deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-39368
Published: 2024-03-14
Description: Protection mechanism failure of bus lock regulator for some Intel(R) Processors may allow an unauthenticated user to potentially enable denial of service via network access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-693
References: https://lists.debian.org/debian-lts-announce/2024/05/msg00003.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00972.html
CVE: CVE-2023-43490
Published: 2024-03-14
Description: Incorrect calculation in microcode keying mechanism for some Intel(R) Xeon(R) D Processors with Intel(R) SGX may allow a privileged user to potentially enable information disclosure via local access.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-682
References: https://lists.debian.org/debian-lts-announce/2024/05/msg00003.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01045.html
CVE: CVE-2024-28849
Published: 2024-03-14
Description: follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://fetch.spec.whatwg.org/#authentication-entries; https://github.com/follow-redirects/follow-redirects/commit/c4f847f85176991f95ab9c88af63b1294de8649b; https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-cxjh-pqwp-8mfp
CVE: CVE-2024-1998
Published: 2024-03-14
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-1795. Reason: This candidate is a reservation duplicate of CVE-2024-1795. Notes: All CVE users should reference CVE-2024-1795 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-28181
Published: 2024-03-14
Description:  turbo_boost-commands is a set of commands to help you build robust reactive applications with Rails & Hotwire. TurboBoost Commands has existing protections in place to guarantee that only public methods on Command classes can be invoked; however, the existing checks aren't as robust as they should be. It's possible for a sophisticated attacker to invoke more methods than should be permitted depending on the the strictness of authorization checks that individual applications enforce. Being able to call some of these methods can have security implications. Commands verify that the class must be a `Command` and that the method requested is defined as a public method; however, this isn't robust enough to guard against all unwanted code execution. The library should more strictly enforce which methods are considered safe before allowing them to be executed. This issue has been addressed in versions 0.1.3, and 0.2.2. Users are advised to upgrade. Users unable to upgrade should see the repository GHSA for workaround advice.
CVSS Score: 8.1 (HIGH)
CWE: CWE-74
References: https://github.com/hopsoft/turbo_boost-commands/commit/88af4fc0ac39cc1799d16c49fab52f6dfbcec9ba; https://github.com/hopsoft/turbo_boost-commands/security/advisories/GHSA-mp76-7w5v-pr75; https://github.com/hopsoft/turbo_boost-commands/commit/88af4fc0ac39cc1799d16c49fab52f6dfbcec9ba
CVE: CVE-2023-42938
Published: 2024-03-14
Description: A logic issue was addressed with improved checks. This issue is fixed in iTunes 12.13.1 for Windows. A local attacker may be able to elevate their privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-693
References: https://support.apple.com/en-us/HT214091; https://support.apple.com/kb/HT214091; https://support.apple.com/en-us/HT214091
CVE: CVE-2024-22346
Published: 2024-03-14
Description: Db2 for IBM i 7.2, 7.3, 7.4, and 7.5 infrastructure could allow a local user to gain elevated privileges due to an unqualified library call. A malicious actor could cause user-controlled code to run with administrator privilege.  IBM X-Force ID:  280203.
CVSS Score: 8.4 (HIGH)
CWE: CWE-427
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/280203; https://www.ibm.com/support/pages/node/7140499; https://exchange.xforce.ibmcloud.com/vulnerabilities/280203
CVE: CVE-2024-23823
Published: 2024-03-14
Description: vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. The vantage6 server has no restrictions on CORS settings. It should be possible for people to set the allowed origins of the server.  The impact is limited because v6 does not use session cookies. This issue has been addressed in commit `70bb4e1d8` and is expected to ship in subsequent releases. Users are advised to upgrade as soon as a new release is available. There are no known workarounds for this vulnerability.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-863, CWE-942
References: https://github.com/vantage6/vantage6/commit/70bb4e1d889230a841eb364d6c03accd7dd01a41; https://github.com/vantage6/vantage6/security/advisories/GHSA-4946-85pr-fvxh; https://github.com/vantage6/vantage6/commit/70bb4e1d889230a841eb364d6c03accd7dd01a41
CVE: CVE-2024-24562
Published: 2024-03-14
Description: vantage6-UI is the official user interface for the vantage6 server. In affected versions a number of security headers are not set. This issue has been addressed in commit `68dfa6614` which is expected to be included in future releases. Users are advised to upgrade when a new release is made. While an upgrade path is not available users may modify the docker image build to insert the headers into nginx.

