deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-45187
Published: 2024-02-09
Description: IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.  IBM X-Force ID:  268749.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-613
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/268749; https://www.ibm.com/support/pages/node/7116045; https://exchange.xforce.ibmcloud.com/vulnerabilities/268749
CVE: CVE-2023-45190
Published: 2024-02-09
Description: IBM Engineering Lifecycle Optimization 7.0.2 and 7.0.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers.  This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.  IBM X-Force ID:  268754.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-307, CWE-644
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/268754; https://www.ibm.com/support/pages/node/7116045; https://exchange.xforce.ibmcloud.com/vulnerabilities/268754
CVE: CVE-2023-45191
Published: 2024-02-09
Description: IBM Engineering Lifecycle Optimization 7.0.2 and 7.0.3 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.  IBM X-Force ID:  268755.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/268755; https://www.ibm.com/support/pages/node/7116045; https://exchange.xforce.ibmcloud.com/vulnerabilities/268755
CVE: CVE-2024-1353
Published: 2024-02-09
Description: A vulnerability, which was classified as critical, has been found in PHPEMS up to 1.0. Affected by this issue is the function index of the file app/weixin/controller/index.api.php. The manipulation of the argument picurl leads to deserialization. The exploit has been disclosed to the public and may be used. VDB-253226 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-502, CWE-502
References: https://note.zhaoj.in/share/nxGzfEB6fFVY; https://vuldb.com/?ctiid.253226; https://vuldb.com/?id.253226
CVE: CVE-2024-22318
Published: 2024-02-09
Description: IBM i Access Client Solutions (ACS) 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.4 is vulnerable to NT LAN Manager (NTLM) hash disclosure by an attacker modifying UNC capable paths within ACS configuration files to point to a hostile server. If NTLM is enabled, the Windows operating system will try to authenticate using the current user's session. The hostile server could capture the NTLM hash information to obtain the user's credentials.  IBM X-Force ID:  279091.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-327, CWE-384
References: http://packetstormsecurity.com/files/177069/IBM-i-Access-Client-Solutions-Remote-Credential-Theft.html; http://seclists.org/fulldisclosure/2024/Feb/7; https://exchange.xforce.ibmcloud.com/vulnerabilities/279091
CVE: CVE-2024-22332
Published: 2024-02-09
Description: The IBM Integration Bus for z/OS 10.1 through 10.1.0.2 AdminAPI is vulnerable to a denial of service due to file system exhaustion.  IBM X-Force ID:  279972.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/279972; https://https://www.ibm.com/support/pages/node/7116046; https://exchange.xforce.ibmcloud.com/vulnerabilities/279972
CVE: CVE-2024-23639
Published: 2024-02-09
Description: Micronaut Framework is a modern, JVM-based, full stack Java framework designed for building modular, easily testable JVM applications with support for Java, Kotlin and the Groovy language. Enabled but unsecured management endpoints are susceptible to drive-by localhost attacks. While not typical of a production application, these attacks may have more impact on a development environment where such endpoints may be flipped on without much thought. A malicious/compromised website can make HTTP requests to `localhost`. Normally, such requests would trigger a CORS preflight check which would prevent the request; however, some requests are "simple" and do not require a preflight check. These endpoints, if enabled and not secured, are vulnerable to being triggered. Production environments typically disable unused endpoints and secure/restrict access to needed endpoints. A more likely victim is the developer in their local development host, who has enabled endpoints without security for the sake of easing development. This issue has been addressed in version 3.8.3. Users are advised to upgrade.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-15, CWE-610, CWE-664
References: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests; https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-583g-g682-crxf; https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests
CVE: CVE-2024-24819
Published: 2024-02-09
Description: icingaweb2-module-incubator is a working project of bleeding edge Icinga Web 2 libraries. In affected versions the class `gipfl\Web\Form` is the base for various concrete form implementations [1] and provides protection against cross site request forgery (CSRF) by default. This is done by automatically adding an element with a CSRF token to any form, unless explicitly disabled, but even if enabled, the CSRF token (sent during a client's submission of a form relying on it) is not validated. This enables attackers to perform changes on behalf of a user which, unknowingly, interacts with a prepared link or website. The version 0.22.0 is available to remedy this issue. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/Icinga/icingaweb2-module-incubator/commit/db7dc49585fee0b4e96be666d7f6009a74a1ccb5; https://github.com/Icinga/icingaweb2-module-incubator/security/advisories/GHSA-p8vv-9pqq-rm8p; https://github.com/search?q=gipfl%5CWeb%5CForm%3B&type=code
CVE: CVE-2023-43609
Published: 2024-02-09
Description: In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an unauthenticated user with network access could obtain access to sensitive information or cause a denial-of-service condition.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-863
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-030-01; https://www.emerson.com/documents/automation/security-notification-emerson-gas-chromatographs-cyber-security-notification-icsa-24-030-01-en-10103910.pdf; https://www.cisa.gov/news-events/ics-advisories/icsa-24-030-01
CVE: CVE-2023-46687
Published: 2024-02-09
Description: 


In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an unauthenticated user with network access could execute arbitrary commands in root context from a remote computer.




CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-030-01; https://www.emerson.com/documents/automation/security-notification-emerson-gas-chromatographs-cyber-security-notification-icsa-24-030-01-en-10103910.pdf; https://www.cisa.gov/news-events/ics-advisories/icsa-24-030-01
CVE: CVE-2023-49716
Published: 2024-02-09
Description: 
In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an authenticated user with network access could run arbitrary commands from a remote computer.


CVSS Score: 6.9 (MEDIUM)
CWE: CWE-77, CWE-77
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-030-01; https://www.emerson.com/documents/automation/security-notification-emerson-gas-chromatographs-cyber-security-notification-icsa-24-030-01-en-10103910.pdf; https://www.cisa.gov/news-events/ics-advisories/icsa-24-030-01
CVE: CVE-2023-51761
Published: 2024-02-09
Description: In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an unauthenticated user with network access could bypass authentication and acquire admin capabilities.
CVSS Score: 8.3 (HIGH)
CWE: CWE-863, CWE-287
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-030-01; https://www.emerson.com/documents/automation/security-notification-emerson-gas-chromatographs-cyber-security-notification-icsa-24-030-01-en-10103910.pdf; https://www.cisa.gov/news-events/ics-advisories/icsa-24-030-01
CVE: CVE-2024-0657
Published: 2024-02-09
Description: The Internal Link Juicer: SEO Auto Linker for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings such as 'ilj_settings_field_links_per_page'  in all versions up to, and including, 2.23.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3033238%40internal-links&new=3033238%40internal-links&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/41d39fe4-b114-4612-92f6-75d6597610f7?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3033238%40internal-links&new=3033238%40internal-links&sfp_email=&sfph_mail=
CVE: CVE-2024-0842
Published: 2024-02-09
Description: The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to Denial of Service in all versions up to, and including, 1.2.6. This is due to direct access of the backuply/restore_ins.php file and. This makes it possible for unauthenticated attackers to make excessive requests that result in the server running out of resources.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-834
References: https://plugins.trac.wordpress.org/changeset/3033242/backuply/trunk/restore_ins.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3036756%40backuply&new=3036756%40backuply&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/1f955d88-ab4c-4cf4-a23b-91119d412716?source=cve
CVE: CVE-2024-1122
Published: 2024-02-09
Description: The Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_data() function in all versions up to, and including, 3.3.50. This makes it possible for unauthenticated attackers to export event data.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/changeset/3033231/wp-event-solution/tags/3.3.51/core/admin/hooks.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/0cbdf679-1657-4249-a433-8fe0cddd94be?source=cve; https://plugins.trac.wordpress.org/changeset/3033231/wp-event-solution/tags/3.3.51/core/admin/hooks.php
CVE: CVE-2023-31506
Published: 2024-02-09
Description: A cross-site scripting (XSS) vulnerability in Grav versions 1.7.44 and before, allows remote authenticated attackers to execute arbitrary web scripts or HTML via the onmouseover attribute of an ISINDEX element.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://m3n0sd0n4ld.github.io/patoHackventuras/cve-2023-31506; https://m3n0sd0n4ld.github.io/patoHackventuras/cve-2023-31506
