deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-12637
Published: 2025-01-17
Description: The Moving Users plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.05 via the export functionality. The JSON files are stored in predictable locations with guessable file names when exporting user data. This could allow unauthenticated attackers to extract sensitive user data, for instance, email addresses, hashed passwords, and IP addresses.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3223894%40moving-users&new=3223894%40moving-users&sfp_email=&sfph_mail=; https://wordpress.org/plugins/moving-users/; https://www.wordfence.com/threat-intel/vulnerabilities/id/8209761c-2cfe-49b9-ab4c-49a9a13b5dcf?source=cve
CVE: CVE-2024-13366
Published: 2025-01-17
Description: The Sandbox plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'debug' parameter in all versions up to, and including, 0.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/sandbox/; https://www.wordfence.com/threat-intel/vulnerabilities/id/3fc752bb-3f1d-4106-9df1-361564905a55?source=cve
CVE: CVE-2024-13367
Published: 2025-01-17
Description: The Sandbox plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the export_download action in all versions up to, and including, 0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to download an entire copy of a sandbox environment which can contain sensitive information like the wp-config.php file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/sandbox/trunk/sandbox-ajax.php#L21; https://www.wordfence.com/threat-intel/vulnerabilities/id/59880d92-5d75-432f-9fb5-d74b13d101ff?source=cve
CVE: CVE-2024-13386
Published: 2025-01-17
Description: The quote-posttype-plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Author field in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/quote-post-type-plugin/; https://www.wordfence.com/threat-intel/vulnerabilities/id/4aa09e5b-fc3d-4409-bf2c-dd8aae69eeda?source=cve
CVE: CVE-2024-11139
Published: 2025-01-17
Description: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that
could allow local attackers to exploit these issues to potentially execute arbitrary code when opening a
malicious project file.
CWE: CWE-119
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-014-09&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-014-09.pdf
CVE: CVE-2024-11425
Published: 2025-01-17
Description: CWE-131: Incorrect Calculation of Buffer Size vulnerability exists that could cause Denial-of-Service of the
product when an unauthenticated user is sending a crafted HTTPS packet to the webserver.
CVSS Score: 7.5 (HIGH)
CWE: CWE-131
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-014-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-014-01.pdf
CVE: CVE-2024-12370
Published: 2025-01-17
Description: The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check when adding rooms in all versions up to, and including, 2.1.5. This makes it possible for unauthenticated attackers to add rooms with custom prices.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284, CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3210798%40wp-hotel-booking%2Ftags%2F2.1.5&new=3214765%40wp-hotel-booking%2Ftags%2F2.1.6; https://www.wordfence.com/threat-intel/vulnerabilities/id/5df32365-5381-48e0-9313-7e83c4c6c440?source=cve
CVE: CVE-2024-12399
Published: 2025-01-17
Description: CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability
exists that could cause partial loss of confidentiality, loss of integrity and availability of the HMI when attacker performs
man in the middle attack by intercepting the communication.
CVSS Score: 7.1 (HIGH)
CWE: CWE-924
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-014-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-014-02.pdf
CVE: CVE-2024-12476
Published: 2025-01-17
Description: CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could
cause information disclosure, impacts workstation integrity and potential remote code execution on the
compromised computer, when specific crafted XML file is imported in the Web Designer configuration tool.
CVSS Score: 7.8 (HIGH)
CWE: CWE-611
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-014-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-014-04.pdf
CVE: CVE-2024-13377
Published: 2025-01-17
Description: The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘alt’ parameter in all versions up to, and including, 2.9.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://docs.gravityforms.com/gravityforms-change-log/; https://www.wordfence.com/threat-intel/vulnerabilities/id/03623f00-2c3c-4590-92fe-a5eaac15b944?source=cve
CVE: CVE-2024-13378
Published: 2025-01-17
Description: The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style_settings’ parameter in versions 2.9.0.1 up to, and including, 2.9.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The attack is only successful in the Chrome web browser, and requires directly browsing the media file via the attachment post.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://docs.gravityforms.com/gravityforms-change-log/; https://www.wordfence.com/threat-intel/vulnerabilities/id/f884ea43-e1a5-4b44-8a24-f68f71b0fcfb?source=cve
CVE: CVE-2024-10497
Published: 2025-01-17
Description: CWE-639: Authorization Bypass Through User-Controlled Key vulnerability exists that could allow an
authorized attacker to modify values outside those defined by their privileges (Elevation of Privileges) when the
attacker sends modified HTTPS requests to the device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-639
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-014-08&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-014-08.pdf
CVE: CVE-2024-10498
Published: 2025-01-17
Description: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that
could allow an unauthorized attacker to modify configuration values outside of the normal range when the
attacker sends specific Modbus write packets to the device which could result in invalid data or loss of web
interface functionality.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-014-08&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-014-08.pdf
CVE: CVE-2024-12142
Published: 2025-01-17
Description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could
cause information disclosure of restricted web page, modification of web page and denial of
service when specific web pages are modified and restricted functions are invoked.
