deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-24320
Published: 2024-06-14
Description: Directory Traversal vulnerability in Mgt-commerce CloudPanel v.2.0.0 thru v.2.4.0 allows a remote attacker to obtain sensitive information and execute arbitrary code via the service parameter of the load-logfiles function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-120
References: https://datack.my/cloudpanel-v2-0-0-v2-4-0-authenticated-user-session-hijacking-cve-2024-24320/; https://datack.my/cloudpanel-v2-0-0-v2-4-0-authenticated-user-session-hijacking-cve-2024-24320/
CVE: CVE-2024-36597
Published: 2024-06-14
Description: Aegon Life v1.0 was discovered to contain a SQL injection vulnerability via the client_id parameter at clientStatus.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/kaliankhe/CVE-Aslam-mahi/blob/9ec0572c68bfd3708a7d6e[PII_REDACTED]31f4e927/vendors/projectworlds.in/AEGON%20LIFE%20v1.0%20Life%20Insurance%20Management%20System/CVE-2024-36597; https://www.exploit-db.com/exploits/52046; https://github.com/kaliankhe/CVE-Aslam-mahi/blob/9ec0572c68bfd3708a7d6e[PII_REDACTED]31f4e927/vendors/projectworlds.in/AEGON%20LIFE%20v1.0%20Life%20Insurance%20Management%20System/CVE-2024-36597
CVE: CVE-2024-36598
Published: 2024-06-14
Description: An arbitrary file upload vulnerability in Aegon Life v1.0 allows attackers to execute arbitrary code via uploading a crafted image file.
CVSS Score: 8.1 (HIGH)
CWE: CWE-94
References: https://github.com/kaliankhe/CVE-Aslam-mahi/blob/9ec0572c68bfd3708a7d6e[PII_REDACTED]31f4e927/vendors/projectworlds.in/AEGON%20LIFE%20v1.0%20Life%20Insurance%20Management%20System/CVE-2024-36598; https://github.com/kaliankhe/CVE-Aslam-mahi/blob/9ec0572c68bfd3708a7d6e[PII_REDACTED]31f4e927/vendors/projectworlds.in/AEGON%20LIFE%20v1.0%20Life%20Insurance%20Management%20System/CVE-2024-36598
CVE: CVE-2024-36599
Published: 2024-06-14
Description: A cross-site scripting (XSS) vulnerability in Aegon Life v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name parameter at insertClient.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/kaliankhe/CVE-Aslam-mahi/blob/9ec0572c68bfd3708a7d6e[PII_REDACTED]31f4e927/vendors/projectworlds.in/AEGON%20LIFE%20v1.0%20Life%20Insurance%20Management%20System/CVE-2024-36599; https://www.exploit-db.com/exploits/52042; https://github.com/kaliankhe/CVE-Aslam-mahi/blob/9ec0572c68bfd3708a7d6e[PII_REDACTED]31f4e927/vendors/projectworlds.in/AEGON%20LIFE%20v1.0%20Life%20Insurance%20Management%20System/CVE-2024-36599
CVE: CVE-2024-37888
Published: 2024-06-14
Description: The Open Link is a CKEditor plugin, extending context menu with a possibility to open link in a new tab. The vulnerability allowed to execute JavaScript code by abusing link href attribute. It affects all users using the Open Link plugin at version < **1.0.5**.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/mlewand/ckeditor-plugin-openlink/security/advisories/GHSA-rhxf-gvmh-hrxm; https://github.com/mlewand/ckeditor-plugin-openlink/security/advisories/GHSA-rhxf-gvmh-hrxm
CVE: CVE-2024-36600
Published: 2024-06-14
Description: Buffer Overflow Vulnerability in libcdio 2.2.0 (fixed in 2.3.0) allows an attacker to execute arbitrary code via a crafted ISO 9660 image file.
