deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-1534
Published: 2024-03-07
Description: The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 7.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3046146%40woocommerce-jetpack%2Ftrunk&old=3034358%40woocommerce-jetpack%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/56dc5138-c864-4e36-8b7d-38ac49589c06?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3046146%40woocommerce-jetpack%2Ftrunk&old=3034358%40woocommerce-jetpack%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2024-1931
Published: 2024-03-07
Description: NLnet Labs Unbound version 1.18.0 up to and including version 1.19.1 contain a vulnerability that can cause denial of service by a certain code path that can lead to an infinite loop. Unbound 1.18.0 introduced a feature that removes EDE records from responses with size higher than the client's advertised buffer size. Before removing all the EDE records however, it would try to see if trimming the extra text fields on those records would result in an acceptable size while still retaining the EDE codes. Due to an unchecked condition, the code that trims the text of the EDE records could loop indefinitely. This happens when Unbound would reply with attached EDE information on a positive reply and the client's buffer size is smaller than the needed space to include EDE records. The vulnerability can only be triggered when the 'ede: yes' option is used; non default configuration. From version 1.19.2 on, the code is fixed to avoid looping indefinitely.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835, CWE-835
References: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4VCBRQ7KMSIGBQ6A4SBL5PF326DIJIIV/; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B2JUIFPA7H75Q2W3VXW2TUNHK6NVGOX4/; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBR4H7RCVMJ6H76S4LLRSY5EBFTYWGXK/
CVE: CVE-2024-22256
Published: 2024-03-07
Description: VMware Cloud Director contains a partial information disclosure vulnerability. A malicious actor can potentially gather information about organization names based on the behavior of the instance.
CVSS Score: 4.3 (MEDIUM)
References: https://www.vmware.com/security/advisories/VMSA-2024-0007.html; https://www.vmware.com/security/advisories/VMSA-2024-0007.html
CVE: CVE-2024-1169
Published: 2024-03-07
Description: The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to unauthorized media upload due to a missing capability check on the buddyforms_upload_handle_dropped_media function in all versions up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to upload media files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/buddyforms/trunk/includes/functions.php#L1466; https://plugins.trac.wordpress.org/changeset/3046092/buddyforms/trunk/includes/functions.php?contextall=1&old=3023795&old_path=%2Fbuddyforms%2Ftrunk%2Fincludes%2Ffunctions.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/6d14a90d-65ea-45da-956b-0735e2e2b538?source=cve
CVE: CVE-2024-1170
Published: 2024-03-07
Description: The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to unauthorized media file deletion due to a missing capability check on the handle_deleted_media function in all versions up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to delete arbitrary media files.
CVSS Score: 8.2 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/buddyforms/trunk/includes/functions.php#L1493; https://plugins.trac.wordpress.org/changeset/3046092/buddyforms/trunk?contextall=1&old=3031945&old_path=%2Fbuddyforms%2Ftrunk#file7; https://www.wordfence.com/threat-intel/vulnerabilities/id/380c646c-fd95-408a-89eb-3e646768bbc5?source=cve
CVE: CVE-2024-28228
Published: 2024-03-07
Description: In JetBrains YouTrack before 2024.1.25893 creation comments on behalf of an arbitrary user in HelpDesk was possible
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-290, CWE-290
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-28229
Published: 2024-03-07
Description: In JetBrains YouTrack before 2024.1.25893 user without appropriate permissions could restore issues and articles
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-28230
Published: 2024-03-07
Description: In JetBrains YouTrack before 2024.1.25893 attaching/detaching workflow to a project was possible without project admin permissions
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-0818
Published: 2024-03-07
Description: Arbitrary File Overwrite Via Path Traversal in paddlepaddle/paddle before 2.6
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://huntr.com/bounties/85b06a1b-ac0b-4096-a06d-330891570cd9; https://huntr.com/bounties/85b06a1b-ac0b-4096-a06d-330891570cd9
CVE: CVE-2024-2241
Published: 2024-03-07
Description: Improper access control in the user interface in Devolutions Workspace 2024.1.0 and earlier allows an authenticated user to perform unintended actions via specific permissions



CVSS Score: 6.3 (MEDIUM)
References: https://devolutions.net/security/advisories/DEVO-2024-0003; https://devolutions.net/security/advisories/DEVO-2024-0003
CVE: CVE-2024-2245
Published: 2024-03-07
Description: Cross-Site Scripting vulnerability in moziloCMS version 2.0. By sending a POST request to the '/install.php' endpoint, a JavaScript payload could be executed in the 'username' parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-mozilocms; https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-mozilocms
CVE: CVE-2023-42509
Published: 2024-03-07
Description: JFrog Artifactory later than version 7.17.4 but prior to version 7.77.0 is vulnerable to an issue whereby a sequence of improperly handled exceptions in repository configuration initialization steps may lead to exposure of sensitive data.


