deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-28119
Published: 2023-03-22
Description: The crewjam/saml go library contains a partial implementation of the SAML standard in golang. Prior to version 0.4.13, the package's use of `flate.NewReader` does not limit the size of the input. The user can pass more than 1 MB of data in the HTTP request to the processing functions, which will be decompressed server-side using the Deflate algorithm. Therefore, after repeating the same request multiple times, it is possible to achieve a reliable crash since the operating system kills the process. This issue is patched in version 0.4.13.

CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/crewjam/saml/commit/8e9236867d176ad6338c870a84e2039aef8a5021; https://github.com/crewjam/saml/security/advisories/GHSA-5mqj-xc49-246p; https://github.com/crewjam/saml/commit/8e9236867d176ad6338c870a84e2039aef8a5021
CVE: CVE-2022-45003
Published: 2023-03-22
Description: Gophish through 0.12.1 allows attackers to cause a Denial of Service (DoS) via a crafted payload involving autofocus.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/gophish/gophish/releases/tag/v0.12.1; https://pastebin.com/z5MD3z8c; https://github.com/gophish/gophish/releases/tag/v0.12.1
CVE: CVE-2022-45004
Published: 2023-03-22
Description: Gophish through 0.12.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted landing page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/gophish/gophish/releases/tag/v0.12.1; https://pastebin.com/z5MD3z8c; https://github.com/gophish/gophish/releases/tag/v0.12.1
CVE: CVE-2023-0386
Published: 2023-03-22
Description: A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-282
References: http://packetstormsecurity.com/files/173087/Kernel-Live-Patch-Security-Notice-LSN-0095-1.html; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4f11ada10d0a; https://lists.debian.org/debian-lts-announce/2023/06/msg00008.html
CVE: CVE-2023-28431
Published: 2023-03-22
Description: Frontier is an Ethereum compatibility layer for Substrate. Frontier's `modexp` precompile uses `num-bigint` crate under the hood. In the implementation prior to pull request 1017, the cases for modulus being even and modulus being odd are treated separately. Odd modulus uses the fast Montgomery multiplication, and even modulus uses the slow plain power algorithm. This gas cost discrepancy was not accounted for in the `modexp` precompile, leading to possible denial of service attacks.

No fixes for `num-bigint` are currently available, and thus this issue is fixed in the short term by raising the gas costs for even modulus, and in the long term fixing it in `num-bigint` or switching to another modexp implementation. The short-term fix for Frontier is deployed at pull request 1017. There are no known workarounds aside from applying the fix.
CVSS Score: 7.5 (HIGH)
CWE: CWE-682
References: https://github.com/paritytech/frontier/commit/5af12e94d7dfc8a0208a290643a800f55de7b219; https://github.com/paritytech/frontier/pull/1017; https://github.com/paritytech/frontier/security/advisories/GHSA-fcmm-54jp-7vf6
CVE: CVE-2023-28432
Published: 2023-03-22
Description: Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY`
and `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/minio/minio/releases/tag/RELEASE.2023-03-20T20-16-18Z; https://github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3q; https://twitter.com/Andrew___Morris/status/[PII_REDACTED]41278464
CVE: CVE-2023-28433
Published: 2023-03-22
Description: Minio is a Multi-Cloud Object Storage framework. All users on Windows prior to version RELEASE.2023-03-20T20-16-18Z are impacted. MinIO fails to filter the `\` character, which allows for arbitrary object placement across buckets. As a result, a user with low privileges, such as an access key, service account, or STS credential, which only has permission to `PutObject` in a specific bucket, can create an admin user. This issue is patched in RELEASE.2023-03-20T20-16-18Z. There are no known workarounds.
