deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-13262
Published: 2025-11-17
Description: A vulnerability was determined in lsfusion platform up to 6.1. Affected by this vulnerability is the function UploadFileRequestHandler of the file platform/web-client/src/main/java/lsfusion/http/controller/file/UploadFileRequestHandler.java. Executing manipulation of the argument sid can lead to path traversal. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 7.3 (HIGH)
CWE: CWE-22
References: https://github.com/lsfusion/platform/issues/1544; https://github.com/lsfusion/platform/issues/1544#issue[PII_REDACTED]; https://vuldb.com/?ctiid.332597
CVE: CVE-2025-13263
Published: 2025-11-17
Description: A vulnerability was identified in SourceCodester Online Magazine Management System 1.0. Affected by this issue is some unknown functionality of the file /categories.php. The manipulation of the argument c leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/0xffaaa/cve/blob/main/Online%20Magazine%20Management%20System%20SQL%20blind%20injection(SQLI).md; https://vuldb.com/?ctiid.332598; https://vuldb.com/?id.332598
CVE: CVE-2025-13264
Published: 2025-11-17
Description: A security flaw has been discovered in SourceCodester Online Magazine Management System 1.0. This affects an unknown part of the file /view_magazine.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be exploited.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/0xffaaa/cve/blob/main/Online%20Magazine%20Management%20System%20SQL%20blind%20injection2(SQLI)%20.md; https://vuldb.com/?ctiid.332599; https://vuldb.com/?id.332599
CVE: CVE-2025-13265
Published: 2025-11-17
Description: A weakness has been identified in lsfusion platform up to 6.1. This vulnerability affects the function unpackFile of the file server/src/main/java/lsfusion/server/physics/dev/integration/external/to/file/ZipUtils.java. This manipulation causes path traversal. It is possible to initiate the attack remotely.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/lsfusion/platform/issues/1545; https://vuldb.com/?ctiid.332600; https://vuldb.com/?id.332600
CVE: CVE-2025-13266
Published: 2025-11-17
Description: A security vulnerability has been detected in wwwlike vlife up to 2.0.1. This issue affects the function create of the file vlife-base/src/main/java/cn/wwwlike/sys/api/SysFileApi.java of the component VLifeApi. Such manipulation of the argument fileName leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/wwwlike/vlife/issues/3; https://vuldb.com/?ctiid.332601; https://vuldb.com/?id.332601
CVE: CVE-2025-60022
Published: 2025-11-17
Description: Improper certificate validation vulnerability exists in 'デジラアプリ' App for iOS prior to ver.80.10.00. If this vulnerability is exploited, a man-in-the-middle attack may allow an attacker to eavesdrop on and/or tamper with an encrypted communication.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-295
References: https://jvn.jp/en/jp/JVN54005037/
CVE: CVE-2025-9501
Published: 2025-11-17
Description: The W3 Total Cache WordPress plugin before 2.8.13 is vulnerable to command injection via the _parse_dynamic_mfunc function, allowing unauthenticated users to execute PHP commands by submitting a comment with a malicious payload to a post.
CVSS Score: 9.0 (CRITICAL)
References: https://wpscan.com/vulnerability/6697a2c9-63ae-42f0-8931-f2e5d67d45ae/
CVE: CVE-2025-13163
Published: 2025-11-17
Description: EasyFlow GP developed by Digiwin has an Insufficiently Protected Credentials vulnerability, allowing privileged remote attackers to obtain plaintext database account credentials from the system frontend.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-522
References: https://www.twcert.org.tw/en/cp-139-10504-23f4c-2.html; https://www.twcert.org.tw/tw/cp-132-10503-a66fe-1.html
CVE: CVE-2025-13164
Published: 2025-11-17
Description: EasyFlow GP developed by Digiwin has an Insufficiently Protected Credentials vulnerability, allowing privileged remote attackers to obtain plaintext credentials of AD and system mail from the system frontend.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-522
References: https://www.twcert.org.tw/en/cp-139-10504-23f4c-2.html; https://www.twcert.org.tw/tw/cp-132-10503-a66fe-1.html
CVE: CVE-2025-13165
Published: 2025-11-17
Description: EasyFlow GP developed by Digiwin has a Denial of service vulnerability, allowing unauthenticated remote attackers to send specific requests that result in denial of web service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://www.twcert.org.tw/en/cp-139-10504-23f4c-2.html; https://www.twcert.org.tw/tw/cp-132-10503-a66fe-1.html
CVE: CVE-2025-13267
Published: 2025-11-17
Description: A vulnerability was detected in SourceCodester Dental Clinic Appointment Reservation System 1.0. Impacted is an unknown function of the file /success.php. Performing manipulation of the argument username/password results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/0xffaaa/cve/blob/main/Dental_Clinic_Appointment_Reservation_System_Time-Based_SQL_Injection2.md; https://vuldb.com/?ctiid.332602; https://vuldb.com/?id.332602
