Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ttributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4af04219-26c5-401d-94ef-11d2321f98bf?source=cve - https://plugins.trac.wordpress.org/browser/wp-sponsors/tags/3.5.0/includes/class-wp-sponsors-shortcodes.php#L267
CVE ID: CVE-2023-5663 State: PUBLISHED Published: 2024-03-13T15:27:11.281Z Last Updated: 2024-08-05T15:13:56.427Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: storeapps Products: News Announcement Scroll Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The News Announcement Scroll plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 9.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with contributor-lev
ufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with contributor-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b29113d6-7a9a-4e10-a446-147ec146ac93?source=cve - https://plugins.trac.wordpress.org/browser/news-announcement-scroll/tags/9.0.0/news-announcement-scroll.php#L261 - https://plugins.trac.wordpress.org/changeset/2987837/news-announcement-scroll#file2
CVE ID: CVE-2023-5664 State: PUBLISHED Published: 2023-11-22T15:33:31.110Z Last Updated: 2024-08-02T08:07:32.489Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ggnomes Products: Garden Gnome Package Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Garden Gnome Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ggpkg' shortcode in all versions up to, and including, 2.2.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above per
ing on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This was partially patched in version 2.2.7 and fully patched in version 2.2.9. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8c7385c7-47de-4511-b474-7415c3977aa8?source=cve - https://plugins.trac.wordpress.org/browser/garden-gnome-package/tags/2.2.5/include/ggpackage.php#L284 - https://plugins.trac.wordpress.org/changeset/2987987/garden-gnome-package#file1 - https://plugins.trac.wordpress
#L284 - https://plugins.trac.wordpress.org/changeset/2987987/garden-gnome-package#file1 - https://plugins.trac.wordpress.org/changeset/2988944/garden-gnome-package#file1
CVE ID: CVE-2023-5665 State: PUBLISHED Published: 2024-02-08T03:33:15.487Z Last Updated: 2024-08-09T17:24:24.616Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: kendysond Products: Payment Forms for Paystack Problem Types: CWE-79 Description: The Payment Forms for Paystack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a
ckers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-32130 is likely a duplicate of this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/98f80608-f24f-4019-a757-de71cba9902f?source=cve - https://plugins.trac.wordpress.org/browser/payment-forms-for-paystack/tags/3.4.1/public/class-paystack-forms-public-for-old-themes.php#L958 - https://plugins.trac.wordpress.org/browser/payment-forms-for-paystack/tags/3.4.1/public/class-paystack-forms-public-for-old-themes.php#L986 - https://plugi
browser/payment-forms-for-paystack/tags/3.4.1/public/class-paystack-forms-public-for-old-themes.php#L986 - https://plugins.trac.wordpress.org/browser/payment-forms-for-paystack/tags/3.4.1/public/class-paystack-forms-public-for-old-themes.php#L1013 - https://plugins.trac.wordpress.org/browser/payment-forms-for-paystack/tags/3.4.1/public/class-paystack-forms-public-for-old-themes.php#L1054 - https://plugins.trac.wordpress.org/browser/payment-forms-for-paystack/tags/3.4.1/public/class-paystack-forms-public-for-old-themes.php#L1128 - https://plugins.trac.wordpress.org/browser/payment-forms-for-paystack/tags/3.4.1/public/class-paystack-forms-public-for-old-themes.php#L1164 - https://plugins.trac.
