deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-53526
Published: 2025-01-08
Description: composio >=0.5.40 is vulnerable to Command Execution in composio_openai, composio_claude, and composio_julep via the handle_tool_calls function.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-77
References: https://github.com/ComposioHQ/composio/blob/11ee7470aa6543097ee30bb036af8e9726dc7a85/python/plugins/claude/composio_claude/toolset.py#L156; https://github.com/ComposioHQ/composio/blob/11ee7470aa6543097ee30bb036af8e9726dc7a85/python/plugins/julep/composio_julep/toolset.py#L21; https://github.com/ComposioHQ/composio/blob/11ee7470aa6543097ee30bb036af8e9726dc7a85/python/plugins/openai/composio_openai/toolset.py#L184
CVE: CVE-2024-54818
Published: 2025-01-08
Description: SourceCodester Computer Laboratory Management System 1.0 is vulnerable to Incorrect Access Control. via /php-lms/admin/?page=user/list.
CVSS Score: 8.8 (HIGH)
CWE: CWE-281
References: https://github.com/CloseC4ll/vulnerability-research/tree/main/CVE-2024-54818; https://portswigger.net/web-security/access-control#how-to-prevent-access-control-vulnerabilities
CVE: CVE-2025-0291
Published: 2025-01-08
Description: Type Confusion in V8 in Google Chrome prior to 131.0.6778.264 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-843, CWE-843
References: https://chromereleases.googleblog.com/2025/01/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/383356864
CVE: CVE-2025-22139
Published: 2025-01-08
Description: WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the configuracao_geral.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the msg_c parameter. This vulnerability is fixed in 3.2.8.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/nilsonLazarin/WeGIA/security/advisories/GHSA-xrjq-57mq-4hf8; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-xrjq-57mq-4hf8
CVE: CVE-2025-22140
Published: 2025-01-08
Description: WeGIA is a web manager for charitable institutions. A SQL Injection vulnerability was identified in the /html/funcionario/dependente_listar_um.php endpoint, specifically in the id_dependente parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This vulnerability is fixed in 3.2.8.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/nilsonLazarin/WeGIA/security/advisories/GHSA-mrhp-wfp2-59h5; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-mrhp-wfp2-59h5
CVE: CVE-2025-22141
Published: 2025-01-08
Description: WeGIA is a web manager for charitable institutions. A SQL Injection vulnerability was identified in the /dao/verificar_recursos_cargo.php endpoint, specifically in the cargo parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This vulnerability is fixed in 3.2.8.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/nilsonLazarin/WeGIA/security/advisories/GHSA-w7hp-2w2c-p636; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-w7hp-2w2c-p636
CVE: CVE-2024-13189
Published: 2025-01-08
Description: A vulnerability classified as critical has been found in ZeroWdd myblog 1.0. This affects an unknown part of the file src/main/java/com/wdd/myblog/config/MyBlogMvcConfig.java. The manipulation leads to permission issues. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-266, CWE-275
References: https://github.com/ZeroWdd/myblog/issues/1; https://github.com/ZeroWdd/myblog/issues/1#issue[PII_REDACTED]; https://vuldb.com/?ctiid.290781
CVE: CVE-2024-45342
Published: 2025-01-08
Description: Rejected reason: reserved but not needed
CVE: CVE-2024-45343
Published: 2025-01-08
Description: Rejected reason: reserved but not needed
CVE: CVE-2024-45344
Published: 2025-01-08
Description: Rejected reason: reserved but not needed
CVE: CVE-2024-45345
Published: 2025-01-08
Description: Rejected reason: reserved but not needed
CVE: CVE-2025-0194
Published: 2025-01-08
Description: An issue was discovered in GitLab CE/EE affecting all versions starting from 17.4 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. Under certain conditions, access tokens may have been logged when API requests were made in a specific manner.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-538
References: https://about.gitlab.com/releases/2025/01/08/patch-release-gitlab-17-7-1-released/#possible-access-token-exposure-in-gitlab-logs; https://gitlab.com/gitlab-org/gitlab/-/issues/489459
CVE: CVE-2025-22143
Published: 2025-01-08
Description: WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the listar_permissoes.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the msg_e parameter. This vulnerability is fixed in 3.2.8.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-gxh2-8jxp-m59h
CVE: CVE-2024-12431
Published: 2025-01-08
Description: An issue was discovered in GitLab CE/EE affecting all versions starting from 15.5 before 17.5.5, 17.6 before 17.6.3, and 17.7 before 17.7.1, in which unauthorized users could manipulate the status of issues in public projects.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://about.gitlab.com/releases/2025/01/08/patch-release-gitlab-17-7-1-released/#unauthorized-user-can-manipulate-status-of-issues-in-public-projects; https://gitlab.com/gitlab-org/gitlab/-/issues/508742; https://hackerone.com/reports/2877710
