deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-0498
Published: 2024-01-13
Description: A vulnerability was found in Project Worlds Lawyer Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file searchLawyer.php. The manipulation of the argument experience leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250603.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/laoquanshi/heishou/blob/main/lawyermanagementsystem.doc; https://vuldb.com/?ctiid.250603; https://vuldb.com/?id.250603
CVE: CVE-2024-0499
Published: 2024-01-13
Description: A vulnerability, which was classified as problematic, has been found in SourceCodester House Rental Management System 1.0. This issue affects some unknown processing of the file index.php. The manipulation of the argument page leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250607.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://drive.google.com/file/d/1DTGd_IWdS_tMOQN0Pt1-MeZ4Yv3tXiRt/view?usp=sharing; https://vuldb.com/?ctiid.250607; https://vuldb.com/?id.250607
CVE: CVE-2024-0500
Published: 2024-01-13
Description: A vulnerability, which was classified as problematic, was found in SourceCodester House Rental Management System 1.0. Affected is an unknown function of the component Manage Tenant Details. The manipulation of the argument Name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250608.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://drive.google.com/file/d/1z30nTAfoX58NqwIMXyHb3LB6Pv2bEm5v/view?usp=sharing; https://vuldb.com/?ctiid.250608; https://vuldb.com/?id.250608
CVE: CVE-2024-0501
Published: 2024-01-13
Description: A vulnerability has been found in SourceCodester House Rental Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Manage Invoice Details. The manipulation of the argument Invoice leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250609 was assigned to this vulnerability.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://drive.google.com/file/d/1xEenTDcXwNYdOxY8kdQ142nRnbcHrTRv/view?usp=sharing; https://vuldb.com/?ctiid.250609; https://vuldb.com/?id.250609
CVE: CVE-2024-0502
Published: 2024-01-13
Description: A vulnerability was found in SourceCodester House Rental Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file manage_user.php of the component Edit User. The manipulation of the argument id/name/username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-250610 is the identifier assigned to this vulnerability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://drive.google.com/file/d/1DGb371-evTgstf42t3u2dOM4KBEt5mPw/view?usp=sharing; https://vuldb.com/?ctiid.250610; https://vuldb.com/?id.250610
CVE: CVE-2024-0503
Published: 2024-01-13
Description: A vulnerability was found in code-projects Online FIR System 1.0. It has been classified as problematic. This affects an unknown part of the file registercomplaint.php. The manipulation of the argument Name/Address leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250611.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://drive.google.com/file/d/1n9Zas-iSOfKVMN3UzPyVGgQgCmig2A5I/view?usp=sharing; https://vuldb.com/?ctiid.250611; https://vuldb.com/?id.250611
CVE: CVE-2024-0504
Published: 2024-01-13
Description: A vulnerability has been found in code-projects Simple Online Hotel Reservation System 1.0 and classified as problematic. This vulnerability affects unknown code of the file add_reserve.php of the component Make a Reservation Page. The manipulation of the argument Firstname/Lastname with the input <script>alert(1)</script> leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-250618 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://drive.google.com/file/d/1BIa4jfZ9FbW9d7O3tRdAKF3tb6b5NUB6/view?usp=sharing; https://vuldb.com/?ctiid.250618; https://vuldb.com/?id.250618
CVE: CVE-2024-0505
Published: 2024-01-13
Description: A vulnerability was found in ZhongFuCheng3y Austin 1.0 and classified as critical. This issue affects the function getFile of the file com/java3y/austin/web/controller/MaterialController.java of the component Upload Material Menu. The manipulation leads to unrestricted upload. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250619.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-434, CWE-434
References: https://github.com/biantaibao/Austin-CMS-report/blob/main/File%20Upload%20Vulnerabilities.md; https://vuldb.com/?ctiid.250619; https://vuldb.com/?id.250619
CVE: CVE-2024-0510
Published: 2024-01-13
Description: A vulnerability, which was classified as critical, has been found in HaoKeKeJi YiQiNiu up to 3.1. Affected by this issue is the function http_post of the file /application/pay/controller/Api.php. The manipulation of the argument url leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250652.