CVSS Score: 5.4 (MEDIUM)
CWE: CWE-668, CWE-693
References: https://github.com/vantage6/vantage6-UI/commit/68dfa661415182da0e5717bd58db3d00aedcbd2e; https://github.com/vantage6/vantage6-UI/security/advisories/GHSA-gwq3-pvwq-4c9w; https://github.com/vantage6/vantage6-UI/commit/68dfa661415182da0e5717bd58db3d00aedcbd2e
CVE: CVE-2024-24770
Published: 2024-03-14
Description: vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. Much like GHSA-45gq-q4xh-cp53, it is possible to find which usernames exist in vantage6 by calling the API routes `/recover/lost` and `/2fa/lost`. These routes send emails to users if they have lost their password or MFA token. This issue has been addressed in commit `aecfd6d0e` and is expected to ship in subsequent releases. Users are advised to upgrade as soon as a new release is available. There are no known workarounds for this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-208, CWE-362
References: https://github.com/vantage6/vantage6/commit/aecfd6d0e83165a41a60ebd52d2287b0217be26b; https://github.com/vantage6/vantage6/security/advisories/GHSA-45gq-q4xh-cp53; https://github.com/vantage6/vantage6/security/advisories/GHSA-5h3x-6gwf-73jm
CVE: CVE-2024-27265
Published: 2024-03-14
Description: IBM Integration Bus for z/OS 10.1 through 10.1.0.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.  IBM X-Force ID:  284564.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/284564; https://www.ibm.com/support/pages/node/7140678; https://exchange.xforce.ibmcloud.com/vulnerabilities/284564
CVE: CVE-2024-27266
Published: 2024-03-14
Description: IBM Maximo Application Suite 7.6.1.3 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.  IBM X-Force ID:  284566.
CVSS Score: 8.2 (HIGH)
CWE: CWE-611
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/284566; https://www.ibm.com/support/pages/node/7141270; https://exchange.xforce.ibmcloud.com/vulnerabilities/284566
CVE: CVE-2024-27301
Published: 2024-03-14
Description: Support App is an opensource application specialized in managing Apple devices. It's possible to abuse a vulnerability inside the postinstall installer script to make the installer execute arbitrary code as root. The cause of the vulnerability is the fact that the shebang `#!/bin/zsh` is being used. When the installer is executed it asks for the users password to be executed as root. However, it'll still be using the $HOME of the user and therefore loading the file  `$HOME/.zshenv` when the `postinstall` script is executed.
An attacker could add malicious code to `$HOME/.zshenv` and it will be executed when the app is installed. An attacker may leverage this vulnerability to escalate privilege on the system. This issue has been addressed in version 2.5.1 Rev 2. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-269
References: https://github.com/root3nl/SupportApp/commit/e866b2aa4028f6a982977f462c0f7550d952c5d0; https://github.com/root3nl/SupportApp/security/advisories/GHSA-jr78-247f-rhqc; https://github.com/root3nl/SupportApp/commit/e866b2aa4028f6a982977f462c0f7550d952c5d0
CVE: CVE-2024-28423
Published: 2024-03-14
Description: Airflow-Diagrams v2.1.0 was discovered to contain an arbitrary file upload vulnerability in the unsafe_load function at cli.py. This vulnerability allows attackers to execute arbitrary code via uploading a crafted YML file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/bayuncao/vul-cve-15; https://github.com/bayuncao/vul-cve-15
CVE: CVE-2024-28424
Published: 2024-03-14
Description: zenml v0.55.4 was discovered to contain an arbitrary file upload vulnerability in the load function at /materializers/cloudpickle_materializer.py. This vulnerability allows attackers to execute arbitrary code via uploading a crafted file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://github.com/bayuncao/vul-cve-18; https://github.com/bayuncao/vul-cve-18
CVE: CVE-2024-28425
Published: 2024-03-14
Description: greykite v1.0.0 was discovered to contain an arbitrary file upload vulnerability in the load_obj function at /templates/pickle_utils.py. This vulnerability allows attackers to execute arbitrary code via uploading a crafted file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-434
References: https://github.com/bayuncao/vul-cve-17; https://github.com/bayuncao/vul-cve-17
CVE: CVE-2024-0860
Published: 2024-03-14
Description: 
The affected product is vulnerable to a cleartext transmission of sensitive information vulnerability, which may allow an attacker to capture packets to craft their own requests.


CVSS Score: 8.0 (HIGH)
CWE: CWE-319
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-13; https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-13
CVE: CVE-2024-1713
Published: 2024-03-14
Description: A user who can create objects in a database with plv8 3.2.1 installed is able to cause deferred triggers to execute as the Superuser during autovacuum.