ayment-forms-for-paystack/tags/3.4.1/public/class-paystack-forms-public-for-old-themes.php#L1164 - https://plugins.trac.wordpress.org/browser/payment-forms-for-paystack/tags/3.4.1/public/class-paystack-forms-public-for-old-themes.php#L1194
CVE ID: CVE-2023-5666 State: PUBLISHED Published: 2023-10-30T13:49:00.706Z Last Updated: 2025-02-05T18:55:01.477Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themepoints Products: Accordion Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tcpaccordion' shortcode in all versions up to, and including, 2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to i
upplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a8ada876-4a8b-494f-9132-d88a71b42c44?source=cve - https://plugins.trac.wordpress.org/browser/accordions-wp/trunk/theme/custom-wp-accordion-themes.php?rev=2406278#L24 - https://plugins.trac.wordpress.org/changeset/2982015/accordions-wp#file370
CVE ID: CVE-2023-5667 State: PUBLISHED Published: 2023-11-22T15:33:19.217Z Last Updated: 2024-11-20T18:48:53.726Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themepoints Products: Tab Ultimate Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Tab Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject ar
attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/08220b23-d6fa-4005-bbbb-019412d328a5?source=cve - https://plugins.trac.wordpress.org/browser/tabs-pro/trunk/theme/tab-shortcode-ultimate-themes.php?rev=2406144#L87 - https://plugins.trac.wordpress.org/changeset/2982005/tabs-pro#file23
CVE ID: CVE-2023-5668 State: PUBLISHED Published: 2023-10-20T04:30:32.830Z Last Updated: 2025-02-05T19:11:52.694Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: alexmoss Products: WhatsApp Share Button Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WhatsApp Share Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'whatsapp' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and abo
escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/77911b0f-c028-49ae-b85e-15909d806e30?source=cve - https://plugins.trac.wordpress.org/browser/whatsapp/tags/1.0.1/class-frontend.php#L46
CVE ID: CVE-2023-5669 State: PUBLISHED Published: 2023-11-07T11:31:05.515Z Last Updated: 2025-02-05T18:50:34.898Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: cconover Products: Featured Image Caption Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Featured Image Caption plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode and post meta in all versions up to, and including, 0.8.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level a
output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0c43a88c-6374-414f-97ae-26ba15d75cdc?source=cve - https://plugins.trac.wordpress.org/browser/featured-image-caption/trunk/classes/MetaBox.php?rev=2300545#L91 - https://plugins.trac.wordpress.org/browser/featured-image-caption/trunk/classes/MetaBox.php?rev=2300545#L92 - https://plugins.trac.wordpress.org/chan
s.org/browser/featured-image-caption/trunk/classes/MetaBox.php?rev=2300545#L92 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2998182%40featured-image-caption%2Ftrunk&old=2486227%40featured-image-caption%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-5671 State: PUBLISHED Published: 2023-10-25T17:11:05.225Z Last Updated: 2024-09-12T14:19:17.392Z Vendors: HP Inc. Products: HP Print and Scan Doctor for Windows Description: HP Print and Scan Doctor for Windows may potentially be vulnerable to escalation of privilege. HP is releasing software updates to mitigate the potential vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hp.com/us-en/document/ish_9502679-9502704-16
CVE ID: CVE-2023-5672 State: PUBLISHED Published: 2023-12-26T18:33:09.420Z Last Updated: 2024-11-21T19:24:00.859Z Vendors: Unknown Products: WP Mail Log Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file path parameters when attaching files to emails, leading to local file inclusion, and allowing an attacker to leak the contents of arbitrary files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7c1dff5b-bed3-49f8-96cc-1bc9abe78749
CVE ID: CVE-2023-5673 State: PUBLISHED Published: 2023-12-26T18:33:03.911Z Last Updated: 2024-08-02T08:07:32.474Z Vendors: Unknown Products: WP Mail Log Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file extensions uploading files to attach to emails, allowing attackers to upload PHP files, leading to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/231f72bf-9ad0-417e-b7a0-3555875749e9
CVE ID: CVE-2023-5674 State: PUBLISHED Published: 2023-12-26T18:33:03.106Z Last Updated: 2024-08-02T08:07:32.552Z Vendors: Unknown Products: WP Mail Log Problem Types: CWE-89 SQL Injection Description: The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Contributor. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/32a23d0d-7ece-4870-a99d-f3f344be2d67
CVE ID: CVE-2023-5675 State: PUBLISHED Published: 2024-04-25T15:44:55.582Z Last Updated: 2025-11-20T18:06:41.381Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Red Hat Products: Red Hat build of Quarkus 2.13.9.Final, Red Hat build of Quarkus 3.2.9.Final, A-MQ Clients 2, Cryostat 2, OpenShift Serverless, Red Hat build of Apicurio Registry 2, Red Hat build of OptaPlanner 8, Red Hat Fuse 7, Red Hat Integration Camel K 1, Red Hat Integration Camel Quarkus 2, Red Hat JBoss Enterprise Application Platform 8, Red Hat Process Automation 7 Problem Types: CWE-285 Description: A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint ha
Types: CWE-285 Description: A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either 'quarkus.security.jaxrs.deny-unannotated-endpoints' or 'quarkus.security.jaxrs.default-roles-allowed' properties. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:0494 - https://access.redhat.com/errata/RHSA-2024:0495 - https://access.redhat.com/security/cve/CVE-2023-5675 - https://bugzilla.red
://access.redhat.com/errata/RHSA-2024:0495 - https://access.redhat.com/security/cve/CVE-2023-5675 - https://bugzilla.redhat.com/show_bug.cgi?id=2245197