CVSS Score: 8.8 (HIGH)
CWE: CWE-668
References: https://github.com/minio/minio/commit/8d6558b23649f613414c8527b58973fbdfa4d1b8; https://github.com/minio/minio/commit/b3c54ec81e0a06392abfb3a1ffcdc80c6fbf6ebc; https://github.com/minio/minio/releases/tag/RELEASE.2023-03-20T20-16-18Z
CVE: CVE-2023-28434
Published: 2023-03-22
Description: Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off `MINIO_BROWSER=off`.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://github.com/minio/minio/commit/67f4ba154a27a1b06e48bfabda38355a010dfca5; https://github.com/minio/minio/pull/16849; https://github.com/minio/minio/security/advisories/GHSA-2pxw-r47w-4p8c
CVE: CVE-2023-28438
Published: 2023-03-22
Description: Pimcore is an open source data and experience management platform. Prior to version 10.5.19, since a user with 'report' permission can already write arbitrary SQL queries and given the fact that this endpoint is using the GET method (no CSRF protection), an attacker can inject an arbitrary query by manipulating a user to click on a link. Users should upgrade to version 10.5.19 to receive a patch or, as a workaround, may apply the patch manually.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-89
References: https://github.com/pimcore/pimcore/commit/d1abadb181c88ebaa4bce1916f9077469d4ea2bc.patch; https://github.com/pimcore/pimcore/pull/14526; https://github.com/pimcore/pimcore/security/advisories/GHSA-vf7q-g2pv-jxvx
CVE: CVE-2023-28439
Published: 2023-03-22
Description: CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered affecting Iframe Dialog and Media Embed packages. The vulnerability may trigger a JavaScript code after fulfilling special conditions: using one of the affected packages on a web page with missing proper Content Security Policy configuration; initializing the editor on an element and using an element other than `<textarea>` as a base; and destroying the editor instance. This vulnerability might affect a small percentage of integrators that depend on dynamic editor initialization/destroy mechanism.

A fix is available in CKEditor4 version 4.21.0. In some rare cases, a security fix may be considered a breaking change. Starting from version 4.21.0, the Iframe Dialog plugin applies the `sandbox` attribute by default, which restricts JavaScript code execution in the iframe element. To change this behavior, configure the `config.iframe_attributes` option. Also starting from version 4.21.0, the Media Embed plugin regenerates the entire content of the embed widget by default. To change this behavior, configure the `config.embed_keepOriginalContent` option. Those who choose to enable either of the more permissive options or who cannot upgrade to a patched version should properly configure Content Security Policy to avoid any potential security issues that may arise from embedding iframe elements on their web page.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://ckeditor.com/cke4/addon/embed; https://ckeditor.com/cke4/addon/iframe; https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-vh5c-xwqv-cv9g
CVE: CVE-2023-28659
Published: 2023-03-22
Description: The Waiting: One-click Countdowns WordPress Plugin, version <= 0.6.2, is affected by an authenticated SQL injection vulnerability in the pbc_down[meta][id] parameter of the pbc_save_downs action.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.tenable.com/security/research/tra-2023-2; https://www.tenable.com/security/research/tra-2023-2
CVE: CVE-2023-28660
Published: 2023-03-22
Description: The Events Made Easy WordPress Plugin, version <= 2.3.14 is affected by an authenticated SQL injection vulnerability in the 'search_name' parameter in the eme_recurrences_list action.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.tenable.com/security/research/tra-2023-2; https://www.tenable.com/security/research/tra-2023-2
CVE: CVE-2023-28661
Published: 2023-03-22
Description: The WP Popup Banners WordPress Plugin, version <= 1.2.5, is affected by an authenticated SQL injection vulnerability in the 'value' parameter in the get_popup_data action.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.tenable.com/security/research/tra-2023-2; https://www.tenable.com/security/research/tra-2023-2
CVE: CVE-2023-28662
Published: 2023-03-22
