deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-49491
Published: 2025-07-01
Description: Improper Resource Shutdown or Release vulnerability in ASR Falcon_Linux、Kestrel、Lapwing_Linux on Linux (traffic_stat modules) allows Resource Leak Exposure. This vulnerability is associated with program files traffic_stat/traffic_service/traffic_service.C.

This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-404
References: https://www.asrmicro.com/en/goods/psirt?cid=40
CVE: CVE-2025-49492
Published: 2025-07-01
Description: Out-of-bounds write in ASR180x  in lte-telephony, May cause a buffer underrun.  This vulnerability is associated with program files apps/atcmd_server/src/dev_api.C.

This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536.
CVSS Score: 7.4 (HIGH)
CWE: CWE-787
References: https://www.asrmicro.com/en/goods/psirt?cid=40
CVE: CVE-2025-6224
Published: 2025-07-01
Description: Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the network in plaintext, an attacker listening on that network could sniff the certificate and trivially extract the private key from it.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-312
References: https://github.com/juju/utils/security/advisories/GHSA-h34r-jxqm-qgpr
CVE: CVE-2025-49480
Published: 2025-07-01
Description: Out-of-bounds access in ASR180x 、ASR190x  in lte-telephony,  This vulnerability is associated with program files apps/lzma/src/LzmaEnc.c.

This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536.
CVSS Score: 7.4 (HIGH)
CWE: CWE-125
References: https://www.asrmicro.com/en/goods/psirt?cid=40
CVE: CVE-2025-49481
Published: 2025-07-01
Description: Improper Resource Shutdown or Release vulnerability in ASR180x 、ASR190x in router modules allows Resource Leak Exposure. This vulnerability is associated with program files router/phonebook/pbwork-queue.C.

This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-404
References: https://www.asrmicro.com/en/goods/psirt?cid=40
CVE: CVE-2025-49482
Published: 2025-07-01
Description: Improper Resource Shutdown or Release vulnerability in ASR180x 、ASR190x in tr069 modules allows Resource Leak Exposure. 
This vulnerability is associated with program files tr069/tr098.c.
This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-404
References: https://www.asrmicro.com/en/goods/psirt?cid=40
CVE: CVE-2025-49483
Published: 2025-07-01
Description: Improper Resource Shutdown or Release vulnerability in ASR180x 、ASR190x in tr069 modules  allows Resource Leak Exposure. This vulnerability is associated with program files tr069/tr069_uci.c.

This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-404
References: https://www.asrmicro.com/en/goods/psirt?cid=40
CVE: CVE-2025-5314
Published: 2025-07-01
Description: The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the ‘pdf-source’ parameter in all versions up to, and including, 2.3.65 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/3d-flipbook-dflip-lite/trunk/assets/js/dflip.js#L8861; https://plugins.trac.wordpress.org/browser/3d-flipbook-dflip-lite/trunk/assets/js/dflip.min.js; https://plugins.trac.wordpress.org/browser/3d-flipbook-dflip-lite/trunk/assets/js/libs/pdf.min.js
CVE: CVE-2025-6951
Published: 2025-07-01
Description: A vulnerability classified as problematic was found in SAFECAM X300 up to 20250611. This vulnerability affects unknown code of the component FTP Service. The manipulation leads to use of default credentials. Access to the local network is required for this attack to succeed. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1392
References: https://github.com/geo-chen/SAFECAM; https://vuldb.com/?ctiid.314488; https://vuldb.com/?id.314488
CVE: CVE-2025-6952
Published: 2025-07-01
Description: A vulnerability, which was classified as problematic, has been found in Open5GS up to 2.7.5. This issue affects the function amf_state_operational of the file src/amf/amf-sm.c of the component AMF Service. The manipulation leads to reachable assertion. It is possible to launch the attack on the local host. The identifier of the patch is 53e9e059ed96b940f7ddcd9a2b68cb512524d5db. It is recommended to apply a patch to fix this issue.
