Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
path traversal, as identified in CVE-2023-51449. This vulnerability allows unauthorized users to bypass the intended restrictions and access sensitive files, such as `config.json`, which contains API keys. The issue affects the latest version of chuanhuchatgpt prior to the fixed version released on 20240305. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/277e3ff0-5878-4809-a4b9-73cdbb70dc9f - https://github.com/gaizhenbiao/chuanhuchatgpt/commit/6b8f7db347b390f6f8bd07ea2a4ef01a47382f00
CVE ID: CVE-2024-3235 State: PUBLISHED Published: 2024-04-10T04:30:20.663Z Last Updated: 2024-08-01T20:05:08.333Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: ThemePunch Products: Essential Grid Gallery WordPress Plugin Problem Types: CWE-862 Missing Authorization Description: The Essential Grid Gallery WordPress Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.1 via the on_front_ajax_action() function. This makes it possible for unauthenticated attackers to view private and password protected posts that may have private or sensitive information. Additional Analyst Notes: - CISA ADP Vuln
e and password protected posts that may have private or sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/adadac1e-3d92-41a5-90d4-b2028c8c40c0?source=cve - https://codecanyon.net/item/essential-grid-wordpress-plugin/7563340
CVE ID: CVE-2024-3236 State: PUBLISHED Published: 2024-06-17T06:00:01.133Z Last Updated: 2024-08-01T20:05:08.361Z Vendors: Unknown Products: Popup Builder Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Popup Builder WordPress plugin before 1.1.33 does not sanitise and escape some of its Notification fields, which could allow users such as contributor and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/a6c2da28-dc03-4bcc-a6c3-ee55a73861db/
CVE ID: CVE-2024-3237 State: PUBLISHED Published: 2024-05-04T03:31:03.130Z Last Updated: 2024-08-01T20:05:08.216Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Brainstorm Force Products: ConvertPlug Problem Types: CWE-862 Missing Authorization Description: The ConvertPlug plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the cp_dismiss_notice() function in all versions up to, and including, 3.5.25. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary option values to true. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Con
d above, to update arbitrary option values to true. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0cd72420-dca1-455d-92a6-a178b4b26eab?source=cve - https://www.convertplug.com/plus/product/convertplug/
CVE ID: CVE-2024-3238 State: PUBLISHED Published: 2024-08-02T06:41:38.167Z Last Updated: 2024-08-02T16:09:42.490Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: looks_awesome Products: WordPress Menu Plugin — Superfly Responsive Menu Problem Types: CWE-352 Description: The WordPress Menu Plugin — Superfly Responsive Menu plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0.29. This is due to missing or incorrect nonce validation on the ajax_handle_delete_icons() function. This makes it possible for unauthenticated attackers to delete arbitrary files via a forged request granted they can trick a site admini
ssible for unauthenticated attackers to delete arbitrary files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Please not the CSRF was patched in 5.0.28, however, adequate directory traversal protection wasn't introduced until 5.0.30. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3608fce3-0869-4516-ae08-68108f733c37?source=cve - https://codecanyon.net/item/superfly-responsive-wordpress-menu-plugin/8012790
CVE ID: CVE-2024-3239 State: PUBLISHED Published: 2024-05-13T06:00:01.142Z Last Updated: 2024-11-01T19:15:08.102Z Vendors: Unknown Products: Post Grid Gutenberg Blocks and WordPress Blog Plugin Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Post Grid Gutenberg Blocks and WordPress Blog Plugin WordPress plugin before 4.0.2 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/dfa
onal Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/dfa1421b-41b0-4b25-95ef-0843103e1f5e/
CVE ID: CVE-2024-3240 State: PUBLISHED Published: 2024-05-04T03:31:03.810Z Last Updated: 2024-08-01T20:05:08.336Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Brainstorm Force Products: ConvertPlug Problem Types: CWE-502 Deserialization of Untrusted Data Description: The ConvertPlug plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.25 via deserialization of untrusted input from the 'settings_encoded' attribute of the 'smile_info_bar' shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin
ckers, with contributor-level access and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fca3259b-bf0e-4b4a-815f-1eb399b8b674?source=cve - https://www.convertplug.com/plus/product/convertplug/
CVE ID: CVE-2024-3241 State: PUBLISHED Published: 2024-05-14T06:00:02.064Z Last Updated: 2024-11-07T16:24:36.657Z Vendors: Unknown Products: Ultimate Blocks Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Ultimate Blocks WordPress plugin before 3.1.7 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/a645daee-42ea-43f8-9480-ef3be69606e0/
CVE ID: CVE-2024-3242 State: PUBLISHED Published: 2024-07-18T08:33:03.613Z Last Updated: 2024-08-01T20:05:08.280Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: themefusecom Products: Brizy – Page Builder Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file extension validation in the validateImageContent function called via storeImages in all versions up to, and including, 2.4.43. This makes it possible for authenticated attackers, with contributor access and above, to upload arbitrary files on the affected site's server wh