CVSS Score: 7.2 (HIGH)
CWE: CWE-394, CWE-754
References: https://github.com/google/security-research/security/advisories/GHSA-r7m9-grw7-vcc4; https://github.com/google/security-research/security/advisories/GHSA-r7m9-grw7-vcc4
CVE: CVE-2024-2256
Published: 2024-03-14
Description: The oik plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes such as bw_contact_button and bw_button shortcodes in all versions up to, and including, 4.10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3049746%40oik&new=3049746%40oik&sfp_email=&sfph_mail=; https://www.oik-plugins.com/shortcode_example/bw_contact_button-security-fix/; https://www.wordfence.com/threat-intel/vulnerabilities/id/1266c6df-214b-4b6b-8f1d-a67385469bf5?source=cve
CVE: CVE-2023-42286
Published: 2024-03-14
Description: There is a PHP file inclusion vulnerability in the template configuration of eyoucms v1.6.4, allowing attackers to execute code or system commands through a carefully crafted malicious payload.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/Nacl122/CVEReport/blob/main/CVE-2023-42286/CVE-2023-42286.md; https://github.com/Nacl122/CVEReport/blob/main/CVE-2023-42286/CVE-2023-42286.md
CVE: CVE-2023-50677
Published: 2024-03-14
Description: An issue in NETGEAR-DGND4000 v.1.1.00.15_1.00.15 allows a remote attacker to escalate privileges via the next_file parameter to the /setup.cgi component.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://gist.github.com/DMIND-NLL/b61b8d8d20271adf60fc717b3b48faff; https://gist.github.com/DMIND-NLL/b61b8d8d20271adf60fc717b3b48faff
CVE: CVE-2024-26475
Published: 2024-03-14
Description: An issue in radareorg radare2 v.0.9.7 through v.5.8.6 and fixed in v.5.8.8 allows a local attacker to cause a denial of service via the grub_sfs_read_extent function.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://github.com/TronciuVlad/CVE-2024-26475; https://github.com/TronciuVlad/CVE-2024-26475
CVE: CVE-2024-26503
Published: 2024-03-14
Description: Unrestricted File Upload vulnerability in Greek Universities Network Open eClass v.3.15 and earlier allows attackers to run arbitrary code via upload of crafted file to certbadge.php endpoint.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-434
References: https://www.less-secure.com/2024/03/open-eclass-cve-2024-26503-unrestricted.html; https://www.less-secure.com/2024/03/open-eclass-cve-2024-26503-unrestricted.html
CVE: CVE-2024-2249
Published: 2024-03-14
Description: The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the LinkWrapper attribute found in several widgets in all versions up to, and including, 1.3.7.4 due to insufficient input sanitization and output escaping the user supplied attribute. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3050316/lastudio-element-kit/trunk/includes/extensions/elementor/wrapper-link.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/5113170a-5a53-4e53-84e6-56d9ba0740ed?source=cve; https://plugins.trac.wordpress.org/changeset/3050316/lastudio-element-kit/trunk/includes/extensions/elementor/wrapper-link.php
CVE: CVE-2024-1853
Published: 2024-03-14
Description: Zemana AntiLogger v2.74.204.664 is vulnerable to an Arbitrary Process Termination vulnerability by triggering the 0x80002048 IOCTL code of the zam64.sys and zamguard64.sys drivers.


