deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-50828
Published: 2023-12-21
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Vongries Ultimate Dashboard – Custom WordPress Dashboard allows Stored XSS.This issue affects Ultimate Dashboard – Custom WordPress Dashboard: from n/a through 3.7.11.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/ultimate-dashboard/wordpress-ultimate-dashboard-plugin-3-7-11-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ultimate-dashboard/wordpress-ultimate-dashboard-plugin-3-7-11-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-51442
Published: 2023-12-21
Description: Navidrome is an open source web-based music collection server and streamer. A security vulnerability has been identified in navidrome's subsonic endpoint, allowing for authentication bypass. This exploit enables unauthorized access to any known account by utilizing a JSON Web Token (JWT) signed with the key "not so secret". The vulnerability can only be exploited on instances that have never been restarted. Navidrome supports an extension to the subsonic authentication scheme, where a JWT can be provided using a `jwt` query parameter instead of the traditional password or token and salt (corresponding to resp. the `p` or `t` and `s` query parameters). This authentication bypass vulnerability potentially affects all instances that don't protect the subsonic endpoint `/rest/`, which is expected to be most instances in a standard deployment, and most instances in the reverse proxy setup too (as the documentation mentions to leave that endpoint unprotected). This issue has been patched in version 0.50.2.

CVSS Score: 8.6 (HIGH)
CWE: CWE-287
References: https://github.com/navidrome/navidrome/commit/1132abb0135d1ecaebc41ed97a1e908a4ae02f7c; https://github.com/navidrome/navidrome/security/advisories/GHSA-wq59-4q6r-635r; https://github.com/navidrome/navidrome/commit/1132abb0135d1ecaebc41ed97a1e908a4ae02f7c
CVE: CVE-2023-7035
Published: 2023-12-21
Description: A vulnerability was found in automad up to 1.10.9 and classified as problematic. Affected by this issue is some unknown functionality of the file packages\standard\templates\post.php of the component Setting Handler. The manipulation of the argument sitename leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/screetsec/VDD/tree/main/Automad%20CMS/Stored%20Cross%20Site%20Scripting%20(XSS); https://vuldb.com/?ctiid.248684; https://vuldb.com/?id.248684
CVE: CVE-2023-7047
Published: 2023-12-21
Description: 
Inadequate validation of permissions when employing remote tools and 
macros via the context menu within Devolutions Remote Desktop Manager versions 2023.3.31 and 
earlier permits a user to initiate a connection without proper execution
 rights via the remote tools feature. This affects only SQL data sources.

CVSS Score: 4.4 (MEDIUM)
CWE: CWE-863
References: https://devolutions.net/security/advisories/DEVO-2023-0024/; https://devolutions.net/security/advisories/DEVO-2023-0024/
CVE: CVE-2023-45115
Published: 2023-12-21
Description: Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'ch' parameter of the /update.php?q=addqns resource does not validate the characters received and they are sent unfiltered to the database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://fluidattacks.com/advisories/argerich/; https://projectworlds.in/; https://fluidattacks.com/advisories/argerich/
CVE: CVE-2023-45116
Published: 2023-12-21
Description: Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'demail' parameter of the /update.php resource does not validate the characters received and they are sent unfiltered to the database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://fluidattacks.com/advisories/argerich/; https://projectworlds.in/; https://fluidattacks.com/advisories/argerich/
CVE: CVE-2023-45117
Published: 2023-12-21
Description: Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'eid' parameter of the /update.php?q=rmquiz resource does not validate the characters received and they are sent unfiltered to the database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://fluidattacks.com/advisories/argerich/; https://projectworlds.in/; https://fluidattacks.com/advisories/argerich/
CVE: CVE-2023-45118
Published: 2023-12-21
Description: Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'fdid' parameter of the /update.php resource does not validate the characters received and they are sent unfiltered to the database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://fluidattacks.com/advisories/argerich/; https://projectworlds.in/; https://fluidattacks.com/advisories/argerich/
CVE: CVE-2023-45119
Published: 2023-12-21
Description: Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'n' parameter of the /update.php?q=quiz resource does not validate the characters received and they are sent unfiltered to the database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://fluidattacks.com/advisories/argerich/; https://projectworlds.in/; https://fluidattacks.com/advisories/argerich/
