Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-10127 State: PUBLISHED Published: 2024-11-20T08:36:03.443Z Last Updated: 2024-12-16T07:01:27.047Z Vendors: M-Files Corporation Products: M-Files Server Problem Types: CWE-303 Description: Authentication bypass condition in LDAP authentication in M-Files server versions before 24.11 supported usage of OpenLDAP configurations that allowed user authentication without a password when the LDAP server itself had the vulnerable configuration. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://product.m-files.com/security-advisories/CVE-2024-10127
CVE ID: CVE-2024-10128 State: PUBLISHED Published: 2024-10-18T21:00:05.268Z Last Updated: 2024-10-21T18:03:46.911Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:P/I:N/A:N) Vendors: Topdata Products: Inner Rep Plus WebServer Problem Types: CWE-327 Description: A vulnerability was found in Topdata Inner Rep Plus WebServer 2.01. It has been rated as problematic. Affected by this issue is some unknown functionality of the file td.js.gz. The manipulation leads to risky cryptographic algorithm. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: -
e used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280916 - https://vuldb.com/?ctiid.280916 - https://vuldb.com/?submit.422604
CVE ID: CVE-2024-10129 State: PUBLISHED Published: 2024-10-18T21:31:04.055Z Last Updated: 2024-10-21T17:59:23.328Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: HFO4 Products: shudong-share Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in HFO4 shudong-share up to 2.4.7. This affects an unknown part of the file /includes/create_share.php of the component Share Handler. The manipulation of the argument fkey leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Ana
lic and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280917 - https://vuldb.com/?ctiid.280917 - https://vuldb.com/?submit.421391 - https://github.com/timeflykai/shudong_share_sql_injection
CVE ID: CVE-2024-10130 State: PUBLISHED Published: 2024-10-18T21:31:06.724Z Last Updated: 2024-10-21T17:50:18.674Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: AC8 Problem Types: CWE-121 Description: A vulnerability classified as critical was found in Tenda AC8 16.03.34.06. This vulnerability affects the function formSetRebootTimer of the file /goform/SetSysAutoRebbotCfg. The manipulation of the argument rebootTime leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: -
used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280918 - https://vuldb.com/?ctiid.280918 - https://vuldb.com/?submit.422141 - https://github.com/JohenanLi/router_vuls/blob/main/ac8v4/FUN_004a8838.md - https://www.tenda.com.cn/
CVE ID: CVE-2024-10131 State: PUBLISHED Published: 2024-10-19T03:50:09.553Z Last Updated: 2025-10-15T12:49:21.875Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: infiniflow Products: infiniflow/ragflow Problem Types: CWE-94 Description: The `add_llm` function in `llm_app.py` in infiniflow/ragflow version 0.11.0 contains a remote code execution (RCE) vulnerability. The function uses user-supplied input `req['llm_factory']` and `req['llm_name']` to dynamically instantiate classes from various model dictionaries. This approach allows an attacker to potentially execute arbitrary code due to the lack of comprehensive input validation or sanitization. An attacker c
r to potentially execute arbitrary code due to the lack of comprehensive input validation or sanitization. An attacker could provide a malicious value for 'llm_factory' that, when used as an index to these model dictionaries, results in the execution of arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/42ae0b27-e851-4b58-a991-f691a437fbaa
CVE ID: CVE-2024-10133 State: PUBLISHED Published: 2024-10-19T08:31:05.771Z Last Updated: 2024-10-21T14:28:17.221Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: ESAFENET Products: CDG Problem Types: CWE-89 Description: A vulnerability has been found in ESAFENET CDG 5 and classified as critical. Affected by this vulnerability is the function updateNetSecPolicyPriority of the file /com/esafenet/servlet/ajax/NetSecPolicyAjax.java. The manipulation of the argument id/frontId leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. A
ed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280921 - https://vuldb.com/?ctiid.280921 - https://vuldb.com/?submit.422231 - https://flowus.cn/share/a320073e-a545-419e-bfb5-d6e2b8526433?code=G8A6P3
CVE ID: CVE-2024-10134 State: PUBLISHED Published: 2024-10-19T10:00:08.469Z Last Updated: 2024-10-21T14:22:32.797Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: ESAFENET Products: CDG Problem Types: CWE-89 Description: A vulnerability was found in ESAFENET CDG 5 and classified as critical. Affected by this issue is the function connectLogout of the file /com/esafenet/servlet/ajax/MultiServerAjax.java. The manipulation of the argument servername leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: -
used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280922 - https://vuldb.com/?ctiid.280922 - https://vuldb.com/?submit.422232 - https://flowus.cn/share/cf5e5c45-d097-48d4-b33b-54acfa846fe5?code=G8A6P3
CVE ID: CVE-2024-10135 State: PUBLISHED Published: 2024-10-19T11:31:06.714Z Last Updated: 2024-10-21T14:14:52.321Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: ESAFENET Products: CDG Problem Types: CWE-89 Description: A vulnerability was found in ESAFENET CDG 5. It has been classified as critical. This affects the function actionDelNetSecConfig of the file /com/esafenet/servlet/netSec/NetSecConfigService.java. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Anal
ic and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280923 - https://vuldb.com/?ctiid.280923 - https://vuldb.com/?submit.422233 - https://flowus.cn/share/90077815-dc85-42a1-9144-af0002cd0011?code=G8A6P3
CVE ID: CVE-2024-10136 State: PUBLISHED Published: 2024-10-19T12:00:07.360Z Last Updated: 2024-10-21T14:13:04.890Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Pharmacy Management System Problem Types: CWE-89 Description: A vulnerability was found in code-projects Pharmacy Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /manage_invoice.php. The manipulation of the argument invoice_number leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?