CVSS Score: 5.5 (MEDIUM)
CWE: CWE-283
References: https://fluidattacks.com/advisories/ellington/; https://zemana.com/us/antilogger.html; https://fluidattacks.com/advisories/ellington/
CVE: CVE-2024-26163
Published: 2024-03-14
Description: Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-693
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26163; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26163
CVE: CVE-2024-26246
Published: 2024-03-14
Description: Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
CVSS Score: 3.9 (LOW)
CWE: CWE-1220
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26246; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26246
CVE: CVE-2024-0802
Published: 2024-03-15
Description: Incorrect Pointer Scaling vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated attacker to read arbitrary information from a target product or execute malicious code on a target product by sending a specially crafted packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-468
References: https://jvn.jp/vu/JVNVU99690199/; https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-14; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-024_en.pdf
CVE: CVE-2024-0803
Published: 2024-03-15
Description: Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated attacker to execute malicious code on a target product by sending a specially crafted packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://jvn.jp/vu/JVNVU99690199/; https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-14; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-024_en.pdf
CVE: CVE-2024-1915
Published: 2024-03-15
Description: Incorrect Pointer Scaling vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated attacker to execute malicious code on a target product by sending a specially crafted packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-468
References: https://jvn.jp/vu/JVNVU99690199/; https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-14; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-024_en.pdf
CVE: CVE-2024-1916
Published: 2024-03-15
Description: Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated attacker to execute malicious code on a target product by sending a specially crafted packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://jvn.jp/vu/JVNVU99690199/; https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-14; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-024_en.pdf
CVE: CVE-2024-1917
Published: 2024-03-15
Description: Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated attacker to execute malicious code on a target product by sending a specially crafted packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://jvn.jp/vu/JVNVU99690199/; https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-14; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-024_en.pdf
CVE: CVE-2024-26454
Published: 2024-03-15
Description: A Cross Site Scripting vulnerability in Healthcare-Chatbot through 9b7058a can occur via a crafted payload to the email1 or pwd1 parameter in login.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/OmRajpurkar/Healthcare-Chatbot/issues/4; https://medium.com/%400x0d0x0a/healthcare-chatbot-xss-cve-2024-26454-acf2607bf210; https://github.com/OmRajpurkar/Healthcare-Chatbot/issues/4
CVE: CVE-2024-26540
Published: 2024-03-15
Description: A heap-based buffer overflow in Clmg before 3.3.3 can occur via a crafted file to cimg_library::CImg<unsigned char>::_load_analyze.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://github.com/GreycLab/CImg/issues/403; https://github.com/GreycLab/CImg/issues/403
CVE: CVE-2024-2180
Published: 2024-03-15
Description: Zemana AntiLogger v2.74.204.664 is vulnerable to a Memory Information Leak vulnerability by triggering the 0x80002020 IOCTL code of the zam64.sys and zamguard64.sys drivers
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-404
References: https://fluidattacks.com/advisories/gomez/; https://zemana.com/us/antilogger.html; https://fluidattacks.com/advisories/gomez/
CVE: CVE-2024-2204
Published: 2024-03-15
Description: Zemana AntiLogger v2.74.204.664 is vulnerable to a Denial of Service (DoS) vulnerability by triggering the 0x80002004 and 0x80002010 IOCTL codes of the zam64.sys and zamguard64.sys drivers.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://fluidattacks.com/advisories/hassan/; https://zemana.com/us/antilogger.html; https://fluidattacks.com/advisories/hassan/
CVE: CVE-2024-25227
Published: 2024-03-15
Description: SQL Injection vulnerability in ABO.CMS version 5.8, allows remote attackers to execute arbitrary code, cause a denial of service (DoS), escalate privileges, and obtain sensitive information via the tb_login parameter in admin login page.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://thetrueartist.wixsite.com/cveblog/post/understanding-the-potential-impact-of-cve-2024-25227-what-you-need-to-know-and-how-it-was-discovered; https://thetrueartist.wixsite.com/cveblog/post/understanding-the-potential-impact-of-cve-2024-25227-what-you-need-to-know-and-how-it-was-discovered
CVE: CVE-2024-2478
Published: 2024-03-15
Description: A vulnerability was found in BradWenqiang HR 2.0. It has been rated as critical. Affected by this issue is the function selectAll of the file /bishe/register of the component Background Management. The manipulation of the argument userName leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-256886 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/zuizui35/cve/blob/main/cve.md; https://vuldb.com/?ctiid.256886; https://vuldb.com/?id.256886
CVE: CVE-2024-2479
Published: 2024-03-15
Description: A vulnerability classified as problematic has been found in MHA Sistemas arMHAzena 9.6.0.0. This affects an unknown part of the component Cadastro Page. The manipulation of the argument Query leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256887. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://johnermac.github.io/cve/xss/; https://vuldb.com/?ctiid.256887; https://vuldb.com/?id.256887
CVE: CVE-2024-2480
Published: 2024-03-15
Description: A vulnerability classified as critical was found in MHA Sistemas arMHAzena 9.6.0.0. This vulnerability affects unknown code of the component Executa Page. The manipulation of the argument Companhia/Planta/Agente de/Agente até leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256888. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://johnermac.github.io/cve/sqli/; https://vuldb.com/?ctiid.256888; https://vuldb.com/?id.256888
CVE: CVE-2024-2481
Published: 2024-03-15
Description: A vulnerability, which was classified as critical, was found in Surya2Developer Hostel Management System 1.0. Affected is an unknown function of the file /admin/manage-students.php. The manipulation of the argument del leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-256890 is the identifier assigned to this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://github.com/blackslim3/cve_sidequest/blob/main/poc/Broken_Access_Control%20on%20Hostel%20Management%20System%20using%20PHP%20and%20MySQL%201.0.md; https://vuldb.com/?ctiid.256890; https://vuldb.com/?id.256890