CVSS Score: 3.3 (LOW)
CWE: CWE-617
References: https://github.com/open5gs/open5gs/commit/53e9e059ed96b940f7ddcd9a2b68cb512524d5db; https://github.com/open5gs/open5gs/issues/3938; https://github.com/open5gs/open5gs/issues/3938#issuecomment[PII_REDACTED]
CVE: CVE-2025-36582
Published: 2025-07-01
Description: Dell NetWorker, versions 19.12.0.1 and prior, contains a Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-757
References: https://www.dell.com/support/kbdoc/en-us/000338757/dsa-2025-268-security-update-for-dell-networker-selection-of-less-secure-algorithm-during-negotiation-vulnerability
CVE: CVE-2025-37097
Published: 2025-07-01
Description: A vulnerability in HPE Insight Remote Support (IRS) prior to v7.15.0.646 may allow an unauthenticated denial of service
CVSS Score: 7.5 (HIGH)
CWE: CWE-749
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04878en_us&docLocale=en_US; https://www.tenable.com/security/research/tra-2025-15
CVE: CVE-2025-45872
Published: 2025-07-01
Description: zrlog v3.1.5 was discovered to contain a Server-Side Request Forgery (SSRF) via the downloadUrl parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://github.com/dengxmenglihua/cve/blob/main/ZrLog%20Blog%20System%20SSRF%20%2B%20File%20Overwrite%20Leading%20to%20RCE%20Vulnerability.md; https://github.com/dengxmenglihua/cve/blob/main/ZrLog%20Blog%20System%20SSRF%20%2B%20File%20Overwrite%20Leading%20to%20RCE%20Vulnerability.md
CVE: CVE-2025-49029
Published: 2025-07-01
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in bitto.kazi Custom Login And Signup Widget custom-login-and-signup-widget allows Code Injection.This issue affects Custom Login And Signup Widget: from n/a through <= 1.0.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-94
References: https://patchstack.com/database/Wordpress/Plugin/custom-login-and-signup-widget/vulnerability/wordpress-custom-login-and-signup-widget-plugin-1-0-arbitrary-code-execution-vulnerability?_s_id=cve
CVE: CVE-2025-6920
Published: 2025-07-01
Description: A flaw was found in the authentication enforcement mechanism of a model inference API in ai-inference-server. All /v1/* endpoints are expected to enforce API key validation. However, the POST /invocations endpoint failed to do so, resulting in an authentication bypass. This vulnerability allows unauthorized users to access the same inference features available on protected endpoints, potentially exposing sensitive functionality or allowing unintended access to backend resources.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: https://access.redhat.com/security/cve/CVE-2025-6920; https://bugzilla.redhat.com/show_bug.cgi?id=2375522
CVE: CVE-2025-6953
Published: 2025-07-01
Description: A vulnerability, which was classified as critical, was found in TOTOLINK A3002RU 3.0.0-B20[PII_REDACTED]. Affected is an unknown function of the file /boafrm/formParentControl of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/d2pq/cve/blob/main/616/26.md; https://github.com/d2pq/cve/blob/main/616/26.md#poc; https://vuldb.com/?ctiid.314490
CVE: CVE-2025-6954
Published: 2025-07-01
Description: A vulnerability has been found in Campcodes Employee Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /applyleave.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/ez-lbz/poc/issues/32; https://vuldb.com/?ctiid.314491; https://vuldb.com/?id.314491
CVE: CVE-2025-6955
Published: 2025-07-01
Description: A vulnerability was found in Campcodes Employee Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /process/aprocess.php. The manipulation of the argument mailuid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/ez-lbz/poc/issues/33; https://vuldb.com/?ctiid.314492; https://vuldb.com/?id.314492
CVE: CVE-2025-6956
Published: 2025-07-01
Description: A vulnerability was found in Campcodes Employee Management System 1.0. It has been classified as critical. This affects an unknown part of the file /changepassemp.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/ez-lbz/poc/issues/34; https://vuldb.com/?ctiid.314493; https://vuldb.com/?id.314493
CVE: CVE-2025-34050
Published: 2025-07-01
Description: A cross-site request forgery (CSRF) vulnerability exists in the web interface of AVTECH IP camera, DVR, and NVR devices. An attacker can craft malicious requests that, when executed in the context of an authenticated user’s browser session, allow unauthorized changes to the device configuration without user interaction.
