deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-12928
Published: 2024-12-26
Description: A vulnerability, which was classified as critical, was found in code-projects Simple Admin Panel 1.0. This affects an unknown part. The manipulation of the argument c_name leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://vuldb.com/?ctiid.289281; https://vuldb.com/?id.289281
CVE: CVE-2024-12929
Published: 2024-12-26
Description: A vulnerability has been found in code-projects Student Management System 1.0.00 and classified as critical. This vulnerability affects unknown code of the file /addCatController.php. The manipulation of the argument size leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-74, CWE-89
References: https://code-projects.org/; https://vuldb.com/?ctiid.289282; https://vuldb.com/?id.289282
CVE: CVE-2024-12930
Published: 2024-12-26
Description: A vulnerability was found in code-projects Simple Admin Panel 1.0 and classified as problematic. This issue affects some unknown processing of the file addCatController.php. The manipulation of the argument c_name leads to cross site scripting. The attack may be initiated remotely.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79, CWE-94
References: https://code-projects.org/; https://vuldb.com/?ctiid.289283; https://vuldb.com/?id.289283
CVE: CVE-2024-12931
Published: 2024-12-26
Description: A vulnerability was found in code-projects Simple Admin Panel 1.0. It has been classified as critical. Affected is an unknown function of the file /addCatController.php. The manipulation of the argument size leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-74, CWE-89
References: https://code-projects.org/; https://vuldb.com/?ctiid.289284; https://vuldb.com/?id.289284
CVE: CVE-2024-12932
Published: 2024-12-26
Description: A vulnerability was found in code-projects Simple Admin Panel 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file addSizeController.php. The manipulation of the argument size leads to cross site scripting. The attack can be launched remotely.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79, CWE-94
References: https://code-projects.org/; https://vuldb.com/?ctiid.289285; https://vuldb.com/?id.289285
CVE: CVE-2024-12652
Published: 2024-12-26
Description: A Improper Control of Generation of Code ('Code Injection') vulnerability in groovy script function in SmartRobot′s Conversational AI Platform before v7.2.0 allows remote authenticated users to perform arbitrary system commands via Groovy code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://zuso.ai/advisory/za-2024-13
CVE: CVE-2024-12933
Published: 2024-12-26
Description: A vulnerability was found in code-projects Simple Admin Panel 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file updateItemController.php. The manipulation of the argument p_name/p_desc leads to cross site scripting. The attack may be launched remotely.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79, CWE-94
References: https://code-projects.org/; https://vuldb.com/?ctiid.289286; https://vuldb.com/?id.289286
CVE: CVE-2024-12934
Published: 2024-12-26
Description: A vulnerability classified as critical has been found in code-projects Simple Admin Panel 1.0. This affects an unknown part of the file updateItemController.php. The manipulation of the argument p_desk leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-74, CWE-89
References: https://code-projects.org/; https://vuldb.com/?ctiid.289287; https://vuldb.com/?id.289287
CVE: CVE-2024-12935
Published: 2024-12-26
Description: A vulnerability classified as critical was found in code-projects Simple Admin Panel 1.0. This vulnerability affects unknown code of the file editItemForm.php. The manipulation of the argument record leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://vuldb.com/?ctiid.289288; https://vuldb.com/?id.289288
CVE: CVE-2024-12936
Published: 2024-12-26
Description: A vulnerability, which was classified as critical, has been found in code-projects Simple Admin Panel 1.0. This issue affects some unknown processing of the file catDeleteController.php. The manipulation of the argument record leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://vuldb.com/?ctiid.289289; https://vuldb.com/?id.289289
CVE: CVE-2024-10903
Published: 2024-12-26