CVE: CVE-2024-13190
Published: 2025-01-08
Description: A vulnerability classified as critical was found in ZeroWdd myblog 1.0. This vulnerability affects unknown code of the file src/main/resources/mapper/BlogMapper.xml. The manipulation of the argument findBlogList/getTotalBlogs leads to xml injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-91
References: https://github.com/ZeroWdd/myblog/issues/2; https://github.com/ZeroWdd/myblog/issues/2#issue[PII_REDACTED]; https://vuldb.com/?ctiid.290782
CVE: CVE-2024-52869
Published: 2025-01-08
Description: Certain Teradata account-handling code through 2024-11-04, used with SUSE Enterprise Linux Server, mismanages groups. Specifically, when there is an operating system move from SUSE Enterprise Linux Server (SLES) 12 Service Pack (SP) 2 or 3 to SLES 15 SP2 on Teradata Database systems, some service/system user accounts, and possibly systems administrator created user accounts, are incorrectly assigned to groups that allow higher system-level privileges than intended for those user accounts. Depending on the usage of these accounts, this may lead to full system compromise.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-281
References: https://chrismanson.com/CVE/cve-2024-52869.html; https://www.teradata.com/trust-security-center/data-security
CVE: CVE-2024-53995
Published: 2025-01-08
Description: SickChill is an automatic video library manager for TV shows. A user-controlled `login` endpoint's `next_` parameter takes arbitrary content. Prior to commit c7128a8946c3701df95c285810eb75b2de18bf82, an authenticated attacker may use this to redirect the user to arbitrary destinations, leading to open redirect. Commit c7128a8946c3701df95c285810eb75b2de18bf82 changes the login page to redirect to `settings.DEFAULT_PAGE` instead of to the `next` parameter.
CWE: CWE-601
References: https://github.com/SickChill/sickchill/blob/846adafdfab579281353ea08a27bbb813f9a9872/sickchill/views/authentication.py#L33; https://github.com/SickChill/sickchill/commit/c7128a8946c3701df95c285810eb75b2de18bf82; https://github.com/SickChill/sickchill/pull/8811
CVE: CVE-2024-54010
Published: 2025-01-08
Description: A vulnerability in the firewall component of HPE Aruba Networking CX 10000 Series Switches  exists. It could allow an unauthenticated adjacent attacker to conduct a packet  forwarding attack against the ICMP and UDP protocol. For this attack to be successful an attacker requires a switch configuration that allows packets routing (at layer 3). Configurations that do not allow network traffic routing are not impacted. Successful exploitation could allow an attacker to bypass security policies, potentially leading to unauthorized data exposure.
CVSS Score: 3.4 (LOW)
CWE: CWE-863
References: https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04772.txt; https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04772en_us&docLocale=en_US
CVE: CVE-2025-22145
Published: 2025-01-08
Description: Carbon is an international PHP extension for DateTime. Application passing unsanitized user input to Carbon::setLocale are at risk of arbitrary file include, if the application allows users to upload files with .php extension in an folder that allows include or require to read it, then they are at risk of arbitrary code ran on their servers. This vulnerability is fixed in 3.8.4 and 2.72.6.
CWE: CWE-98
References: https://github.com/CarbonPHP/carbon/security/advisories/GHSA-j3f9-p6hm-5w6q; https://github.com/briannesbitt/Carbon/commit/129700ed449b1f02d70272d2ac802357c8c30c58; https://lists.debian.org/debian-lts-announce/2025/02/msg00032.html
CVE: CVE-2024-13191
Published: 2025-01-08
Description: A vulnerability, which was classified as critical, has been found in ZeroWdd myblog 1.0. This issue affects the function upload of the file src/main/java/com/wdd/myblog/controller/admin/uploadController.java. The manipulation of the argument file leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/ZeroWdd/myblog/issues/3; https://github.com/ZeroWdd/myblog/issues/3#issue[PII_REDACTED]; https://vuldb.com/?ctiid.290783
CVE: CVE-2024-13192
Published: 2025-01-08
Description: A vulnerability, which was classified as problematic, was found in ZeroWdd myblog 1.0. Affected is the function update of the file src/main/java/com/wdd/myblog/controller/admin/BlogController.java. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/ZeroWdd/myblog/issues/4; https://github.com/ZeroWdd/myblog/issues/4#issue[PII_REDACTED]; https://vuldb.com/?ctiid.290784
CVE: CVE-2024-13193
Published: 2025-01-08
Description: A vulnerability has been found in SEMCMS up to 4.8 and classified as critical. Affected by this vulnerability is an unknown functionality of the file SEMCMS_Images.php of the component Image Library Management Page. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Upgradeextension/SEMCMS/blob/main/README.md; https://vuldb.com/?ctiid.290785; https://vuldb.com/?id.290785
CVE: CVE-2024-5610
Published: 2025-01-08
Description: Rejected reason: loading template...
