Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-6427 State: PUBLISHED Published: 2025-06-24T12:28:01.317Z Last Updated: 2025-10-30T16:13:22.016Z Vendors: Mozilla Products: Firefox, Thunderbird Description: An attacker was able to bypass the `connect-src` directive of a Content Security Policy by manipulating subdocuments. This would have also hidden the connections from the Network tab in Devtools. This vulnerability affects Firefox < 140 and Thunderbird < 140. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1966927 - https://www.mozilla.org/security/advisories/mfsa2025-51/ - https://www.mozilla.org/security/advisories/mfsa2025-54/
CVE ID: CVE-2025-6428 State: PUBLISHED Published: 2025-06-24T12:28:02.201Z Last Updated: 2025-10-30T16:13:24.727Z Vendors: Mozilla Products: Firefox Description: When a URL was provided in a link querystring parameter, Firefox for Android would follow that URL instead of the correct URL, potentially leading to phishing attacks. *This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox < 140. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1970151 - https://www.mozilla.org/security/advisories/mfsa2025-51/
CVE ID: CVE-2025-6429 State: PUBLISHED Published: 2025-06-24T12:28:00.819Z Last Updated: 2025-11-03T20:07:03.248Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Description: Firefox could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the URL specified in an `embed` tag. This could have bypassed website security checks that restricted which domains users were allowed to embed. This vulnerability affects Firefox < 140, Firefox ESR < 128.12, Thunderbird < 140, and Thunderbird < 128.12. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1970658 - https://www.m
ulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1970658 - https://www.mozilla.org/security/advisories/mfsa2025-51/ - https://www.mozilla.org/security/advisories/mfsa2025-53/ - https://www.mozilla.org/security/advisories/mfsa2025-54/ - https://www.mozilla.org/security/advisories/mfsa2025-55/
CVE ID: CVE-2025-6430 State: PUBLISHED Published: 2025-06-24T12:28:01.020Z Last Updated: 2025-11-03T20:07:05.987Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Description: When a file download is specified via the `Content-Disposition` header, that directive would be ignored if the file was included via a `&lt;embed&gt;` or `&lt;object&gt;` tag, potentially making a website vulnerable to a cross-site scripting attack. This vulnerability affects Firefox < 140, Firefox ESR < 128.12, Thunderbird < 140, and Thunderbird < 128.12. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1971140 - https://
ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1971140 - https://www.mozilla.org/security/advisories/mfsa2025-51/ - https://www.mozilla.org/security/advisories/mfsa2025-53/ - https://www.mozilla.org/security/advisories/mfsa2025-54/ - https://www.mozilla.org/security/advisories/mfsa2025-55/
CVE ID: CVE-2025-6431 State: PUBLISHED Published: 2025-06-24T12:28:03.475Z Last Updated: 2025-10-30T16:13:28.180Z Vendors: Mozilla Products: Firefox Description: When a link can be opened in an external application, Firefox for Android will, by default, prompt the user before doing so. An attacker could have bypassed this prompt, potentially exposing the user to security vulnerabilities or privacy leaks in external applications. *This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox < 140. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1942716 - https://www.mozill
Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1942716 - https://www.mozilla.org/security/advisories/mfsa2025-51/
CVE ID: CVE-2025-6432 State: PUBLISHED Published: 2025-06-24T12:28:03.769Z Last Updated: 2025-10-30T16:13:30.705Z Vendors: Mozilla Products: Firefox, Thunderbird Description: When Multi-Account Containers was enabled, DNS requests could have bypassed a SOCKS proxy when the domain name was invalid or the SOCKS proxy was not responding. This vulnerability affects Firefox < 140 and Thunderbird < 140. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1943804 - https://www.mozilla.org/security/advisories/mfsa2025-51/ - https://www.mozilla.org/security/advisories/mfsa2025-54/
CVE ID: CVE-2025-6433 State: PUBLISHED Published: 2025-06-24T12:28:04.065Z Last Updated: 2025-10-30T16:13:34.564Z Vendors: Mozilla Products: Firefox, Thunderbird Description: If a user visited a webpage with an invalid TLS certificate, and granted an exception, the webpage was able to provide a WebAuthn challenge that the user would be prompted to complete. This is in violation of the WebAuthN spec which requires "a secure transport established without errors". This vulnerability affects Firefox < 140 and Thunderbird < 140. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1954033 - https://www.mozilla.org/security/advisories/mfsa20
