deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-34252
Published: 2023-06-14
Description: Grav is a flat-file content management system. Prior to version 1.7.42, there is a logic flaw in the `GravExtension.filterFilter()` function whereby validation against a denylist of unsafe functions is only performed when the argument passed to filter is a string. However, passing an array as a callable argument allows the validation check to be skipped. Consequently, a low privileged attacker with login access to Grav Admin panel and page creation/update permissions is able to inject malicious templates to obtain remote code execution. The vulnerability can be found in the `GravExtension.filterFilter()` function declared in `/system/src/Grav/Common/Twig/Extension/GravExtension.php`. Version 1.7.42 contains a patch for this issue. End users should also ensure that `twig.undefined_functions` and `twig.undefined_filters` properties in `/path/to/webroot/system/config/system.yaml` configuration file are set to `false` to disallow Twig from treating undefined filters/functions as PHP functions and executing them.
CVSS Score: 8.8 (HIGH)
CWE: CWE-184, CWE-1336, CWE-94
References: https://github.com/getgrav/grav/blob/1.7.40/system/src/Grav/Common/Twig/Extension/GravExtension.php#L1692-L1698; https://github.com/getgrav/grav/blob/1.7.40/system/src/Grav/Common/Utils.php#L1956-L2074; https://github.com/getgrav/grav/commit/244758d4383034fe4cd292d41e477177870b65ec
CVE: CVE-2023-34253
Published: 2023-06-14
Description: Grav is a flat-file content management system. Prior to version 1.7.42, the denylist introduced in commit 9d6a2d to prevent dangerous functions from being executed via injection of malicious templates was insufficient and could be easily subverted in multiple ways -- (1) using unsafe functions that are not banned, (2) using capitalised callable names, and (3) using fully-qualified names for referencing callables. Consequently, a low privileged attacker with login access to Grav Admin panel and page creation/update permissions is able to inject malicious templates to obtain remote code execution. A patch in version 1.7.42 improves the denylist.
CVSS Score: 8.8 (HIGH)
CWE: CWE-184, CWE-1336, CWE-94
References: https://github.com/getgrav/grav/blob/1.7.40/system/src/Grav/Common/Utils.php#L1952-L2190; https://github.com/getgrav/grav/commit/71bbed12f950de8335006d7f91112263d8504f1b; https://github.com/getgrav/grav/security/advisories/GHSA-j3v8-v77f-fvgm
CVE: CVE-2023-34448
Published: 2023-06-14
Description: Grav is a flat-file content management system. Prior to version 1.7.42, the patch for CVE-2022-2073, a server-side template injection vulnerability in Grav leveraging the default `filter()` function, did not block other built-in functions exposed by Twig's Core Extension that could be used to invoke arbitrary unsafe functions, thereby allowing for remote code execution. A patch in version 1.74.2 overrides the built-in Twig `map()` and `reduce()` filter functions in `system/src/Grav/Common/Twig/Extension/GravExtension.php` to validate the argument passed to the filter in `$arrow`.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-1336, CWE-94
References: https://github.com/getgrav/grav/commit/8c2c1cb72611a399f13423fc6d0e1d998c03e5c8; https://github.com/getgrav/grav/security/advisories/GHSA-whr7-m3f8-mpm8; https://github.com/twigphp/Twig/blob/v1.44.7/src/Environment.php#L148
CVE: CVE-2023-34452
Published: 2023-06-14
Description: Grav is a flat-file content management system. In versions 1.7.42 and prior, the "/forgot_password" page has a self-reflected cross-site scripting vulnerability that can be exploited by injecting a script into the "email" parameter of the request. While this vulnerability can potentially allow an attacker to execute arbitrary code on the user's browser, the impact is limited as it requires user interaction to trigger the vulnerability. As of time of publication, a patch is not available. Server-side validation should be implemented to prevent this vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/getgrav/grav/security/advisories/GHSA-xcr8-cc2j-62fc; https://github.com/getgrav/grav/security/advisories/GHSA-xcr8-cc2j-62fc
CVE: CVE-2022-22307
Published: 2023-06-15
Description: IBM Security Guardium 11.3, 11.4, and 11.5 could allow a local user to obtain elevated privileges due to incorrect authorization checks.  IBM X-Force ID:  216753.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/216753; https://www.ibm.com/support/pages/node/6999317; https://exchange.xforce.ibmcloud.com/vulnerabilities/216753
CVE: CVE-2023-25683
Published: 2023-06-15
Description: IBM PowerVM Hypervisor FW950.00 through FW950.71, FW1010.00 through FW1010.40, FW1020.00 through FW1020.20, and FW1030.00 through FW1030.11 could allow an attacker to obtain sensitive information if they gain service access to the HMC.  IBM X-Force ID:  247592.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/247592; https://www.ibm.com/support/pages/node/7002721; https://exchange.xforce.ibmcloud.com/vulnerabilities/247592
CVE: CVE-2022-33159
Published: 2023-06-15
Description: IBM Security Directory Suite VA 8.0.1 through 8.0.1.19 stores user credentials in plain clear text which can be read by an authenticated user.  IBM X-Force ID:  228567.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-312
