deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-8576
Published: 2025-08-07
Description: Use after free in Extensions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2025/08/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/414760982
CVE: CVE-2025-8577
Published: 2025-08-07
Description: Inappropriate implementation in Picture In Picture in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://chromereleases.googleblog.com/2025/08/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/384050903
CVE: CVE-2025-8578
Published: 2025-08-07
Description: Use after free in Cast in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2025/08/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/423387026
CVE: CVE-2025-8579
Published: 2025-08-07
Description: Inappropriate implementation in Picture In Picture in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://chromereleases.googleblog.com/2025/08/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/407791462
CVE: CVE-2025-8580
Published: 2025-08-07
Description: Inappropriate implementation in Filesystems in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://chromereleases.googleblog.com/2025/08/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/411544197
CVE: CVE-2025-8581
Published: 2025-08-07
Description: Inappropriate implementation in Extensions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://chromereleases.googleblog.com/2025/08/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/416942878
CVE: CVE-2025-8582
Published: 2025-08-07
Description: Insufficient validation of untrusted input in Core in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://chromereleases.googleblog.com/2025/08/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/40089450
CVE: CVE-2025-8583
Published: 2025-08-07
Description: Inappropriate implementation in Permissions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-451
References: https://chromereleases.googleblog.com/2025/08/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/373794472
CVE: CVE-2025-32094
Published: 2025-08-07
Description: An issue was discovered in Akamai Ghost, as used for the Akamai CDN platform before 2025-03-26. Under certain circumstances, a client making an HTTP/1.x OPTIONS request with an "Expect: 100-continue" header, and using obsolete line folding, can lead to a discrepancy in how two in-path Akamai servers interpret the request, allowing an attacker to smuggle a second request in the original request body.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-444
References: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/100; https://www.akamai.com/blog/security/cve-2025-32094-http-request-smuggling; https://www.blackhat.com/us-25/briefings/schedule/#http1-must-die-the-desync-endgame-45103
CVE: CVE-2025-29866
Published: 2025-08-07
Description: : External Control of File Name or Path vulnerability in TAGFREE X-Free Uploader XFU allows : Parameter Injection.This issue affects X-Free Uploader: from 1.0.1.0084 before 1.0.1.0085, from 2.0.1.0034 before 2.0.1.0035.
CWE: CWE-73
References: https://www.boho.or.kr/kr/bbs/view.do?searchCnd=&bbsId=B0000302&searchWrd=&menuNo=205023&pageIndex=1&categoryCode=&nttId=71827
CVE: CVE-2025-35970
Published: 2025-08-07
Description: On multiple products of SEIKO EPSON and FUJIFILM Corporation, the initial administrator password is easy to guess from the information available via SNMP. If the administrator password is not changed from the initial one, a remote attacker with SNMP access can log in to the product with the administrator privilege.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1391
References: https://global.fujifilm.com/en/news/hq/697e; https://jvn.jp/en/vu/JVNVU91363496/; https://www.epson.jp/support/misc_t/250807_oshirase.htm
CVE: CVE-2025-8533
Published: 2025-08-07
Description: A vulnerability was identified in the XPC services of Fantastical. The services failed to implement proper client authorization checks in its listener:shouldAcceptNewConnection method, unconditionally accepting requests from any local process. As a result, any local, unprivileged process could connect to the XPC service and access its methods.




This issue has been resolved in version 4.0.16.
CWE: CWE-863
References: https://cert.pl/en/posts/2025/08/CVE-2025-8533; https://flexibits.com/fantastical
CVE: CVE-2024-52680
Published: 2025-08-07
Description: EyouCMS 1.6.7 is vulnerable to Cross Site Scripting (XSS) in /login.php?m=admin&c=System&a=web&lang=cn.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.eyoucms.com; https://gist.github.com/cyb3res3c/c715407bfe6d418d8e6da61e1ab41fc8
CVE: CVE-2024-55401
Published: 2025-08-07
Description: An issue in 4C Strategies Exonaut before v22.4 allows attackers to execute a directory traversal.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://exonaut.com; https://gist.github.com/Jowu73/d157080aea62075a4d2c9bcf7a2e399c
CVE: CVE-2025-47188
Published: 2025-08-07
Description: A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 (R6.4.0.4006), and the 6970 Conference Unit through 6.4 SP4 (R6.4.0.4006) or version V1 R0.1.0, could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. A successful exploit could allow an attacker to execute arbitrary commands within the context of the phone, leading to disclosure or modification of sensitive configuration data or affecting device availability and operation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://www.mitel.com/support/security-advisories; https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2025-0004
CVE: CVE-2025-50952
Published: 2025-08-07
Description: openjpeg v 2.5.0 was discovered to contain a NULL pointer dereference via the component /openjp2/dwt.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/uclouvain/openjpeg/issues/1505; https://lists.debian.org/debian-lts-announce/2025/12/msg00035.html
CVE: CVE-2024-56339
Published: 2025-08-07
Description: IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7 could allow a remote attacker to bypass security restrictions caused by a failure to honor security configuration.