CVE: CVE-2025-13268
Published: 2025-11-17
Description: A flaw has been found in Dromara dataCompare up to 1.0.1. The affected element is the function DbConfig of the file src/main/java/com/vince/xq/project/system/dbconfig/service/DbconfigServiceImpl.java of the component JDBC URL Handler. Executing manipulation can lead to injection. The attack can be launched remotely. The exploit has been published and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-707
References: https://github.com/dromara/dataCompare/issues/13; https://vuldb.com/?ctiid.332603; https://vuldb.com/?id.332603
CVE: CVE-2025-13269
Published: 2025-11-17
Description: A vulnerability has been found in Campcodes School Fees Payment Management System 1.0. The impacted element is an unknown function of the file /ajax.php?action=save_payment. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/ASantsSec/CVE/issues/17; https://vuldb.com/?ctiid.332604; https://vuldb.com/?id.332604
CVE: CVE-2025-13270
Published: 2025-11-17
Description: A vulnerability was found in Campcodes School Fees Payment Management System 1.0. This affects an unknown function of the file /ajax.php?action=save_course. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/ASantsSec/CVE/issues/16; https://vuldb.com/?ctiid.332605; https://vuldb.com/?id.332605
CVE: CVE-2025-65073
Published: 2025-11-17
Description: OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Keystone authorization.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://www.openwall.com/lists/oss-security/2025/11/04/2; http://www.openwall.com/lists/oss-security/2025/11/17/6
CVE: CVE-2025-13271
Published: 2025-11-17
Description: A vulnerability was determined in Campcodes School Fees Payment Management System 1.0. This impacts an unknown function of the file /ajax.php?action=login. This manipulation of the argument Username causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/ASantsSec/CVE/issues/18; https://vuldb.com/?ctiid.332606; https://vuldb.com/?id.332606
CVE: CVE-2025-13272
Published: 2025-11-17
Description: A vulnerability was identified in Campcodes School Fees Payment Management System 1.0. Affected is an unknown function of the file /manage_course.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/ASantsSec/CVE/issues/19; https://vuldb.com/?ctiid.332607; https://vuldb.com/?id.332607
CVE: CVE-2025-13273
Published: 2025-11-17
Description: A security flaw has been discovered in Campcodes School Fees Payment Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=delete_payment. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/ASantsSec/CVE/issues/20; https://vuldb.com/?ctiid.332608; https://vuldb.com/?id.332608
CVE: CVE-2025-13274
Published: 2025-11-17
Description: A weakness has been identified in Campcodes School Fees Payment Management System 1.0. Affected by this issue is some unknown functionality of the file /ajax.php?action=delete_fees. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/ASantsSec/CVE/issues/21; https://vuldb.com/?ctiid.332609; https://vuldb.com/?id.332609
CVE: CVE-2025-13275
Published: 2025-11-17
Description: A security vulnerability has been detected in Iqbolshoh php-business-website up to 10677743a8dfc281f85291a27cf63a0bce043c24. This affects an unknown part of the file /admin/about.php. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://github.com/mhszed/Report/blob/main/php-business-website%20upload.docx; https://vuldb.com/?ctiid.332610; https://vuldb.com/?id.332610
CVE: CVE-2025-13276
Published: 2025-11-17
Description: A vulnerability was detected in g33kyrash Online-Banking-System up to 12dbfa690e5af649fb72d2e5d3674e88d6743455. This vulnerability affects unknown code of the file /index.php. The manipulation of the argument Username results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/Nianalb/Report_Online-Banking-System/blob/main/SQL.docx; https://vuldb.com/?ctiid.332611; https://vuldb.com/?id.332611
CVE: CVE-2025-11681
Published: 2025-11-17
Description: Denial-of-service condition in M-Files Server versions before 25.11.15392.1, before 25.2 LTS SR2 and before 25.8 LTS SR2 allows an authenticated user to cause the MFserver process to crash.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://empower.m-files.com/security-advisories/CVE-2025-11681; https://product.m-files.com/security-advisories/cve-2025-11681/
CVE: CVE-2025-13277
Published: 2025-11-17
Description: A flaw has been found in code-projects Nero Social Networking Site 1.0. This issue affects some unknown processing of the file /friendsphoto.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/daojian1/Nero-Social-Networking-Site-V1.0_004; https://vuldb.com/?ctiid.332612
CVE: CVE-2025-40834
Published: 2025-11-17
Description: A vulnerability has been identified in Mendix RichText (All versions >= V4.0.0 < V4.6.1). Affected widget does not properly neutralize the input. This could allow an attacker to execute cross-site scripting attacks.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-79
