deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-28896
Published: 2023-12-01
Description: Access to critical Unified Diagnostics Services (UDS) of the Modular Infotainment Platform 3 (MIB3) infotainment is transmitted via Controller Area Network (CAN) bus in a form that can be easily decoded by attackers with physical access to the vehicle.

Vulnerability discovered on Škoda Superb III (3V3) - 2.0 TDI manufactured in 2022.


CVSS Score: 3.3 (LOW)
CWE: CWE-261, CWE-326
References: https://asrg.io/security-advisories/cve-2023-28896/; https://asrg.io/security-advisories/cve-2023-28896/
CVE: CVE-2023-5634
Published: 2023-12-01
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ArslanSoft Education Portal allows SQL Injection.This issue affects Education Portal: before v1.1.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0670; https://www.usom.gov.tr/bildirim/tr-23-0670
CVE: CVE-2023-5635
Published: 2023-12-01
Description: Improper Protection for Outbound Error Messages and Alert Signals vulnerability in ArslanSoft Education Portal allows Account Footprinting.This issue affects Education Portal: before v1.1.


CVSS Score: 7.5 (HIGH)
CWE: CWE-1320
References: https://www.usom.gov.tr/bildirim/tr-23-0670; https://www.usom.gov.tr/bildirim/tr-23-0670
CVE: CVE-2023-5636
Published: 2023-12-01
Description: Unrestricted Upload of File with Dangerous Type vulnerability in ArslanSoft Education Portal allows Command Injection.This issue affects Education Portal: before v1.1.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.usom.gov.tr/bildirim/tr-23-0670; https://www.usom.gov.tr/bildirim/tr-23-0670
CVE: CVE-2023-5637
Published: 2023-12-01
Description: Unrestricted Upload of File with Dangerous Type vulnerability in ArslanSoft Education Portal allows Read Sensitive Strings Within an Executable.This issue affects Education Portal: before v1.1.


