deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-27905
Published: 2023-03-10
Description: Jenkins update-center2 3.13 and 3.14 renders the required Jenkins core version on plugin download index pages without sanitization, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide a plugin for hosting.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://www.jenkins.io/security/advisory/2023-03-08/#SECURITY-3063; https://www.jenkins.io/security/advisory/2023-03-08/#SECURITY-3063
CVE: CVE-2022-44574
Published: 2023-03-10
Description: An improper authentication vulnerability exists in Avalanche version 6.3.x and below allows unauthenticated attacker to modify properties on specific port.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287, CWE-287
References: https://forums.ivanti.com/s/article/Avalanche-ZDI-CAN-19513-Security-Advisory?language=en_US; https://forums.ivanti.com/s/article/Avalanche-ZDI-CAN-19513-Security-Advisory?language=en_US
CVE: CVE-2023-23326
Published: 2023-03-10
Description: A Stored Cross-Site Scripting (XSS) vulnerability exists in AvantFAX 3.3.7. An authenticated low privilege user can inject arbitrary Javascript into their e-mail address which is executed when an administrator logs into AvantFAX to view the admin dashboard. This may result in stealing an administrator's session cookie and hijacking their session.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://avantfax.com; https://github.com/superkojiman/vulnerabilities/blob/master/AvantFAX-3.3.7/README.md; http://avantfax.com
CVE: CVE-2023-23327
Published: 2023-03-10
Description: An Information Disclosure vulnerability exists in AvantFAX 3.3.7. Backups of the AvantFAX sent/received faxes, and database backups are stored using the current date as the filename and hosted on the web server without access controls.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200, CWE-200
References: http://avantfax.com; https://github.com/superkojiman/vulnerabilities/blob/master/AvantFAX-3.3.7/README.md; http://avantfax.com
CVE: CVE-2023-23328
Published: 2023-03-10
Description: A File Upload vulnerability exists in AvantFAX 3.3.7. An authenticated user can bypass PHP file type validation in FileUpload.php by uploading a specially crafted PHP file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: http://avantfax.com; https://github.com/superkojiman/vulnerabilities/blob/master/AvantFAX-3.3.7/README.md; http://avantfax.com
CVE: CVE-2023-23911
Published: 2023-03-10
Description: An improper access control vulnerability exists prior to v6 that could allow an attacker to break the E2E encryption of a chat room by a user changing the group key of a chat room.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284, CWE-326
References: https://hackerone.com/reports/1757663; https://hackerone.com/reports/1757663
CVE: CVE-2023-27530
Published: 2023-03-10
Description: A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could allow an attacker to craft requests that can be abuse to cause multipart parsing to take longer than expected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-770, CWE-770
References: https://discuss.rubyonrails.org/t/cve-2023-27530-possible-dos-vulnerability-in-multipart-mime-parsing/82388; https://lists.debian.org/debian-lts-announce/2023/04/msg00017.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-27532
Published: 2023-03-10
Description: Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to gaining access to the backup infrastructure hosts.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: https://www.veeam.com/kb4424; https://www.veeam.com/kb4424; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27532
CVE: CVE-2023-24999
Published: 2023-03-11
Description: HashiCorp Vault and Vault Enterprise’s approle auth method allowed any authenticated user with access to an approle destroy endpoint to destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability is fixed in Vault 1.13.0, 1.12.4, 1.11.8, 1.10.11 and above.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://discuss.hashicorp.com/t/hcsec-2023-07-vault-fails-to-verify-if-approle-secretid-belongs-to-role-during-a-destroy-operation/51305; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://discuss.hashicorp.com/t/hcsec-2023-07-vault-fails-to-verify-if-approle-secretid-belongs-to-role-during-a-destroy-operation/51305
CVE: CVE-2023-1349
Published: 2023-03-11
Description: A vulnerability, which was classified as problematic, has been found in Hsycms 3.1. Affected by this issue is some unknown functionality of the file controller\cate.php of the component Add Category Module. The manipulation of the argument title leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-222842 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/yztale/hsycms/blob/main/README.md; https://vuldb.com/?ctiid.222842; https://vuldb.com/?id.222842
CVE: CVE-2023-1350
Published: 2023-03-11
