deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-39839
Published: 2024-08-01
Description: Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to disallow users to set their own remote username, when shared channels were enabled, which allows a user on a remote to set their remote username prop to an arbitrary string, which would be then synced to the local server as long as the user hadn't been synced before.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://mattermost.com/security-updates
CVE: CVE-2024-41123
Published: 2024-08-01
Description: REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, `>]` and `]>`. The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://github.com/ruby/rexml/security/advisories/GHSA-4xqq-m2hx-25v8; https://github.com/ruby/rexml/security/advisories/GHSA-r55c-59qm-vjw6; https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh
CVE: CVE-2024-41144
Published: 2024-08-01
Description: Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to properly validate synced posts, when shared channels are enabled,  which allows a malicious remote to create/update/delete arbitrary posts in arbitrary channels
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: https://mattermost.com/security-updates
CVE: CVE-2024-41162
Published: 2024-08-01
Description: Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow the modification of local channels by a remote, when shared channels are enabled, which allows a malicious remote to make an arbitrary local channel read-only.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-284
References: https://mattermost.com/security-updates
CVE: CVE-2024-41926
Published: 2024-08-01
Description: Mattermost versions 9.9.x <= 9.9.0 and 9.5.x <= 9.5.6 fail to validate the source of sync messages and only allow the correct remote IDs, which allows a malicious remote to set arbitrary RemoteId values for synced users and therefore claim that a user was synced from another remote.
CVSS Score: 2.7 (LOW)
CWE: CWE-284, CWE-346
References: https://mattermost.com/security-updates
CVE: CVE-2024-41946
Published: 2024-08-01
Description: REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API. The REXML gem 3.3.3 or later include the patch to fix the vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://github.com/ruby/rexml/commit/033d1909a8f259d5a7c53681bcaf14f13bcf0368; https://github.com/ruby/rexml/security/advisories/GHSA-5866-49gr-22v4; https://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml
CVE: CVE-2024-41961
Published: 2024-08-01
Description: Elektra is an opinionated Openstack Dashboard for Operators and Consumers of Openstack Services. A code injection vulnerability was found in the live search functionality of the Ruby on Rails based Elektra web application. An authenticated user can craft a search term containing Ruby code, which later flows into an `eval` sink which executes the code. Fixed in commit 8bce00be93b95a6512ff68fe86bf9554e486bc02.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-94
References: https://github.com/sapcc/elektra/commit/49aea3b[PII_REDACTED]58bf3bf7bf4a51766cfc44d; https://github.com/sapcc/elektra/commit/8bce00be93b95a6512ff68fe86bf9554e486bc02; https://github.com/sapcc/elektra/security/advisories/GHSA-6j2h-486h-487q
CVE: CVE-2024-41260
Published: 2024-08-01
Description: A static initialization vector (IV) in the encrypt function of netbird management's service from v0.23.2 to v0.29.1 allows attackers to obtain sensitive information (email addresses) when in possession of the audit events database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-321
References: https://gist.github.com/nyxfqq/92232108ac153e95d538bb17fc5ad636; https://github.com/github/advisory-database/pull/5714; https://github.com/netbirdio/netbird/pull/2569
CVE: CVE-2024-41264
Published: 2024-08-01
Description: An issue discovered in casdoor v1.636.0 allows attackers to obtain sensitive information via the ssh.InsecureIgnoreHostKey() method.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295, CWE-200
References: https://gist.github.com/nyxfqq/33ceaccbc9b05d439a944c2b55fa1c0f
CVE: CVE-2024-41265
Published: 2024-08-01
Description: A TLS certificate verification issue discovered in cortex v0.42.1 allows attackers to obtain sensitive information via the makeOperatorRequest function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-599
References: https://gist.github.com/nyxfqq/1a8237f3f9cf793c6433f08b17d1593c
CVE: CVE-2024-6040
Published: 2024-08-01
Description: In parisneo/lollms-webui version v9.8, the lollms_binding_infos is missing the client_id parameter, which leads to multiple security vulnerabilities. Specifically, the endpoints /reload_binding, /install_binding, /reinstall_binding, /unInstall_binding, /set_active_binding_settings, and /update_binding_settings are susceptible to CSRF attacks and local attacks. An attacker can exploit this vulnerability to perform unauthorized actions on the victim's machine.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://huntr.com/bounties/ac0bbb1d-89aa-42ba-bc48-1b59bd16acc7
CVE: CVE-2024-6242
Published: 2024-08-01
Description: A vulnerability exists in Rockwell Automation affected products that allows a threat actor to bypass the Trusted® Slot feature in a ControlLogix® controller. If exploited on any affected module in a 1756 chassis, a threat actor could potentially execute CIP commands that modify user projects and/or device configuration on a Logix controller in the chassis.
