deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-0839
Published: 2025-04-05
Description: The ZoomSounds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 6.91 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://codecanyon.net/item/zoomsounds-wordpress-wave-audio-player-with-playlist/6181433; https://www.wordfence.com/threat-intel/vulnerabilities/id/49b76f5f-03f7-48bc-b848-9ab55d875639?source=cve
CVE: CVE-2025-1233
Published: 2025-04-05
Description: The Lafka Plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'lafka_options_upload' AJAX function in all versions up to, and including, 7.1.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the theme option that overrides the site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://themeforest.net/item/lafka-fast-food-restaurant-woocommerce-theme/23969682; https://www.wordfence.com/threat-intel/vulnerabilities/id/865b87a8-ab8a-4054-9e18-50693023cb96?source=cve
CVE: CVE-2025-2789
Published: 2025-04-05
Description: The MultiVendorX – Empower Your WooCommerce Store with a Dynamic Multivendor Marketplace – Build the Next Amazon, eBay, Etsy plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_table_rate_shipping_row function in all versions up to, and including, 4.2.19. This makes it possible for unauthenticated attackers to delete Table Rates that can impact the shipping cost calculations.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/dc-woocommerce-multi-vendor/tags/4.2.19/packages/mvx-tablerate/mvx-tablerate.php#L211; https://plugins.trac.wordpress.org/browser/dc-woocommerce-multi-vendor/tags/4.2.19/packages/mvx-tablerate/mvx-tablerate.php#L78; https://www.wordfence.com/threat-intel/vulnerabilities/id/bf4eca37-066f-428c-a4f7-061ce06e1142?source=cve
CVE: CVE-2025-2941
Published: 2025-04-05
Description: The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress is vulnerable to arbitrary file moving due to insufficient file path validation via the wc-upload-file[] parameter in all versions up to, and including, 1.1.4. This makes it possible for unauthenticated attackers to move arbitrary files on the server, which can easily lead to remote code execution when the right file is moved (such as wp-config.php).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3266697%40drag-and-drop-multiple-file-upload-for-woocommerce&new=3266697%40drag-and-drop-multiple-file-upload-for-woocommerce&sfp_email=&sfph_mail=; https://wordpress.org/plugins/drag-and-drop-multiple-file-upload-for-woocommerce/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/2685a2b4-aba3-425b-af0d-06f7693ab3d7?source=cve
CVE: CVE-2025-3296
Published: 2025-04-05
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Online Eyewear Shop 1.0. This issue affects some unknown processing of the file /classes/Users.php?f=delete_customer. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/foreverfeifei/cve/blob/main/sql.md; https://vuldb.com/?ctiid.303491; https://vuldb.com/?id.303491
CVE: CVE-2025-3297
Published: 2025-04-05
Description: A vulnerability, which was classified as problematic, was found in SourceCodester Online Eyewear Shop 1.0. Affected is an unknown function of the file /classes/Master.php?f=save_product. The manipulation of the argument brand leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/foreverfeifei/cve/blob/main/xss.md; https://vuldb.com/?ctiid.303492; https://vuldb.com/?id.303492
CVE: CVE-2025-3298
Published: 2025-04-05
Description: A vulnerability has been found in SourceCodester Online Eyewear Shop 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /oews/classes/Master.php?f=save_product of the component Registration Handler. The manipulation of the argument email leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-266, CWE-284
References: https://github.com/foreverfeifei/cve/blob/main/user.md; https://vuldb.com/?ctiid.303493; https://vuldb.com/?id.303493
CVE: CVE-2025-3299
Published: 2025-04-05
Description: A vulnerability was found in PHPGurukul Men Salon Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /appointment.php. The manipulation of the argument Name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/LaneyYu/cve/issues/1; https://phpgurukul.com/; https://vuldb.com/?ctiid.303494
CVE: CVE-2025-30401
Published: 2025-04-05
Description: A spoofing issue in WhatsApp for Windows prior to version 2.2450.6 displayed attachments according to their MIME type but selected the file opening handler based on the attachment’s filename extension. A maliciously crafted mismatch could have caused the recipient to inadvertently execute arbitrary code rather than view the attachment when manually opening the attachment inside WhatsApp. We have not seen evidence of exploitation in the wild.
CVSS Score: 6.7 (MEDIUM)
References: https://www.facebook.com/security/advisories/cve-2025-30401; https://www.whatsapp.com/security/advisories/2025/
CVE: CVE-2024-57835
Published: 2025-04-05
Description: Amon2::Auth::Site::LINE uses the String::Random module to generate nonce values. 

