deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-56472
Published: 2025-02-05
Description: IBM Aspera Shares 1.9.0 through 1.10.0 PL6  is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7182490
CVE: CVE-2024-56473
Published: 2025-02-05
Description: IBM Aspera Shares 1.9.0 through 1.10.0 PL6  could allow an attacker to spoof their IP address, which is written to log files, due to improper verification of 'Client-IP' headers.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-117, CWE-116
References: https://www.ibm.com/support/pages/node/7182490
CVE: CVE-2024-49791
Published: 2025-02-06
Description: IBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7182522
CVE: CVE-2024-49792
Published: 2025-02-06
Description: IBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7182522
CVE: CVE-2024-49793
Published: 2025-02-06
Description: IBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7182522
CVE: CVE-2024-49794
Published: 2025-02-06
Description: IBM ApplinX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://www.ibm.com/support/pages/node/7182522
CVE: CVE-2024-49795
Published: 2025-02-06
Description: IBM ApplinX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://www.ibm.com/support/pages/node/7182522
CVE: CVE-2024-49796
Published: 2025-02-06
Description: IBM ApplinX 11.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-1021, CWE-1021
References: https://www.ibm.com/support/pages/node/7182522
CVE: CVE-2024-49797
Published: 2025-02-06
Description: IBM ApplinX 11.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327
References: https://www.ibm.com/support/pages/node/7182522
CVE: CVE-2024-49798
Published: 2025-02-06
Description: IBM ApplinX 11.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://www.ibm.com/support/pages/node/7182522
CVE: CVE-2024-49800
Published: 2025-02-06
Description: IBM ApplinX 11.1 stores sensitive information in cleartext in memory that could be obtained by an authenticated user.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-316, CWE-312
References: https://www.ibm.com/support/pages/node/7182522
CVE: CVE-2025-1066
Published: 2025-02-06
Description: OpenPLC_V3 contains an arbitrary file upload vulnerability, which could be leveraged for malvertising or phishing campaigns.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/thiagoralves/OpenPLC_v3/commit/d1b1a3b7e97f2b3fef0876056cf9d[PII_REDACTED]a; https://medium.com/@alimuhammadsecured/cyberforce-2024-how-i-found-my-first-cve-openplcv3-16c058b114b0
CVE: CVE-2024-49814
Published: 2025-02-06
Description: IBM Security Verify Access Appliance 10.0.0 through 10.0.3 could allow a locally authenticated user to increase their privileges due to execution with unnecessary privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-250
References: https://www.ibm.com/support/pages/node/7182558
CVE: CVE-2024-51450
Published: 2025-02-06
Description: IBM Security Verify Directory 10.0.0 through 10.0.3 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78
References: https://www.ibm.com/support/pages/node/7182558
CVE: CVE-2025-0799
Published: 2025-02-06
Description: IBM App Connect enterprise 12.0.1.0 through 12.0.12.10 and 13.0.1.0 through 13.0.2.1 could allow an authenticated user to write to an arbitrary file on the system during bar configuration deployment due to improper pathname limitations on restricted directories.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.ibm.com/support/pages/node/7182418
CVE: CVE-2024-51547
Published: 2025-02-06
Description: Use of Hard-coded Credentials vulnerability in ABB ASPECT-Enterprise, ABB NEXUS Series, ABB MATRIX Series.This issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108470A6775&LanguageCode=en&DocumentPartId=pdf%20-%20Public%20Advisory&Action=Launch
CVE: CVE-2025-0522
Published: 2025-02-06
Description: The LikeBot  WordPress plugin through 0.85 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/4c2eed5a-f4d8-457d-a403-7eaced36c491/
CVE: CVE-2024-13487
Published: 2025-02-06
Description: The The CURCY – Multi Currency for WooCommerce – The best free currency exchange plugin – Run smoothly on WooCommerce 9.x plugin for WordPress is vulnerable to arbitrary shortcode execution via the get_products_price() function in all versions up to, and including, 2.2.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVSS Score: 7.3 (HIGH)
CWE: CWE-94
References: https://plugins.trac.wordpress.org/browser/woo-multi-currency/trunk/frontend/cache.php#L60; https://plugins.trac.wordpress.org/changeset/3234505/; https://wordpress.org/plugins/woo-multi-currency/#developers
CVE: CVE-2025-22890
Published: 2025-02-06
Description: Execution with unnecessary privileges issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker performs a specific operation, SYSTEM privilege of the Windows system where the product is running may be obtained.