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/228567; https://www.ibm.com/support/pages/node/7001693; https://exchange.xforce.ibmcloud.com/vulnerabilities/228567
CVE: CVE-2022-33163
Published: 2023-06-15
Description: IBM Security Directory Suite VA 8.0.1 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.  IBM X-Force ID:  228571.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-732, CWE-732
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/228571; https://www.ibm.com/support/pages/node/7001885; https://exchange.xforce.ibmcloud.com/vulnerabilities/228571
CVE: CVE-2022-33168
Published: 2023-06-15
Description: IBM Security Directory Suite VA 8.0.1 could allow an attacker to cause a denial of service due to uncontrolled resource consumption.  IBM X-Force ID:  228588.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/228588; https://www.ibm.com/support/pages/node/7001885; https://exchange.xforce.ibmcloud.com/vulnerabilities/228588
CVE: CVE-2022-32752
Published: 2023-06-15
Description: IBM Security Directory Suite VA 8.0.1 through 8.0.1.19 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request.  IBM X-Force ID:  228439.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/228439; https://www.ibm.com/support/pages/node/7001693; https://exchange.xforce.ibmcloud.com/vulnerabilities/228439
CVE: CVE-2022-32757
Published: 2023-06-15
Description: IBM Security Directory Suite VA 8.0.1 through 8.0.1.19 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.  IBM X-Force ID:  228510.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307, CWE-307
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/228510; https://www.ibm.com/support/pages/node/7001693; https://exchange.xforce.ibmcloud.com/vulnerabilities/228510
CVE: CVE-2022-33166
Published: 2023-06-15
Description: IBM Security Directory Suite VA 8.0.1 through 8.0.1.19 could allow a privileged user to upload malicious files of dangerous types that can be automatically processed within the product's environment.  IBM X-Force ID:  228586.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-434
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/228586; https://www.ibm.com/support/pages/node/7001693; https://exchange.xforce.ibmcloud.com/vulnerabilities/228586
CVE: CVE-2023-35029
Published: 2023-06-15
Description: Open redirect vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update 70 through 76 allows remote attackers to redirect users to arbitrary external URLs via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-35029; https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-35029
CVE: CVE-2023-3193
Published: 2023-06-15
Description: Cross-site scripting (XSS) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.73, and Liferay DXP 7.4 update 70 through 73 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-3193; https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-3193
CVE: CVE-2023-2270
Published: 2023-06-15
Description: The Netskope client service running with NT\SYSTEM privileges accepts network connections from localhost to start various services and execute commands. The connection handling function of Netskope client before R100 in this service utilized a relative path to download and unzip configuration files on the machine. This relative path provided a way for local users to write arbitrary files at a location which is accessible to only higher privileged users. This can be exploited by local users to execute code with NT\SYSTEM privileges on the end machine.
CVSS Score: 7.0 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.netskope.com/company/security-compliance-and-assurance/security-advisories-and-disclosures/netskope-security-advisory-nskpsa-2023-001; https://www.netskope.com/company/security-compliance-and-assurance/security-advisories-and-disclosures/netskope-security-advisory-nskpsa-2023-001
CVE: CVE-2023-35030
Published: 2023-06-15
Description: Cross-site request forgery (CSRF) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update 70 through 76 allows remote attackers to execute arbitrary code in the scripting console via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-35030; https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-35030
CVE: CVE-2022-4149
Published: 2023-06-15
Description: The Netskope client service (prior to R96) on Windows runs as NT AUTHORITY\SYSTEM which writes log files to a writable directory (C:\Users\Public\netSkope) for a standard user. The files are created and written with a SYSTEM account except one file (logplaceholder) which inherits permission giving all users full access control list. Netskope client restricts access to this file by allowing only read permissions as a standard user. Whenever the Netskope client service restarts, it deletes the logplaceholder and recreates, creating a race condition, which can be exploited by a malicious local user to create the file and set ACL permissions on the file. Once the file is created by a malicious user with proper ACL permissions, all files within C:\Users\Public\netSkope\ becomes modifiable by the unprivileged user. By using Windows pseudo-symlink, these files can be pointed to other places in the system and thus malicious users will be able to elevate privileges.

