deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-32679
Published: 2024-04-23
Description: Missing Authorization vulnerability in Anssi Laitila Shared Files shared-files.This issue affects Shared Files: from n/a through <= 1.7.16.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/shared-files/vulnerability/wordpress-shared-files-plugin-1-7-16-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/shared-files/wordpress-shared-files-plugin-1-7-16-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-33211
Published: 2024-04-23
Description: Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the PPPOEPassword parameter in ip/goform/QuickIndex.
CVSS Score: 7.3 (HIGH)
CWE: CWE-121
References: https://palm-vertebra-fe9.notion.site/formQuickIndex-e1f24466830f4cb4a7756d6997f411b4; https://palm-vertebra-fe9.notion.site/formQuickIndex-e1f24466830f4cb4a7756d6997f411b4
CVE: CVE-2024-33212
Published: 2024-04-23
Description: Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the funcpara1 parameter in ip/goform/setcfm.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://palm-vertebra-fe9.notion.site/formSetCfm-7d199da0fd0740988a498304905e2dd1; https://palm-vertebra-fe9.notion.site/formSetCfm-7d199da0fd0740988a498304905e2dd1
CVE: CVE-2024-33213
Published: 2024-04-23
Description: Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the mitInterface parameter in ip/goform/RouteStatic.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121
References: https://palm-vertebra-fe9.notion.site/fromRouteStatic_2-e98a555978be404583fef5f5c1e50efa; https://palm-vertebra-fe9.notion.site/fromRouteStatic_2-e98a555978be404583fef5f5c1e50efa
CVE: CVE-2024-33214
Published: 2024-04-23
Description: Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the entrys parameter in ip/goform/RouteStatic.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://palm-vertebra-fe9.notion.site/fromRouteStatic_1-c8b6c87ee247481c9728a4ed4c6ac853; https://palm-vertebra-fe9.notion.site/fromRouteStatic_1-c8b6c87ee247481c9728a4ed4c6ac853
CVE: CVE-2024-33215
Published: 2024-04-23
Description: Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the mitInterface parameter in ip/goform/addressNat.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://palm-vertebra-fe9.notion.site/fromAddressNat_mitInterface-20fb[PII_REDACTED]5082243e393b11fd1c; https://palm-vertebra-fe9.notion.site/fromAddressNat_mitInterface-20fb[PII_REDACTED]5082243e393b11fd1c
CVE: CVE-2024-33217
Published: 2024-04-23
Description: Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the page parameter in ip/goform/addressNat.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://palm-vertebra-fe9.notion.site/fromAddressNat_page-e9c05fb00f89482fa340d21bbda30642; https://palm-vertebra-fe9.notion.site/fromAddressNat_page-e9c05fb00f89482fa340d21bbda30642
CVE: CVE-2024-32258
Published: 2024-04-23
Description: The network server of fceux 2.7.0 has a path traversal vulnerability, allowing attackers to overwrite any files on the server without authentication by fake ROM.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://github.com/TASEmulators/fceux/issues/727; https://github.com/liyansong2018/CVE-2024-32258; https://github.com/TASEmulators/fceux/issues/727
CVE: CVE-2024-21972
Published: 2024-04-23
Description: 
An out of bounds write vulnerability in the AMD Radeon™ user mode driver for DirectX® 11 could allow an attacker with access to a malformed shader to potentially achieve arbitrary code execution.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-787
References: https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6012.html; https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6012.html; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1848
CVE: CVE-2024-21979
Published: 2024-04-23
Description: 
An out of bounds write vulnerability in the AMD Radeon™ user mode driver for DirectX® 11 could allow an attacker with access to a malformed shader to potentially achieve arbitrary code execution.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-787
References: https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6012.html; https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6012.html; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1847
CVE: CVE-2024-31208
Published: 2024-04-23
Description: Synapse is an open-source Matrix homeserver. A remote Matrix user with malicious intent, sharing a room with Synapse instances before 1.105.1, can dispatch specially crafted events to exploit a weakness in the V2 state resolution algorithm. This can induce high CPU consumption and accumulate excessive data in the database of such instances, resulting in a denial of service. Servers in private federations, or those that do not federate, are not affected. Server administrators should upgrade to 1.105.1 or later. Some workarounds are available. One can ban the malicious users or ACL block servers from the rooms and/or leave the room and purge the room using the admin API.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://github.com/element-hq/synapse/commit/55b0aa847a61774b6a3acdc4b177a20dc019f01a; https://github.com/element-hq/synapse/releases/tag/v1.105.1; https://github.com/element-hq/synapse/security/advisories/GHSA-3h7q-rfh9-xm4v
CVE: CVE-2024-32482
Published: 2024-04-23
Description: The Tillitis TKey signer device application is an ed25519 signing tool. A vulnerability has been found that makes it possible to disclose portions of the TKey’s data in RAM over the USB interface. To exploit the vulnerability an attacker needs to use a custom client application and to touch the TKey. No secret is disclosed. All client applications integrating tkey-device-signer should upgrade to version 1.0.0 to receive a fix. No known workarounds are available.