CVE: CVE-2025-0282
Published: 2025-01-08
Description: A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283; https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day; https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-0282
CVE: CVE-2025-0283
Published: 2025-01-08
Description: A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a local authenticated attacker to escalate their privileges.
CVSS Score: 7.0 (HIGH)
CWE: CWE-121, CWE-787
References: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283
CVE: CVE-2024-13194
Published: 2025-01-09
Description: A vulnerability was found in Sucms 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/admin_members.php?ac=search. The manipulation of the argument uid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Upgradeextension/Sucms-v1.0SQLinjection/blob/main/README.md; https://vuldb.com/?ctiid.290786; https://vuldb.com/?id.290786
CVE: CVE-2024-13195
Published: 2025-01-09
Description: A vulnerability was found in donglight bookstore电商书城系统说明 1.0.0. It has been classified as critical. This affects the function getHtml of the file src/main/java/org/zdd/bookstore/rawl/HttpUtil.java. The manipulation of the argument url leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/donglight/bookstore/issues/11; https://github.com/donglight/bookstore/issues/11#issue[PII_REDACTED]; https://vuldb.com/?ctiid.290787
CVE: CVE-2024-13196
Published: 2025-01-09
Description: A vulnerability was found in donglight bookstore电商书城系统说明 1.0.0. It has been declared as problematic. This vulnerability affects the function BookSearchList of the file src/main/java/org/zdd/bookstore/web/controller/BookInfoController.java. The manipulation of the argument keywords leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/donglight/bookstore/issues/12; https://github.com/donglight/bookstore/issues/12#issue[PII_REDACTED]; https://vuldb.com/?ctiid.290788
CVE: CVE-2024-13197
Published: 2025-01-09
Description: A vulnerability was found in donglight bookstore电商书城系统说明 1.0.0. It has been rated as problematic. This issue affects the function updateUser of the file src/main/Java/org/zdd/bookstore/web/controller/admin/AdminUserControlle.java. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/donglight/bookstore/issues/13; https://github.com/donglight/bookstore/issues/13#issue[PII_REDACTED]; https://vuldb.com/?ctiid.290789
CVE: CVE-2023-23913
Published: 2025-01-09
Description: There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are assigned the contenteditable attribute. This has the potential to occur when pasting malicious HTML content from the clipboard that includes a data-method, data-remote or data-disable-with attribute.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033263; https://discuss.rubyonrails.org/t/cve-2023-23913-dom-based-cross-site-scripting-in-rails-ujs-for-contenteditable-html-elements/82468; https://github.com/rails/rails/commit/5037a13614d71727af8a175063bcf6ba1a74bdbd
CVE: CVE-2023-27531
Published: 2025-01-09
Description: There is a deserialization of untrusted data vulnerability in the Kredis JSON deserialization code
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-502
References: https://discuss.rubyonrails.org/t/cve-2023-27531-possible-deserialization-of-untrusted-data-vulnerability-in-kredis-json/82467
CVE: CVE-2023-27539
Published: 2025-01-09
Description: There is a denial of service vulnerability in the header parsing component of Rack.
CVSS Score: 5.3 (MEDIUM)
References: https://discuss.rubyonrails.org/t/cve-2023-27539-possible-denial-of-service-vulnerability-in-racks-header-parsing/82466; https://github.com/advisories/GHSA-c6qg-cjj8-47qp; https://github.com/rack/rack/commit/231ef369ad0b542575fb36c74fcfcfabcf6c530c
CVE: CVE-2023-28120
Published: 2025-01-09
Description: There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-79
References: https://discuss.rubyonrails.org/t/cve-2023-28120-possible-xss-security-vulnerability-in-safebuffer-bytesplice/82469; https://github.com/rails/rails/commit/3cf23c3f891e2e81c977ea4ab83b62bc2a444b70; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UPV6PVCX4VDJHLFFT42EXBBSGAWZICOW/
CVE: CVE-2023-28362
Published: 2025-01-09
Description: The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-116
References: https://discuss.rubyonrails.org/t/cve-2023-28362-possible-xss-via-user-supplied-values-to-redirect-to/83132; https://github.com/advisories/GHSA-4g8v-vg43-wpgf; https://github.com/rails/rails/commit/1c3f93d1e90a3475f9ae2377ead25ccf11f71441
CVE: CVE-2023-38037
Published: 2025-01-09
Description: ActiveSupport::EncryptedFile writes contents that will be encrypted to a
temporary file.  The temporary file's permissions are defaulted to the user's
current `umask` settings, meaning that it's possible for other users on the
same system to read the contents of the temporary file.