CVSS Score: 8.4 (HIGH)
CWE: CWE-121
References: https://bugzilla.redhat.com/show_bug.cgi?id=2292833; https://github.com/gashasbi/My-Reports/tree/main/CVE-2024-36600; https://github.com/libcdio/libcdio/pull/32
CVE: CVE-2024-37831
Published: 2024-06-14
Description: Itsourcecode Payroll Management System 1.0 is vulnerable to SQL Injection in payroll_items.php via the ID parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/ganzhi-qcy/cve/issues/5; https://github.com/ganzhi-qcy/cve/issues/5
CVE: CVE-2024-37889
Published: 2024-06-14
Description: MyFinances is a web application for managing finances. MyFinances has a way to access other customer invoices while signed in as a user. This method allows an actor to access PII and financial information from another account. The vulnerability is fixed in 0.4.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://github.com/TreyWW/MyFinances/commit/2c1e6d5b7ec8b2d6f660b260e3c5f4d3eaaa613f; https://github.com/TreyWW/MyFinances/security/advisories/GHSA-4884-3gvp-3wj2; https://github.com/TreyWW/MyFinances/commit/2c1e6d5b7ec8b2d6f660b260e3c5f4d3eaaa613f
CVE: CVE-2024-2875
Published: 2024-06-14
Description: Rejected reason: ** REJECT ** Duplicate reservation. Please use CVE-2024-4258 instead.
CVE: CVE-2024-21988
Published: 2024-06-14
Description: StorageGRID (formerly StorageGRID Webscale) versions prior to 
11.7.0.9 and 11.8.0.5 are susceptible to disclosure of sensitive 
information via complex MiTM attacks due to a vulnerability in the SSH 
cryptographic implementation.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-347
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-30119
Published: 2024-06-14
Description: HCL DRYiCE Optibot Reset Station is impacted by a missing Strict Transport Security Header.  This could allow an attacker to intercept or manipulate data during redirection.
CVSS Score: 3.7 (LOW)
CWE: CWE-522, CWE-326
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0113496; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0113496
CVE: CVE-2024-30120
Published: 2024-06-14
Description: HCL DRYiCE Optibot Reset Station is impacted by an Unused Parameter in the web application.
CVSS Score: 2.9 (LOW)
CWE: CWE-563
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0113496; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0113496
CVE: CVE-2024-6003
Published: 2024-06-14
Description: A vulnerability was found in Guangdong Baolun Electronics IP Network Broadcasting Service Platform 2.0. It has been classified as critical. Affected is an unknown function of the file /api/v2/maps. The manipulation of the argument orderColumn leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-268692. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/chennuo17/cve; https://vuldb.com/?ctiid.268692; https://vuldb.com/?id.268692
CVE: CVE-2023-6696
Published: 2024-06-15
Description: The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on several functions in all versions up to, and including, 4.3.1. While some functions contain a nonce check, the nonce can be obtained from the profile page of a logged-in user. This allows subscribers to perform several actions including deleting subscribers and perform blind Server-Side Request Forgery.
CVSS Score: 8.1 (HIGH)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/popup-builder/tags/4.2.3/com/classes/Ajax.php; https://plugins.trac.wordpress.org/changeset/3096000/popup-builder/trunk/com/classes/Ajax.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/9f86ec30-7a9d-4c36-8559-bde331c8b958?source=cve
CVE: CVE-2024-2544
Published: 2024-06-15
Description: The Popup Builder plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on all AJAX actions. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform multiple unauthorized actions, such as deleting subscribers, and importing subscribers to conduct stored cross-site scripting attacks.
