ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-3mqq-gw67-h42g: WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
RHSA-2020:4479: Red Hat Security Advisory: libxml2 security update
libxml2: memory leak in xmlParseBalancedChunkMemoryRecover in parser.c libxml2: memory leak in xmlSchemaPreRun in xmlschemas.c libxml2: infinite loop in xmlStringLenDecodeEntities in some end-of-file situations
CVSS v3.1: 7.5
CVE-2021-44876: Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to User enumeration. The Systeam application is an ERP system that uses a mixed architecture based on SaaS tenant and user management, and on-premise database and web application counterparts. This issue occurs during the identification of the correct tenant for a given user, where a difference in messages could allow an attacker to determine if the given user is valid or not, enabling a brute force attack with valid users.
CVSS v3.1: 5.3
CVSS v2.0: 5
CVE-2017-17931: PHP Scripts Mall Resume Clone Script has SQL Injection via the forget.php username parameter.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
CVE-2024-21729: [20240701] - Core - XSS in accessible media selection field
Inadequate input validation leads to XSS vulnerabilities in the accessiblemedia field.
CVSS v3.1: 6.1
GHSA-wjhv-8fw8-jxw2: The implementation of certain splice_write file operations in the Linux kernel before 3.16 does not enforce a restriction on the maximum size of a single file, which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted splice system call, as demonstrated by use of a file descriptor associated with an ext4 filesystem.
GHSA-v9ph-qmm4-6hp3: IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26216.
CVSS v3.0: 7.8
RHSA-2023:3615: Red Hat Security Advisory: OpenShift Container Platform 4.12.22 bug fix and security update
go-yaml: Denial of Service in go-yaml
CVSS v3.1: 5.5
CVE-2024-47893: GPU DDK - OOB read and write of the shared KMD/FW memory heap (VZ/TEE setups)
Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to read and/or write data outside the Guest's virtualised GPU memory.
CVSS v3.1: 6.5
GHSA-7m77-qr67-p2wh: N/A
CVSS v3.1: 8.8
CVE-2020-24590: The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML Entity Expansion attacks.
CVSS v3.1: 9.1
CVE-2025-71360: picklescan - Remote Code Execution via Undetected idlelib.calltip.get_entity
picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.calltip.get_entity function in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by victims.
CVSS v4.0: 7.6
CVSS v3.1: 8.1
GHSA-wq23-xq9q-wf8w: In parseUriInternal of Intent.java, there is a possible infinite loop due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 7.5
GHSA-gf59-j48p-85vg: index.php CuteNews 1.4.0 and earlier allows remote attackers to obtain the path of the installation path of the application by triggering an error message, such as by entering multiple ../ (dot dot slash) in the archive parameter.
CVE-2025-13520: MTCaptcha WordPress Plugin <= 2.7.2 - Cross-Site Request Forgery to Settings Update
The MTCaptcha WordPress Plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.2. This is due to missing or incorrect nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to update the plugin settings, including sensitive values like the private key, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS v3.1: 4.3
CVE-2025-50819: Directory traversal vulnerability in beiyuouo arxiv-daily thru 2025-05-06 (commit fad168770b0e68aef3e5acfa16bb2e7a7765d687) when parsing the the topic.yml file in the generation logic in daily_arxiv.py.
CVSS v3.1: 7.1
GHSA-8hpc-6883-68x9: HDF5 Library through 1.14.3 contains a heap-based buffer over-read in H5HL__fl_deserialize in H5HLcache.c, resulting in the corruption of the instruction pointer, a different vulnerability than CVE-2024-32613.
CVSS v3.1: 7.4
CVE-2022-24075: Whale browser before 3.12.129.18 allowed extensions to replace JavaScript files of the HWP viewer website which could access to local HWP files. When the HWP files were opened, the replaced script could read the files.
CVSS v3.1: 6.5
CVSS v2.0: 4.3
CVE-2026-20455: In geniezone, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10873936; Issue ID: MSV-6784.
CVSS v3.1: 7.8
GHSA-f86g-9653-w53f: ext/standard/var_unserializer.c in PHP 5.x through 7.1.24 allows attackers to cause a denial of service (application crash) via an unserialize call for the com, dotnet, or variant class.
