Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-48573 State: PUBLISHED Published: 2024-10-29T00:00:00 Last Updated: 2024-10-30T14:32:14.596Z Vendors: n/a Products: n/a Problem Types: n/a Description: A NoSQL injection vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to reset user and administrator account passwords via the "Reset password" feature. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dos-m0nk3y/CVE/tree/main/CVE-2024-48573
CVE ID: CVE-2024-48579 State: PUBLISHED Published: 2024-10-25T00:00:00 Last Updated: 2024-10-25T19:52:05.379Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in Best House rental management system project in php v.1.0 allows a remote attacker to execute arbitrary code via the username parameter of the login request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/baineoli/CVE/blob/main/2024/house%20rental%20management%20system%20-%20SQL%20Injection%20%28Admin%20Login%29.md
CVE ID: CVE-2024-48580 State: PUBLISHED Published: 2024-10-25T00:00:00 Last Updated: 2024-10-25T19:44:15.354Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in Best courier management system in php v.1.0 allows a remote attacker to execute arbitrary code via the email parameter of the login request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/baineoli/CVE/blob/main/2024/courier%20management%20system%20-%20SQL%20Injection%20%28Admin%20Login%29.md
CVE ID: CVE-2024-48581 State: PUBLISHED Published: 2024-10-25T00:00:00 Last Updated: 2024-10-25T19:47:50.410Z Vendors: n/a Products: n/a Problem Types: n/a Description: File Upload vulnerability in Best courier management system in php v.1.0 allows a remote attacker to execute arbitrary code via the admin_class.php component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/baineoli/CVE/blob/main/2024/courier%20management%20system%20-%20Unrestricted%20File%20Upload%20to%20RCE%20%28Sign%20Up%29.md
CVE ID: CVE-2024-48589 State: PUBLISHED Published: 2025-02-06T00:00:00.000Z Last Updated: 2025-02-11T14:21:10.954Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Gilnei Moraes phpABook v.0.9 allows a remote attacker to execute arbitrary code via the rol parameter in index.php Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Exek1el/CVE-2024-48589
CVE ID: CVE-2024-48590 State: PUBLISHED Published: 2025-03-20T00:00:00.000Z Last Updated: 2025-03-24T15:07:05.597Z Vendors: n/a Products: n/a Problem Types: n/a Description: Inflectra SpiraTeam 7.2.00 is vulnerable to Server-Side Request Forgery (SSRF) via the NewsReaderService. This allows an attacker to escalate privileges and obtain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/GCatt-AS/CVE-2024-48590/blob/main/README.md
CVE ID: CVE-2024-48591 State: PUBLISHED Published: 2025-03-20T00:00:00.000Z Last Updated: 2025-03-21T18:55:52.017Z Vendors: n/a Products: n/a Problem Types: n/a Description: Inflectra SpiraTeam 7.2.00 is vulnerable to Cross Site Scripting (XSS). A specially crafted SVG file can be uploaded that will render and execute JavaScript upon direct viewing. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/GCatt-AS/CVE-2024-48591
CVE ID: CVE-2024-48594 State: PUBLISHED Published: 2024-10-28T00:00:00 Last Updated: 2024-10-30T16:46:54.674Z Vendors: n/a Products: n/a Problem Types: n/a Description: File Upload vulnerability in Prison Management System v.1.0 allows a remote attacker to execute arbitrary code via the file upload component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Aa1b/mycve/blob/main/Readme.md
CVE ID: CVE-2024-48597 State: PUBLISHED Published: 2024-10-21T00:00:00 Last Updated: 2024-10-21T19:52:37.881Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Clinic Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /success/editp.php?action=edit. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/h1-wh0areu/bug_report/blob/main/online-clinic-management-system/SQLi-1.md
CVE ID: CVE-2024-48605 State: PUBLISHED Published: 2024-10-22T00:00:00 Last Updated: 2024-10-22T17:14:28.202Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Helakuru Desktop Application v1.1 allows a local attacker to execute arbitrary code via the lack of proper validation of the wow64log.dll file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://medium.com/%40xNEED/dll-hijacking-jagexlauncher-819599165822 - https://clement.notin.org/blog/2020/09/12/CVE-2020-7315-McAfee-Agent-DLL-injection/ - https://www.exploit-db.com/exploits/51461 - https://github.com/surajhacx/HelakuruV.1.1-DLLHijack
CVE ID: CVE-2024-48615 State: PUBLISHED Published: 2025-03-28T00:00:00.000Z Last Updated: 2025-04-01T13:42:43.591Z Vendors: n/a Products: n/a Problem Types: n/a Description: Null Pointer Dereference vulnerability in libarchive 3.7.6 and earlier when running program bsdtar in function header_pax_extension at rchive_read_support_format_tar.c:1844:8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/libarchive/libarchive/releases/download/v3.7.6/libarchive-3.7.6.tar.gz - https://github.com/88Sanghy88/crash-test