CVSS Score: 7.3 (HIGH)
CWE: CWE-918, CWE-918
References: https://note.zhaoj.in/share/gBtNhBb39u9u; https://vuldb.com/?ctiid.250652; https://vuldb.com/?id.250652
CVE: CVE-2024-0522
Published: 2024-01-14
Description: A vulnerability was found in Allegro RomPager 4.01. It has been classified as problematic. Affected is an unknown function of the file usertable.htm?action=delete of the component HTTP POST Request Handler. The manipulation of the argument username leads to cross-site request forgery. It is possible to launch the attack remotely. Upgrading to version 4.30 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-250692. NOTE: The vendor explains that this is a very old issue that got fixed 20 years ago but without a public disclosure.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://vuldb.com/?ctiid.250692; https://vuldb.com/?id.250692; https://vuldb.com/?ctiid.250692
CVE: CVE-2024-0523
Published: 2024-01-14
Description: A vulnerability was found in CmsEasy up to 7.7.7. It has been declared as critical. Affected by this vulnerability is the function getslide_child_action in the library lib/admin/language_admin.php. The manipulation of the argument sid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250693 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/V3geD4g/cmseasy_vul/blob/main/SQL1-EN.md; https://vuldb.com/?ctiid.250693; https://vuldb.com/?id.250693
CVE: CVE-2024-0524
Published: 2024-01-15
Description: A vulnerability was found in CXBSoft Url-shorting up to 1.3.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file index.php. The manipulation of the argument url leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-250694 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://note.zhaoj.in/share/GdpwiaItePFq; https://vuldb.com/?ctiid.250694; https://vuldb.com/?id.250694
CVE: CVE-2024-0525
Published: 2024-01-15
Description: A vulnerability classified as critical has been found in CXBSoft Url-shorting up to 1.3.1. This affects an unknown part of the file /pages/long_s_short.php of the component HTTP POST Request Handler. The manipulation of the argument longurl leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250695. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://note.zhaoj.in/share/9tjcunCPidgI; https://vuldb.com/?ctiid.250695; https://vuldb.com/?id.250695
CVE: CVE-2024-0526
Published: 2024-01-15
Description: A vulnerability classified as critical was found in CXBSoft Url-shorting up to 1.3.1. This vulnerability affects unknown code of the file /pages/short_to_long.php of the component HTTP POST Request Handler. The manipulation of the argument shorturl leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250696. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://note.zhaoj.in/share/Zezf8fmoq7lk; https://vuldb.com/?ctiid.250696; https://vuldb.com/?id.250696
CVE: CVE-2024-0527
Published: 2024-01-15
Description: A vulnerability, which was classified as critical, has been found in CXBSoft Url-shorting up to 1.3.1. This issue affects some unknown processing of the file /admin/pages/update_go.php of the component HTTP POST Request Handler. The manipulation of the argument version leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-250697 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://note.zhaoj.in/share/6bz65C2dfgUk; https://vuldb.com/?ctiid.250697; https://vuldb.com/?id.250697
CVE: CVE-2024-0528
Published: 2024-01-15
Description: A vulnerability, which was classified as critical, was found in CXBSoft Post-Office 1.0. Affected is an unknown function of the file /admin/pages/update_go.php of the component HTTP POST Request Handler. The manipulation of the argument version leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-250698 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://note.zhaoj.in/share/grOgvdMgn0wg; https://vuldb.com/?ctiid.250698; https://vuldb.com/?id.250698
CVE: CVE-2024-0529
Published: 2024-01-15
Description: A vulnerability has been found in CXBSoft Post-Office up to 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /apps/login_auth.php of the component HTTP POST Request Handler. The manipulation of the argument username_login leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250699. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://note.zhaoj.in/share/neURUa2NSxzd; https://vuldb.com/?ctiid.250699; https://vuldb.com/?id.250699
