deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-51672
Published: 2024-04-11
Description: Missing Authorization vulnerability in FunnelKit FunnelKit Checkout.This issue affects FunnelKit Checkout: from n/a through 3.10.3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/woofunnels-aero-checkout/wordpress-funnelkit-checkout-plugin-3-10-3-unauthenticated-arbitrary-post-page-deletion-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woofunnels-aero-checkout/wordpress-funnelkit-checkout-plugin-3-10-3-unauthenticated-arbitrary-post-page-deletion-vulnerability?_s_id=cve
CVE: CVE-2024-24850
Published: 2024-04-11
Description: Missing Authorization vulnerability in Mark Stockton Quicksand Post Filter jQuery Plugin.This issue affects Quicksand Post Filter jQuery Plugin: from n/a through 3.1.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/quicksand-jquery-post-filter/wordpress-quicksand-post-filter-jquery-plugin-3-1-1-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/quicksand-jquery-post-filter/wordpress-quicksand-post-filter-jquery-plugin-3-1-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-24883
Published: 2024-04-11
Description: Missing Authorization vulnerability in BdThemes Prime Slider – Addons For Elementor.This issue affects Prime Slider – Addons For Elementor: from n/a through 3.11.10.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/bdthemes-prime-slider-lite/wordpress-prime-slider-plugin-3-11-10-broken-access-control-on-duplicate-post-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/bdthemes-prime-slider-lite/wordpress-prime-slider-plugin-3-11-10-broken-access-control-on-duplicate-post-vulnerability?_s_id=cve
CVE: CVE-2024-25907
Published: 2024-04-11
Description: Missing Authorization vulnerability in JoomUnited WP Media folder.This issue affects WP Media folder: from n/a through 5.7.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/wp-media-folder/wordpress-wp-media-folder-plugin-5-7-2-plugin-settings-change-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-media-folder/wordpress-wp-media-folder-plugin-5-7-2-plugin-settings-change-vulnerability?_s_id=cve
CVE: CVE-2024-25908
Published: 2024-04-11
Description: Missing Authorization vulnerability in JoomUnited WP Media folder.This issue affects WP Media folder: from n/a through 5.7.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/wp-media-folder/wordpress-wp-media-folder-plugin-5-7-2-subscriber-arbitrary-post-page-modification-title-excerpt-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-media-folder/wordpress-wp-media-folder-plugin-5-7-2-subscriber-arbitrary-post-page-modification-title-excerpt-vulnerability?_s_id=cve
CVE: CVE-2024-25912
Published: 2024-04-11
Description: Missing Authorization vulnerability in Skymoonlabs MoveTo.This issue affects MoveTo: from n/a through 6.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/moveto/wordpress-moveto-plugin-6-2-unauthenticated-arbitrary-wordpress-settings-change-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/moveto/wordpress-moveto-plugin-6-2-unauthenticated-arbitrary-wordpress-settings-change-vulnerability?_s_id=cve
CVE: CVE-2024-25922
Published: 2024-04-11
Description: Missing Authorization vulnerability in Peach Payments Peach Payments Gateway.This issue affects Peach Payments Gateway: from n/a through 3.1.9.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/wc-peach-payments-gateway/wordpress-peach-payments-gateway-plugin-3-1-9-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wc-peach-payments-gateway/wordpress-peach-payments-gateway-plugin-3-1-9-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-25935
Published: 2024-04-11
Description: Missing Authorization vulnerability in Metagauss RegistrationMagic.This issue affects RegistrationMagic: from n/a through 5.2.5.9.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/custom-registration-form-builder-with-submission-manager/wordpress-registrationmagic-plugin-5-2-5-9-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/custom-registration-form-builder-with-submission-manager/wordpress-registrationmagic-plugin-5-2-5-9-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-27683
Published: 2024-04-11
Description: D-Link Go-RT-AC750 GORTAC750_A1_FW_v101b03 contains a stack-based buffer overflow via the function hnap_main. An attacker can send a POST request to trigger the vulnerablilify.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://drive.google.com/file/d/18RhbBnaD_kH16Y6C-7TpSSPUmYKKyU_k/view; https://gist.github.com/sunwithmoon/428c3871482a600382fec0a1994a518b; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2024-27966
Published: 2024-04-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master allows Stored XSS.This issue affects Quiz And Survey Master: from n/a through 8.2.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/quiz-master-next/wordpress-quiz-and-survey-master-plugin-8-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/quiz-master-next/wordpress-quiz-and-survey-master-plugin-8-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-27967
Published: 2024-04-11
Description: Cross-Site Request Forgery (CSRF) vulnerability in Michael Leithold DSGVO All in one for WP.This issue affects DSGVO All in one for WP: from n/a through 4.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/dsgvo-all-in-one-for-wp/wordpress-dsgvo-all-in-one-for-wp-plugin-4-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/dsgvo-all-in-one-for-wp/wordpress-dsgvo-all-in-one-for-wp-plugin-4-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-27969