CVSS Score: 2.2 (LOW)
CWE: CWE-125, CWE-367
References: https://bugbounty.tillitis.se/security-bulletins/tillitis-security-bulletin-240115-1; https://github.com/tillitis/tkey-device-signer/security/advisories/GHSA-frqc-62hv-379p; https://bugbounty.tillitis.se/security-bulletins/tillitis-security-bulletin-240115-1
CVE: CVE-2024-32658
Published: 2024-04-23
Description: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read. Version 3.5.1 contains a patch for the issue. No known workarounds are available.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125, CWE-125
References: https://github.com/FreeRDP/FreeRDP/commit/1a755d898ddc028cc818d0dd9d49d5acff4c44bf; https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vpv3-m3m9-4c2v; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/
CVE: CVE-2024-4062
Published: 2024-04-23
Description: A vulnerability was found in Hualai Xiaofang iSC5 3.2.2_112 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to improper certificate validation. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The identifier of this vulnerability is VDB-261788. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.7 (LOW)
CWE: CWE-295
References: https://github.com/kzLiu2017/CVE_Document/blob/main/Hualai_Xiaofang_camera.pdf; https://vuldb.com/?ctiid.261788; https://vuldb.com/?id.261788
CVE: CVE-2024-4063
Published: 2024-04-23
Description: A vulnerability was found in EZVIZ CS-C6-21WFR-8 5.2.7 Build 170628. It has been classified as problematic. This affects an unknown part of the component Davinci Application. The manipulation leads to improper certificate validation. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The identifier VDB-261789 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.7 (LOW)
CWE: CWE-295
References: https://github.com/kzLiu2017/CVE_Document/blob/main/CVE_%20advisory_ezviz.pdf; https://vuldb.com/?ctiid.261789; https://vuldb.com/?id.261789
CVE: CVE-2024-32659
Published: 2024-04-23
Description: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read if `((nWidth == 0) and (nHeight == 0))`. Version 3.5.1 contains a patch for the issue. No known workarounds are available.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125, CWE-125
References: https://github.com/FreeRDP/FreeRDP/commit/6430945ce003a5e24d454d8566f54aae1b6b617b; https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8jgr-7r33-x87w; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/
CVE: CVE-2024-32660
Published: 2024-04-23
Description: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.5.1, a malicious server can crash the FreeRDP client by sending invalid huge allocation size. Version 3.5.1 contains a patch for the issue. No known workarounds are available.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-770
References: https://github.com/FreeRDP/FreeRDP/commit/5e5d27cf310e4c10b854be7667bfb7a5d774eb47; https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mxv6-2cw6-m3mx; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/
CVE: CVE-2024-32661
Published: 2024-04-23
Description: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to a possible `NULL` access and crash. Version 3.5.1 contains a patch for the issue. No known workarounds are available.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://github.com/FreeRDP/FreeRDP/commit/71e463e31b4d69f4022d36bfc814592f56600793; https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-p5m5-342g-pv9m; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/
CVE: CVE-2024-4064
Published: 2024-04-23
Description: A vulnerability was found in Tenda AC8 16.03.34.09. It has been declared as critical. This vulnerability affects the function R7WebsSecurityHandler of the file /goform/execCommand. The manipulation of the argument password leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-261790 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC8/R7WebsSecurityHandler.md; https://vuldb.com/?ctiid.261790; https://vuldb.com/?id.261790
CVE: CVE-2024-4065
Published: 2024-04-23
Description: A vulnerability was found in Tenda AC8 16.03.34.09. It has been rated as critical. This issue affects the function formSetRebootTimer of the file /goform/SetRebootTimer. The manipulation of the argument rebootTime leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-261791. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC8/formSetRebootTimer.md; https://vuldb.com/?ctiid.261791; https://vuldb.com/?id.261791
CVE: CVE-2024-32662
Published: 2024-04-23