CVE: CVE-2023-39683
Published: 2024-02-09
Description: Cross Site Scripting (XSS) vulnerability in EasyEmail v.4.12.2 and before allows a local attacker to execute arbitrary code via the user input parameter(s). NOTE: Researcher claims issue is present in all versions prior and later than tested version.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/zalify/easy-email/issues/321; https://github.com/zalify/easy-email/issues/373; https://medium.com/%40vificatem/cve-2023-39683-dom-xss-on-json-source-code-panel-in-zalify-easy-email-3fa08f3e0d49
CVE: CVE-2024-0229
Published: 2024-02-09
Description: An out-of-bounds memory access flaw was found in the X.Org server. This issue can be triggered when a device frozen by a sync grab is reattached to a different master device. This issue may lead to an application crash, local privilege escalation (if the server runs with extended privileges), or remote code execution in SSH X11 forwarding environments.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://access.redhat.com/errata/RHSA-2024:0320; https://access.redhat.com/errata/RHSA-2024:0557; https://access.redhat.com/errata/RHSA-2024:0558
CVE: CVE-2024-25003
Published: 2024-02-09
Description: KiTTY versions 0.76.1.13 and before is vulnerable to a stack-based buffer overflow via the hostname, occurs due to insufficient bounds checking and input sanitization. This allows an attacker to overwrite adjacent memory, which leads to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://packetstormsecurity.com/files/177031/KiTTY-0.76.1.13-Command-Injection.html; http://packetstormsecurity.com/files/177032/KiTTY-0.76.1.13-Buffer-Overflows.html; http://seclists.org/fulldisclosure/2024/Feb/13
CVE: CVE-2024-25004
Published: 2024-02-09
Description: KiTTY versions 0.76.1.13 and before is vulnerable to a stack-based buffer overflow via the username, occurs due to insufficient bounds checking and input sanitization (at line 2600). This allows an attacker to overwrite adjacent memory, which leads to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://packetstormsecurity.com/files/177031/KiTTY-0.76.1.13-Command-Injection.html; http://packetstormsecurity.com/files/177032/KiTTY-0.76.1.13-Buffer-Overflows.html; http://seclists.org/fulldisclosure/2024/Feb/13
CVE: CVE-2023-46350
Published: 2024-02-09
Description: SQL injection vulnerability in InnovaDeluxe "Manufacturer or supplier alphabetical search" (idxrmanufacturer) module for PrestaShop versions 2.0.4 and before, allows remote attackers to escalate privileges and obtain sensitive information via the methods IdxrmanufacturerFunctions::getCornersLink, IdxrmanufacturerFunctions::getManufacturersLike and IdxrmanufacturerFunctions::getSuppliersLike.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://security.friendsofpresta.org/modules/2024/02/08/idxrmanufacturer.html; https://security.friendsofpresta.org/modules/2024/02/08/idxrmanufacturer.html
CVE: CVE-2023-50026
Published: 2024-02-09
Description: SQL injection vulnerability in Presta Monster "Multi Accessories Pro" (hsmultiaccessoriespro) module for PrestaShop versions 5.1.1 and before, allows remote attackers to escalate privileges and obtain sensitive information via the method HsAccessoriesGroupProductAbstract::getAccessoriesByIdProducts().
