Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/79cce1fc-a27f-4842-b1a2-2c53857add4c?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2991103%40ultimate-dashboard%2Ftrunk&old=2958955%40ultimate-dashboard%2Ftrunk&sfp_email=&sfph_mail=#file5
CVE ID: CVE-2023-4727 State: PUBLISHED Published: 2024-06-11T19:30:25.613Z Last Updated: 2025-11-20T07:06:06.877Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Certificate System 10.4 EUS for RHEL-8, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services for S
port, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Enterprise Linux 6 Problem Types: CWE-305 Description: A flaw was found in dogtag-pki and pki-core. The token authentication scheme can be bypassed with a LDAP injection. By passing the query string parameter sessionID=*, an attacker can authenticate with an existing session saved in the LDAP directory server, which may lead to escalation of privilege. Add
authenticate with an existing session saved in the LDAP directory server, which may lead to escalation of privilege. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:4051 - https://access.redhat.com/errata/RHSA-2024:4070 - https://access.redhat.com/errata/RHSA-2024:4164 - https://access.redhat.com/errata/RHSA-2024:4165 - https://access.redhat.com/errata/RHSA-2024:4179 - https://access.redhat.com/errata/RHSA-2024:4222 - https://access.redhat.com/errata/RHSA-2024:4367 - https://access.redhat.com/errata/RHSA-2024:4403 - https://access.redhat.com/errata/RHSA-2024:4413 - https://access.redhat.com/security/cve/CVE-
om/errata/RHSA-2024:4403 - https://access.redhat.com/errata/RHSA-2024:4413 - https://access.redhat.com/security/cve/CVE-2023-4727 - https://bugzilla.redhat.com/show_bug.cgi?id=2232218
CVE ID: CVE-2023-4728 State: PUBLISHED Published: 2024-03-12T09:33:55.846Z Last Updated: 2024-08-02T07:38:00.506Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: binhnguyenplus Products: LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing… Problem Types: CWE-862 Missing Authorization Description: The LadiApp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the publish_lp() function hooked via an AJAX action in versions up to, and including, 4.4. This makes it possible for authenticated attackers with subscriber-level access and above to change the LadiPage key (a key fully contr
ossible for authenticated attackers with subscriber-level access and above to change the LadiPage key (a key fully controlled by the attacker), enabling them to freely create new pages, including web pages that trigger stored XSS Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6dafc81c-f1be-422d-b34f-87f1956e8849?source=cve - https://plugins.trac.wordpress.org/browser/ladipage/trunk/ladipage.php#L1992
CVE ID: CVE-2023-4729 State: PUBLISHED Published: 2024-03-12T09:33:56.755Z Last Updated: 2024-08-02T07:37:59.533Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: binhnguyenplus Products: LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing… Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The LadiApp plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the publish_lp() function hooked via an AJAX action in versions up to, and including, 4.4. This makes it possible for unauthenticated attackers to change the LadiPage key (a key fully controlled by the attacker), enabling them
ossible for unauthenticated attackers to change the LadiPage key (a key fully controlled by the attacker), enabling them to freely create new pages, including web pages that trigger stored XSS via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/db707507-c53f-45b8-a8e1-7fea1c6f8f3c?source=cve - https://plugins.trac.wordpress.org/browser/ladipage/trunk/ladipage.php#L1992
CVE ID: CVE-2023-4730 State: PUBLISHED Published: 2024-08-17T07:34:23.344Z Last Updated: 2024-08-19T17:39:25.220Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: binhnguyenplus Products: LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing… Problem Types: CWE-862 Description: The LadiApp plugn for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the init_endpoint() function hooked via 'init' in versions up to, and including, 4.3. This makes it possible for unauthenticated attackers to modify a variety of settings. An attacker can directly modify the 'ladipage_key' which enables them to crea