CVSS Score: 7.4 (HIGH)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3096000%40popup-builder%2Ftrunk&old=3085485%40popup-builder%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/04802c63-4a5d-4948-9ef1-cf89c4cc757e?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3096000%40popup-builder%2Ftrunk&old=3085485%40popup-builder%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2024-3813
Published: 2024-06-15
Description: The tagDiv Composer plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.8 via the 'td_block_title' shortcode 'block_template_id' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
CVSS Score: 8.8 (HIGH)
CWE: CWE-98
References: https://tagdiv.com/tagdiv-composer-page-builder-basics/; https://www.wordfence.com/threat-intel/vulnerabilities/id/87b7bc4a-4d2f-4bcb-a9d5-72e31c95c09e?source=cve; https://tagdiv.com/tagdiv-composer-page-builder-basics/
CVE: CVE-2024-3814
Published: 2024-06-15
Description: The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'single' module in all versions up to, and including, 4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tagdiv.com/tagdiv-composer-page-builder-basics/; https://www.wordfence.com/threat-intel/vulnerabilities/id/4c2a88c3-5c11-4b42-b8f8-aafecf6c4c74?source=cve; https://tagdiv.com/tagdiv-composer-page-builder-basics/
CVE: CVE-2024-3815
Published: 2024-06-15
Description: The Newspaper theme for WordPress is vulnerable to Stored Cross-Site Scripting via attachment meta in the archive page in all versions up to, and including, 12.6.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://themeforest.net/item/newspaper/5489609; https://www.wordfence.com/threat-intel/vulnerabilities/id/6f0a332f-b761-44b3-86e8-82411455ba3e?source=cve; https://themeforest.net/item/newspaper/5489609
CVE: CVE-2024-4479
Published: 2024-06-15
Description: The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the sg_general_toggle_tab_enable and sg_accordion_style attributes within the plugin's JKit - Tabs and JKit - Accordion widget, respectively, in all versions up to, and including, 2.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/2.6.5/class/elements/views/class-accordion-view.php#L22; https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/2.6.5/class/elements/views/class-tabs-view.php#L88; https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/2.6.5/class/elements/views/class-view-abstract.php#L195
CVE: CVE-2024-5263
Published: 2024-06-15
Description: The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Motion Text and Table widgets in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpmet.com/plugin/elementskit/roadmaps/; https://www.wordfence.com/threat-intel/vulnerabilities/id/2e[PII_REDACTED]-4a16-968d-f00b65e1361d?source=cve; https://wpmet.com/plugin/elementskit/roadmaps/
CVE: CVE-2024-5868
Published: 2024-06-15
Description: The WooCommerce - Social Login plugin for WordPress is vulnerable to Email Verification in all versions up to, and including, 2.6.2 via the use of insufficiently random activation code. This makes it possible for unauthenticated attackers to bypass the email verification.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-330
References: https://codecanyon.net/item/social-login-wordpress-woocommerce-plugin/8495883; https://www.wordfence.com/threat-intel/vulnerabilities/id/97fbbf5b-d3c7-47ce-b251-ce1fe38af152?source=cve; https://codecanyon.net/item/social-login-wordpress-woocommerce-plugin/8495883
CVE: CVE-2024-5871
Published: 2024-06-15
Description: The WooCommerce - Social Login plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.2 via deserialization of untrusted input from the 'woo_slg_verify' vulnerable parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://codecanyon.net/item/social-login-wordpress-woocommerce-plugin/8495883; https://www.wordfence.com/threat-intel/vulnerabilities/id/ffd592e6-2ac4-4af4-bfc0-d4f834157d71?source=cve; https://codecanyon.net/item/social-login-wordpress-woocommerce-plugin/8495883
CVE: CVE-2024-6000
Published: 2024-06-15
Description: The FooEvents for WooCommerce plugin for WordPress is vulnerable to unauthorized arbitrary file uploads due to an improper capability setting on the 'display_ticket_themes_page' function in versions up to, and including, 1.19.20. This makes it possible for authenticated attackers with contributor-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible. This was partially patched in 1.19.20, and fully patched in 1.19.21.
CVSS Score: 7.1 (HIGH)
CWE: CWE-285
References: https://help.fooevents.com/docs/topics/changelogs/fooevents-for-woocommerce/; https://www.wordfence.com/threat-intel/vulnerabilities/id/1080810b-ec9a-44fb-b4da-49b28646a441?source=cve; https://help.fooevents.com/docs/topics/changelogs/fooevents-for-woocommerce/
CVE: CVE-2024-1399
Published: 2024-06-15
Description: The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3064578%40menu-ordering-reservations%2Ftrunk&old=3022834%40menu-ordering-reservations%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/4d419d9e-73c5-4d14-8da0-27a90924e0b5?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3064578%40menu-ordering-reservations%2Ftrunk&old=3022834%40menu-ordering-reservations%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2024-2695
Published: 2024-06-15