References: https://cert-portal.siemens.com/productcert/html/ssa-190588.html
CVE: CVE-2025-40936
Published: 2025-11-17
Description: A vulnerability has been identified in PS/IGES Parasolid Translator Component (All versions < V29.0.258), Solid Edge (All versions < V226.00 Update 03). The affected applications contains an out of bounds read vulnerability while parsing specially crafted IGS files. This could allow an attacker to crash the application or execute code in the context of the current process. (ZDI-CAN-26755)
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/html/ssa-241605.html; https://cert-portal.siemens.com/productcert/html/ssa-445819.html
CVE: CVE-2025-13278
Published: 2025-11-17
Description: A vulnerability has been found in projectworlds Advanced Library Management System 1.0. Impacted is an unknown function of the file /borrowed_book_search.php. Such manipulation of the argument datefrom/dateto leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/CH0ico/CVE_choco_1/blob/master/report.md; https://vuldb.com/?ctiid.332613; https://vuldb.com/?id.332613
CVE: CVE-2025-13279
Published: 2025-11-17
Description: A vulnerability was found in code-projects Nero Social Networking Site 1.0. The affected element is an unknown function of the file /profilefriends.php. Performing manipulation of the argument ID results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/daojian1/Nero-Social-Networking-Site-V1.0_005; https://github.com/daojian1/Nero-Social-Networking-Site-V1.0_005/blob/main/report.md
CVE: CVE-2025-13280
Published: 2025-11-17
Description: A vulnerability was determined in CodeAstro Simple Inventory System 1.0. The impacted element is an unknown function of the file /index.php of the component Login. Executing a manipulation of the argument Username can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://codeastro.com/; https://github.com/umu123456/cvesimpleInventorysystem/issues/1; https://vuldb.com/?ctiid.332615
CVE: CVE-2025-13285
Published: 2025-11-17
Description: A vulnerability was identified in itsourcecode Online Voting System 1.0. The affected element is an unknown function of the file /login.php. Such manipulation of the argument Username leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/WANGshuyan2025/cve/issues/6; https://itsourcecode.com/; https://vuldb.com/?ctiid.332625
CVE: CVE-2025-13286
Published: 2025-11-17
Description: A security flaw has been discovered in itsourcecode Online Voting System 1.0. The impacted element is an unknown function of the file /ajax.php?action=save_user. Performing manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/WANGshuyan2025/cve/issues/8; https://itsourcecode.com/; https://vuldb.com/?ctiid.332626
CVE: CVE-2025-13287
Published: 2025-11-17
Description: A weakness has been identified in itsourcecode Online Voting System 1.0. This affects an unknown function of the file /index.php?page=categories. Executing manipulation of the argument id/category can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/WANGshuyan2025/cve/issues/9; https://itsourcecode.com/; https://vuldb.com/?ctiid.332627
CVE: CVE-2025-13310
Published: 2025-11-17
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2025-4321
Published: 2025-11-17
Description: In a Bluetooth device, using RS9116-WiseConnect SDK experiences a Denial of Service, if it receives malformed L2CAP packets, only hard reset will bring the device to normal operation
CWE: CWE-240, CWE-617
References: https://community.silabs.com/068Vm00000YV9DL
CVE: CVE-2025-13288
Published: 2025-11-17
Description: A security vulnerability has been detected in Tenda CH22 1.0.0.1. This impacts the function fromPptpUserSetting of the file /goform/PPTPUserSetting. The manipulation of the argument delno leads to buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/yyyy1g/CVE/issues/1; https://vuldb.com/?ctiid.332628; https://vuldb.com/?id.332628
CVE: CVE-2025-13289
Published: 2025-11-17
Description: A vulnerability was detected in 1000projects Design & Development of Student Database Management System 1.0. Affected is an unknown function of the file /TeacherLogin/Academics/SubjectDetails.php. The manipulation of the argument SubCode results in sql injection. The attack may be performed from remote. The exploit is now public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/f14g-orz/CVE/issues/2; https://vuldb.com/?ctiid.332629; https://vuldb.com/?id.332629
CVE: CVE-2025-63708
Published: 2025-11-17
Description: Cross-Site Scripting (XSS) vulnerability exists in SourceCodester AI Font Matcher (nid=18425, 2025-10-10) that allows remote attackers to execute arbitrary JavaScript in victims' browsers. The vulnerability occurs in the webfonts API handling mechanism where font family names are not properly sanitized. An attacker can intercept fetch requests to the webfonts endpoint and inject malicious JavaScript payloads through font family names, resulting in session cookie theft, account hijacking, and unauthorized actions performed on behalf of authenticated users. The vulnerability can be exploited by injecting a fetch hook that returns controlled font data containing malicious scripts.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/DylanDavis1/CVE-2025-64708; https://www.sourcecodester.com/javascript/18425/ai-font-matcher-using-html-css-and-javascript-source-code.html; https://github.com/DylanDavis1/CVE-2025-64708