String::Random defaults to Perl's built-in predictable random number generator, the rand() function, which is not cryptographically secure
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-338, CWE-338
References: https://metacpan.org/release/SHLOMIF/String-Random-0.32/source/lib/String/Random.pm#L377; https://metacpan.org/release/TANIGUCHI/Amon2-Auth-Site-LINE-0.04/source/lib/Amon2/Auth/Site/LINE.pm#L235; https://metacpan.org/release/TANIGUCHI/Amon2-Auth-Site-LINE-0.04/source/lib/Amon2/Auth/Site/LINE.pm#L255
CVE: CVE-2024-57868
Published: 2025-04-05
Description: Web::API 2.8 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.

Specifically Web::API uses the Data::Random library which specifically states that it is "Useful mostly for test programs". Data::Random uses the rand() function.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-331, CWE-338, CWE-338
References: https://metacpan.org/dist/Web-API/source/lib/Web/API.pm#L20; https://metacpan.org/dist/Web-API/source/lib/Web/API.pm#L348; https://metacpan.org/release/BAREFOOT/Data-Random-0.13/source/lib/Data/Random.pm#L537
CVE: CVE-2024-58036
Published: 2025-04-05
Description: Net::Dropbox::API 1.9 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.

Specifically Net::Dropbox::API uses the Data::Random library which specifically states that it is "Useful mostly for test programs". Data::Random uses the rand() function.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-331, CWE-338, CWE-338
References: https://metacpan.org/release/BAREFOOT/Data-Random-0.13/source/lib/Data/Random.pm#L537; https://metacpan.org/release/NORBU/Net-Dropbox-API-1.9/source/lib/Net/Dropbox/API.pm#L11; https://metacpan.org/release/NORBU/Net-Dropbox-API-1.9/source/lib/Net/Dropbox/API.pm#L385
CVE: CVE-2024-52322
Published: 2025-04-05
Description: WebService::Xero 0.11 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.

Specifically WebService::Xero uses the Data::Random library which specifically states that it is "Useful mostly for test programs". Data::Random uses the rand() function.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-331, CWE-338, CWE-338
References: https://metacpan.org/release/BAREFOOT/Data-Random-0.13/source/lib/Data/Random.pm#L537; https://metacpan.org/release/LOCALSHOP/WebService-Xero-0.11/source/lib/WebService/Xero/Agent.pm#L17; https://metacpan.org/release/LOCALSHOP/WebService-Xero-0.11/source/lib/WebService/Xero/Agent.pm#L178
CVE: CVE-2024-56370
Published: 2025-04-05
Description: Net::Xero 0.044 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.

Specifically Net::Xero uses the Data::Random library which specifically states that it is "Useful mostly for test programs". Data::Random uses the rand() function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-331, CWE-338
References: https://metacpan.org/release/BAREFOOT/Data-Random-0.13/source/lib/Data/Random.pm#L537; https://metacpan.org/release/ELLIOTT/Net-Xero-0.44/source/lib/Net/Xero.pm#L58; https://metacpan.org/release/ELLIOTT/Net-Xero-0.44/source/lib/Net/Xero.pm#L9
CVE: CVE-2025-32357
Published: 2025-04-05
Description: In Zammad 6.4.x before 6.4.2, an authenticated agent with knowledge base permissions was able to use the Zammad API to fetch knowledge base content that they have no permission for.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-288, CWE-306
References: https://zammad.com/en/advisories/zaa-2025-04
CVE: CVE-2025-32358
Published: 2025-04-05
Description: In Zammad 6.4.x before 6.4.2, SSRF can occur. Authenticated admin users can enable webhooks in Zammad, which are triggered as POST requests when certain conditions are met. If a webhook endpoint returned a redirect response, Zammad would follow it automatically with another GET request. This could be abused by an attacker to cause GET requests for example in the local network.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://zammad.com/en/advisories/zaa-2025-01
CVE: CVE-2025-32359
Published: 2025-04-05
Description: In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. When changing their two factor authentication configuration, users need to re-authenticate with their current password first. However, this change was enforced in Zammad only on the front end level, and not when using the API directly.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-602
References: https://zammad.com/en/advisories/zaa-2025-02
CVE: CVE-2025-32360
Published: 2025-04-05
Description: In Zammad 6.4.x before 6.4.2, there is information exposure. Only agents should be able to see and work on shared article drafts. However, a logged in customer was able to see details about shared drafts for their customer tickets in the browser console, which may contain confidential information, and also to manipulate them via API.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-402