CVSS Score: 8.6 (HIGH)
CWE: CWE-200
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-014-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-014-05.pdf
CVE: CVE-2024-12703
Published: 2025-01-17
Description: CWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity
and potential remote code execution on workstation when a non-admin authenticated user opens a malicious
project file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-014-06&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-014-06.pdf
CVE: CVE-2024-13502
Published: 2025-01-17
Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Newtec/iDirect NTC2218, NTC2250, NTC2299 on Linux, PowerPC, ARM allows Local Code Inclusion.This issue affects NTC2218, NTC2250, NTC2299: from 1.0.1.1 through 2.2.6.19.


The `commit_multicast` page used to configure multicasts in the modem's web administration interface uses improperly parses incoming data from the request before passing it to an `eval` statement in a bash script. This allows attackers to inject arbitrary shell commands.
CWE: CWE-78
References: https://doi.org/10.1145/3[PII_REDACTED]139; https://www.youtube.com/watch?v=-pxmly8xeas
CVE: CVE-2024-13503
Published: 2025-01-17
Description: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Newtec NTC2218, NTC2250, NTC2299 on Linux, PowerPC, ARM (Updating signaling process in the swdownload binary modules) allows Local Execution of Code, Remote Code Inclusion.
This issue affects NTC2218, NTC2250, NTC2299: from 1.0.1.1 through 2.2.6.19. The issue is both present on the PowerPC versions of the modem and the ARM versions.

A stack buffer buffer overflow in the swdownload binary allows attackers to execute arbitrary code. The parse_INFO function uses an unrestricted `sscanf` to read a string of an incoming network packet into a statically sized buffer.
CWE: CWE-120
References: https://doi.org/10.1145/3[PII_REDACTED]139; https://www.youtube.com/watch?v=-pxmly8xeas
CVE: CVE-2025-0527
Published: 2025-01-17
Description: A vulnerability classified as critical was found in code-projects Admission Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /signupconfirm.php. The manipulation of the argument in_eml leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/Curious-L/-/issues/4; https://vuldb.com/?ctiid.292411
CVE: CVE-2024-50967
Published: 2025-01-17
Description: The /rest/rights/ REST API endpoint in Becon DATAGerry through 2.2.0 contains an Incorrect Access Control vulnerability. An attacker can remotely access this endpoint without authentication, leading to unauthorized disclosure of sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://datagerry.readthedocs.io/en/latest/api/rest/user-management.html#rights; https://github.com/0xByteHunter/CVE-2024-50967; https://medium.com/@0xbytehunter/my-first-cve-discovery-of-broken-access-control-in-the-datagerry-platform-7b0404f88a43
CVE: CVE-2025-0528
Published: 2025-01-17
Description: A vulnerability, which was classified as critical, has been found in Tenda AC8, AC10 and AC18 16.03.10.20. Affected by this issue is some unknown functionality of the file /goform/telnet of the component HTTP Request Handler. The manipulation leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.2 (HIGH)
CWE: CWE-74, CWE-77, CWE-78
References: https://github.com/Pr0b1em/IoT/blob/master/TendaAC10v16.03.10.20telnet.md; https://vuldb.com/?ctiid.292412; https://vuldb.com/?id.292412
CVE: CVE-2025-0529
Published: 2025-01-17
Description: A vulnerability, which was classified as critical, was found in code-projects Train Ticket Reservation System 1.0. This affects an unknown part of the component Login Form. The manipulation of the argument username leads to stack-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-121, CWE-787
References: https://code-projects.org/; https://gist.github.com/higordiego/f9943e2e6ba81a02a85dd07c742eecfc; https://vuldb.com/?ctiid.292413
CVE: CVE-2025-0530
Published: 2025-01-17
Description: A vulnerability has been found in code-projects Job Recruitment 1.0 and classified as problematic. This vulnerability affects unknown code of the file /_parse/_feedback_system.php. The manipulation of the argument type leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://code-projects.org/; https://github.com/ha0day125/cve/blob/main/xss-ha0day.md; https://vuldb.com/?ctiid.292414
CVE: CVE-2025-0531
Published: 2025-01-17
Description: A vulnerability was found in code-projects Chat System 1.0 and classified as critical. This issue affects some unknown processing of the file /user/leaveroom.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/LamentXU123/cve/blob/main/sql_injection2.md; https://vuldb.com/?ctiid.292415
CVE: CVE-2024-26153
Published: 2025-01-17
Description: All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.9.19 
are vulnerable to cross-site request forgery (CSRF). An external 
attacker with no access to the device can force the end user into 
submitting a "setconf" method request, not requiring any CSRF token, 
which can lead into denial of service on the device.