CVE: CVE-2025-63747
Published: 2025-11-17
Description: QaTraq 6.9.2 ships with administrative account credentials which are enabled in default installations and permit immediate login via the web application login page. Because the account provides administrative privileges in the default configuration, an attacker who can reach the login page can gain administrative access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-521
References: http://qatraq.com; https://bitsbyamg.com/blog/post/2025/10/19/qatraq-692-default-creds-and-file-upload-rce
CVE: CVE-2025-63748
Published: 2025-11-17
Description: QaTraq 6.9.2 allows authenticated users to upload arbitrary files via the "Add Attachment" feature in the "Test Script" module. The application fails to restrict file types, enabling the upload of executable PHP files. Once uploaded, the file can be accessed through the "View Attachment" option, which executes the PHP payload on the server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://qatraq.com; https://bitsbyamg.com/blog/post/2025/10/19/qatraq-692-default-creds-and-file-upload-rce
CVE: CVE-2025-63916
Published: 2025-11-17
Description: MyScreenTools v2.2.1.0 contains a critical OS command injection vulnerability in the GIF compression tool. The application fails to properly sanitize user-supplied file paths before passing them to cmd.exe, allowing attackers to execute arbitrary system commands with the privileges of the user running the application. The vulnerability exists in the CMD() function within GIFSicleTool\Form_gif_sicle_tool.cs, which constructs shell commands by concatenating unsanitized user input (file paths) and executes them via cmd.exe.
CVSS Score: 8.1 (HIGH)
CWE: CWE-78
References: https://github.com/cydtseng/Vulnerability-Research/blob/main/myscreentools/OSCommandInjection-GifCompression.md; https://github.com/luotengyuan/MyScreenTools/blob/master/GIFSicleTool/Form_gif_sicle_tool.cs; https://github.com/luotengyuan/MyScreenTools/tree/master
CVE: CVE-2025-64046
Published: 2025-11-17
Description: OpenRapid RapidCMS 1.3.1 is vulnerable to Cross Site Scripting (XSS) in /system/update-run.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://rapidcms.com; https://gist.github.com/b1uel0n3/c8467f156f523fcf16dc572a34693126
CVE: CVE-2025-65083
Published: 2025-11-17
Description: GoSign Desktop through 2.4.1 disables TLS certificate validation when configured to use a proxy server. This can be problematic if the GoSign Desktop user selects an arbitrary proxy server without consideration of whether outbound HTTPS connections from the proxy server to Internet servers succeed even for untrusted or invalid server certificates. In this scenario (which is outside of the product's design objectives), integrity protection could be bypassed. In typical cases of a proxy server for outbound HTTPS traffic from an enterprise, those connections would not succeed. (Admittedly, the usual expectation is that a client application is configured to trust an enterprise CA and does not set SSL_VERIFY_NONE.) Also, it is of course unsafe to place ~/.gosign in the home directory of an untrusted user and then have other users execute downloaded files.
CVSS Score: 3.2 (LOW)
CWE: CWE-295
References: https://securityaffairs.com/184672/hacking/multiple-vulnerabilities-in-gosign-desktop-lead-to-remote-code-execution.html; https://www.firma.infocert.it/prodotti/gosign
CVE: CVE-2024-44641
Published: 2025-11-17
Description: PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via the oldpass parameter in change-password.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/leexsoyoung/CVEs/blob/main/CVE-2024-44641.md; https://phpgurukul.com/small-crm-php/
CVE: CVE-2024-44644
Published: 2025-11-17
Description: PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via the frm_id and aremark parameters in manage-tickets.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/leexsoyoung/CVEs/blob/main/CVE-2024-44644.md; https://phpgurukul.com/small-crm-php/
CVE: CVE-2024-44647
Published: 2025-11-17
Description: PHPGurukul Small CRM 3.0 is vulnerable to Cross Site Scripting (XSS) via the aremark parameter in manage-tickets.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/leexsoyoung/CVEs/blob/main/CVE-2024-44647.md; https://phpgurukul.com/small-crm-php/
CVE: CVE-2024-44648
Published: 2025-11-17
Description: PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via id and adminremark parameters in quote-details.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/leexsoyoung/CVEs/blob/main/CVE-2024-44648.md; https://phpgurukul.com/small-crm-php/