attackers to modify a variety of settings. An attacker can directly modify the 'ladipage_key' which enables them to create new posts on the website and inject malicious web scripts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6c4baf2e-7f5e-4954-88f9-76d32f297aab?source=cve - https://plugins.trac.wordpress.org/browser/ladipage/trunk/ladipage.php#L153 - https://plugins.trac.wordpress.org/browser/ladipage/trunk/ladipage.php#L175 - https://plugins.trac.wordpress.org/browser/ladipage/trunk/ladipage.php#L187
CVE ID: CVE-2023-4731 State: PUBLISHED Published: 2024-03-12T09:33:54.929Z Last Updated: 2024-08-02T07:37:59.920Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: binhnguyenplus Products: LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing… Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The LadiApp plugn for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the init_endpoint() function hooked via 'init' in versions up to, and including, 4.4. This makes it possible for unauthenticated attackers to modify a variety of settings, via a forged request granted they can trick a site admi
e for unauthenticated attackers to modify a variety of settings, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. An attacker can directly modify the 'ladipage_key' which enables them to create new posts on the website and inject malicious web scripts, Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1a46fd57-4cb9-4d98-89b6-926d74b2ab33?source=cve - https://plugins.trac.wordpress.org/browser/ladipage/trunk/ladipage.php#L153 - https://plugins.trac.wordpress.org/browser/ladipage/trunk/ladipage.php#L175 - https://plugins.trac.wo
adipage.php#L153 - https://plugins.trac.wordpress.org/browser/ladipage/trunk/ladipage.php#L175 - https://plugins.trac.wordpress.org/browser/ladipage/trunk/ladipage.php#L187
CVE ID: CVE-2023-4732 State: PUBLISHED Published: 2023-10-03T16:55:01.864Z Last Updated: 2025-11-07T13:03:51.808Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Virtualization 4 for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 Problem Types: CWE-366 Description: A flaw was found in pfn_swap_entry_to_page in memory management subsystem in the Linux Kernel. In this flaw, an attacker with a local user privilege may cause a denial of ser
anagement subsystem in the Linux Kernel. In this flaw, an attacker with a local user privilege may cause a denial of service problem due to a BUG statement referencing pmd_t x. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:6901 - https://access.redhat.com/errata/RHSA-2023:7077 - https://access.redhat.com/errata/RHSA-2023:7539 - https://access.redhat.com/errata/RHSA-2024:0412 - https://access.redhat.com/security/cve/CVE-2023-4732 - https://bugzilla.redhat.com/show_bug.cgi?id=2236982
CVE ID: CVE-2023-4733 State: PUBLISHED Published: 2023-09-04T13:47:09.888Z Last Updated: 2025-02-13T17:17:57.929Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-416 Description: Use After Free in GitHub repository vim/vim prior to 9.0.1840. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/1ce1fd8c-050a-4373-8004-b35b61590217 - https://github.com/vim/vim/commit/e1dc9a627536304bc4f738c21e909ad9fcf3974c - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ITRVK4FB74RZDIGTZJXOZMUW6X6F4TNF/ - https://lists.fedoraproject.org/archives/list/
ounce@lists.fedoraproject.org/message/ITRVK4FB74RZDIGTZJXOZMUW6X6F4TNF/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PFE3LDFRZ7EGWA5AU7YHYL62ELBOFZWQ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I56ITJAFMFAQ2G3BMGTCGM3GS62V2DTR/ - https://support.apple.com/kb/HT213984 - http://seclists.org/fulldisclosure/2023/Oct/24
CVE ID: CVE-2023-4734 State: PUBLISHED Published: 2023-09-02T17:42:18.019Z Last Updated: 2025-02-13T17:17:58.508Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-190 Description: Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1846. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/688e4382-d2b6-439a-a54e-484780f82217 - https://github.com/vim/vim/commit/4c6fe2e2ea62469642ed1d80b16d39e616b25cf5 - https://support.apple.com/kb/HT213984 - http://seclists.org/fulldisclosure/2023/Oct/24
CVE ID: CVE-2023-4735 State: PUBLISHED Published: 2023-09-02T17:46:39.657Z Last Updated: 2025-02-13T17:17:59.248Z Severity: MEDIUM (CVSS 4.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: vim Products: vim/vim Problem Types: CWE-787 Description: Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1847. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/fc83bde3-f621-42bd-aecb-8c1ae44cba51 - https://github.com/vim/vim/commit/889f6af37164775192e33b233a90e86fd3df0f57 - https://support.apple.com/kb/HT213984 - http://seclists.org/fulldisclosure/2023/Oct/24