CVSS Score: 3.7 (LOW)
CWE: CWE-650
References: https://www.ibm.com/support/pages/node/7239955
CVE: CVE-2025-44779
Published: 2025-08-07
Description: An issue in Ollama v0.1.33 allows attackers to delete arbitrary files via sending a crafted packet to the endpoint /api/pull.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-20, CWE-552
References: https://a1batr0ss.top/2025/03/17/Ollama-arbitrary-file-deletion-vulnerability/; https://a1batr0ss.top/2025/08/06/CVE-2025-44779-Ollama-arbitrary-file-deletion/; https://github.com/ollama/ollama
CVE: CVE-2025-47907
Published: 2025-08-07
Description: Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://go.dev/cl/693735; https://go.dev/issue/74831; https://groups.google.com/g/golang-announce/c/x5MKroML2yM
CVE: CVE-2025-55133
Published: 2025-08-07
Description: In Agora Foundation Agora fall23-Alpha1 before b087490, there is XSS via topicName in client/agora/public/js/editorManager.js.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Msfv3n0m/vulnerability-research/tree/main/CVE-2025-55133; https://github.com/agorafoundation/agora/commit/b087490042cb131963b524d0f86511a63a7ff085; https://github.com/agorafoundation/agora/pull/556
CVE: CVE-2025-55134
Published: 2025-08-07
Description: In Agora Foundation Agora fall23-Alpha1 before b087490, there is XSS via tag in client/agora/public/js/editorManager.js.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Msfv3n0m/vulnerability-research/tree/main/CVE-2025-55134; https://github.com/agorafoundation/agora/commit/b087490042cb131963b524d0f86511a63a7ff085; https://github.com/agorafoundation/agora/pull/556
CVE: CVE-2025-55135
Published: 2025-08-07
Description: In Agora Foundation Agora fall23-Alpha1 before 690ce56, there is XSS via a profile picture to server/controller/userController.js. Formats other than PNG, JPEG, and WEBP are permitted by server/routes/userRoutes.js; this includes SVG.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-434
References: https://github.com/Msfv3n0m/vulnerability-research/tree/main/CVE-2025-55135; https://github.com/agorafoundation/agora/blob/90f7f9c217cf1d5dc9d27f5695cd65b61a4c4759/server/controller/userController.js#L332-L336; https://github.com/agorafoundation/agora/commit/690ce56f254af01375b6033e53a80f14d7cc002e
CVE: CVE-2025-55136
Published: 2025-08-07
Description: ERC (aka Emotion Recognition in Conversation) through 0.3 has insecure deserialization via a serialized object because jsonpickle is used.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-502
References: https://github.com/tae898/erc/pull/31
CVE: CVE-2025-7054
Published: 2025-08-07
Description: Cloudflare quiche was discovered to be vulnerable to an infinite loop when sending packets containing RETIRE_CONNECTION_ID frames.

QUIC connections possess a set of connection identifiers (IDs); see  Section 5.1 of RFC 9000 https://datatracker.ietf.org/doc/html/rfc9000#section-5.1 . Once the QUIC handshake completes, a local endpoint is responsible for issuing and retiring Connection IDs that are used by the remote peer to populate the Destination Connection ID field in packets sent from remote to local. Each Connection ID has a sequence number to ensure synchronization between peers.

An unauthenticated remote attacker can exploit this vulnerability by first completing a handshake and then sending a specially-crafted set of frames that trigger a connection ID retirement in the victim. When the victim attempts to send a packet containing RETIRE_CONNECTION_ID frames,  Section 19.16 of RFC 9000 https://datatracker.ietf.org/doc/html/rfc9000#section-19.6  requires that the sequence number of the retired connection ID must not be the same as the sequence number of the connection ID used by the packet. In other words, a packet cannot contain a frame that retires itself. In scenarios such as path migration, it is possible for there to be multiple active paths with different active connection IDs that could be used to retire each other. The exploit triggered an unintentional behaviour of a quiche design feature that supports retirement across paths while maintaining full connection ID synchronization, leading to an infinite loop.This issue affects quiche: from 0.15.0 before 0.24.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835
References: https://github.com/cloudflare/quiche/security/advisories/GHSA-m3hh-f9gh-74c2
CVE: CVE-2024-42048
Published: 2025-08-07
Description: OpenOrange Business Framework version 1.15.5 installs to a directory with overly permissive access control, allowing all authenticated users to write to the installation path. In combination with the application's behavior of loading DLLs from this location, this allows for DLL hijacking and may result in arbitrary code execution and privilege escalation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://attack.mitre.org/techniques/T1574/001; https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-loadlibrarya; https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-loadlibraryexa
CVE: CVE-2025-24000
Published: 2025-08-07
Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in Saad Iqbal Post SMTP post-smtp allows Authentication Bypass.This issue affects Post SMTP: from n/a through <= 3.2.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-288
References: https://patchstack.com/database/Wordpress/Plugin/post-smtp/vulnerability/wordpress-post-smtp-3-2-0-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2025-34148
Published: 2025-08-07
Description: An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02). When configuring the device in WISP mode, the 'ssid' parameter is passed unsanitized to system-level scripts. This allows remote attackers within Wi-Fi range to inject arbitrary shell commands that execute as root, resulting in full device compromise.
