Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-42760 State: PUBLISHED Published: 2024-09-11T00:00:00 Last Updated: 2024-09-12T15:58:36.262Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in Ellevo v.6.2.0.38160 allows a remote attacker to obtain sensitive information via the /api/mob/instrucao/conta/destinatarios component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://ellevo.com/ - https://csflabs.github.io/cve/2024/09/10/cve-2024-42760-sql-injection-in-ellevo-API.html
CVE ID: CVE-2024-42761 State: PUBLISHED Published: 2024-08-22T00:00:00 Last Updated: 2024-08-23T14:13:16.816Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross Site Scripting (XSS) vulnerability was found in "/admin_schedule.php" in Kashipara Bus Ticket Reservation System v1.0, which allows remote attackers to execute arbitrary code via scheduleDurationPHP parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kashipara.com/ - https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Bus%20Ticket%20Reservation%20System%20v1.0/Stored%20XSS%20-%20Bus%20Schedule%20List.pdf
CVE ID: CVE-2024-42762 State: PUBLISHED Published: 2024-08-22T00:00:00 Last Updated: 2024-08-23T13:45:18.112Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross Site Scripting (XSS) vulnerability was found in "/history.php" in Kashipara Bus Ticket Reservation System v1.0, which allows remote attackers to execute arbitrary code via the Name, Phone, and Email parameter fields. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kashipara.com/ - https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Bus%20Ticket%20Reservation%20System%20v1.0/Stored%20XSS%20-%20Customer%20Booking%20List.pdf
CVE ID: CVE-2024-42763 State: PUBLISHED Published: 2024-08-22T00:00:00 Last Updated: 2024-08-23T16:33:37.500Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Reflected Cross Site Scripting (XSS) vulnerability was found in the "/schedule.php" page of the Kashipara Bus Ticket Reservation System v1.0, which allows remote attackers to execute arbitrary code via the "bookingdate" parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kashipara.com/ - https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Bus%20Ticket%20Reservation%20System%20v1.0/Reflected%20XSS%20-%20Book%20Ticket.pdf
CVE ID: CVE-2024-42764 State: PUBLISHED Published: 2024-08-23T00:00:00 Last Updated: 2024-08-23T14:43:10.185Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kashipara Bus Ticket Reservation System v1.0 is vulnerable to Cross Site Request Forgery (CSRF) via /deleteTicket.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kashipara.com/ - https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Bus%20Ticket%20Reservation%20System%20v1.0/CSRF.pdf
CVE ID: CVE-2024-42765 State: PUBLISHED Published: 2024-08-23T00:00:00 Last Updated: 2024-08-23T14:44:46.667Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in "/login.php" of the Kashipara Bus Ticket Reservation System v1.0 allows remote attackers to execute arbitrary SQL commands and bypass Login via the "email" or "password" Login page parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kashipara.com/ - https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Bus%20Ticket%20Reservation%20System%20v1.0/SQL%20Injection%20-%20Login.pdf
CVE ID: CVE-2024-42766 State: PUBLISHED Published: 2024-08-23T00:00:00 Last Updated: 2024-08-26T16:18:24.767Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kashipara Bus Ticket Reservation System v1.0 0 is vulnerable to Incorrect Access Control via /deleteTicket.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kashipara.com/ - https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Bus%20Ticket%20Reservation%20System%20v1.0/Broken%20Access%20Control%20-%20Delete%20Bookings.pdf
CVE ID: CVE-2024-42767 State: PUBLISHED Published: 2024-08-22T00:00:00 Last Updated: 2024-08-22T18:45:03.863Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kashipara Hotel Management System v1.0 is vulnerable to Unrestricted File Upload RCE via /admin/add_room_controller.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cwe.mitre.org/data/definitions/434.html - https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Hotel%20Management%20System%20v1.0/Unrestricted%20File%20Upload.pdf
CVE ID: CVE-2024-42768 State: PUBLISHED Published: 2024-08-22T00:00:00 Last Updated: 2024-08-22T18:11:08.849Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Hotel Management System v1.0 via /admin/delete_room.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cwe.mitre.org/data/definitions/352.html - https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Hotel%20Management%20System%20v1.0/CSRF.pdf
CVE ID: CVE-2024-42769 State: PUBLISHED Published: 2024-08-22T00:00:00 Last Updated: 2024-08-22T18:32:58.668Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Reflected Cross Site Scripting (XSS) vulnerability was found in "/core/signup_user.php " of Kashipara Hotel Management System v1.0, which allows remote attackers to execute arbitrary code via "user_fname" and "user_lname" parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kashipara.com/ - https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Hotel%20Management%20System%20v1.0/Reflected%20XSS%20-%20Sign%20UP.pdf
