deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-4501
Published: 2024-05-05
Description: A vulnerability was found in Ruijie RG-UAC up to 20240428. It has been rated as critical. This issue affects some unknown processing of the file /view/bugSolve/captureData/commit.php. The manipulation of the argument tcpDump leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263105 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-78
References: https://github.com/h0e4a0r1t/-2x3J-1rPc-1-0-/blob/main/Ruijie%20RG-UAC%20Unified%20Internet%20Behavior%20Management%20Audit%20System%20Backend%20RCE%20Vulnerability-view_bugSolve_captureData_commit.php.pdf; https://vuldb.com/?ctiid.263105; https://vuldb.com/?id.263105
CVE: CVE-2024-34515
Published: 2024-05-05
Description: image-optimizer before 1.7.3 allows PHAR deserialization, e.g., the phar:// protocol in arguments to file_exists().
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://github.com/spatie/image-optimizer/compare/1.7.2...1.7.3; https://github.com/spatie/image-optimizer/issues/210; https://github.com/spatie/image-optimizer/pull/211
CVE: CVE-2024-34519
Published: 2024-05-05
Description: Avantra Server 24.x before 24.0.7 and 24.1.x before 24.1.1 mishandles the security of dashboards, aka XAN-5367. If a user can create a dashboard with an auto-login user, data disclosure may occur. Access control can be bypassed when there is a shared dashboard, and its auto-login user has privileges that a dashboard visitor should not have.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-289
References: https://docs.avantra.com/release-notes/24/changes.html; https://support.avantra.com/support/solutions/articles/[PII_REDACTED]6-xan-5367-security-vulnerability-fix-for-dashboards; https://docs.avantra.com/release-notes/24/changes.html
CVE: CVE-2024-4502
Published: 2024-05-05
Description: A vulnerability classified as critical has been found in Ruijie RG-UAC up to 20240428. Affected is an unknown function of the file /view/dhcp/dhcpClient/dhcp_client_commit.php. The manipulation of the argument ifName leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-263106 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-78
References: https://github.com/h0e4a0r1t/-2x3J-1rPc-1-0-/blob/main/Ruijie%20RG-UAC%20Unified%20Internet%20Behavior%20Management%20Audit%20System%20Backend%20RCE%20Vulnerability-view_dhcp_dhcpClient_dhcp_client_commit.php.pdf; https://vuldb.com/?ctiid.263106; https://vuldb.com/?id.263106
CVE: CVE-2024-4503
Published: 2024-05-05
Description: A vulnerability classified as critical was found in Ruijie RG-UAC up to 20240428. Affected by this vulnerability is an unknown functionality of the file /view/dhcp/dhcpConfig/dhcp_relay_commit.php. The manipulation of the argument interface_from leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263107. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-78
References: https://github.com/h0e4a0r1t/-2x3J-1rPc-1-0-/blob/main/Ruijie%20RG-UAC%20Unified%20Internet%20Behavior%20Management%20Audit%20System%20Backend%20RCE%20Vulnerability-dhcp_relay_commit.php.pdf; https://vuldb.com/?ctiid.263107; https://vuldb.com/?id.263107
CVE: CVE-2024-4504
Published: 2024-05-05
Description: A vulnerability, which was classified as critical, has been found in Ruijie RG-UAC up to 20240428. Affected by this issue is some unknown functionality of the file /view/HAconfig/baseConfig/commit.php. The manipulation of the argument peer_ip/local_ip leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263108. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-78
References: https://github.com/h0e4a0r1t/-2x3J-1rPc-1-0-/blob/main/Ruijie%20RG-UAC%20Unified%20Internet%20Behavior%20Management%20Audit%20System%20Backend%20RCE%20Vulnerability-view_HAconfig_baseConfig_commit.php.pdf; https://vuldb.com/?ctiid.263108; https://vuldb.com/?id.263108
CVE: CVE-2024-4505
Published: 2024-05-05
Description: A vulnerability, which was classified as critical, was found in Ruijie RG-UAC up to 20240428. This affects an unknown part of the file /view/IPV6/ipv6Addr/ip_addr_add_commit.php. The manipulation of the argument prelen/ethname leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263109 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-78
References: https://github.com/h0e4a0r1t/-2x3J-1rPc-1-0-/blob/main/Ruijie%20RG-UAC%20Unified%20Internet%20Behavior%20Management%20Audit%20System%20Backend%20RCE%20Vulnerability-ip_addr_add_commit.php.pdf; https://vuldb.com/?ctiid.263109; https://vuldb.com/?id.263109
CVE: CVE-2024-4506
Published: 2024-05-05