CVSS Score: 7.4 (HIGH)
CWE: CWE-352
References: https://www.cisa.gov/news-events/ics-advisories/icsa-22-307-01
CVE: CVE-2024-26154
Published: 2025-01-17
Description: All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 
are vulnerable to reflected cross site scripting in the appliance site 
name. The ETIC RAS web server saves the site name and then presents it 
to the administrators in a few different pages.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.cisa.gov/news-events/ics-advisories/icsa-22-307-01
CVE: CVE-2024-26155
Published: 2025-01-17
Description: All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 
expose clear text credentials in the web portal. An attacker can access 
the ETIC RAS web portal and view the HTML code, which is configured to 
be hidden, thus allowing a connection to the ETIC RAS ssh server, which 
could enable an attacker to perform actions on the device.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-319
References: https://www.cisa.gov/news-events/ics-advisories/icsa-22-307-01
CVE: CVE-2024-26156
Published: 2025-01-17
Description: All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 
are vulnerable to reflected cross site scripting (XSS) attacks in the 
method parameter. The ETIC RAS web server uses dynamic pages that gets 
their input from the client side and reflects the input in its response 
to the client.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.cisa.gov/news-events/ics-advisories/icsa-22-307-01
CVE: CVE-2024-26157
Published: 2025-01-17
Description: All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 
are vulnerable to reflected cross site scripting (XSS) attacks in get 
view method under view parameter. The ETIC RAS web server uses dynamic 
pages that get their input from the client side and reflect the input in
 their response to the client.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.cisa.gov/news-events/ics-advisories/icsa-22-307-01
CVE: CVE-2024-45832
Published: 2025-01-17
Description: Hard-coded credentials were included as part of the application binary. 
These credentials served as part of the application authentication flow 
and communication with the mobile application. An attacker could access 
unauthorized information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-798
References: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-354-01
CVE: CVE-2024-53683
Published: 2025-01-17
Description: A valid set of credentials in a .js file and a static token for 
communication were obtained from the decompiled IPA. An attacker could 
use the information to disrupt normal use of the application by changing
 the translation files and thus weaken the integrity of normal use.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-497
References: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-354-01
CVE: CVE-2024-54681
Published: 2025-01-17
Description: Multiple bash files were present in the application's private directory.
 Bash files can be used on their own, by an attacker that has already 
full access to the mobile platform to compromise the translations for 
the application.
CVSS Score: 3.5 (LOW)
CWE: CWE-77
References: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-354-01
CVE: CVE-2024-12757
Published: 2025-01-17
Description: Nedap Librix Ecoreader 
 is missing authentication for critical functions that could allow an 
unauthenticated attacker to potentially execute malicious code.