r authenticated attackers, with contributor access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Version 2.4.44 prevents the upload of files ending in .sh and .php. Version 2.4.45 fully patches the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a414de0a-ae44-4955-bd25-ec6ad7860835?source=cve - https://plugins.trac.wordpress.org/browser/brizy/trunk/editor/zip/archiver.php#L264 - https://plugins.trac.wordpress.org/browser/brizy/trunk/editor/zip/archiver.php#L547 - https://plugins.trac.wordpress.org/changeset/3086506/briz
rdpress.org/browser/brizy/trunk/editor/zip/archiver.php#L547 - https://plugins.trac.wordpress.org/changeset/3086506/brizy/trunk/editor/zip/archiver.php - https://plugins.trac.wordpress.org/changeset/3112878/brizy/trunk?contextall=1&old=3086506&old_path=%2Fbrizy%2Ftrunk
CVE ID: CVE-2024-3243 State: PUBLISHED Published: 2024-04-16T12:51:46.885Z Last Updated: 2024-08-01T20:05:08.342Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: ivole Products: Customer Reviews for WooCommerce Problem Types: CWE-862 Missing Authorization Description: The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the send_test_email() function in all versions up to, and including, 5.46.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to send arbitrary test emails. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE P
criber-level access and above, to send arbitrary test emails. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a0e80e63-f4f7-44cc-ae29-72e7847d7448?source=cve - https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/trunk/includes/settings/class-cr-settings-review-discount.php#L506 - https://plugins.trac.wordpress.org/changeset/3069811/customer-reviews-woocommerce/trunk/includes/settings/class-cr-settings-review-discount.php
CVE ID: CVE-2024-3244 State: PUBLISHED Published: 2024-04-09T18:58:59.605Z Last Updated: 2025-02-26T18:22:51.630Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpdevteam Products: EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'embedpre
ts in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'embedpress_calendar' shortcode in all versions up to, and including, 3.9.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/778d8443-fc0f-4e97-8460-e5ceee8b62a1?source=cve - https://plugins.trac.wordpress.
ce.com/threat-intel/vulnerabilities/id/778d8443-fc0f-4e97-8460-e5ceee8b62a1?source=cve - https://plugins.trac.wordpress.org/browser/embedpress/tags/3.9.13/EmbedPress/ThirdParty/Googlecalendar/Embedpress_Google_Helper.php#L657 - https://plugins.trac.wordpress.org/changeset/3064544/embedpress/tags/3.9.15/EmbedPress/ThirdParty/Googlecalendar/Embedpress_Google_Helper.php
CVE ID: CVE-2024-3245 State: PUBLISHED Published: 2024-04-06T02:32:04.151Z Last Updated: 2024-08-01T20:05:08.315Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpdevteam Products: EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Youtube b
ts in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Youtube block in all versions up to, and including, 3.9.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a427c798-f546-4ca1-98ab-32b433ee5b59?source=cve - https://plugins.trac.wordpress.org/changeset/3064
l/vulnerabilities/id/a427c798-f546-4ca1-98ab-32b433ee5b59?source=cve - https://plugins.trac.wordpress.org/changeset/3064544/embedpress/tags/3.9.15/Gutenberg/dist/blocks.build.js
CVE ID: CVE-2024-3246 State: PUBLISHED Published: 2024-07-24T03:17:17.104Z Last Updated: 2024-08-01T20:05:08.345Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: litespeedtech Products: LiteSpeed Cache Problem Types: CWE-352 Description: The LiteSpeed Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.2.0.1. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to update the token setting and inject malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional
ged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8036bd83-9af5-4b71-8974-9b0690ea6769?source=cve - https://plugins.trac.wordpress.org/changeset/3123399/litespeed-cache/trunk/src/cloud.cls.php
CVE ID: CVE-2024-3247 State: PUBLISHED Published: 2024-04-02T22:57:35.394Z Last Updated: 2024-08-01T20:05:08.335Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Xpdf Products: Xpdf Problem Types: CWE-674 Description: In Xpdf 4.05 (and earlier), a PDF object loop in an object stream leads to infinite recursion and a stack overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forum.xpdfreader.com/viewtopic.php?t=43597
CVE ID: CVE-2024-3248 State: PUBLISHED Published: 2024-04-02T23:04:40.828Z Last Updated: 2024-08-12T13:52:19.102Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Xpdf Products: Xpdf Problem Types: CWE-674 Description: In Xpdf 4.05 (and earlier), a PDF object loop in the attachments leads to infinite recursion and a stack overflow. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://forum.xpdfreader.com/viewtopic.php?t=43657
CVE ID: CVE-2024-3249 State: PUBLISHED Published: 2024-06-25T06:57:38.060Z Last Updated: 2024-08-01T20:05:08.365Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: wpzita Products: Zita Elementor Site Library Problem Types: CWE-862 Missing Authorization Description: The Zita Elementor Site Library plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the import_xml_data, xml_data_import, import_option_data, import_widgets, and import_customizer_settings functions in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to creat
