deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-26783
Published: 2025-05-14
Description: An issue was discovered in RRC in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 2100, 1280, 2200, 1330, 1380, 1480, 2400, W1000, Modem 5300, and Modem 5400. Incorrect handling of undefined values leads to a Denial of Service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-26783/
CVE: CVE-2025-27891
Published: 2025-05-14
Description: An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, W920, W930, W1000, Modem 5123, Modem 5300, Modem 5400. The lack of a length check leads to out-of-bounds reads via malformed NAS packets.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-27891/
CVE: CVE-2025-44024
Published: 2025-05-14
Description: Cross-Site Scripting (XSS) vulnerability was discovered in the Pichome system v2.1.0 and before. The vulnerability exists due to insufficient sanitization of user input in the login form. An attacker can inject malicious JavaScript code into the username or password fields during the login process
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/zyx0814/Pichome/issues/50; https://github.com/zyx0814/Pichome/issues/50
CVE: CVE-2025-44879
Published: 2025-05-14
Description: WS-WN572HP3 V230525 was discovered to contain a buffer overflow in the component /www/cgi-bin/upload.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://lafdrew.github.io/2025/03/17/Buffer%20Overflow%20in%20upload.cgi%20of%20WINSTAR_WN572HP3%20Device/; https://lafdrew.github.io/2025/03/17/Buffer%20Overflow%20in%20upload.cgi%20of%20WINSTAR_WN572HP3%20Device/
CVE: CVE-2025-47884
Published: 2025-05-14
Description: In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentially overridden values of environment variables, in conjunction with certain other plugins allowing attackers able to configure jobs to craft a build ID Token that impersonates a trusted job, potentially gaining unauthorized access to external services.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-284
References: https://www.jenkins.io/security/advisory/2025-05-14/#SECURITY-3574
CVE: CVE-2025-47885
Published: 2025-05-14
Description: Jenkins Health Advisor by CloudBees Plugin 374.v194b_d4f0c8c8 and earlier does not escape responses from the Jenkins Health Advisor server, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control Jenkins Health Advisor server responses.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: https://www.jenkins.io/security/advisory/2025-05-14/#SECURITY-3559
CVE: CVE-2025-47886
Published: 2025-05-14
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Cadence vManager Plugin 4.0.1-286.v9e25a_740b_a_48 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified username and password.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://www.jenkins.io/security/advisory/2025-05-14/#SECURITY-3548
CVE: CVE-2025-47887
Published: 2025-05-14
Description: Missing permission checks in Jenkins Cadence vManager Plugin 4.0.1-286.v9e25a_740b_a_48 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://www.jenkins.io/security/advisory/2025-05-14/#SECURITY-3548
CVE: CVE-2025-47888
Published: 2025-05-14
Description: Jenkins DingTalk Plugin 2.7.3 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections to the configured DingTalk webhooks.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: https://www.jenkins.io/security/advisory/2025-05-14/#SECURITY-3353
CVE: CVE-2025-47889
Published: 2025-05-14
Description: In Jenkins WSO2 Oauth Plugin 1.0 and earlier, authentication claims are accepted without validation by the "WSO2 Oauth" security realm, allowing unauthenticated attackers to log in to controllers using this security realm using any username and any password, including usernames that do not exist.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://www.jenkins.io/security/advisory/2025-05-14/#SECURITY-3481
CVE: CVE-2025-29686
Published: 2025-05-14
Description: A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title parameter at /inform/InformManageController.java.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gitee.com/hailey888/oa_system/issues/IBRQWG; https://gitee.com/hailey888/oa_system/issues/IBRQWG
CVE: CVE-2025-29688
Published: 2025-05-14
Description: A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title parameter at /daymanager/daymanageabilitycontroller.java.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gitee.com/hailey888/oa_system/issues/IBRRZX; https://gitee.com/hailey888/oa_system/issues/IBRRZX
CVE: CVE-2025-29689
Published: 2025-05-14
Description: A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the password parameter at /mail/MailController.java.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gitee.com/hailey888/oa_system/issues/IBRQZ9; https://gitee.com/hailey888/oa_system/issues/IBRQZ9
