deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-2063
Published: 2023-06-02
Description: Unrestricted Upload of File with Dangerous Type vulnerability in FTP function on Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP allows a remote unauthenticated attacker to cause information disclosure, tampering, deletion or destruction via file upload/download. As a result, the attacker may be able to exploit this for further attacks.

CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434, CWE-434
References: https://jvn.jp/vu/JVNVU92908006; https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2023-004.pdf; https://jvn.jp/vu/JVNVU92908006
CVE: CVE-2023-1159
Published: 2023-06-02
Description: The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via service titles in versions up to, and including, 21.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative privileges to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2913570%40bookly-responsive-appointment-booking-tool&new=2913570%40bookly-responsive-appointment-booking-tool&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/d4cdf774-c93b-4b94-85ba-aa56bf401873?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2913570%40bookly-responsive-appointment-booking-tool&new=2913570%40bookly-responsive-appointment-booking-tool&sfp_email=&sfph_mail=
CVE: CVE-2023-2835
Published: 2023-06-02
Description: The WP Directory Kit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/Don-H50/wp-vul/blob/main/WDK-xss-exploit.md; https://plugins.trac.wordpress.org/changeset/2917413/wpdirectorykit/trunk/application/views/wdk_messages/index.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/847f1c00-0e8f-4d38-84af-fe959e2efe5c?source=cve
CVE: CVE-2023-3000
Published: 2023-06-02
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Erikoglu Technology ErMon allows Command Line Execution through SQL Injection, Authentication Bypass.This issue affects ErMon: before 230602.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0315; https://www.usom.gov.tr/bildirim/tr-23-0315
CVE: CVE-2022-46307
Published: 2023-06-02
Description: SGUDA U-Lock central lock control service’s lock management function has incorrect authorization. A remote attacker with general privilege can exploit this vulnerability to call privileged APIs to acquire information, manipulate or disrupt the functionality of arbitrary electronic locks.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://www.twcert.org.tw/tw/cp-132-7099-e8897-1.html; https://www.twcert.org.tw/tw/cp-132-7099-e8897-1.html
CVE: CVE-2022-46308
Published: 2023-06-02
Description: SGUDA U-Lock central lock control service’s user management function has incorrect authorization. A remote attacker with general user privilege can exploit this vulnerability to call privileged APIs to access, modify and delete user information.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://www.twcert.org.tw/tw/cp-132-7100-7a15c-1.html; https://www.twcert.org.tw/tw/cp-132-7100-7a15c-1.html
CVE: CVE-2022-47616
Published: 2023-06-02
Description: Hitron CODA-5310 has insufficient filtering for specific parameters in the connection test function. A remote attacker authenticated as an administrator, can use the management page to perform command injection attacks, to execute arbitrary system command, manipulate system or disrupt service.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.twcert.org.tw/tw/cp-132-7082-373d5-1.html; https://www.twcert.org.tw/tw/cp-132-7082-373d5-1.html
CVE: CVE-2022-47617
Published: 2023-06-02
Description: Hitron CODA-5310 has hard-coded encryption/decryption keys in the program code. A remote attacker authenticated as an administrator can decrypt system files using the hard-coded keys for file access, modification, and cause service disruption.
