deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-57438
Published: 2025-01-29
Description: Insecure permissions in RuoYi v4.8.0 allows authenticated attackers to escalate privileges by assigning themselves higher level roles.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-863
References: https://gitee.com/y_project/RuoYi; https://github.com/peccc/restful_vul/blob/main/ruoyi_insecure_role_assignments/ruoyi_insecure_role_assignments.md; https://github.com/yangzongzhuan/RuoYi
CVE: CVE-2024-57439
Published: 2025-01-29
Description: An issue in the reset password interface of ruoyi v4.8.0 allows attackers with Admin privileges to cause a Denial of Service (DoS) by duplicating the login name of the account.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-281
References: https://gitee.com/y_project/RuoYi; https://github.com/peccc/restful_vul/blob/main/ruoyi_dos/ruoyi_dos.md; https://github.com/yangzongzhuan/RuoYi
CVE: CVE-2025-24374
Published: 2025-01-29
Description: Twig is a template language for PHP. When using the ?? operator, output escaping was missing for the expression on the left side of the operator. This vulnerability is fixed in 3.19.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-74
References: https://github.com/twigphp/Twig/commit/38576b12f05df3cc871bf68f39ccb46b418334a3; https://github.com/twigphp/Twig/security/advisories/GHSA-3xg3-cgvq-2xwr
CVE: CVE-2025-24792
Published: 2025-01-29
Description: Snowflake PHP PDO Driver is a driver that uses the PHP Data Objects (PDO) extension to connect to the Snowflake database. Snowflake discovered and remediated a vulnerability in the Snowflake PHP PDO Driver where executing unsupported queries like PUT or GET on stages causes a signed-to-unsigned conversion error that crashes the application using the Driver. This vulnerability affects versions 0.2.0 through 3.0.3. Snowflake fixed the issue in version 3.1.0.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-195
References: https://github.com/snowflakedb/pdo_snowflake/security/advisories/GHSA-f8q2-7fv5-cg93
CVE: CVE-2023-35907
Published: 2025-01-29
Description: IBM Aspera Faspex 5.0.0 through 5.0.10 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-521
References: https://www.ibm.com/support/pages/node/7181814
CVE: CVE-2023-37398
Published: 2025-01-29
Description: IBM Aspera Faspex 5.0.0 through 5.0.10 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-521
References: https://www.ibm.com/support/pages/node/7181814
CVE: CVE-2023-37412
Published: 2025-01-29
Description: IBM Aspera Faspex 5.0.0 through 5.0.10 could allow a privileged user to make system changes without proper access controls.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-250
References: https://www.ibm.com/support/pages/node/7181814
CVE: CVE-2023-37413
Published: 2025-01-29
Description: IBM Aspera Faspex 5.0.0 through 5.0.10 could disclose sensitive username information due to an observable response discrepancy.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-204, CWE-203
References: https://www.ibm.com/support/pages/node/7181814
CVE: CVE-2025-24527
Published: 2025-01-29
Description: An issue was discovered in Akamai Enterprise Application Access (EAA) before 2025-01-17. If an admin knows another tenant's 128-bit connector GUID, they can execute debug commands on that connector.
