deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-3027
Published: 2024-04-13
Description: The Smart Slider 3 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the upload function in all versions up to, and including, 3.5.1.22. This makes it possible for authenticated attackers, with contributor-level access and above, to upload files, including SVG files, which can be used to conduct stored cross-site scripting attacks.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-285
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3069057%40smart-slider-3&old=2996377%40smart-slider-3&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/915f464f-449d-4ad2-9f43-6ce5d93ccb05?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3069057%40smart-slider-3&old=2996377%40smart-slider-3&sfp_email=&sfph_mail=
CVE: CVE-2024-2583
Published: 2024-04-13
Description: The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.0.5 does not properly escape some of its shortcodes attributes before they are echoed back to users, making it possible for users with the contributor role to conduct Stored XSS attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/98d8c713-e8cd-4fad-a8fb-7a40db2742a2/; https://wpscan.com/vulnerability/98d8c713-e8cd-4fad-a8fb-7a40db2742a2/
CVE: CVE-2023-6494
Published: 2024-04-13
Description: The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3069323%40woo-smart-quick-view&new=3069323%40woo-smart-quick-view&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/45ac52e1-9f0e-499e-9[PII_REDACTED]f5bdd?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3069323%40woo-smart-quick-view&new=3069323%40woo-smart-quick-view&sfp_email=&sfph_mail=
CVE: CVE-2024-3662
Published: 2024-04-13
Description: The WPZOOM Social Feed Widget & Block plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpzoom_instagram_clear_data() function in all versions up to, and including, 2.1.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete all Instagram images installed on the site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3069664%40instagram-widget-by-wpzoom&new=3069664%40instagram-widget-by-wpzoom&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/e3a70510-51c8-49c3-933b-79e79dfb8611?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3069664%40instagram-widget-by-wpzoom&new=3069664%40instagram-widget-by-wpzoom&sfp_email=&sfph_mail=
CVE: CVE-2024-3719
Published: 2024-04-13
Description: A vulnerability, which was classified as critical, was found in Campcodes House Rental Management System 1.0. This affects an unknown part of the file ajax.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-260571.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/House%20Rental%20Management%20System/House%20Rental%20Management%20System%20-%20vuln%205.pdf; https://vuldb.com/?ctiid.260571; https://vuldb.com/?id.260571
CVE: CVE-2024-26817
Published: 2024-04-13
Description: In the Linux kernel, the following vulnerability has been resolved:

amdkfd: use calloc instead of kzalloc to avoid integer overflow

This uses calloc instead of doing the multiplication which might
overflow.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: https://git.kernel.org/stable/c/0c33d[PII_REDACTED]d76631d8f4a4736519eacd3a; https://git.kernel.org/stable/c/315eb3c2df7e4cb18e3eacfa18a53a46f2bf0ef7; https://git.kernel.org/stable/c/3b0daecfeac0103aba8b293df07a0cbaf8b43f29
CVE: CVE-2024-3720
Published: 2024-04-13
Description: A vulnerability has been found in Tianwell Fire Intelligent Command Platform 1.1.1.1 and classified as critical. This vulnerability affects unknown code of the file /mfsNotice/page of the component API Interface. The manipulation of the argument gsdwid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-260572.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/scausoft/cve/blob/main/sql.md; https://vuldb.com/?ctiid.260572; https://vuldb.com/?id.260572
CVE: CVE-2024-3721
Published: 2024-04-13
Description: A vulnerability was found in TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical. This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___. The manipulation of the argument mdb/mdc leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260573 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-78
References: https://github.com/netsecfish/tbk_dvr_command_injection; https://vuldb.com/?ctiid.260573; https://vuldb.com/?id.260573
CVE: CVE-2024-3735
Published: 2024-04-13
Description: A vulnerability was found in Smart Office up to 20240405. It has been classified as problematic. Affected is an unknown function of the file Main.aspx. The manipulation of the argument New Password/Confirm Password with the input 1 leads to weak password requirements. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. VDB-260574 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.7 (LOW)
CWE: CWE-521
References: https://mega.nz/file/7F0BSJhD#EvnXFRviBstJGHSafvLmVWosWH2JFPAouD6ER8wnGxk; https://vuldb.com/?ctiid.260574; https://vuldb.com/?id.260574
CVE: CVE-2024-3736
Published: 2024-04-13
Description: A vulnerability was found in cym1102 nginxWebUI up to 3.9.9. It has been declared as problematic. Affected by this vulnerability is the function upload of the file /adminPage/main/upload. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-260575.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/cym1102/nginxWebUI/files/14818455/nginxwebui.rce.3.9.9.pdf; https://github.com/cym1102/nginxWebUI/issues/138; https://vuldb.com/?ctiid.260575
CVE: CVE-2024-32487
Published: 2024-04-13
Description: less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation also requires the LESSOPEN environment variable, but this is set by default in many common cases.