References: https://zammad.com/en/advisories/zaa-2025-03
CVE: CVE-2025-3303
Published: 2025-04-05
Description: A vulnerability, which was classified as critical, has been found in code-projects Patient Record Management System 1.0. Affected by this issue is some unknown functionality of the file /birthing_record.php. The manipulation of the argument itr_no leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/hyfhacker/cve/blob/main/README.md; https://vuldb.com/?ctiid.303500
CVE: CVE-2025-32364
Published: 2025-04-05
Description: A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-190
References: https://gitlab.freedesktop.org/poppler/poppler/-/commit/d87bc726c7cc98f8c26b60ece5f20236e9de1bc3; https://gitlab.freedesktop.org/poppler/poppler/-/issues/1574; https://lists.debian.org/debian-lts-announce/2025/04/msg00037.html
CVE: CVE-2025-32365
Published: 2025-04-05
Description: Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc because of a misplaced isOk check.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-125
References: https://gitlab.freedesktop.org/poppler/poppler/-/issues/1577; https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/1792; https://lists.debian.org/debian-lts-announce/2025/04/msg00037.html
CVE: CVE-2025-3304
Published: 2025-04-05
Description: A vulnerability, which was classified as critical, was found in code-projects Patient Record Management System 1.0. This affects an unknown part of the file /dental_not.php. The manipulation of the argument itr_no leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/hyx123123/cve/blob/main/cve2.md; https://vuldb.com/?ctiid.303501
CVE: CVE-2025-32366
Published: 2025-04-05
Description: In ConnMan through 1.44, parse_rr in dnsproxy.c has a memcpy length that depends on an RR RDLENGTH value, i.e., *rdlen=ntohs(rr->rdlen) and memcpy(response+offset,*end,*rdlen) without a check for whether the sum of *end and *rdlen exceeds max. Consequently, *rdlen may be larger than the amount of remaining packet data in the current state of parsing. Values of stack memory locations may be sent over the network in a response.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-130
References: https://lapis-sawfish-be3.notion.site/0-day-Comman-memory-Leak-190dc00d01d080688472d322c93c4340; https://web.archive.org/web/[PII_REDACTED]0356/https://lapis-sawfish-be3.notion.site/0-day-Comman-memory-Leak-190dc00d01d080688472d322c93c4340; https://web.git.kernel.org/pub/scm/network/connman/connman.git/tree/src/dnsproxy.c?h=1.44#n1001
CVE: CVE-2025-3305
Published: 2025-04-05
Description: A vulnerability has been found in[PII_REDACTED]/code-projects IKUN_Library 1.0 and classified as problematic. This vulnerability affects the function addInterceptors of the file MvcConfig.java of the component Borrow Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-266, CWE-284
References: https://github.com/buluorifu/Vulnerability-recurrence/blob/main/Refer/IKUN_Library-authority.md; https://vuldb.com/?ctiid.303502; https://vuldb.com/?id.303502
CVE: CVE-2025-3306
Published: 2025-04-06
Description: A vulnerability was found in code-projects Blood Bank Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /don.php. The manipulation of the argument fullname leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/p1026/CVE/issues/22; https://vuldb.com/?ctiid.303503
CVE: CVE-2024-58131
Published: 2025-04-06
Description: FISCO BCOS 3.11.0 has an issue with synchronization of the transaction pool that can, for example, be observed when a malicious node (that has modified the codebase to allow a large min_seal_time value) joins a blockchain network.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-821, CWE-662
References: https://github.com/FISCO-BCOS/FISCO-BCOS/issues/4656; https://github.com/FISCO-BCOS/FISCO-BCOS/issues/4656
CVE: CVE-2024-58132
Published: 2025-04-06
Description: In chainmaker-go (aka ChainMaker) before 2.3.6, multiple updates to a single node's configuration can cause other normal nodes to perform concurrent read and write operations on a map, leading to a panic.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-821
References: https://git.chainmaker.org.cn/chainmaker/issue/-/issues/1202
CVE: CVE-2024-58133
Published: 2025-04-06
Description: In chainmaker-go (aka ChainMaker) before 2.4.0, when making frequent updates to a node's configuration file and restarting this node, concurrent writes by logger.go to a map are mishandled. Creating other logs simultaneously can lead to a read-write conflict and panic.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-821
References: https://git.chainmaker.org.cn/chainmaker/issue/-/issues/1228
CVE: CVE-2025-3307