CVE ID: CVE-2024-48622 State: PUBLISHED Published: 2024-10-15T00:00:00 Last Updated: 2024-10-15T20:29:15.568Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) issue in DomainMOD below v4.12.0 allows remote attackers to inject JavaScript code via admin/domain-fields/edit.php and the cdfid parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/domainmod/domainmod/issues/174
CVE ID: CVE-2024-48623 State: PUBLISHED Published: 2024-10-15T00:00:00 Last Updated: 2024-10-15T20:24:04.284Z Vendors: n/a Products: n/a Problem Types: n/a Description: In queue\index.php of DomainMOD below v4.12.0, the list_id and domain_id parameters in the GET request can be exploited to cause a reflected Cross Site Scripting (XSS). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/domainmod/domainmod/issues/176
CVE ID: CVE-2024-48624 State: PUBLISHED Published: 2024-10-15T00:00:00 Last Updated: 2024-10-15T17:49:49.981Z Vendors: n/a Products: n/a Problem Types: n/a Description: In segments\edit.php of DomainMOD below v4.12.0, the segid parameter in the GET request can be exploited to cause a reflected Cross Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/domainmod/domainmod/issues/175
CVE ID: CVE-2024-48629 State: PUBLISHED Published: 2024-10-17T00:00:00 Last Updated: 2024-10-17T19:04:39.518Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the IPAddress parameter in the SetGuestZoneRouterSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/pjqwudi1/my_vuln/blob/main/D-link4/vuln_34/34.md
CVE ID: CVE-2024-48630 State: PUBLISHED Published: 2024-10-17T00:00:00 Last Updated: 2024-10-17T19:04:32.716Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the MacAddress parameter in the SetMACFilters2 function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/pjqwudi1/my_vuln/blob/main/D-link4/vuln_41/41.md
CVE ID: CVE-2024-48631 State: PUBLISHED Published: 2024-10-17T00:00:00 Last Updated: 2024-10-17T19:04:24.773Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the SSID parameter in the SetWLanRadioSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/pjqwudi1/my_vuln/blob/main/D-link4/vuln_32/32.md
CVE ID: CVE-2024-48632 State: PUBLISHED Published: 2024-10-17T00:00:00 Last Updated: 2024-10-17T19:04:18.200Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain multiple command injection vulnerabilities via the LocalIPAddress, TCPPorts, and UDPPorts parameters in the SetPortForwardingSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/pjqwudi1/my_vuln/blob/main/D-link4/vuln_39/39.md
CVE ID: CVE-2024-48633 State: PUBLISHED Published: 2024-10-17T00:00:00 Last Updated: 2024-10-17T19:04:11.450Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain multiple command injection vulnerabilities via the ExternalPort, InternalPort, ProtocolNumber, and LocalIPAddress parameters in the SetVirtualServerSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/pjqwudi1/my_vuln/blob/main/D-link4/vuln_40/40.md
CVE ID: CVE-2024-48634 State: PUBLISHED Published: 2024-10-17T00:00:00 Last Updated: 2024-10-17T19:04:05.414Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the key parameter in the SetWLanRadioSecurity function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/pjqwudi1/my_vuln/blob/main/D-link4/vuln_33/33.md
CVE ID: CVE-2024-48635 State: PUBLISHED Published: 2024-10-17T00:00:00 Last Updated: 2024-10-17T19:03:55.490Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the VLANID:2/VID parameter in the SetVLANSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/pjqwudi1/my_vuln/tree/main/D-link4/vuln_38
CVE ID: CVE-2024-48636 State: PUBLISHED Published: 2024-10-17T00:00:00 Last Updated: 2024-10-17T19:03:47.221Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the VLANID:0/VID parameter in the SetVLANSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/pjqwudi1/my_vuln/blob/main/D-link4/vuln_36/36.md
CVE ID: CVE-2024-48637 State: PUBLISHED Published: 2024-10-17T00:00:00 Last Updated: 2024-10-17T19:03:37.004Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the VLANID:1/VID parameter in the SetVLANSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/pjqwudi1/my_vuln/blob/main/D-link4/vuln_37/37.md
CVE ID: CVE-2024-48638 State: PUBLISHED Published: 2024-10-17T00:00:00 Last Updated: 2024-10-17T19:01:01.709Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the SubnetMask parameter in the SetGuestZoneRouterSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/pjqwudi1/my_vuln/blob/main/D-link4/vuln_35/35.md