CVSS Score: 7.5 (HIGH)
CWE: CWE-434
References: https://www.usom.gov.tr/bildirim/tr-23-0670; https://www.usom.gov.tr/bildirim/tr-23-0670
CVE: CVE-2023-6461
Published: 2023-12-01
Description: Cross-site Scripting (XSS) - Reflected in GitHub repository viliusle/minipaint prior to 4.14.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/viliusle/minipaint/commit/f22cb46515c91b1071d48fff3e6c9b92c9b3878c; https://huntr.com/bounties/9a97d163-1738-4a09-b284-a04716e69dd0; https://github.com/viliusle/minipaint/commit/f22cb46515c91b1071d48fff3e6c9b92c9b3878c
CVE: CVE-2023-45168
Published: 2023-12-01
Description: IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout command to execute arbitrary commands.  IBM X-Force ID:  267966.
CVSS Score: 8.4 (HIGH)
CWE: CWE-119
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/267966; https://www.ibm.com/support/pages/node/7086090; https://exchange.xforce.ibmcloud.com/vulnerabilities/267966
CVE: CVE-2023-49371
Published: 2023-12-01
Description: RuoYi up to v4.6 was discovered to contain a SQL injection vulnerability via /system/dept/edit.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/Maverickfir/53405b944b2830b43a84abf4b1734847; https://github.com/Maverickfir/RuoYi-v4.6-vulnerability/blob/main/Ruoyiv4.6.md; https://gist.github.com/Maverickfir/53405b944b2830b43a84abf4b1734847
CVE: CVE-2023-4518
Published: 2023-12-01
Description: A vulnerability exists in the input validation of the GOOSE 
messages where out of range values received and processed 
by the IED caused a reboot of the device. In order for an 
attacker to exploit the vulnerability, goose receiving blocks need 
to be configured.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1284, CWE-1284
References: https://publisher.hitachienergy.com/preview?DocumentId=8DBD000170&languageCode=en&Preview=true; https://publisher.hitachienergy.com/preview?DocumentId=8DBD000170&languageCode=en&Preview=true
CVE: CVE-2023-48813
Published: 2023-12-01
Description: Senayan Library Management Systems (Slims) 9 Bulian v9.6.1 is vulnerable to SQL Injection via admin/modules/reporting/customs/fines_report.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/komangsughosa/CVE-ID-not-yet/blob/main/slims/slims9_bulian-9.6.1-SQLI-fines_report.md; https://github.com/slims/slims9_bulian/issues/217; https://github.com/komangsughosa/CVE-ID-not-yet/blob/main/slims/slims9_bulian-9.6.1-SQLI-fines_report.md
CVE: CVE-2023-48842
Published: 2023-12-01
Description: D-Link Go-RT-AC750 revA_v101b03 was discovered to contain a command injection vulnerability via the service parameter at hedwig.cgi.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-78
References: https://drive.google.com/file/d/1y5om__f2SAhNmcPqDxC_SRTvJVAWwPcH/view?usp=drive_link; https://drive.google.com/file/d/1y5om__f2SAhNmcPqDxC_SRTvJVAWwPcH/view?usp=drive_link
CVE: CVE-2023-48893
Published: 2023-12-01
Description: SLiMS (aka SENAYAN Library Management System) through 9.6.1 allows admin/modules/reporting/customs/staff_act.php SQL Injection via startDate or untilDate.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/Vuln0wned/slims_owned/blob/main/slims/slims9-bulian-9.6.1-SQLI-staff_act.md; https://github.com/slims/slims9_bulian/issues/209; https://github.com/Vuln0wned/slims_owned/blob/main/slims/slims9-bulian-9.6.1-SQLI-staff_act.md
CVE: CVE-2023-42006
Published: 2023-12-01
Description: IBM Administration Runtime Expert for i 7.2, 7.3, 7.4, and 7.5 could allow a local user to obtain sensitive information caused by improper authority checks.  IBM X-Force ID:  265266.
CVSS Score: 8.4 (HIGH)
CWE: CWE-863
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/265266; https://www.ibm.com/support/pages/node/7085891; https://exchange.xforce.ibmcloud.com/vulnerabilities/265266
CVE: CVE-2023-26024
Published: 2023-12-01
Description: IBM Planning Analytics on Cloud Pak for Data 4.0 could allow an attacker on a shared network to obtain sensitive information caused by insecure network communication.  IBM X-Force ID:  247898.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/247898; https://https://www.ibm.com/support/pages/node/7082784; https://www.ibm.com/support/pages/node/7082784
CVE: CVE-2023-38268
Published: 2023-12-01
Description: IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.  IBM X-Force ID:  260585.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/260585; https://www.ibm.com/support/pages/node/7067682; https://exchange.xforce.ibmcloud.com/vulnerabilities/260585
CVE: CVE-2023-43015
Published: 2023-12-01
Description: IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  266064.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/266064; https://www.ibm.com/support/pages/node/7067704; https://exchange.xforce.ibmcloud.com/vulnerabilities/266064
CVE: CVE-2023-40699
Published: 2023-12-01
Description: 


IBM InfoSphere Information Server 11.7 could allow a remote attacker to cause a denial of service due to improper input validation.  IBM X-Force ID:  265161.




CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/265161; https://www.ibm.com/support/pages/node/7067714; https://exchange.xforce.ibmcloud.com/vulnerabilities/265161
CVE: CVE-2023-42009
Published: 2023-12-01
Description: IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  265504.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/265504; https://https://www.ibm.com/support/pages/node/7070755; https://exchange.xforce.ibmcloud.com/vulnerabilities/265504
CVE: CVE-2023-42019
Published: 2023-12-01
Description: 


IBM InfoSphere Information Server 11.7 could allow a remote attacker to cause a denial of service due to improper input validation.  IBM X-Force ID:  265161.




CVSS Score: 5.9 (MEDIUM)
CWE: CWE-311
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/265569; https://www.ibm.com/support/pages/node/7067719; https://exchange.xforce.ibmcloud.com/vulnerabilities/265569
CVE: CVE-2023-42022
Published: 2023-12-01
Description: 


IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 265938.




CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/265938; https://www.ibm.com/support/pages/node/7074335; https://exchange.xforce.ibmcloud.com/vulnerabilities/265938
CVE: CVE-2023-43021
Published: 2023-12-01
Description: 
IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 266167.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/266167; https://www.ibm.com/support/pages/node/7074317; https://exchange.xforce.ibmcloud.com/vulnerabilities/266167
CVE: CVE-2023-46174
Published: 2023-12-01
Description: 


IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  269506.




CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/269506; https://www.ibm.com/support/pages/node/7067717; https://exchange.xforce.ibmcloud.com/vulnerabilities/269506
CVE: CVE-2023-49277
Published: 2023-12-01
Description: dpaste is an open source pastebin application written in Python using the Django framework. A security vulnerability has been identified in the expires parameter of the dpaste API, allowing for a POST Reflected XSS attack. This vulnerability can be exploited by an attacker to execute arbitrary JavaScript code in the context of a user's browser, potentially leading to unauthorized access, data theft, or other malicious activities. Users are strongly advised to upgrade to dpaste release v3.8 or later versions, as dpaste versions older than v3.8 are susceptible to the identified security vulnerability. No known workarounds have been identified, and applying the patch is the most effective way to remediate the vulnerability.
CVSS Score: 8.3 (HIGH)
CWE: CWE-79
References: https://github.com/DarrenOfficial/dpaste/commit/44a666a79b3b29ed4f340600bfcf55113bfb7086; https://github.com/DarrenOfficial/dpaste/security/advisories/GHSA-r8j9-5cj7-cv39; https://github.com/DarrenOfficial/dpaste/commit/44a666a79b3b29ed4f340600bfcf55113bfb7086
CVE: CVE-2023-44381
Published: 2023-12-01
Description: October is a Content Management System (CMS) and web platform to assist with development workflow. An authenticated backend user with the `editor.cms_pages`, `editor.cms_layouts`, or `editor.cms_partials` permissions who would normally not be permitted to provide PHP code to be executed by the CMS due to `cms.safe_mode` being enabled can craft a special request to include PHP code in the CMS template. This issue has been patched in version 3.4.15.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-94
References: https://github.com/octobercms/october/security/advisories/GHSA-q22j-5r3g-9hmh; https://github.com/octobercms/october/security/advisories/GHSA-q22j-5r3g-9hmh
CVE: CVE-2023-44382
Published: 2023-12-01
Description: October is a Content Management System (CMS) and web platform to assist with development workflow. An authenticated backend user with the `editor.cms_pages`, `editor.cms_layouts`, or `editor.cms_partials` permissions who would normally not be permitted to provide PHP code to be executed by the CMS due to `cms.safe_mode` being enabled can write specific Twig code to escape the Twig sandbox and execute arbitrary PHP. This issue has been patched in 3.4.15.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-94
References: https://github.com/octobercms/october/security/advisories/GHSA-p8q3-h652-65vx; https://github.com/octobercms/october/security/advisories/GHSA-p8q3-h652-65vx
CVE: CVE-2023-44402
Published: 2023-12-01
Description: Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. This only impacts apps that have the `embeddedAsarIntegrityValidation` and `onlyLoadAppFromAsar` fuses enabled.  Apps without these fuses enabled are not impacted.  This issue is specific to macOS as these fuses are only currently supported on macOS. Specifically this issue can only be exploited if your app is launched from a filesystem the attacker has write access too.  i.e. the ability to edit files inside the `.app` bundle on macOS which these fuses are supposed to protect against. There are no app side workarounds, you must update to a patched version of Electron.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-345
References: https://github.com/electron/electron/pull/39788; https://github.com/electron/electron/security/advisories/GHSA-7m48-wc93-9g85; https://www.electronjs.org/docs/latest/tutorial/fuses
CVE: CVE-2023-46746
Published: 2023-12-01
Description: PostHog provides open-source product analytics, session recording, feature flagging and A/B testing that you can self-host. A server-side request forgery (SSRF), which can only be exploited by authenticated users, was found in Posthog. Posthog did not verify whether a URL was local when enabling webhooks, allowing authenticated users to forge a POST request. This vulnerability has been addressed in `22bd5942` and will be included in subsequent releases. There are no known workarounds for this vulnerability.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-918
References: https://github.com/PostHog/posthog/commit/22bd5942638d5d9bc4bd603a9bfe8f8a95572292; https://github.com/PostHog/posthog/security/advisories/GHSA-wqqw-r8c5-j67c; https://securitylab.github.com/advisories/GHSL-2023-185_posthog_posthog/
CVE: CVE-2023-48314
Published: 2023-12-01
Description: Collabora Online is a collaborative online office suite based on LibreOffice technology. Users of Nextcloud with Collabora Online Built-in CODE Server app can be vulnerable to attack via proxy.php. This vulnerability has been fixed in Collabora Online - Built-in CODE Server (richdocumentscode) release 23.5.403. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://github.com/CollaboraOnline/online/security/advisories/GHSA-qjrm-q4h5-v3r2; https://github.com/CollaboraOnline/online/security/advisories/GHSA-qjrm-q4h5-v3r2