CVSS Score: 8.8 (HIGH)
CWE: CWE-250
References: https://jvn.jp/en/jp/JVN66673020/; https://www.hummingheads.co.jp/dep/storelist/
CVE: CVE-2025-20094
Published: 2025-02-06
Description: Unprotected Windows messaging channel ('Shatter') issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker sends a specially crafted message to the specific process of the Windows system where the product is running, arbitrary code may be executed with SYSTEM privilege.
CVSS Score: 8.8 (HIGH)
CWE: CWE-422
References: https://jvn.jp/en/jp/JVN66673020/; https://www.hummingheads.co.jp/dep/storelist/
CVE: CVE-2025-22894
Published: 2025-02-06
Description: Unprotected Windows messaging channel ('Shatter') issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker sends a specially crafted message to the specific process of the Windows system where the product is running, arbitrary files in the system may be altered. As a result, an arbitrary DLL may be executed with SYSTEM privilege.
CVSS Score: 8.8 (HIGH)
CWE: CWE-422
References: https://jvn.jp/en/jp/JVN66673020/; https://www.hummingheads.co.jp/dep/storelist/
CVE: CVE-2025-23236
Published: 2025-02-06
Description: Buffer overflow vulnerability exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker performs a specific operation, SYSTEM privilege of the Windows system where the product is running may be obtained.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://jvn.jp/en/jp/JVN66673020/; https://www.hummingheads.co.jp/dep/storelist/
CVE: CVE-2025-24483
Published: 2025-02-06
Description: NULL pointer dereference vulnerability exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker provides specially crafted data to the specific process of the Windows system where the product is running, the system may cause a Blue Screen of Death (BSOD), and as a result, cause a denial-of-service (DoS) condition.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://jvn.jp/en/jp/JVN66673020/; https://www.hummingheads.co.jp/dep/storelist/
CVE: CVE-2025-24845
Published: 2025-02-06
Description: Improper neutralization of argument delimiters in a command ('Argument Injection') issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker provides specially crafted data to the specific process of the Windows system where the product is running, the system may cause a Blue Screen of Death (BSOD), and as a result, cause a denial-of-service (DoS) condition.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-88
References: https://jvn.jp/en/jp/JVN66673020/; https://www.hummingheads.co.jp/dep/storelist/
CVE: CVE-2025-0859
Published: 2025-02-06
Description: The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.27.6 via the template_via_url() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/BoldGrid/post-and-page-builder/pull/638/commits/10e4d1d96fd[PII_REDACTED]259d15896fa6dd35471; https://plugins.trac.wordpress.org/browser/post-and-page-builder/trunk/includes/class-boldgrid-editor-preview.php#L178; https://plugins.trac.wordpress.org/changeset?old=3234175&old_path=post-and-page-builder%2Ftags%2F1.27.7%2Fincludes%2Fclass-boldgrid-editor-preview.php&new=3234175&new_path=post-and-page-builder%2Ftags%2F1.27.7%2Fincludes%2Fclass-boldgrid-editor-preview.php
CVE: CVE-2024-37358
Published: 2025-02-06
Description: Similarly to CVE-2024-34055, Apache James is vulnerable to denial of service through the abuse of IMAP literals from both authenticated and unauthenticated users, which could be used to cause unbounded memory allocation and very long computations

Version 3.7.6 and 3.8.2 restrict such illegitimate use of IMAP literals.
CVSS Score: 8.6 (HIGH)
CWE: CWE-770, CWE-770
References: https://lists.apache.org/thread/1pxsh11v5s3fkvhnqvkmlqwt3fgpcrqc
CVE: CVE-2024-45626
Published: 2025-02-06
Description: Apache James server JMAP HTML to text plain implementation in versions below 3.8.2 and 3.7.6 is subject to unbounded memory consumption that can result in a denial of service.