CVSS Score: 7.0 (HIGH)
CWE: CWE-367, CWE-367
References: https://www.netskope.com/company/security-compliance-and-assurance/security-advisories-and-disclosures/netskope-security-advisory-nskpsa-2023-002; https://www.netskope.com/company/security-compliance-and-assurance/security-advisories-and-disclosures/netskope-security-advisory-nskpsa-2023-002
CVE: CVE-2023-2847
Published: 2023-06-15
Description: 
During internal security analysis, a local privilege escalation vulnerability has been identified. On a machine with the affected ESET product installed, it was possible for a user with lower privileges due to improper privilege management to trigger actions with root privileges.

ESET remedied this possible attack vector and has prepared new builds of its products that are no longer susceptible to this vulnerability.




CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-269
References: https://support.eset.com/en/ca8447; https://support.eset.com/en/ca8447
CVE: CVE-2023-28175
Published: 2023-06-15
Description: Improper Authorization in SSH server in Bosch VMS 11.0, 11.1.0, and 11.1.1 allows a remote authenticated user to access resources within the trusted internal network via a port forwarding request.
CVSS Score: 7.1 (HIGH)
CWE: CWE-200, CWE-863
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-025794-bt.html; https://psirt.bosch.com/security-advisories/BOSCH-SA-025794-bt.html
CVE: CVE-2023-32229
Published: 2023-06-15
Description: Due to an error in the software interface to the secure element chip on Bosch IP cameras of family CPP13 and CPP14, the chip can be permanently damaged when enabling the Stream security option (signing of the video stream) with option MD5, SHA-1 or SHA-256.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-1246, CWE-400
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-435698-BT.html; https://psirt.bosch.com/security-advisories/BOSCH-SA-435698-BT.html
CVE: CVE-2023-25449
Published: 2023-06-15
Description: Cross-Site Request Forgery (CSRF) vulnerability in Oliver Seidel, Bastian Germann cformsII plugin <= 15.0.4 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/cforms2/wordpress-cformsii-plugin-15-0-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/cforms2/wordpress-cformsii-plugin-15-0-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-23802
Published: 2023-06-15
Description: Cross-Site Request Forgery (CSRF) vulnerability in HasThemes HT Easy GA4 ( Google Analytics 4 ) plugin <= 1.0.6 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/ht-easy-google-analytics/wordpress-ht-easy-ga4-google-analytics-4-plugin-1-0-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ht-easy-google-analytics/wordpress-ht-easy-ga4-google-analytics-4-plugin-1-0-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-25450
Published: 2023-06-15
Description: Cross-Site Request Forgery (CSRF) vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform plugin <= 2.25.1 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/give/wordpress-givewp-plugin-2-25-1-cross-site-request-forgery-csrf-via-give-cache-flush-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/give/wordpress-givewp-plugin-2-25-1-cross-site-request-forgery-csrf-via-give-cache-flush-vulnerability?_s_id=cve
CVE: CVE-2023-25972
Published: 2023-06-15
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in IKSWEB WordPress Старт plugin <= 3.7 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/iksweb/wordpress-start-plugin-3-6-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/iksweb/wordpress-start-plugin-3-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-3274
Published: 2023-06-15
Description: A vulnerability classified as critical has been found in code-projects Supplier Management System 1.0. Affected is an unknown function of the file btn_functions.php of the component Picture Handler. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231624.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/wuyangzihan/SUPPLIER-MANAGEMENT-SYSTEM/blob/main/SUPPLIER%20MANAGEMENT%20SYSTEM%20has%20a%20file%20upload%20(RCE)%20vulnerability.pdf; https://vuldb.com/?ctiid.231624; https://vuldb.com/?id.231624
CVE: CVE-2023-3275
Published: 2023-06-15
Description: A vulnerability classified as critical was found in PHPGurukul Rail Pass Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /view-pass-detail.php of the component POST Request Handler. The manipulation of the argument searchdata leads to sql injection. The attack can be launched remotely. The identifier VDB-231625 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.231625; https://vuldb.com/?id.231625; https://vuldb.com/?ctiid.231625
CVE: CVE-2023-3276
Published: 2023-06-15
Description: A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19. Affected by this issue is the function readBySax of the file XmlUtil.java of the component XML Parsing Module. The manipulation leads to xml external entity reference. The exploit has been disclosed to the public and may be used. VDB-231626 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://fbdhhhh47.github.io/2023/06/06/hutool-XXE/; https://vuldb.com/?ctiid.231626; https://vuldb.com/?id.231626
CVE: CVE-2023-24420
Published: 2023-06-15
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Zestard Technologies Admin side data storage for Contact Form 7 plugin <= 1.1.1 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/admin-side-data-storage-for-contact-form-7/wordpress-admin-side-data-storage-for-contact-form-7-plugin-1-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/admin-side-data-storage-for-contact-form-7/wordpress-admin-side-data-storage-for-contact-form-7-plugin-1-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-25055
Published: 2023-06-15
Description: Cross-Site Request Forgery (CSRF) vulnerability in Amit Agarwal Google XML Sitemap for Videos plugin <= 2.6.1 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/xml-sitemaps-for-videos/wordpress-google-xml-sitemap-for-videos-plugin-2-6-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/xml-sitemaps-for-videos/wordpress-google-xml-sitemap-for-videos-plugin-2-6-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-27634
Published: 2023-06-15
Description: Cross-Site Request Forgery (CSRF) vulnerability allows arbitrary file upload in Shingo Intrepidity plugin <= 1.5.1 versions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/intrepidity/wordpress-intrepidity-theme-1-5-1-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/intrepidity/wordpress-intrepidity-theme-1-5-1-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2023-34626
Published: 2023-06-15
Description: Piwigo 13.7.0 is vulnerable to SQL Injection via the "Users" function.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Piwigo/Piwigo/issues/1924; https://github.com/Piwigo/Piwigo/issues/1924
CVE: CVE-2023-34453
Published: 2023-06-15
Description: snappy-java is a fast compressor/decompressor for Java. Due to unchecked multiplications, an integer overflow may occur in versions prior to 1.1.10.1, causing a fatal error.