Description: The Broken Link Checker WordPress plugin before 2.4.2 does not validate a the link URLs before making a request to them, which could allow admin users to perform SSRF attack, for example on a multisite installation.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-918
References: https://wpscan.com/vulnerability/39027390-ce01-4dd5-a979-426785aa7acb/; https://wpscan.com/vulnerability/39027390-ce01-4dd5-a979-426785aa7acb/
CVE: CVE-2024-11223
Published: 2024-12-26
Description: The WPForms  WordPress plugin before 1.9.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/82[PII_REDACTED]-4c9a-abc7-c1adf8c2b047/; https://wpscan.com/vulnerability/82[PII_REDACTED]-4c9a-abc7-c1adf8c2b047/
CVE: CVE-2024-12937
Published: 2024-12-26
Description: A vulnerability, which was classified as critical, was found in code-projects Simple Admin Panel 1.0. Affected is an unknown function of the file addVariationController.php. The manipulation of the argument qty leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-74, CWE-89
References: https://code-projects.org/; https://vuldb.com/?ctiid.289290; https://vuldb.com/?id.289290
CVE: CVE-2024-12938
Published: 2024-12-26
Description: A vulnerability has been found in code-projects Simple Admin Panel 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file updateOrderStatus.php. The manipulation of the argument record leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://vuldb.com/?ctiid.289291; https://vuldb.com/?id.289291
CVE: CVE-2024-12939
Published: 2024-12-26
Description: A vulnerability was found in code-projects Job Recruitment 1.0. It has been rated as critical. This issue affects the function add_edu of the file /_parse/_all_edits.php. The manipulation of the argument degree leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/Hl0kk/cve/blob/main/sql-hi.md; https://vuldb.com/?ctiid.289295
CVE: CVE-2024-12940
Published: 2024-12-26
Description: A vulnerability has been found in 1000 Projects Attendance Tracking Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/student_action.php. The manipulation of the argument student_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://1000projects.org/; https://github.com/bug3536/CVE/issues/1; https://vuldb.com/?ctiid.289300
CVE: CVE-2024-12941
Published: 2024-12-26
Description: A vulnerability was found in CodeAstro Blood Donor Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /pages/deletedannounce.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://codeastro.com/; https://github.com/Bea1ee/cve/issues/1; https://vuldb.com/?ctiid.289301
CVE: CVE-2024-12942
Published: 2024-12-26
Description: A vulnerability was found in 1000 Projects Portfolio Management System MCA 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/admin_login.php. The manipulation of the argument username/password leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://1000projects.org/; https://github.com/dawatermelon/CVE/blob/main/Portfolio%20Management%20System%20MCA%20Project/README.md; https://vuldb.com/?ctiid.289302
CVE: CVE-2023-7300
Published: 2024-12-26
Description: Huawei Home Music System has a path traversal vulnerability. Successful exploitation of this vulnerability may cause the music host file to be deleted or the file permission to be changed.(Vulnerability ID:HWPSIRT-2023-60613)
CVSS Score: 8.0 (HIGH)
CWE: CWE-35
References: https://www.huawei.com/en/psirt/security-advisories/2024/huawei-sa-ptvihhms-91f7c6fa-en
CVE: CVE-2024-12943
Published: 2024-12-26
Description: A vulnerability was found in CodeAstro House Rental Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /ownersignup.php. The manipulation of the argument f/e/p/m/o/n/c/s/ci/a leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory only mentions the parameter "m" to be affected. But it must be assumed that many other parameters are affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://codeastro.com/; https://github.com/Wind-liberty/CVE/issues/1; https://vuldb.com/?ctiid.289303
CVE: CVE-2024-12944
Published: 2024-12-26
Description: A vulnerability was found in CodeAstro House Rental Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /signin.php. The manipulation of the argument u/p leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://codeastro.com/; https://github.com/Wind-liberty/CVE/issues/2; https://vuldb.com/?ctiid.289304
CVE: CVE-2024-56433
Published: 2024-12-26
Description: shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.