Users are recommended to upgrade to version 3.7.6 and 3.8.2, which fix this issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://lists.apache.org/thread/1fr9hvpsylomwwfr3rv82g84sxszn4kl; http://www.openwall.com/lists/oss-security/2025/02/05/7
CVE: CVE-2025-0982
Published: 2025-02-06
Description: Sandbox escape in the JavaScript Task feature of Google Cloud Application Integration allows an actor to execute arbitrary unsandboxed code via crafted JavaScript code executed by the Rhino engine. Effective January 24, 2025, Application Integration will no longer support Rhino as the JavaScript execution engine. No further fix actions are needed.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-829, CWE-829
References: https://cloud.google.com/application-integration/docs/release-notes#January_23_2025
CVE: CVE-2024-12602
Published: 2025-02-06
Description: Identity verification vulnerability in the ParamWatcher module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-300
References: https://consumer.huawei.com/en/support/bulletin/2025/2/
CVE: CVE-2024-57954
Published: 2025-02-06
Description: Permission verification vulnerability in the media library module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-285
References: https://consumer.huawei.com/en/support/bulletin/2025/2/
CVE: CVE-2024-57955
Published: 2025-02-06
Description: Arbitrary write vulnerability in the Gallery module 
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-787
References: https://consumer.huawei.com/en/support/bulletin/2025/2/
CVE: CVE-2024-57956
Published: 2025-02-06
Description: Out-of-bounds read vulnerability in the interpreter string module
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 2.8 (LOW)
CWE: CWE-680, CWE-125
References: https://consumer.huawei.com/en/support/bulletin/2025/2/
CVE: CVE-2024-57957
Published: 2025-02-06
Description: Vulnerability of improper log information control in the UI framework module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-657, CWE-532
References: https://consumer.huawei.com/en/support/bulletin/2025/2/
CVE: CVE-2024-57958
Published: 2025-02-06
Description: Out-of-bounds array read vulnerability in the FFRT module
Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://consumer.huawei.com/en/support/bulletin/2025/2/
CVE: CVE-2024-57959
Published: 2025-02-06
Description: Use-After-Free (UAF) vulnerability in the display module
Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://consumer.huawei.com/en/support/bulletin/2025/2/
CVE: CVE-2024-57960
Published: 2025-02-06
Description: Input verification vulnerability in the ExternalStorageProvider module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20
References: https://consumer.huawei.com/en/support/bulletin/2025/2/
CVE: CVE-2024-57961
Published: 2025-02-06
Description: Out-of-bounds write vulnerability in the emcom module
Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://consumer.huawei.com/en/support/bulletin/2025/2/
CVE: CVE-2024-57962
Published: 2025-02-06
Description: Vulnerability of incomplete verification information in the VPN service module
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-701
References: https://consumer.huawei.com/en/support/bulletin/2025/2/
CVE: CVE-2024-24911
Published: 2025-02-06
Description: In rare scenarios, the cpca process on the Security Management Server / Domain Management Server may exit unexpectedly, creating a core dump file. When the cpca process is down, VPN and SIC connectivity issues may occur if the CRL is not present in the Security Gateway's CRL cache.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125
References: https://support.checkpoint.com/results/sk/sk183101
CVE: CVE-2025-1074
Published: 2025-02-06
Description: A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. Affected is the function logout of the file /en/?mylogout of the component URL Handler. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure. They are aware about it and are working on resolving it.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862
References: https://github.com/mano257200/qloapps-csrf-logout-vulnerability; https://vuldb.com/?ctiid.294834; https://vuldb.com/?id.294834
CVE: CVE-2025-1076
Published: 2025-02-06
Description: A Stored Cross-Site Scripting (Stored XSS) vulnerability has been found in the Holded application. This vulnerability could allow an attacker to store a JavaScript payload within the editable ‘name’ and ‘icon’ parameters of the Activities functionality.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-vulnerability-holded
CVE: CVE-2022-31764
Published: 2025-02-06
Description: The Lite UI of Apache ShardingSphere ElasticJob-UI allows an attacker to perform RCE by constructing a special JDBC URL of H2 database. This issue affects Apache ShardingSphere ElasticJob-UI version 3.0.1 and prior versions. This vulnerability has been fixed in ElasticJob-UI 3.0.2.
The premise of this attack is that the attacker has obtained the account and password. Otherwise, the attacker cannot perform this attack.
CVSS Score: 8.5 (HIGH)
CWE: CWE-913
References: https://lists.apache.org/thread/pg0k223m4hsnnzg4nh7lxvdxxgbkrlqb
CVE: CVE-2023-5878
Published: 2025-02-06
Description: Honeywell OneWireless 

Wireless Device Manager (WDM) for the following versions R310.x, R320.x, R321.x, R322.1, R322.2, R323.x, R330.1 contains a command injection vulnerability. An attacker who is authenticated could use the firmware update process to potentially exploit the vulnerability, leading to a command injection. Honeywell recommends updating to 

 R322.3, R330.2 or the most recent version of this product2.