Description: The Gift Cards (Gift Vouchers and Packages) WordPress Plugin, version <= 4.3.1, is affected by an unauthenticated SQL injection vulnerability in the template parameter in the wpgv_doajax_voucher_pdf_save_func action.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.tenable.com/security/research/tra-2023-2; https://www.tenable.com/security/research/tra-2023-2
CVE: CVE-2023-28663
Published: 2023-03-22
Description: The Formidable PRO2PDF WordPress Plugin, version < 3.11, is affected by an authenticated SQL injection vulnerability in the ‘fieldmap’ parameter in the fpropdf_export_file action.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.tenable.com/security/research/tra-2023-2; https://www.tenable.com/security/research/tra-2023-2
CVE: CVE-2023-28664
Published: 2023-03-22
Description: The Meta Data and Taxonomies Filter WordPress plugin, in versions < 1.3.1, is affected by a reflected cross-site scripting vulnerability in the 'tax_name' parameter of the mdf_get_tax_options_in_widget action, which can only be triggered by an authenticated user.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.tenable.com/security/research/tra-2023-3; https://www.tenable.com/security/research/tra-2023-3
CVE: CVE-2023-28665
Published: 2023-03-22
Description: The Woo Bulk Price Update WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'page' parameter to the techno_get_products action, which can only be triggered by an authenticated user.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.tenable.com/security/research/tra-2023-3; https://www.tenable.com/security/research/tra-2023-3
CVE: CVE-2023-28666
Published: 2023-03-22
Description: The InPost Gallery WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'imgurl' parameter to the add_inpost_gallery_slide_item action, which can only be triggered by an authenticated user.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.tenable.com/security/research/tra-2023-3; https://www.tenable.com/security/research/tra-2023-3
CVE: CVE-2023-28667
Published: 2023-03-22
Description: The Lead Generated WordPress Plugin, version <= 1.23, was affected by an unauthenticated insecure deserialization issue. The tve_labels parameter of the tve_api_form_submit action is passed to the PHP unserialize() function without being sanitized or verified, and as a result could lead to PHP object injection, which when combined with certain class implementations / gadget chains could be leveraged to perform a variety of malicious actions granted a POP chain is also present.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://www.tenable.com/security/research/tra-2023-7; https://www.tenable.com/security/research/tra-2023-7
CVE: CVE-2022-43863
Published: 2023-03-22
Description: IBM QRadar SIEM 7.4 and 7.5 is vulnerable to privilege escalation, allowing a user with some admin capabilities to gain additional admin capabilities.  IBM X-Force ID:  239425.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20, CWE-269
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/239425; https://www.ibm.com/support/pages/node/6964862; https://exchange.xforce.ibmcloud.com/vulnerabilities/239425
CVE: CVE-2023-27054
Published: 2023-03-22
Description: A cross-site scripting (XSS) vulnerability in MiroTalk P2P before commit f535b35 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter under the settings module.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/miroslavpejic85/mirotalk; https://github.com/miroslavpejic85/mirotalk/commit/f535b3515d2d480dc3135b37982f5df93e43c592; https://github.com/miroslavpejic85/mirotalk/issues/139
CVE: CVE-2023-27060
Published: 2023-03-22
Description: LightCMS v1.3.7 was discovered to contain a remote code execution (RCE) vulnerability via the image:make function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://github.com/eddy8/LightCMS/issues/21; https://igml.top/2021/05/10/lightcms-RCE/; https://github.com/eddy8/LightCMS/issues/21
CVE: CVE-2023-27100
Published: 2023-03-22
Description: Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE software v2.6.0 allows attackers to bypass brute force protection mechanisms via crafted web requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307, CWE-307
References: http://packetstormsecurity.com/files/171791/pfsenseCE-2.6.0-Protection-Bypass.html; https://docs.netgate.com/downloads/pfSense-SA-23_05.sshguard.asc; https://redmine.pfsense.org/issues/13574
CVE: CVE-2022-28494
Published: 2023-03-23