CVSS Score: 6.6 (MEDIUM)
CWE: CWE-755
References: https://jfrog.com/help/r/jfrog-release-information/jfrog-security-advisories; https://jfrog.com/help/r/jfrog-release-information/jfrog-security-advisories
CVE: CVE-2023-42661
Published: 2024-03-07
Description: JFrog Artifactory prior to version 7.76.2 is vulnerable to Arbitrary File Write of untrusted data, which may lead to DoS or Remote Code Execution when a specially crafted series of requests is sent by an authenticated user. This is due to insufficient validation of artifacts.

CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: https://jfrog.com/help/r/jfrog-release-information/jfrog-security-advisories; https://jfrog.com/help/r/jfrog-release-information/jfrog-security-advisories
CVE: CVE-2023-47691
Published: 2024-03-07
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-48725
Published: 2024-03-07
Description: A stack-based buffer overflow vulnerability exists in the JSON Parsing getblockschedule() functionality of Netgear RAX30 1.0.11.96 and 1.0.7.78. A specially crafted HTTP request can lead to code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121, CWE-787
References: https://kb.netgear.com/000066037/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-the-RAX30-PSV-2023-0160; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1887; https://kb.netgear.com/000066037/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-the-RAX30-PSV-2023-0160
CVE: CVE-2024-1351
Published: 2024-03-07
Description: Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which may result in untrusted connections to succeed. This may effectively reduce the security guarantees provided by TLS and open connections  that should have been closed due to failing certificate validation. This issue affects MongoDB Server v7.0 versions prior to and including 7.0.5, MongoDB Server v6.0 versions prior to and including 6.0.13, MongoDB Server v5.0 versions prior to and including 5.0.24 and MongoDB Server v4.4 versions prior to and including 4.4.28.

Required Configuration : A server process will allow incoming connections to skip peer certificate validation if the server process was started with TLS enabled (net.tls.mode set to allowTLS, preferTLS, or requireTLS) and without a net.tls.CAFile configured.
CVSS Score: 8.8 (HIGH)
CWE: CWE-295, CWE-295
References: https://jira.mongodb.org/browse/SERVER-72839; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.mongodb.com/docs/manual/release-notes/4.4/#4.4.29---february-28--2024
CVE: CVE-2024-27733
Published: 2024-03-07
Description: File Upload vulnerability in Byzro Network Smart s42 Management Platform v.S42 allows a local attacker to execute arbitrary code via the useratte/userattestation.php component.
CVSS Score: 7.7 (HIGH)
CWE: CWE-434
References: https://github.com/Sadw11v/cve/blob/main/upload.md; https://github.com/Sadw11v/cve/blob/main/upload.md
CVE: CVE-2024-1442
Published: 2024-03-07
Description:  A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *.
Doing this will grant the user access to read, query, edit and delete all data sources within the organization.

CVSS Score: 6.0 (MEDIUM)
CWE: CWE-269
References: https://grafana.com/security/security-advisories/cve-2024-1442/; https://grafana.com/security/security-advisories/cve-2024-1442/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-22752
Published: 2024-03-07
Description: Insecure permissions issue in EaseUS MobiMover 6.0.5 Build 21620 allows attackers to gain escalated privileges via use of crafted executable launched from the application installation directory.