CWE: CWE-352
References: https://avtech.com/; https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns; https://web.archive.org/web/[PII_REDACTED]1749/https://github.com/ebux/AVTECH
CVE: CVE-2025-34051
Published: 2025-07-01
Description: A server-side request forgery vulnerability exists in multiple firmware versions of AVTECH DVR devices that exposes the /cgi-bin/nobody/Search.cgi?action=cgi_query endpoint without authentication. An attacker can manipulate the ip, port, and queryb64str parameters to make arbitrary HTTP requests from the DVR to internal or external systems, potentially exposing sensitive data or interacting with internal services.
CWE: CWE-200, CWE-918
References: https://avtech.com/; https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns; https://web.archive.org/web/[PII_REDACTED]1749/https://github.com/ebux/AVTECH
CVE: CVE-2025-34052
Published: 2025-07-01
Description: Rejected reason: An unauthenticated endpoint that exposes firmware version, MAC address, and supported codecs is not indicative of a security boundary being crossed, as this metadata is not inherently sensitive and commonly used for legitimate fingerprinting and discovery.
CVE: CVE-2025-34053
Published: 2025-07-01
Description: An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr() function is used to identify ".cab" requests, allowing any URL containing ".cab" to bypass authentication and access protected endpoints.
CWE: CWE-290
References: https://avtech.com/; https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns; https://web.archive.org/web/[PII_REDACTED]1749/https://github.com/ebux/AVTECH
CVE: CVE-2025-34054
Published: 2025-07-01
Description: An unauthenticated command injection vulnerability exists in AVTECH DVR devices via Search.cgi?action=cgi_query. The use of wget without input sanitization allows attackers to inject shell commands through the username or queryb64str parameters, executing commands as root. Exploitation evidence was observed by the Shadowserver Foundation on 2025-01-04 UTC.
CWE: CWE-78
References: https://avtech.com/; https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns; https://web.archive.org/web/[PII_REDACTED]1749/https://github.com/ebux/AVTECH
CVE: CVE-2025-34055
Published: 2025-07-01
Description: An OS command injection vulnerability exists in AVTECH DVR, NVR, and IP camera devices within the adcommand.cgi endpoint, which interfaces with the ActionD daemon. Authenticated users can invoke the DoShellCmd operation, passing arbitrary input via the strCmd parameter. This input is executed directly by the system shell without sanitation allowing attackers to execute commands as the root user.
CWE: CWE-20, CWE-78
References: https://avtech.com/; https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns; https://web.archive.org/web/[PII_REDACTED]1749/https://github.com/ebux/AVTECH
CVE: CVE-2025-34056
Published: 2025-07-01
Description: An OS command injection vulnerability exists in AVTECH IP camera, DVR, and NVR devices via the PwdGrp.cgi endpoint, which handles user and group management operations. Authenticated users can supply input through the pwd or grp parameters, which are directly embedded into system commands without proper sanitation. This allows for the execution of arbitrary shell commands with root privileges.
CWE: CWE-20, CWE-78
References: https://avtech.com/; https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns; https://web.archive.org/web/[PII_REDACTED]1749/https://github.com/ebux/AVTECH
CVE: CVE-2025-34058
Published: 2025-07-01
Description: Hikvision Streaming Media Management Server v2.3.5 uses default credentials that allow remote attackers to authenticate and access restricted functionality. After authenticating with these credentials, an attacker can exploit an arbitrary file read vulnerability in the /systemLog/downFile.php endpoint via directory traversal in the fileName parameter. This exploit chain can enable unauthorized access to sensitive system files.
