deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-22155
Published: 2024-04-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in Automattic WooCommerce.This issue affects WooCommerce: from n/a through 8.5.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/woocommerce/wordpress-woocommerce-plugin-8-5-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce/wordpress-woocommerce-plugin-8-5-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-31233
Published: 2024-04-07
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sizam Rehub.This issue affects Rehub: from n/a through 19.6.1.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/rehub-theme/wordpress-rehub-theme-19-6-1-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/rehub-theme/wordpress-rehub-theme-19-6-1-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-31234
Published: 2024-04-07
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sizam REHub Framework.This issue affects REHub Framework: from n/a before 19.6.2.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/rehub-framework/wordpress-rehub-framework-plugin-19-6-2-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/rehub-framework/wordpress-rehub-framework-plugin-19-6-2-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-31236
Published: 2024-04-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons allows Stored XSS.This issue affects Royal Elementor Addons: from n/a through 1.3.93.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/royal-elementor-addons/wordpress-royal-elementor-addons-plugin-1-3-93-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/royal-elementor-addons/wordpress-royal-elementor-addons-plugin-1-3-93-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-31241
Published: 2024-04-07
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThimPress LearnPress Export Import.This issue affects LearnPress Export Import: from n/a through 4.0.3.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/learnpress-import-export/wordpress-learnpress-export-import-plugin-4-0-3-admin-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/learnpress-import-export/wordpress-learnpress-export-import-plugin-4-0-3-admin-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-31255
Published: 2024-04-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ELEXtensions ELEX WooCommerce Dynamic Pricing and Discounts allows Reflected XSS.This issue affects ELEX WooCommerce Dynamic Pricing and Discounts: from n/a through 2.1.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/elex-woocommerce-dynamic-pricing-and-discounts/wordpress-elex-woocommerce-dynamic-pricing-and-discounts-plugin-2-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/elex-woocommerce-dynamic-pricing-and-discounts/wordpress-elex-woocommerce-dynamic-pricing-and-discounts-plugin-2-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-31256
Published: 2024-04-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebinarPress allows Reflected XSS.This issue affects WebinarPress: from n/a through 1.33.10.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-webinarsystem/wordpress-webinarpress-plugin-1-33-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-webinarsystem/wordpress-webinarpress-plugin-1-33-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-31257
Published: 2024-04-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Formsite Formsite | Embed online forms to collect orders, registrations, leads, and surveys allows Stored XSS.This issue affects Formsite | Embed online forms to collect orders, registrations, leads, and surveys: from n/a through 1.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/formsite/wordpress-formsite-plugin-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/formsite/wordpress-formsite-plugin-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-31258
Published: 2024-04-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Micro.Company Form to Chat App allows Stored XSS.This issue affects Form to Chat App: from n/a through 1.1.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/form-to-chat/wordpress-form-to-chat-app-plugin-1-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/form-to-chat/wordpress-form-to-chat-app-plugin-1-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-31260
Published: 2024-04-07
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WisdmLabs Edwiser Bridge.This issue affects Edwiser Bridge: from n/a through 3.0.2.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/edwiser-bridge/wordpress-edwiser-bridge-wordpress-moodle-lms-integration-plugin-3-0-2-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/edwiser-bridge/wordpress-edwiser-bridge-wordpress-moodle-lms-integration-plugin-3-0-2-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-31277
Published: 2024-04-07
Description: Deserialization of Untrusted Data vulnerability in PickPlugins Product Designer.This issue affects Product Designer: from n/a through 1.0.32.