Description: A vulnerability was found in liferea. It has been rated as critical. Affected by this issue is the function update_job_run of the file src/update.c of the component Feed Enrichment. The manipulation of the argument source with the input |date &gt;/tmp/bad-item-link.txt leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 8d8b5b963fa64c7a2122d1bbfbb0bed46e813e59. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-222848.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-78
References: https://github.com/lwindolf/liferea/commit/8d8b5b963fa64c7a2122d1bbfbb0bed46e813e59; https://vuldb.com/?ctiid.222848; https://vuldb.com/?id.222848
CVE: CVE-2023-1351
Published: 2023-03-11
Description: A vulnerability classified as critical has been found in SourceCodester Computer Parts Sales and Inventory System 1.0. This affects an unknown part of the file cust_transac.php. The manipulation of the argument phonenumber leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222849 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/chenxing0903/CveHub/blob/main/Computer-Parts-Sales-And-Inventory-System-Sql-Vulnerability.pdf; https://vuldb.com/?ctiid.222849; https://vuldb.com/?id.222849
CVE: CVE-2023-1352
Published: 2023-03-11
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Design and Implementation of Covid-19 Directory on Vaccination System 1.0. This issue affects some unknown processing of the file /admin/login.php. The manipulation of the argument txtusername/txtpassword leads to sql injection. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-222851.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/covid-19-vaccination%20vlun%20pdf/covid-19-vaccination%20sql(6).pdf; https://vuldb.com/?ctiid.222851; https://vuldb.com/?id.222851
CVE: CVE-2023-1353
Published: 2023-03-11
Description: A vulnerability, which was classified as problematic, was found in SourceCodester Design and Implementation of Covid-19 Directory on Vaccination System 1.0. Affected is an unknown function of the file verification.php. The manipulation of the argument txtvaccinationID leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222852.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/covid-19-vaccination%20vlun%20pdf/covid-19-vaccination%20xss(1).pdf; https://vuldb.com/?ctiid.222852; https://vuldb.com/?id.222852
CVE: CVE-2023-1354
Published: 2023-03-11
Description: A vulnerability has been found in SourceCodester Design and Implementation of Covid-19 Directory on Vaccination System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file register.php. The manipulation of the argument txtfullname/txtage/txtaddress/txtphone leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222853 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/covid-19-vaccination%20vlun%20pdf/covid-19-vaccination%20xss(2).pdf; https://vuldb.com/?ctiid.222853; https://vuldb.com/?id.222853
CVE: CVE-2013-10021
Published: 2023-03-11
Description: A vulnerability was found in dd32 Debug Bar Plugin up to 0.8 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function render of the file panels/class-debug-bar-queries.php. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 0.8.1 is able to address this issue. The patch is named 0842af8f8a556bc3e39b9ef758173b0a8a9ccbfc. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-222739.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/dd32/debug-bar/commit/0842af8f8a556bc3e39b9ef758173b0a8a9ccbfc; https://github.com/dd32/debug-bar/releases/tag/0.8.1; https://vuldb.com/?ctiid.222739
CVE: CVE-2023-1355
Published: 2023-03-11
Description: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1402.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/vim/vim/commit/d13dd30240e32071210f55b587182ff48757ea46; https://huntr.dev/bounties/4d0a9615-d438-4f5c-8dd6-aa22f4b716d9; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IE44W6WMMREYCW3GJHPSYP7NK2VT5NY6/
CVE: CVE-2021-46875
Published: 2023-03-12
Description: An issue was discovered in eZ Platform Ibexa Kernel before 1.3.1.1. An XSS attack can occur because JavaScript code can be uploaded in a .html or .js file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/ezsystems/ezpublish-kernel/commit/29fecd2afe86f763510f10c02f14962d028f311b; https://github.com/ezsystems/ezpublish-kernel/security/advisories/GHSA-mrvj-7q4f-5p42; https://github.com/ezsystems/ezpublish-kernel/commit/29fecd2afe86f763510f10c02f14962d028f311b
CVE: CVE-2021-46876
Published: 2023-03-12
Description: An issue was discovered in eZ Publish Ibexa Kernel before 7.5.15.1. The /user/sessions endpoint can be abused to determine account existence.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://github.com/ezsystems/ezpublish-kernel/commit/b496f073c3f03707d3531a6941dc098b84e3cbed; https://github.com/ezsystems/ezpublish-kernel/security/advisories/GHSA-gmrf-99gw-vvwj; https://github.com/ezsystems/ezpublish-kernel/commit/b496f073c3f03707d3531a6941dc098b84e3cbed
CVE: CVE-2022-48365
Published: 2023-03-12
Description: An issue was discovered in eZ Platform Ibexa Kernel before 1.3.26. The Company admin role gives excessive privileges.