CVSS v3.0: 7.5
GHSA-42jv-6664-mx8r: In the Linux kernel, the following vulnerability has been resolved:ASoC: codecs: wc938x: fix accessing array out of bounds for enum typeAccessing enums using integer would result in array out of bounds access
on platforms like aarch64 where sizeof(long) is 8 compared to enum size
which is 4 bytes.Fix this by using enumerated items instead of integers.
CVSS v3.1: 7.1
CVE-2022-22239: Junos OS Evolved: The ssh CLI command always runs as root which can lead to privilege escalation
An Execution with Unnecessary Privileges vulnerability in Management Daemon (mgd) of Juniper Networks Junos OS Evolved allows a locally authenticated attacker with low privileges to escalate their privileges on the device and potentially remote systems. This vulnerability allows a locally authenticated attacker with access to the ssh operational command to escalate their privileges on the system to root, or if there is user interaction on the local device to potentially escalate privileges on a remote system to root. This issue affects Juniper Networks Junos OS Evolved: All versions prior to 20.4R3-S5-EVO; 21.1-EVO versions prior to 21.1R3-EVO; 21.2-EVO versions prior to 21.2R2-S1-EVO, 21.2R3-EVO; 21.3-EVO versions prior to 21.3R2-EVO. This issue does not affect Juniper Networks Junos OS.
CVSS v3.1: 8.2
CVE-2020-12717: The COVIDSafe (Australia) app 1.0 and 1.1 for iOS allows a remote attacker to crash the app, and consequently interfere with COVID-19 contact tracing, via a Bluetooth advertisement containing manufacturer data that is too short. This occurs because of an erroneous OpenTrace manuData.subdata call. The ABTraceTogether (Alberta), ProteGO (Poland), and TraceTogether (Singapore) apps were also affected.
CVSS v3.1: 6.5
CVSS v2.0: 3.3
CVE-2019-6827: A CWE-787: Out-of-bounds Write vulnerability exists in Interactive Graphical SCADA System (IGSS), Version 14 and prior, which could cause a software crash when data in the mdb database is manipulated.
CVSS v3.1: 7.8
CVSS v2.0: 6.8
GHSA-84mw-34w6-2q43: Null pointer dereference via invalid Ragged Tensors
ImpactCalling `tf.raw_ops.RaggedTensorToVariant` with arguments specifying an invalid ragged tensor results in a null pointer dereference:The implementation of [`RaggedTensorToVariant` operations](https://github.com/tensorflow/tensorflow/blob/904b3926ed1c6c70380d5313d282d248a776baa1/tensorflow/core/kernels/ragged_tensor_to_variant_op.cc#L39-L40) does not validate that the ragged tensor argument is non-empty:Since `batched_ragged` contains no elements, `batched_ragged.splits` is a null vector, thus `batched_ragged.splits(0)` will result in  dereferencing `nullptr`.PatchesWe have patched the issue in GitHub commit [b055b9c474cd376259dde8779908f9eeaf097d93](https://github.com/tensorflow/tensorflow/commit/b055b9c474cd376259dde8779908f9eeaf097d93).The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.For more informationPlease consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.AttributionThis vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
CVSS v4.0: 2
CVSS v3.1: 2.5
CVE-2015-7496: GNOME Display Manager (gdm) before 3.18.2 allows physically proximate attackers to bypass the lock screen by holding the Escape key.
CVSS v2.0: 7.2
GHSA-c9r9-3h38-r7vj: Authenticated RCE in Zen Cart 1.5.5e
The traverseStrictSanitize function in admin_dir/includes/classes/AdminRequestSanitizer.php in ZenCart 1.5.5e mishandles key strings, which allows remote authenticated users to execute arbitrary PHP code by placing that code into an invalid array index of the admin_name array parameter to admin_dir/login.php, if there is an export of an error-log entry for that invalid array index.
CVSS v3.0: 8.8
CVE-2018-16552: MicroPyramid Django-CRM 0.2 allows CSRF for /users/create/, /users/##/edit/, and /accounts/##/delete/ URIs.
CVSS v3.1: 8.8
CVSS v2.0: 6.8
GHSA-jc59-g3q9-qwjw: Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution.