osed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280924 - https://vuldb.com/?ctiid.280924 - https://vuldb.com/?submit.425279 - https://gist.github.com/higordiego/f6411aecc606b015a37382b2be828831 - https://code-projects.org/
CVE ID: CVE-2024-10137 State: PUBLISHED Published: 2024-10-19T12:31:04.686Z Last Updated: 2024-10-21T14:12:03.164Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Pharmacy Management System Problem Types: CWE-89 Description: A vulnerability was found in code-projects Pharmacy Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /manage_medicine.php?action=delete. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.co
sclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280925 - https://vuldb.com/?ctiid.280925 - https://vuldb.com/?submit.425280 - https://gist.github.com/higordiego/edd15afd508c51c95e5ce29544165320 - https://code-projects.org/
CVE ID: CVE-2024-10138 State: PUBLISHED Published: 2024-10-19T13:00:06.035Z Last Updated: 2024-10-21T14:08:23.105Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Pharmacy Management System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in code-projects Pharmacy Management System 1.0. Affected is an unknown function of the file /add_new_purchase.php?action=is_supplier. The manipulation of the argument name leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.
disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280926 - https://vuldb.com/?ctiid.280926 - https://vuldb.com/?submit.425283 - https://gist.github.com/higordiego/26694ace59cbc1e1f8366bef96953569 - https://code-projects.org/
CVE ID: CVE-2024-10139 State: PUBLISHED Published: 2024-10-19T13:31:04.429Z Last Updated: 2024-10-21T14:07:32.486Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Pharmacy Management System Problem Types: CWE-89 Description: A vulnerability classified as critical was found in code-projects Pharmacy Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /add_new_supplier.php. The manipulation of the argument name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?i
sed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280927 - https://vuldb.com/?ctiid.280927 - https://vuldb.com/?submit.425285 - https://gist.github.com/higordiego/155be99b5314d97b276a7b30b9e6dec0 - https://code-projects.org/
CVE ID: CVE-2024-10140 State: PUBLISHED Published: 2024-10-19T14:31:04.562Z Last Updated: 2024-10-21T14:06:27.647Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Pharmacy Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in code-projects Pharmacy Management System 1.0. Affected by this issue is some unknown functionality of the file /manage_supplier.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuld
n disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280928 - https://vuldb.com/?ctiid.280928 - https://vuldb.com/?submit.425348 - https://gist.github.com/higordiego/b03bc3a330374a0581e51891d6105ed2 - https://code-projects.org/
CVE ID: CVE-2024-10141 State: PUBLISHED Published: 2024-10-19T15:00:07.186Z Last Updated: 2024-10-21T13:58:18.883Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: jsbroks Products: COCO Annotator Problem Types: CWE-341 Description: A vulnerability, which was classified as problematic, was found in jsbroks COCO Annotator 0.11.1. This affects an unknown part of the component Session Handler. The manipulation of the argument SECRET_KEY leads to predictable from observable state. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may
attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280929 - https://vuldb.com/?ctiid.280929 - https://vuldb.com/?submit.422713 - https://github.com/jsbroks/coco-annotator/issues/626 - https://github.com/jsbroks/coco-annotator/issues/626#issue-2582440109
CVE ID: CVE-2024-10142 State: PUBLISHED Published: 2024-10-19T17:00:05.596Z Last Updated: 2024-10-21T13:55:10.169Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: code-projects Products: Blood Bank System Problem Types: CWE-79 Description: A vulnerability has been found in code-projects Blood Bank System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /viewrequest.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280930 - https://vuldb.com/?ctiid.280930 -
Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280930 - https://vuldb.com/?ctiid.280930 - https://vuldb.com/?submit.425362 - https://github.com/WrongDish/CVE/blob/main/xss6.md - https://code-projects.org/
CVE ID: CVE-2024-10143 State: PUBLISHED Published: 2025-05-15T20:06:41.435Z Last Updated: 2025-05-20T15:49:47.182Z Vendors: Unknown Products: MB Custom Post Types & Custom Taxonomies Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.7.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b5fd7a3e-33e4-4c73-a581-881f063855b0/