CWE: CWE-420
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1682.html
CVE: CVE-2024-6873
Published: 2024-08-01
Description: It is possible to crash or redirect the execution flow of the ClickHouse server process from an unauthenticated vector by sending a specially crafted request to the ClickHouse server native interface. This redirection is limited to what is available within a 256-byte range of memory at the time of execution, and no known remote code execution (RCE) code has been produced or exploited.

 Fixes have been merged to all currently supported version of ClickHouse. If you are maintaining your own forked version of ClickHouse or using an older version and cannot upgrade, the fix for this vulnerability can be found in this commit  https://github.com/ClickHouse/ClickHouse/pull/64024 .
CVSS Score: 8.1 (HIGH)
CWE: CWE-122
References: https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-432f-r822-j66f
CVE: CVE-2024-23600
Published: 2024-08-01
Description: Improper Input Validation of query search results for private field data in PingIDM (Query Filter module) allows for a potentially efficient brute forcing approach leading to information disclosure.
CVSS Score: 2.7 (LOW)
CWE: CWE-20
References: https://backstage.forgerock.com/docs/idcloud/latest/release-notes/regular-channel-changelog.html#changed_functionality; https://backstage.forgerock.com/knowledge/kb/article/a95212747; http://seclists.org/fulldisclosure/2024/Oct/18
CVE: CVE-2024-41962
Published: 2024-08-01
Description: Bostr is an nostr relay aggregator proxy that acts like a regular nostr relay. bostr let everyone in even having authorized_keys being set when noscraper is set to true. This vulnerability is fixed in 3.0.10.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-285
References: https://github.com/Yonle/bostr/blob/8665374a66e2afb9f92d0414b0d6f420a95d5d2d/auth.js#L21; https://github.com/Yonle/bostr/commit/49181f4ec9ae1472c6675cab56bbc01e723855af; https://github.com/Yonle/bostr/releases/tag/3.0.10
CVE: CVE-2024-7211
Published: 2024-08-01
Description: The 1E Platform's component utilized the third-party Duende Identity Server, which suffered from an open redirect vulnerability, permitting an attacker to control the redirection path of end users.

Note: 1E Platform's component utilizing the third-party Duende Identity Server has been updated with the patch that includes the fix.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://www.teamviewer.com/en/resources/trust-center/security-bulletins/1e-2024-2001/
CVE: CVE-2024-7359
Published: 2024-08-01
Description: A vulnerability was found in SourceCodester Tracking Monitoring Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /ajax.php?action=save_establishment. The manipulation of the argument name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-273338 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://gist.github.com/topsky979/6fbd27f1942d76f0392d883dfd8fef10; https://vuldb.com/?ctiid.273338; https://vuldb.com/?id.273338
CVE: CVE-2024-6990
Published: 2024-08-01
Description: Uninitialized Use in Dawn in Google Chrome on Android prior to 127.0.6533.88 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Critical)
CVSS Score: 8.8 (HIGH)
CWE: CWE-457, CWE-908, CWE-457
References: https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_30.html; https://issues.chromium.org/issues/353034820
CVE: CVE-2024-7255
Published: 2024-08-01
Description: Out of bounds read in WebTransport in Google Chrome prior to 127.0.6533.88 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-125, CWE-125, CWE-125
References: https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_30.html; https://issues.chromium.org/issues/352872238
CVE: CVE-2024-7256
Published: 2024-08-01
Description: Insufficient data validation in Dawn in Google Chrome on Android prior to 127.0.6533.88 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-345
References: https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_30.html; https://issues.chromium.org/issues/354748060
CVE: CVE-2024-7360
Published: 2024-08-01
Description: A vulnerability classified as problematic has been found in SourceCodester Tracking Monitoring Management System 1.0. This affects an unknown part of the file /ajax.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273339.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://gist.github.com/topsky979/ac97a335ed9fcf4eefe3c952928a6d0e; https://vuldb.com/?ctiid.273339; https://vuldb.com/?id.273339
CVE: CVE-2024-7361
Published: 2024-08-01
Description: A vulnerability classified as critical was found in SourceCodester Tracking Monitoring Management System 1.0. This vulnerability affects unknown code of the file /ajax.php?action=save_establishment. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273340.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://gist.github.com/topsky979/f01eca07fce854bf5de96588126cdd7e; https://vuldb.com/?ctiid.273340; https://vuldb.com/?id.273340
CVE: CVE-2024-4353
Published: 2024-08-01
Description: Concrete CMS versions 9.0.0 through 9.3.2 are affected by a stored XSS vulnerability in the generate dashboard board
instance functionality. The Name input field does not check the input sufficiently letting a rogue administrator have the capability to inject malicious
