Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-6440 State: PUBLISHED Published: 2023-11-30T20:31:04.624Z Last Updated: 2024-08-02T08:28:21.801Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Book Borrower System Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Book Borrower System 1.0 and classified as problematic. This issue affects some unknown processing of the file endpoint/add-book.php. The manipulation of the argument Book Title/Book Author leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-246443. Additional Analyst
sclosed to the public and may be used. The associated identifier of this vulnerability is VDB-246443. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.246443 - https://vuldb.com/?ctiid.246443 - https://github.com/lscjl/lsi.webray.com.cn/blob/main/CVE-project/Book%20Borrower%20System%20Cross%20site%20scripting.md
CVE ID: CVE-2023-6441 State: PUBLISHED Published: 2024-02-14T13:11:41.042Z Last Updated: 2024-08-26T17:36:17.595Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: UNI-PA University Marketing & Computer Internet Trade Inc. Products: University Information System Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in UNI-PA University Marketing & Computer Internet Trade Inc. University Information System allows SQL Injection.This issue affects University Information System: before 12.12.2023. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
ation System: before 12.12.2023. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-0102
CVE ID: CVE-2023-6442 State: PUBLISHED Published: 2023-11-30T21:00:06.985Z Last Updated: 2024-10-10T20:18:22.307Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: PHPGurukul Products: Nipah Virus Testing Management System Problem Types: CWE-79 Description: A vulnerability was found in PHPGurukul Nipah Virus Testing Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file add-phlebotomist.php. The manipulation of the argument empid/fullname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-246445 was assigned to
nched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-246445 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.246445 - https://vuldb.com/?ctiid.246445 - https://github.com/dhabaleshwar/niv_testing_sxss/blob/main/exploit.md
CVE ID: CVE-2023-6444 State: PUBLISHED Published: 2024-03-11T17:56:04.708Z Last Updated: 2024-08-05T17:48:43.813Z Vendors: Unknown Products: Seriously Simple Podcasting Problem Types: CWE-201 Insertion of Sensitive Information Into Sent Data Description: The Seriously Simple Podcasting WordPress plugin before 3.0.0 discloses the Podcast owner's email address (which by default is the admin email address) via an unauthenticated crafted request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/061c59d6-f4a0-4cd1-b945-5e92b9c2b4aa/
CVE ID: CVE-2023-6446 State: PUBLISHED Published: 2024-01-11T06:49:33.201Z Last Updated: 2024-09-25T20:42:18.445Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: codepeople Products: Calculated Fields Form Problem Types: CWE-87 Improper Neutralization of Alternate XSS Syntax Description: The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.40 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute w
attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c879123c-531e-43d8-a7d3-16a3c86b68a3?source=cve - https://plugins.trac.wordpress.org/changeset/3005354/calculated-fields-form
CVE ID: CVE-2023-6447 State: PUBLISHED Published: 2024-01-22T19:14:30.115Z Last Updated: 2025-06-17T13:38:28.810Z Vendors: Unknown Products: EventPrime Problem Types: CWE-284 Improper Access Control Description: The EventPrime WordPress plugin before 3.3.6 lacks authentication and authorization, allowing unauthenticated visitors to access private and password protected Events by guessing their numeric id/event name. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e366881c-d21e-4063-a945-95e6b080a373/
CVE ID: CVE-2023-6448 State: PUBLISHED Published: 2023-12-05T17:43:40.451Z Last Updated: 2025-10-21T23:05:30.290Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Unitronics Products: VisiLogic Problem Types: CWE-1188 Description: Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systems -
: - https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systems - https://www.unitronicsplc.com/cyber_security_vision-samba/ - https://downloads.unitronicsplc.com/Sites/plc/Visilogic/Version_Changes-Bug_Reports/VisiLogic%209.9.00%20Version%20changes.pdf - https://downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cybersecurity-Advisory-2023-001-CVE-2023-6448.pdf
CVE ID: CVE-2023-6449 State: PUBLISHED Published: 2023-12-01T11:00:06.019Z Last Updated: 2024-10-15T17:40:47.707Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: takayukister Products: Contact Form 7 Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'validate' function and insufficient blocklisting on the 'wpcf7_antiscript_file_name' function in versions up to, and including, 5.8.3. This makes it possible for authenticated attackers with editor-level capabilities or above to upload arbitrary files o
. This makes it possible for authenticated attackers with editor-level capabilities or above to upload arbitrary files on the affected site's server, but due to the htaccess configuration, remote code cannot be executed in most cases. By default, the file will be deleted from the server immediately. However, in some cases, other plugins may make it possible for the file to live on the server longer. This can make remote code execution possible when combined with another vulnerability, such as local file inclusion. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5d7fb020-6acb-445e-a46b-bdb5aaf8
P Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5d7fb020-6acb-445e-a46b-bdb5aaf8f2b6?source=cve - https://plugins.trac.wordpress.org/browser/contact-form-7/tags/5.8.3/includes/formatting.php#L275 - https://github.com/rocklobster-in/contact-form-7/compare/v5.8.3...v5.8.4 - https://contactform7.com/2023/11/30/contact-form-7-584/ - https://plugins.trac.wordpress.org/changeset/3003556/contact-form-7