Description: A vulnerability has been found in Ruijie RG-UAC up to 20240428 and classified as critical. This vulnerability affects unknown code of the file /view/IPV6/ipv6Addr/ip_addr_edit_commit.php. The manipulation of the argument text_ip_addr/orgprelen/orgname leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-263110 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-78
References: https://github.com/h0e4a0r1t/-2x3J-1rPc-1-0-/blob/main/Ruijie%20RG-UAC%20Unified%20Internet%20Behavior%20Management%20Audit%20System%20Backend%20RCE%20Vulnerability-ip_addr_edit_commit.php.pdf; https://vuldb.com/?ctiid.263110; https://vuldb.com/?id.263110
CVE: CVE-2024-34524
Published: 2024-05-06
Description: In XLANG OpenAgents through fe73ac4, the allowed_file protection mechanism can be bypassed by using an incorrect file extension for the nature of the file content.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-288
References: https://github.com/xlang-ai/OpenAgents/blob/880e26adfe380e999962fc645fc8fc80bd72f103/backend/utils/utils.py#L31; https://github.com/xlang-ai/OpenAgents/issues/112; https://github.com/xlang-ai/OpenAgents/blob/880e26adfe380e999962fc645fc8fc80bd72f103/backend/utils/utils.py#L31
CVE: CVE-2024-34525
Published: 2024-05-06
Description: FileCodeBox 2.0 stores a OneDrive password and AWS key in a cleartext env file.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-591
References: https://github.com/vastsa/FileCodeBox/issues/133; https://github.com/vastsa/FileCodeBox/issues/133
CVE: CVE-2024-34527
Published: 2024-05-06
Description: spaces_plugin/app.py in SolidUI 0.4.0 has an unnecessary print statement for an OpenAI key. The printed string might be logged.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: https://github.com/CloudOrc/SolidUI/blob/00d96b53bd0acf082996cef45b0f292eaba22fb7/solidui/spaces_plugin/app.py#L77; https://github.com/CloudOrc/SolidUI/issues/279; https://github.com/CloudOrc/SolidUI/blob/00d96b53bd0acf082996cef45b0f292eaba22fb7/solidui/spaces_plugin/app.py#L77
CVE: CVE-2024-34528
Published: 2024-05-06
Description: WordOps through 3.20.0 has a wo/cli/plugins/stack_pref.py TOCTOU race condition because the conf_path os.open does not use a mode parameter during file creation.
CVSS Score: 7.7 (HIGH)
CWE: CWE-367
References: https://github.com/WordOps/WordOps/blob/ecf20192c7853925e2cb3f8c8378cd0d86ca0d62/wo/cli/plugins/stack_pref.py#L77; https://github.com/WordOps/WordOps/issues/611; https://github.com/WordOps/WordOps/blob/ecf20192c7853925e2cb3f8c8378cd0d86ca0d62/wo/cli/plugins/stack_pref.py#L77
CVE: CVE-2024-34529
Published: 2024-05-06
Description: Nebari through 2024.4.1 prints the temporary Keycloak root password.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-200
References: https://github.com/nebari-dev/nebari/blob/5463e8df9e8d53a266a7b9d3d4e27353ec43c40b/src/_nebari/deploy.py#L71; https://github.com/nebari-dev/nebari/issues/2282; https://github.com/nebari-dev/nebari/blob/5463e8df9e8d53a266a7b9d3d4e27353ec43c40b/src/_nebari/deploy.py#L71
CVE: CVE-2024-4507
Published: 2024-05-06
Description: A vulnerability was found in Ruijie RG-UAC up to 20240428 and classified as critical. This issue affects some unknown processing of the file /view/IPV6/ipv6StaticRoute/static_route_add_ipv6.php. The manipulation of the argument text_prefixlen/text_gateway/devname leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263111. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-78
References: https://github.com/h0e4a0r1t/-2x3J-1rPc-1-0-/blob/main/Ruijie%20RG-UAC%20Unified%20Internet%20Behavior%20Management%20Audit%20System%20Backend%20RCE%20Vulnerability-static_route_add_ipv6.php.pdf; https://vuldb.com/?ctiid.263111; https://vuldb.com/?id.263111
CVE: CVE-2024-4508
Published: 2024-05-06
Description: A vulnerability was found in Ruijie RG-UAC up to 20240428. It has been classified as critical. Affected is an unknown function of the file /view/IPV6/ipv6StaticRoute/static_route_edit_ipv6.php. The manipulation of the argument oldipmask/oldgateway/olddevname leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263112. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-78
References: https://github.com/h0e4a0r1t/-2x3J-1rPc-1-0-/blob/main/Ruijie%20RG-UAC%20Unified%20Internet%20Behavior%20Management%20Audit%20System%20Backend%20RCE%20Vulnerability-static_route_edit_ipv6.php.pdf; https://vuldb.com/?ctiid.263112; https://vuldb.com/?id.263112
CVE: CVE-2024-4509
Published: 2024-05-06