CVE: CVE-2024-0530
Published: 2024-01-15
Description: A vulnerability was found in CXBSoft Post-Office up to 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /apps/reg_go.php of the component HTTP POST Request Handler. The manipulation of the argument username_reg leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250700. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://note.zhaoj.in/share/HUxa372VNwad; https://vuldb.com/?ctiid.250700; https://vuldb.com/?id.250700
CVE: CVE-2024-0531
Published: 2024-01-15
Description: A vulnerability was found in Tenda A15 15.13.07.13. It has been classified as critical. This affects an unknown part of the file /goform/setBlackRule of the component Web-based Management Interface. The manipulation of the argument deviceList leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250701 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/yaoyue123/iot/blob/main/Tenda/A15/setBlackRule.md; https://vuldb.com/?ctiid.250701; https://vuldb.com/?id.250701
CVE: CVE-2024-0532
Published: 2024-01-15
Description: A vulnerability was found in Tenda A15 15.13.07.13. It has been declared as critical. This vulnerability affects the function set_repeat5 of the file /goform/WifiExtraSet of the component Web-based Management Interface. The manipulation of the argument wpapsk_crypto2_4g/wpapsk_crypto5g leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119, CWE-121, CWE-787
References: https://github.com/yaoyue123/iot/blob/main/Tenda/A15/WifExtraSet.md; https://vuldb.com/?ctiid.250702; https://vuldb.com/?id.250702
CVE: CVE-2023-48383
Published: 2024-01-15
Description: NetVision

Information 

 airPASS has a path traversal vulnerability within its parameter in a specific URL. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and download arbitrary system files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.twcert.org.tw/tw/cp-132-7631-c6be3-1.html; https://www.twcert.org.tw/tw/cp-132-7631-c6be3-1.html
CVE: CVE-2024-0533
Published: 2024-01-15
Description: A vulnerability was found in Tenda A15 15.13.07.13. It has been rated as critical. This issue affects some unknown processing of the file /goform/SetOnlineDevName of the component Web-based Management Interface. The manipulation of the argument devName leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250703. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/yaoyue123/iot/blob/main/Tenda/A15/SetOnlineDevName.devname.md; https://vuldb.com/?ctiid.250703; https://vuldb.com/?id.250703
CVE: CVE-2024-0534
Published: 2024-01-15
Description: A vulnerability classified as critical has been found in Tenda A15 15.13.07.13. Affected is an unknown function of the file /goform/SetOnlineDevName of the component Web-based Management Interface. The manipulation of the argument mac leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250704. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/yaoyue123/iot/blob/main/Tenda/A15/SetOnlineDevName.mac.md; https://vuldb.com/?ctiid.250704; https://vuldb.com/?id.250704
CVE: CVE-2024-0535
Published: 2024-01-15
Description: A vulnerability classified as critical was found in Tenda PA6 1.0.1.21. Affected by this vulnerability is the function cgiPortMapAdd of the file /portmap of the component httpd. The manipulation of the argument groupName leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250705 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://github.com/jylsec/vuldb/blob/main/Tenda/PA6/2/README.md; https://vuldb.com/?ctiid.250705; https://vuldb.com/?id.250705
CVE: CVE-2024-0536
Published: 2024-01-15
Description: A vulnerability, which was classified as critical, has been found in Tenda W9 1.0.0.7(4456). Affected by this issue is the function setWrlAccessList of the component httpd. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-250706 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/jylsec/vuldb/blob/main/Tenda/W9/1/README.md; https://vuldb.com/?ctiid.250706; https://vuldb.com/?id.250706
CVE: CVE-2024-0537
Published: 2024-01-15
Description: A vulnerability, which was classified as critical, was found in Tenda W9 1.0.0.7(4456). This affects the function setWrlBasicInfo of the component httpd. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250707. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/jylsec/vuldb/blob/main/Tenda/W9/2/README.md; https://vuldb.com/?ctiid.250707; https://vuldb.com/?id.250707