CVSS Score: 8.1 (HIGH)
CWE: CWE-269
References: https://github.com/hacker625/CVE-2024-22752; https://github.com/hacker625/CVE-2024-22752
CVE: CVE-2024-1773
Published: 2024-03-07
Description: The PDF Invoices and Packing Slips For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.7 via deserialization of untrusted input via the order_id parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-74
References: https://plugins.trac.wordpress.org/browser/pdf-invoices-and-packing-slips-for-woocommerce/trunk/includes/class-apifw-front-end.php#L94; https://plugins.trac.wordpress.org/changeset/3042740/; https://www.wordfence.com/threat-intel/vulnerabilities/id/4dc6e879-4ccf-485e-b02d-2b291e67df40?source=cve
CVE: CVE-2024-0203
Published: 2024-03-07
Description: The Digits plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.1. This is due to missing nonce validation in the 'digits_save_settings' function. This makes it possible for unauthenticated attackers to modify the default role of registered users to elevate user privileges via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://digits.unitedover.com/changelog/; https://www.wordfence.com/threat-intel/vulnerabilities/id/84f2afb4-f1c6-4313-8958-38f1b5140a67?source=cve; https://digits.unitedover.com/changelog/
CVE: CVE-2024-1725
Published: 2024-03-07
Description: A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP). This issue could allow an authenticated attacker to gain access to the root HCP worker node's volume by creating a custom Persistent Volume that matches the name of a worker node.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-501
References: https://access.redhat.com/errata/RHSA-2024:1559; https://access.redhat.com/errata/RHSA-2024:1891; https://access.redhat.com/errata/RHSA-2024:2047
CVE: CVE-2024-2127
Published: 2024-03-07
Description: The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom attributes in all versions up to, and including, 1.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3045444%40pagelayer&new=3045444%40pagelayer&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/98bff131-dee2-4549-9167-69dc3f8d6b9d?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3045444%40pagelayer&new=3045444%40pagelayer&sfp_email=&sfph_mail=
CVE: CVE-2024-2128
Published: 2024-03-07
Description: The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's embed widget in all versions up to, and including, 3.9.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/embedpress/tags/3.9.10/EmbedPress/Elementor/Widgets/Embedpress_Pdf.php#L688; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3045489%40embedpress&new=3045489%40embedpress&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/6189368d-5925-4c84-9f0f-694b9ebcd45e?source=cve
CVE: CVE-2023-46169
Published: 2024-03-07
Description: 
IBM DS8900F HMC 89.21.19.0, 89.21.31.0, 89.30.68.0, 89.32.40.0, and 89.33.48.0 could allow an authenticated user to arbitrarily delete a file.  IBM X-Force ID:  269406.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-41
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/269406; https://www.ibm.com/support/pages/node/7130084; https://exchange.xforce.ibmcloud.com/vulnerabilities/269406
CVE: CVE-2023-46170
Published: 2024-03-07
Description: IBM DS8900F HMC 89.21.19.0, 89.21.31.0, 89.30.68.0, 89.32.40.0, and 89.33.48.0 could allow an authenticated user to arbitrarily read files after enumerating file names.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-204
References: https://www.ibm.com/support/pages/node/7130084; https://exchange.xforce.ibmcloud.com/vulnerabilities/269407; https://www.ibm.com/support/pages/node/7130084
CVE: CVE-2023-46171
Published: 2024-03-07
Description: IBM DS8900F HMC 89.21.19.0, 89.21.31.0, 89.30.68.0, 89.32.40.0, and 89.33.48.0 could allow an authenticated user to view sensitive log information after enumerating filenames.  IBM X-Force ID:  269408.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-532
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/269408; https://www.ibm.com/support/pages/node/7130084; https://exchange.xforce.ibmcloud.com/vulnerabilities/269408
CVE: CVE-2023-46172
Published: 2024-03-07
Description: IBM DS8900F HMC 89.21.19.0, 89.21.31.0, 89.30.68.0, 89.32.40.0, and 89.33.48.0 could allow a remote attacker to bypass authentication restrictions for authorized user.   IBM X-Force ID:  269409.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-287
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/269409; https://www.ibm.com/support/pages/node/7130084; https://exchange.xforce.ibmcloud.com/vulnerabilities/269409
CVE: CVE-2024-1802
Published: 2024-03-07
Description: The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Wistia embed block in all versions up to, and including, 3.9.10 due to insufficient input sanitization and output escaping on the user supplied url. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3045489%40embedpress&new=3045489%40embedpress&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/48511d1a-2fd5-4be4-8409-e99d4aadcdfe?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3045489%40embedpress&new=3045489%40embedpress&sfp_email=&sfph_mail=
CVE: CVE-2024-1986
Published: 2024-03-07
Description: The Booster Elite for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wc_add_new_product() function in all versions up to, and including, 7.1.7. This makes it possible for customer-level attackers, and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. This is only exploitable when the user product upload functionality is enabled.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://booster.io/; https://plugins.trac.wordpress.org/browser/woocommerce-jetpack/trunk/includes/shortcodes/class-wcj-products-add-form-shortcodes.php#L132; https://plugins.trac.wordpress.org/browser/woocommerce-jetpack/trunk/includes/shortcodes/class-wcj-products-add-form-shortcodes.php#L138
CVE: CVE-2024-24035
Published: 2024-03-07
Description: Cross Site Scripting (XSS) vulnerability in Setor Informatica SIL 3.1 allows attackers to run arbitrary code via the hmessage parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ELIZEUOPAIN/CVE-2024-24035/tree/main; https://github.com/ELIZEUOPAIN/CVE-2024-24035/tree/main
CVE: CVE-2024-26167
Published: 2024-03-07
Description: Microsoft Edge for Android Spoofing Vulnerability
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1021
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26167; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26167
CVE: CVE-2024-26492
Published: 2024-03-07
Description: An issue in Online Diagnostic Lab Management System 1.0 allows a remote attacker to gain control of a 'Staff' user account via a crafted POST request using the id, email, password, and cpass parameters.