CVE ID: CVE-2023-6450 State: PUBLISHED Published: 2024-01-19T20:09:59.870Z Last Updated: 2024-10-21T11:13:05.417Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Lenovo Products: Lenovo App Store Application Problem Types: CWE-400 Description: An incorrect permissions vulnerability was reported in the Lenovo App Store app that could allow an attacker to use system resources, resulting in a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://iknow.lenovo.com.cn/detail/419672
CVE ID: CVE-2023-6451 State: PUBLISHED Published: 2024-02-16T04:06:17.797Z Last Updated: 2024-08-02T08:28:21.849Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: AlayaCare Products: Procura Portal Problem Types: CWE-1394 Description: Publicly known cryptographic machine key in AlayaCare's Procura Portal before 9.0.1.2 allows attackers to forge their own authentication cookies and bypass the application's authentication mechanisms. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.themissinglink.com.au/security-advisories/cve-2023-6451
CVE ID: CVE-2023-6452 State: PUBLISHED Published: 2024-08-22T15:21:32.329Z Last Updated: 2024-08-22T19:50:08.561Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Forcepoint Products: Web Security Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Web Security (Transaction Viewer) allows Stored XSS. The Forcepoint Web Security portal allows administrators to generate detailed reports on user requests made through the Web proxy. It has been determined that the "user agent" field in the Transaction Viewer is vulnerable to a persistent Cross-Site Scripting (XSS) vu
rmined that the "user agent" field in the Transaction Viewer is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability, which can be exploited by any user who can route traffic through the Forcepoint Web proxy. This vulnerability enables unauthorized attackers to execute JavaScript within the browser context of a Forcepoint administrator, thereby allowing them to perform actions on the administrator's behalf. Such a breach could lead to unauthorized access or modifications, posing a significant security risk. This issue affects Web Security: before 8.5.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.forcepoint.com/s/article/000042212
CVE ID: CVE-2023-6456 State: PUBLISHED Published: 2024-01-22T19:14:27.567Z Last Updated: 2025-06-11T16:42:50.862Z Vendors: Unknown Products: WP Review Slider Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Review Slider WordPress plugin before 13.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/30f31412-8f94-4d5e-a080-3f6f669703cd/
CVE ID: CVE-2023-6457 State: PUBLISHED Published: 2024-01-16T01:00:33.447Z Last Updated: 2024-10-23T15:25:47.601Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: Hitachi Products: Hitachi Tuning Manager Problem Types: CWE-276 Description: Incorrect Default Permissions vulnerability in Hitachi Tuning Manager on Windows (Hitachi Tuning Manager server component) allows local users to read and write specific files.This issue affects Hitachi Tuning Manager: before 8.8.5-04. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-104/index.html
CVE ID: CVE-2023-6458 State: PUBLISHED Published: 2023-12-06T08:10:18.481Z Last Updated: 2024-08-02T08:28:21.829Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-74 Description: Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perform a client-side path traversal. Additional Analyst Notes: - CVE Program Container: References: - https://mattermost.com/security-updates
CVE ID: CVE-2023-6459 State: PUBLISHED Published: 2023-12-06T08:11:36.417Z Last Updated: 2024-12-16T16:02:20.087Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-200 Description: Mattermost is grouping calls in the /metrics endpoint by id and reports that id in the response. Since this id is the channelID, the public /metrics endpoint is revealing channelIDs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2023-6460 State: PUBLISHED Published: 2023-12-04T12:26:29.505Z Last Updated: 2024-08-02T08:28:21.810Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: Google Products: nodejs-firestore Problem Types: CWE-922 Description: A potential logging of the firestore key via logging within nodejs-firestore exists - Developers who were logging objects through this._settings would be logging the firestore key as well potentially exposing it to anyone with logs read access. We recommend upgrading to version 6.1.0 to avoid this issue Additional Analyst Notes: - CVE Program Container: References: - https://github.com/googleapis/nodejs-firestore/pull/1742
CVE ID: CVE-2023-6461 State: PUBLISHED Published: 2023-12-01T13:30:59.196Z Last Updated: 2024-08-02T08:28:21.833Z Severity: HIGH (CVSS 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: viliusle Products: viliusle/minipaint Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Reflected in GitHub repository viliusle/minipaint prior to 4.14.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.com/bounties/9a97d163-1738-4a09-b284-a04716e69dd0 - https://github.com/viliusle/minipaint/commit/f22cb46515c91b1071d48fff3e6c9b92c9b3878c
CVE ID: CVE-2023-6462 State: PUBLISHED Published: 2023-12-01T21:31:03.767Z Last Updated: 2024-08-02T08:28:21.893Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: User Registration and Login System Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in SourceCodester User Registration and Login System 1.0. Affected is an unknown function of the file /endpoint/delete-user.php. The manipulation of the argument user leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-246612. Additional
exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-246612. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.246612 - https://vuldb.com/?ctiid.246612 - https://github.com/qqisee/vulndis/blob/main/xss_delete_user.md
