Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
o the public and may be used. The identifier of this vulnerability is VDB-264532. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.264532 - https://vuldb.com/?ctiid.264532 - https://vuldb.com/?submit.333783 - https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/%3CWHB%7Cj%5CIbSU0m4%3A_/D-LINK-DAR-7000_upload_%20urlblist.php.pdf - https://supportannouncement.us.dlink.com/security/publication.aspx?nam
%3A_/D-LINK-DAR-7000_upload_%20urlblist.php.pdf - https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10354
CVE ID: CVE-2024-4965 State: PUBLISHED Published: 2024-05-16T07:31:07.390Z Last Updated: 2024-08-08T14:41:28.409Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: D-Link Products: DAR-7000-40 Problem Types: CWE-78 Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000-40 V31R02B1413C and classified as critical. This issue affects some unknown processing of the file /useratte/resmanage.php. The manipulation of the argument load leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-264533 was assigned to this vulnerability. NOTE: This vulnerability only
the public and may be used. The identifier VDB-264533 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.264533 - https://vuldb.com/?ctiid.264533 - https://vuldb.com/?submit.333784 - https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/%3CWHB%7Cj%5CIbSU0m4%3A_/D-LINK-DAR-7000_RCE_%20resmanage.php.pdf - https://supportannouncement.us.dlink.com/security/publication.a
5CIbSU0m4%3A_/D-LINK-DAR-7000_RCE_%20resmanage.php.pdf - https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10354
CVE ID: CVE-2024-4966 State: PUBLISHED Published: 2024-05-16T08:00:04.908Z Last Updated: 2024-08-01T20:55:10.389Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: SchoolWebTech Problem Types: CWE-434 Description: A vulnerability was found in SourceCodester SchoolWebTech 1.0. It has been classified as critical. Affected is an unknown function of the file /improve/home.php. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-264534 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment:
be used. VDB-264534 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.264534 - https://vuldb.com/?ctiid.264534 - https://vuldb.com/?submit.334216 - https://github.com/CveSecLook/cve/issues/30
CVE ID: CVE-2024-4967 State: PUBLISHED Published: 2024-05-16T08:31:04.218Z Last Updated: 2024-08-01T20:55:10.431Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Interactive Map with Marker Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Interactive Map with Marker 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /endpoint/delete-mark.php. The manipulation of the argument mark leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-264535. Addi
it has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-264535. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.264535 - https://vuldb.com/?ctiid.264535 - https://vuldb.com/?submit.335190 - https://github.com/BurakSevben/CVEs/blob/main/Interactive%20Map%20App/Interactive%20Map%20App%20-%20SQL%20Injection.md
CVE ID: CVE-2024-4968 State: PUBLISHED Published: 2024-05-16T08:31:05.608Z Last Updated: 2024-08-01T20:55:10.396Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Interactive Map with Marker Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Interactive Map with Marker 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file Marker Name of the component Add Marker. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264536. Additional Analyst Note
een disclosed to the public and may be used. The identifier of this vulnerability is VDB-264536. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.264536 - https://vuldb.com/?ctiid.264536 - https://vuldb.com/?submit.335191 - https://github.com/BurakSevben/CVEs/blob/main/Interactive%20Map%20App/Interactive%20Map%20App%20-%20Cross-Site-Scripting.md
CVE ID: CVE-2024-4969 State: PUBLISHED Published: 2024-06-21T06:00:05.590Z Last Updated: 2024-08-01T20:55:10.397Z Vendors: Unknown Products: Widget Bundle Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Widget Bundle WordPress plugin through 2.0.0 does not have CSRF checks when logging Widgets, which could allow attackers to make logged in admin enable/disable widgets via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/1a7ec5dc-eda4-4fed-9df9-f41d2b937fed/