Description: A vulnerability was found in Ruijie RG-UAC up to 20240428. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /view/IPV6/naborTable/add_commit.php. The manipulation of the argument ip_addr/mac_addr leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263113 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-78
References: https://github.com/h0e4a0r1t/-2x3J-1rPc-1-0-/blob/main/Ruijie%20RG-UAC%20Unified%20Internet%20Behavior%20Management%20Audit%20System%20Backend%20RCE%20Vulnerability-add_commit.php.pdf; https://vuldb.com/?ctiid.263113; https://vuldb.com/?id.263113
CVE: CVE-2024-4510
Published: 2024-05-06
Description: A vulnerability was found in Ruijie RG-UAC up to 20240428. It has been rated as critical. Affected by this issue is some unknown functionality of the file /view/networkConfig/ArpTable/arp_add_commit.php. The manipulation of the argument text_ip_addr/text_mac_addr leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-263114 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-78
References: https://github.com/h0e4a0r1t/-2x3J-1rPc-1-0-/blob/main/Ruijie%20RG-UAC%20Unified%20Internet%20Behavior%20Management%20Audit%20System%20Backend%20RCE%20Vulnerability-arp_add_commit.php.pdf; https://vuldb.com/?ctiid.263114; https://vuldb.com/?id.263114
CVE: CVE-2024-4511
Published: 2024-05-06
Description: A vulnerability classified as critical has been found in Shanghai Sunfull Automation BACnet Server HMI1002-ARM 2.0.4. This affects an unknown part of the component Message Handler. The manipulation leads to buffer overflow. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263115. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-120
References: https://github.com/isZzzz/HMI1002-ARM-Gateway-Document/blob/main/HMI1002-ARM%20apply.pdf; https://github.com/isZzzz/HMI1002-ARM-Gateway-Document/blob/main/sunfull_bug.pcapng; https://vuldb.com/?ctiid.263115
CVE: CVE-2024-4512
Published: 2024-05-06
Description: A vulnerability classified as problematic was found in SourceCodester Prison Management System 1.0. This vulnerability affects unknown code of the file /Employee/edit-profile.php. The manipulation of the argument txtfullname/txtdob/txtaddress/txtqualification/cmddept/cmdemployeetype/txtappointment leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263116.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/yylmm/CVE/blob/main/Prison%20Management%20System/xss.md; https://vuldb.com/?ctiid.263116; https://vuldb.com/?id.263116
CVE: CVE-2024-4513
Published: 2024-05-06
Description: A vulnerability, which was classified as problematic, has been found in Campcodes Complete Web-Based School Management System 1.0. This issue affects some unknown processing of the file /view/timetable_update_form.php. The manipulation of the argument grade leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263117 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20xss/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%201.pdf; https://vuldb.com/?ctiid.263117; https://vuldb.com/?id.263117
CVE: CVE-2024-4514
Published: 2024-05-06
Description: A vulnerability, which was classified as problematic, was found in Campcodes Complete Web-Based School Management System 1.0. Affected is an unknown function of the file /view/timetable_insert_form.php. The manipulation of the argument grade leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-263118 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20xss/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%202.pdf; https://vuldb.com/?ctiid.263118; https://vuldb.com/?id.263118
CVE: CVE-2024-4515
Published: 2024-05-06
Description: A vulnerability has been found in Campcodes Complete Web-Based School Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /view/timetable_grade_wise.php. The manipulation of the argument grade leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263119.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20xss/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%203.pdf; https://vuldb.com/?ctiid.263119; https://vuldb.com/?id.263119
CVE: CVE-2023-32871
Published: 2024-05-06
Description: In DA, there is a possible permission bypass due to an incorrect status check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08355514; Issue ID: ALPS08355514.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-391, CWE-754
References: https://corp.mediatek.com/product-security-bulletin/May-2024; https://corp.mediatek.com/product-security-bulletin/May-2024
CVE: CVE-2023-32873
Published: 2024-05-06
Description: In keyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08583919; Issue ID: ALPS08304227.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/May-2024; https://corp.mediatek.com/product-security-bulletin/May-2024