CVSS Score: 8.7 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/vulnerability/product-designer/wordpress-product-designer-plugin-1-0-32-php-object-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/product-designer/wordpress-product-designer-plugin-1-0-32-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2024-31280
Published: 2024-04-07
Description: Unrestricted Upload of File with Dangerous Type vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.5.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/church-admin/vulnerability/wordpress-church-admin-plugin-4-1-5-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/church-admin/wordpress-church-admin-plugin-4-1-5-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-31286
Published: 2024-04-07
Description: Unrestricted Upload of File with Dangerous Type vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus.This issue affects WP Photo Album Plus: from n/a before 8.6.03.005.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/wp-photo-album-plus/wordpress-wp-photo-album-plus-plugin-8-6-03-005-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-photo-album-plus/wordpress-wp-photo-album-plus-plugin-8-6-03-005-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-31288
Published: 2024-04-07
Description: Server-Side Request Forgery (SSRF) vulnerability in RapidLoad RapidLoad Power-Up for Autoptimize.This issue affects RapidLoad Power-Up for Autoptimize: from n/a through 2.2.11.
CVSS Score: 7.2 (HIGH)
CWE: CWE-918
References: https://patchstack.com/database/vulnerability/unusedcss/wordpress-rapidload-plugin-2-2-11-server-side-request-forgery-ssrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/unusedcss/wordpress-rapidload-plugin-2-2-11-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2024-31291
Published: 2024-04-07
Description: Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://patchstack.com/database/vulnerability/profilegrid-user-profiles-groups-and-communities/wordpress-profilegrid-plugin-5-7-6-idor-on-friend-request-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/profilegrid-user-profiles-groups-and-communities/wordpress-profilegrid-plugin-5-7-6-idor-on-friend-request-vulnerability?_s_id=cve
CVE: CVE-2024-31292
Published: 2024-04-07
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Moove Agency Import XML and RSS Feeds.This issue affects Import XML and RSS Feeds: from n/a through 2.1.5.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/import-xml-feed/wordpress-import-xml-and-rss-feeds-plugin-2-1-5-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/import-xml-feed/wordpress-import-xml-and-rss-feeds-plugin-2-1-5-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-31296
Published: 2024-04-07
Description: Authorization Bypass Through User-Controlled Key vulnerability in Repute Infosystems BookingPress.This issue affects BookingPress: from n/a through 1.0.81.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://patchstack.com/database/vulnerability/bookingpress-appointment-booking/wordpress-bookingpress-plugin-1-0-81-insecure-direct-object-references-idor-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/bookingpress-appointment-booking/wordpress-bookingpress-plugin-1-0-81-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE: CVE-2024-31306
Published: 2024-04-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Blocks for Gutenberg allows Stored XSS.This issue affects Essential Blocks for Gutenberg: from n/a through 4.5.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/essential-blocks/wordpress-essential-blocks-plugin-4-5-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/essential-blocks/wordpress-essential-blocks-plugin-4-5-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-31308
Published: 2024-04-07
Description: Deserialization of Untrusted Data vulnerability in VJInfotech WP Import Export Lite.This issue affects WP Import Export Lite: from n/a through 3.9.26.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-502
References: https://patchstack.com/database/vulnerability/wp-import-export-lite/wordpress-wp-import-export-lite-wp-import-export-plugin-3-9-26-php-object-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-import-export-lite/wordpress-wp-import-export-lite-wp-import-export-plugin-3-9-26-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2024-31344
Published: 2024-04-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Phpbits Creative Studio Easy Login Styler – White Label Admin Login Page for WordPress allows Stored XSS.This issue affects Easy Login Styler – White Label Admin Login Page for WordPress: from n/a through 1.0.6.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/easy-login-styler/wordpress-easy-login-styler-plugin-1-0-6-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/easy-login-styler/wordpress-easy-login-styler-plugin-1-0-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-31345