CVE: CVE-2023-4255
Published: 2023-12-21
Description: An out-of-bounds write issue has been discovered in the backspace handling of the checkType() function in etc.c within the W3M application. This vulnerability is triggered by supplying a specially crafted HTML file to the w3m binary. Exploitation of this flaw could lead to application crashes, resulting in a denial of service condition.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=2255207; https://github.com/tats/w3m/commit/edc602651c506aeeb60544b55534dd1722a340d3; https://github.com/tats/w3m/issues/268
CVE: CVE-2023-4256
Published: 2023-12-21
Description: Within tcpreplay's tcprewrite, a double free vulnerability has been identified in the tcpedit_dlt_cleanup() function within plugins/dlt_plugins.c. This vulnerability can be exploited by supplying a specifically crafted file to the tcprewrite binary. This flaw enables a local attacker to initiate a Denial of Service (DoS) attack.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-415, CWE-415
References: https://bugzilla.redhat.com/show_bug.cgi?id=2255212; https://github.com/appneta/tcpreplay/issues/813; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EHUILQV2YJI5TXXXJA5FQ2HJQGFT7NTN/
CVE: CVE-2023-51048
Published: 2023-12-21
Description: S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_newsauth parameter at /admin/ajax.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.notion.so/scms5-0-sql-injection-94c791a563d1481a9439fa98a1bc9a1b; https://www.notion.so/scms5-0-sql-injection-94c791a563d1481a9439fa98a1bc9a1b
CVE: CVE-2023-51049
Published: 2023-12-21
Description: S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_bbsauth parameter at /admin/ajax.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.notion.so/scms5-0-sql-injection-94c791a563d1481a9439fa98a1bc9a1b; https://www.notion.so/scms5-0-sql-injection-94c791a563d1481a9439fa98a1bc9a1b
CVE: CVE-2023-51050
Published: 2023-12-21
Description: S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_productauth parameter at /admin/ajax.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.notion.so/scms5-0-sql-injection-94c791a563d1481a9439fa98a1bc9a1b; https://www.notion.so/scms5-0-sql-injection-94c791a563d1481a9439fa98a1bc9a1b
CVE: CVE-2023-51051
Published: 2023-12-21
Description: S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_textauth parameter at /admin/ajax.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.notion.so/scms5-0-sql-injection-94c791a563d1481a9439fa98a1bc9a1b; https://www.notion.so/scms5-0-sql-injection-94c791a563d1481a9439fa98a1bc9a1b
CVE: CVE-2023-51052
Published: 2023-12-21
Description: S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_formauth parameter at /admin/ajax.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.notion.so/scms5-0-sql-injection-94c791a563d1481a9439fa98a1bc9a1b; https://www.notion.so/scms5-0-sql-injection-94c791a563d1481a9439fa98a1bc9a1b
CVE: CVE-2023-7036
Published: 2023-12-21
Description: A vulnerability was found in automad up to 1.10.9. It has been classified as problematic. This affects the function upload of the file FileCollectionController.php of the component Content Type Handler. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248685 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-434, CWE-79
References: https://github.com/screetsec/VDD/tree/main/Automad%20CMS/Unrestricted%20File%20Upload; https://vuldb.com/?ctiid.248685; https://vuldb.com/?id.248685
CVE: CVE-2023-40058
Published: 2023-12-21
Description: Sensitive data was added to our public-facing knowledgebase that, if exploited, could be used to access components of Access Rights Manager (ARM) if the threat actor is in the same environment.   







CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-40058; https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-40058
CVE: CVE-2023-45120
Published: 2023-12-21
Description: Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'qid' parameter of the /update.php?q=quiz&step=2 resource does not validate the characters received and they are sent unfiltered to the database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://fluidattacks.com/advisories/argerich/; https://projectworlds.in/; https://fluidattacks.com/advisories/argerich/
CVE: CVE-2023-45121
Published: 2023-12-21
Description: Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'desc' parameter of the /update.php?q=addquiz resource does not validate the characters received and they are sent unfiltered to the database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://fluidattacks.com/advisories/argerich/; https://projectworlds.in/; https://fluidattacks.com/advisories/argerich/
CVE: CVE-2023-45122
Published: 2023-12-21
Description: Rejected reason: It is a duplicate.
CVE: CVE-2023-45123
Published: 2023-12-21
Description: Rejected reason: It is a duplicate.