CVE ID: CVE-2023-4736 State: PUBLISHED Published: 2023-09-02T18:02:05.557Z Last Updated: 2025-02-13T17:17:59.866Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-426 Description: Untrusted Search Path in GitHub repository vim/vim prior to 9.0.1833. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/e1ce0995-4df4-4dec-9cd7-3136ac3e8e71 - https://github.com/vim/vim/commit/816fbcc262687b81fc46f82f7bbeb1453addfe0c - https://support.apple.com/kb/HT213984 - http://seclists.org/fulldisclosure/2023/Oct/24
CVE ID: CVE-2023-4737 State: PUBLISHED Published: 2023-09-27T07:53:45.160Z Last Updated: 2024-09-23T20:14:39.925Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hedef Tracking Products: Admin Panel Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hedef Tracking Admin Panel allows SQL Injection.This issue affects Admin Panel: before 1.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0559
CVE ID: CVE-2023-4738 State: PUBLISHED Published: 2023-09-02T19:39:14.290Z Last Updated: 2025-11-03T20:36:03.988Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-122 Description: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1848. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/9fc7dced-a7bb-4479-9718-f956df20f612 - https://github.com/vim/vim/commit/ced2c7394aafdc90fb7845e09b3a3fee23d48cb1 - https://support.apple.com/kb/HT213984 - http://seclists.org/fulldisclosure/2023/Oct/24
CVE ID: CVE-2023-4739 State: PUBLISHED Published: 2023-09-03T19:31:04.594Z Last Updated: 2024-11-21T14:49:59.342Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Byzoro Products: Smart S85F Management Platform Problem Types: CWE-434 Description: A vulnerability, which was classified as critical, has been found in Byzoro Smart S85F Management Platform up to 20230820. Affected by this issue is some unknown functionality of the file /sysmanage/updateos.php. The manipulation of the argument 1_file_upload leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-238628.
tely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-238628. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.238628 - https://vuldb.com/?ctiid.238628 - https://vuldb.com/?submit.197572 - https://github.com/Meizhi-hua/cve/blob/main/upload_file.md
CVE ID: CVE-2023-4740 State: PUBLISHED Published: 2023-09-03T20:00:05.762Z Last Updated: 2025-06-25T14:27:40.566Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: IBOS Products: OA Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in IBOS OA 4.5.5. This affects an unknown part of the file ?r=email/api/delDraft&archiveId=0 of the component Delete Draft Handler. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-238629 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did
tifier VDB-238629 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.238629 - https://vuldb.com/?ctiid.238629 - https://github.com/RCEraser/cve/blob/main/sql_inject.md
CVE ID: CVE-2023-4741 State: PUBLISHED Published: 2023-09-03T22:00:08.323Z Last Updated: 2024-10-01T13:05:43.703Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: IBOS Products: OA Problem Types: CWE-89 Description: A vulnerability has been found in IBOS OA 4.5.5 and classified as critical. This vulnerability affects unknown code of the file ?r=diary/default/del of the component Delete Logs Handler. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-238630 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in a
fier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.238630 - https://vuldb.com/?ctiid.238630 - https://github.com/wudidike/cve/blob/main/sql.md
CVE ID: CVE-2023-4742 State: PUBLISHED Published: 2023-09-03T22:31:04.223Z Last Updated: 2024-10-01T13:05:07.087Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: IBOS Products: OA Problem Types: CWE-89 Description: A vulnerability was found in IBOS OA 4.5.5 and classified as critical. This issue affects some unknown processing of the file ?r=dashboard/user/export&uid=X. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-238631. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst
B-238631. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.238631 - https://vuldb.com/?ctiid.238631 - https://github.com/gatsby2003/cve/blob/main/sql.md