References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1954033 - https://www.mozilla.org/security/advisories/mfsa2025-51/ - https://www.mozilla.org/security/advisories/mfsa2025-54/
CVE ID: CVE-2025-6434 State: PUBLISHED Published: 2025-06-24T12:28:04.375Z Last Updated: 2025-10-30T16:13:36.740Z Vendors: Mozilla Products: Firefox, Thunderbird Description: The exception page for the HTTPS-Only feature, displayed when a website is opened via HTTP, lacked an anti-clickjacking delay, potentially allowing an attacker to trick a user into granting an exception and loading a webpage over HTTP. This vulnerability affects Firefox < 140 and Thunderbird < 140. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1955182 - https://www.mozilla.org/security/advisories/mfsa2025-51/ - https://www.mozilla.org/security/advisories/mf
i?id=1955182 - https://www.mozilla.org/security/advisories/mfsa2025-51/ - https://www.mozilla.org/security/advisories/mfsa2025-54/
CVE ID: CVE-2025-6435 State: PUBLISHED Published: 2025-06-24T12:28:04.603Z Last Updated: 2025-10-30T16:13:40.022Z Vendors: Mozilla Products: Firefox, Thunderbird Description: If a user saved a response from the Network tab in Devtools using the Save As context menu option, that file may not have been saved with the `.download` file extension. This could have led to the user inadvertently running a malicious executable. This vulnerability affects Firefox < 140 and Thunderbird < 140. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1950056 - https://bugzilla.mozilla.org/show_bug.cgi?id=1961777 - https://www.mozilla.org/security/advis
/show_bug.cgi?id=1950056 - https://bugzilla.mozilla.org/show_bug.cgi?id=1961777 - https://www.mozilla.org/security/advisories/mfsa2025-51/ - https://www.mozilla.org/security/advisories/mfsa2025-54/
CVE ID: CVE-2025-6436 State: PUBLISHED Published: 2025-06-24T12:28:04.830Z Last Updated: 2025-10-30T16:13:44.176Z Vendors: Mozilla Products: Firefox, Thunderbird Description: Memory safety bugs present in Firefox 139 and Thunderbird 139. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 140 and Thunderbird < 140. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1941377%2C1960948%2C1966187%2C1966505%2C1970764%2C1942930 - https://www.mozilla.org/security/advisories/mfsa2025-51/ - https://
%2C1960948%2C1966187%2C1966505%2C1970764%2C1942930 - https://www.mozilla.org/security/advisories/mfsa2025-51/ - https://www.mozilla.org/security/advisories/mfsa2025-54/
CVE ID: CVE-2025-6437 State: PUBLISHED Published: 2025-07-02T03:47:25.020Z Last Updated: 2025-07-02T13:15:09.572Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: scripteo Products: Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager Problem Types: CWE-89 Description: The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the ‘oid’ parameter in all versions up to, and including, 4.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries
aration on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5d74e494-b5a0-4e44-8efe-9f904de6b878?source=cve - https://codecanyon.net/item/ads-pro-plugin-multipurpose-wordpress-advertising-manager/10275010
CVE ID: CVE-2025-6438 State: PUBLISHED Published: 2025-07-11T09:06:32.411Z Last Updated: 2025-11-03T20:07:07.439Z Vendors: Schneider Electric Products: EcoStruxure™ IT Data Center Expert Problem Types: CWE-611 Description: A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause manipulation of SOAP API calls and XML external entities injection resulting in unauthorized file access when the server is accessed via the network using an application account. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-189-01&p_enDocType=Security+and+Safety+
References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-189-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-189-01.pdf
CVE ID: CVE-2025-6439 State: PUBLISHED Published: 2025-10-11T09:28:37.577Z Last Updated: 2025-10-14T20:13:34.718Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: JMA Plugins Products: WooCommerce Designer Pro Problem Types: CWE-22 Description: The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'wcdp_save_canvas_design_ajax' function in all versions up to, and including, 1.9.26. This makes it possible for unauthenticated attackers to delete all files in an arbitrary directory on the server, which c
his makes it possible for unauthenticated attackers to delete all files in an arbitrary directory on the server, which can lead to remote code execution, data loss, or site unavailability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/407a0bc3-2775-4a34-9817-924bf94a4f94?source=cve - https://codecanyon.net/item/woocommerce-designer-pro-cmyk-card-flyer/22027731