CVSS Score: 7.2 (HIGH)
CWE: CWE-798
References: https://www.twcert.org.tw/tw/cp-132-7083-94e13-1.html; https://www.twcert.org.tw/tw/cp-132-7083-94e13-1.html
CVE: CVE-2023-25780
Published: 2023-06-02
Description: It is identified a vulnerability of insufficient authentication in an important specific function of Status PowerBPM. A LAN attacker with normal user privilege can exploit this vulnerability to modify substitute agent to arbitrary users, resulting in serious consequence.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-306
References: https://www.twcert.org.tw/tw/cp-132-7152-d7f5b-1.html; https://www.twcert.org.tw/tw/cp-132-7152-d7f5b-1.html
CVE: CVE-2023-28698
Published: 2023-06-02
Description: Wade Graphic Design FANTSY has a vulnerability of insufficient authorization check. An unauthenticated remote user can exploit this vulnerability by modifying URL parameters to gain administrator privileges to perform arbitrary system operation or disrupt service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: https://www.twcert.org.tw/tw/cp-132-7101-f88db-1.html; https://www.twcert.org.tw/tw/cp-132-7101-f88db-1.html
CVE: CVE-2023-28699
Published: 2023-06-02
Description: Wade Graphic Design FANTSY has a vulnerability of insufficient filtering for file type in its file update function. An authenticated remote attacker with general user privilege can exploit this vulnerability to upload a PHP file containing a webshell to perform arbitrary system operation or disrupt service.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://www.twcert.org.tw/tw/cp-132-7102-41ab8-1.html; https://www.twcert.org.tw/tw/cp-132-7102-41ab8-1.html
CVE: CVE-2023-28700
Published: 2023-06-02
Description: OMICARD EDM backend system’s file uploading function does not restrict upload of file with dangerous type. A local area network attacker with administrator privileges can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary system commands or disrupt service.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-434
References: https://www.twcert.org.tw/tw/cp-132-7144-b7536-1.html; https://www.twcert.org.tw/tw/cp-132-7144-b7536-1.html
CVE: CVE-2023-28701
Published: 2023-06-02
Description: ELITE TECHNOLOGY CORP. Web Fax has a vulnerability of SQL Injection. An unauthenticated remote attacker can inject SQL commands into the input field of the login page to perform arbitrary system commands, disrupt service or terminate service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.twcert.org.tw/tw/cp-132-7145-1a0d4-1.html; https://www.twcert.org.tw/tw/cp-132-7145-1a0d4-1.html
CVE: CVE-2023-28702
Published: 2023-06-02
Description: ASUS RT-AC86U does not filter special characters for parameters in specific web URLs. A remote attacker with normal user privileges can exploit this vulnerability to perform command injection attack to execute arbitrary system commands, disrupt system or terminate service.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.twcert.org.tw/tw/cp-132-7146-ef92a-1.html; https://www.twcert.org.tw/tw/cp-132-7146-ef92a-1.html
CVE: CVE-2023-28703
Published: 2023-06-02
Description: ASUS RT-AC86U’s specific cgi function has a stack-based buffer overflow vulnerability due to insufficient validation for network packet header length. A remote attacker with administrator privileges can exploit this vulnerability to execute arbitrary system commands, disrupt system or terminate service.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121
References: https://www.twcert.org.tw/tw/cp-132-7147-afcf9-1.html; https://www.twcert.org.tw/tw/cp-132-7147-afcf9-1.html
CVE: CVE-2023-28704
Published: 2023-06-02
Description: Furbo dog camera has insufficient filtering for special parameter of device log management function. An unauthenticated remote attacker in the Bluetooth network with normal user privileges can exploit this vulnerability to perform command injection attack to execute arbitrary system commands or disrupt service.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.twcert.org.tw/tw/cp-132-7153-68f52-1.html; https://www.twcert.org.tw/tw/cp-132-7153-68f52-1.html
CVE: CVE-2023-28705
Published: 2023-06-02
Description: Openfind Mail2000 has insufficient filtering special characters of email content of its content filtering function. A remote attacker can exploit this vulnerability using phishing emails that contain malicious web pages injected with JavaScript. When users access the system and open the email, it triggers an XSS (Reflected Cross-site scripting) attack.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.twcert.org.tw/tw/cp-132-7158-751a6-1.html; https://www.twcert.org.tw/tw/cp-132-7158-751a6-1.html
CVE: CVE-2023-30602
Published: 2023-06-02
