deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-7496
Published: 2024-08-06
Description: A vulnerability has been found in itsourcecode Airline Reservation System 1.0 and classified as critical. This vulnerability affects unknown code of the file /index.php. The manipulation of the argument page leads to file inclusion. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-273622 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-73
References: https://github.com/DeepMountains/zzz/blob/main/CVE1-1.md; https://vuldb.com/?ctiid.273622; https://vuldb.com/?id.273622
CVE: CVE-2024-7497
Published: 2024-08-06
Description: A vulnerability was found in itsourcecode Airline Reservation System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/index.php. The manipulation of the argument page leads to file inclusion. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273623.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-73
References: https://github.com/DeepMountains/zzz/blob/main/CVE1-2.md; https://vuldb.com/?ctiid.273623; https://vuldb.com/?id.273623
CVE: CVE-2024-5828
Published: 2024-08-06
Description: Expression Language Injection vulnerability in Hitachi Tuning Manager on Windows, Linux, Solaris allows Code Injection.This issue affects Hitachi Tuning Manager: before 8.8.7-00.
CVSS Score: 8.6 (HIGH)
CWE: CWE-917, CWE-917
References: https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-140/index.html
CVE: CVE-2024-5963
Published: 2024-08-06
Description: Unquoted Executable Path vulnerability in Hitachi Device Manager on Windows (Device Manager Server component).This issue affects Hitachi Device Manager: before 8.8.7-00.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-428
References: https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-135/index.html
CVE: CVE-2024-7498
Published: 2024-08-06
Description: A vulnerability was found in itsourcecode Airline Reservation System 1.0. It has been classified as critical. Affected is the function login/login2 of the file /admin/login.php of the component Admin Login Page. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273624.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/DeepMountains/zzz/blob/main/CVE1-3.md; https://vuldb.com/?ctiid.273624; https://vuldb.com/?id.273624
CVE: CVE-2024-7499
Published: 2024-08-06
Description: A vulnerability was found in itsourcecode Airline Reservation System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file flights.php. The manipulation of the argument departure_airport_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273625 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/DeepMountains/zzz/blob/main/CVE1-4.md; https://vuldb.com/?ctiid.273625; https://vuldb.com/?id.273625
CVE: CVE-2024-28962
Published: 2024-08-06
Description: Dell Command | Update, Dell Update, and Alienware Update UWP, versions prior to 5.4, contain an Exposed Dangerous Method or Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-610
References: https://www.dell.com/support/kbdoc/en-us/000227236/dsa-2024-169
CVE: CVE-2024-6781
Published: 2024-08-06
Description: Path traversal in Calibre <= 7.14.0 allow unauthenticated attackers to achieve arbitrary file read.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/kovidgoyal/calibre/commit/bcd0ab12c41a887f8290a9b56e46c3a29038d9c4; https://starlabs.sg/advisories/24/24-6781/
CVE: CVE-2024-6782
Published: 2024-08-06
Description: Improper access control in Calibre 6.9.0 ~ 7.14.0 allow unauthenticated attackers to achieve remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: https://github.com/kovidgoyal/calibre/commit/38a1bf50d8cd22052ae59c513816706c6445d5e9; https://starlabs.sg/advisories/24/24-6782/
CVE: CVE-2024-6886
Published: 2024-08-06
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea Open Source Git Server allows Stored XSS.This issue affects Gitea Open Source Git Server: 1.22.0.
CWE: CWE-79
References: https://blog.gitea.com/release-of-1.22.1/; https://github.com/go-gitea/gitea/pull/31200
CVE: CVE-2024-7008
Published: 2024-08-06
Description: Unsanitized user-input in Calibre <= 7.15.0 allow attackers to perform reflected cross-site scripting.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/kovidgoyal/calibre/commit/863abac24e7bc3e5ca0b3307362ff1953ba53fe0; https://starlabs.sg/advisories/24/24-7008/
CVE: CVE-2024-7009
Published: 2024-08-06
Description: Unsanitized user-input in Calibre <= 7.15.0 allow users with permissions to perform full-text searches to achieve SQL injection on the SQLite database.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/kovidgoyal/calibre/commit/d56574285e8859d3d715eb7829784ee74337b7d7; https://starlabs.sg/advisories/24/24-7009/
CVE: CVE-2024-7500
Published: 2024-08-06