CVSS Score: 3.6 (LOW)
CWE: CWE-1188
References: https://github.com/shadow-maint/shadow/blob/e2512d5741d4a44bdd81a8c2d0029b6222728cf0/etc/login.defs#L238-L241; https://github.com/shadow-maint/shadow/issues/1157; https://github.com/shadow-maint/shadow/releases/tag/4.4
CVE: CVE-2024-12945
Published: 2024-12-26
Description: A vulnerability classified as critical was found in code-projects Simple Car Rental System 1.0. This vulnerability affects unknown code of the file /account.php. The manipulation of the argument email/pass leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/Wind-liberty/CVE/issues/3; https://vuldb.com/?ctiid.289306
CVE: CVE-2024-12946
Published: 2024-12-26
Description: A vulnerability, which was classified as critical, has been found in 1000 Projects Attendance Tracking Management System 1.0. This issue affects some unknown processing of the file /admin/admin_action.php. The manipulation of the argument admin_user_name leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://1000projects.org/; https://github.com/vicleet/CVE/issues/1; https://vuldb.com/?ctiid.289307
CVE: CVE-2024-12947
Published: 2024-12-26
Description: A vulnerability was found in Codezips Hospital Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /invo.php. The manipulation of the argument dname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/alc9700jmo/CVE/issues/3; https://vuldb.com/?ctiid.289310; https://vuldb.com/?id.289310
CVE: CVE-2024-12948
Published: 2024-12-26
Description: A vulnerability was found in code-projects Travel Management System 1.0. It has been classified as critical. This affects an unknown part of the file /detail.php. The manipulation of the argument pid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-74, CWE-89
References: https://code-projects.org/; https://vuldb.com/?ctiid.289311; https://vuldb.com/?id.289311
CVE: CVE-2024-47151
Published: 2024-12-26
Description: Some Honor products are affected by file writing vulnerability, successful exploitation could cause code execution
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://www.honor.com/global/security/cve-2024-47151/
CVE: CVE-2024-47156
Published: 2024-12-26
Description: Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.
CVSS Score: 3.3 (LOW)
CWE: CWE-203
References: https://www.honor.com/global/security/cve-2024-47156/
CVE: CVE-2024-12949
Published: 2024-12-26
Description: A vulnerability was found in code-projects Travel Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /package.php. The manipulation of the argument subcatid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-74, CWE-89
References: https://code-projects.org/; https://vuldb.com/?ctiid.289312; https://vuldb.com/?id.289312
CVE: CVE-2024-12950
Published: 2024-12-26
Description: A vulnerability was found in code-projects/projectworlds Travel Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /subcat.php. The manipulation of the argument catid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-74, CWE-89
References: https://vuldb.com/?ctiid.289313; https://vuldb.com/?id.289313; https://vuldb.com/?submit.468543
CVE: CVE-2024-47148
Published: 2024-12-26
Description: Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-863
References: https://www.honor.com/global/security/cve-2024-47148/
CVE: CVE-2024-47153
Published: 2024-12-26
Description: Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-203
References: https://www.honor.com/global/security/cve-2024-47153/
CVE: CVE-2024-47154
Published: 2024-12-26
Description: Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-203
References: https://www.honor.com/global/security/cve-2024-47154/
CVE: CVE-2024-47155
Published: 2024-12-26
Description: Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-203
References: https://www.honor.com/global/security/cve-2024-47155/
CVE: CVE-2024-47157
Published: 2024-12-26
Description: Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.