CWE: CWE-22, CWE-521
References: https://blog.csdn.net/qq_40684306/article/details/115278837; https://vulncheck.com/advisories/hikvision-streaming-server-default-creds-file-read; https://www.cnvd.org.cn/flaw/show/CNVD-2021-14544
CVE: CVE-2025-34059
Published: 2025-07-01
Description: An SQL injection vulnerability exists in the Dahua Smart Cloud Gateway Registration Management Platform via the username parameter in the /index.php/User/doLogin endpoint. The application fails to properly sanitize user input, allowing unauthenticated attackers to inject arbitrary SQL statements and potentially disclose sensitive information. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.
CWE: CWE-89, CWE-200
References: https://pentest-tools.com/vulnerabilities-exploits/zhejiang-dahua-smart-cloud-gateway-registration-platform-sql-injection-cnvd-2024-38747_23762; https://vulncheck.com/advisories/dahua-smart-cloud-gateway-sql-injection; https://www.cnblogs.com/LeouMaster/p/18509644
CVE: CVE-2025-34060
Published: 2025-07-01
Description: A PHP objection injection vulnerability exists in the Monero Project’s Laravel-based forum software due to unsafe handling of untrusted input in the /get/image/ endpoint. The application passes a user-supplied link parameter directly to file_get_contents() without validation. MIME type checks using PHP’s finfo can be bypassed via crafted stream filter chains that prepend spoofed headers, allowing access to internal Laravel configuration files. An attacker can extract the APP_KEY from config/app.php, forge encrypted cookies, and trigger unsafe unserialize() calls, leading to reliable remote code execution.
CWE: CWE-20, CWE-502, CWE-829
References: https://swap.gs/posts/monero-forums/; https://vulncheck.com/advisories/monero-forum-rce
CVE: CVE-2025-34062
Published: 2025-07-01
Description: An information disclosure vulnerability exists in OneLogin AD Connector versions prior to 6.1.5 via the /api/adc/v4/configuration endpoint. An attacker with access to a valid directory_token—which may be retrievable from host registry keys or improperly secured logs—can retrieve a plaintext response disclosing sensitive credentials. These may include an API key, AWS IAM access and secret keys, and a base64-encoded JWT signing key used in the tenant’s SSO IdP configuration.
CWE: CWE-200, CWE-522
References: https://specterops.io/blog/2025/06/10/onelogin-many-issues-how-i-pivoted-from-a-trial-tenant-to-compromising-customer-signing-keys/; https://support.onelogin.com/product-notification/noti-00001768; https://vulncheck.com/advisories/onelogin-ad-connector-account-compromise
CVE: CVE-2025-34063
Published: 2025-07-01
Description: A cryptographic authentication bypass vulnerability exists in OneLogin AD Connector prior to 6.1.5 due to the exposure of a tenant’s SSO JWT signing key via the /api/adc/v4/configuration endpoint. An attacker in possession of the signing key can craft valid JWT tokens impersonating arbitrary users within a OneLogin tenant. The tokens allow authentication to the OneLogin SSO portal and all downstream applications federated via SAML or OIDC. This allows full unauthorized access across the victim’s SaaS environment.
CWE: CWE-290
References: https://specterops.io/blog/2025/06/10/onelogin-many-issues-how-i-pivoted-from-a-trial-tenant-to-compromising-customer-signing-keys/; https://support.onelogin.com/product-notification/noti-00001768; https://vulncheck.com/advisories/onelogin-ad-connector-account-compromise
CVE: CVE-2025-34064
Published: 2025-07-01
Description: A cloud infrastructure misconfiguration in OneLogin AD Connector results in log data being sent to a hardcoded S3 bucket (onelogin-adc-logs-production) without validating bucket ownership. An attacker who registers this unclaimed bucket can begin receiving log files from other OneLogin tenants. These logs may contain sensitive data such as directory tokens, user metadata, and environment configuration. This enables cross-tenant leakage of secrets, potentially allowing JWT signing key recovery and user impersonation.
CWE: CWE-200, CWE-668
References: https://specterops.io/blog/2025/06/10/onelogin-many-issues-how-i-pivoted-from-a-trial-tenant-to-compromising-customer-signing-keys/; https://support.onelogin.com/product-notification/noti-00001768; https://vulncheck.com/advisories/onelogin-ad-connector-account-compromise
CVE: CVE-2025-34065
Published: 2025-07-01
Description: An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr() function allows unauthenticated access to any request containing "/nobody" in the URL, bypassing login controls.