Description: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read. This occurs when `WCHAR` string is read with twice the size it has and converted to `UTF-8`, `base64` decoded. The string is only used to compare against the redirection server certificate. Version 3.5.1 contains a patch for the issue. No known workarounds are available.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: https://github.com/FreeRDP/FreeRDP/commit/626d10a94a88565d957ddc30768ed08b320049a7; https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vffh-j6hh-95f4; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/
CVE: CVE-2024-32866
Published: 2024-04-23
Description: Conform, a type-safe form validation library, allows the parsing of nested objects in the form of `object.property`. Due to an improper implementation of this feature in versions prior to 1.1.1, an attacker can exploit the feature to trigger prototype pollution by passing a crafted input to `parseWith...` functions. Applications that use conform for server-side validation of form data or URL parameters are affected by this vulnerability. Version 1.1.1 contains a patch for the issue.

CVSS Score: 8.6 (HIGH)
CWE: CWE-1321
References: https://github.com/edmundhung/conform/blob/59156d7115a7207fa3b6f8a70a4342a9b24c2501/packages/conform-dom/formdata.ts#L117; https://github.com/edmundhung/conform/commit/4819d51b5a53fd5486fc85c17cdc148eb160e3de; https://github.com/edmundhung/conform/security/advisories/GHSA-624g-8qjg-8qxf
CVE: CVE-2024-32869
Published: 2024-04-23
Description: Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.2.7, when using serveStatic with deno, it is possible to traverse the directory where `main.ts` is located. This can result in retrieval of unexpected files. Version 4.2.7 contains a patch for the issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/honojs/hono/commit/92e65fbb6e5e7372650e7690dbd84938432d9e65; https://github.com/honojs/hono/security/advisories/GHSA-3mpf-rcc7-5347; https://github.com/honojs/hono/commit/92e65fbb6e5e7372650e7690dbd84938432d9e65
CVE: CVE-2024-32875
Published: 2024-04-23
Description: Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.125.3, title arguments in Markdown for links and images not escaped in internal render hooks. Hugo users who are impacted are those who have these hooks enabled and do not trust their Markdown content files. The issue is patched in v0.125.3. As a workaround, replace the templates with user defined templates or disable the internal templates.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-80
References: https://github.com/gohugoio/hugo/releases/tag/v0.125.3; https://github.com/gohugoio/hugo/security/advisories/GHSA-ppf8-hhpp-f5hj; https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault
CVE: CVE-2024-4066
Published: 2024-04-23
Description: A vulnerability classified as critical has been found in Tenda AC8 16.03.34.09. Affected is the function fromAdvSetMacMtuWan of the file /goform/AdvSetMacMtuWan. The manipulation of the argument wanMTU/wanSpeed/cloneType/mac/serviceName/serverName leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-261792. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC8/fromAdvSetMacMtuWan.md; https://vuldb.com/?ctiid.261792; https://vuldb.com/?id.261792
CVE: CVE-2023-47357
Published: 2024-04-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-48938
Published: 2024-04-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-48939
Published: 2024-04-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2024-27536
Published: 2024-04-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2024-27537
Published: 2024-04-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2024-30886
Published: 2024-04-23
Description: A stored cross-site scripting (XSS) vulnerability in the remotelink function of HadSky v7.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the url parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Hebing123/cve/issues/30; https://github.com/Hebing123/cve/issues/30
CVE: CVE-2024-31616
Published: 2024-04-23
Description: An issue discovered in RG-RSR10-01G-T(W)-S and RG-RSR10-01G-T(WA)-S routers with firmware version RSR10-01G-T-S_RSR_3.0(1)B9P2, Release(07150910) allows attackers to execute arbitrary code via the common_quick_config.lua file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-790
References: https://gist.github.com/Swind1er/0c50e72428059fb72a4fd4d31c43f883; https://gist.github.com/Swind1er/0c50e72428059fb72a4fd4d31c43f883
CVE: CVE-2024-4069
Published: 2024-04-23