Description: A vulnerability was found in itsourcecode Airline Reservation System 1.0. It has been rated as critical. Affected by this issue is the function save_settings of the file admin/admin_class.php. The manipulation of the argument img leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-273626 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/DeepMountains/zzz/blob/main/CVE1-5.md; https://vuldb.com/?ctiid.273626; https://vuldb.com/?id.273626
CVE: CVE-2024-7505
Published: 2024-08-06
Description: A vulnerability, which was classified as critical, was found in itsourcecode Bike Delivery System 1.0. Affected is an unknown function of the file contact_us_action.php. The manipulation of the argument name leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273648.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/CveSecLook/cve/issues/56; https://vuldb.com/?ctiid.273648; https://vuldb.com/?id.273648
CVE: CVE-2024-39817
Published: 2024-08-06
Description: Insertion of sensitive information into sent data issue exists in Cybozu Office 10.0.0 to 10.8.6, which may allow a user who can login to the product to view data that the user does not have access by conducting 'search' under certain conditions in Custom App.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://jvn.jp/en/jp/JVN29845579/; https://kb.cybozu.support/?product=office&v=&fv=10.8.7&t=%E8%84%86%E5%BC%B1%E6%80%A7&s=
CVE: CVE-2024-7506
Published: 2024-08-06
Description: A vulnerability has been found in itsourcecode Tailoring Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /setlogo.php. The manipulation of the argument bgimg leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273649 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/CveSecLook/cve/issues/57; https://vuldb.com/?ctiid.273649; https://vuldb.com/?id.273649
CVE: CVE-2024-5708
Published: 2024-08-06
Description: The WPBakery Visual Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter in all versions up to, and including, 7.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, and with post permissions granted by an Administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpbakery.com/; https://www.wordfence.com/threat-intel/vulnerabilities/id/23ff12f0-eb9d-4bb3-8db0-0e794c0f0594?source=cve
CVE: CVE-2024-5709
Published: 2024-08-06
Description: The WPBakery Visual Composer plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.7 via the 'layout_name' parameter. This makes it possible for authenticated attackers, with Author-level access and above, and with post permissions granted by an Administrator, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://wpbakery.com/; https://www.wordfence.com/threat-intel/vulnerabilities/id/7fad30c8-fd8a-4cf2-a3aa-16a374231b87?source=cve
CVE: CVE-2024-6200
Published: 2024-08-06
Description: HaloITSM versions up to 2.146.1 are affected by a Stored Cross-Site Scripting (XSS) vulnerability. The injected JavaScript code can execute arbitrary action on behalf of the user accessing a ticket. HaloITSM versions past 2.146.1 (and patches starting from 2.143.61 ) fix the mentioned vulnerability.
CVSS Score: 8.0 (HIGH)
CWE: CWE-79, CWE-79
References: https://haloitsm.com/guides/article/?kbid=2152
CVE: CVE-2024-6201
Published: 2024-08-06
Description: HaloITSM versions up to 2.146.1 are affected by a Template Injection vulnerability within the engine used to generate emails. This can lead to the leakage of potentially sensitive information. HaloITSM versions past 2.146.1 (and patches starting from 2.143.61 ) fix the mentioned vulnerability.
CVSS Score: 5.3 (MEDIUM)
References: https://haloitsm.com/guides/article/?kbid=2153
CVE: CVE-2024-6202
Published: 2024-08-06
Description: HaloITSM versions up to 2.146.1 are affected by a SAML XML Signature Wrapping (XSW) vulnerability. When having a SAML integration configured, anonymous actors could impersonate arbitrary HaloITSM users by just knowing their email address. HaloITSM versions past 2.146.1 (and patches starting from 2.143.61 ) fix the mentioned vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863, CWE-863
References: https://haloitsm.com/guides/article/?kbid=2154
CVE: CVE-2024-6203
Published: 2024-08-06
Description: HaloITSM versions up to 2.146.1 are affected by a Password Reset Poisoning vulnerability. Poisoned password reset links can be sent to existing HaloITSM users (given their email address is known). When these poisoned links get accessed (e.g. manually by the victim or automatically by an email client software), the password reset token is leaked to the malicious actor, allowing them to set a new password for the victim's account.This potentially leads to account takeover attacks.HaloITSM versions past 2.146.1 (and patches starting from 2.143.61 ) fix the mentioned vulnerability.