JavaScript code. The Concrete CMS security team gave this vulnerability a CVSS v4 score of 4.6 with a vector of CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Concrete versions below 9 are not affected by this vulnerability.Thanks fhAnso for reporting. (CNA updated this risk rank on 17 Jan 2025 by lowering the AC based on CVSS 4.0 documentation that access privileges should not be considered for AC).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-20, CWE-79
References: https://documentation.concretecms.org/9-x/developers/introduction/version-history/933-release-notes; https://github.com/concretecms/concretecms/pull/12151
CVE: CVE-2024-7362
Published: 2024-08-01
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Tracking Monitoring Management System 1.0. This issue affects some unknown processing of the file /manage_user.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273341 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://gist.github.com/topsky979/96f43bd9f1477a56d1c8f8e08f0e5449; https://vuldb.com/?ctiid.273341; https://vuldb.com/?id.273341
CVE: CVE-2024-7363
Published: 2024-08-01
Description: A vulnerability, which was classified as critical, was found in SourceCodester Tracking Monitoring Management System 1.0. Affected is an unknown function of the file /manage_person.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-273342 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://gist.github.com/topsky979/69455a114e8718af6c611c86fbdc78b5; https://vuldb.com/?ctiid.273342; https://vuldb.com/?id.273342
CVE: CVE-2024-7364
Published: 2024-08-01
Description: A vulnerability has been found in SourceCodester Tracking Monitoring Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /manage_records.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273343.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://gist.github.com/topsky979/b507afabd4e3da39e7eca6103435ba3a; https://vuldb.com/?ctiid.273343; https://vuldb.com/?id.273343
CVE: CVE-2024-7365
Published: 2024-08-01
Description: A vulnerability was found in SourceCodester Tracking Monitoring Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /manage_establishment.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273344.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://gist.github.com/topsky979/18a15150a[PII_REDACTED]6d918d79a0bf9; https://vuldb.com/?ctiid.273344; https://vuldb.com/?id.273344
CVE: CVE-2023-52209
Published: 2024-08-01
Description: Improper Privilege Management vulnerability in WPForms, LLC. WPForms User Registration allows Privilege Escalation.This issue affects WPForms User Registration: from n/a through 2.1.0.
CVSS Score: 8.0 (HIGH)
CWE: CWE-269
References: https://patchstack.com/database/vulnerability/wpforms-user-registration/wordpress-wpforms-user-registration-plugin-2-1-0-authenticated-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2024-32863
Published: 2024-08-01
Description: Under certain circumstances the exacqVision Web Services may be susceptible to Cross-Site Request Forgery (CSRF)
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-03; https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories
CVE: CVE-2024-32864
Published: 2024-08-01
Description: Under certain circumstances exacqVision Web Services will not enforce secure web communications (HTTPS)
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-319, CWE-319
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-04; https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories
CVE: CVE-2024-38746
Published: 2024-08-01
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in MakeStories Team MakeStories (for Google Web Stories) allows Path Traversal, Server Side Request Forgery.This issue affects MakeStories (for Google Web Stories): from n/a through 3.0.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/makestories-helper/wordpress-makestories-for-google-web-stories-plugin-3-0-3-arbitrary-file-download-and-ssrf-vulnerability?_s_id=cve
CVE: CVE-2024-38768
Published: 2024-08-01
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Webangon The Pack Elementor addons allows PHP Local File Inclusion, Path Traversal.This issue affects The Pack Elementor addons: from n/a through 2.0.8.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/the-pack-addon/wordpress-the-pack-elementor-addons-plugin-2-0-8-6-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-38770
Published: 2024-08-01
Description: Improper Privilege Management vulnerability in Revmakx Backup and Staging by WP Time Capsule allows Privilege Escalation, Authentication Bypass.This issue affects Backup and Staging by WP Time Capsule: from n/a through 1.22.20.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://patchstack.com/database/vulnerability/wp-time-capsule/wordpress-backup-and-staging-by-wp-time-capsule-plugin-1-22-20-authentication-bypass-and-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2024-38772
Published: 2024-08-01
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Crocoblock JetWidgets for Elementor and WooCommerce allows PHP Local File Inclusion.This issue affects JetWidgets for Elementor and WooCommerce: from n/a through 1.1.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/jetwoo-widgets-for-elementor/wordpress-jetwidgets-for-elementor-and-woocommerce-plugin-1-1-7-contributor-limited-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-38775
Published: 2024-08-01
Description: Improper Privilege Management vulnerability in WebAppick CTX Feed allows Privilege Escalation.This issue affects CTX Feed: from n/a through 6.5.6.