CVE ID: CVE-2025-6440 State: PUBLISHED Published: 2025-10-24T07:23:28.109Z Last Updated: 2025-10-24T16:51:11.425Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: JMA Plugins Products: WooCommerce Designer Pro Problem Types: CWE-434 Description: The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'wcdp_save_canvas_design_ajax' function in all versions up to, and including, 1.9.26. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make re
akes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cc2f8da1-7503-45e3-8a7d-0031ce264edf?source=cve - https://codecanyon.net/item/woocommerce-designer-pro-cmyk-card-flyer/22027731
CVE ID: CVE-2025-6441 State: PUBLISHED Published: 2025-07-24T09:22:16.616Z Last Updated: 2025-07-24T13:15:02.281Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: tobias_conrad Products: Webinar Solution: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition Problem Types: CWE-862 Description: The Webinar Solution: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition plugin for WordPress is vulnerable to unauthenticated login token generation due to a missing capability check on the `webinarignition_sign_in_support_staff` and `webinarignition_register_support` functions in all versio
lity check on the `webinarignition_sign_in_support_staff` and `webinarignition_register_support` functions in all versions up to, and including, 4.03.31. This makes it possible for unauthenticated attackers to generate login tokens for arbitrary WordPress users under certain circumstances, issuing authorization cookies which can lead to authentication bypass. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/52c19707-df18-4239-af46-12ea5ee86a4b?source=cve - https://plugins.trac.wordpress.org/browser/webinar-ignition/trunk/inc/class-webinarignition.php#L549 - https://plugins.trac.wordpress.org/browser/webinar-ignition/tr
binar-ignition/trunk/inc/class-webinarignition.php#L549 - https://plugins.trac.wordpress.org/browser/webinar-ignition/trunk/inc/class.WebinarignitionManager.php#L53 - https://plugins.trac.wordpress.org/browser/webinar-ignition/trunk/inc/class.WebinarignitionManager.php#L1040 - https://plugins.trac.wordpress.org/browser/webinar-ignition/trunk/inc/class.WebinarignitionAjax.php#L769
CVE ID: CVE-2025-6442 State: PUBLISHED Published: 2025-06-25T16:52:24.625Z Last Updated: 2025-06-25T20:42:41.093Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N) Vendors: Ruby Products: WEBrick Problem Types: CWE-444 Description: Ruby WEBrick read_header HTTP Request Smuggling Vulnerability. This vulnerability allows remote attackers to smuggle arbitrary HTTP requests on affected installations of Ruby WEBrick. This issue is exploitable when the product is deployed behind an HTTP proxy that fulfills specific conditions. The specific flaw exists within the read_headers method. The issue results from the inconsistent parsing of terminators of HTTP headers. An attacker c
n the read_headers method. The issue results from the inconsistent parsing of terminators of HTTP headers. An attacker can leverage this vulnerability to smuggle arbitrary HTTP requests. Was ZDI-CAN-21876. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-414/ - https://github.com/ruby/webrick/commit/ee60354bcb84ec33b9245e1d1aa6e1f7e8132101#diff-ad02984d873efb089aa51551bc6b7d307a53e0ba1ac439e91d69c2e58a478864
CVE ID: CVE-2025-6443 State: PUBLISHED Published: 2025-06-25T21:29:22.232Z Last Updated: 2025-06-26T14:18:12.575Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: Mikrotik Products: RouterOS Problem Types: CWE-284 Description: Mikrotik RouterOS VXLAN Source IP Improper Access Control Vulnerability. This vulnerability allows remote attackers to bypass access restrictions on affected installations of Mikrotik RouterOS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of remote IP addresses when processing VXLAN traffic. The issue results from the lack of validation of the remote IP address against configur
s when processing VXLAN traffic. The issue results from the lack of validation of the remote IP address against configured values prior to allowing ingress traffic into the internal network. An attacker can leverage this vulnerability to gain access to internal network resources. Was ZDI-CAN-26415. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-424/
