deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-2215
Published: 2024-03-06
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers to connect to an attacker-specified TCP or Unix socket URL, and to reconfigure the plugin using the provided connection test parameters, affecting future build step executions.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2024/03/06/3; https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3200; http://www.openwall.com/lists/oss-security/2024/03/06/3
CVE: CVE-2024-2216
Published: 2024-03-06
Description: A missing permission check in an HTTP endpoint in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified TCP or Unix socket URL, and to reconfigure the plugin using the provided connection test parameters, affecting future build step executions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2024/03/06/3; https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3200; http://www.openwall.com/lists/oss-security/2024/03/06/3
CVE: CVE-2023-50167
Published: 2024-03-06
Description: Pega Platform from 7.1.7 to 23.1.1 is affected by an XSS issue with editing/rendering user html content.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://support.pega.com/support-doc/pega-security-advisory-i23-vulnerability-remediation-note; https://support.pega.com/support-doc/pega-security-advisory-i23-vulnerability-remediation-note
CVE: CVE-2023-50716
Published: 2024-03-06
Description: eProsima Fast DDS (formerly Fast RTPS) is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.13.0, 2.12.2, 2.11.3, 2.10.3, and 2.6.7, an invalid DATA_FRAG Submessage causes a bad-free error, and the Fast-DDS process can be remotely terminated. If an invalid Data_Frag packet is sent, the `Inline_qos, SerializedPayload` member of object `ch` will attempt to release memory without initialization, resulting in a 'bad-free' error. Versions 2.13.0, 2.12.2, 2.11.3, 2.10.2, and 2.6.7 fix this issue.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-416, CWE-416
References: https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-5m2f-hvj2-cx2h; https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-5m2f-hvj2-cx2h
CVE: CVE-2024-24761
Published: 2024-03-06
Description: Galette is a membership management web application for non profit organizations. Starting in version 1.0.0 and prior to version 1.0.2, public pages are per default restricted to only administrators and staff members. From configuration, it is possible to restrict to up-to-date members or to everyone. Version 1.0.2 fixes this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863, CWE-863
References: https://github.com/galette/galette/commit/a5c18bb9819b8da1b3ef58f3e79577083c657fbb; https://github.com/galette/galette/security/advisories/GHSA-jrqg-mpwv-pxpv; https://github.com/galette/galette/commit/a5c18bb9819b8da1b3ef58f3e79577083c657fbb
CVE: CVE-2024-24765
Published: 2024-03-06
Description: CasaOS-UserService provides user management functionalities to CasaOS. Prior to version 0.4.7, path filtering of the URL for user avatar image files was not strict, making it possible to get any file on the system. This could allow an unauthorized actor to access, for example, the CasaOS user database, and possibly obtain system root privileges. Version 0.4.7 fixes this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/IceWhaleTech/CasaOS-UserService/commit/3f4558e23c0a9958f9a0e20aabc64aa8fd51840e; https://github.com/IceWhaleTech/CasaOS-UserService/releases/tag/v0.4.7; https://github.com/IceWhaleTech/CasaOS-UserService/security/advisories/GHSA-h5gf-cmm8-cg7c
CVE: CVE-2024-24767
Published: 2024-03-06
Description: CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, CasaOS doesn't defend against password brute force attacks, which leads to having full access to the server. The web application lacks control over the login attempts. This vulnerability allows attackers to get super user-level access over the server. Version 0.4.7 contains a patch for this issue.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-307, CWE-307
References: https://github.com/IceWhaleTech/CasaOS-UserService/commit/62006f61b55951048dbace4ebd9e[PII_REDACTED]99; https://github.com/IceWhaleTech/CasaOS-UserService/releases/tag/v0.4.7; https://github.com/IceWhaleTech/CasaOS-UserService/security/advisories/GHSA-c69x-5xmw-v44x
CVE: CVE-2024-24766
Published: 2024-03-06
Description: CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, the Casa OS Login page disclosed the username enumeration vulnerability in the login page. An attacker can enumerate the CasaOS username using the application response. If the username is incorrect application gives the error `**User does not exist**`.  If the password is incorrect application gives the error `**Invalid password**`.  Version 0.4.7 fixes this issue.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-204, CWE-203
References: https://github.com/IceWhaleTech/CasaOS-UserService/commit/c75063d7ca5800948e9c09c0a6efe9809b5d39f7; https://github.com/IceWhaleTech/CasaOS-UserService/releases/tag/v0.4.7; https://github.com/IceWhaleTech/CasaOS-UserService/security/advisories/GHSA-c967-2652-gfjm
CVE: CVE-2024-25111
Published: 2024-03-06
Description: Squid is a web proxy cache. Starting in version 3.5.27 and prior to version 6.8, Squid may be vulnerable to a Denial of Service attack against HTTP Chunked decoder due to an uncontrolled recursion bug. This problem allows a remote attacker to cause Denial of Service when sending a crafted, chunked, encoded HTTP Message. This bug is fixed in Squid version 6.8. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. There is no workaround for this issue.