CVE: CVE-2025-29690
Published: 2025-05-14
Description: A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the outtype parameter at /address/AddrController.java.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gitee.com/hailey888/oa_system/issues/IBRRX3; https://gitee.com/hailey888/oa_system/issues/IBRRX3
CVE: CVE-2025-29691
Published: 2025-05-14
Description: A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the userName parameter at /login/LoginsController.java.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gitee.com/hailey888/oa_system/issues/IBRQYI; https://gitee.com/hailey888/oa_system/issues/IBRQYI
CVE: CVE-2024-45067
Published: 2025-05-14
Description: Incorrect default permissions in some Intel(R) Gaudi(R) software installers before version 1.18 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 8.2 (HIGH)
CWE: CWE-276
References: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01271.html
CVE: CVE-2025-32421
Published: 2025-05-14
Description: Next.js is a React framework for building full-stack web applications. Versions prior to 14.2.24 and 15.1.6 have a race-condition vulnerability. This issue only affects the Pages Router under certain misconfigurations, causing normal endpoints to serve `pageProps` data instead of standard HTML. This issue was patched in versions 15.1.6 and 14.2.24 by stripping the `x-now-route-matches` header from incoming requests. Applications hosted on Vercel's platform are not affected by this issue, as the platform does not cache responses based solely on `200 OK` status without explicit `cache-control` headers. Those who self-host Next.js deployments and are unable to upgrade immediately can mitigate this vulnerability by stripping the `x-now-route-matches` header from all incoming requests at the content development network and setting `cache-control: no-store` for all responses under risk. The maintainers of Next.js strongly recommend only caching responses with explicit cache-control headers.
CVSS Score: 3.7 (LOW)
CWE: CWE-362
References: https://github.com/vercel/next.js/security/advisories/GHSA-qpjv-v59x-3qc4; https://vercel.com/changelog/cve-2025-32421
CVE: CVE-2025-46836
Published: 2025-05-14
Description: net-tools is a collection of programs that form the base set of the NET-3 networking distribution for the Linux operating system. Inn versions up to and including 2.10, the Linux network utilities (like ifconfig) from the net-tools package do not properly validate the structure of /proc files when showing interfaces. `get_name()` in `interface.c` copies interface labels from `/proc/net/dev` into a fixed 16-byte stack buffer without bounds checking, leading to possible arbitrary code execution or crash. The known attack path does not require privilege but also does not provide privilege escalation in this scenario. A patch is available and expected to be part of version 2.20.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-20, CWE-121
References: https://github.com/ecki/net-tools/commit/7a8f42fb20013a1493d8cae1c43436f85e656f2d; https://github.com/ecki/net-tools/security/advisories/GHSA-pfwf-h6m3-63wf; https://lists.debian.org/debian-lts-announce/2025/05/msg00053.html
CVE: CVE-2025-47783
Published: 2025-05-14
Description: Label Studio is a multi-type data labeling and annotation tool. A vulnerability in versions prior to 1.18.0 allows an attacker to inject a malicious script into the context of a web page, which can lead to data theft, session hijacking, unauthorized actions on behalf of the user, and other attacks. The vulnerability is reproducible when sending a properly formatted request to the `POST /projects/upload-example/` endpoint. In the source code, the vulnerability is located at `label_studio/projects/views.py`. Version 1.18.0 contains a patch for the issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/HumanSignal/label-studio/security/advisories/GHSA-8jhr-wpcm-hh4h
CVE: CVE-2025-4579
Published: 2025-05-15
Description: The WP Content Security Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the blocked-uri and effective-directive  parameters in all versions up to, and including, 2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-content-security-policy/tags/2.3/includes/WP_CSP.php#L597; https://plugins.trac.wordpress.org/browser/wp-content-security-policy/tags/2.3/includes/WP_CSP.php#L612; https://plugins.trac.wordpress.org/browser/wp-content-security-policy/tags/2.3/includes/WP_CSP.php#L659
CVE: CVE-2025-3917
Published: 2025-05-15
