deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-43280
Published: 2024-08-19
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Salon Booking System Salon booking system.This issue affects Salon booking system: from n/a through 10.8.1.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://patchstack.com/database/vulnerability/salon-booking-system/wordpress-salon-booking-system-plugin-10-8-1-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2024-43281
Published: 2024-08-19
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in VOID CODERS Void Elementor Post Grid Addon for Elementor Page builder allows PHP Local File Inclusion.This issue affects Void Elementor Post Grid Addon for Elementor Page builder: from n/a through 2.3.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/void-elementor-post-grid-addon-for-elementor-page-builder/wordpress-void-elementor-post-grid-addon-for-elementor-page-builder-plugin-2-3-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-7924
Published: 2024-08-19
Description: A vulnerability was found in ZZCMS 2023. It has been declared as critical. This vulnerability affects unknown code of the file /I/list.php. The manipulation of the argument skin leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://gitee.com/A0kooo/cve_article/blob/master/zzcms/zzcms%20list.php%20Directory%20traversal.md; https://vuldb.com/?ctiid.275110; https://vuldb.com/?id.275110
CVE: CVE-2024-7925
Published: 2024-08-19
Description: A vulnerability was found in ZZCMS 2023. It has been rated as problematic. This issue affects some unknown processing of the file 3/E_bak5.1/upload/eginfo.php. The manipulation of the argument phome with the input ShowPHPInfo leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://gitee.com/A0kooo/cve_article/blob/master/zzcms/information_leak/Zenmus%20ekinfo.php%20had%20an%20information%20leak.md; https://vuldb.com/?ctiid.275111; https://vuldb.com/?id.275111
CVE: CVE-2024-23729
Published: 2024-08-19
Description: The ColorOS Internet Browser com.heytap.browser application 45.10.3.4.1 for Android allows a remote attacker to execute arbitrary JavaScript code via the com.android.browser.RealBrowserActivity component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/actuator/com.heytap.browser; https://play.google.com/store/apps/details?id=com.heytap.browser
CVE: CVE-2024-7592
Published: 2024-08-19
Description: There is a LOW severity vulnerability affecting CPython, specifically the
'http.cookies' standard library module.


When parsing cookies that contained backslashes for quoted characters in
the cookie value, the parser would use an algorithm with quadratic
complexity, resulting in excess CPU resources being used while parsing the
value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-1333
References: https://github.com/python/cpython/commit/391e5626e3ee5af267b97e37abc7475732e67621; https://github.com/python/cpython/commit/44e458357fca05ca0ae2658d62c8c595b048b5ef; https://github.com/python/cpython/commit/a77ab24427a18bff817025adb03ca920dc3f1a06
CVE: CVE-2024-42812
Published: 2024-08-19
Description: In D-Link DIR-860L v2.03, there is a buffer overflow vulnerability due to the lack of length verification for the SID field in gena.cgi. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://gist.github.com/XiaoCurry/574ed9c2b0d12cd0b45399116d82121c; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2024-42813
Published: 2024-08-19
Description: In TRENDnet TEW-752DRU FW1.03B01, there is a buffer overflow vulnerability due to the lack of length verification for the service field in gena.cgi. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://gist.github.com/XiaoCurry/204680035c1efffa27d14956820ad928
CVE: CVE-2024-42815
Published: 2024-08-19
Description: In the TP-Link RE365 V1_180213, there is a buffer overflow vulnerability due to the lack of length verification for the USER_AGENT field in /usr/bin/httpd. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://gist.github.com/XiaoCurry/14d46e0becd79d9bb9907f2fbe147cfe; https://securityonline.info/cve-2024-42815-cvss-9-8-buffer-overflow-flaw-in-tp-link-routers-opens-door-to-rce/
CVE: CVE-2024-43311
Published: 2024-08-19
Description: Improper Privilege Management vulnerability in Geek Code Lab Login As Users allows Privilege Escalation.This issue affects Login As Users: from n/a through 1.4.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://patchstack.com/database/vulnerability/login-as-users/wordpress-login-as-users-plugin-1-4-2-broken-authentication-vulnerability?_s_id=cve
CVE: CVE-2024-43317
Published: 2024-08-19
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Metagauss User Registration Team RegistrationMagic allows Cross-Site Scripting (XSS).This issue affects RegistrationMagic: from n/a through 6.0.1.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/custom-registration-form-builder-with-submission-manager/wordpress-registrationmagic-plugin-6-0-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-43326
Published: 2024-08-19
Description: Missing Authorization vulnerability in Jamie Bergen Plugin Notes Plus allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Plugin Notes Plus: from n/a through 1.2.7.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/plugin-notes-plus/wordpress-plugin-notes-plus-plugin-1-2-7-arbitrary-content-deletion-vulnerability?_s_id=cve
CVE: CVE-2024-43328
Published: 2024-08-19
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPDeveloper EmbedPress allows PHP Local File Inclusion.This issue affects EmbedPress: from n/a through 4.0.9.