CWE: CWE-290
References: https://avtech.com/; https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns; https://web.archive.org/web/[PII_REDACTED]1749/https://github.com/ebux/AVTECH
CVE: CVE-2025-34066
Published: 2025-07-01
Description: An improper certificate validation vulnerability exists in AVTECH IP cameras, DVRs, and NVRs due to the use of wget with --no-check-certificate in scripts like SyncCloudAccount.sh and SyncPermit.sh. This exposes HTTPS communications to man-in-the-middle (MITM) attacks.
CWE: CWE-295
References: https://avtech.com/; https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns; https://web.archive.org/web/[PII_REDACTED]1749/https://github.com/ebux/AVTECH
CVE: CVE-2025-37098
Published: 2025-07-01
Description: A path traversal vulnerability exists in HPE Insight Remote Support (IRS) prior to v7.15.0.646.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04878en_us&docLocale=en_US
CVE: CVE-2025-50404
Published: 2025-07-01
Description: Intelbras RX1500 Router v2.2.17 and before is vulnerable to Integer Overflow. The websReadEvent function incorrectly uses the int type when processing the "command" field of the http header, causing the array to cross the boundary and overwrite other fields in the array.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-190
References: https://github.com/feiwuxingxie/cve/blob/main/Intelbras/vul01/01.md; https://www.intelbras.com/en
CVE: CVE-2025-50405
Published: 2025-07-01
Description: Intelbras RX1500 Router v2.2.17 and before is vulnerable to Incorrect Access Control in the FirmwareUpload function and GetFirmwareValidation function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://github.com/feiwuxingxie/cve/blob/main/Intelbras/vul02/02.md; https://www.intelbras.com/en
CVE: CVE-2025-53099
Published: 2025-07-01
Description: Sentry is a developer-first error tracking and performance monitoring tool. Prior to version 25.5.0, an attacker with a malicious OAuth application registered with Sentry can take advantage of a race condition and improper handling of authorization code within Sentry to maintain persistence to a user's account. With a specially timed requests and redirect flows, an attacker could generate multiple authorization codes that could be used to exchange for access and refresh tokens. This was possible even after de-authorizing the particular application. This issue has been patched in version 25.5.0. Self-hosted Sentry users should upgrade to version 25.5.0 or higher. Sentry SaaS users do not need to take any action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-288
References: https://github.com/getsentry/sentry/commit/57f0129e1e977b76fe8d16667a586578791a3dcd; https://github.com/getsentry/sentry/commit/ab5fd932ca6bd46529ba3308b4669e3cee719b8f; https://github.com/getsentry/sentry/commit/e6241254aead969e6c8490a81cde9a01335df19d
CVE: CVE-2025-6957
Published: 2025-07-01
Description: A vulnerability was found in Campcodes Employee Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /process/eprocess.php. The manipulation of the argument mailuid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/ez-lbz/poc/issues/35; https://vuldb.com/?ctiid.314494; https://vuldb.com/?id.314494
CVE: CVE-2025-6958
Published: 2025-07-01
Description: A vulnerability was found in Campcodes Employee Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /edit.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/ez-lbz/poc/issues/36; https://vuldb.com/?ctiid.314495; https://vuldb.com/?id.314495
CVE: CVE-2025-6959
Published: 2025-07-01
Description: A vulnerability classified as critical has been found in Campcodes Employee Management System 1.0. Affected is an unknown function of the file /eloginwel.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/ez-lbz/poc/issues/37; https://vuldb.com/?ctiid.314496; https://vuldb.com/?id.314496
CVE: CVE-2025-6960
Published: 2025-07-01
Description: A vulnerability classified as critical was found in Campcodes Employee Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /empproject.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/ez-lbz/poc/issues/38; https://vuldb.com/?ctiid.314497; https://vuldb.com/?id.314497