CVE ID: CVE-2024-4970 State: PUBLISHED Published: 2024-06-21T06:00:05.870Z Last Updated: 2025-03-18T14:10:18.475Z Vendors: Unknown Products: Widget Bundle Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Widget Bundle WordPress plugin through 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/4a9fc352-7ec2-4992-9cda-7bdca4f42788/
CVE ID: CVE-2024-4971 State: PUBLISHED Published: 2024-05-22T05:32:46.886Z Last Updated: 2024-08-01T20:55:10.435Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: thimpress Products: LearnPress – WordPress LMS Plugin Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 4.2.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages
tion and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/10b08a05-3561-4d05-985b-6a2339a547a7?source=cve - https://wordpress.org/plugins/learnpress/#developers
CVE ID: CVE-2024-4972 State: PUBLISHED Published: 2024-05-16T09:00:04.678Z Last Updated: 2024-08-01T20:55:10.397Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Simple Chat System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in code-projects Simple Chat System 1.0. This affects an unknown part of the file /login.php. The manipulation of the argument email/password leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-264537 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CV
d. The identifier VDB-264537 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.264537 - https://vuldb.com/?ctiid.264537 - https://vuldb.com/?submit.335199 - https://github.com/BurakSevben/CVEs/blob/main/Simple%20Chat%20App/Simple%20Chat%20App%20-%20SQL%20Injection%20-%201.md
CVE ID: CVE-2024-4973 State: PUBLISHED Published: 2024-05-16T09:31:04.488Z Last Updated: 2024-08-01T20:55:10.387Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Simple Chat System Problem Types: CWE-89 Description: A vulnerability classified as critical was found in code-projects Simple Chat System 1.0. This vulnerability affects unknown code of the file /register.php. The manipulation of the argument name/number/address leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-264538 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: -
used. VDB-264538 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.264538 - https://vuldb.com/?ctiid.264538 - https://vuldb.com/?submit.335200 - https://github.com/BurakSevben/CVEs/blob/main/Simple%20Chat%20App/Simple%20Chat%20App%20-%20SQL%20Injection%20-%202.md
CVE ID: CVE-2024-4974 State: PUBLISHED Published: 2024-05-16T09:31:06.058Z Last Updated: 2024-08-01T20:55:10.412Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: code-projects Products: Simple Chat System Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in code-projects Simple Chat System 1.0. Affected is an unknown function of the file /register.php. The manipulation of the argument name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264540. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE
ay be used. The identifier of this vulnerability is VDB-264540. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.264540 - https://vuldb.com/?ctiid.264540 - https://vuldb.com/?submit.335205 - https://github.com/BurakSevben/CVEs/blob/main/Simple%20Chat%20App/Simple%20Chat%20App%20-%20Cross-Site-Scripting-1.md
CVE ID: CVE-2024-4975 State: PUBLISHED Published: 2024-05-16T10:00:05.161Z Last Updated: 2024-08-01T20:55:10.366Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: code-projects Products: Simple Chat System Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in code-projects Simple Chat System 1.0. This issue affects some unknown processing of the component Message Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-264539. Additional Analyst Notes: - CISA ADP Vulnrichment:
used. The associated identifier of this vulnerability is VDB-264539. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.264539 - https://vuldb.com/?ctiid.264539 - https://vuldb.com/?submit.335206 - https://github.com/BurakSevben/CVEs/blob/main/Simple%20Chat%20App/Simple%20Chat%20App%20-%20Cross-Site-Scripting-2.md
CVE ID: CVE-2024-4976 State: PUBLISHED Published: 2024-05-15T20:34:24.716Z Last Updated: 2024-08-01T20:55:10.484Z Vendors: Xpdf Products: Xpdf Problem Types: CWE-787 Description: Out-of-bounds array write in Xpdf 4.05 and earlier, due to missing object type check in AcroForm field reference. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.xpdfreader.com/security-bug/CVE-2024-4976.html