CVSS Score: 8.3 (HIGH)
CWE: CWE-22, CWE-22
References: https://patchstack.com/database/vulnerability/embedpress/wordpress-embedpress-plugin-4-0-9-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-43345
Published: 2024-08-19
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PluginOps Landing Page Builder allows PHP Local File Inclusion.This issue affects Landing Page Builder: from n/a through 1.5.2.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/page-builder-add/wordpress-landing-page-builder-plugin-1-5-2-0-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-43354
Published: 2024-08-19
Description: Deserialization of Untrusted Data vulnerability in Saad Iqbal myCred mycred.This issue affects myCred: from n/a through <= 2.7.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/mycred/vulnerability/wordpress-mycred-plugin-2-7-2-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2024-7926
Published: 2024-08-19
Description: A vulnerability classified as critical has been found in ZZCMS 2023. Affected is an unknown function of the file /admin/about_edit.php?action=modify. The manipulation of the argument skin leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-22
References: https://gitee.com/A0kooo/cve_article/blob/master/zzcms/Directory_traversal2/zzcms%20siteinfo.php%20Directory%20traversal.md; https://vuldb.com/?ctiid.275112; https://vuldb.com/?id.275112
CVE: CVE-2024-7927
Published: 2024-08-19
Description: A vulnerability classified as critical was found in ZZCMS 2023. Affected by this vulnerability is an unknown functionality of the file /admin/class.php?dowhat=modifyclass. The manipulation of the argument skin[] leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-22
References: https://gitee.com/A0kooo/cve_article/blob/master/zzcms/Directory_traversal3/zzcms%20class.php%20Directory%20traversal.md; https://vuldb.com/?ctiid.275113; https://vuldb.com/?id.275113
CVE: CVE-2024-7958
Published: 2024-08-19
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-35538
Published: 2024-08-19
Description: Typecho v1.3.0 was discovered to contain a Client IP Spoofing vulnerability, which allows attackers to falsify their IP addresses by specifying an arbitrary IP as value of X-Forwarded-For or Client-Ip headers while performing HTTP requests.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-290, CWE-444
References: https://cyberaz0r.info/2024/08/typecho-multiple-vulnerabilities/; https://typecho.org
CVE: CVE-2024-35539
Published: 2024-08-19
Description: Typecho v1.3.0 was discovered to contain a race condition vulnerability in the post commenting function. This vulnerability allows attackers to post several comments before the spam protection checks if the comments are posted too frequently.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-290
References: https://cyberaz0r.info/2024/08/typecho-multiple-vulnerabilities/; https://typecho.org
CVE: CVE-2024-4785
Published: 2024-08-19
Description: BT: Missing Check in LL_CONNECTION_UPDATE_IND Packet Leads to Division by Zero
CVSS Score: 7.6 (HIGH)
CWE: CWE-369, CWE-369
References: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-xcr5-5g98-mchp
CVE: CVE-2024-7928
Published: 2024-08-19
Description: A vulnerability, which was classified as problematic, has been found in FastAdmin up to 1.3.3.20220121. Affected by this issue is some unknown functionality of the file /index/ajax/lang. The manipulation of the argument lang leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.3.4.20220530 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://vuldb.com/?ctiid.275114; https://vuldb.com/?id.275114; https://vuldb.com/?submit.392202
CVE: CVE-2024-7929
Published: 2024-08-19
Description: A vulnerability, which was classified as problematic, was found in SourceCodester Simple Forum Website 1.0. This affects an unknown part of the file /registration.php of the component Signup Page. The manipulation of the argument username leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/ulayaha/ulayaha.github.io/issues/2; https://vuldb.com/?ctiid.275115; https://vuldb.com/?id.275115
CVE: CVE-2024-7930
Published: 2024-08-19