CVE: CVE-2024-20021
Published: 2024-05-06
Description: In atf spm, there is a possible way to remap physical memory to virtual memory due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08584568; Issue ID: MSV-1249.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-269
References: https://corp.mediatek.com/product-security-bulletin/May-2024; https://corp.mediatek.com/product-security-bulletin/May-2024
CVE: CVE-2024-20056
Published: 2024-05-06
Description: In preloader, there is a possible escalation of privilege due to an insecure default value. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08528185; Issue ID: ALPS08528185.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20
References: https://corp.mediatek.com/product-security-bulletin/May-2024; https://corp.mediatek.com/product-security-bulletin/May-2024
CVE: CVE-2024-20057
Published: 2024-05-06
Description: In keyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08587881; Issue ID: ALPS08587881.
CVSS Score: 7.2 (HIGH)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/May-2024; https://corp.mediatek.com/product-security-bulletin/May-2024
CVE: CVE-2024-20058
Published: 2024-05-06
Description: In keyInstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08580204; Issue ID: ALPS08580204.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://corp.mediatek.com/product-security-bulletin/May-2024; https://corp.mediatek.com/product-security-bulletin/May-2024
CVE: CVE-2024-20059
Published: 2024-05-06
Description: In da, there is a possible escalation of privilege due to an incorrect status check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08541749; Issue ID: ALPS08541749.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-1332
References: https://corp.mediatek.com/product-security-bulletin/May-2024; https://corp.mediatek.com/product-security-bulletin/May-2024
CVE: CVE-2024-20060
Published: 2024-05-06
Description: In da, there is a possible escalation of privilege due to an incorrect status check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08541749; Issue ID: ALPS08541754.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-1332
References: https://corp.mediatek.com/product-security-bulletin/May-2024; https://corp.mediatek.com/product-security-bulletin/May-2024
CVE: CVE-2024-20064
Published: 2024-05-06
Description: In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08572601; Issue ID: MSV-1229.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/May-2024; https://corp.mediatek.com/product-security-bulletin/May-2024
CVE: CVE-2024-34538
Published: 2024-05-06
Description: Mateso PasswordSafe through 8.13.9.26689 has Weak Cryptography.
CVSS Score: 7.5 (HIGH)
CWE: CWE-338
References: https://hansesecure.de/2023/02/schwachstelle-in-passwordsafe-mateso/; https://hansesecure.de/2023/02/schwachstelle-in-passwordsafe-mateso/
CVE: CVE-2024-4516
Published: 2024-05-06
Description: A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /view/timetable.php. The manipulation of the argument grade leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263120.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20xss/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%204.pdf; https://vuldb.com/?ctiid.263120; https://vuldb.com/?id.263120
CVE: CVE-2024-4517
Published: 2024-05-06
Description: A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /view/teacher_salary_invoice1.php. The manipulation of the argument date leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263121 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20xss/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%205.pdf; https://vuldb.com/?ctiid.263121; https://vuldb.com/?id.263121
CVE: CVE-2024-4518
Published: 2024-05-06
Description: A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /view/teacher_salary_invoice.php. The manipulation of the argument desc leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-263122 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20xss/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%206.pdf; https://vuldb.com/?ctiid.263122; https://vuldb.com/?id.263122
CVE: CVE-2024-4519
Published: 2024-05-06
Description: A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /view/teacher_salary_details3.php. The manipulation of the argument month leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263123.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20xss/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%207.pdf; https://vuldb.com/?ctiid.263123; https://vuldb.com/?id.263123