CVSS Score: 8.0 (HIGH)
CWE: CWE-732
References: https://techdocs.akamai.com/eaa/changelog; https://techdocs.akamai.com/eaa/changelog/january-29-2025
CVE: CVE-2025-24791
Published: 2025-01-29
Description: snowflake-connector-nodejs is a NodeJS driver for Snowflake. Snowflake discovered and remediated a vulnerability in the Snowflake NodeJS Driver. File permissions checks of the temporary credential cache could be bypassed by an attacker with write access to the local cache directory. This vulnerability affects versions 1.12.0 through 2.0.1 on Linux. Snowflake fixed the issue in version 2.0.2.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-281
References: https://github.com/snowflakedb/snowflake-connector-nodejs/commit/89731b3a4d61a75b721d13d4e47a7a3712ffa45f; https://github.com/snowflakedb/snowflake-connector-nodejs/security/advisories/GHSA-xfhv-wqj6-rx99
CVE: CVE-2025-24789
Published: 2025-01-29
Description: Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Snowflake discovered and remediated a vulnerability in the Snowflake JDBC Driver. When the EXTERNALBROWSER authentication method is used on Windows, an attacker with write access to a directory in the %PATH% can escalate their privileges to the user that runs the vulnerable JDBC Driver version. This vulnerability affects versions 3.2.3 through 3.21.0 on Windows. Snowflake fixed the issue in version 3.22.0.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://github.com/snowflakedb/snowflake-jdbc/commit/4f01bb8f9b708c71e7a2111c87371dbfc1d53dd6; https://github.com/snowflakedb/snowflake-jdbc/security/advisories/GHSA-7hpq-3g6w-pvhf
CVE: CVE-2025-24790
Published: 2025-01-29
Description: Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Snowflake discovered and remediated a vulnerability in the Snowflake JDBC Driver. On Linux systems, when temporary credential caching is enabled, the Snowflake JDBC Driver will cache temporary credentials locally in a world-readable file. This vulnerability affects versions 3.6.8 through 3.21.0. Snowflake fixed the issue in version 3.22.0.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-276
References: https://github.com/snowflakedb/snowflake-jdbc/commit/9e1a5acf12406b16c4780ca013f4c4db48b74b59; https://github.com/snowflakedb/snowflake-jdbc/security/advisories/GHSA-33g6-495w-v8j2
CVE: CVE-2025-24882
Published: 2025-01-29
Description: regclient is a Docker and OCI Registry Client in Go. A malicious registry could return a different digest for a pinned manifest without detection. This vulnerability is fixed in 0.7.1.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-20, CWE-345
References: https://github.com/regclient/regclient/commit/7d17cff26c22196b5ddd66bda8c5ee4abf3d1269; https://github.com/regclient/regclient/security/advisories/GHSA-qv35-3gw6-8q4j
CVE: CVE-2024-10001
Published: 2025-01-29
Description: A Code Injection vulnerability was identified in GitHub Enterprise Server that allowed attackers to inject malicious code into the query selector via the identity property in the message handling function. This enabled the exfiltration of sensitive data by manipulating the DOM, including authentication tokens. To execute the attack, the victim must be logged into GitHub and interact with the attacker controlled malicious webpage containing the hidden iframe. This vulnerability occurs due to an improper sequence of validation, where the origin check occurs after accepting the user-controlled identity property. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.11.16, 3.12.10, 3.13.5, 3.14.2, and 3.15.0. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS Score: 7.1 (HIGH)
CWE: CWE-94
References: https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.17; https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.11; https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.6
CVE: CVE-2024-48849
Published: 2025-01-29
Description: Missing Origin Validation in WebSockets vulnerability in FLXEON. Session management was not sufficient to prevent unauthorized HTTPS requests. This issue affects FLXEON: through <= 9.3.4.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-1385
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108470A5684&LanguageCode=en&DocumentPartId=PDF&Action=Launch
CVE: CVE-2024-48852
Published: 2025-01-29
Description: Insertion of Sensitive Information into Log File vulnerability observed in FLEXON. Some information may be improperly disclosed through https access.