CVSS Score: 8.6 (HIGH)
CWE: CWE-674, CWE-674
References: http://www.squid-cache.org/Versions/v6/SQUID-2024_1.patch; https://github.com/squid-cache/squid/security/advisories/GHSA-72c2-c3wm-8qxc; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7R4KPSO3MQT3KAOZV7LC2GG3CYMCGK7H/
CVE: CVE-2024-27287
Published: 2024-03-06
Description: ESPHome is a system to control your ESP8266/ESP32 for Home Automation systems. Starting in version 2023.12.9 and prior to version 2024.2.2, editing the configuration file API in dashboard component of ESPHome version 2023.12.9 (command line installation and Home Assistant add-on) serves unsanitized data with `Content-Type: text/html; charset=UTF-8`, allowing a remote authenticated user to inject arbitrary web script and exfiltrate session cookies via Cross-Site scripting. It is possible for a malicious authenticated user to inject arbitrary Javascript in configuration files using a POST request to the /edit endpoint, the configuration parameter allows to specify the file to write. To trigger the XSS vulnerability, the victim must visit the page` /edit?configuration=[xss file]`. Abusing this vulnerability a malicious actor could perform operations on the dashboard on the behalf of a logged user, access sensitive information, create, edit and delete configuration files and flash firmware on managed boards.
In addition to this, cookies are not correctly secured, allowing the exfiltration of session cookie values. Version 2024.2.2 contains a patch for this issue.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://github.com/esphome/esphome/commit/37d2b3c7977a4ccbec59726ca7549cb776661455; https://github.com/esphome/esphome/security/advisories/GHSA-9p43-hj5j-96h5; https://github.com/esphome/esphome/commit/37d2b3c7977a4ccbec59726ca7549cb776661455
CVE: CVE-2024-27288
Published: 2024-03-06
Description: 1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.10.1-lts, users can use Burp to obtain unauthorized access to the console page. The vulnerability has been fixed in v1.10.1-lts. There are no known workarounds.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://github.com/1Panel-dev/1Panel/releases/tag/v1.10.1-lts; https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-26w3-q4j8-4xjp; https://github.com/1Panel-dev/1Panel/releases/tag/v1.10.1-lts
CVE: CVE-2024-27289
Published: 2024-03-06
Description: pgx is a PostgreSQL driver and toolkit for Go. Prior to version 4.18.2, SQL injection can occur when all of the following conditions are met: the non-default simple protocol is used; a placeholder for a numeric value must be immediately preceded by a minus; there must be a second placeholder for a string value after the first placeholder; both must be on the same line; and both parameter values must be user-controlled. The problem is resolved in v4.18.2. As a workaround, do not use the simple protocol or do not place a minus directly before a placeholder.

CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: https://github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81df; https://github.com/jackc/pgx/security/advisories/GHSA-m7wr-2xf7-cm9p; https://github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81df
CVE: CVE-2024-27302
Published: 2024-03-06
Description: go-zero is a web and rpc framework. Go-zero allows user to specify a CORS Filter with a configurable allows param - which is an array of domains allowed in CORS policy. However, the `isOriginAllowed` uses `strings.HasSuffix` to check the origin, which leads to bypass via a malicious domain. This vulnerability is capable of breaking CORS policy and thus allowing any page to make requests and/or retrieve data on behalf of other users. Version 1.4.4 fixes this issue.