CVE ID: CVE-2024-42770 State: PUBLISHED Published: 2024-08-22T00:00:00 Last Updated: 2024-08-22T15:58:44.840Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross Site Scripting (XSS) vulnerability was found in "/core/signup_user.php" of Kashipara Hotel Management System v1.0, which allows remote attackers to execute arbitrary code via the "user_email" parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kashipara.com/ - https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Hotel%20Management%20System%20v1.0/Stored%20XSS%20-%20Sign%20UP.pdf
CVE ID: CVE-2024-42771 State: PUBLISHED Published: 2024-08-22T00:00:00 Last Updated: 2024-08-22T19:43:17.562Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross Site Scripting (XSS) vulnerability was found in " /admin/edit_room_controller.php" of the Kashipara Hotel Management System v1.0, which allows remote attackers to execute arbitrary code via "room_name" parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kashipara.com/ - https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Hotel%20Management%20System%20v1.0/Stored%20XSS%20-%20Edit%20Room.pdf
CVE ID: CVE-2024-42772 State: PUBLISHED Published: 2024-08-22T00:00:00 Last Updated: 2024-08-22T18:36:27.910Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Incorrect Access Control vulnerability was found in /admin/rooms.php in Kashipara Hotel Management System v1.0, which allows an unauthenticated attacker to view valid hotel room entries in administrator section. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kashipara.com/ - https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Hotel%20Management%20System%20v1.0/Broken%20Access%20Control%20-%20View%20Room%20Entry.pdf
CVE ID: CVE-2024-42773 State: PUBLISHED Published: 2024-08-22T00:00:00 Last Updated: 2024-11-06T14:34:37.039Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Incorrect Access Control vulnerability was found in /admin/edit_room_controller.php in Kashipara Hotel Management System v1.0, which allows an unauthenticated attacker to edit the valid hotel room entries in the administrator section. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kashipara.com/ - https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Hotel%20Management%20System%20v1.0/Broken%20Access%20Control%20-%20Edit%20Room%20Entry.pdf
CVE ID: CVE-2024-42774 State: PUBLISHED Published: 2024-08-22T00:00:00 Last Updated: 2024-08-22T20:00:48.473Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Incorrect Access Control vulnerability was found in /admin/delete_room.php in Kashipara Hotel Management System v1.0, which allows an unauthenticated attacker to delete valid hotel room entries in the administrator section. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kashipara.com/ - https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Hotel%20Management%20System%20v1.0/Broken%20Access%20Control%20-%20Delete%20Room%20Entry.pdf
CVE ID: CVE-2024-42775 State: PUBLISHED Published: 2024-08-22T00:00:00 Last Updated: 2024-08-22T19:49:31.835Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Incorrect Access Control vulnerability was found in /admin/add_room_controller.php in Kashipara Hotel Management System v1.0, which allows an unauthenticated attacker to add the valid hotel room entries in the administrator section via the direct URL access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kashipara.com/ - https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Hotel%20Management%20System%20v1.0/Broken%20Access%20Control%20-%20Add%20New%20Room%20Entry.pdf
CVE ID: CVE-2024-42776 State: PUBLISHED Published: 2024-08-22T00:00:00 Last Updated: 2024-08-22T19:31:48.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kashipara Hotel Management System v1.0 is vulnerable to Incorrect Access Control via /admin/users.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kashipara.com/ - https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Hotel%20Management%20System%20v1.0/Broken%20Access%20Control%20-%20View%20User%20Data.pdf
CVE ID: CVE-2024-42777 State: PUBLISHED Published: 2024-08-21T00:00:00 Last Updated: 2024-08-21T20:18:22.452Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=signup" of Kashipara Music Management System v1.0, which allows attackers to execute arbitrary code via uploading a crafted PHP file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/Unrestricted%20File%20Upload%20-%20SignUp.pdf
CVE ID: CVE-2024-42778 State: PUBLISHED Published: 2024-08-21T00:00:00.000Z Last Updated: 2025-03-13T15:39:40.071Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=save_playlist" in Kashipara Music Management System v1.0. This allows attackers to execute arbitrary code via uploading a crafted PHP file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kashipara.com/project/php/12978/music-management-system-in-php-php-project-source-code - https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/Unrestricted%20File%20Upload%20-%20Add%20Ne
kekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/Unrestricted%20File%20Upload%20-%20Add%20New%20Playlist.pdf