CVSS Score: 7.2 (HIGH)
CWE: CWE-269, CWE-269
References: https://developers.ibexa.co/security-advisories/ibexa-sa-2022-009-critical-vulnerabilities-in-graphql-role-assignment-ct-editing-and-drafts-tooltips; https://github.com/ezsystems/ezplatform-kernel/security/advisories/GHSA-8h83-chh2-fchp; https://github.com/ezsystems/ezpublish-kernel/commit/957e67a08af2b3265753f9763943e8225ed779ab
CVE: CVE-2022-48366
Published: 2023-03-12
Description: An issue was discovered in eZ Platform Ibexa Kernel before 1.3.19. It allows determining account existence via a timing attack.
CVSS Score: 3.7 (LOW)
CWE: CWE-362, CWE-362
References: https://developers.ibexa.co/security-advisories/ibexa-sa-2022-006-vulnerabilities-in-page-builder-login-and-commerce; https://github.com/ezsystems/ezplatform-kernel/security/advisories/GHSA-342c-vcff-2ff2; https://github.com/ezsystems/ezpublish-kernel/security/advisories/GHSA-xfqg-p48g-hh94
CVE: CVE-2022-48367
Published: 2023-03-12
Description: An issue was discovered in eZ Publish Ibexa Kernel before 7.5.28. Access control based on object state is mishandled.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862, CWE-862
References: https://developers.ibexa.co/security-advisories/ibexa-sa-2022-004-ineffective-object-state-limitation-and-unauthenticated-fastly-purge; https://github.com/ezsystems/ezpublish-kernel/security/advisories/GHSA-5x4f-7xgq-r42x; https://developers.ibexa.co/security-advisories/ibexa-sa-2022-004-ineffective-object-state-limitation-and-unauthenticated-fastly-purge
CVE: CVE-2023-1357
Published: 2023-03-12
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Simple Bakery Shop Management System 1.0. Affected by this issue is some unknown functionality of the component Admin Login. The manipulation of the argument username/password with the input admin' or 1=1 -- leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222860.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://vuldb.com/?ctiid.222860; https://vuldb.com/?id.222860; https://vuldb.com/?ctiid.222860
CVE: CVE-2023-1358
Published: 2023-03-12
Description: A vulnerability, which was classified as critical, was found in SourceCodester Gadget Works Online Ordering System 1.0. This affects an unknown part of the file /philosophy/admin/login.php of the component POST Parameter Handler. The manipulation of the argument user_email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222861 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/heitaoa999/bug_report/blob/main/vendors/janobe/Gadget%20Works%20Online%20Ordering%20System/SQLi-1.md; https://vuldb.com/?ctiid.222861; https://vuldb.com/?id.222861
CVE: CVE-2023-1359
Published: 2023-03-12
Description: A vulnerability has been found in SourceCodester Gadget Works Online Ordering System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /philosophy/admin/user/controller.php?action=add of the component Add New User. The manipulation of the argument U_NAME leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-222862 is the identifier assigned to this vulnerability.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/heitaoa999/bug_report/blob/main/vendors/janobe/Gadget%20Works%20Online%20Ordering%20System/XSS-1.md; https://vuldb.com/?ctiid.222862; https://vuldb.com/?id.222862
CVE: CVE-2023-1360
Published: 2023-03-12
Description: A vulnerability was found in SourceCodester Employee Payslip Generator with Sending Mail 1.2.0 and classified as critical. This issue affects some unknown processing of the file classes/Users.php?f=save of the component New User Creation. The manipulation of the argument username leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-222863.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://blog.0xgabe.com/?p=90; https://vuldb.com/?ctiid.222863; https://vuldb.com/?id.222863
CVE: CVE-2016-15028
Published: 2023-03-12
Description: A vulnerability was found in ICEPAY REST-API-NET 0.9. It has been declared as problematic. Affected by this vulnerability is the function RestClient of the file Classes/RestClient.cs of the component Checksum Validation. The manipulation leads to improper validation of integrity check value. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 1.0 is able to address this issue. The patch is named 61f6b8758e5c971abff5f901cfa9f231052b775f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-222847.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-354
References: https://github.com/ICEPAY/REST-API-NET/commit/61f6b8758e5c971abff5f901cfa9f231052b775f; https://github.com/ICEPAY/REST-API-NET/releases/tag/1.0; https://vuldb.com/?ctiid.222847
CVE: CVE-2023-28154
Published: 2023-03-13
Description: Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/webpack/webpack/compare/v5.75.0...v5.76.0; https://github.com/webpack/webpack/pull/16500; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AU7BOXTBK3KDYSWH67ASZ22TUIOZ3X5G/
CVE: CVE-2022-2258
Published: 2023-03-13
Description: In affected versions of Octopus Deploy it is possible for a user to view Tagsets without being explicitly assigned permissions to view these items