CVE: CVE-2023-7037
Published: 2023-12-21
Description: A vulnerability was found in automad up to 1.10.9. It has been declared as critical. This vulnerability affects the function import of the file FileController.php. The manipulation of the argument importUrl leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-248686 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/screetsec/VDD/tree/main/Automad%20CMS/Authenticated%20Blind%20SSRF; https://vuldb.com/?ctiid.248686; https://vuldb.com/?id.248686
CVE: CVE-2023-50829
Published: 2023-12-21
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aerin Loan Repayment Calculator and Application Form allows Stored XSS.This issue affects Loan Repayment Calculator and Application Form: from n/a through 2.9.3.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/quick-interest-slider/wordpress-loan-repayment-calculator-and-application-form-plugin-2-9-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/quick-interest-slider/wordpress-loan-repayment-calculator-and-application-form-plugin-2-9-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-50830
Published: 2023-12-21
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Seosbg Seos Contact Form allows Stored XSS.This issue affects Seos Contact Form: from n/a through 1.8.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/seos-contact-form/wordpress-seos-contact-form-plugin-1-8-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/seos-contact-form/wordpress-seos-contact-form-plugin-1-8-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-50831
Published: 2023-12-21
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY – Multi Currency for WooCommerce allows Stored XSS.This issue affects CURCY – Multi Currency for WooCommerce: from n/a through 2.2.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/woo-multi-currency/wordpress-curcy-plugin-2-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woo-multi-currency/wordpress-curcy-plugin-2-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-50832
Published: 2023-12-21
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mondula GmbH Multi Step Form allows Stored XSS.This issue affects Multi Step Form: from n/a through 1.7.13.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/multi-step-form/wordpress-multi-step-form-plugin-1-7-13-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/multi-step-form/wordpress-multi-step-form-plugin-1-7-13-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-50833
Published: 2023-12-21
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExtendThemes Colibri Page Builder allows Stored XSS.This issue affects Colibri Page Builder: from n/a through 1.0.239.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/colibri-page-builder/wordpress-colibri-page-builder-plugin-1-0-239-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/colibri-page-builder/wordpress-colibri-page-builder-plugin-1-0-239-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-7038
Published: 2023-12-21
Description: A vulnerability was found in automad up to 1.10.9. It has been rated as problematic. This issue affects some unknown processing of the file /dashboard?controller=UserCollection::createUser of the component User Creation Handler. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248687. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/screetsec/VDD/tree/main/Automad%20CMS/Cross-Site%20Request%20Forgery%20(CSRF); https://vuldb.com/?ctiid.248687; https://vuldb.com/?id.248687
CVE: CVE-2023-32747
Published: 2023-12-21
Description: Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Bookings.This issue affects WooCommerce Bookings: from n/a through 1.15.78.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-639
References: https://patchstack.com/database/vulnerability/woocommerce-bookings/wordpress-woocommerce-bookings-plugin-1-15-78-insecure-direct-object-references-idor-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-bookings/wordpress-woocommerce-bookings-plugin-1-15-78-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE: CVE-2023-32799
Published: 2023-12-21
Description: Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce Shipping Multiple Addresses.This issue affects Shipping Multiple Addresses: from n/a through 3.8.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://patchstack.com/database/vulnerability/woocommerce-shipping-multiple-addresses/wordpress-woocommerce-ship-to-multiple-addresses-plugin-3-8-3-insecure-direct-object-references-idor-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-shipping-multiple-addresses/wordpress-woocommerce-ship-to-multiple-addresses-plugin-3-8-3-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE: CVE-2023-44481
Published: 2023-12-21
Description: Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'setearnleave' parameter of the admin/setleaves.php resource does not validate the characters received and they are sent unfiltered to the database.


CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://fluidattacks.com/advisories/martin/; https://projectworlds.in/; https://fluidattacks.com/advisories/martin/
CVE: CVE-2023-44482
Published: 2023-12-21
Description: Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'setsickleave' parameter of the admin/setleaves.php resource does not validate the characters received and they are sent unfiltered to the database.


CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://fluidattacks.com/advisories/martin/; https://projectworlds.in/; https://fluidattacks.com/advisories/martin/
CVE: CVE-2023-45124
Published: 2023-12-21
Description: Rejected reason: It is a duplicate.