Description: Hitron Technologies CODA-5310’s Telnet function transfers sensitive data in plaintext. An unauthenticated remote attacker can exploit this vulnerability to access credentials of normal users and administrator.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://www.twcert.org.tw/tw/cp-132-7084-74e83-1.html; https://www.twcert.org.tw/tw/cp-132-7084-74e83-1.html
CVE: CVE-2023-30603
Published: 2023-06-02
Description: Hitron Technologies CODA-5310 Telnet function with the default account and password, and there is no warning or prompt to ask users to change the default password and account. An unauthenticated remote attackers can exploit this vulnerability to obtain the administrator’s privilege, resulting in performing arbitrary system operation or disrupt service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1392
References: https://www.twcert.org.tw/tw/cp-132-7085-13321-1.html; https://www.twcert.org.tw/tw/cp-132-7085-13321-1.html
CVE: CVE-2023-30604
Published: 2023-06-02
Description: It is identified a vulnerability of insufficient authentication in the system configuration interface of Hitron Technologies CODA-5310. An unauthorized remote attacker can exploit this vulnerability to access system configuration interface, resulting in performing arbitrary system operation or disrupt service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.twcert.org.tw/tw/cp-132-7086-35622-1.html; https://www.twcert.org.tw/tw/cp-132-7086-35622-1.html
CVE: CVE-2022-24695
Published: 2023-06-02
Description: Bluetooth Classic in Bluetooth Core Specification through 5.3 does not properly conceal device information for Bluetooth transceivers in Non-Discoverable mode. By conducting an efficient over-the-air attack, an attacker can fully extract the permanent, unique Bluetooth MAC identifier, along with device capabilities and identifiers, some of which may contain identifying information about the device owner. This additionally allows the attacker to establish a connection to the target device.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-203
References: https://sp2023.ieee-security.org/program-papers.html; https://www.bluetooth.com/specifications/specs/core-specification/; https://www.computer.org/csdl/proceedings-article/sp/2023/933600a521/1He7Yja1AYM
CVE: CVE-2023-28469
Published: 2023-06-02
Description: An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing operations to gain access to already freed memory. This affects Valhall r29p0 through r42p0 before r43p0, and Arm's GPU Architecture Gen5 r41p0 through r42p0 before r43p0.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities; https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE: CVE-2023-33717
Published: 2023-06-02
Description: mp4v2 v2.1.3 was discovered to contain a memory leak when a method calling MP4File::ReadBytes() had allocated memory but did not catch exceptions thrown by ReadBytes()
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://github.com/enzo1982/mp4v2/; https://github.com/enzo1982/mp4v2/issues/37; https://github.com/enzo1982/mp4v2/
CVE: CVE-2023-33731
Published: 2023-06-02
Description: Reflected Cross Site Scripting (XSS) in the view dashboard detail feature in Microworld Technologies eScan management console 14.0.1400.2281 allows remote attacker to inject arbitrary code via the URL directly.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/sahiloj/CVE-2023-33731/blob/main/CVE-2023-33731.md; https://owasp.org/www-community/attacks/xss/; https://github.com/sahiloj/CVE-2023-33731/blob/main/CVE-2023-33731.md
CVE: CVE-2023-3056
Published: 2023-06-02
Description: A vulnerability was found in YFCMF up to 3.0.4. It has been declared as problematic. This vulnerability affects unknown code of the file index.php. The manipulation leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-230542 is the identifier assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-24
References: https://github.com/HuBenLab/HuBenVulList/blob/main/YFCMF-TP6-3.0.4%20has%20a%20Remote%20Command%20Execution%20(RCE)%20vulnerability%201.md; https://vuldb.com/?ctiid.230542; https://vuldb.com/?id.230542
CVE: CVE-2023-3031
Published: 2023-06-02
Description: Improper Limitation of a Pathname leads to a Path Traversal vulnerability in the module King-Avis for Prestashop, allowing a user knowing the download token to read arbitrary local files.This issue affects King-Avis: before 17.3.15.


CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://borelenzo.github.io/stuff/2023/06/01/cve-2023-3031.html; https://borelenzo.github.io/stuff/2023/06/01/cve-2023-3031.html
CVE: CVE-2023-3032
Published: 2023-06-02
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Mobatime web application (Documentary proof upload modules) allows a malicious user to Upload a Web Shell to a Web Server.This issue affects Mobatime web application: through 06.7.22.