CVSS Score: 9.1 (CRITICAL)
CWE: CWE-639
References: https://github.com/zeromicro/go-zero/commit/d9d79e930dff6218a873f4f02115df61c38b15db; https://github.com/zeromicro/go-zero/security/advisories/GHSA-fgxv-gw55-r5fq; https://github.com/zeromicro/go-zero/commit/d9d79e930dff6218a873f4f02115df61c38b15db
CVE: CVE-2024-27303
Published: 2024-03-06
Description: electron-builder is a solution to package and build a ready for distribution Electron, Proton Native app for macOS, Windows and Linux. A vulnerability that only affects eletron-builder prior to 24.13.2 in Windows, the NSIS installer makes a system call to open cmd.exe via NSExec in the `.nsh` installer script. NSExec by default searches the current directory of where the installer is located before searching `PATH`. This means that if an attacker can place a malicious executable file named cmd.exe in the same folder as the installer, the installer will run the malicious file. Version 24.13.2 fixes this issue. No known workaround exists. The code executes at the installer-level before the app is present on the system, so there's no way to check if it exists in a current installer.
CVSS Score: 7.3 (HIGH)
CWE: CWE-426, CWE-427
References: https://github.com/electron-userland/electron-builder/commit/8f4acff3c2d45c1cb07779bb3fe79644408ee387; https://github.com/electron-userland/electron-builder/pull/8059; https://github.com/electron-userland/electron-builder/security/advisories/GHSA-r4pf-3v7r-hh55
CVE: CVE-2024-27304
Published: 2024-03-06
Description: pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control. The problem is resolved in v4.18.2 and v5.5.4. As a workaround, reject user input large enough to cause a single query or bind message to exceed 4 GB in size.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-190
References: https://github.com/jackc/pgproto3/commit/945c2126f6db8f3bea7eeebe307c01fe92bca007; https://github.com/jackc/pgproto3/security/advisories/GHSA-7jwh-3vrq-q3m8; https://github.com/jackc/pgx/commit/adbb38f298c76e283ffc7c7a3f571036fea47fd4
CVE: CVE-2024-2173
Published: 2024-03-06
Description: Out of bounds memory access in V8 in Google Chrome prior to 122.0.6261.111 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://chromereleases.googleblog.com/2024/03/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/325893559; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OYEGSHTMXIPXD5OW5CXVWQS3ZUBCBSXG/
CVE: CVE-2024-2174
Published: 2024-03-06
Description: Inappropriate implementation in V8 in Google Chrome prior to 122.0.6261.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-358
References: https://chromereleases.googleblog.com/2024/03/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/325866363; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OYEGSHTMXIPXD5OW5CXVWQS3ZUBCBSXG/
CVE: CVE-2024-2176
Published: 2024-03-06
Description: Use after free in FedCM in Google Chrome prior to 122.0.6261.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/03/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/325936438; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OYEGSHTMXIPXD5OW5CXVWQS3ZUBCBSXG/
CVE: CVE-2023-48703
Published: 2024-03-06
Description: RobotsAndPencils go-saml, a SAML client library written in Go, contains an authentication bypass vulnerability in all known versions. This is due to how the `xmlsec1` command line tool is called internally to verify the signature of SAML assertions. When `xmlsec1` is used without defining the enabled key data, the origin of the public key for the signature verification is, unfortunately, not restricted. That means an attacker can sign the SAML assertions themselves and provide the required public key (e.g. an RSA key) directly embedded in the SAML token. Projects still using RobotsAndPencils/go-saml should move to another SAML library or alternatively remove support for SAML from their projects. The vulnerability can likely temporarily be fixed by forking the go-saml project and adding the command line argument `--enabled-key-data` and specifying a value such as `x509` or `raw-x509-cert` when calling the `xmlsec1` binary in the verify function. Please note that this workaround must be carefully tested before it can be used.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://securitylab.github.com/advisories/GHSL-2023-121_go-saml__archived_/; https://securitylab.github.com/advisories/GHSL-2023-121_go-saml__archived_/