CVE ID: CVE-2024-4977 State: PUBLISHED Published: 2024-07-13T06:00:06.897Z Last Updated: 2024-08-01T20:55:10.402Z Vendors: Unknown Products: Index WP MySQL For Speed Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Index WP MySQL For Speed WordPress plugin before 1.4.18 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/89791a80-5cff-4a1a-8163-94b5be4081a5/
CVE ID: CVE-2024-4978 State: PUBLISHED Published: 2024-05-23T01:56:37.946Z Last Updated: 2025-10-21T23:05:17.733Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: Justice AV Solutions Products: Viewer Problem Types: CWE-506 Description: Justice AV Solutions Viewer Setup 8.3.7.250-1 contains a malicious binary when executed and is signed with an unexpected authenticode signature. A remote, privileged threat actor may exploit this vulnerability to execute of unauthorized PowerShell commands. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://twitter.com/2RunJack2/status/1775052981966377148 - https://www.rapid7.com/bl
VE Program Container: References: - https://twitter.com/2RunJack2/status/1775052981966377148 - https://www.rapid7.com/blog/post/2024/05/23/cve-2024-4978-backdoored-justice-av-solutions-viewer-software-used-in-apparent-supply-chain-attack/ - https://www.javs.com/downloads/
CVE ID: CVE-2024-4980 State: PUBLISHED Published: 2024-05-22T04:30:29.111Z Last Updated: 2024-08-01T20:55:10.413Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpkoithemes Products: WPKoi Templates for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WPKoi Templates for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'id', 'mixColor', 'backgroundColor', 'saveInCookies', and 'autoMatchOsTheme' parameters in all versions up to, and including, 2.5.9 due to insufficient input sanitization and output escaping. This makes it possible for authentic
o, and including, 2.5.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6054a885-e67a-4731-93ea-64d7f90d9ea8?source=cve - https://plugins.trac.wordpress.org/browser/wpkoi-templates-for-elementor/trunk/elements/elements/advanced-heading/advanced-heading.php#L626 - https://plugins.trac.wordpress.org/browser/wpkoi-templates-for-elementor/trunk/el
ed-heading/advanced-heading.php#L626 - https://plugins.trac.wordpress.org/browser/wpkoi-templates-for-elementor/trunk/elements/elements/qr-code/qr-code.php#L110 - https://plugins.trac.wordpress.org/browser/wpkoi-templates-for-elementor/trunk/elements/elements/darkmode/darkmode.php#L291 - https://plugins.trac.wordpress.org/changeset/3088306/
CVE ID: CVE-2024-4981 State: PUBLISHED Published: 2025-05-12T18:55:08.744Z Last Updated: 2025-05-12T19:05:43.641Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Problem Types: CWE-552 Description: A vulnerability was discovered in Pagure server. If a malicious user were to submit a git repository with symbolic links, the server could unintentionally show incorporate and make visible content from outside the git repo. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2024-4981 - https://bugzilla.redhat.com/show_bug.cgi?id=2278745 - https://bugzilla.redhat.com/show_bug.cgi?id=2280723 - https://pagure.io/pagure/c/
a.redhat.com/show_bug.cgi?id=2278745 - https://bugzilla.redhat.com/show_bug.cgi?id=2280723 - https://pagure.io/pagure/c/454f2677bc50d7176f07da9784882eb2176537f4
CVE ID: CVE-2024-4982 State: PUBLISHED Published: 2025-05-12T19:01:45.824Z Last Updated: 2025-05-12T19:16:28.730Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Problem Types: CWE-22 Description: A directory traversal vulnerability was discovered in Pagure server. If a malicious user submits a specially cratfted git repository they could discover secrets on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2024-4982 - https://bugzilla.redhat.com/show_bug.cgi?id=2279411 - https://bugzilla.redhat.com/show_bug.cgi?id=2280726 - https://pagure.io/pagure/c/c43844d23c919133fc983fe8c0f1dfb3b86e67d0
CVE ID: CVE-2024-4983 State: PUBLISHED Published: 2024-06-27T08:34:20.691Z Last Updated: 2024-08-01T20:55:10.394Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: posimyththemes Products: The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘video_color’ parameter in all versions up to, and including, 5.6.0 due to insufficie