Published: 2024-04-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Enhanced Free Downloads WooCommerce allows Stored XSS.This issue affects Free Downloads WooCommerce: from n/a through 3.5.8.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/download-now-for-woocommerce/wordpress-free-downloads-woocommerce-plugin-3-5-8-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/download-now-for-woocommerce/wordpress-free-downloads-woocommerce-plugin-3-5-8-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-27970
Published: 2024-04-11
Description: Missing Authorization vulnerability in BogdanFix WP SendFox.This issue affects WP SendFox: from n/a through 1.3.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/wp-sendfox/wordpress-wp-sendfox-plugin-1-3-0-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-sendfox/wordpress-wp-sendfox-plugin-1-3-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-27985
Published: 2024-04-11
Description: Deserialization of Untrusted Data vulnerability in PropertyHive.This issue affects PropertyHive: from n/a through 2.0.9.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-502
References: https://patchstack.com/database/vulnerability/propertyhive/wordpress-propertyhive-plugin-2-0-9-php-object-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/propertyhive/wordpress-propertyhive-plugin-2-0-9-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2024-27988
Published: 2024-04-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WEN Themes WEN Responsive Columns allows Stored XSS.This issue affects WEN Responsive Columns: from n/a through 1.3.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wen-responsive-columns/wordpress-wen-responsive-columns-plugin-1-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wen-responsive-columns/wordpress-wen-responsive-columns-plugin-1-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-27989
Published: 2024-04-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in I Thirteen Web Solution WP Responsive Tabs horizontal vertical and accordion Tabs allows Stored XSS.This issue affects WP Responsive Tabs horizontal vertical and accordion Tabs: from n/a through 1.1.17.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/responsive-horizontal-vertical-and-accordion-tabs/wordpress-wp-responsive-tabs-horizontal-vertical-and-accordion-tabs-plugin-1-1-17-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/responsive-horizontal-vertical-and-accordion-tabs/wordpress-wp-responsive-tabs-horizontal-vertical-and-accordion-tabs-plugin-1-1-17-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-27990
Published: 2024-04-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The Moneytizer allows Stored XSS.This issue affects The Moneytizer: from n/a through 9.5.20.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/the-moneytizer/wordpress-the-moneytizer-plugin-9-5-20-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/the-moneytizer/wordpress-the-moneytizer-plugin-9-5-20-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-27991
Published: 2024-04-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SupportCandy allows Stored XSS.This issue affects SupportCandy: from n/a through 3.2.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/supportcandy/wordpress-supportcandy-plugin-3-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/supportcandy/wordpress-supportcandy-plugin-3-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-27992
Published: 2024-04-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Whisper Link Whisper Free allows Reflected XSS.This issue affects Link Whisper Free: from n/a through 0.6.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/link-whisper/wordpress-link-whisper-free-plugin-0-6-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/link-whisper/wordpress-link-whisper-free-plugin-0-6-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-28402
Published: 2024-04-11
Description: TOTOLINK X2000R before V1.0.0-B20[PII_REDACTED] contains a Stored Cross-site scripting (XSS) vulnerability in IP/Port Filtering under the Firewall Page.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://github.com/4hsien/CVE-vulns/blob/main/TOTOLINK/X2000R/XSS_4_IP_Port_Filtering/XSS.md; https://www.totolink.net/home/menu/detail/menu_listtpl/products/id/242/ids/33.html; https://github.com/4hsien/CVE-vulns/blob/main/TOTOLINK/X2000R/XSS_4_IP_Port_Filtering/XSS.md
CVE: CVE-2024-29019
Published: 2024-04-11
Description: ESPHome is a system to control microcontrollers remotely through Home Automation systems. API endpoints in dashboard component of ESPHome version 2023.12.9 (command line installation) are vulnerable to Cross-Site Request Forgery (CSRF) allowing remote attackers to carry out attacks against a logged user of the dashboard to perform operations on configuration files (create, edit, delete). It is possible for a malicious actor to create a specifically crafted web page that triggers a cross site request against ESPHome, this allows bypassing the authentication for API calls on the platform. This vulnerability allows bypassing authentication on API calls accessing configuration file operations on the behalf of a logged user. In order to trigger the vulnerability, the victim must visit a weaponized page. In addition to this, it is possible to chain this vulnerability with GHSA-9p43-hj5j-96h5/ CVE-2024-27287 to obtain a complete takeover of the user account. Version 2024.3.0 contains a patch for this issue.