CVE ID: CVE-2025-6444 State: PUBLISHED Published: 2025-06-25T17:41:36.933Z Last Updated: 2025-06-25T18:09:55.731Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: ServiceStack Products: ServiceStack Problem Types: CWE-20 Description: ServiceStack GetErrorResponse Improper Input Validation NTLM Relay Vulnerability. This vulnerability allows remote attackers to relay NTLM credentials on affected installations of ServiceStack. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the implementation of the GetErrorResponse method. The issue results from
plementation. The specific flaw exists within the implementation of the GetErrorResponse method. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to relay NTLM credentials in the context of the current user. Was ZDI-CAN-25834. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-415/
CVE ID: CVE-2025-6445 State: PUBLISHED Published: 2025-06-25T17:42:05.996Z Last Updated: 2025-06-25T18:02:27.900Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ServiceStack Products: ServiceStack Problem Types: CWE-22 Description: ServiceStack FindType Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ServiceStack. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the implementation of the FindType method. The issue results from the lack of p
ntation. The specific flaw exists within the implementation of the FindType method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25837. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-416/ - https://docs.servicestack.net/releases/v8_06#reported-vulnerabilities
CVE ID: CVE-2025-6446 State: PUBLISHED Published: 2025-06-21T23:00:11.544Z Last Updated: 2025-06-23T19:27:12.764Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Client Details System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in code-projects Client Details System 1.0. This issue affects some unknown processing of the file /clientdetails/admin/index.php. The manipulation of the argument Username leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
y. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313553 - https://vuldb.com/?ctiid.313553 - https://vuldb.com/?submit.598499 - https://github.com/kakalalaww/CVE/issues/18 - https://code-projects.org/
CVE ID: CVE-2025-6447 State: PUBLISHED Published: 2025-06-21T23:31:06.691Z Last Updated: 2025-06-23T19:27:07.386Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Simple Online Hotel Reservation System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in code-projects Simple Online Hotel Reservation System 1.0. Affected is an unknown function of the file /admin/index.php. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnri
tack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313554 - https://vuldb.com/?ctiid.313554 - https://vuldb.com/?submit.598581 - https://github.com/kakalalaww/CVE/issues/19 - https://code-projects.org/
CVE ID: CVE-2025-6448 State: PUBLISHED Published: 2025-06-22T00:00:16.309Z Last Updated: 2025-06-23T19:27:00.574Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Simple Online Hotel Reservation System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in code-projects Simple Online Hotel Reservation System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/delete_room.php. The manipulation of the argument room_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Note
e attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313555 - https://vuldb.com/?ctiid.313555 - https://vuldb.com/?submit.598586 - https://github.com/zzb1388/cve/issues/8 - https://code-projects.org/
CVE ID: CVE-2025-6449 State: PUBLISHED Published: 2025-06-22T00:31:05.205Z Last Updated: 2025-06-23T19:26:55.202Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Simple Online Hotel Reservation System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Simple Online Hotel Reservation System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/checkout_query.php. The manipulation of the argument transaction_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes
attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313556 - https://vuldb.com/?ctiid.313556 - https://vuldb.com/?submit.598587 - https://github.com/zzb1388/cve/issues/9 - https://code-projects.org/
CVE ID: CVE-2025-6450 State: PUBLISHED Published: 2025-06-22T01:00:21.497Z Last Updated: 2025-06-23T19:26:49.814Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Simple Online Hotel Reservation System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Simple Online Hotel Reservation System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/confirm_reserve.php. The manipulation of the argument transaction_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: -
initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313557 - https://vuldb.com/?ctiid.313557 - https://vuldb.com/?submit.598588 - https://github.com/zzb1388/cve/issues/10 - https://code-projects.org/