Published: 2024-04-07
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Sukhchain Singh Auto Poster.This issue affects Auto Poster: from n/a through 1.2.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/auto-poster/wordpress-auto-poster-plugin-1-2-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/auto-poster/wordpress-auto-poster-plugin-1-2-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-31346
Published: 2024-04-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Blocksmarket Gradient Text Widget for Elementor allows Stored XSS.This issue affects Gradient Text Widget for Elementor: from n/a through 1.0.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/gradient-text-widget-for-elementor/wordpress-gradient-text-widget-for-elementor-plugin-1-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/gradient-text-widget-for-elementor/wordpress-gradient-text-widget-for-elementor-plugin-1-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-31348
Published: 2024-04-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Testimonials allows Stored XSS.This issue affects Testimonials: from n/a through 3.0.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/super-testimonial/wordpress-super-testimonials-plugin-3-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/super-testimonial/wordpress-super-testimonials-plugin-3-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-31349
Published: 2024-04-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MailMunch MailMunch – Grow your Email List allows Stored XSS.This issue affects MailMunch – Grow your Email List: from n/a through 3.1.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/mailmunch/wordpress-mailmunch-grow-your-email-list-plugin-3-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/mailmunch/wordpress-mailmunch-grow-your-email-list-plugin-3-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-3428
Published: 2024-04-07
Description: A vulnerability has been found in SourceCodester Online Courseware 1.0 and classified as problematic. This vulnerability affects unknown code of the file edit.php. The manipulation of the argument id leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259600.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/thisissuperann/Vul/blob/Online-Courseware/Online-Courseware-13.md; https://vuldb.com/?ctiid.259600; https://vuldb.com/?id.259600
CVE: CVE-2024-31948
Published: 2024-04-07
Description: In FRRouting (FRR) through 9.1, an attacker using a malformed Prefix SID attribute in a BGP UPDATE packet can cause the bgpd daemon to crash.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1287
References: https://github.com/FRRouting/frr/pull/15628; https://github.com/FRRouting/frr/pull/15628/commits/ba6a8f1a31e1a88df2de69ea46068e8bd9b97138; https://lists.debian.org/debian-lts-announce/2024/04/msg00019.html
CVE: CVE-2024-31949
Published: 2024-04-07
Description: In FRRouting (FRR) through 9.1, an infinite loop can occur when receiving a MP/GR capability as a dynamic capability because malformed data results in a pointer not advancing.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835
References: https://github.com/FRRouting/frr/pull/15640; https://github.com/FRRouting/frr/pull/15640/commits/30a332dad86fafd2b0b6c61d23de59ed969a219b; https://lists.debian.org/debian-lts-announce/2024/04/msg00019.html
CVE: CVE-2024-31950
Published: 2024-04-07
Description: In FRRouting (FRR) through 9.1, there can be a buffer overflow and daemon crash in ospf_te_parse_ri for OSPF LSA packets during an attempt to read Segment Routing subTLVs (their size is not validated).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/FRRouting/frr/pull/15674/; https://github.com/FRRouting/frr/pull/15674/commits/6b84541df71772f697a7f9e6b2aaf72536aab775; https://github.com/FRRouting/frr/pull/15674/
CVE: CVE-2024-31951
Published: 2024-04-07
Description: In the Opaque LSA Extended Link parser in FRRouting (FRR) through 9.1, there can be a buffer overflow and daemon crash in ospf_te_parse_ext_link for OSPF LSA packets during an attempt to read Segment Routing Adjacency SID subTLVs (lengths are not validated).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/FRRouting/frr/pull/15674/; https://github.com/FRRouting/frr/pull/15674/commits/344fb4be2bc27316c74b17003c05ea40be395836; https://github.com/FRRouting/frr/pull/15674/
CVE: CVE-2024-3430
Published: 2024-04-07
Description: A vulnerability was found in QKSMS up to 3.9.4 on Android. It has been classified as problematic. This affects an unknown part of the file androidmanifest.xml of the component Backup File Handler. The manipulation leads to exposure of backup file to an unauthorized control sphere. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259611. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-530