Description: The 百度站长SEO合集(支持百度/神马/Bing/头条推送) plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the download_remote_image_to_media_library function in all versions up to, and including, 2.0.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/browser/baiduseo/tags/2.0.6/inc/index/youhua.php#L371; https://plugins.trac.wordpress.org/changeset/3293597; https://wordpress.org/plugins/baiduseo/
CVE: CVE-2025-4126
Published: 2025-05-15
Description: The EG-Series plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [series] shortcode in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes in the shortcode_title function. This makes it possible for authenticated attackers - with contributor-level access and above, on sites with the Classic Editor plugin activated - to inject arbitrary JavaScript code in the titletag attribute that will execute whenever a user access an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-80
References: https://plugins.trac.wordpress.org/browser/eg-series/trunk/lib/eg-plugin.inc.php#L546; https://www.wordfence.com/threat-intel/vulnerabilities/id/ab518a1b-304d-4b93-b807-65ef3941dd47?source=cve
CVE: CVE-2025-4589
Published: 2025-05-15
Description: The Bon Toolkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bt-map' shortcode in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/bon-toolkit/trunk/includes/shortcodes.php#L71; https://www.wordfence.com/threat-intel/vulnerabilities/id/4cafec05-c275-475d-91cf-ed65cd191b0e?source=cve
CVE: CVE-2025-4591
Published: 2025-05-15
Description: The Weluka Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'weluka-map' shortcode in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/weluka-lite/trunk/class-weluka-builder.php#L4666; https://www.wordfence.com/threat-intel/vulnerabilities/id/d21a12b4-2f9d-4ae3-a5f6-1ba90fab43a2?source=cve
CVE: CVE-2025-3053
Published: 2025-05-15
Description: The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.5.07 via the uip_process_form_input() function. This is due to the function taking user supplied inputs to execute arbitrary functions with arbitrary data, and does not have any sort of capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary code on the server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://plugins.trac.wordpress.org/changeset/3292552/uipress-lite/trunk/admin/core/ajax-functions.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/6717adb0-27bc-4cd4-8c34-bea59bc0e016?source=cve
CVE: CVE-2025-48024
Published: 2025-05-15
Description: In BlueWave Checkmate before 2.1, an authenticated regular user can access sensitive application secrets via the /api/v1/settings endpoint.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-497
References: https://github.com/bluewave-labs/Checkmate/commit/36d78a9aa4ed607ca1bd2b5fdaca5a3927b2d287; https://github.com/bluewave-labs/Checkmate/commit/7a855ef47adf2265121c236097059c7c6555fd7c; https://github.com/bluewave-labs/Checkmate/commit/91c2f7f0d5106bdfd4a0ff2c14b7e44acc3baee6
CVE: CVE-2024-13914
Published: 2025-05-15
Description: The File Manager Advanced Shortcode plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.4 (file-manager-advanced-shortcode) and 2.5.6 (advanced-file-manager-pro-premium), via the 'file_manager_advanced' shortcode. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary JavaScript files on the server. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Sites currently using 2.5.4 (file-manager-advanced-shortcode) should be updated to 2.6.0 (advanced-file-manager-pro-premium).
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: https://advancedfilemanager.com/; https://www.wordfence.com/threat-intel/vulnerabilities/id/1500c72a-0621-4f97-9cab-0c9c8abeaf8f?source=cve
CVE: CVE-2025-3742
Published: 2025-05-15
Description: The Responsive Lightbox & Gallery WordPress plugin before 2.5.1 does not validate and escape some of its attributes before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/5b8f487b-63a5-4d2a-9b61-ed4d97f18320/
CVE: CVE-2025-48027
Published: 2025-05-15
Description: The HttpAuth plugin in pGina.Fork through 3.9.9.12 allows authentication bypass when an adversary controls DNS resolution for pginaloginserver.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-290
References: https://github.com/MutonUfoAI/pgina/blob/1922de0fe27492c09d2f188c2c7e54a4b364bbad/Plugins/HttpAuth/HttpAuth/Settings.cs#L44; https://github.com/kwburns/CVE/blob/main/pGina.Fork/3.9.9.12/README.md
CVE: CVE-2025-27523
Published: 2025-05-15
Description: XXE vulnerability in Hitachi JP1/IT Desktop Management 2 - Smart Device Manager on Windows.This issue affects JP1/IT Desktop Management 2 - Smart Device Manager: from 12-00 before 12-00-08, from 11-10 through 11-10-08, from 11-00 through 11-00-05, from 10-50 through 10-50-06.