Description: A vulnerability has been found in SourceCodester Clinics Patient Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /pms/ajax/get_packings.php. The manipulation of the argument medicine_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Pingxy/cve/blob/main/sql.md; https://vuldb.com/?ctiid.275116; https://vuldb.com/?id.275116
CVE: CVE-2024-7931
Published: 2024-08-19
Description: A vulnerability was found in SourceCodester Online Graduate Tracer System 1.0 and classified as critical. This issue affects some unknown processing of the file /tracking/admin/view_csprofile.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Pingxy/cve/blob/main/sql3.md; https://vuldb.com/?ctiid.275117; https://vuldb.com/?id.275117
CVE: CVE-2024-7933
Published: 2024-08-19
Description: A vulnerability was found in itsourcecode Project Expense Monitoring System 1.0. It has been classified as critical. Affected is an unknown function of the file login1.php of the component Backend Login. The manipulation of the argument user leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/DeepMountains/zzz/blob/main/CVE3-1.md; https://vuldb.com/?ctiid.275118; https://vuldb.com/?id.275118
CVE: CVE-2024-7934
Published: 2024-08-19
Description: A vulnerability was found in itsourcecode Project Expense Monitoring System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file execute.php. The manipulation of the argument code leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/DeepMountains/zzz/blob/main/CVE3-2.md; https://vuldb.com/?ctiid.275119; https://vuldb.com/?id.275119
CVE: CVE-2024-7935
Published: 2024-08-19
Description: A vulnerability was found in itsourcecode Project Expense Monitoring System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file print.php. The manipulation of the argument map_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/DeepMountains/zzz/blob/main/CVE3-3.md; https://vuldb.com/?ctiid.275120; https://vuldb.com/?id.275120
CVE: CVE-2024-7305
Published: 2024-08-20
Description: A maliciously crafted DWF file, when parsed in AdDwfPdk.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0014
CVE: CVE-2024-7936
Published: 2024-08-20
Description: A vulnerability classified as critical has been found in itsourcecode Project Expense Monitoring System 1.0. This affects an unknown part of the file transferred_report.php. The manipulation of the argument start/end/employee leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/DeepMountains/zzz/blob/main/CVE3-4.md; https://vuldb.com/?ctiid.275121; https://vuldb.com/?id.275121
CVE: CVE-2024-7937
Published: 2024-08-20
Description: A vulnerability classified as critical was found in itsourcecode Project Expense Monitoring System 1.0. This vulnerability affects unknown code of the file printtransfer.php. The manipulation of the argument transfer_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/DeepMountains/zzz/blob/main/CVE3-5.md; https://vuldb.com/?ctiid.275122; https://vuldb.com/?id.275122
CVE: CVE-2024-7942
Published: 2024-08-20
Description: A vulnerability has been found in SourceCodester Leads Manager Tool 1.0 and classified as problematic. This vulnerability affects unknown code of the file update-leads.php. The manipulation of the argument phone_number leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/jadu101/CVE/blob/main/SourceCodester_Lead_Manager_Tool_Update_Leads_XSS.md; https://vuldb.com/?ctiid.275134; https://vuldb.com/?id.275134
CVE: CVE-2024-7943
Published: 2024-08-20
Description: A vulnerability was found in itsourcecode Laravel Property Management System 1.0 and classified as critical. This issue affects the function upload of the file PropertiesController.php. The manipulation of the argument file leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/DeepMountains/zzz/blob/main/CVE2-1.md; https://vuldb.com/?ctiid.275135; https://vuldb.com/?id.275135
CVE: CVE-2024-5932
Published: 2024-08-20
Description: The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'give_title' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code remotely, and to delete arbitrary files.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://plugins.trac.wordpress.org/browser/give/tags/3.12.0/includes/login-register.php#L235; https://plugins.trac.wordpress.org/browser/give/tags/3.12.0/includes/process-donation.php#L420; https://plugins.trac.wordpress.org/browser/give/tags/3.12.0/src/DonorDashboards/Tabs/EditProfileTab/AvatarRoute.php#L51