CVE: CVE-2023-49276
Published: 2023-12-01
Description: Uptime Kuma is an open source self-hosted monitoring tool. In affected versions the Google Analytics element in vulnerable to Attribute Injection leading to Cross-Site-Scripting (XSS). Since the custom status interface can set an independent Google Analytics ID and the template has not been sanitized, there is an attribute injection vulnerability here, which can lead to XSS attacks. This vulnerability has been addressed in commit `f28dccf4e` which is included in release version 1.23.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/louislam/uptime-kuma/commit/f28dccf4e11f041564293e4f407e69ab9ee2277f; https://github.com/louislam/uptime-kuma/security/advisories/GHSA-v4v2-8h88-65qj; https://github.com/louislam/uptime-kuma/commit/f28dccf4e11f041564293e4f407e69ab9ee2277f
CVE: CVE-2023-49281
Published: 2023-12-01
Description: Calendarinho is an open source calendaring application to manage large teams of consultants. An Open Redirect issue occurs when a web application redirects users to external URLs without proper validation. This can lead to phishing attacks, where users are tricked into visiting malicious sites, potentially leading to information theft and reputational damage to the website used for redirection. The problem is has been patched in commit `15b2393`. Users are advised to update to a commit after `15b2393`. There are no known workarounds for this vulnerability. 
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://github.com/Cainor/Calendarinho/commit/15b2393efd69101727d27a4e710880ce46e84d70; https://github.com/Cainor/Calendarinho/commit/9a0174bef939565a76cbe7762996ecddca9ba55e; https://github.com/Cainor/Calendarinho/commit/c77defeb0103c1f7a4709799b8751aaeb0d09eed
CVE: CVE-2023-6462
Published: 2023-12-01
Description: A vulnerability, which was classified as problematic, was found in SourceCodester User Registration and Login System 1.0. Affected is an unknown function of the file /endpoint/delete-user.php. The manipulation of the argument user leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-246612.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/qqisee/vulndis/blob/main/xss_delete_user.md; https://vuldb.com/?ctiid.246612; https://vuldb.com/?id.246612
CVE: CVE-2023-48801
Published: 2023-12-01
Description: In TOTOLINK X6000R_Firmware V9.4.0cu.852_B20230719, the shttpd file sub_415534 function obtains fields from the front-end, connects them through the snprintf function, and passes them to the CsteSystem function, resulting in a command execution vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://palm-jump-676.notion.site/CVE-2023-48801-40d4553fc7a649fe833201fcecf76f2b; https://www.notion.so/X6000R-sub_415534-40d4553fc7a649fe833201fcecf76f2b?pvs=4; https://palm-jump-676.notion.site/CVE-2023-48801-40d4553fc7a649fe833201fcecf76f2b
CVE: CVE-2023-48886
Published: 2023-12-01
Description: A deserialization vulnerability in NettyRpc v1.2 allows attackers to execute arbitrary commands via sending a crafted RPC request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://github.com/luxiaoxun/NettyRpc; https://github.com/luxiaoxun/NettyRpc/issues/53; https://github.com/luxiaoxun/NettyRpc
CVE: CVE-2023-48887
Published: 2023-12-01
Description: A deserialization vulnerability in Jupiter v1.3.1 allows attackers to execute arbitrary commands via sending a crafted RPC request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/fengjiachun/Jupiter; https://github.com/fengjiachun/Jupiter/issues/115; https://github.com/welk1n/JNDI-Injection-Exploit/releases/tag/v1.0
CVE: CVE-2023-6463
Published: 2023-12-01
Description: A vulnerability has been found in SourceCodester User Registration and Login System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /endpoint/add-user.php. The manipulation of the argument first_name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-246613 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/qqisee/vulndis/blob/main/xss_add_user.md; https://vuldb.com/?ctiid.246613; https://vuldb.com/?id.246613
CVE: CVE-2023-49914
Published: 2023-12-02
Description: InteraXon Muse 2 devices allow remote attackers to cause a denial of service (incorrect Muse App report of an outstanding, calm meditation state) via a 480 MHz RF carrier that is modulated by a "false" brain wave, aka a Brain-Hack attack. For example, the Muse App does not display the reception of a strong RF carrier, and alert the user that a report may be misleading if this carrier has been modulated by a low-frequency signal.
CVSS Score: 6.5 (MEDIUM)
References: https://dl.acm.org/doi/10.1145/3[PII_REDACTED]497; https://scholar.google.com/citations?view_op=view_citation&hl=en&user=8hu27apy8A4C&citation_for_view=8hu27apy8A4C:Se3iqnhoufwC; https://dl.acm.org/doi/10.1145/3[PII_REDACTED]497
CVE: CVE-2023-39256
Published: 2023-12-02
Description: 
Dell Rugged Control Center, version prior to 4.7, contains an improper access control vulnerability. A local malicious standard user could potentially exploit this vulnerability to modify the content in an unsecured folder during product installation and upgrade, leading to privilege escalation on the system.