CVE: CVE-2023-45125
Published: 2023-12-21
Description: Rejected reason: It is a duplicate.
CVE: CVE-2023-45126
Published: 2023-12-21
Description: Rejected reason: It is a duplicate.
CVE: CVE-2023-45127
Published: 2023-12-21
Description: Rejected reason: It is a duplicate.
CVE: CVE-2023-47191
Published: 2023-12-21
Description: Authorization Bypass Through User-Controlled Key vulnerability in KaineLabs Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress.This issue affects Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress: from n/a through 1.2.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://patchstack.com/database/vulnerability/youzify/wordpress-youzify-plugin-1-2-2-insecure-direct-object-reference-idor-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/youzify/wordpress-youzify-plugin-1-2-2-insecure-direct-object-reference-idor-vulnerability?_s_id=cve
CVE: CVE-2023-49765
Published: 2023-12-21
Description: Authorization Bypass Through User-Controlled Key vulnerability in Blaz K. Rate my Post – WP Rating System.This issue affects Rate my Post – WP Rating System: from n/a through 3.4.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://patchstack.com/database/vulnerability/rate-my-post/wordpress-rate-my-post-wp-rating-system-plugin-3-4-1-insecure-direct-object-references-idor-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/rate-my-post/wordpress-rate-my-post-wp-rating-system-plugin-3-4-1-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE: CVE-2023-50834
Published: 2023-12-21
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in August Infotech WooCommerce Menu Extension allows Stored XSS.This issue affects WooCommerce Menu Extension: from n/a through 1.6.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/woocommerce-menu-extension/wordpress-woocommerce-menu-extension-plugin-1-6-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-menu-extension/wordpress-woocommerce-menu-extension-plugin-1-6-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-7039
Published: 2023-12-21
Description: A vulnerability classified as critical has been found in Byzoro S210 up to 20231210. Affected is an unknown function of the file /importexport.php. The manipulation of the argument sql leads to injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248688.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74
References: https://github.com/Stitch3612/cve/blob/main/rce.md; https://vuldb.com/?ctiid.248688; https://vuldb.com/?id.248688
CVE: CVE-2023-46791
Published: 2023-12-21
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-50732
Published: 2023-12-21
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute a Velocity script without script right through the document tree. This has been patched in XWiki 14.10.7 and 15.2RC1.
CVSS Score: 8.3 (HIGH)
CWE: CWE-863, CWE-863
References: https://github.com/xwiki/xwiki-platform/commit/41d7dca2d30084966ca6a7ee537f39ee8354a7e3; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p5f8-qf24-24cj; https://jira.xwiki.org/browse/XWIKI-20625
CVE: CVE-2023-6546
Published: 2023-12-21
Description: A race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two threads execute the GSMIOC_SETCONF ioctl on the same tty file descriptor with the gsm line discipline enabled, and can lead to a use-after-free problem on a struct gsm_dlci while restarting the gsm mux. This could allow a local unprivileged user to escalate their privileges on the system.
CVSS Score: 7.0 (HIGH)
CWE: CWE-366, CWE-362
References: https://access.redhat.com/errata/RHSA-2024:0930; https://access.redhat.com/errata/RHSA-2024:0937; https://access.redhat.com/errata/RHSA-2024:1018
CVE: CVE-2023-7040
Published: 2023-12-21
Description: A vulnerability classified as problematic was found in codelyfe Stupid Simple CMS up to 1.2.4. Affected by this vulnerability is an unknown functionality of the file /file-manager/rename.php. The manipulation of the argument oldName leads to path traversal: '../filedir'. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248689 was assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-24
References: https://github.com/g1an123/POC/blob/main/Unauthorized%20file%20read.md; https://vuldb.com/?ctiid.248689; https://vuldb.com/?id.248689
CVE: CVE-2023-7041
Published: 2023-12-21
Description: A vulnerability, which was classified as critical, has been found in codelyfe Stupid Simple CMS up to 1.2.4. Affected by this issue is some unknown functionality of the file /file-manager/rename.php. The manipulation of the argument newName leads to path traversal: '../filedir'. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-248690 is the identifier assigned to this vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-24
References: https://github.com/g1an123/POC/blob/main/Unauthorized%20file%20overwrite.md; https://vuldb.com/?ctiid.248690; https://vuldb.com/?id.248690