Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-53730 State: PUBLISHED Published: 2025-10-22T13:23:58.419Z Last Updated: 2025-10-22T13:23:58.419Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: blk-iocost: use spin_lock_irqsave in adjust_inuse_and_calc_cost adjust_inuse_and_calc_cost() use spin_lock_irq() and IRQ will be enabled when unlock. DEADLOCK might happen if we have held other locks and disabled IRQ before invoking it. Fix it by using spin_lock_irqsave() instead, which can keep IRQ state consistent with before when unlock. ================================ WARNING: inconsistent lock state 5.10.0-02758-g8e5f91fd772f #26 Not tainted ---------------------
====================== WARNING: inconsistent lock state 5.10.0-02758-g8e5f91fd772f #26 Not tainted -------------------------------- inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage. kworker/2:3/388 [HC0[0]:SC0[0]:HE0:SE1] takes: ffff888118c00c28 (&bfqd->lock){?.-.}-{2:2}, at: spin_lock_irq ffff888118c00c28 (&bfqd->lock){?.-.}-{2:2}, at: bfq_bio_merge+0x141/0x390 {IN-HARDIRQ-W} state was registered at: __lock_acquire+0x3d7/0x1070 lock_acquire+0x197/0x4a0 __raw_spin_lock_irqsave _raw_spin_lock_irqsave+0x3b/0x60 bfq_idle_slice_timer_body bfq_idle_slice_timer+0x53/0x1d0 __run_hrtimer+0x477/0xa70 __hrtimer_run_queues+0x1c6/0x2d0 hrtimer_interrupt+0x302/0x9e0 local_apic_timer_interrupt __sysvec
n_hrtimer+0x477/0xa70 __hrtimer_run_queues+0x1c6/0x2d0 hrtimer_interrupt+0x302/0x9e0 local_apic_timer_interrupt __sysvec_apic_timer_interrupt+0xfd/0x420 run_sysvec_on_irqstack_cond sysvec_apic_timer_interrupt+0x46/0xa0 asm_sysvec_apic_timer_interrupt+0x12/0x20 irq event stamp: 837522 hardirqs last enabled at (837521): [<ffffffff84b9419d>] __raw_spin_unlock_irqrestore hardirqs last enabled at (837521): [<ffffffff84b9419d>] _raw_spin_unlock_irqrestore+0x3d/0x40 hardirqs last disabled at (837522): [<ffffffff84b93fa3>] __raw_spin_lock_irq hardirqs last disabled at (837522): [<ffffffff84b93fa3>] _raw_spin_lock_irq+0x43/0x50 softirqs last enabled at (835852): [<ffffffff84e00558>] __do_softirq+0x55
fffffff84b93fa3>] _raw_spin_lock_irq+0x43/0x50 softirqs last enabled at (835852): [<ffffffff84e00558>] __do_softirq+0x558/0x8ec softirqs last disabled at (835845): [<ffffffff84c010ff>] asm_call_irq_on_stack+0xf/0x20 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&bfqd->lock); <Interrupt> lock(&bfqd->lock); *** DEADLOCK *** 3 locks held by kworker/2:3/388: #0: ffff888107af0f38 ((wq_completion)kthrotld){+.+.}-{0:0}, at: process_one_work+0x742/0x13f0 #1: ffff8881176bfdd8 ((work_completion)(&td->dispatch_work)){+.+.}-{0:0}, at: process_one_work+0x777/0x13f0 #2: ffff888118c00c28 (&bfqd->lock){?.-.}-{2:2}, at: spin_lock_irq #2: ffff888118c00c28 (&bfqd->l
s_one_work+0x777/0x13f0 #2: ffff888118c00c28 (&bfqd->lock){?.-.}-{2:2}, at: spin_lock_irq #2: ffff888118c00c28 (&bfqd->lock){?.-.}-{2:2}, at: bfq_bio_merge+0x141/0x390 stack backtrace: CPU: 2 PID: 388 Comm: kworker/2:3 Not tainted 5.10.0-02758-g8e5f91fd772f #26 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Workqueue: kthrotld blk_throtl_dispatch_work_fn Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x107/0x167 print_usage_bug valid_state mark_lock_irq.cold+0x32/0x3a mark_lock+0x693/0xbc0 mark_held_locks+0x9e/0xe0 __trace_hardirqs_on_caller lockdep_hardirqs_on_prepare.part.0+0x151/0x360 trace_hardirqs_on+