Description: A vulnerability, which was classified as critical, was found in Kashipara Online Furniture Shopping Ecommerce Website 1.0. This affects an unknown part of the file search.php. The manipulation of the argument txtSearch leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-261795.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Online%20Furniture%20Shopping%20Ecommerce%20Website/Online%20Furniture%20Shopping%20Ecommerce%20Website%20Project%20-%20vuln%201.pdf; https://vuldb.com/?ctiid.261795; https://vuldb.com/?id.261795
CVE: CVE-2024-4070
Published: 2024-04-23
Description: A vulnerability has been found in Kashipara Online Furniture Shopping Ecommerce Website 1.0 and classified as critical. This vulnerability affects unknown code of the file prodList.php. The manipulation of the argument prodType leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-261796.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Online%20Furniture%20Shopping%20Ecommerce%20Website/Online%20Furniture%20Shopping%20Ecommerce%20Website%20Project%20-%20vuln%202.pdf; https://vuldb.com/?ctiid.261796; https://vuldb.com/?id.261796
CVE: CVE-2024-4071
Published: 2024-04-23
Description: A vulnerability was found in Kashipara Online Furniture Shopping Ecommerce Website 1.0 and classified as critical. This issue affects some unknown processing of the file prodInfo.php. The manipulation of the argument prodId leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-261797 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Online%20Furniture%20Shopping%20Ecommerce%20Website/Online%20Furniture%20Shopping%20Ecommerce%20Website%20Project%20-%20vuln%203.pdf; https://vuldb.com/?ctiid.261797; https://vuldb.com/?id.261797
CVE: CVE-2024-4072
Published: 2024-04-23
Description: A vulnerability was found in Kashipara Online Furniture Shopping Ecommerce Website 1.0. It has been classified as problematic. Affected is an unknown function of the file search.php. The manipulation of the argument txtSearch leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-261798 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Online%20Furniture%20Shopping%20Ecommerce%20Website/Online%20Furniture%20Shopping%20Ecommerce%20Website%20Project%20-%20vuln%204.pdf; https://vuldb.com/?ctiid.261798; https://vuldb.com/?id.261798
CVE: CVE-2024-4073
Published: 2024-04-23
Description: A vulnerability was found in Kashipara Online Furniture Shopping Ecommerce Website 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file prodList.php. The manipulation of the argument prodType leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-261799.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Online%20Furniture%20Shopping%20Ecommerce%20Website/Online%20Furniture%20Shopping%20Ecommerce%20Website%20Project%20-%20vuln%205.pdf; https://vuldb.com/?ctiid.261799; https://vuldb.com/?id.261799
CVE: CVE-2024-4074
Published: 2024-04-23
Description: A vulnerability was found in Kashipara Online Furniture Shopping Ecommerce Website 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file prodInfo.php. The manipulation of the argument prodId leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-261800.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Online%20Furniture%20Shopping%20Ecommerce%20Website/Online%20Furniture%20Shopping%20Ecommerce%20Website%20Project%20-%20vuln%206.pdf; https://vuldb.com/?ctiid.261800; https://vuldb.com/?id.261800
CVE: CVE-2024-4075
Published: 2024-04-23
Description: A vulnerability classified as problematic has been found in Kashipara Online Furniture Shopping Ecommerce Website 1.0. This affects an unknown part of the file login.php. The manipulation of the argument txtAddress leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-261801 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Online%20Furniture%20Shopping%20Ecommerce%20Website/Online%20Furniture%20Shopping%20Ecommerce%20Website%20Project%20-%20vuln%207.pdf; https://vuldb.com/?ctiid.261801; https://vuldb.com/?id.261801
CVE: CVE-2024-4093
Published: 2024-04-24
Description: A vulnerability, which was classified as critical, was found in SourceCodester Simple Subscription Website 1.0. Affected is an unknown function of the file view_application.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-261822 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/4wchen/Cve/blob/main/Simple%20Subscription%20Website%20with%20Admin%20System%20view_application.php%20has%20Sqlinjection.pdf; https://vuldb.com/?ctiid.261822; https://vuldb.com/?id.261822