CVE-2024-6792: WP ULike < 4.7.2.1 - Subscriber+ Stored-XSS
The WP ULike  WordPress plugin before 4.7.2.1 does not properly sanitize user display names when rendering on a public page.
CVSS v3.1: 3.5
CVE-2008-7254: Directory traversal vulnerability in includes/template-loader.php in Irmin CMS (formerly Pepsi CMS) 0.5 and 0.6 BETA2, when register_globals is enabled, allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the _Root_Path parameter.  NOTE: some of these details are obtained from third party information.
CVSS v2.0: 6.8
CVE-2025-65849: A cryptanalytic break in Altcha Proof-of-Work obfuscation mode version 0.8.0 and later allows for remote visitors to recover the Proof-of-Work nonce in constant time via mathematical deduction. NOTE: this is disputed by the Supplier because the product's objective is "to discourage automated scraping / bots, not guarantee resistance to determined attackers." The documentation states “the goal is not to provide a secure cryptographic algorithm but to use a proof-of-work mechanism that allows any capable device to decrypt the hidden data.”
CVSS v3.1: 9.1
GHSA-wwcp-26wc-3fxm: JSON-lib mishandles an unbalanced comment string
util/JSONTokener.java in JSON-lib before 3.1.0 mishandles an unbalanced comment string.
CVSS v4.0: 6.9
CVSS v3.1: 5.3
CVE-2011-4608: mod_cluster in JBoss Enterprise Application Platform 5.1.2 for Red Hat Linux allows worker nodes to register with arbitrary virtual hosts, which allows remote attackers to bypass intended access restrictions and provide malicious content, hijack sessions, and steal credentials by registering from an external vhost that does not enforce security constraints.
CVSS v2.0: 7.5
CVE-2017-7362: Pixie 1.0.4 allows an admin/index.php s=publish&m=dynamic&x= XSS attack.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
GHSA-4fh9-jvf5-584j: When DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges from the responses as these do not make sense coming from a DoH resolver. However when an IPv4 address was mapped through IPv6, these addresses were erroneously let through, leading to a potential DNS Rebinding attack. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.
CVE-2021-34280: Polaris Office v9.103.83.44230 is affected by a Uninitialized Pointer Vulnerability in PolarisOffice.exe and EngineDLL.dll that may cause a Remote Code Execution. To exploit the vulnerability, someone must open a crafted PDF file.
CVSS v3.1: 7.8
CVSS v2.0: 6.8
RHSA-2022:1379: Red Hat Security Advisory: Red Hat Decision Manager 7.12.1 security update
spring-framework: RCE via Data Binding on JDK 9+
CVSS v3.1: 8.1
CVE-2007-4805: Directory traversal vulnerability in getgalldata.php in fuzzylime (cms) 3.0 and earlier allows remote attackers to include arbitrary local files via a .. (dot dot) in the p parameter.
CVSS v2.0: 7.5
CVE-2026-8230: Wavlink NU516U1 login.cgi sys_login1 os command injection
A flaw has been found in Wavlink NU516U1 240425. The impacted element is the function sys_login1 of the file /cgi-bin/login.cgi. Executing a manipulation of the argument ipaddr can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
CVE-2022-33244: Reachable assertion in Modem
Transient DOS due to reachable assertion in modem during MIB reception and SIB timeout
CVSS v3.1: 7.5
CVE-2007-3660: The Nonnoi ASP/Barcode ActiveX control (nonnoi_ASPBarcode.dll) allows remote attackers to overwrite arbitrary files via an argument to the SaveBarcode function.
CVSS v2.0: 7.5
CVE-2001-1432: Directory traversal vulnerability in Cherokee Web Server allows remote attackers to read arbitrary files via a .. (dot dot) in the URL.
CVSS v2.0: 7.8
GHSA-c493-6g8x-m92j: Unspecified vulnerability in Microsoft Office Communications Server (OCS), Office Communicator, and Windows Live Messenger allows remote attackers to cause a denial of service (crash) via a crafted Real-time Transport Control Protocol (RTCP) receiver report packet.