0 mark_held_locks+0x9e/0xe0 __trace_hardirqs_on_caller lockdep_hardirqs_on_prepare.part.0+0x151/0x360 trace_hardirqs_on+0x5b/0x180 __raw_spin_unlock_irq _raw_spin_unlock_irq+0x24/0x40 spin_unlock_irq adjust_inuse_and_calc_cost+0x4fb/0x970 ioc_rqos_merge+0x277/0x740 __rq_qos_merge+0x62/0xb0 rq_qos_merge bio_attempt_back_merge+0x12c/0x4a0 blk_mq_sched_try_merge+0x1b6/0x4d0 bfq_bio_merge+0x24a/0x390 __blk_mq_sched_bio_merge+0xa6/0x460 blk_mq_sched_bio_merge blk_mq_submit_bio+0x2e7/0x1ee0 __submit_bio_noacct_mq+0x175/0x3b0 submit_bio_noacct+0x1fb/0x270 blk_throtl_dispatch_work_fn+0x1ef/0x2b0 process_one_work+0x83e/0x13f0 process_scheduled_works worker_thread+0x7e3/0xd80 kthread+0x353/0x470 ret_f
fn+0x1ef/0x2b0 process_one_work+0x83e/0x13f0 process_scheduled_works worker_thread+0x7e3/0xd80 kthread+0x353/0x470 ret_from_fork+0x1f/0x30 References: - https://git.kernel.org/stable/c/8563b58a4360e648ce18f0e98a75a4be51667431 - https://git.kernel.org/stable/c/eb120c0aff5ceab9c9c46b87f302465bbf2bbaed - https://git.kernel.org/stable/c/8ceeb3fc86a83700bb1585c189006080a47e8506 - https://git.kernel.org/stable/c/9279a1b74ad98039d5d44d26b9e7a9cfe655b6d3 - https://git.kernel.org/stable/c/3376c4fe2db4aea2dc721a27a999c41fdb45b54f - https://git.kernel.org/stable/c/8d211554679d0b23702bd32ba04aeac0c1c4f660
CVE ID: CVE-2023-53731 State: PUBLISHED Published: 2025-10-22T13:23:59.055Z Last Updated: 2025-10-22T13:23:59.055Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: netlink: fix potential deadlock in netlink_set_err() syzbot reported a possible deadlock in netlink_set_err() [1] A similar issue was fixed in commit 1d482e666b8e ("netlink: disable IRQs for netlink_lock_table()") in netlink_lock_table() This patch adds IRQ safety to netlink_set_err() and __netlink_diag_dump() which were not covered by cited commit. [1] WARNING: possible irq lock inversion dependency detected 6.4.0-rc6-syzkaller-00240-g4e9f0ec38852 #0 Not tainted syz-e
1] WARNING: possible irq lock inversion dependency detected 6.4.0-rc6-syzkaller-00240-g4e9f0ec38852 #0 Not tainted syz-executor.2/23011 just changed the state of lock: ffffffff8e1a7a58 (nl_table_lock){.+.?}-{2:2}, at: netlink_set_err+0x2e/0x3a0 net/netlink/af_netlink.c:1612 but this lock was taken by another, SOFTIRQ-safe lock in the past: (&local->queue_stop_reason_lock){..-.}-{2:2} and interrupts could create inverse lock ordering between them. other info that might help us debug this: Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(nl_table_lock); local_irq_disable(); lock(&local->queue_stop_reason_lock); lock(nl_table_lock); <Interrupt> lock(&local->queue_stop_reason
cal_irq_disable(); lock(&local->queue_stop_reason_lock); lock(nl_table_lock); <Interrupt> lock(&local->queue_stop_reason_lock); *** DEADLOCK *** References: - https://git.kernel.org/stable/c/c09e8e3f7fd432984bf5422302b093d2371dfc48 - https://git.kernel.org/stable/c/4b9adb8d4a62ff7608d4a7d4eb42036a88f30980 - https://git.kernel.org/stable/c/8f6652ed2ad98fe6d13b903483d9257762ab2ec6 - https://git.kernel.org/stable/c/cde7b90e0539a3b11da377e463dfd2288a162dbf - https://git.kernel.org/stable/c/a641240b7e071c5538dc0e7894ece833fce459dd - https://git.kernel.org/stable/c/61ffe8b1ee084e5c82a4e4bbf9e7b68e0c06e464 - https://git.kernel.org/stable/c/eb8e27c8fa9397b4a7b181c48fa58157dbe9902e - https://git.kern
5c82a4e4bbf9e7b68e0c06e464 - https://git.kernel.org/stable/c/eb8e27c8fa9397b4a7b181c48fa58157dbe9902e - https://git.kernel.org/stable/c/1556ba034b95cfd4f75ea93c1a2679ae0444bba1 - https://git.kernel.org/stable/c/8d61f926d42045961e6b65191c09e3678d86a9cf