tored Cross-Site Scripting via the ‘video_color’ parameter in all versions up to, and including, 5.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e3f0a20b-d572-4040-b5b6-ede0aec4e2b0?source=cve - https://plugins.trac.wordpress.org/browser/the-plus-addons-for-elementor-page-builder/tags/5.5.3/modules/widgets/tp_video_player.php#L1302 - htt
dpress.org/browser/the-plus-addons-for-elementor-page-builder/tags/5.5.3/modules/widgets/tp_video_player.php#L1302 - https://plugins.trac.wordpress.org/changeset/3107776/
CVE ID: CVE-2024-4984 State: PUBLISHED Published: 2024-05-16T02:02:35.901Z Last Updated: 2024-08-01T20:55:10.330Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: yoast Products: Yoast SEO Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Yoast SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘display_name’ author meta in all versions up to, and including, 22.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that w
le for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/59bcd246-ca2f-4336-9a6e-89afe873ed25?source=cve - https://github.com/Yoast/wordpress-seo/pull/21334 - https://plugins.trac.wordpress.org/changeset/3079234/wordpress-seo/trunk/src/presenters/slack/enhanced-data-presenter.php - https://developer.yoast.com/changelog/yoast-seo/22.7/
CVE ID: CVE-2024-4985 State: PUBLISHED Published: 2024-05-20T21:17:27.315Z Last Updated: 2024-08-01T20:55:10.505Z Vendors: GitHub Products: Enterprise Server Problem Types: CWE-303 Description: An authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES) when utilizing SAML single sign-on authentication with the optional encrypted assertions feature. This vulnerability allowed an attacker to forge a SAML response to provision and/or gain access to a user with site administrator privileges. Exploitation of this vulnerability would allow unauthorized access to the instance without requiring prior authentication. This vulnerability affected all versions of GitHub En
zed access to the instance without requiring prior authentication. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.13.0 and was fixed in versions 3.9.15, 3.10.12, 3.11.10 and 3.12.4. This vulnerability was reported via the GitHub Bug Bounty program. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.15 - https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.12 - https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.10 - https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.4
CVE ID: CVE-2024-4988 State: PUBLISHED Published: 2024-05-21T10:04:10.672Z Last Updated: 2024-08-21T05:37:55.582Z Vendors: TECNO Products: com.transsion.videocallenhancer Problem Types: CWE-269 Description: The mobile application (com.transsion.videocallenhancer) interface has improper permission control, which can lead to the risk of private file leakage. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.tecno.com/SRC/blogdetail/250?lang=en_US - https://security.tecno.com/SRC/securityUpdates?type=SA
CVE ID: CVE-2024-4990 State: PUBLISHED Published: 2025-03-20T10:11:14.988Z Last Updated: 2025-03-20T13:31:05.950Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: yiisoft Products: yiisoft/yii2 Problem Types: CWE-470 Description: In yiisoft/yii2 version 2.0.48, the base Component class contains a vulnerability where the `__set()` magic method does not validate that the value passed is a valid Behavior class name or configuration. This allows an attacker to instantiate arbitrary classes, passing parameters to their constructors and invoking setter methods. Depending on the installed dependencies, various types of attacks are possible, including the execution of
ter methods. Depending on the installed dependencies, various types of attacks are possible, including the execution of arbitrary code, retrieval of sensitive information, and unauthorized access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/4fbdd965-02b6-42e4-b57b-f98f93415b8f
CVE ID: CVE-2024-4991 State: PUBLISHED Published: 2024-05-16T11:42:49.357Z Last Updated: 2024-08-01T20:55:10.445Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SiAdmin Products: SiAdmin Problem Types: CWE-89 Description: Vulnerability in SiAdmin 1.1 that allows SQL injection via the /modul/mod_pass/aksi_pass.php parameter in nama_lengkap. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in it. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-siadmin