CVE: CVE-2024-0538
Published: 2024-01-15
Description: A vulnerability has been found in Tenda W9 1.0.0.7(4456) and classified as critical. This vulnerability affects the function formQosManage_auto of the component httpd. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250708. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/jylsec/vuldb/blob/main/Tenda/W9/3/README.md; https://vuldb.com/?ctiid.250708; https://vuldb.com/?id.250708
CVE: CVE-2024-0552
Published: 2024-01-15
Description: Intumit inc. SmartRobot's web framwork has a remote code execution vulnerability. An unauthorized remote attacker can exploit this vulnerability to execute arbitrary commands on the remote server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://www.twcert.org.tw/tw/cp-132-7662-41d50-1.html; https://www.twcert.org.tw/tw/cp-132-7662-41d50-1.html
CVE: CVE-2024-0539
Published: 2024-01-15
Description: A vulnerability was found in Tenda W9 1.0.0.7(4456) and classified as critical. This issue affects the function formQosManage_user of the component httpd. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250709 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/jylsec/vuldb/blob/main/Tenda/W9/4/README.md; https://vuldb.com/?ctiid.250709; https://vuldb.com/?id.250709
CVE: CVE-2024-0540
Published: 2024-01-15
Description: A vulnerability was found in Tenda W9 1.0.0.7(4456). It has been classified as critical. Affected is the function formOfflineSet of the component httpd. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-250710 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://github.com/jylsec/vuldb/blob/main/Tenda/W9/5/README.md; https://vuldb.com/?ctiid.250710; https://vuldb.com/?id.250710
CVE: CVE-2024-0541
Published: 2024-01-15
Description: A vulnerability was found in Tenda W9 1.0.0.7(4456). It has been declared as critical. Affected by this vulnerability is the function formAddSysLogRule of the component httpd. The manipulation of the argument sysRulenEn leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250711. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/jylsec/vuldb/blob/main/Tenda/W9/6/README.md; https://vuldb.com/?ctiid.250711; https://vuldb.com/?id.250711
CVE: CVE-2024-0542
Published: 2024-01-15
Description: A vulnerability was found in Tenda W9 1.0.0.7(4456). It has been rated as critical. Affected by this issue is the function formWifiMacFilterGet of the component httpd. The manipulation of the argument index leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250712. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/jylsec/vuldb/blob/main/Tenda/W9/7/README.md; https://vuldb.com/?ctiid.250712; https://vuldb.com/?id.250712
CVE: CVE-2024-0543
Published: 2024-01-15
Description: A vulnerability classified as critical has been found in CodeAstro Real Estate Management System up to 1.0. This affects an unknown part of the file propertydetail.php. The manipulation of the argument pid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250713 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://drive.google.com/drive/folders/1U2nirIi6OtuCi-vrD2-VHyJbsHK5yA7t?usp=sharing; https://vuldb.com/?ctiid.250713; https://vuldb.com/?id.250713
CVE: CVE-2024-0545
Published: 2024-01-15
Description: A vulnerability classified as problematic was found in CodeCanyon RISE Ultimate Project Manager 3.5.3. This vulnerability affects unknown code of the file /index.php/signin. The manipulation of the argument redirect with the input http://evil.com leads to open redirect. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-601
References: https://vuldb.com/?ctiid.250714; https://vuldb.com/?id.250714; https://vuldb.com/?submit.266974
CVE: CVE-2024-0546
Published: 2024-01-15
Description: A vulnerability, which was classified as problematic, has been found in EasyFTP 1.7.0. This issue affects some unknown processing of the component LIST Command Handler. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250715.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-404
References: https://packetstormsecurity.com/files/94905/EasyFTP-1.7.0.x-Denial-Of-Service.html; https://vuldb.com/?ctiid.250715; https://vuldb.com/?id.250715