CVSS Score: 8.1 (HIGH)
CWE: CWE-434, CWE-434
References: https://borelenzo.github.io/stuff/2023/06/01/cve-2023-3032.html; https://borelenzo.github.io/stuff/2023/06/01/cve-2023-3032.html
CVE: CVE-2023-3033
Published: 2023-06-02
Description: Incorrect Authorization vulnerability in Mobatime web application allows Privilege Escalation, Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mobatime web application: through 06.7.22.


CVSS Score: 6.8 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://borelenzo.github.io/stuff/2023/06/01/cve-2023-3033.html; https://borelenzo.github.io/stuff/2023/06/01/cve-2023-3033.html
CVE: CVE-2023-3057
Published: 2023-06-02
Description: A vulnerability was found in YFCMF up to 3.0.4. It has been rated as problematic. This issue affects some unknown processing of the file app/admin/controller/Ajax.php. The manipulation of the argument controllername leads to path traversal: '../filedir'. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-230543.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-24
References: https://github.com/HuBenLab/HuBenVulList/blob/main/YFCMF-TP6-3.0.4%20has%20a%20Remote%20Command%20Execution%20(RCE)%20vulnerability%202.md; https://vuldb.com/?ctiid.230543; https://vuldb.com/?id.230543
CVE: CVE-2023-3058
Published: 2023-06-02
Description: A vulnerability was found in 07FLY CRM up to 1.2.0. It has been declared as problematic. This vulnerability affects unknown code of the component User Profile Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-230560.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://gitee.com/07fly/FLY-CRM/issues/I76K4N; https://vuldb.com/?ctiid.230560; https://vuldb.com/?id.230560
CVE: CVE-2023-3059
Published: 2023-06-02
Description: A vulnerability, which was classified as critical, was found in SourceCodester Online Exam Form Submission 1.0. This affects an unknown part of the file /admin/update_s6.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-230565 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Aiiimer/requestCVE/blob/main/SQL.md; https://vuldb.com/?ctiid.230565; https://vuldb.com/?id.230565
CVE: CVE-2023-33476
Published: 2023-06-02
Description: ReadyMedia (MiniDLNA) versions from 1.1.15 up to 1.3.2 is vulnerable to Buffer Overflow. The vulnerability is caused by incorrect validation logic when handling HTTP requests using chunked transport encoding. This results in other code later using attacker-controlled chunk values that exceed the length of the allocated buffer, resulting in out-of-bounds read/write.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://blog.coffinsec.com/0day/2023/05/31/minidlna-heap-overflow-rca.html; https://lists.debian.org/debian-lts-announce/2023/06/msg00027.html; https://security.gentoo.org/glsa/202311-12
CVE: CVE-2023-34362
Published: 2023-06-02
Description: In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, and execute SQL statements that alter or delete database elements. NOTE: this is exploited in the wild in May and June 2023; exploitation of unpatched systems can occur via HTTP or HTTPS. All versions (e.g., 2020.0 and 2019x) before the five explicitly mentioned versions are affected, including older unsupported versions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: http://packetstormsecurity.com/files/172883/MOVEit-Transfer-SQL-Injection-Remote-Code-Execution.html; http://packetstormsecurity.com/files/173110/MOVEit-SQL-Injection.html; https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023
CVE: CVE-2023-3060
Published: 2023-06-02
Description: A vulnerability has been found in code-projects Agro-School Management System 1.0 and classified as problematic. This vulnerability affects the function doAddQuestion of the file btn_functions.php. The manipulation of the argument Question leads to cross site scripting. The attack can be initiated remotely. VDB-230566 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/hotencode/CveHub/blob/main/agricultural%20school%20management%20system%20has%20cross-site%20script%20vulnerability.pdf; https://vuldb.com/?ctiid.230566; https://vuldb.com/?id.230566
CVE: CVE-2023-3061
Published: 2023-06-02