CVSS Score: 8.6 (HIGH)
CWE: CWE-96
References: http://www.openwall.com/lists/oss-security/2024/04/15/1; https://github.com/gwsw/less/commit/007521ac3c95bc76e3d59c6dbfe75d06c8075c33; https://lists.debian.org/debian-lts-announce/2024/05/msg00018.html
CVE: CVE-2024-3737
Published: 2024-04-13
Description: A vulnerability was found in cym1102 nginxWebUI up to 3.9.9. It has been rated as critical. Affected by this issue is the function findCountByQuery of the file /adminPage/www/addOver. The manipulation of the argument dir leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-260576.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/cym1102/nginxWebUI/files/14818455/nginxwebui.rce.3.9.9.pdf; https://github.com/cym1102/nginxWebUI/issues/138; https://vuldb.com/?ctiid.260576
CVE: CVE-2024-3738
Published: 2024-04-13
Description: A vulnerability classified as critical has been found in cym1102 nginxWebUI up to 3.9.9. This affects the function handlePath of the file /adminPage/conf/saveCmd. The manipulation of the argument nginxPath leads to improper certificate validation. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260577 was assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-295
References: https://github.com/cym1102/nginxWebUI/files/14818455/nginxwebui.rce.3.9.9.pdf; https://github.com/cym1102/nginxWebUI/issues/138; https://vuldb.com/?ctiid.260577
CVE: CVE-2024-3739
Published: 2024-04-13
Description: A vulnerability classified as critical was found in cym1102 nginxWebUI up to 3.9.9. This vulnerability affects unknown code of the file /adminPage/main/upload. The manipulation of the argument file leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-260578 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-78
References: https://github.com/cym1102/nginxWebUI/files/14818455/nginxwebui.rce.3.9.9.pdf; https://github.com/cym1102/nginxWebUI/issues/138; https://vuldb.com/?ctiid.260578
CVE: CVE-2024-3740
Published: 2024-04-13
Description: A vulnerability, which was classified as critical, has been found in cym1102 nginxWebUI up to 3.9.9. This issue affects the function exec of the file /adminPage/conf/reload. The manipulation of the argument nginxExe leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-260579.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-502
References: https://github.com/cym1102/nginxWebUI/files/14818455/nginxwebui.rce.3.9.9.pdf; https://github.com/cym1102/nginxWebUI/issues/138; https://vuldb.com/?ctiid.260579
CVE: CVE-2024-24862
Published: 2024-04-14
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-24863
Published: 2024-04-14
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2024-24863 has been replaced by CVE-2024-36014.