Description: TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 is discovered to contain a command injection vulnerability in the setUpgradeFW function via the filename parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/B2eFly/CVE/blob/main/totolink/CP900/5/5.md; https://github.com/B2eFly/Router/blob/main/totolink/CP900/5/5.md; https://github.com/B2eFly/CVE/blob/main/totolink/CP900/5/5.md
CVE: CVE-2023-24655
Published: 2023-03-23
Description: Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter under the Profile Update function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/y0gesh-verma/a9e83220f268f0294a611b82cf266739; https://github.com/y0gesh-verma/CVE/blob/main/CVE-2023-24655/CVE-2023-24655.txt; https://www.sourcecodester.com/php/15895/simple-customer-relationship-management-crm-system-using-php-free-source-coude.html
CVE: CVE-2023-26088
Published: 2023-03-23
Description: In Malwarebytes before 4.5.23, a symbolic link may be used delete any arbitrary file on the system by exploiting the local quarantine system. It can also lead to privilege escalation in certain scenarios.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://support.malwarebytes.com/hc/en-us/articles/[PII_REDACTED]659-Malwarebytes-for-Windows-4-5-23-Release-Notes; https://www.malwarebytes.com/secure/cves/cve-2023-26088; https://support.malwarebytes.com/hc/en-us/articles/[PII_REDACTED]659-Malwarebytes-for-Windows-4-5-23-Release-Notes
CVE: CVE-2023-26498
Published: 2023-03-23
Description: An issue was discovered in Samsung Baseband Modem Chipset for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, Exynos Auto T5126. Memory corruption can occur due to improper checking of the number of properties while parsing the chatroom attribute in the SDP (Session Description Protocol) module.
CVSS Score: 8.6 (HIGH)
CWE: CWE-787
References: https://semiconductor.samsung.com/processor/mobile-processor/; https://semiconductor.samsung.com/processor/modem/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2023-28470
Published: 2023-03-23
Description: In Couchbase Server 5 through 7 before 7.1.4, the nsstats endpoint is accessible without authentication.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306, CWE-306
References: https://docs.couchbase.com/server/current/release-notes/relnotes.html; https://forums.couchbase.com/tags/security; https://www.couchbase.com/alerts/
CVE: CVE-2022-30037
Published: 2023-03-23
Description: XunRuiCMS v4.3.3 to v4.5.1 vulnerable to PHP file write and CMS PHP file inclusion, allows attackers to execute arbitrary php code, via the add function in cron.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-829
References: https://weltolk.github.io/p/xunruicms-v4.3.3-to-v4.5.1-backstage-code-injection-vulnerabilityfile-write-and-file-inclusion/; https://weltolk.github.io/p/xunruicms-v4.3.3-to-v4.5.1-backstage-code-injection-vulnerabilityfile-write-and-file-inclusion/
CVE: CVE-2023-23192
Published: 2023-03-23
Description: IS Decisions UserLock MFA 11.01 is vulnerable to authentication bypass using scheduled task.
CVSS Score: 7.2 (HIGH)
CWE: CWE-863
References: https://github.com/pinarsadioglu/CVE-2023-23192/; https://www.isdecisions.com/products/userlock/; https://github.com/pinarsadioglu/CVE-2023-23192/
CVE: CVE-2023-24367
Published: 2023-03-23
Description: Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-26496
Published: 2023-03-23
Description: An issue was discovered in Samsung Baseband Modem Chipset for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, and Exynos Auto T5124. Memory corruption can occur due to improper checking of the parameter length while parsing the fmtp attribute in the SDP (Session Description Protocol) module.
CVSS Score: 8.6 (HIGH)
CWE: CWE-787
References: https://semiconductor.samsung.com/processor/mobile-processor/; https://semiconductor.samsung.com/processor/modem/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2023-27249
Published: 2023-03-23
Description: swfdump v0.9.2 was discovered to contain a heap buffer overflow in the function swf_GetPlaceObject at swfobject.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: http://swfdump.com; https://github.com/keepinggg/poc/blob/main/poc_of_swfdump/poc; https://github.com/keepinggg/poc/tree/main/poc_of_swfdump
CVE: CVE-2023-28758
Published: 2023-03-23
Description: An issue was discovered in Veritas NetBackup before 8.3.0.2. BPCD allows an unprivileged user to specify a log file path when executing a NetBackup command. This can be used to overwrite existing NetBackup log files.