CVSS Score: 8.1 (HIGH)
CWE: CWE-352
References: https://github.com/advisories/GHSA-9p43-hj5j-96h5; https://github.com/esphome/esphome/security/advisories/GHSA-5925-88xh-6h99; https://github.com/advisories/GHSA-9p43-hj5j-96h5
CVE: CVE-2024-29937
Published: 2024-04-11
Description: NFS in a BSD derived codebase, as used in OpenBSD through 7.4 and FreeBSD through 14.0-RELEASE, allows remote attackers to execute arbitrary code via a bug that is unrelated to memory corruption.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://news.ycombinator.com/item?id=39778203; https://t2.fi/schedule/2024/; https://www.signedness.org/t2.fi.2024/
CVE: CVE-2024-2740
Published: 2024-04-11
Description: Information exposure vulnerability in Planet IGS-4215-16T2S, affecting firmware version 1.305b210528. This vulnerability could allow a remote attacker to access some administrative resources due to lack of proper management of the Switch web interface.
CVSS Score: 7.7 (HIGH)
CWE: CWE-200
References: https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-planet-igs-4215-16t2s; https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-planet-igs-4215-16t2s
CVE: CVE-2024-2741
Published: 2024-04-11
Description: Cross-Site Request Forgery (CSRF) vulnerability in Planet IGS-4215-16T2S, affecting firmware version 1.305b210528. This vulnerability could allow a remote attacker to trick some authenticated users into performing actions in their session, such as adding or updating accounts through the Switch web interface.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-planet-igs-4215-16t2s; https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-planet-igs-4215-16t2s
CVE: CVE-2024-2742
Published: 2024-04-11
Description: Operating system command injection vulnerability in Planet IGS-4215-16T2S, affecting firmware version 1.305b210528. An authenticated attacker could execute arbitrary code on the remote host by exploiting IP address functionality.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-78
References: https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-planet-igs-4215-16t2s; https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-planet-igs-4215-16t2s
CVE: CVE-2023-6811
Published: 2024-04-11
Description: The Language Translate Widget for WordPress – ConveyThis plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'api_key’ parameter in all versions up to, and including, 223 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3067865%40conveythis-translate%2Ftrunk&old=3062168%40conveythis-translate%2Ftrunk&sfp_email=&sfph_mail=#file5; https://www.wordfence.com/threat-intel/vulnerabilities/id/093af92e-bbc2-463a-8547-0e48fb356655?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3067865%40conveythis-translate%2Ftrunk&old=3062168%40conveythis-translate%2Ftrunk&sfp_email=&sfph_mail=#file5
CVE: CVE-2024-29452
Published: 2024-04-11
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability.