References: https://github.com/moezbhatti/qksms; https://vuldb.com/?ctiid.259611; https://vuldb.com/?id.259611
CVE: CVE-2024-3431
Published: 2024-04-07
Description: A vulnerability was found in EyouCMS 1.6.5. It has been declared as critical. This vulnerability affects unknown code of the file /login.php?m=admin&c=Field&a=channel_edit of the component Backend. The manipulation of the argument channel_id leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259612. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-502
References: https://terrific-street-3d0.notion.site/EYOUCMS-v1-6-5-RCE-7fe12e91a9b249e88e6ab36446b5ba22; https://vuldb.com/?ctiid.259612; https://vuldb.com/?id.259612
CVE: CVE-2024-3432
Published: 2024-04-07
Description: A vulnerability was found in PuneethReddyHC Event Management 1.0. It has been rated as critical. This issue affects some unknown processing of the file /backend/register.php. The manipulation of the argument event_id/full_name/email/mobile/college/branch leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259613 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://packetstormsecurity.com/files/177841/Event-Management-1.0-SQL-Injection.html; https://vuldb.com/?ctiid.259613; https://vuldb.com/?id.259613
CVE: CVE-2024-3433
Published: 2024-04-07
Description: A vulnerability classified as problematic has been found in PuneethReddyHC Event Management 1.0. Affected is an unknown function of the file /backend/register.php. The manipulation of the argument event_id/full_name/email/mobile/college/branch leads to cross site scripting. It is possible to launch the attack remotely. VDB-259614 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://packetstormsecurity.com/files/177841/Event-Management-1.0-SQL-Injection.html; https://vuldb.com/?ctiid.259614; https://vuldb.com/?id.259614
CVE: CVE-2020-36829
Published: 2024-04-08
Description: The Mojolicious module before 8.65 for Perl is vulnerable to secure_compare timing attacks that allow an attacker to guess the length of a secret string. Only versions after 1.74 are affected.
CVSS Score: 7.5 (HIGH)
References: https://github.com/mojolicious/mojo/issues/1599; https://github.com/mojolicious/mojo/pull/1601; https://lists.debian.org/debian-lts-announce/2024/06/msg00025.html
CVE: CVE-2021-47208
Published: 2024-04-08
Description: The Mojolicious module before 9.11 for Perl has a bug in format detection that can potentially be exploited for denial of service.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400
References: https://github.com/mojolicious/mojo/commit/a0c4576ffb11c235088550de9ba7ac4196e1953c; https://github.com/mojolicious/mojo/issues/1736; https://github.com/mojolicious/mojo/commit/a0c4576ffb11c235088550de9ba7ac4196e1953c
CVE: CVE-2024-3434
Published: 2024-04-08
Description: A vulnerability classified as critical was found in CP Plus Wi-Fi Camera up to 20240401. Affected by this vulnerability is an unknown functionality of the component User Management. The manipulation leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259615. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-285
References: https://drive.google.com/file/d/1-Fz3G5HQZxBNgeXjPfIR1bEeC_qAegWD/view?usp=sharing; https://vuldb.com/?ctiid.259615; https://vuldb.com/?id.259615
CVE: CVE-2024-3436
Published: 2024-04-08
Description: A vulnerability was found in SourceCodester Prison Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /Admin/edit-photo.php of the component Avatar Handler. The manipulation of the argument avatar leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-259630 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/fubxx/CVE/blob/main/PrisonManagementSystemRCE.md; https://vuldb.com/?ctiid.259630; https://vuldb.com/?id.259630
CVE: CVE-2024-3437
Published: 2024-04-08
Description: A vulnerability was found in SourceCodester Prison Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /Admin/add-admin.php of the component Avatar Handler. The manipulation of the argument avatar leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259631.
CVSS Score: 7.3 (HIGH)
CWE: CWE-434
References: https://github.com/fubxx/CVE/blob/main/PrisonManagementSystemRCE2.md; https://vuldb.com/?ctiid.259631; https://vuldb.com/?id.259631
CVE: CVE-2024-28744
Published: 2024-04-08
Description: The password is empty in the initial configuration of ACERA 9010-08 firmware v02.04 and earlier, and ACERA 9010-24 firmware v02.04 and earlier. An unauthenticated attacker may log in to the product with no password, and obtain and/or alter information such as network configuration and user information. The products are affected only when running in non MS mode with the initial configuration.
CVSS Score: 8.8 (HIGH)
CWE: CWE-258
References: https://jvn.jp/en/vu/JVNVU99285099/; https://www.furunosystems.co.jp/news/info/vulner20240401.html; https://jvn.jp/en/vu/JVNVU99285099/