CWE: CWE-78
References: https://chocapikk.com/posts/2025/when-a-wifi-name-gives-you-root-part-two/; https://www.aliexpress.us/item/[PII_REDACTED].html; https://www.vulncheck.com/advisories/shenzhen-aitemi-m300-wifi-repeater-os-command-injection-via-wisp-ssid
CVE: CVE-2025-34149
Published: 2025-08-07
Description: A command injection vulnerability affects the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) during WPA2 configuration. The 'key' parameter is interpreted directly by the system shell, enabling attackers to execute arbitrary commands as root. Exploitation requires no authentication and can be triggered during wireless setup.
CWE: CWE-78
References: https://chocapikk.com/posts/2025/when-a-wifi-name-gives-you-root-part-two/; https://www.aliexpress.us/item/[PII_REDACTED].html; https://www.vulncheck.com/advisories/shenzhen-aitemi-m300-wifi-repeater-os-command-injection-via-wpa2-key
CVE: CVE-2025-34150
Published: 2025-08-07
Description: The PPPoE configuration interface of the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) is vulnerable to command injection via the 'user' parameter. Input is processed unsafely during network setup, allowing attackers to execute arbitrary system commands with root privileges.
CWE: CWE-78
References: https://chocapikk.com/posts/2025/when-a-wifi-name-gives-you-root-part-two/; https://www.aliexpress.us/item/[PII_REDACTED].html; https://www.vulncheck.com/advisories/shenzhen-aitemi-m300-wifi-repeater-pppoe-username-command-injection
CVE: CVE-2025-34151
Published: 2025-08-07
Description: A command injection vulnerability exists in the 'passwd' parameter of the PPPoE setup process on the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02). The input is passed directly to system-level commands without sanitation, enabling unauthenticated attackers to achieve root-level code execution.
CWE: CWE-78
References: https://chocapikk.com/posts/2025/when-a-wifi-name-gives-you-root-part-two/; https://www.aliexpress.us/item/[PII_REDACTED].html; https://www.vulncheck.com/advisories/shenzhen-aitemi-m300-wifi-repeater-pppoe-password-command-injection
CVE: CVE-2025-34152
Published: 2025-08-07
Description: An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) via the 'time' parameter of the '/protocol.csp?' endpoint. The input is processed by the internal date '-s' command without rebooting or disrupting HTTP service. Unlike other injection points, this vector allows remote compromise without triggering visible configuration changes.
CWE: CWE-78
References: https://chocapikk.com/posts/2025/when-a-wifi-name-gives-you-root-part-two/; https://www.aliexpress.us/item/[PII_REDACTED].html; https://www.vulncheck.com/advisories/shenzhen-aitemi-m300-wifi-repeater-os-command-injection-via-time-parameter
CVE: CVE-2025-54392
Published: 2025-08-07
Description: Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows XSS for authentication error data, a different vulnerability than CVE-2025-47189.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://community.netwrix.com/t/adv-2025-015-critical-vulnerabilities-in-netwrix-directory-manager-formerly-imanami-groupid-v11/17192
CVE: CVE-2025-54393
Published: 2025-08-07
Description: Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows Static Code Injection. Authenticated users can obtain administrative access.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-77
References: https://community.netwrix.com/t/adv-2025-015-critical-vulnerabilities-in-netwrix-directory-manager-formerly-imanami-groupid-v11/17192
CVE: CVE-2025-54394
Published: 2025-08-07
Description: Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 has Insufficiently Protected Credentials for requests to remote Excel resources.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-522
References: https://community.netwrix.com/t/adv-2025-015-critical-vulnerabilities-in-netwrix-directory-manager-formerly-imanami-groupid-v11/17192
CVE: CVE-2025-54395
Published: 2025-08-07
Description: Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows XSS for authentication configuration data.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://community.netwrix.com/t/adv-2025-015-critical-vulnerabilities-in-netwrix-directory-manager-formerly-imanami-groupid-v11/17192
CVE: CVE-2025-54396
Published: 2025-08-07
Description: Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows SQL Injection. Authenticated users can exploit this.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-89
References: https://community.netwrix.com/t/adv-2025-015-critical-vulnerabilities-in-netwrix-directory-manager-formerly-imanami-groupid-v11/17192
CVE: CVE-2025-54397
Published: 2025-08-07
Description: Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 inserts Sensitive Information Into Sent Data to authenticated users.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://community.netwrix.com/t/adv-2025-015-critical-vulnerabilities-in-netwrix-directory-manager-formerly-imanami-groupid-v11/17192
CVE: CVE-2025-55137
Published: 2025-08-07
Description: LinkJoin through 882f196 mishandles lacks type checking in password reset.