CVE ID: CVE-2024-42779 State: PUBLISHED Published: 2024-08-21T00:00:00 Last Updated: 2024-08-22T13:44:14.641Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=save_music" in Kashipara Music Management System v1.0. This allows attackers to execute arbitrary code via uploading a crafted PHP file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kashipara.com/project/php/12978/music-management-system-in-php-php-project-source-code - https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/Unrestricted%20File%20Upload%20-%20Add%20New%20Musi
y/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/Unrestricted%20File%20Upload%20-%20Add%20New%20Music%20List.pdf
CVE ID: CVE-2024-42780 State: PUBLISHED Published: 2024-08-21T00:00:00 Last Updated: 2024-08-22T18:53:02.406Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=save_genre" in Kashipara Music Management System v1.0. This allows attackers to execute arbitrary code via uploading a crafted PHP file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kashipara.com/project/php/12978/music-management-system-in-php-php-project-source-code - https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/Unrestricted%20File%20Upload%20-%20Add%20New%20Genr
y/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/Unrestricted%20File%20Upload%20-%20Add%20New%20Genre.pdf
CVE ID: CVE-2024-42781 State: PUBLISHED Published: 2024-08-21T00:00:00 Last Updated: 2024-08-22T13:46:18.639Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in "/music/ajax.php?action=login" of Kashipara Music Management System v1.0 allows remote attackers to execute arbitrary SQL commands and bypass Login via the email parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kashipara.com/project/php/12978/music-management-system-in-php-php-project-source-code - https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/SQL%20Injection%20-%20Login.pdf
CVE ID: CVE-2024-42782 State: PUBLISHED Published: 2024-08-21T00:00:00 Last Updated: 2024-08-22T15:02:29.648Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in "/music/ajax.php?action=find_music" in Kashipara Music Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "search" parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kashipara.com/project/php/12978/music-management-system-in-php-php-project-source-code - https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/SQL%20Injection%20-%20Find%20Music.pdf
CVE ID: CVE-2024-42783 State: PUBLISHED Published: 2024-08-21T00:00:00 Last Updated: 2024-08-22T16:44:52.478Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kashipara Music Management System v1.0 is vulnerable to SQL Injection via /music/manage_playlist_items.php. An attacker can execute arbitrary SQL commands via the "pid" parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kashipara.com/project/php/12978/music-management-system-in-php-php-project-source-code - https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/SQL%20Injection%20-%20Manage%20Playlist.pdf
CVE ID: CVE-2024-42784 State: PUBLISHED Published: 2024-08-21T00:00:00 Last Updated: 2024-08-22T13:45:31.119Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in "/music/controller.php?page=view_music" in Kashipara Music Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "id" parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kashipara.com/project/php/12978/music-management-system-in-php-php-project-source-code - https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/SQL%20Injection%20-%20View%20Music%20List.pdf
CVE ID: CVE-2024-42785 State: PUBLISHED Published: 2024-08-21T00:00:00 Last Updated: 2024-08-22T15:04:42.887Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in /music/index.php?page=view_playlist in Kashipara Music Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "id" parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kashipara.com/project/php/12978/music-management-system-in-php-php-project-source-code - https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/SQL%20Injection%20-%20View%20Playlist.pdf
CVE ID: CVE-2024-42786 State: PUBLISHED Published: 2024-08-21T00:00:00 Last Updated: 2024-08-21T20:32:26.291Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in "/music/view_user.php" in Kashipara Music Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "id" parameter of View User Profile Page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kashipara.com/project/php/12978/music-management-system-in-php-php-project-source-code - https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/SQL%20Injection%20-%20View%20Profile.pdf
CVE ID: CVE-2024-42787 State: PUBLISHED Published: 2024-08-26T00:00:00 Last Updated: 2024-08-26T15:24:53.044Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross Site Scripting (XSS) vulnerability was found in "/music/ajax.php?action=save_playlist" in Kashipara Music Management System v1.0. This vulnerability allows remote attackers to execute arbitrary code via "title" & "description" parameter fields. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kashipara.com/project/php/12978/music-management-system-in-php-php-project-source-code - https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/Stored%
-source-code - https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/Stored%20XSS%20-%20Add%20Playlist.pdf