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://security.friendsofpresta.org/modules/2024/02/08/hsmultiaccessoriespro.html; https://security.friendsofpresta.org/modules/2024/02/08/hsmultiaccessoriespro.html
CVE: CVE-2024-23749
Published: 2024-02-09
Description: KiTTY versions 0.76.1.13 and before is vulnerable to command injection via the filename variable, occurs due to insufficient input sanitization and validation, failure to escape special characters, and insecure system calls (at lines 2369-2390). This allows an attacker to add inputs inside the filename variable, leading to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-77, CWE-77
References: http://packetstormsecurity.com/files/177031/KiTTY-0.76.1.13-Command-Injection.html; http://seclists.org/fulldisclosure/2024/Feb/13; http://seclists.org/fulldisclosure/2024/Feb/14
CVE: CVE-2024-24308
Published: 2024-02-09
Description: SQL Injection vulnerability in Boostmyshop (boostmyshopagent) module for Prestashop versions 1.1.9 and before, allows remote attackers to escalate privileges and obtain sensitive information via changeOrderCarrier.php, relayPoint.php, and shippingConfirmation.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://security.friendsofpresta.org/modules/2024/02/08/boostmyshopagent.html; https://security.friendsofpresta.org/modules/2024/02/08/boostmyshopagent.html
CVE: CVE-2023-6716
Published: 2024-02-09
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CVE RECORD. All references and descriptions in this record have been removed to prevent accidental usage.
CVE: CVE-2024-21762
Published: 2024-02-09
Description: A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7 allows attacker to execute unauthorized code or commands via specifically crafted requests
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://fortiguard.com/psirt/FG-IR-24-015; https://fortiguard.com/psirt/FG-IR-24-015; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21762
CVE: CVE-2024-22119
Published: 2024-02-09
Description: The cause of vulnerability is improper validation of form input field “Name” on Graph page in Items section.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20, CWE-79
References: https://lists.debian.org/debian-lts-announce/2024/04/msg00020.html; https://support.zabbix.com/browse/ZBX-24070; https://lists.debian.org/debian-lts-announce/2024/04/msg00020.html
CVE: CVE-2024-25674
Published: 2024-02-09
Description: An issue was discovered in MISP before 2.4.184. Organisation logo upload is insecure because of a lack of checks for the file extension and MIME type.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/MISP/MISP/commit/312d2d[PII_REDACTED]ddd211dcb6bb5bb09c07791f; https://github.com/MISP/MISP/compare/v2.4.183...v2.4.184; https://github.com/MISP/MISP/commit/312d2d[PII_REDACTED]ddd211dcb6bb5bb09c07791f
CVE: CVE-2024-25675
Published: 2024-02-09
Description: An issue was discovered in MISP before 2.4.184. A client does not need to use POST to start an export generation process. This is related to app/Controller/JobsController.php and app/View/Events/export.ctp.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-749
References: https://github.com/MISP/MISP/commit/0ac2468c2896f4be4ef9219cfe02bff164411594; https://github.com/MISP/MISP/compare/v2.4.183...v2.4.184; https://github.com/MISP/MISP/commit/0ac2468c2896f4be4ef9219cfe02bff164411594
CVE: CVE-2024-25677
Published: 2024-02-09
Description: In Min before 1.31.0, local files are not correctly treated as unique security origins, which allows them to improperly request cross-origin resources. For example, a local file may request other local files through an XML document.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://github.com/minbrowser/min/security/advisories/GHSA-4w9v-7h8h-rv8x; https://github.com/minbrowser/min/security/advisories/GHSA-4w9v-7h8h-rv8x
CVE: CVE-2024-25678
Published: 2024-02-09
Description: In LiteSpeed QUIC (LSQUIC) Library before 4.0.4, DCID validation is mishandled.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-354
References: https://github.com/litespeedtech/lsquic/commit/515f453556c99d27c4dddb5424898dc1a5537708; https://github.com/litespeedtech/lsquic/releases/tag/v4.0.4; https://www.rfc-editor.org/rfc/rfc9001
CVE: CVE-2024-25679
Published: 2024-02-09
Description: In PQUIC before 5bde5bb, retention of unused initial encryption keys allows attackers to disrupt a connection with a PSK configuration by sending a CONNECTION_CLOSE frame that is encrypted via the initial key computed. Network traffic sniffing is needed as part of exploitation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-324
References: https://github.com/p-quic/pquic/issues/35; https://github.com/p-quic/pquic/pull/39; https://www.rfc-editor.org/rfc/rfc9001#name-discarding-unused-keys
CVE: CVE-2023-6724
Published: 2024-02-09
Description: Authorization Bypass Through User-Controlled Key vulnerability in Software Engineering Consultancy Machine Equipment Limited Company Hearing Tracking System allows Authentication Abuse.This issue affects Hearing Tracking System: before for IOS 7.0, for Android Latest release 1.0.