CVE ID: CVE-2023-53732 State: PUBLISHED Published: 2025-10-22T13:23:59.630Z Last Updated: 2025-10-30T19:33:09.452Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix NULL dereference in ni_write_inode Syzbot reports a NULL dereference in ni_write_inode. When creating a new inode, if allocation fails in mi_init function (called in mi_format_new function), mi->mrec is set to NULL. In the error path of this inode creation, mi->mrec is later dereferenced in ni_write_inode. Add a NULL check to prevent NULL dereference. References: - https://git.kernel.org/stable/c/d4b74482529516477cf7b12502538e51827c699f - https://git.kern
L dereference. References: - https://git.kernel.org/stable/c/d4b74482529516477cf7b12502538e51827c699f - https://git.kernel.org/stable/c/b3152afc0eb864f7c6ecad134a15b577ef7aec77 - https://git.kernel.org/stable/c/b1135fbaf8ebef93df326761ac70ebcc3c2e3d63 - https://git.kernel.org/stable/c/8dae4f6341e335a09575be60b4fdf697c732a470
CVE ID: CVE-2023-53733 State: PUBLISHED Published: 2025-10-24T11:44:28.115Z Last Updated: 2025-10-24T11:44:28.115Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode When u32_replace_hw_knode fails, we need to undo the tcf_bind_filter operation done at u32_set_parms. References: - https://git.kernel.org/stable/c/a9345793469b65ee5ba7b033239916c2a67d3dd4 - https://git.kernel.org/stable/c/025159ed118ba5145b241d574edadb0e00d3c20f - https://git.kernel.org/stable/c/9cb36faedeafb9720ac236aeae2ea57091d90a09
CVE ID: CVE-2023-5000 State: PUBLISHED Published: 2024-08-06T01:49:58.058Z Last Updated: 2024-08-08T15:37:44.597Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: gopiplus Products: Horizontal scrolling announcements Problem Types: CWE-89 Description: The Horizontal scrolling announcements plugin for WordPress is vulnerable to SQL Injection via the plugin's 'hsas-shortcode' shortcode in versions up to, and including, 2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with contributor-level and above permissions to append additional SQL q
is makes it possible for authenticated attackers with contributor-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/327e706d-2d6c-4204-a531-281f2e2dbcf0?source=cve - https://plugins.trac.wordpress.org/browser/horizontal-scrolling-announcements/trunk/query/db_content.php?rev=2827116#L44 - https://plugins.trac.wordpress.org/browser/horizontal-scrolling-announcements/trunk/query/db_content.php?rev=2973422#L56
CVE ID: CVE-2023-5001 State: PUBLISHED Published: 2023-09-16T04:25:56.199Z Last Updated: 2025-02-05T19:27:54.751Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: gopiplus Products: Horizontal scrolling announcement Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Horizontal scrolling announcement for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'horizontal-scrolling' shortcode in versions up to, and including, 9.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers
t input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d4f60e8c-2745-4930-9101-914bd73c6e1c?source=cve - https://plugins.trac.wordpress.org/browser/horizontal-scrolling-announcement/trunk/horizontal-scrolling-announcement.php#L389
CVE ID: CVE-2023-5002 State: PUBLISHED Published: 2023-09-22T13:31:43.124Z Last Updated: 2024-08-02T07:44:53.739Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H) Problem Types: CWE-78 Description: A flaw was found in pgAdmin. This issue occurs when the pgAdmin server HTTP API validates the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. Versions of pgAdmin prior to 7.6 failed to properly control the server code executed on this API, allowing an authenticated user to run arbitrary commands on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?
Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2239164 - https://github.com/pgadmin-org/pgadmin4/issues/6763 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2S24D3S2GVNGTDNE6SF2OQSOPU3H72UW/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VIRTMQZEE6K7RD37ERZ2UFYFLEUXLQU3/
CVE ID: CVE-2023-5003 State: PUBLISHED Published: 2023-10-16T19:39:08.657Z Last Updated: 2025-04-23T16:12:34.614Z Vendors: Unknown Products: Active Directory Integration / LDAP Integration Problem Types: CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory Description: The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.10 stores sensitive LDAP logs in a buffer file when an administrator wants to export said logs. Unfortunately, this log file is never removed, and remains accessible to any users knowing the URL to do so. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/v
to do so. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/91f4e500-71f3-4ef6-9cc7-24a7c12a5748
CVE ID: CVE-2023-5004 State: PUBLISHED Published: 2023-09-28T20:40:58.591Z Last Updated: 2024-09-23T18:10:20.572Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hospital-management-system Products: Hospital-management-system Problem Types: CWE-89 Description: Hospital management system version 378c157 allows to bypass authentication. This is possible because the application is vulnerable to SQLI. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/alcocer - https://github.com/projectworldsofficial/hospital-management-system-in-php/
CVE ID: CVE-2023-5005 State: PUBLISHED Published: 2023-12-18T20:07:55.051Z Last Updated: 2025-05-07T20:35:11.699Z Vendors: Unknown Products: Autocomplete Location field Contact Form 7, Autocomplete Location field Contact Form 7 Pro Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro WordPress plugin before 2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analy
ripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/bfb174d4-7658-4883-a682-d06bda89ec44
CVE ID: CVE-2023-5006 State: PUBLISHED Published: 2024-01-17T14:31:48.144Z Last Updated: 2025-06-11T17:04:46.980Z Vendors: Unknown Products: WP Discord Invite Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP Discord Invite WordPress plugin before 2.5.1 does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to perform actions on their behalf by tricking a logged in administrator to submit a crafted request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d29bcc1c-241b-4867-a0c8-4ae5f9d1c8e8
CVE ID: CVE-2023-5007 State: PUBLISHED Published: 2023-12-20T15:58:34.088Z Last Updated: 2025-05-19T18:36:26.364Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Kashipara Group Products: Student Information System Problem Types: CWE-89 Description: Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'id' parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/kissin/ - https://www.kashipara.com/
CVE ID: CVE-2023-5008 State: PUBLISHED Published: 2023-12-07T23:16:52.700Z Last Updated: 2024-10-09T13:57:21.829Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Kashipara Group Products: Student Information System Problem Types: CWE-89 Description: Student Information System v1.0 is vulnerable to an unauthenticated SQL Injection vulnerability on the 'regno' parameter of index.php page, allowing an external attacker to dump all the contents of the database contents and bypass the login control. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/blechacz/ - https://www.kashipara.com/
CVE ID: CVE-2023-5009 State: PUBLISHED Published: 2023-09-19T07:01:14.930Z Last Updated: 2025-11-20T04:10:13.265Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-863 Description: An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.2.7, all versions starting from 16.3 before 16.3.4. It was possible for an attacker to run pipeline jobs as an arbitrary user via scheduled security scan policies. This was a bypass of [CVE-2023-3932](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3932) showing additional impact. Additional Analyst Notes: - CVE Program Container: - CISA
bin/cvename.cgi?name=CVE-2023-3932) showing additional impact. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/425304 - https://hackerone.com/reports/2147126