CVE ID: CVE-2023-4743 State: PUBLISHED Published: 2023-09-03T23:00:06.540Z Last Updated: 2024-11-21T14:49:14.520Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Dreamer Products: CMS Problem Types: CWE-552 Description: A vulnerability was found in Dreamer CMS up to 4.1.3. It has been classified as problematic. Affected is an unknown function of the file /upload/ueditorConfig?action=config. The manipulation leads to files or directories accessible. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier of th
ploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-238632. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.238632 - https://vuldb.com/?ctiid.238632 - https://github.com/FFR66/Dreamer-CMS_Unauthorized-access-vulnerability
CVE ID: CVE-2023-4744 State: PUBLISHED Published: 2023-09-03T23:31:04.502Z Last Updated: 2024-09-30T20:37:02.940Z Severity: N/A (CVSS 10 AV:N/AC:L/Au:N/C:C/I:C/A:C) Vendors: Tenda Products: AC8 Problem Types: CWE-121 Description: A vulnerability was found in Tenda AC8 16.03.34.06_cn_TDC01. It has been declared as critical. Affected by this vulnerability is the function formSetDeviceName. The manipulation leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-238633 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - htt
ned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.238633 - https://vuldb.com/?ctiid.238633 - https://github.com/GleamingEyes/vul/blob/main/tenda_ac8/ac8_1.md
CVE ID: CVE-2023-4745 State: PUBLISHED Published: 2023-09-03T23:31:05.562Z Last Updated: 2024-08-02T07:38:00.590Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Byzoro Products: Smart S45F Multi-Service Secure Gateway Intelligent Management Platform Problem Types: CWE-89 Description: A vulnerability was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230822. It has been rated as critical. Affected by this issue is some unknown functionality of the file /importexport.php. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-238634 is the iden
he attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-238634 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.238634 - https://vuldb.com/?ctiid.238634 - https://vuldb.com/?submit.198222 - https://github.com/Jacky-Y/vuls/blob/main/vul6.md
CVE ID: CVE-2023-4746 State: PUBLISHED Published: 2023-09-04T00:00:13.761Z Last Updated: 2024-08-02T07:37:59.564Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: TOTOLINK Products: N200RE V5 Problem Types: CWE-134 Description: A vulnerability classified as critical has been found in TOTOLINK N200RE V5 9.3.5u.6437_B20230519. This affects the function Validity_check. The manipulation leads to format string. It is possible to initiate the attack remotely. The root-cause of the vulnerability is a format string issue. But the impact is to bypass the validation which leads to to OS command injection. The exploit has been disclosed to the public and may be used. The associated identifier
eads to to OS command injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-238635. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.238635 - https://vuldb.com/?ctiid.238635 - https://gist.github.com/dmknght/8f3b6aa65e9d08f45b5236c6e9ab8d80
CVE ID: CVE-2023-4747 State: PUBLISHED Published: 2023-09-04T00:00:16.227Z Last Updated: 2024-08-02T07:38:00.326Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: DedeCMS Problem Types: CWE-89 Description: A vulnerability classified as critical was found in DedeCMS 5.7.110. This vulnerability affects unknown code of the file /uploads/tags.php. The manipulation of the argument tag_alias leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-238636. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?
DB-238636. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.238636 - https://vuldb.com/?ctiid.238636 - https://github.com/laoquanshi/cve - https://github.com/laoquanshi/cve/blob/main/dedecms%20%20sql%20%20injection
CVE ID: CVE-2023-4748 State: PUBLISHED Published: 2023-09-05T06:00:07.518Z Last Updated: 2024-08-02T07:37:59.632Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Yongyou Products: UFIDA-NC Problem Types: CWE-22 Description: A vulnerability, which was classified as critical, has been found in Yongyou UFIDA-NC up to 20230807. This issue affects some unknown processing of the file PrintTemplateFileServlet.java. The manipulation of the argument filePath leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-238637 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Contai
ay be used. The identifier VDB-238637 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.238637 - https://vuldb.com/?ctiid.238637 - https://github.com/houseoforange/mybugs/blob/main/Yongyou-UFIDA-NC-Arbitrary-File-Read.pdf