CVE ID: CVE-2024-42788 State: PUBLISHED Published: 2024-08-26T00:00:00 Last Updated: 2024-08-26T19:08:48.462Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross Site Scripting (XSS) vulnerability was found in "/music/ajax.php?action=save_music" in Kashipara Music Management System v1.0. This vulnerability allows remote attackers to execute arbitrary code via "title" & "artist" parameter fields. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kashipara.com/project/php/12978/music-management-system-in-php-php-project-source-code - https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/Stored%20XSS%20
code - https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/Stored%20XSS%20-%20Add%20New%20Music%20List.pdf
CVE ID: CVE-2024-42789 State: PUBLISHED Published: 2024-08-26T00:00:00 Last Updated: 2024-08-27T19:39:00.292Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Reflected Cross Site Scripting (XSS) vulnerability was found in "/music/controller.php?page=test" in Kashipara Music Management System v1.0. This vulnerability allows remote attackers to execute arbitrary code via the "page" parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kashipara.com/project/php/12978/music-management-system-in-php-php-project-source-code - https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/Reflected%20XSS%20-%20Control
/github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/Reflected%20XSS%20-%20Controller.pdf
CVE ID: CVE-2024-42790 State: PUBLISHED Published: 2024-08-26T00:00:00 Last Updated: 2024-08-27T14:00:44.890Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Reflected Cross Site Scripting (XSS) vulnerability was found in "/music/index.php?page=test" in Kashipara Music Management System v1.0. This vulnerability allows remote attackers to execute arbitrary code via the "page" parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kashipara.com/project/php/12978/music-management-system-in-php-php-project-source-code - https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/Reflected%20XSS%20-%20index.pdf
CVE ID: CVE-2024-42791 State: PUBLISHED Published: 2024-08-26T00:00:00 Last Updated: 2024-08-26T18:48:30.217Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Music Management System v1.0 via /music/ajax.php?action=delete_genre. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kashipara.com/project/php/12978/music-management-system-in-php-php-project-source-code - https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/CSRF%20-%20Delete%20Genre.pdf
CVE ID: CVE-2024-42792 State: PUBLISHED Published: 2024-08-26T00:00:00 Last Updated: 2024-08-26T17:23:37.103Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Music Management System v1.0 via /music/ajax.php?action=delete_playlist page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kashipara.com/project/php/12978/music-management-system-in-php-php-project-source-code - https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/CSRF%20-%20Delete%20Playlist.pdf
CVE ID: CVE-2024-42793 State: PUBLISHED Published: 2024-08-28T00:00:00 Last Updated: 2024-08-28T20:01:46.176Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Music Management System v1.0 via a crafted request to the /music/ajax.php?action=save_user page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kashipara.com/project/php/12978/music-management-system-in-php-php-project-source-code - https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/CSRF%20-%20Edit%20User.pdf
CVE ID: CVE-2024-42794 State: PUBLISHED Published: 2024-09-16T00:00:00 Last Updated: 2024-09-18T18:32:13.603Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kashipara Music Management System v1.0 is vulnerable to Incorrect Access Control via /music/ajax.php?action=save_user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kashipara.com/project/php/12978/music-management-system-in-php-php-project-source-code - https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/Broken%20Access%20Control%20-%20Save%20User%20%26%20Account%20Takeover.pdf
CVE ID: CVE-2024-42795 State: PUBLISHED Published: 2024-09-16T00:00:00 Last Updated: 2024-09-18T15:48:48.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Incorrect Access Control vulnerability was found in /music/view_user.php?id=3 and /music/controller.php?page=edit_user&id=3 in Kashipara Music Management System v1.0. This vulnerability allows an unauthenticated attacker to view valid user details. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kashipara.com/ - https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/Broken%20Access%20Control%20-%20View%20User.pdf
CVE ID: CVE-2024-42796 State: PUBLISHED Published: 2024-09-16T00:00:00 Last Updated: 2024-09-18T15:46:11.442Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Incorrect Access Control vulnerability was found in /music/ajax.php?action=delete_genre in Kashipara Music Management System v1.0. This vulnerability allows an unauthenticated attacker to delete the valid music genre entries. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kashipara.com/project/php/12978/music-management-system-in-php-php-project-source-code - https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/Broken%20Access%20Control%20-%20Delete
om/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/Broken%20Access%20Control%20-%20Delete%20Genre.pdf