CVE: CVE-2024-3762
Published: 2024-04-14
Description: A vulnerability was found in Emlog Pro 2.2.10. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/twitter.php of the component Whisper Page. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-260602 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/fubxx/CVE/blob/main/Emlog-XSS.md; https://vuldb.com/?ctiid.260602; https://vuldb.com/?id.260602
CVE: CVE-2024-27462
Published: 2024-04-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2024-3763
Published: 2024-04-14
Description: A vulnerability was found in Emlog Pro 2.2.10. It has been rated as problematic. This issue affects some unknown processing of the file /admin/tag.php of the component Post Tag Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-260603. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/fubxx/CVE/blob/main/Emlog-XSS2.md; https://vuldb.com/?ctiid.260603; https://vuldb.com/?id.260603
CVE: CVE-2024-3764
Published: 2024-04-14
Description: ** DISPUTED ** A vulnerability classified as problematic has been found in Tuya SDK up to 5.0.x. Affected is an unknown function of the component MQTT Packet Handler. The manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. Upgrading to version 5.1.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-260604. NOTE: The vendor explains that a malicious actor would have to crack TLS first or use a legitimate login to initiate the attack.
CVSS Score: 2.7 (LOW)
CWE: CWE-404
References: https://github.com/kzLiu2017/Tuya_Cam_CVE_Doc/blob/main/CVE%20Doc.pdf; https://vuldb.com/?ctiid.260604; https://vuldb.com/?id.260604
CVE: CVE-2024-3765
Published: 2024-04-14
Description: A vulnerability classified as critical was found in Xiongmai AHB7804R-MH-V2, AHB8004T-GL, AHB8008T-GL, AHB7004T-GS-V3, AHB7004T-MHV2, AHB8032F-LME and XM530_R80X30-PQ_8M. Affected by this vulnerability is an unknown functionality of the component Sofia Service. The manipulation with the input ff[PII_REDACTED][PII_REDACTED]000000f[PII_REDACTED]7b[PII_REDACTED]22203a203130302c[PII_REDACTED]73696f6e494422203a[PII_REDACTED]22207d0a leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260605 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://github.com/netsecfish/xiongmai_incorrect_access_control; https://github.com/netsecfish/xiongmai_incorrect_access_control/blob/main/pocCheck3-en.py; https://vuldb.com/?ctiid.260605
CVE: CVE-2024-29836
Published: 2024-04-15
Description: The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control, allowing for an unauthenticated attacker to update and add user profiles within the application, and gain full access of the site.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html; https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html
CVE: CVE-2024-29837
Published: 2024-04-15
Description: The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below uses poor session management, allowing for an unauthenticated attacker to access administrator functionality if any other user is already signed in.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284, CWE-1390, CWE-287
References: https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html; https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html
CVE: CVE-2024-29838
Published: 2024-04-15
Description: The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below does not proper sanitize user input,  allowing for an unauthenticated attacker to crash the controller software
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-457, CWE-908
References: https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html; https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html
CVE: CVE-2024-29839
Published: 2024-04-15
Description: The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_CARD, allowing for an unauthenticated attacker to return the card value data of any user


CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-284
References: https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html; https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html
CVE: CVE-2024-29840
Published: 2024-04-15
Description: The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_PIN_FIELDS, allowing for an unauthenticated attacker to return the pin value of any user


CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-284
References: https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html; https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html
CVE: CVE-2024-29841
Published: 2024-04-15
Description: The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_KEYS_FIELDS, allowing for an unauthenticated attacker to return the keys value of any user
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-284
References: https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html; https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html
CVE: CVE-2024-29842
Published: 2024-04-15
Description: The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_ABACARD_FIELDS, allowing for an unauthenticated attacker to return the abacard field of any user
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-284
