T21:31:06.425Z Last Updated: 2024-08-12T13:58:37.386Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: keerti1924 Products: Secret-Coder-PHP-Project Problem Types: CWE-79 Description: A vulnerability has been found in keerti1924 Secret-Coder-PHP-Project 1.0 and classified as problematic. This vulnerability affects unknown code of the file /login.php of the component Login Page. The manipulation of the argument emailcookie/passwordcookie leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256036. NOTE:
The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256036. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.256036 - https://vuldb.com/?ctiid.256036 - https://github.com/smurf-reigz/security/blob/main/proof-of-concepts/keerti1924%20%5BSecret-Coder-PHP-Project%20XSS%5D%20on%20login.php%20via%20arbitrary%20cookies.md
CVE ID: CVE-2024-2267 State: PUBLISHED Published: 2024-03-07T22:00:06.831Z Last Updated: 2024-08-26T14:50:43.962Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: keerti1924 Products: Online-Book-Store-Website Problem Types: CWE-840 Description: A vulnerability was found in keerti1924 Online-Book-Store-Website 1.0 and classified as problematic. This issue affects some unknown processing of the file /shop.php. The manipulation of the argument product_price leads to business logic errors. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256037 was assigned to this vulnerability. NOTE: The ven