CVSS Score: 8.3 (HIGH)
CWE: CWE-640, CWE-640
References: https://haloitsm.com/guides/article/?kbid=2155
CVE: CVE-2024-6651
Published: 2024-08-06
Description: The WordPress File Upload WordPress plugin before 4.24.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/65e2c77d-09bd-4a44-81d9-d7a5db0e0f84/
CVE: CVE-2024-6766
Published: 2024-08-06
Description: The shortcodes-ultimate-pro WordPress plugin before 7.2.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/77bb1dcf-4e84-497a-955e-f3c0b649ad1c/
CVE: CVE-2024-7055
Published: 2024-08-06
Description: A vulnerability was found in FFmpeg up to 7.0.1. It has been classified as critical. This affects the function pnm_decode_frame in the library /libavcodec/pnmdec.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0.2 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-273651.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-122, CWE-787
References: https://ffmpeg.org/; https://ffmpeg.org/download.html; https://github.com/CookedMelon/ReportCVE/tree/main/FFmpeg/poc3
CVE: CVE-2024-7082
Published: 2024-08-06
Description: The Easy Table of Contents WordPress plugin before 2.0.68 does not sanitise and escape some parameters, which could allow users with a role as low as Editor to perform Cross-Site Scripting attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/8f30e685-00fa-4dbb-b516-2d14e4b13697/
CVE: CVE-2024-7084
Published: 2024-08-06
Description: The Ajax Search Lite WordPress plugin before 4.12.1 does not sanitise and escape some parameters, which could allow users with a role as low as Admin+ to perform Cross-Site Scripting attacks.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/0d38bf4d-de6a-49f8-be69-fa483fa61bb7/
CVE: CVE-2024-41995
Published: 2024-08-06
Description: Initialization of a resource with an insecure default vulnerability exists in JavaTM Platform Ver.12.89 and earlier. If this vulnerability is exploited, the product may be affected by some known TLS1.0 and TLS1.1 vulnerabilities. As for the specific products/models/versions of MFPs and printers that contain JavaTM Platform, see the information provided by the vendor.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1188
References: https://jp.ricoh.com/security/products/vulnerabilities/vul?id=ricoh-2024-000010; https://jvn.jp/en/jp/JVN78728294/; https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2024-000010
CVE: CVE-2024-33957
Published: 2024-08-06
Description: SQL injection vulnerability in E-Negosyo System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in 'id' in '/admin/orders/controller.php' parameter
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products
CVE: CVE-2024-33958
Published: 2024-08-06
Description: SQL injection vulnerability in E-Negosyo System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in 'phonenumber' in '/passwordrecover.php' parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products
CVE: CVE-2024-33959
Published: 2024-08-06
Description: SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following 'categ' in '/admin/mod_reports/printreport.php' parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products
CVE: CVE-2024-33975
Published: 2024-08-06
Description: Cross-Site Scripting (XSS) vulnerability in E-Negosyo System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted JavaScript payload to an authenticated user and partially take over their browser session via 'view' parameter in '/admin/products/index.php'.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products
CVE: CVE-2024-33976
Published: 2024-08-06
Description: Cross-Site Scripting (XSS) vulnerability in E-Negosyo System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted JavaScript payload to an authenticated user and partially take over their browser session via 'id' parameter in '/admin/user/index.php'.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products
CVE: CVE-2024-33977
Published: 2024-08-06
Description: Cross-Site Scripting (XSS) vulnerability in E-Negosyo System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain their session cookie details via 'view' parameter in /admin/orders/index.php'.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products
CVE: CVE-2024-33978
Published: 2024-08-06
Description: Cross-Site Scripting (XSS) vulnerability in E-Negosyo System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain their session cookie details via 'category' parameter in '/index.php'.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products
CVE: CVE-2024-33979
Published: 2024-08-06
Description: Cross-Site Scripting (XSS) vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'q', 'arrival', 'departure' and 'accomodation' parameters in '/index.php'.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products
CVE: CVE-2024-33980
Published: 2024-08-06
Description: Cross-Site Scripting (XSS) vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'start' parameter in '/admin/mod_reports/printreport.php'.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products
CVE: CVE-2024-33981
Published: 2024-08-06
Description: Cross-Site Scripting (XSS) vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'start' parameter in '/admin/mod_reports/index.php'.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products
CVE: CVE-2024-7246
Published: 2024-08-06
Description: It's possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy and the backend such that other clients see failed requests. It's also possible to use this vulnerability to leak other clients HTTP header keys, but not values.

This occurs because the error status for a misencoded header is not cleared between header reads, resulting in subsequent (incrementally indexed) added headers in the first request being poisoned until cleared from the HPACK table.

Please update to a fixed version of gRPC as soon as possible. This bug has been fixed in 1.58.3, 1.59.5, 1.60.2, 1.61.3, 1.62.3, 1.63.2, 1.64.3, 1.65.4.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-440
References: https://github.com/grpc/grpc/issues/36245
CVE: CVE-2024-7317
Published: 2024-08-06
Description: The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/folders/tags/3.0.3/includes/media.replace.php#L1296; https://plugins.trac.wordpress.org/changeset/3130880/; https://plugins.trac.wordpress.org/changeset/3130880/#file25
CVE: CVE-2024-33960
Published: 2024-08-06
Description: SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following 'end' in '/admin/mod_reports/printreport.php' parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products
CVE: CVE-2024-33961
Published: 2024-08-06
Description: SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following 'code' in '/admin/mod_reservation/controller.php' parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products
CVE: CVE-2024-33962
Published: 2024-08-06
Description: SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following 'code' in '/admin/mod_reservation/index.php' parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products
CVE: CVE-2024-33963
Published: 2024-08-06
Description: SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following 'id' in '/admin/mod_room/index.php' parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products
CVE: CVE-2024-33964
Published: 2024-08-06
Description: SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following  'id' in '/admin/mod_users/index.php' parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products
CVE: CVE-2024-33965
Published: 2024-08-06
Description: SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following  'view' in '/tubigangarden/admin/mod_accomodation/index.php' parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products