The function `shuffle(int[] input)` in the file `BitShuffle.java` receives an array of integers and applies a bit shuffle on it. It does so by multiplying the length by 4 and passing it to the natively compiled shuffle function. Since the length is not tested, the multiplication by four can cause an integer overflow and become a smaller value than the true size, or even zero or negative. In the case of a negative value, a `java.lang.NegativeArraySizeException` exception will raise, which can crash the program. In a case of a value that is zero or too small, the code that afterwards references the shuffled array will assume a bigger size of the array, which might cause exceptions such as `java.lang.ArrayIndexOutOfBoundsException`.

The same issue exists also when using the `shuffle` functions that receive a double, float, long and short, each using a different multiplier that may cause the same issue.

Version 1.1.10.1 contains a patch for this vulnerability.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-190
References: https://github.com/xerial/snappy-java/blob/05c39b2ca9b5b7b39611529cc302d3d796329611/src/main/java/org/xerial/snappy/BitShuffle.java#L107; https://github.com/xerial/snappy-java/blob/master/src/main/java/org/xerial/snappy/BitShuffle.java; https://github.com/xerial/snappy-java/commit/820e2e074c58748b41dbd547f4edba9e108ad905
CVE: CVE-2023-34454
Published: 2023-06-15
Description: snappy-java is a fast compressor/decompressor for Java. Due to unchecked multiplications, an integer overflow may occur in versions prior to 1.1.10.1, causing an unrecoverable fatal error.

The function `compress(char[] input)` in the file `Snappy.java` receives an array of characters and compresses it. It does so by multiplying the length by 2 and passing it to the rawCompress` function.

Since the length is not tested, the multiplication by two can cause an integer overflow and become negative. The rawCompress function then uses the received length and passes it to the natively compiled maxCompressedLength function, using the returned value to allocate a byte array.

Since the maxCompressedLength function treats the length as an unsigned integer, it doesn’t care that it is negative, and it returns a valid value, which is casted to a signed integer by the Java engine. If the result is negative, a `java.lang.NegativeArraySizeException` exception will be raised while trying to allocate the array `buf`. On the other side, if the result is positive, the `buf` array will successfully be allocated, but its size might be too small to use for the compression, causing a fatal Access Violation error.

The same issue exists also when using the `compress` functions that receive double, float, int, long and short, each using a different multiplier that may cause the same issue. The issue most likely won’t occur when using a byte array, since creating a byte array of size 0x80000000 (or any other negative value) is impossible in the first place.

Version 1.1.10.1 contains a patch for this issue.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-190
References: https://github.com/xerial/snappy-java/blob/05c39b2ca9b5b7b39611529cc302d3d796329611/src/main/java/org/xerial/snappy/Snappy.java#L169; https://github.com/xerial/snappy-java/blob/05c39b2ca9b5b7b39611529cc302d3d796329611/src/main/java/org/xerial/snappy/Snappy.java#L422; https://github.com/xerial/snappy-java/blob/master/src/main/java/org/xerial/snappy/Snappy.java
CVE: CVE-2023-34666
Published: 2023-06-15
Description: Cross-site scripting (XSS) vulnerability in Phpgurukul Cyber Cafe Management System 1.0 allows remote attackers to inject arbitrary web script or HTML via the admin username parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.exploit-db.com/exploits/49204; https://www.exploit-db.com/exploits/49204