RHSA-2024:7004: Red Hat Security Advisory: kernel security update
kernel: gpiolib: cdev: Fix use after free in lineinfo_changed_notify kernel: wifi: mac80211: Avoid address calculations via out of bounds array indexing kernel: ice: Fix improper extts handling
CVSS v3.1: 4.4
GHSA-5339-hvwr-7582: Unhead Vulnerable to Bypass of URI Scheme Sanitization in makeTagSafe via Case-Sensitivity
The `link.href` check in `makeTagSafe` (safe.ts, line 68-71) uses `String.includes()`, which is case-sensitive:Browsers treat URI schemes case-insensitively. `DATA:text/css,...` is the same as `data:text/css,...` to the browser, but `'DATA:...'.includes('data:')` returns `false`.PoCSSR output:The browser loads this as a CSS stylesheet. An attacker can inject arbitrary CSS for UI redressing or data exfiltration via CSS attribute selectors with background-image callbacks.Any case variation works: `DATA:`, `Data:`, `dAtA:`, `JAVASCRIPT:`, etc.Suggested fix
CVSS v3.1: 0
CVE-2010-4630: Cross-site scripting (XSS) vulnerability in pages/admin/surveys/create.php in the WP Survey And Quiz Tool plugin 1.2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter.
CVSS v2.0: 4.3
GHSA-858m-2vf7-cgmq: The crypto engine process in Cisco IOS on Aggregation Services Router (ASR) Route Processor 2 does not properly manage memory, which allows local users to cause a denial of service (route processor crash) by creating multiple tunnels and then examining encryption statistics, aka Bug ID CSCuc52193.
CVE-2022-4184: Insufficient policy enforcement in Autofill in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass autofill restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVSS v3.1: 4.3
CVE-2017-14035: CrushFTP 8.x before 8.2.0 has a serialization vulnerability.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-4xcv-44mg-q4m6: The contact-form-to-email plugin before 1.2.66 for WordPress has CSRF.
CVSS v3.0: 8.8
GHSA-gcfv-hrxv-4rjx: Memory corruption while preprocessing IOCTLs in sensors.
CVSS v3.1: 7.8
CVE-2026-4032: CodeColorer <= 0.10.1 - Unauthenticated Stored Cross-Site Scripting via 'class' attribute in 'cc' Comment Shortcode
The CodeColorer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' parameter in 'cc' comment shortcode in versions up to, and including, 0.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires comments to be enabled on the target post and guest comments to be allowed.
CVSS v3.1: 6.1
GHSA-rrj9-vv37-478g: Operational restrictions bypass vulnerability in E-mail of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to alter the data of Portal without the appropriate privilege.
CVSS v3.1: 4.3
CVE-2021-20093: A buffer over-read vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a. An unauthenticated remote attacker can exploit this issue to disclose heap memory contents or crash the CodeMeter Runtime Server.
CVSS v3.1: 9.1
CVSS v2.0: 6.4
CVE-2024-24568: Suricata http2: header handling evasion
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine.  Prior to 7.0.3, the rules inspecting HTTP2 headers can get bypassed by crafted traffic. The vulnerability has been patched in 7.0.3.
CVSS v3.1: 5.3
CVE-2026-41974: Permission control vulnerability in service notifications. Impact: Successful exploitation of this vulnerability may affect availability.
CVSS v3.1: 3.6
CVE-2017-3116: Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the MakeAccessible plugin when parsing TrueType font data. Successful exploitation could lead to arbitrary code execution.
CVSS v3.0: 8.8
CVSS v2.0: 9.3
GHSA-rqpg-j7j6-g58g: A Incorrect Default Permissions vulnerability in the packaging of inn of SUSE Linux Enterprise Server 11-SP3; openSUSE Backports SLE-15-SP2, openSUSE Leap 15.2 allows local attackers to escalate their privileges from the news user to root. This issue affects: SUSE Linux Enterprise Server 11-SP3 inn version inn-2.4.2-170.21.3.1 and prior versions. openSUSE Backports SLE-15-SP2 inn versions prior to 2.6.2. openSUSE Leap 15.2 inn versions prior to 2.6.2.