CVSS Score: 7.3 (HIGH)
CWE: CWE-284
References: https://www.dell.com/support/kbdoc/en-us/000217705/dsa-2023-340; https://www.dell.com/support/kbdoc/en-us/000217705/dsa-2023-340
CVE: CVE-2023-39257
Published: 2023-12-02
Description: 
Dell Rugged Control Center, version prior to 4.7, contains an Improper Access Control vulnerability. A local malicious standard user could potentially exploit this vulnerability to modify the content in an unsecured folder when product installation repair is performed, leading to privilege escalation on the system.


CVSS Score: 7.3 (HIGH)
CWE: CWE-284
References: https://www.dell.com/support/kbdoc/en-us/000217705/dsa-2023-340; https://www.dell.com/support/kbdoc/en-us/000217705/dsa-2023-340
CVE: CVE-2023-6464
Published: 2023-12-02
Description: A vulnerability was found in SourceCodester User Registration and Login System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /endpoint/add-user.php. The manipulation of the argument user leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-246614 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/qqisee/vulndis/blob/main/sqlInjection_delete_user.md; https://vuldb.com/?ctiid.246614; https://vuldb.com/?id.246614
CVE: CVE-2023-6465
Published: 2023-12-02
Description: A vulnerability was found in PHPGurukul Nipah Virus Testing Management System 1.0. It has been classified as problematic. This affects an unknown part of the file registered-user-testing.php. The manipulation of the argument regmobilenumber leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-246615.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/dhabaleshwar/niv_testing_reflectedxss/blob/main/exploit.md; https://vuldb.com/?ctiid.246615; https://vuldb.com/?id.246615
CVE: CVE-2023-6466
Published: 2023-12-02
Description: A vulnerability was found in Thecosy IceCMS 2.0.1. It has been declared as problematic. This vulnerability affects unknown code of the file /planet of the component User Comment Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-246616.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://39.106.130.187/; https://vuldb.com/?ctiid.246616; https://vuldb.com/?id.246616