CVSS Score: 6.3 (MEDIUM)
References: https://packetstormsecurity.com/files/165555/Online-Diagnostic-Lab-Management-System-1.0-Missing-Access-Control.html; https://www.exploit-db.com/exploits/50660; https://packetstormsecurity.com/files/165555/Online-Diagnostic-Lab-Management-System-1.0-Missing-Access-Control.html
CVE: CVE-2024-27707
Published: 2024-03-07
Description: Server Side Request Forgery (SSRF) vulnerability in hcengineering Huly Platform v.0.6.202 allows attackers to run arbitrary code via upload of crafted SVG file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/b-hermes/vulnerability-research/tree/main/CVE-2024-27707; https://github.com/b-hermes/vulnerability-research/tree/main/CVE-2024-27707
CVE: CVE-2024-28115
Published: 2024-03-07
Description: FreeRTOS is a real-time operating system for microcontrollers. FreeRTOS Kernel versions through 10.6.1 do not sufficiently protect against local privilege escalation via Return Oriented Programming techniques should a vulnerability exist that allows code injection and execution. These issues affect ARMv7-M MPU ports, and ARMv8-M ports with Memory Protected Unit (MPU) support enabled (i.e. `configENABLE_MPU` set to 1). These issues are fixed in version 10.6.2 with a new MPU wrapper. 
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://github.com/FreeRTOS/FreeRTOS-Kernel/releases/tag/V10.6.2; https://github.com/FreeRTOS/FreeRTOS-Kernel/security/advisories/GHSA-xcv7-v92w-gq6r; https://github.com/FreeRTOS/FreeRTOS-Kernel/releases/tag/V10.6.2
CVE: CVE-2024-2044
Published: 2024-03-07
Description: pgAdmin <= 8.3 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session handling code. If the server is running on Windows, an unauthenticated attacker can load and deserialize remote pickle objects and gain code execution. If the server is running on POSIX/Linux, an authenticated attacker can upload pickle objects, deserialize them, and gain code execution.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-31
References: https://github.com/pgadmin-org/pgadmin4/issues/7258; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LUYN2JXKKHFSVTASH344TBRGWDH64XQV/; https://www.shielder.com/advisories/pgadmin-path-traversal_leads_to_unsafe_deserialization_and_rce/
CVE: CVE-2024-2264
Published: 2024-03-07
Description: A vulnerability, which was classified as critical, has been found in keerti1924 PHP-MYSQL-User-Login-System 1.0. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-256034 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/keerti1924%20PHP-MYSQL-User-Login-System/SQLI%20Auth.md; https://vuldb.com/?ctiid.256034; https://vuldb.com/?id.256034
CVE: CVE-2024-2265
Published: 2024-03-07
Description: A vulnerability, which was classified as problematic, was found in keerti1924 PHP-MYSQL-User-Login-System 1.0. This affects an unknown part of the file login.sql. The manipulation leads to inclusion of sensitive information in source code. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256035. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-540
References: https://github.com/smurf-reigz/security/blob/main/proof-of-concepts/keerti1924%20publicly%20exposed%20password%20hashes.md; https://vuldb.com/?ctiid.256035; https://vuldb.com/?id.256035