GHSA-f49m-vf83-692w: i18next-http-middleware: MissingKeyHandler does not reject keys whose segments contain prototype-polluting names
Impact`i18next-http-middleware` ≤ 3.9.6's `missingKeyHandler` blocked the literal request-body keys `__proto__`, `constructor`, and `prototype` (added in 3.9.3, see GHSA-5fgg-jcpf-8jjw), but did not reject dotted variants such as `"__proto__.polluted"`. Downstream backends that split the missing-key string on a configured `keySeparator` (notably `i18next-fs-backend` ≤ 2.6.5) hand these keys to an unguarded `setPath()` walker that writes to `Object.prototype`.Applications that expose `missingKeyHandler` to untrusted input **AND** use `i18next-fs-backend` ≤ 2.6.5 are directly exploitable for remote prototype pollution. Other downstream backends that split the missing-key string the same way may be similarly affected.Depending on the host application, polluted prototype properties may cause crashes, corrupted translation behaviour, configuration poisoning, or bypasses of property-based security checks.PatchesFixed in **i18next-http-middleware 3.9.7**. A new `utils.hasUnsafeKeySegment(key, keySeparator)` helper is now used by `missingKeyHandler`; the configured `i18next.options.keySeparator` is honoured (default `.`; `false` disables segment splitting and only the literal-key denylist applies). Legitimate dotted keys (e.g. `"header.title"`) are unaffected.The root-cause fix has been shipped in `i18next-fs-backend` **2.6.6** — see the companion advisory.WorkaroundsIf users cannot upgrade immediately:Do not expose `missingKeyHandler` to untrusted users (mount it behind authentication, or remove the route).Add a request-body filter ahead of the handler that rejects any top-level key containing `__proto__`, `constructor`, or `prototype` after splitting on a configured `keySeparator`.Disable missing-key persistence (`saveMissing: false`) when accepting writes from untrusted input.ResourcesOriginal report by [@codeswhite](https://github.com/codeswhite).Companion advisory in `i18next-fs-backend`: [GHSA-2933-q333-qg83](https://github.com/i18next/i18next-fs-backend/security/advisories/GHSA-2933-q333-qg83).Previous `i18next-http-middleware` security release: GHSA-5fgg-jcpf-8jjw and GHSA-c3h8-g69v-pjrg (in 3.9.3).
CVSS v3.1: 9.1
GHSA-p2fp-6329-h7jp: The TinyPNG – JPEG, PNG & WebP image compression plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_converted_image_size function in all versions up to, and including, 3.6.13. This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). An attacker can exploit this by injecting an arbitrary server file path into the 'convert.path' field of the 'tiny_compress_images' post meta on an attachment they own, then triggering attachment deletion to invoke the vulnerable code path.
CVSS v3.1: 8.1
CVE-2021-44350: SQL Injection vulnerability exists in ThinkPHP5 5.0.x <=5.1.22 via the parseOrder function in Builder.php.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2023-4532: Incorrect Authorization in GitLab
An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. Users were capable of linking CI/CD jobs of private projects which they are not a member of.
CVSS v3.1: 4.3
CVE-2025-48995: SignXML's signature verification with HMAC is vulnerable to a timing attack
SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared secret set (`signxml.XMLVerifier.verify(require_x509=False, hmac_key=...`), versions of SignXML prior to 4.0.4 are vulnerable to a potential timing attack. The verifier may leak information about the correct HMAC when comparing it with the user supplied hash, allowing users to reconstruct the correct HMAC for any data.
CVSS v4.0: 6.9
GHSA-5j84-2mfg-4v5r: Context-specific code was included in a shared jump table; resulting in assertions being triggered in multithreaded wasm code. This vulnerability affects Firefox < 86.
CVSS v3.1: 6.5
CVE-2021-24339: Pods < 2.7.27 - Authenticated Stored Cross-Site Scripting (XSS)
The Pods – Custom Content Types and Fields WordPress plugin before 2.7.27 was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Menu Label' field parameter.
CVSS v3.1: 5.4
CVSS v2.0: 3.5
CVE-2024-5103: Campcodes Complete Web-Based School Management System student_first_payment.php sql injection
A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /view/student_first_payment.php. The manipulation of the argument grade leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-265093 was assigned to this vulnerability.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5