CVE: CVE-2024-27307
Published: 2024-03-06
Description: JSONata is a JSON query and transformation language. Starting in version 1.4.0 and prior to version 1.8.7 and 2.0.4, a malicious expression can use the transform operator to override properties on the `Object` constructor and prototype. This may lead to denial of service, remote code execution or other unexpected behavior in applications that evaluate user-provided JSONata expressions. This issue has been fixed in JSONata versions 1.8.7 and 2.0.4. Applications that evaluate user-provided expressions should update ASAP to prevent exploitation. As a workaround, one may apply the patch manually.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321
References: https://github.com/jsonata-js/jsonata/commit/1d579dbe99c19fbe509f5ba2c6db7959b0d456d1; https://github.com/jsonata-js/jsonata/commit/335d38f6278e96c908b24183f1c9c90afc8ae00c; https://github.com/jsonata-js/jsonata/commit/c907b5e517bb718015fcbd993d742ba6202f2be2
CVE: CVE-2024-27308
Published: 2024-03-06
Description: Mio is a Metal I/O library for Rust. When using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes that have already been deregistered from the mio registry. The impact of this vulnerability depends on how mio is used. For some applications, invalid tokens may be ignored or cause a warning or a crash. On the other hand, for applications that store pointers in the tokens, this vulnerability may result in a use-after-free. For users of Tokio, this vulnerability is serious and can result in a use-after-free in Tokio. The vulnerability is Windows-specific, and can only happen if you are using named pipes. Other IO resources are not affected. This vulnerability has been fixed in mio v0.8.11. All versions of mio between v0.7.2 and v0.8.10 are vulnerable. Tokio is vulnerable when you are using a vulnerable version of mio AND you are using at least Tokio v1.30.0. Versions of Tokio prior to v1.30.0 will ignore invalid tokens, so they are not vulnerable. Vulnerable libraries that use mio can work around this issue by detecting and ignoring invalid tokens.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416, CWE-672
References: https://github.com/tokio-rs/mio/commit/90d4fe00df870acd3d38f3dc4face9aacab8fbb9; https://github.com/tokio-rs/mio/pull/1760; https://github.com/tokio-rs/mio/security/advisories/GHSA-r8w9-5wcg-vfj7
CVE: CVE-2024-27915
Published: 2024-03-06
Description: Sulu is a PHP content management system. Starting in verson 2.2.0 and prior to version 2.4.17 and 2.5.13, access to pages is granted regardless of role permissions for webspaces which have a security system configured and permission check enabled. Webspaces without do not have this issue. The problem is patched in versions 2.4.17 and 2.5.13. Some workarounds are available. One may apply the patch to `vendor/symfony/security-http/HttpUtils.php` manually or avoid installing `symfony/security-http` versions greater equal than `v5.4.30` or `v6.3.6`.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://github.com/sulu/sulu/commit/ec9c3f99e15336dc4f6877f512300f231c17c6da; https://github.com/sulu/sulu/security/advisories/GHSA-jr83-m233-gg6p; https://github.com/sulu/sulu/commit/ec9c3f99e15336dc4f6877f512300f231c17c6da
CVE: CVE-2024-27917
Published: 2024-03-06
Description: Shopware is an open commerce platform based on Symfony Framework and Vue. The Symfony Session Handler pops the Session Cookie and assigns it to the Response. Since Shopware 6.5.8.0, the 404 pages are cached to improve the performance of 404 pages. So the cached Response which contains a Session Cookie when the Browser accessing the 404 page, has no cookies yet. The Symfony Session Handler is in use, when no explicit Session configuration has been done. When Redis is in use for Sessions using the PHP Redis extension, this exploiting code is not used. Shopware version 6.5.8.7 contains a patch for this issue. As a workaround, use Redis for Sessions, as this does not trigger the exploit code.