CVE: CVE-2024-5939
Published: 2024-08-20
Description: The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'setup_wizard' function in all versions up to, and including, 3.13.0. This makes it possible for unauthenticated attackers to read the setup wizard administrative pages.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/give/tags/3.12.0/src/Onboarding/Wizard/Page.php#L78; https://plugins.trac.wordpress.org/changeset/3120745/; https://www.wordfence.com/threat-intel/vulnerabilities/id/a104f88b-deae-465d-b4c1-9a1fc78e5ee9?source=cve
CVE: CVE-2024-5940
Published: 2024-08-20
Description: The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'handle_request' function in all versions up to, and including, 3.13.0. This makes it possible for unauthenticated attackers to edit event ticket settings if the Events beta feature is enabled.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/give/tags/3.12.0/src/EventTickets/Routes/UpdateEvent.php#L81; https://plugins.trac.wordpress.org/browser/give/tags/3.12.0/src/EventTickets/Routes/UpdateEventTicketType.php#L78; https://plugins.trac.wordpress.org/changeset/3120745/
CVE: CVE-2024-5941
Published: 2024-08-20
Description: The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access and deletion of data due to a missing capability check on the 'handle_request' function in all versions up to, and including, 3.14.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read attachment paths and delete attachment files.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/give/tags/3.12.0/src/DonorDashboards/Tabs/EditProfileTab/AvatarRoute.php#L36; https://plugins.trac.wordpress.org/changeset/3132247/; https://www.wordfence.com/threat-intel/vulnerabilities/id/824ec2ba-b701-46e9-b237-53cd7d0e46da?source=cve
CVE: CVE-2024-7827
Published: 2024-08-20
Description: The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to boolean-based SQL Injection via the ‘model_number’ parameter in all versions up to, and including, 5.7.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/wp-easycart/trunk/wpeasycart.php#L8821; https://plugins.trac.wordpress.org/changeset/3136347/; https://wordpress.org/plugins/wp-easycart/#developers
CVE: CVE-2024-7850
Published: 2024-08-20
Description: The BP Profile Search plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.7.5. This is due to missing or incorrect nonce validation on the bps_ajax_field_selector(), bps_ajax_template_options(), and bps_ajax_field_row() functions. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/bp-profile-search/trunk/bps-admin.php#L160; https://plugins.trac.wordpress.org/changeset/3136686/; https://plugins.trac.wordpress.org/changeset/3137271/bp-profile-search/tags/5.8/bps-admin.php
CVE: CVE-2024-7944
Published: 2024-08-20
Description: A vulnerability was found in itsourcecode Laravel Property Management System 1.0. It has been classified as critical. Affected is the function UpdateDocumentsRequest of the file DocumentsController.php. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/DeepMountains/zzz/blob/main/CVE2-2.md; https://vuldb.com/?ctiid.275136; https://vuldb.com/?id.275136
CVE: CVE-2024-7945
Published: 2024-08-20
Description: A vulnerability was found in itsourcecode Laravel Property Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/notes/create of the component Notes Page. The manipulation of the argument Note text leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/DeepMountains/zzz/blob/main/CVE2-3.md; https://vuldb.com/?ctiid.275137; https://vuldb.com/?id.275137
CVE: CVE-2024-7946
Published: 2024-08-20
Description: A vulnerability was found in itsourcecode Online Blood Bank Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file register.php of the component User Signup. The manipulation of the argument user leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/a[PII_REDACTED]/cve/issues/1; https://vuldb.com/?ctiid.275138; https://vuldb.com/?id.275138
CVE: CVE-2024-7947
Published: 2024-08-20
Description: A vulnerability classified as critical has been found in SourceCodester Point of Sales and Inventory Management System 1.0. This affects an unknown part of the file login.php. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/CveSecLook/cve/issues/60; https://vuldb.com/?ctiid.275139; https://vuldb.com/?id.275139