CVE ID: CVE-2024-48644 State: PUBLISHED Published: 2024-10-22T00:00:00 Last Updated: 2024-10-23T18:23:13.462Z Vendors: n/a Products: n/a Problem Types: n/a Description: Accounts enumeration vulnerability in the Login Component of Reolink Duo 2 WiFi Camera (Firmware Version v3.0.0.1889_23031701) allows remote attackers to determine valid user accounts via login attempts. This can lead to the enumeration of user accounts and potentially facilitate other attacks, such as brute-forcing of passwords. The vulnerability arises from the application responding differently to login attempts with valid and invalid usernames. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://githu
ttempts with valid and invalid usernames. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rosembergpro/CVE-2024-48644
CVE ID: CVE-2024-48645 State: PUBLISHED Published: 2024-10-21T00:00:00 Last Updated: 2024-10-21T20:12:10.383Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AC:L/AV:N/A:N/C:N/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In Minecraft mod "Command Block IDE" up to and including version 0.4.9, a missing authorization (CWE-862) allows any user to modify "function" files used by the game when installed on a dedicated server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/apple502j/f083fbe21a7cfe018036c73a0e5fff9a - https://github.com/arm32x/command-block-ide/commit/42e09840168d9c2fe2ee07f4472d296000b2a416 - https://modrinth.com/mod/com
tps://github.com/arm32x/command-block-ide/commit/42e09840168d9c2fe2ee07f4472d296000b2a416 - https://modrinth.com/mod/command-block-ide/version/0.4.10
CVE ID: CVE-2024-48646 State: PUBLISHED Published: 2024-10-30T00:00:00 Last Updated: 2024-10-31T17:33:33.534Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Unrestricted File Upload vulnerability exists in Sage 1000 v7.0.0, which allows authorized users to upload files without proper validation. An attacker could exploit this vulnerability by uploading malicious files, such as HTML, scripts, or other executable content, that may be executed on the server, leading to further system compromise. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/hx381/Sage-1000-v7.0.0-Exploit/blob/main/README.md
CVE ID: CVE-2024-48647 State: PUBLISHED Published: 2024-10-30T00:00:00 Last Updated: 2024-10-31T17:19:39.252Z Vendors: n/a Products: n/a Problem Types: n/a Description: A file disclosure vulnerability exists in Sage 1000 v7.0.0. This vulnerability allows remote attackers to retrieve arbitrary files from the server's file system by manipulating the URL parameter in HTTP requests. The attacker can exploit this flaw to access sensitive information, including configuration files that may contain credentials and system settings, which could lead to further compromise of the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/hx381/Sage-1000-v7.0.0-Exploit/b
er. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/hx381/Sage-1000-v7.0.0-Exploit/blob/main/README.md
CVE ID: CVE-2024-48648 State: PUBLISHED Published: 2024-10-30T00:00:00 Last Updated: 2024-10-31T17:04:48.538Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Reflected Cross-Site Scripting (XSS) vulnerability exists in the Sage 1000 v 7.0.0. This vulnerability allows attackers to inject malicious scripts into URLs, which are reflected back by the server in the response without proper sanitization or encoding. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/hx381/Sage-1000-v7.0.0-Exploit/blob/main/README.md
CVE ID: CVE-2024-48651 State: PUBLISHED Published: 2024-11-29T00:00:00.000Z Last Updated: 2025-11-03T22:22:03.568Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access to GID 0 because of the lack of supplemental groups from mod_sql. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/proftpd/proftpd/issues/1830 - https://github.com/proftpd/proftpd/commit/cec01cc0a2523453e5da5a486bc6d977c3768db1
CVE ID: CVE-2024-48652 State: PUBLISHED Published: 2024-10-22T00:00:00 Last Updated: 2024-10-23T15:53:54.751Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in camaleon-cms v.2.7.5 allows remote attacker to execute arbitrary code via the content group name field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/paragbagul111/CVE-2024-48652/
CVE ID: CVE-2024-48654 State: PUBLISHED Published: 2024-10-25T00:00:00 Last Updated: 2024-10-25T20:27:11.997Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Blood Bank v.1 allows a remote attacker to execute arbitrary code via a crafted script to the login.php component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Prabhatsk7/CVE/blob/main/CVE-2024-48654 - https://github.com/Prabhatsk7/CVE/commit/d735e4f0bab7267608098284f51b602ead429b27