Description: A vulnerability was found in code-projects Agro-School Management System 1.0 and classified as critical. This issue affects some unknown processing of the file btn_functions.php of the component Attachment Image Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-230567.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/hotencode/CveHub/blob/main/Agro-School%20Management%20System%20has%20a%20file%20upload%20(RCE)%20vulnerability.pdf; https://vuldb.com/?ctiid.230567; https://vuldb.com/?id.230567
CVE: CVE-2023-3062
Published: 2023-06-02
Description: A vulnerability was found in code-projects Agro-School Management System 1.0. It has been classified as critical. Affected is an unknown function of the file index.php. The manipulation of the argument password leads to sql injection. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-230568.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/hotencode/CveHub/blob/main/Agro-School%20Management%20System%20index.php%20has%20Sqlinjection.pdf; https://vuldb.com/?ctiid.230568; https://vuldb.com/?id.230568
CVE: CVE-2023-30149
Published: 2023-06-02
Description: SQL injection vulnerability in the City Autocomplete (cityautocomplete) module from ebewe.net for PrestaShop, prior to version 1.8.12 (for PrestaShop version 1.5/1.6) or prior to 2.0.3 (for PrestaShop version 1.7), allows remote attackers to execute arbitrary SQL commands via the type, input_name. or q parameter in the autocompletion.php front controller.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://addons.prestashop.com/fr/inscription-processus-de-commande/6097-city-autocomplete.html; https://friends-of-presta.github.io/security-advisories/module/2023/06/01/cityautocomplete.html; https://addons.prestashop.com/fr/inscription-processus-de-commande/6097-city-autocomplete.html
CVE: CVE-2023-2687
Published: 2023-06-02
Description: Buffer overflow in Platform CLI component in Silicon Labs Gecko SDK v4.2.1 and earlier allows user to overwrite limited structures on the heap.
CVSS Score: 2.9 (LOW)
CWE: CWE-787, CWE-131
References: https://community.silabs.com/sfc/servlet.shepherd/document/download/0698Y00000U2sWXQAZ?operationContext=S1; https://github.com/SiliconLabs/gecko_sdk/releases; https://community.silabs.com/sfc/servlet.shepherd/document/download/0698Y00000U2sWXQAZ?operationContext=S1
CVE: CVE-2023-34094
Published: 2023-06-02
Description: ChuanhuChatGPT is a graphical user interface for ChatGPT and many large language models. A vulnerability in versions 20230526 and prior allows unauthorized access to the config.json file of the privately deployed ChuanghuChatGPT project, when authentication is not configured. The attacker can exploit this vulnerability to steal the API keys in the configuration file. The vulnerability has been fixed in commit bfac445. As a workaround, setting up access authentication can help mitigate the vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-306
References: https://github.com/GaiZhenbiao/ChuanhuChatGPT/commit/bfac445e799c317b0f5e738ab394032a18de62eb; https://github.com/GaiZhenbiao/ChuanhuChatGPT/security/advisories/GHSA-j34w-9xr4-m9p8; https://github.com/GaiZhenbiao/ChuanhuChatGPT/commit/bfac445e799c317b0f5e738ab394032a18de62eb
CVE: CVE-2023-3067
Published: 2023-06-02
Description: Cross-site Scripting (XSS) - Stored in GitHub repository zadam/trilium prior to 0.59.4.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/zadam/trilium/commit/4c3fcc3ea6f37debcb87ac1a7f5698c27be0e67b; https://huntr.dev/bounties/4772ceb7-1594-414d-9b20-5b82029da7b6; https://github.com/zadam/trilium/commit/4c3fcc3ea6f37debcb87ac1a7f5698c27be0e67b
CVE: CVE-2023-3068
Published: 2023-06-02
Description: A vulnerability classified as critical has been found in Campcodes Retro Cellphone Online Store 1.0. Affected is an unknown function of the file /admin/modal_add_product.php. The manipulation of the argument category leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-230580.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/wordpress405/cve/blob/main/Retro%20Cellphone%20Online%20Store.pdf; https://vuldb.com/?ctiid.230580; https://vuldb.com/?id.230580