Attackers that have access to the file system could possibly read the contents
of this temporary file while a user is editing it.

All users running an affected release should either upgrade or use one of the
workarounds immediately.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-732
References: https://discuss.rubyonrails.org/t/cve-2023-38037-possible-file-disclosure-of-locally-encrypted-files/83544; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-13198
Published: 2025-01-09
Description: A vulnerability classified as problematic has been found in langhsu Mblog Blog System 3.5.0. Affected is an unknown function of the file /login. The manipulation leads to observable response discrepancy. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.7 (LOW)
CWE: CWE-203, CWE-204
References: https://github.com/cydtseng/Vulnerability-Research/blob/main/mblog/ObservableDiscrepancy-UserLogin.md; https://vuldb.com/?ctiid.290790; https://vuldb.com/?id.290790
CVE: CVE-2024-13199
Published: 2025-01-09
Description: A vulnerability classified as problematic was found in langhsu Mblog Blog System 3.5.0. Affected by this vulnerability is an unknown functionality of the file /search of the component Search Bar. The manipulation of the argument kw leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/cydtseng/Vulnerability-Research/blob/main/mblog/ReflectedXSS-Search.md; https://vuldb.com/?ctiid.290791; https://vuldb.com/?id.290791
CVE: CVE-2024-27980
Published: 2025-01-09
Description: Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.
CVSS Score: 8.1 (HIGH)
CWE: CWE-77
References: http://www.openwall.com/lists/oss-security/2024/04/10/15; http://www.openwall.com/lists/oss-security/2024/07/11/6; http://www.openwall.com/lists/oss-security/2024/07/19/3
CVE: CVE-2024-37372
Published: 2025-01-09
Description: The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases.
CVSS Score: 3.6 (LOW)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2024/07/11/6; http://www.openwall.com/lists/oss-security/2024/07/19/3; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-13200
Published: 2025-01-09
Description: A vulnerability, which was classified as critical, was found in wander-chu SpringBoot-Blog 1.0. This affects the function preHandle of the file src/main/java/com/my/blog/website/interceptor/BaseInterceptor.java of the component HTTP POST Request Handler. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-266, CWE-284
References: https://github.com/wander-chu/SpringBoot-Blog/issues/4; https://github.com/wander-chu/SpringBoot-Blog/issues/4#issue[PII_REDACTED]; https://vuldb.com/?ctiid.290793
CVE: CVE-2024-13201
Published: 2025-01-09
Description: A vulnerability has been found in wander-chu SpringBoot-Blog 1.0 and classified as critical. This vulnerability affects the function upload of the file src/main/java/com/my/blog/website/controller/admin/AttachtController.java of the component Admin Attachment Handler. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/wander-chu/SpringBoot-Blog/issues/6; https://github.com/wander-chu/SpringBoot-Blog/issues/6#issue[PII_REDACTED]; https://vuldb.com/?ctiid.290794
CVE: CVE-2024-13202
Published: 2025-01-09
Description: A vulnerability was found in wander-chu SpringBoot-Blog 1.0 and classified as problematic. This issue affects the function modifiyArticle of the file src/main/java/com/my/blog/website/controller/admin/PageController.java of the component Blog Article Handler. The manipulation of the argument content leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/wander-chu/SpringBoot-Blog/issues/7; https://github.com/wander-chu/SpringBoot-Blog/issues/7#issue[PII_REDACTED]; https://vuldb.com/?ctiid.290795
CVE: CVE-2024-13203
Published: 2025-01-09
Description: A vulnerability was found in kurniaramadhan E-Commerce-PHP 1.0. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862
References: https://vuldb.com/?ctiid.290796; https://vuldb.com/?id.290796; https://www.websecurityinsights.my.id/2024/12/ecommerce-php-by-kurniaramadhan-sql.html?m=1