CVSS Score: 2.9 (LOW)
CWE: CWE-863
References: https://www.honor.com/global/security/cve-2024-47157/
CVE: CVE-2024-8992
Published: 2024-12-26
Description: Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-203
References: https://www.honor.com/global/security/cve-2024-8992/
CVE: CVE-2024-8993
Published: 2024-12-26
Description: Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-203
References: https://www.honor.com/global/security/cve-2024-8993/
CVE: CVE-2024-8994
Published: 2024-12-26
Description: Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-203
References: https://www.honor.com/global/security/cve-2024-8994/
CVE: CVE-2024-12951
Published: 2024-12-26
Description: A vulnerability classified as critical has been found in 1000 Projects Portfolio Management System MCA 1.0. Affected is an unknown function of the file /add_personal_details.php. The manipulation of the argument profile leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://1000projects.org/; https://github.com/dawatermelon/CVE/blob/main/Portfolio%20Management%20System%20MCA%20Project/README3.md; https://vuldb.com/?ctiid.289314
CVE: CVE-2024-12952
Published: 2024-12-26
Description: A vulnerability classified as critical was found in melMass comfy_mtb up to 0.1.4. Affected by this vulnerability is the function run_command of the file comfy_mtb/endpoint.py of the component Dependency Handler. The manipulation leads to code injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The patch is named d6e004cce2c32f8e48b868e66b89f82da4887dc3. It is recommended to apply a patch to fix this issue.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-94
References: https://github.com/melMass/comfy_mtb/commit/d6e004cce2c32f8e48b868e66b89f82da4887dc3; https://github.com/melMass/comfy_mtb/issues/224; https://github.com/melMass/comfy_mtb/issues/224#issuecomment[PII_REDACTED]
CVE: CVE-2024-47149
Published: 2024-12-26
Description: Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.
CVSS Score: 3.3 (LOW)
CWE: CWE-203
References: https://www.honor.com/global/security/cve-2024-47149/
CVE: CVE-2024-47150
Published: 2024-12-26
Description: Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.
CVSS Score: 3.3 (LOW)
CWE: CWE-203
References: https://www.honor.com/global/security/cve-2024-47150/
CVE: CVE-2024-12953
Published: 2024-12-26
Description: A vulnerability, which was classified as critical, has been found in 1000 Projects Portfolio Management System MCA 1.0. Affected by this issue is some unknown functionality of the file /update_pd_process.php. The manipulation of the argument profile leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://1000projects.org/; https://github.com/dawatermelon/CVE/blob/main/Portfolio%20Management%20System%20MCA%20Project/README4.md; https://vuldb.com/?ctiid.289316
CVE: CVE-2024-12954
Published: 2024-12-26
Description: A vulnerability, which was classified as critical, was found in 1000 Projects Portfolio Management System MCA 1.0. This affects an unknown part of the file /update_ach.php. The manipulation of the argument ach_certy leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://1000projects.org/; https://github.com/dawatermelon/CVE/blob/main/Portfolio%20Management%20System%20MCA%20Project/README5.md; https://vuldb.com/?ctiid.289317
CVE: CVE-2024-12955
Published: 2024-12-26
Description: A vulnerability has been found in PHPGurukul Blood Bank & Donor Management System 2.4 and classified as problematic. This vulnerability affects unknown code of the file /logout.php. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862
References: https://phpgurukul.com/; https://vuldb.com/?ctiid.289318; https://vuldb.com/?id.289318
CVE: CVE-2024-12956
Published: 2024-12-26
Description: A vulnerability was found in 1000 Projects Portfolio Management System MCA 1.0 and classified as critical. This issue affects some unknown processing of the file /add_achievement_details.php. The manipulation of the argument ach_certy leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://1000projects.org/; https://github.com/dawatermelon/CVE/blob/main/Portfolio%20Management%20System%20MCA%20Project/README2.md; https://vuldb.com/?ctiid.289319
CVE: CVE-2024-12908
Published: 2024-12-26
Description: Delinea addressed a reported case on Secret Server v11.7.31 (protocol handler version 6.0.3.26) where, within the protocol handler function, URI's were compared before normalization and canonicalization, potentially leading to over matching against the approved list. If this attack were successfully exploited, a remote attacker may be able to convince a user to visit a malicious web-page, or open a
malicious document which could trigger the vulnerable handler, allowing them to execute
arbitrary code on the user's machine. Delinea added additional validation that the downloaded installer's batch file was in the expected format.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-94
References: https://blog.amberwolf.com/blog/2024/december/cve-2024-12908-delinea-protocol-handler---remote-code-execution-via-update-process/; https://docs.delinea.com/online-help/secret-server/release-notes/ss-rn-11-7-000049.htm; https://trust.delinea.com/