 

This issue affects FLXEON through <= 9.3.4.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-532
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108470A5684&LanguageCode=en&DocumentPartId=PDF&Action=Launch
CVE: CVE-2025-0840
Published: 2025-01-29
Description: A vulnerability, which was classified as problematic, was found in GNU Binutils up to 2.43. This affects the function disassemble_bytes of the file binutils/objdump.c. The manipulation of the argument buf leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 2.44 is able to address this issue. The identifier of the patch is baac6c221e9d69335bf41366a1c7d87d8ab2f893. It is recommended to upgrade the affected component.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119, CWE-121, CWE-787
References: https://sourceware.org/bugzilla/attachment.cgi?id=15882; https://sourceware.org/bugzilla/show_bug.cgi?id=32560; https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=baac6c221e9d69335bf41366a1c7d87d8ab2f893
CVE: CVE-2025-20014
Published: 2025-01-29
Description: mySCADA myPRO does not properly neutralize POST requests sent to a specific port with version information. This vulnerability could be exploited by an attacker to execute arbitrary commands on the affected system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-023-01
CVE: CVE-2025-20061
Published: 2025-01-29
Description: mySCADA myPRO does not properly neutralize POST requests sent to a specific port with email information. This vulnerability could be exploited by an attacker to execute arbitrary commands on the affected system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-023-01
CVE: CVE-2025-0841
Published: 2025-01-29
Description: A vulnerability has been found in Aridius XYZ up to 20240927 on OpenCart and classified as critical. This vulnerability affects the function loadMore of the component News. The manipulation leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
CVSS Score: 7.3 (HIGH)
CWE: CWE-20, CWE-502
References: https://gist.github.com/mcdruid/52383f40d11becb79ce4033cb46546eb; https://vuldb.com/?ctiid.293998; https://vuldb.com/?id.293998
CVE: CVE-2025-24788
Published: 2025-01-29
Description: snowflake-connector-net is the Snowflake Connector for .NET. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for .NET in which files downloaded from stages are temporarily placed in a world-readable local directory, making them accessible to unauthorized users on the same machine. This vulnerability affects versions 2.0.12 through 4.2.0 on Linux and macOS. Snowflake fixed the issue in version 4.3.0.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-276
References: https://github.com/snowflakedb/snowflake-connector-net/commit/89d91e8316ca213c5d184bcf469ed93977a5edf9; https://github.com/snowflakedb/snowflake-connector-net/security/advisories/GHSA-2mqw-rq5m-8hc8
CVE: CVE-2025-24793
Published: 2025-01-29
Description: The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. A function from the snowflake.connector.pandas_tools module is vulnerable to SQL injection. This vulnerability affects versions 2.2.5 through 3.13.0. Snowflake fixed the issue in version 3.13.1.
CVSS Score: 7.0 (HIGH)
CWE: CWE-89
References: https://github.com/snowflakedb/snowflake-connector-python/commit/f3f9b666518d29c31a49384bbaa9a65889e72056; https://github.com/snowflakedb/snowflake-connector-python/security/advisories/GHSA-2vpq-fh52-j3wv
CVE: CVE-2025-24794
Published: 2025-01-29
Description: The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. The OCSP response cache uses pickle as the serialization format, potentially leading to local privilege escalation. This vulnerability affects versions 2.7.12 through 3.13.0. Snowflake fixed the issue in version 3.13.1.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-502
References: https://github.com/snowflakedb/snowflake-connector-python/commit/3769b43822357c3874c40f5e74068458c2dc79af; https://github.com/snowflakedb/snowflake-connector-python/security/advisories/GHSA-m4f6-vcj4-w5mx
CVE: CVE-2025-24795
Published: 2025-01-29
Description: The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. On Linux systems, when temporary credential caching is enabled, the Snowflake Connector for Python will cache temporary credentials locally in a world-readable file. This vulnerability affects versions 2.3.7 through 3.13.0. Snowflake fixed the issue in version 3.13.1.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-276
References: https://github.com/snowflakedb/snowflake-connector-python/commit/3769b43822357c3874c40f5e74068458c2dc79af; https://github.com/snowflakedb/snowflake-connector-python/security/advisories/GHSA-r2x6-cjg7-8r43
CVE: CVE-2025-24884
Published: 2025-01-29
Description: kube-audit-rest is a simple logger of mutation/creation requests to the k8s api. If the "full-elastic-stack" example vector configuration was used for a real cluster, the previous values of kubernetes secrets would have been disclosed in the audit messages. This vulnerability is fixed in 1.0.16.