CVE ID: CVE-2023-6463 State: PUBLISHED Published: 2023-12-01T22:31:04.531Z Last Updated: 2024-08-02T08:28:21.830Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: User Registration and Login System Problem Types: CWE-79 Description: A vulnerability has been found in SourceCodester User Registration and Login System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /endpoint/add-user.php. The manipulation of the argument first_name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-246613 was assigned to th
hed remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-246613 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.246613 - https://vuldb.com/?ctiid.246613 - https://github.com/qqisee/vulndis/blob/main/xss_add_user.md
CVE ID: CVE-2023-6464 State: PUBLISHED Published: 2023-12-02T09:00:07.949Z Last Updated: 2024-08-02T08:28:21.986Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: User Registration and Login System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester User Registration and Login System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /endpoint/add-user.php. The manipulation of the argument user leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-246614 is the identifier assigned to this vulnerability. Addition
has been disclosed to the public and may be used. VDB-246614 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.246614 - https://vuldb.com/?ctiid.246614 - https://github.com/qqisee/vulndis/blob/main/sqlInjection_delete_user.md
CVE ID: CVE-2023-6465 State: PUBLISHED Published: 2023-12-02T12:00:07.228Z Last Updated: 2024-11-21T15:29:00.434Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: PHPGurukul Products: Nipah Virus Testing Management System Problem Types: CWE-79 Description: A vulnerability was found in PHPGurukul Nipah Virus Testing Management System 1.0. It has been classified as problematic. This affects an unknown part of the file registered-user-testing.php. The manipulation of the argument regmobilenumber leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is
otely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-246615. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.246615 - https://vuldb.com/?ctiid.246615 - https://github.com/dhabaleshwar/niv_testing_reflectedxss/blob/main/exploit.md
CVE ID: CVE-2023-6466 State: PUBLISHED Published: 2023-12-02T13:31:04.471Z Last Updated: 2024-10-11T17:55:19.882Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Thecosy Products: IceCMS Problem Types: CWE-79 Description: A vulnerability was found in Thecosy IceCMS 2.0.1. It has been declared as problematic. This vulnerability affects unknown code of the file /planet of the component User Comment Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-246616. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refe
er of this vulnerability is VDB-246616. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.246616 - https://vuldb.com/?ctiid.246616 - http://39.106.130.187/
CVE ID: CVE-2023-6467 State: PUBLISHED Published: 2023-12-02T14:00:05.493Z Last Updated: 2024-08-02T08:28:21.869Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Thecosy Products: IceCMS Problem Types: CWE-837 Description: A vulnerability was found in Thecosy IceCMS 2.0.1. It has been rated as problematic. This issue affects some unknown processing of the file /Websquare/likeClickComment/ of the component Comment Like Handler. The manipulation leads to improper enforcement of a single, unique action. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the
omplexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-246617 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.246617 - https://vuldb.com/?ctiid.246617 - http://39.106.130.187/wenjian/2.html
CVE ID: CVE-2023-6470 State: REJECTED Published: N/A Last Updated: 2024-01-26T20:43:25.225Z Description: No description available.
CVE ID: CVE-2023-6472 State: PUBLISHED Published: 2023-12-02T18:31:03.772Z Last Updated: 2024-08-02T08:28:21.802Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: n/a Products: PHPEMS Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in PHPEMS 7.0. This issue affects some unknown processing of the file app\content\cls\api.cls.php of the component Content Section Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-246629 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container:
e used. The identifier VDB-246629 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.246629 - https://vuldb.com/?ctiid.246629 - https://www.yuque.com/u39339523/el4dxs/vs8kw5gql9646xx4
CVE ID: CVE-2023-6473 State: PUBLISHED Published: 2023-12-02T20:31:04.336Z Last Updated: 2024-08-02T08:28:21.906Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Online Quiz System Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in SourceCodester Online Quiz System 1.0. This affects an unknown part of the file take-quiz.php. The manipulation of the argument quiz_taker/year_section leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-246639. Additional Analyst Notes:
to the public and may be used. The associated identifier of this vulnerability is VDB-246639. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.246639 - https://vuldb.com/?ctiid.246639 - https://www.yuque.com/u39339523/el4dxs/mmvgxz2hgb5na0aw
CVE ID: CVE-2023-6474 State: PUBLISHED Published: 2023-12-02T23:31:04.514Z Last Updated: 2025-06-03T02:18:00.896Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: PHPGurukul Products: Nipah Virus Testing Management System Problem Types: CWE-352 Description: A vulnerability has been found in PHPGurukul Nipah Virus Testing Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file manage-phlebotomist.php. The manipulation of the argument pid leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-246640. Additional
xploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-246640. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.246640 - https://vuldb.com/?ctiid.246640 - https://github.com/dhabaleshwar/niv_testing_csrf/blob/main/exploit.md