CVSS Score: 7.2 (HIGH)
CWE: CWE-269
References: https://patchstack.com/database/vulnerability/webappick-product-feed-for-woocommerce/wordpress-ctx-feed-plugin-6-5-6-arbitrary-options-update-vulnerability?_s_id=cve
CVE: CVE-2024-38791
Published: 2024-08-01
Description: Server-Side Request Forgery (SSRF) vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot allows Server Side Request Forgery.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 2.4.7.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/vulnerability/ai-engine/wordpress-ai-engine-plugin-2-4-7-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2024-39619
Published: 2024-08-01
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CridioStudio ListingPro listingpro-plugin allows PHP Local File Inclusion.This issue affects ListingPro: from n/a through <= 2.9.4.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/listingpro-plugin/vulnerability/wordpress-listingpro-plugin-2-9-3-unauthenticated-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-39621
Published: 2024-08-01
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CridioStudio ListingPro listingpro-plugin allows PHP Local File Inclusion.This issue affects ListingPro: from n/a through <= 2.9.4.
CVSS Score: 8.0 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/listingpro-plugin/vulnerability/wordpress-listingpro-plugin-2-9-3-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-39624
Published: 2024-08-01
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CridioStudio ListingPro listingpro allows PHP Local File Inclusion.This issue affects ListingPro: from n/a through <= 2.9.4.
CVSS Score: 8.5 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Theme/listingpro/vulnerability/wordpress-listingpro-theme-2-9-3-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-39630
Published: 2024-08-01
Description: Deserialization of Untrusted Data vulnerability in MotoPress Timetable and Event Schedule allows Object Injection.This issue affects Timetable and Event Schedule: from n/a through 2.4.13.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-502
References: https://patchstack.com/database/vulnerability/mp-timetable/wordpress-timetable-and-event-schedule-by-motopress-plugin-2-4-13-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2024-39633
Published: 2024-08-01
Description: Improper Privilege Management vulnerability in IdeaBox PowerPack for Beaver Builder allows Privilege Escalation.This issue affects PowerPack for Beaver Builder: from n/a through 2.33.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://patchstack.com/database/vulnerability/bbpowerpack/wordpress-powerpack-for-beaver-builder-plugin-2-33-0-contributor-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2024-39634
Published: 2024-08-01
Description: Improper Privilege Management vulnerability in IdeaBox PowerPack Pro for Elementor allows Privilege Escalation.This issue affects PowerPack Pro for Elementor: from n/a through 2.10.14.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://patchstack.com/database/vulnerability/powerpack-elements/wordpress-powerpack-pro-for-elementor-plugin-2-10-14-contributor-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2024-41259
Published: 2024-08-01
Description: Use of insecure hashing algorithm in the Gravatar's service in Navidrome v0.52.3 allows attackers to manipulate a user's account information.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-200
References: https://gist.github.com/nyxfqq/d192af10b53a363e2d9e430068333e04
CVE: CVE-2024-7093
Published: 2024-08-01
Description: Dispatch's notification service uses Jinja templates to generate messages to users. Jinja permits code execution within blocks, which were neither properly sanitized nor sandboxed. This vulnerability enables users to construct command line scripts in their custom message templates, which are then executed whenever these notifications are rendered and sent out.
CWE: CWE-94
References: https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2024-003.md
CVE: CVE-2024-7366
Published: 2024-08-01
Description: A vulnerability was found in SourceCodester Tracking Monitoring Management System 1.0. It has been classified as critical. This affects an unknown part of the file /ajax.php?action=login of the component Login. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273345 was assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://gist.github.com/topsky979/c0efd2f3e6e146eb9e110e5e63cb5fbb; https://vuldb.com/?ctiid.273345; https://vuldb.com/?id.273345