Published: 2025-04-06
Description: A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /reset.php. The manipulation of the argument useremail leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/p1026/CVE/issues/24; https://vuldb.com/?ctiid.303504
CVE: CVE-2025-3308
Published: 2025-04-06
Description: A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /viewrequest.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/p1026/CVE/issues/25; https://vuldb.com/?ctiid.303505
CVE: CVE-2025-1264
Published: 2025-04-06
Description: The Broken Link Checker by AIOSEO – Easily Fix/Monitor Internal and External links plugin for WordPress is vulnerable to SQL Injection via the 'orderBy' parameter in all versions up to, and including, 1.2.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/broken-link-checker-seo/trunk/app/Api/Api.php#L42; https://plugins.trac.wordpress.org/browser/broken-link-checker-seo/trunk/app/Api/LinkStatusTable.php#L31; https://plugins.trac.wordpress.org/browser/broken-link-checker-seo/trunk/app/Core/Database.php#L1357
CVE: CVE-2025-32369
Published: 2025-04-06
Description: Kentico Xperience before 13.0.181 allows authenticated users to distribute malicious content (for stored XSS) via certain interactions with the media library file upload feature.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://devnet.kentico.com/download/hotfixes; https://labs.watchtowr.com/xss-to-rce-by-abusing-custom-file-handlers-kentico-xperience-cms-cve-2025-2748/
CVE: CVE-2025-3309
Published: 2025-04-06
Description: A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/campsdetails.php. The manipulation of the argument hospital leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/p1026/CVE/issues/26; https://vuldb.com/?ctiid.303506
CVE: CVE-2025-3310
Published: 2025-04-06
Description: A vulnerability classified as critical has been found in code-projects Blood Bank Management System 1.0. This affects an unknown part of the file /admin/delete.php. The manipulation of the argument Search leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/p1026/CVE/issues/27; https://vuldb.com/?ctiid.303507
CVE: CVE-2025-32370
Published: 2025-04-06
Description: Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated uploads; however, because .zip is processed through TryZipProviderSafe, there is additional functionality to create files with other extensions. NOTE: this is a separate issue not necessarily related to SVG or XSS.
CVSS Score: 7.2 (HIGH)
CWE: CWE-912, CWE-434
References: https://devnet.kentico.com/download/hotfixes; https://labs.watchtowr.com/xss-to-rce-by-abusing-custom-file-handlers-kentico-xperience-cms-cve-2025-2748/; https://labs.watchtowr.com/xss-to-rce-by-abusing-custom-file-handlers-kentico-xperience-cms-cve-2025-2748/
CVE: CVE-2025-3311
Published: 2025-04-06
Description: A vulnerability classified as critical was found in PHPGurukul Men Salon Management System 1.0. This vulnerability affects unknown code of the file /admin/about-us.php. The manipulation of the argument pagetitle leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/FIGHTINGTMQ/CVE/issues/1; https://phpgurukul.com/; https://vuldb.com/?ctiid.303508
CVE: CVE-2025-3312
Published: 2025-04-06
Description: A vulnerability, which was classified as critical, has been found in PHPGurukul Men Salon Management System 1.0. This issue affects some unknown processing of the file /admin/add-customer-services.php. The manipulation of the argument sids[] leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/FIGHTINGTMQ/CVE/issues/2; https://phpgurukul.com/; https://vuldb.com/?ctiid.303509
CVE: CVE-2025-3313
Published: 2025-04-06
Description: A vulnerability, which was classified as critical, was found in PHPGurukul Men Salon Management System 1.0. Affected is an unknown function of the file /admin/add-customer.php. The manipulation of the argument Name leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/ltranquility/CVE/issues/2; https://phpgurukul.com/; https://vuldb.com/?ctiid.303510
CVE: CVE-2025-3314
Published: 2025-04-06
Description: A vulnerability has been found in SourceCodester Apartment Visitor Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /forgotpw.php. The manipulation of the argument secode leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/tongjt123/CVE/issues/1; https://vuldb.com/?ctiid.303511; https://vuldb.com/?id.303511
CVE: CVE-2025-3315
Published: 2025-04-06
Description: A vulnerability was found in SourceCodester Apartment Visitor Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /view-report.php. The manipulation of the argument fromdate/todate leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/alc9700jmo/CVE/issues/11; https://vuldb.com/?ctiid.303512; https://vuldb.com/?id.303512