CVE ID: CVE-2024-48655 State: PUBLISHED Published: 2024-10-25T00:00:00 Last Updated: 2024-10-29T19:19:12.981Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Total.js CMS v.1.0 allows a remote attacker to execute arbitrary code via the func.js file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/totaljs/cms/issues/49 - https://medium.com/%400x0d0x0a/cve-2024-48655-server-side-javascript-code-injection-in-total-js-cms-c5fc18359bdc
CVE ID: CVE-2024-48656 State: PUBLISHED Published: 2024-10-22T00:00:00 Last Updated: 2024-10-23T16:08:59.942Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in student management system in php with source code v.1.0.0 allows a remote attacker to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LeiPudd/Student-Management-System-v1.0-has-Cross-site-Scripting-XSS-
CVE ID: CVE-2024-48657 State: PUBLISHED Published: 2024-10-22T00:00:00 Last Updated: 2024-10-23T16:06:59.565Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in hospital management system in php with source code v.1.0.0 allows a remote attacker to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LeiPudd/Hospital-Management-System-v1.0-has-SQL-Injection-SQLDET-
CVE ID: CVE-2024-48659 State: PUBLISHED Published: 2024-10-21T00:00:00 Last Updated: 2024-10-22T17:29:58.973Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in DCME-320-L <=9.3.2.114 allows a remote attacker to execute arbitrary code via the log_u_umount.php component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/CLan-nad/a879f7696a58656b384c46bf4ba74e80
CVE ID: CVE-2024-48662 State: PUBLISHED Published: 2025-01-27T00:00:00.000Z Last Updated: 2025-01-28T19:39:39.943Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in AdGuard Application v.7.18.1 (4778) and before allows an attacker to execute arbitrary code via a crafted payload to the fontMatrix component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/VuDuc09/vuln_research/tree/main/CVE-2024-48662
CVE ID: CVE-2024-48694 State: PUBLISHED Published: 2024-11-19T00:00:00 Last Updated: 2024-11-21T16:24:26.201Z Vendors: n/a Products: n/a Problem Types: n/a Description: File Upload vulnerability in Xi'an Daxi Information technology OfficeWeb365 v.8.6.1.0 and v7.18.23.0 allows a remote attacker to execute arbitrary code via the pw/savedraw component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Threekiii/Vulnerability-Wiki/blob/master/docs-base/docs/webapp/OfficeWeb365-SaveDraw-%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E.md - https://github.com/luck-ying/Library-POC/blob/master/2023HW/2023.8.15/OfficeWeb365_SaveDraw%E4%BB%BB%
C%8F%E6%B4%9E.md - https://github.com/luck-ying/Library-POC/blob/master/2023HW/2023.8.15/OfficeWeb365_SaveDraw%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E.py - https://github.com/xuetang1125/OfficeWeb365/blob/main/OfficeWeb365%20SaveDraw%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E%20%282%29.md - https://avd.aliyun.com/detail?id=AVD-2023-1678930 - https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/32024c5dbb7ff60fa7347cccf6ebb3763a513e7a/docs/wiki/webapp/OfficeWeb365/OfficeWeb365%20SaveDraw%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E.md?plain=1#L24
CVE ID: CVE-2024-48700 State: PUBLISHED Published: 2024-10-25T00:00:00 Last Updated: 2024-10-29T19:03:48.164Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kliqqi-CMS has a background arbitrary code execution vulnerability that attackers can exploit to implant backdoors or getShell via the edit_page.php component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ChangeYourWay/post/blob/main/CVE-2024-48700
CVE ID: CVE-2024-48702 State: PUBLISHED Published: 2025-05-23T00:00:00.000Z Last Updated: 2025-05-29T15:13:12.031Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPGurukul Old Age Home Management System v1.0 is vulnerable to HTML Injection via the searchdata parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/0xBhushan/Writeups/blob/main/CVE/phpGurukul/Medical%20Card%20Generation%20System/HTML%20Injection%28pagedes%29.pdf
CVE ID: CVE-2024-48703 State: PUBLISHED Published: 2024-12-06T00:00:00 Last Updated: 2024-12-11T16:42:52.993Z Vendors: n/a Products: n/a Problem Types: n/a Description: PhpGurukul Medical Card Generation System v1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/search-medicalcard.php via the searchdata parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/0xBhushan/Writeups/blob/main/CVE/phpGurukul/Medical%20Card%20Generation%20System/Reflected%20Cross-Site%20Scripting%20%28XSS%29-Search.pdf
CVE ID: CVE-2024-48704 State: PUBLISHED Published: 2025-05-23T00:00:00.000Z Last Updated: 2025-06-02T17:59:12.381Z Vendors: n/a Products: n/a Problem Types: n/a Description: Phpgurukul Medical Card Generation System v1.0 is vulnerable to HTML Injection in admin/contactus.php via the parameter pagedes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/0xBhushan/Writeups/blob/main/CVE/phpGurukul/Medical%20Card%20Generation%20System/HTML%20Injection%28pagedes%29.pdf