CVE ID: CVE-2023-5010 State: PUBLISHED Published: 2023-12-20T15:55:07.052Z Last Updated: 2025-05-19T18:34:51.808Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Kashipara Group Products: Student Information System Problem Types: CWE-89 Description: Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'coursecode' parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/kissin/ - https://www.kashipara.com/
CVE ID: CVE-2023-5011 State: PUBLISHED Published: 2023-12-20T15:57:19.012Z Last Updated: 2025-05-19T18:35:54.793Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Kashipara Group Products: Student Information System Problem Types: CWE-89 Description: Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'coursename' parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: References: - https://fluidattacks.com/advisories/kissin/ - https://www.kashipara.com/
CVE ID: CVE-2023-5012 State: PUBLISHED Published: 2023-09-16T20:31:05.407Z Last Updated: 2024-08-02T07:44:53.703Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Topaz Products: OFD Problem Types: CWE-428 Description: A vulnerability, which was classified as problematic, was found in Topaz OFD 2.11.0.201. This affects an unknown part of the file C:\Program Files\Topaz OFD\Warsaw\core.exe of the component Protection Module Warsaw. The manipulation leads to unquoted search path. Attacking locally is a requirement. Upgrading to version 2.12.0.259 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-239853 was as
259 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-239853 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.239853 - https://vuldb.com/?ctiid.239853
CVE ID: CVE-2023-5013 State: PUBLISHED Published: 2023-09-16T23:00:07.544Z Last Updated: 2024-08-02T07:44:53.857Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: Pluck Products: CMS Problem Types: CWE-79 Description: A vulnerability has been found in Pluck CMS 4.7.18 and classified as problematic. This vulnerability affects unknown code of the file install.php of the component Installation Handler. The manipulation of the argument contents with the input <script>alert('xss')</script> leads to cross site scripting. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disc
emotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-239854 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.239854 - https://vuldb.com/?ctiid.239854 - https://github.com/Jacky-Y/vuls/blob/main/vul3.md
CVE ID: CVE-2023-5014 State: PUBLISHED Published: 2023-09-17T01:00:08.398Z Last Updated: 2024-09-25T13:45:24.293Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Sakshi2610 Products: Food Ordering Website Problem Types: CWE-89 Description: A vulnerability was found in Sakshi2610 Food Ordering Website 1.0 and classified as critical. This issue affects some unknown processing of the file categoryfood.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-239855. Additional Analyst Notes: - CVE Program Container: - CISA
The associated identifier of this vulnerability is VDB-239855. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.239855 - https://vuldb.com/?ctiid.239855 - https://github.com/TheCyberDiver/Public-Disclosures-CVE-/blob/main/Food-Ordering-Website%20SQLi.md
CVE ID: CVE-2023-5015 State: PUBLISHED Published: 2023-09-17T01:31:05.295Z Last Updated: 2024-08-02T07:44:53.772Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: n/a Products: UCMS Problem Types: CWE-79 Description: A vulnerability was found in UCMS 1.4.7. It has been classified as problematic. Affected is an unknown function of the file ajax.php?do=strarraylist. The manipulation of the argument strdefault leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-239856. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References:
is vulnerability is VDB-239856. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.239856 - https://vuldb.com/?ctiid.239856 - https://github.com/Num-Nine/CVE/issues/3
CVE ID: CVE-2023-5016 State: PUBLISHED Published: 2023-09-17T02:00:06.688Z Last Updated: 2024-08-02T07:44:53.706Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: spider-flow Problem Types: CWE-502 Description: A vulnerability was found in spider-flow up to 0.5.0. It has been declared as critical. Affected by this vulnerability is the function DriverManager.getConnection of the file src/main/java/org/spiderflow/controller/DataSourceController.java of the component API. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-239857 was assigned to this vulnerabili