CVSS Score: 8.6 (HIGH)
CWE: CWE-306
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-007-02
CVE: CVE-2025-0430
Published: 2025-01-17
Description: Belledonne Communications Linphone-Desktop 
 is vulnerable to a NULL Dereference vulnerability, which could allow a remote attacker to create a denial-of-service condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-014-04
CVE: CVE-2025-0532
Published: 2025-01-17
Description: A vulnerability was found in Codezips Gym Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /dashboard/admin/new_submit.php. The manipulation of the argument m_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/TIANN0/CVE/issues/1; https://vuldb.com/?ctiid.292416; https://vuldb.com/?id.292416
CVE: CVE-2025-0533
Published: 2025-01-17
Description: A vulnerability was found in 1000 Projects Campaign Management System Platform for Women 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /Code/sc_login.php. The manipulation of the argument uname leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://1000projects.org/; https://github.com/onupset/CVE/issues/2; https://vuldb.com/?ctiid.292417
CVE: CVE-2025-0534
Published: 2025-01-17
Description: A vulnerability was found in 1000 Projects Campaign Management System Platform for Women 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /Code/loginnew.php. The manipulation of the argument Username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://1000projects.org/; https://github.com/onupset/CVE/issues/3; https://vuldb.com/?ctiid.292418
CVE: CVE-2025-0535
Published: 2025-01-17
Description: A vulnerability classified as critical has been found in Codezips Gym Management System 1.0. This affects an unknown part of the file /dashboard/admin/edit_mem_submit.php. The manipulation of the argument uid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/lan041221/cve/blob/main/SQL_Injection_in_Gym_Management_System.md; https://vuldb.com/?ctiid.292419; https://vuldb.com/?id.292419
CVE: CVE-2024-13026
Published: 2025-01-17
Description: A vulnerability exists in Algo Edge up to 2.1.1 - a previously used (legacy) component of navify® Algorithm Suite.  The vulnerability impacts the authentication mechanism of this component and could allow an attacker with adjacent access to the laboratory network and the Algo Edge system to craft valid authentication tokens and access the component. Other components of navify® Algorithm Suite are not affected.
CWE: CWE-326
References: https://diagnostics.roche.com/content/dam/diagnostics/Blueprint/en/pdf/Algo%20Edge%20-%20Authentication%20Vulnerability%20-%20Product%20Security%20Advisory.pdf
CVE: CVE-2024-52870
Published: 2025-01-17
Description: Teradata Vantage Editor 1.0.1 is mostly intended for SQL database access and docs.teradata.com access, but provides unintended functionality (including Chromium Developer Tools) that can result in a client user accessing arbitrary remote websites.
CVSS Score: 7.1 (HIGH)
CWE: CWE-909
References: https://chrismanson.com/CVE/cve-2024-52870.html; https://www.teradata.com/trust-security-center/data-security
CVE: CVE-2024-57030
Published: 2025-01-17
Description: Wegia < 3.2.0 is vulnerable to Cross Site Scripting (XSS) in /geral/documentos_funcionario.php via the id parameter.
CVSS Score: 8.1 (HIGH)
CWE: CWE-79
References: https://github.com/nmmorette/vulnerability-research/tree/main/CVE-2024-57030; https://www.wegia.org/
CVE: CVE-2024-57031
Published: 2025-01-17
Description: WeGIA < 3.2.0 is vulnerable to SQL Injection in /funcionario/remuneracao.php via the id_funcionario parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/nmmorette/vulnerability-research/tree/main/CVE-2024-57031; https://www.wegia.org/
CVE: CVE-2024-57032
Published: 2025-01-17
Description: WeGIA < 3.2.0 is vulnerable to Incorrect Access Control in controle/control.php. The application does not validate the value of the old password, so it is possible to change the password by placing any value in the senha_antiga field.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863, CWE-284
References: https://github.com/nmmorette/vulnerability-research/blob/main/CVE-2024-57032; https://www.wegia.org/
CVE: CVE-2024-57034
Published: 2025-01-17
Description: WeGIA < 3.2.0 is vulnerable to SQL Injection in query_geracao_auto.php via the query parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/nmmorette/vulnerability-research/tree/main/CVE-2024-57034; https://www.wegia.org
CVE: CVE-2024-57369
Published: 2025-01-17
Description: Clickjacking vulnerability in typecho v1.2.1.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-1021
References: https://github.com/typecho/typecho; https://royblume.github.io/CVE-2024-57369/; https://typecho.org/
CVE: CVE-2024-57370
Published: 2025-01-17
Description: Cross Site Scripting vulnerability in sunnygkp10 Online Exam System master version allows a remote attacker to obtain sensitive information via the w parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://sunnygkp10.com; https://github.com/sunnygkp10/Online-Exam-System-; https://royblume.github.io/CVE-2024-57370/
CVE: CVE-2024-57372
Published: 2025-01-17
Description: Cross Site Scripting vulnerability in InformationPush master version allows a remote attacker to obtain sensitive information via the title, time and msg parameters
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/kaixin1995; https://github.com/kaixin1995/InformationPush; https://royblume.github.io/CVE-2024-57372/