d including, 1.6.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to create pages, update certain options, including WooCommerce page titles and Elementor settings, import widgets, and update the plugin's customizer settings and the WordPress custom CSS. NOTE: This vulnerability was partially fixed in version 1.6.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/62bc3794-a2c2-4c1a-b1c9-2be6e2526635?source=cve - https://plugins.trac.wordpress.org/changeset/3100431/zita-site-library - https://plugins.trac.wordpress.org/changeset/3105478/zita-site-li
ac.wordpress.org/changeset/3100431/zita-site-library - https://plugins.trac.wordpress.org/changeset/3105478/zita-site-library
CVE ID: CVE-2024-3250 State: PUBLISHED Published: 2024-04-04T14:29:31.250Z Last Updated: 2024-11-06T15:43:34.482Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Canonical Ltd. Products: Pebble Description: It was discovered that Canonical's Pebble service manager read-file API and the associated pebble pull command, before v1.10.2, allowed unprivileged local users to read files with root-equivalent permissions when Pebble was running as root. Fixes are also available as backports to v1.1.1, v1.4.2, and v1.7.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cve.org/CVERecord?id=CVE-2024-3250 - https://gi
ISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cve.org/CVERecord?id=CVE-2024-3250 - https://github.com/canonical/pebble/security/advisories/GHSA-4685-2x5r-65pj
CVE ID: CVE-2024-3251 State: PUBLISHED Published: 2024-04-03T10:00:05.539Z Last Updated: 2024-08-01T20:05:08.277Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Computer Laboratory Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Computer Laboratory Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/?page=borrow/view_borrow. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259100.
tely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259100. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.259100 - https://vuldb.com/?ctiid.259100 - https://vuldb.com/?submit.309091 - https://github.com/0xAlmighty/Vulnerability-Research/blob/main/SourceCodester/CLMS/SourceCodester-CLMS-SQLi.md
CVE ID: CVE-2024-3252 State: PUBLISHED Published: 2024-04-03T10:00:07.120Z Last Updated: 2024-08-22T19:52:18.487Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Internship Portal Management System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in SourceCodester Internship Portal Management System 1.0. This affects an unknown part of the file admin/check_admin.php. The manipulation of the argument username/password leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259101 was assigned to this vulnerability. Addit
it has been disclosed to the public and may be used. The identifier VDB-259101 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.259101 - https://vuldb.com/?ctiid.259101 - https://vuldb.com/?submit.309212 - https://github.com/thisissuperann/Vul/blob/main/Internship-Portal-Management-System-01
CVE ID: CVE-2024-3253 State: PUBLISHED Published: 2024-04-03T11:00:05.961Z Last Updated: 2024-08-01T20:05:08.219Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Internship Portal Management System Problem Types: CWE-89 Description: A vulnerability classified as critical was found in SourceCodester Internship Portal Management System 1.0. This vulnerability affects unknown code of the file admin/add_admin.php. The manipulation of the argument name/username/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-259102 is the identifier assigned to this vulnerability. Additio
t has been disclosed to the public and may be used. VDB-259102 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.259102 - https://vuldb.com/?ctiid.259102 - https://vuldb.com/?submit.309214 - https://github.com/thisissuperann/Vul/blob/main/Internship-Portal-Management-System-03
CVE ID: CVE-2024-3254 State: PUBLISHED Published: 2024-04-03T12:00:05.721Z Last Updated: 2024-08-20T20:23:50.200Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Internship Portal Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in SourceCodester Internship Portal Management System 1.0. This issue affects some unknown processing of the file admin/edit_admin.php. The manipulation of the argument admin_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259103
exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259103. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.259103 - https://vuldb.com/?ctiid.259103 - https://vuldb.com/?submit.309215 - https://github.com/thisissuperann/Vul/blob/main/Internship-Portal-Management-System-04
CVE ID: CVE-2024-3255 State: PUBLISHED Published: 2024-04-03T12:00:07.100Z Last Updated: 2024-08-01T20:05:08.223Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Internship Portal Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in SourceCodester Internship Portal Management System 1.0. Affected is an unknown function of the file admin/edit_admin_query.php. The manipulation of the argument username/password/name/admin_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is
attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259104. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.259104 - https://vuldb.com/?ctiid.259104 - https://vuldb.com/?submit.309216 - https://github.com/thisissuperann/Vul/blob/main/Internship-Portal-Management-System-05
CVE ID: CVE-2024-3256 State: PUBLISHED Published: 2024-04-03T12:31:05.117Z Last Updated: 2025-02-27T20:11:21.232Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Internship Portal Management System Problem Types: CWE-89 Description: A vulnerability has been found in SourceCodester Internship Portal Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file admin/edit_activity.php. The manipulation of the argument activity_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259105 was assigned to this v