CVE ID: CVE-2023-5676 State: PUBLISHED Published: 2023-11-15T14:02:01.422Z Last Updated: 2025-11-03T21:50:38.622Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Eclipse Foundation Products: OpenJ9 Problem Types: CWE-364 Description: In Eclipse OpenJ9 before version 0.41.0, the JVM can be forced into an infinite busy hang on a spinlock or a segmentation fault if a shutdown signal (SIGTERM, SIGINT or SIGHUP) is received before the JVM has finished initializing. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/eclipse-openj9/openj9/pull/18085 - https://gitlab.eclipse.org/security/cve-assignement/-/iss
ences: - https://github.com/eclipse-openj9/openj9/pull/18085 - https://gitlab.eclipse.org/security/cve-assignement/-/issues/13
CVE ID: CVE-2023-5677 State: PUBLISHED Published: 2024-02-05T05:20:24.483Z Last Updated: 2025-06-17T21:29:24.839Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Axis Communications AB Products: AXIS OS Problem Types: CWE-78 Description: Brandon Rothel from QED Secure Solutions and Sam Hanson of Dragos have found that the VAPIX API tcptest.cgi did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. The impact of exploiting this vulnerability is lower with operator-privileges compared to administrator-privileges
ount. The impact of exploiting this vulnerability is lower with operator-privileges compared to administrator-privileges service accounts. Please refer to the Axis security advisory for more information and solution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.axis.com/dam/public/0a/47/d1/cve-2023-5677-en-US-483444.pdf
CVE ID: CVE-2023-5678 State: PUBLISHED Published: 2023-11-06T15:47:30.795Z Last Updated: 2025-11-03T21:50:41.915Z Vendors: OpenSSL Products: OpenSSL Problem Types: CWE-606 Description: Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an un
parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. While DH_check() performs all the necessary checks (as of CVE-2023-3817), DH_check_pub_key() doesn't make any of these checks, and is therefore vulnerable for excessively large P and Q parameters. Likewise, while DH_generate_key() performs a check for an excessively large P, it doesn't check for an excessively large Q. An application that calls DH_generate_key() or DH_check_pub_key() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. DH_generate_key() and
r parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. DH_generate_key() and DH_check_pub_key() are also called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_pub_key_ex(), EVP_PKEY_public_check(), and EVP_PKEY_generate(). Also vulnerable are the OpenSSL pkey command line application when using the "-pubcheck" option, as well as the OpenSSL genpkey command line application. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue. Additional Analyst No
not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue. Additional Analyst Notes: - CVE Program Container: References: - https://www.openssl.org/news/secadv/20231106.txt - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=34efaef6c103d636ab507a0cc34dca4d3aecc055 - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=710fee740904b6290fef0dd5536fbcedbc38ff0c - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=db925ae2e65d0d925adef429afc37f75bd1c2017 - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ddeb4b6c6d527e54ce9a99cba785c0f7776e54b6
CVE ID: CVE-2023-5679 State: PUBLISHED Published: 2024-02-13T14:05:06.688Z Last Updated: 2025-03-28T23:51:12.042Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: BIND 9 Description: A bad interaction between DNS64 and serve-stale may cause `named` to crash with an assertion failure during recursive resolution, when both of these features are enabled. This issue affects BIND 9 versions 9.16.12 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.12-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://kb.isc.org/docs/cve-2023-5679
nal Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://kb.isc.org/docs/cve-2023-5679 - http://www.openwall.com/lists/oss-security/2024/02/13/1 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263
//lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/ - https://security.netapp.com/advisory/ntap-20240426-0002/
CVE ID: CVE-2023-5680 State: PUBLISHED Published: 2024-02-13T14:05:19.783Z Last Updated: 2025-03-17T15:04:41.734Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: ISC Products: BIND 9 Description: If a resolver cache has a very large number of ECS records stored for the same name, the process of cleaning the cache database node for this name can significantly impair query performance. This issue affects BIND 9 versions 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://kb.isc.org/docs/cve-2023-5680 - https://security.ne
ISA ADP Vulnrichment: - CVE Program Container: References: - https://kb.isc.org/docs/cve-2023-5680 - https://security.netapp.com/advisory/ntap-20240503-0005/
CVE ID: CVE-2023-5681 State: PUBLISHED Published: 2023-10-20T20:31:05.363Z Last Updated: 2024-09-17T14:24:18.416Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: Netentsec Products: NS-ASG Application Security Gateway Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /admin/list_addr_fwresource_ip.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-243057 was assigned to this vulnerability. NOTE: The vendor was contacte
the public and may be used. The identifier VDB-243057 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.243057 - https://vuldb.com/?ctiid.243057 - https://github.com/Wsecpro/cve1/blob/main/NS-ASG-sql-list_addr_fwresource_ip.md
CVE ID: CVE-2023-5682 State: PUBLISHED Published: 2023-10-20T20:31:06.429Z Last Updated: 2024-10-11T18:08:53.553Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Tongda Products: OA Problem Types: CWE-89 Description: A vulnerability has been found in Tongda OA 2017 and classified as critical. This vulnerability affects unknown code of the file general/hr/training/record/delete.php. The manipulation of the argument RECORD_ID leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. VDB-243058 is the identifier assigned to