CVSS Score: 4.3 (MEDIUM)
References: https://advisories.octopus.com/post/2023/sa2023-03/; https://advisories.octopus.com/post/2023/sa2023-03/
CVE: CVE-2022-2259
Published: 2023-03-13
Description: In affected versions of Octopus Deploy it is possible for a user to view Workerpools without being explicitly assigned permissions to view these items
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://advisories.octopus.com/post/2023/sa2023-04/; https://advisories.octopus.com/post/2023/sa2023-04/
CVE: CVE-2023-1361
Published: 2023-03-13
Description: SQL Injection in GitHub repository unilogies/bumsys prior to v2.0.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/unilogies/bumsys/commit/6a328eb5bf9dbb44329a3df82e95683b77c4730d; https://huntr.dev/bounties/1b1dbc5a-df16-421f-9a0d-de83e43146c4; https://github.com/unilogies/bumsys/commit/6a328eb5bf9dbb44329a3df82e95683b77c4730d
CVE: CVE-2023-1362
Published: 2023-03-13
Description: Improper Restriction of Rendered UI Layers or Frames in GitHub repository unilogies/bumsys prior to v2.0.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1021
References: https://github.com/unilogies/bumsys/commit/8c5b27d54707f9805b27ef26ad741f2801e30e1f; https://huntr.dev/bounties/e5959166-c8ef-4ada-9bb1-0ff5a9693bac; https://github.com/unilogies/bumsys/commit/8c5b27d54707f9805b27ef26ad741f2801e30e1f
CVE: CVE-2023-1363
Published: 2023-03-13
Description: A vulnerability, which was classified as problematic, was found in SourceCodester Computer Parts Sales and Inventory System 1.0. Affected is an unknown function of the component Add User Account. The manipulation of the argument username leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-222870 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/Songs-YZS/CveList/blob/main/Computer-Parts-Sales-and-Inventory-System-has-Cross-Site-Scriptin-vulnerability.pdf; https://vuldb.com/?ctiid.222870; https://vuldb.com/?id.222870
CVE: CVE-2023-1364
Published: 2023-03-13
Description: A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file category.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-222871.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Online%20Pizza%20Ordering%20System/Online%20Pizza%20Ordering%20System%20sql%20vlun(1).pdf; https://vuldb.com/?ctiid.222871; https://vuldb.com/?id.222871
CVE: CVE-2023-1365
Published: 2023-03-13
Description: A vulnerability was found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/ajax.php. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222872.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Online%20Pizza%20Ordering%20System/Online%20Pizza%20Ordering%20System%20sql%20vlun(3).pdf; https://vuldb.com/?ctiid.222872; https://vuldb.com/?id.222872
CVE: CVE-2023-0888
Published: 2023-03-13
Description: An improper neutralization of directives in dynamically evaluated code vulnerability in the WiFi Battery embedded web server in versions L90/U70 and L92/U92 can be used to gain administrative access to the WiFi communication module. An authenticated user, having access to both the medical device WiFi network (such as a biomedical engineering staff member) and the specific B.Braun Battery Pack SP with WiFi web server credentials, could get administrative (root) access on the infusion pump communication module. This could be used as a vector to start further attacks


CVSS Score: 4.9 (MEDIUM)
CWE: CWE-95, CWE-94
References: https://www.bbraun.com/productsecurity; https://www.bbraunusa.com/productsecurity; https://www.bbraun.com/productsecurity
CVE: CVE-2023-1366
Published: 2023-03-13
Description: A vulnerability was found in SourceCodester Yoga Class Registration System 1.0. It has been classified as critical. This affects the function query of the file admin/categories/manage_category.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222873 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://blog.csdn.net/Dwayne_Wade/article/details/129493110; https://vuldb.com/?ctiid.222873; https://vuldb.com/?id.222873
CVE: CVE-2023-1367
Published: 2023-03-13
Description: Code Injection in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
CVSS Score: 3.8 (LOW)
CWE: CWE-94, CWE-94
References: https://github.com/alextselegidis/easyappointments/commit/453c6e[PII_REDACTED]0c91bef450db643a0f263e4; https://huntr.dev/bounties/16bc74e2-1825-451f-bff7-bfdc1ea75cc2; https://github.com/alextselegidis/easyappointments/commit/453c6e[PII_REDACTED]0c91bef450db643a0f263e4
CVE: CVE-2023-1368
Published: 2023-03-13
Description: A vulnerability was found in XHCMS 1.0. It has been declared as critical. This vulnerability affects unknown code of the file login.php of the component POST Parameter Handler. The manipulation of the argument user leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-222874 is the identifier assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/wswokao/wswoako.github.io/blob/main/README.md; https://vuldb.com/?ctiid.222874; https://vuldb.com/?id.222874