CVE ID: CVE-2024-10144 State: PUBLISHED Published: 2025-05-15T20:06:41.630Z Last Updated: 2025-05-20T15:49:11.723Z Vendors: Unknown Products: Photo Gallery, Images, Slider in Rbs Image Gallery Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a83521d3-0aba-4
etup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a83521d3-0aba-493d-8dec-e764277e69b8/
CVE ID: CVE-2024-10145 State: PUBLISHED Published: 2025-05-15T20:06:41.838Z Last Updated: 2025-05-20T15:48:23.514Z Vendors: Unknown Products: Hubbub Lite Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Hubbub Lite WordPress plugin before 1.34.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b9e2381b-3ea0-48fa-bd9c-4181ddf36389/
CVE ID: CVE-2024-10146 State: PUBLISHED Published: 2024-11-14T06:00:06.865Z Last Updated: 2024-11-14T18:50:53.614Z Vendors: Unknown Products: Simple File List Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Simple File List WordPress plugin before 6.1.13 does not sanitise and escape a generated URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against admins. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/9ee74a0f-83ff-4c15-a114-f8f6baab8bf5/
CVE ID: CVE-2024-10147 State: PUBLISHED Published: 2024-11-16T03:20:49.107Z Last Updated: 2024-11-16T15:14:16.854Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: starverte Products: Steel Problem Types: CWE-79 Description: The Steel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's btn shortcode in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Addition
nd above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b1ed1ef4-8867-499b-8f73-296280573462?source=cve - https://wordpress.org/plugins/steel/#developers
CVE ID: CVE-2024-10148 State: PUBLISHED Published: 2024-10-25T06:51:24.936Z Last Updated: 2024-10-25T14:08:33.447Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: sohelwpexpert Products: Awesome buttons Problem Types: CWE-79 Description: The Awesome buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's btn2 shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an
tributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/84ef25b6-8119-41e5-9959-ccdfb9893e75?source=cve - https://wordpress.org/plugins/wp-awesome-buttons/#developers
CVE ID: CVE-2024-10149 State: PUBLISHED Published: 2025-05-15T20:06:42.266Z Last Updated: 2025-05-20T15:46:26.992Z Vendors: Unknown Products: Social Slider Feed Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Social Slider Feed WordPress plugin before 2.2.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1619dc4b-4e5e-4b82-820b-3c4e732db3ad/
CVE ID: CVE-2024-10150 State: PUBLISHED Published: 2024-10-25T07:37:59.025Z Last Updated: 2024-10-25T20:28:37.940Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bamazoo Products: Bamazoo – Button Generator Problem Types: CWE-79 Description: The Bamazoo – Button Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's dgs shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a us
ckers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/543507a1-02de-417f-a742-7764465987b2?source=cve - https://wordpress.org/plugins/bamazoo-button-generator/#developers
CVE ID: CVE-2024-10151 State: PUBLISHED Published: 2025-01-08T06:00:12.427Z Last Updated: 2025-01-08T15:35:41.545Z Vendors: Unknown Products: Auto iFrame Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Auto iFrame WordPress plugin before 2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/487facf7-8880-48b3-b1b2-0d09823d3c46/
CVE ID: CVE-2024-10152 State: PUBLISHED Published: 2025-02-26T06:00:02.971Z Last Updated: 2025-02-26T16:17:55.054Z Vendors: Unknown Products: Simple Certain Time to Show Content Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Simple Certain Time to Show Content WordPress plugin before 1.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b4d17da2-4c47-4fd1-a6bd-6692b07cf710/
CVE ID: CVE-2024-10153 State: PUBLISHED Published: 2024-10-19T18:00:09.081Z Last Updated: 2025-03-16T17:15:23.804Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: PHPGurukul Products: Boat Booking System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in PHPGurukul Boat Booking System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file book-boat.php?bid=1 of the component Book a Boat Page. The manipulation of the argument bookingdatefrom/nopeople leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected a
be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280939 - https://vuldb.com/?ctiid.280939 - https://vuldb.com/?submit.425365 - https://github.com/jadu101/CVE/blob/main/phpgurukul_boat_booking_system_book_boat_sqli.md - https://phpgurukul.com/