CVE: CVE-2024-3614
Published: 2024-04-11
Description: A vulnerability classified as problematic has been found in SourceCodester Warehouse Management System 1.0. This affects an unknown part of the file customer.php. The manipulation of the argument nama_customer/alamat_customer/notelp_customer leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-260271.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/fubxx/CVE/blob/main/WarehouseManagementSystemXSS3.md; https://vuldb.com/?ctiid.260271; https://vuldb.com/?id.260271
CVE: CVE-2024-3616
Published: 2024-04-11
Description: A vulnerability classified as problematic was found in SourceCodester Warehouse Management System 1.0. This vulnerability affects unknown code of the file pengguna.php. The manipulation of the argument admin_user/admin_nama/admin_alamat/admin_telepon leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-260272.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/fubxx/CVE/blob/main/WarehouseManagementSystemXSS4.md; https://vuldb.com/?ctiid.260272; https://vuldb.com/?id.260272
CVE: CVE-2024-3617
Published: 2024-04-11
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Kortex Lite Advocate Office Management System 1.0. This issue affects some unknown processing of the file /control/deactivate_case.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260273 was assigned to this vulnerability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://github.com/zyairelai/CVE-submissions/blob/main/kortex-deactivate_case-sqli.md; https://vuldb.com/?ctiid.260273; https://vuldb.com/?id.260273
CVE: CVE-2024-3652
Published: 2024-04-11
Description: The Libreswan Project was notified of an issue causing libreswan to restart when using IKEv1 without specifying an esp= line. When the peer requests AES-GMAC, libreswan's default proposal handler causes an assertion failure and crashes and restarts. IKEv2 connections are not affected.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-404
References: http://www.openwall.com/lists/oss-security/2024/04/18/2; https://libreswan.org/security/CVE-2024-3652; http://www.openwall.com/lists/oss-security/2024/04/18/2
CVE: CVE-2024-25572
Published: 2024-04-11
Description: Cross-site request forgery (CSRF) vulnerability exists in Ninja Forms prior to 3.4.31. If a website administrator views a malicious page while logging in, unintended operations may be performed.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://jvn.jp/en/jp/JVN50361500/; https://ninjaforms.com/; https://wordpress.org/plugins/ninja-forms/
CVE: CVE-2024-26019
Published: 2024-04-11
Description: Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in submit processing. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is accessing to the website using the product.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN50361500/; https://ninjaforms.com/; https://wordpress.org/plugins/ninja-forms/
CVE: CVE-2024-29220
Published: 2024-04-11
Description: Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in custom fields for labels. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is accessing to the website using the product.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN50361500/; https://ninjaforms.com/; https://wordpress.org/plugins/ninja-forms/
CVE: CVE-2024-3618
Published: 2024-04-11
Description: A vulnerability, which was classified as critical, was found in SourceCodester Kortex Lite Advocate Office Management System 1.0. Affected is an unknown function of the file /control/activate_case.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-260274 is the identifier assigned to this vulnerability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://github.com/zyairelai/CVE-submissions/blob/main/kortex-activate_case-sqli.md; https://vuldb.com/?ctiid.260274; https://vuldb.com/?id.260274
CVE: CVE-2024-3619
Published: 2024-04-11
Description: A vulnerability has been found in SourceCodester Kortex Lite Advocate Office Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /control/addcase_stage.php. The manipulation of the argument cname leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-260275.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://github.com/zyairelai/CVE-submissions/blob/main/kortex-addcase_stage-sqli.md; https://vuldb.com/?ctiid.260275; https://vuldb.com/?id.260275
CVE: CVE-2024-3620
Published: 2024-04-11
Description: A vulnerability was found in SourceCodester Kortex Lite Advocate Office Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /control/adds.php. The manipulation of the argument name/gender/dob/email/mobile/address leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-260276.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://github.com/zyairelai/CVE-submissions/blob/main/kortex-adds-sqli.md; https://vuldb.com/?ctiid.260276; https://vuldb.com/?id.260276
CVE: CVE-2024-29448
Published: 2024-04-11
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability.
CVE: CVE-2024-29449
Published: 2024-04-11
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability.
CVE: CVE-2024-29450
Published: 2024-04-11
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability.
CVE: CVE-2024-3621
Published: 2024-04-11
Description: A vulnerability was found in SourceCodester Kortex Lite Advocate Office Management System 1.0. It has been classified as critical. This affects an unknown part of the file /control/register_case.php. The manipulation of the argument title/case_no/client_name/court/case_type/case_stage/legel_acts/description/filling_date/hearing_date/opposite_lawyer/total_fees/unpaid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260277 was assigned to this vulnerability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://github.com/zyairelai/CVE-submissions/blob/main/kortex-register_case-sqli.md; https://vuldb.com/?ctiid.260277; https://vuldb.com/?id.260277