CVSS Score: 8.8 (HIGH)
CWE: CWE-639
References: https://www.usom.gov.tr/bildirim/tr-24-0099; https://www.usom.gov.tr/bildirim/tr-24-0099
CVE: CVE-2024-25304
Published: 2024-02-09
Description: Code-projects Simple School Managment System 1.0 allows SQL Injection via the 'apass' parameter at "School/index.php."
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/tubakvgc/CVEs/blob/main/Simple%20School%20Management%20System/Simple%20School%20Managment%20System%20-%20SQL%20Injection%20-2.md; https://github.com/tubakvgc/CVEs/blob/main/Simple%20School%20Management%20System/Simple%20School%20Managment%20System%20-%20SQL%20Injection%20-2.md
CVE: CVE-2024-25305
Published: 2024-02-09
Description: Code-projects Simple School Managment System 1.0 allows Authentication Bypass via the username and password parameters at School/index.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/tubakvgc/CVEs/blob/main/Simple%20School%20Management%20System/Simple%20School%20Managment%20System%20-%20Authentication%20Bypass.md; https://github.com/tubakvgc/CVEs/blob/main/Simple%20School%20Management%20System/Simple%20School%20Managment%20System%20-%20Authentication%20Bypass.md
CVE: CVE-2024-25306
Published: 2024-02-09
Description: Code-projects Simple School Managment System 1.0 allows SQL Injection via the 'aname' parameter at "School/index.php".
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/tubakvgc/CVEs/blob/main/Simple%20School%20Management%20System/Simple%20School%20Managment%20System%20-%20SQL%20Injection%20-1.md; https://github.com/tubakvgc/CVEs/blob/main/Simple%20School%20Management%20System/Simple%20School%20Managment%20System%20-%20SQL%20Injection%20-1.md
CVE: CVE-2024-25308
Published: 2024-02-09
Description: Code-projects Simple School Managment System 1.0 allows SQL Injection via the 'name' parameter at School/teacher_login.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/tubakvgc/CVEs/blob/main/Simple%20School%20Management%20System/Simple%20School%20Managment%20System%20-%20SQL%20Injection%20-6.md; https://github.com/tubakvgc/CVEs/blob/main/Simple%20School%20Management%20System/Simple%20School%20Managment%20System%20-%20SQL%20Injection%20-6.md
CVE: CVE-2024-25309
Published: 2024-02-09
Description: Code-projects Simple School Managment System 1.0 allows SQL Injection via the 'pass' parameter at School/teacher_login.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/tubakvgc/CVEs/blob/main/Simple%20School%20Management%20System/Simple%20School%20Managment%20System%20-%20SQL%20Injection%20-7.md; https://github.com/tubakvgc/CVEs/blob/main/Simple%20School%20Management%20System/Simple%20School%20Managment%20System%20-%20SQL%20Injection%20-7.md
CVE: CVE-2024-25312
Published: 2024-02-09
Description: Code-projects Simple School Managment System 1.0 allows SQL Injection via the 'id' parameter at "School/sub_delete.php?id=5."
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/tubakvgc/CVEs/blob/main/Simple%20School%20Management%20System/Simple%20School%20Managment%20System%20-%20SQL%20Injection%20-5.md; https://github.com/tubakvgc/CVEs/blob/main/Simple%20School%20Management%20System/Simple%20School%20Managment%20System%20-%20SQL%20Injection%20-5.md
CVE: CVE-2024-25313
Published: 2024-02-09
Description: Code-projects Simple School Managment System 1.0 allows Authentication Bypass via the username and password parameters at School/teacher_login.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287, CWE-287
References: https://github.com/tubakvgc/CVEs/blob/main/Simple%20School%20Management%20System/Simple%20School%20Managment%20System%20-%20Authentication%20Bypass%20-%202.md; https://github.com/tubakvgc/CVEs/blob/main/Simple%20School%20Management%20System/Simple%20School%20Managment%20System%20-%20Authentication%20Bypass%20-%202.md