CVSS Score: 7.1 (HIGH)
CWE: CWE-269
References: https://www.veritas.com/content/support/en_US/security/VTS23-003; https://www.veritas.com/content/support/en_US/security/VTS23-003
CVE: CVE-2023-28759
Published: 2023-03-23
Description: An issue was discovered in Veritas NetBackup before 10.0 on Windows. A vulnerability in the way the client validates the path to a DLL prior to loading may allow a lower-level user to elevate privileges and compromise the system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://www.veritas.com/content/support/en_US/security/VTS23-006; https://www.veritas.com/content/support/en_US/security/VTS23-006
CVE: CVE-2023-26114
Published: 2023-03-23
Description: Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Exploiting this vulnerability can allow an adversary in specific scenarios to access data from and connect to the code-server instance.
CVSS Score: 8.2 (HIGH)
CWE: CWE-1385, CWE-346, CWE-346
References: https://github.com/coder/code-server/commit/d477972c68fc8c8e8d610aa7287db87ba90e55c7; https://github.com/coder/code-server/releases/tag/v4.10.1; https://security.snyk.io/vuln/SNYK-JS-CODESERVER-3368148
CVE: CVE-2022-22512
Published: 2023-03-23
Description: Hard-coded credentials in Web-UI of multiple VARTA Storage products in multiple versions allows an unauthorized attacker to gain administrative access to the Web-UI via network.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://cert.vde.com/en/advisories/VDE-2022-061/; https://cert.vde.com/en/advisories/VDE-2022-061/
CVE: CVE-2023-1050
Published: 2023-03-23
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in As Koc Energy Web Report System allows SQL Injection.This issue affects Web Report System: before 23.03.10.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0166; https://www.usom.gov.tr/bildirim/tr-23-0166
CVE: CVE-2023-1051
Published: 2023-03-23
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in As Koc Energy Web Report System allows Reflected XSS.This issue affects Web Report System: before 23.03.10.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.usom.gov.tr/bildirim/tr-23-0166; https://www.usom.gov.tr/bildirim/tr-23-0166
CVE: CVE-2023-1410
Published: 2023-03-23
Description: Grafana is an open-source platform for monitoring and observability. 

Grafana had a stored XSS vulnerability in the Graphite FunctionDescription tooltip. 

The stored XSS vulnerability was possible due the value of the Function Description was not properly sanitized.

An attacker needs to have control over the Graphite data source in order to manipulate a function description and a Grafana admin needs to configure the data source, later a Grafana user needs to select a tampered function and hover over the description. 

  Users may upgrade to version 8.5.22, 9.2.15 and 9.3.11 to receive a fix.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/grafana/bugbounty/security/advisories/GHSA-qrrg-gw7w-vp76; https://grafana.com/security/security-advisories/cve-2023-1410/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-1589
Published: 2023-03-23
Description: A vulnerability has been found in SourceCodester Online Tours & Travels Management System 1.0 and classified as critical. This vulnerability affects the function exec of the file admin/operations/approve_delete.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-223654 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://blog.csdn.net/weixin_43864034/article/details/129729911; https://vuldb.com/?ctiid.223654; https://vuldb.com/?id.223654
CVE: CVE-2023-1590
Published: 2023-03-23
Description: A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0 and classified as critical. This issue affects the function exec of the file admin/operations/currency.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223655.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://blog.csdn.net/weixin_43864034/article/details/129730106; https://vuldb.com/?ctiid.223655; https://vuldb.com/?id.223655