CWE: CWE-200, CWE-212, CWE-532
References: https://github.com/RichardoC/kube-audit-rest/commit/db1aa5b867256b0a7bf206544c6981ab068b73dc; https://github.com/RichardoC/kube-audit-rest/security/advisories/GHSA-hcr5-wv4p-h2g2
CVE: CVE-2024-11187
Published: 2025-01-29
Description: It is possible to construct a zone such that some queries to it will generate responses containing numerous records in the Additional section. An attacker sending many such queries can cause either the authoritative server itself or an independent resolver to use disproportionate resources processing the queries. Zones will usually need to have been deliberately crafted to attack this exposure.
This issue affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.32-S1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-405
References: https://kb.isc.org/docs/cve-2024-11187; https://lists.debian.org/debian-lts-announce/2025/02/msg00011.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-12705
Published: 2025-01-29
Description: Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it with crafted valid or invalid HTTP/2 traffic.
This issue affects BIND 9 versions 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, and 9.18.11-S1 through 9.18.32-S1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://kb.isc.org/docs/cve-2024-12705; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-23733
Published: 2025-01-29
Description: The /WmAdmin/,/invoke/vm.server/login login page in the Integration Server in Software AG webMethods 10.15.0 before Core_Fix7 allows remote attackers to reach the administration panel and discover hostname and version information by sending an arbitrary username and a blank password to the /WmAdmin/#/login/ URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: https://github.com/ekcrsm/CVE-2024-23733/tree/main
CVE: CVE-2024-48761
Published: 2025-01-29
Description: Reflected XSS vulnerability in Celk Sistemas Celk Saude v.3.1.252.1 allows a remote attacker to inject arbitrary JavaScript code via the "erro" parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: https://github.com/gabriel-bri/vulnerability-research/tree/main/CVE-2024-48761; https://github.com/gabriel-bri/vulnerability-research/tree/main/CVE-2024-48761
CVE: CVE-2024-51182
Published: 2025-01-29
Description: HTML Injection vulnerability in Celk Sistemas Celk Saude v.3.1.252.1 allows a remote attacker to inject arbitrary HTML code via the "erro" parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/gabriel-bri/vulnerability-research/tree/main/CVE-2024-51182
CVE: CVE-2024-54851
Published: 2025-01-29
Description: Teedy <= 1.12 is vulnerable to Cross Site Request Forgery (CSRF), due to the lack of CSRF protection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/Tanguy-Boisset/CVE/blob/master/CVE-2024-54851/README.md
CVE: CVE-2024-54852
Published: 2025-01-29
Description: When LDAP connection is activated in Teedy versions between 1.9 to 1.12, the username field of the login form is vulnerable to LDAP injection. Due to improper sanitization of user input, an unauthenticated attacker is then able to perform various malicious actions, such as creating arbitrary accounts and spraying passwords.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-90
References: https://github.com/Tanguy-Boisset/CVE/blob/master/CVE-2024-54852/README.md; https://github.com/Tanguy-Boisset/CVE/blob/master/CVE-2024-54852/README.md
CVE: CVE-2024-57395
Published: 2025-01-29
Description: Password Vulnerability in Safety production process management system v1.0 allows a remote attacker to escalate privileges, execute arbitrary code and obtain sensitive information via the password and account number parameters.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: http://www.hzzcka.com/; https://github.com/qtxz54/Vul/blob/main/WeakPasswd/Safety-production-process-management-system.md
CVE: CVE-2024-57509
Published: 2025-01-29
Description: Buffer Overflow vulnerability in Bento4 mp42avc v.3bdc891602d19789b8e8626e4a3e613a937b4d35 allows a local attacker to execute arbitrary code via the AP4_File::ParseStream and related functions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://gist.github.com/G2FUZZ/91a1cc3b8f2b0720e984353d59023b24; https://github.com/axiomatic-systems/Bento4/issues/989
CVE: CVE-2024-57510