CVSS Score: 7.4 (HIGH)
CWE: CWE-843
References: https://github.com/Latkecrszy/linkjoin/pull/4
CVE: CVE-2025-55138
Published: 2025-08-07
Description: LinkJoin through 882f196 mishandles token ownership in password reset.
CVSS Score: 7.4 (HIGH)
CWE: CWE-304
References: https://github.com/Latkecrszy/linkjoin/pull/4
CVE: CVE-2023-40992
Published: 2025-08-07
Description: Hospital Management System 4 is vulnerable to a SQL injection in /Hospital-Management-System-master/func.php via the password2 parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://gist.github.com/celbahraoui/606fc8159738c06c41ece15182a6934f; https://github.com/kishan0725/Hospital-Management-System
CVE: CVE-2023-41519
Published: 2025-08-07
Description: Student Attendance Management System v1 was discovered to contain a cross-site scripting (XSS) vulnerability via the sessionName parameter at createSessionTerm.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/celbahraoui/412085648b1e8131aee9456e15177524; https://github.com/rickxy/Student-Attendance-Management-System
CVE: CVE-2023-41520
Published: 2025-08-07
Description: Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createClassArms.php via the classId and classArmName parameters.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://gist.github.com/celbahraoui/39c19c0b7f9f92a1a7e06d1c928bb1c3; https://github.com/rickxy/Student-Attendance-Management-System
CVE: CVE-2023-41521
Published: 2025-08-07
Description: Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createSessionTerm.php via the id, termId, and sessionName parameters.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://gist.github.com/celbahraoui/4300aa8eb79e99f2c481cfb3a49a0cd9; https://github.com/rickxy/Student-Attendance-Management-System
CVE: CVE-2023-41522
Published: 2025-08-07
Description: Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createStudents.php via the Id, firstname, and admissionNumber parameters.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://gist.github.com/celbahraoui/f13884670ac6668ae05b60fd37bb3521; https://github.com/rickxy/Student-Attendance-Management-System
CVE: CVE-2023-41523
Published: 2025-08-07
Description: Student Attendance Management System v1 was discovered to contain a SQL injection vulnerability via the emailAddress parameter at createClassTeacher.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://gist.github.com/celbahraoui/b18580d4acf3e4ada6c220c7416469ed; https://github.com/rickxy/Student-Attendance-Management-System
CVE: CVE-2023-41524
Published: 2025-08-07
Description: Student Attendance Management System v1 was discovered to contain a SQL injection vulnerability via the username parameter at index.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://gist.github.com/celbahraoui/b9437dbec7ab539531fe44f0c26b48a2; https://github.com/rickxy/Student-Attendance-Management-System
CVE: CVE-2023-41525
Published: 2025-08-07
Description: Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the patient_contact parameter in patientsearch.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/celbahraoui/ec09b05d4b36fce476458b0ee8140416; https://github.com/kishan0725/Hospital-Management-System
CVE: CVE-2023-41526
Published: 2025-08-07
Description: Hospital Management System v4 was discovered to contain multiple SQL injection vulnerabilities in func1.php via the username3 and password3 parameters.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/celbahraoui/f5343ffba6e99bd0a65bd36d21a679c6; https://github.com/kishan0725/Hospital-Management-System
CVE: CVE-2023-41527
Published: 2025-08-07
Description: Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the password2 parameter in func.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/celbahraoui/cbfa4a06cb3cce7222718f8c25519c98; https://github.com/kishan0725/Hospital-Management-System
CVE: CVE-2023-41528
Published: 2025-08-07
Description: Hospital Management System v4 was discovered to contain multiple SQL injection vulnerabilities in contact.php via the txtname, txtphone, and txtmail parameters.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/celbahraoui/4f6168774ef31510e3bad5cdeccd131e; https://github.com/kishan0725/Hospital-Management-System