CVSS Score: 8.7 (HIGH)
CWE: CWE-611
References: https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2025-115/index.html
CVE: CVE-2025-27524
Published: 2025-05-15
Description: Weak encryption vulnerability in Hitachi JP1/IT Desktop Management 2 - Smart Device Manager on Windows.This issue affects JP1/IT Desktop Management 2 - Smart Device Manager: from 12-00 before 12-00-08, from 11-10 through 11-10-08, from 11-00 through 11-00-05, from 10-50 through 10-50-06.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-326
References: https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2025-115/index.html
CVE: CVE-2025-27525
Published: 2025-05-15
Description: Information Exposure vulnerability in Hitachi JP1/IT Desktop Management 2 - Smart Device Manager on Windows.This issue affects JP1/IT Desktop Management 2 - Smart Device Manager: from 12-00 before 12-00-08, from 11-10 through 11-10-08, from 11-00 through 11-00-05, from 10-50 through 10-50-06.
CVSS Score: 3.9 (LOW)
CWE: CWE-525
References: https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2025-115/index.html
CVE: CVE-2025-4737
Published: 2025-05-15
Description: Insufficient encryption vulnerability in the mobile application (com.transsion.aivoiceassistant) may lead to the risk of sensitive information leakage.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-312
References: https://security.tecno.com/SRC/blogdetail/422?lang=en_US; https://security.tecno.com/SRC/securityUpdates
CVE: CVE-2025-32002
Published: 2025-05-15
Description: Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in I-O DATA network attached hard disk 'HDL-T Series' firmware Ver.1.21 and earlier when 'Remote Link3 function' is enabled. If exploited, a remote unauthenticated attacker may execute an arbitrary OS command.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://jvn.jp/en/vu/JVNVU91726405/; https://www.iodata.jp/support/information/2025/05_hdl-t/
CVE: CVE-2025-32738
Published: 2025-05-15
Description: Missing authentication for critical function issue exists in I-O DATA network attached hard disk 'HDL-T Series' firmware Ver.1.21 and earlier. If exploited, a remote unauthenticated attacker may change the product settings.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: https://jvn.jp/en/vu/JVNVU91726405/; https://www.iodata.jp/support/information/2025/05_hdl-t/
CVE: CVE-2025-31947
Published: 2025-05-15
Description: Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to lockout LDAP users following repeated login failures, which allows attackers to lock external LDAP accounts through repeated login failures through Mattermost.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-645
References: https://mattermost.com/security-updates
CVE: CVE-2025-3446
Published: 2025-05-15
Description: Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to check the correct permissions which allows authenticated users who only have permission to invite non-guest users to a team to add guest users to that team via the API to add a single user to a team.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://mattermost.com/security-updates
CVE: CVE-2025-4564
Published: 2025-05-15
Description: The TicketBAI Facturas para WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation via the 'delpdf' action in all versions up to, and including, 3.18. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/browser/wp-ticketbai/trunk/wp-ticketbai.php#L240; https://plugins.trac.wordpress.org/changeset/3292061/; https://www.wordfence.com/threat-intel/vulnerabilities/id/2927aa13-b012-41eb-93bd-38a4e5fc5455?source=cve
CVE: CVE-2025-4762
Published: 2025-05-15
Description: Insecure Direct Object Reference (IDOR) vulnerability in the eSignaViewer component in eSigna product versions 1.0 to 1.5 on all platforms allow an unauthenticated attacker to access arbitrary files in the document system via manipulation of file paths and object identifiers.
CWE: CWE-20
References: https://edgewatch.com/vulnerability-advisories/path-traversal-and-idor-vulnerabilities-in-esignaviewer-allow-unauthorized-file-access/
CVE: CVE-2025-4695
Published: 2025-05-15
Description: A vulnerability was found in PHPGurukul/Campcodes Cyber Cafe Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /add-users.php. The manipulation of the argument uadd leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Iandweb/CVE/issues/14; https://vuldb.com/?ctiid.308994; https://vuldb.com/?id.308994
CVE: CVE-2025-4696
Published: 2025-05-15
Description: A vulnerability was found in PHPGurukul/Campcodes Cyber Cafe Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /search.php. The manipulation of the argument searchdata leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Iandweb/CVE/issues/15; https://vuldb.com/?ctiid.308995; https://vuldb.com/?id.308995
CVE: CVE-2025-4697
Published: 2025-05-15
Description: A vulnerability was found in PHPGurukul Directory Management System 2.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/edit-directory.php. The manipulation of the argument editid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/lwecho/myCVE/issues/2; https://phpgurukul.com/; https://vuldb.com/?ctiid.308996