CVSS Score: 7.5 (HIGH)
CWE: CWE-524
References: https://github.com/shopware/shopware/commit/7d9cb03225efca5f97e69b800d8747598dd15ce3; https://github.com/shopware/shopware/releases/tag/v6.5.8.7; https://github.com/shopware/shopware/security/advisories/GHSA-c2f9-4jmm-v45m
CVE: CVE-2024-28110
Published: 2024-03-06
Description: Go SDK for CloudEvents is the official CloudEvents SDK to integrate applications with CloudEvents. Prior to version 2.15.2, using cloudevents.WithRoundTripper to create a cloudevents.Client with an authenticated http.RoundTripper causes the go-sdk to leak credentials to arbitrary endpoints. When the transport is populated with an authenticated transport, then http.DefaultClient is modified with the authenticated transport and will start to send Authorization tokens to any endpoint it is used to contact. Version 2.15.2 patches this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: https://github.com/cloudevents/sdk-go/blob/67e389964131d55d65cd14b4eb32d57a47312695/v2/protocol/http/protocol.go#L104-L110; https://github.com/cloudevents/sdk-go/commit/de2f28370b0d2a0f64f92c0c6139fa4b8a7c3851; https://github.com/cloudevents/sdk-go/security/advisories/GHSA-5pf6-2qwx-pxm2
CVE: CVE-2024-28111
Published: 2024-03-06
Description: Canarytokens helps track activity and actions on a network. Canarytokens.org supports exporting the history of a Canarytoken's incidents in CSV format. The generation of these CSV files is vulnerable to a CSV Injection vulnerability. This flaw can be used by an attacker who discovers an HTTP-based Canarytoken to target the Canarytoken's owner, if the owner exports the incident history to CSV and opens in a reader application such as Microsoft Excel. The impact is that this issue could lead to code execution on the machine on which the CSV file is opened. Version sha-c595a1f8 contains a fix for this issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1236
References: https://github.com/thinkst/canarytokens/commit/c595a1f884b986da2ca05aa5bff9ae5f93c6a4aa; https://github.com/thinkst/canarytokens/security/advisories/GHSA-fqh6-v4qp-65fv; https://github.com/thinkst/canarytokens/commit/c595a1f884b986da2ca05aa5bff9ae5f93c6a4aa
CVE: CVE-2024-2236
Published: 2024-03-06
Description: A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-385
References: https://access.redhat.com/errata/RHSA-2024:9404; https://access.redhat.com/errata/RHSA-2025:3530; https://access.redhat.com/errata/RHSA-2025:3534
CVE: CVE-2023-47415
Published: 2024-03-07
Description: Cypress Solutions CTM-200 v2.7.1.5600 and below was discovered to contain an OS command injection vulnerability via the cli_text parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78
References: http://ctm-200.com; http://cypress.com; https://gitlab.com/loudmouth-security/vulnerability-disclosures/cve-2023-47415
CVE: CVE-2023-49986
Published: 2024-03-07
Description: A cross-site scripting (XSS) vulnerability in the component /admin/parent of School Fees Management System 1.0 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name parameter.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://github.com/geraldoalcantara/CVE-2023-49986; https://www.sourcecodester.com/php/15697/school-fees-management-system-project-php-and-codeigniter-free-source-code.html; https://github.com/geraldoalcantara/CVE-2023-49986
CVE: CVE-2023-49987
Published: 2024-03-07
Description: A cross-site scripting (XSS) vulnerability in the component /management/term of School Fees Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the tname parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/geraldoalcantara/CVE-2023-49987; https://www.sourcecodester.com/php/15697/school-fees-management-system-project-php-and-codeigniter-free-source-code.html; https://github.com/geraldoalcantara/CVE-2023-49987
CVE: CVE-2023-49988
Published: 2024-03-07
Description: Hotel Booking Management v1.0 was discovered to contain a SQL injection vulnerability via the npss parameter at rooms.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/geraldoalcantara/CVE-2023-49988; https://github.com/pratham-jaiswal/HotelBookingManagement; https://github.com/geraldoalcantara/CVE-2023-49988
CVE: CVE-2023-49989
Published: 2024-03-07
Description: Hotel Booking Management v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at update.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/geraldoalcantara/CVE-2023-49989; https://github.com/pratham-jaiswal/HotelBookingManagement; https://github.com/geraldoalcantara/CVE-2023-49989