References: https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html; https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html
CVE: CVE-2024-29843
Published: 2024-04-15
Description: The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on MOBILE_GET_USERS_LIST, allowing for an unauthenticated attacker to enumerate all users and their access levels


CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-284
References: https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html; https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html
CVE: CVE-2024-29844
Published: 2024-04-15
Description: Default credentials on the Web Interface of Evolution Controller 2.x allows anyone to log in to the server directly to perform administrative functions. Upon installation or upon first login, the application does not ask the user to change the password. There is no warning or prompt to ask the user to change the default password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1392
References: https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html; https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html
CVE: CVE-2024-3766
Published: 2024-04-15
Description: A vulnerability, which was classified as problematic, has been found in slowlyo OwlAdmin up to 3.5.7. Affected by this issue is some unknown functionality of the file /admin-api/upload_image of the component Image File Upload. The manipulation of the argument file leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-260606 is the identifier assigned to this vulnerability.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/fubxx/CVE/blob/main/OwlAdmin-XSS.md; https://vuldb.com/?ctiid.260606; https://vuldb.com/?id.260606
CVE: CVE-2024-3772
Published: 2024-04-15
Description: Regular expression denial of service in Pydanic < 2.4.0, < 1.10.13 allows remote attackers to cause denial of service via a crafted email string.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-1333
References: https://github.com/pydantic/pydantic/pull/7360; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6JBZLMSH4GAZOVBMT2JUO2LXHY7M2ALI/; https://github.com/pydantic/pydantic/pull/7360
CVE: CVE-2024-3774
Published: 2024-04-15
Description: aEnrich Technology a+HRD's functionality for front-end retrieval of system configuration values lacks proper restrictions on a specific parameter, allowing attackers to modify this parameter to access certain sensitive system configuration values.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306, CWE-497
References: https://www.twcert.org.tw/tw/cp-132-7724-c28d3-1.html; https://www.twcert.org.tw/tw/cp-132-7724-c28d3-1.html
CVE: CVE-2024-1655
Published: 2024-04-15
Description: Certain ASUS WiFi routers models has an OS Command Injection vulnerability, allowing an authenticated remote attacker to execute arbitrary system commands by sending a specially crafted request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.twcert.org.tw/tw/cp-132-7737-1acd0-1.html; https://www.twcert.org.tw/tw/cp-132-7737-1acd0-1.html
CVE: CVE-2024-3767
Published: 2024-04-15
Description: A vulnerability classified as critical was found in PHPGurukul News Portal 4.1. This vulnerability affects unknown code of the file /admin/edit-post.php. The manipulation of the argument posttitle/category leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/BurakSevben/CVEs/blob/main/News%20Portal/News%20Portal%20-%20SQL%20Injection%20-%203.md; https://phpgurukul.com/; https://vuldb.com/?ctiid.260614
CVE: CVE-2024-3768
Published: 2024-04-15
Description: A vulnerability, which was classified as critical, has been found in PHPGurukul/itsourcecode News Portal 4.1. This issue affects some unknown processing of the file search.php. The manipulation of the argument searchtitle leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-260615.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/BurakSevben/CVEs/blob/main/News%20Portal/News%20Portal%20-%20SQL%20Injection%20-%204.md; https://github.com/L1OudFd8cl09/CVE/blob/main/25_07_2024_b.md; https://vuldb.com/?ctiid.260615
CVE: CVE-2024-3769
Published: 2024-04-15
Description: A vulnerability, which was classified as critical, was found in PHPGurukul Student Record System 3.20. Affected is an unknown function of the file /login.php. The manipulation of the argument id/password leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-260616.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/BurakSevben/CVEs/blob/main/Student%20Record%20System%203.20/Student%20Record%20System%20-%20Authentication%20Bypass.md; https://vuldb.com/?ctiid.260616; https://vuldb.com/?id.260616
CVE: CVE-2024-3775
Published: 2024-04-15
Description: aEnrich Technology a+HRD's functionality for downloading files using youtube-dl.exe does not properly restrict user input. This allows attackers to pass arbitrary arguments to youtube-dl.exe, leading to the download of partial unauthorized files.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-88
References: https://www.twcert.org.tw/tw/cp-132-7726-e5f70-1.html; https://www.twcert.org.tw/tw/cp-132-7726-e5f70-1.html