Description: The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shariff' shortcode in all versions up to, and including, 4.6.13 due to insufficient input sanitization and output escaping on user supplied attributes such as 'borderradius', 'services' and 'timestamp'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3069111%40shariff%2Ftrunk&old=3061040%40shariff%2Ftrunk&sfp_email=&sfph_mail=#file1; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3103137%40shariff&new=3103137%40shariff&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/9baa8bbf-a318-4bc5-8bfd-2bd64536965e?source=cve
CVE: CVE-2024-3105
Published: 2024-06-15
Description: The Woody code snippets – Insert Header Footer Code, AdSense Ads plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.5.0 via the 'insert_php' shortcode. This is due to the plugin not restricting the usage of the functionality to high level authorized users. This makes it possible for authenticated attackers, with contributor-level access and above, to execute code on the server.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-94
References: https://plugins.trac.wordpress.org/browser/insert-php/trunk/includes/class.plugin.php#L166; https://plugins.trac.wordpress.org/browser/insert-php/trunk/includes/shortcodes/shortcode-insert-php.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3102522%40insert-php&new=3102522%40insert-php&sfp_email=&sfph_mail=
CVE: CVE-2024-4095
Published: 2024-06-15
Description: The Collapse-O-Matic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'expand' and 'expandsub' shortcode in all versions up to, and including, 1.8.5.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/baden03/collapse-o-matic/blob/561d8ab53a03e44c12234ba9687226fdbb5054cc/collapse-o-matic.php#L343; https://pluginoven.com/plugins/collapse-o-matic/documentation/shortcode/; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3094116%40jquery-collapse-o-matic&new=3094116%40jquery-collapse-o-matic&sfp_email=&sfph_mail=
CVE: CVE-2024-4258
Published: 2024-06-15
Description: The Video Gallery – YouTube Playlist, Channel Gallery by YotuWP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.13 via the settings parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-98
References: https://plugins.trac.wordpress.org/browser/yotuwp-easy-youtube-embed/trunk/yotuwp.php#L731; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3106918%40yotuwp-easy-youtube-embed&new=3106918%40yotuwp-easy-youtube-embed&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/6feae1c4-3735-4a33-85a5-867d458d2e8a?source=cve
CVE: CVE-2024-4551
Published: 2024-06-15
Description: The Video Gallery – YouTube Playlist, Channel Gallery by YotuWP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.13 via the display function. This makes it possible for authenticated attackers, with contributor access and higher, to include and execute arbitrary php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-98
References: https://plugins.trac.wordpress.org/browser/yotuwp-easy-youtube-embed/trunk/inc/views.php#L828; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3106918%40yotuwp-easy-youtube-embed&new=3106918%40yotuwp-easy-youtube-embed&sfp_email=&sfph_mail=; https://swisskyrepo.github.io/PayloadsAllTheThings/File%20Inclusion/#lfi-to-rce-via-php-pearcmd
CVE: CVE-2024-5858
Published: 2024-06-15
Description: The AI Infographic Maker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the qcld_openai_title_generate_desc AJAX action in all versions up to, and including, 4.7.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary post titles.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/infographic-and-list-builder-ilist/trunk/qc-project-ilist-ajax.php?rev=3102295#L447; https://plugins.trac.wordpress.org/changeset/3102754/infographic-and-list-builder-ilist/trunk/qc-project-ilist-ajax.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/4c8f1c29-b99d-4af0-9cc4-5d6179529ab4?source=cve
CVE: CVE-2024-5611
Published: 2024-06-15
Description: The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘label_years’ attribute within the Countdown widget in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/stratum/tags/1.4.0/includes/templates/countdown.php#L66; https://plugins.trac.wordpress.org/changeset/3102765#file1; https://www.wordfence.com/threat-intel/vulnerabilities/id/840dd4a9-103a-4ff9-ba26-3bf5b6e831a1?source=cve
CVE: CVE-2024-6005
Published: 2024-06-15
Description: A vulnerability was found in ZKTeco ZKBio CVSecurity V5000 4.1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Department Section. The manipulation of the argument Department Name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor explains, "that ZKBio Security V5000 has been withdrawn from the market and [is] recommended for upgrading to the ZKBio CVSecurity latest version." This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://vuldb.com/?ctiid.268693; https://vuldb.com/?id.268693; https://vuldb.com/?submit.351241
CVE: CVE-2024-6006
Published: 2024-06-15
Description: A vulnerability was found in ZKTeco ZKBio CVSecurity V5000 4.1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Summer Schedule Handler. The manipulation of the argument Schedule Name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor explains, "that ZKBio Security V5000 has been withdrawn from the market and [is] recommended for upgrading to the ZKBio CVSecurity latest version." This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://vuldb.com/?ctiid.268694; https://vuldb.com/?id.268694; https://vuldb.com/?submit.351403