CWE: CWE-77
References: https://process.honeywell.com/
CVE: CVE-2024-43811
Published: 2025-02-06
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2024. Notes: none.
CVE: CVE-2025-0994
Published: 2025-02-06
Description: Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer’s Microsoft Internet Information Services (IIS) web server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://learn.assetlifecycle.trimble.com/i/1532182-cityworks-customer-communication-2025-02-05-docx/0?; https://www.cisa.gov/news-events/ics-advisories/icsa-25-037-04; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-0994
CVE: CVE-2022-40490
Published: 2025-02-06
Description: Tiny File Manager v2.4.7 and below was discovered to contain a Cross Site Scripting (XSS) vulnerability. This vulnerability allows attackers to execute arbitrary code via a crafted payload injected into the name of an uploaded or already existing file.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/prasathmani/tinyfilemanager; https://github.com/whitej3rry/CVE-2022-40490/blob/main/PoC.md; https://github.com/whitej3rry/CVE-2022-40490/blob/main/PoC.md
CVE: CVE-2022-40916
Published: 2025-02-06
Description: Tiny File Manager v2.4.7 and below is vulnerable to session fixation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-384
References: https://github.com/prasathmani/tinyfilemanager; https://github.com/whitej3rry/CVE-2022-40916/blob/main/PoC.md
CVE: CVE-2024-13614
Published: 2025-02-06
Description: Kaspersky has fixed a security issue in Kaspersky Anti-Virus SDK for Windows, Kaspersky Security for Virtualization Light Agent, Kaspersky Endpoint Security for Windows, Kaspersky Small Office Security, Kaspersky for Windows (Standard, Plus, Premium), Kaspersky Free, Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Security Cloud, Kaspersky Safe Kids, Kaspersky Anti-Ransomware Tool that could allow an authenticated attacker to write data to a limited area outside the allocated kernel memory buffer. The fix was installed automatically for all Kaspersky Endpoint products.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-190
References: https://support.kaspersky.com/vulnerability/list-of-advisories/12430#060225
CVE: CVE-2024-39033
Published: 2025-02-06
Description: In Newgensoft OmniDocs 11.0_SP1_03_006, Insecure Direct Object Reference (IDOR) in the getuserproperty function allows user's configuration and PII to be stolen.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639
References: https://pastebin.com/SHExsfh6
CVE: CVE-2024-39272
Published: 2025-02-06
Description: A cross-site scripting (xss) vulnerability exists in the dataset upload functionality of ClearML Enterprise Server 3.22.5-1533. A specially crafted HTTP request can lead to an arbitrary html code. An attacker can send a series of HTTP requests to trigger this vulnerability.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-2110; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2110
CVE: CVE-2024-43779
Published: 2025-02-06
Description: An information disclosure vulnerability exists in the Vault API functionality of ClearML Enterprise Server 3.22.5-1533. A specially crafted HTTP request can lead to reading vaults that have been previously disabled, possibly leaking sensitive credentials. An attacker can send a series of HTTP requests to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-200, CWE-522
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-2112; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2112
CVE: CVE-2024-57427
Published: 2025-02-06
Description: PHPJabbers Cinema Booking System v2.0 is vulnerable to reflected cross-site scripting (XSS). Multiple endpoints improperly handle user input, allowing malicious scripts to execute in a victim’s browser. Attackers can craft malicious links to steal session cookies or conduct phishing attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ahrixia/CVE-2024-57427; https://www.phpjabbers.com/cinema-booking-system/; https://github.com/ahrixia/CVE-2024-57427
CVE: CVE-2024-57428
Published: 2025-02-06
Description: A stored cross-site scripting (XSS) vulnerability in PHPJabbers Cinema Booking System v2.0 exists due to unsanitized input in file upload fields (event_img, seat_maps) and seat number configurations (number[new_X] in pjActionCreate). Attackers can inject persistent JavaScript, leading to phishing, malware injection, and session hijacking.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-79
References: https://github.com/ahrixia/CVE-2024-57428; https://www.phpjabbers.com/cinema-booking-system/
CVE: CVE-2024-57429
Published: 2025-02-06
Description: A cross-site request forgery (CSRF) vulnerability in the pjActionUpdate function of PHPJabbers Cinema Booking System v2.0 allows remote attackers to escalate privileges by tricking an authenticated admin into submitting an unauthorized request.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://github.com/ahrixia/CVE-2024-57429; https://www.phpjabbers.com/cinema-booking-system/