Published: 2025-01-29
Description: Buffer Overflow vulnerability in Bento4 mp42avc v.3bdc891602d19789b8e8626e4a3e613a937b4d35 allows a local attacker to execute arbitrary code via the AP4_MemoryByteStream::WritePartial.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://gist.github.com/G2FUZZ/91a1cc3b8f2b0720e984353d59023b24; https://github.com/axiomatic-systems/Bento4/issues/989; https://github.com/axiomatic-systems/Bento4/issues/989
CVE: CVE-2024-57513
Published: 2025-01-29
Description: A floating-point exception (FPE) vulnerability exists in the AP4_TfraAtom::AP4_TfraAtom function in Bento4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://gist.github.com/G2FUZZ/91a1cc3b8f2b0720e984353d59023b24; https://github.com/axiomatic-systems/Bento4/issues/990
CVE: CVE-2025-0842
Published: 2025-01-29
Description: A vulnerability was found in needyamin Library Card System 1.0 and classified as critical. This issue affects some unknown processing of the file admin.php of the component Login. The manipulation of the argument email/password leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://vuldb.com/?ctiid.293999; https://vuldb.com/?id.293999; https://vuldb.com/?submit.485540
CVE: CVE-2025-0851
Published: 2025-01-29
Description: A path traversal issue in ZipUtils.unzip and TarUtils.untar in Deep Java Library (DJL) on all platforms allows a bad actor to write files to arbitrary locations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-36, CWE-73
References: https://aws.amazon.com/security/security-bulletins/AWS-2025-003/; https://github.com/deepjavalibrary/djl/releases/tag/v0.31.1; https://github.com/deepjavalibrary/djl/security/advisories/GHSA-jcrp-x7w3-ffmg
CVE: CVE-2024-57665
Published: 2025-01-29
Description: JFinalCMS 1.0 is vulnerable to SQL Injection in rc/main/java/com/cms/entity/Content.java. The cause of the vulnerability is that the title parameter is controllable and is concatenated directly into filterSql without filtering.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/Nbccccc/vulnerability_discovery/blob/main/JFinalCMS/JFinalCms%20SQL%20Injection.md; https://github.com/Nbccccc/vulnerability_discovery/blob/main/JFinalCMS/JFinalCms%20SQL%20Injection.md
CVE: CVE-2025-0843
Published: 2025-01-29
Description: A vulnerability was found in needyamin Library Card System 1.0. It has been classified as critical. Affected is an unknown function of the file admindashboard.php of the component Admin Panel. The manipulation of the argument email/password leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://vuldb.com/?ctiid.294000; https://vuldb.com/?id.294000; https://vuldb.com/?submit.485553
CVE: CVE-2025-21396
Published: 2025-01-29
Description: Missing authorization in Microsoft Account allows an unauthorized attacker to elevate privileges over a network.
CVSS Score: 8.2 (HIGH)
CWE: CWE-862
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21396
CVE: CVE-2025-21415
Published: 2025-01-29
Description: Authentication bypass by spoofing in Azure AI Face Service allows an authorized attacker to elevate privileges over a network.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-290
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21415
CVE: CVE-2025-0844
Published: 2025-01-30
Description: A vulnerability was found in needyamin Library Card System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file signup.php of the component Registration Page. The manipulation of the argument firstname/lastname/email/borrow/user_address leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://vuldb.com/?ctiid.294001; https://vuldb.com/?id.294001; https://vuldb.com/?submit.485558
CVE: CVE-2025-0846
Published: 2025-01-30
Description: A vulnerability was found in 1000 Projects Employee Task Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/AdminLogin.php. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://1000projects.org/; https://github.com/onupset/CVE/issues/4; https://vuldb.com/?ctiid.294009
CVE: CVE-2025-0847
Published: 2025-01-30
Description: A vulnerability was found in 1000 Projects Employee Task Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /index.php of the component Login. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://1000projects.org/; https://github.com/onupset/CVE/issues/5; https://vuldb.com/?ctiid.294010