deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-25972
Published: 2024-03-01
Description: Initialization of a resource with an insecure default vulnerability in OET-213H-BTS1 sold in Japan by Atsumi Electric Co., Ltd. allows a network-adjacent unauthenticated attacker to configure and control the affected product.
CVSS Score: 8.3 (HIGH)
CWE: CWE-1188
References: https://jvn.jp/en/jp/JVN77203800/; https://www.atsumi.co.jp/info-20240229.html; https://www.atsumi.co.jp/pdf/oet-213h-bts1.pdf
CVE: CVE-2024-22457
Published: 2024-03-01
Description: Dell Secure Connect Gateway 5.20 contains an improper authentication vulnerability during the SRS to SCG update path. A remote low privileged attacker could potentially exploit this vulnerability, leading to impersonation of the server through presenting a fake self-signed certificate and communicating with the remote server.
CVSS Score: 7.1 (HIGH)
CWE: CWE-290
References: https://www.dell.com/support/kbdoc/en-us/000222433/dsa-2024-076-security-update-for-dell-secure-connect-gateway-appliance-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000222433/dsa-2024-076-security-update-for-dell-secure-connect-gateway-appliance-vulnerabilities
CVE: CVE-2024-22458
Published: 2024-03-01
Description: Dell Secure Connect Gateway, 5.18, contains an Inadequate Encryption Strength Vulnerability. An unauthenticated network attacker could potentially exploit this vulnerability, allowing an attacker to recover plaintext from a block of ciphertext.
CVSS Score: 3.7 (LOW)
CWE: CWE-327
References: https://www.dell.com/support/kbdoc/en-us/000222433/dsa-2024-076-security-update-for-dell-secure-connect-gateway-appliance-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000222433/dsa-2024-076-security-update-for-dell-secure-connect-gateway-appliance-vulnerabilities
CVE: CVE-2024-26280
Published: 2024-03-01
Description: Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers users to view all information on audit logs, including dag names and usernames they were not permitted to view. With 2.8.2 and newer, Ops and Viewer users do not have audit log permission by default, they need to be explicitly granted permissions to see the logs. Only admin users have audit log permission by default.

Users of Apache Airflow are recommended to upgrade to version 2.8.2 or newer to mitigate the risk associated with this vulnerability
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-276
References: http://www.openwall.com/lists/oss-security/2024/03/01/1; https://github.com/apache/airflow/pull/37501; https://lists.apache.org/thread/knskxxxml95091rsnpxkpo1jjp8rj0fh
CVE: CVE-2024-2058
Published: 2024-03-01
Description: A vulnerability was found in SourceCodester Petrol Pump Management Software 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/app/product.php. The manipulation of the argument photo leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-255373 was assigned to this vulnerability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-434
References: https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Petrol%20pump%20management%20software/Unauthenticated%20Arbitrary%20File%20Upload.md; https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/Surya2Developer%20Online_shopping_-system/SOURCECODESTER%20Petrol%20pump%20management%20software/Unauthenticated%20Arbitrary%20File%20Upload.md; https://vuldb.com/?ctiid.255373
CVE: CVE-2024-2057
Published: 2024-03-01
Description: A vulnerability was found in LangChain langchain_community 0.0.26. It has been classified as critical. Affected is the function load_local in the library libs/community/langchain_community/retrievers/tfidf.py of the component TFIDFRetriever. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.0.27 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-255372.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/bayuncao/vul-cve-16; https://github.com/bayuncao/vul-cve-16/tree/main/PoC.pkl; https://github.com/langchain-ai/langchain/pull/18695
CVE: CVE-2024-2059
Published: 2024-03-01
Description: A vulnerability was found in SourceCodester Petrol Pump Management Software 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/app/service_crud.php. The manipulation of the argument photo leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-255374 is the identifier assigned to this vulnerability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-434
References: https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Petrol%20pump%20management%20software/service_crud.php%20Unauthenticated%20Arbitrary%20File%20Upload.md; https://vuldb.com/?ctiid.255374; https://vuldb.com/?id.255374
CVE: CVE-2024-2078
Published: 2024-03-01
Description: A Cross-Site Scripting (XSS) vulnerability has been found in HelpDeskZ affecting version 2.0.2 and earlier. This vulnerability could allow an attacker to send a specially crafted JavaScript payload within the email field and partially take control of an authenticated user's browser session.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-helpdeskz; https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-helpdeskz
CVE: CVE-2023-39254
Published: 2024-03-01
Description: Dell Update Package (DUP), Versions prior to 4.9.10 contain an Uncontrolled Search Path vulnerability. A malicious user with local access to the system could potentially exploit this vulnerability to run arbitrary code as admin.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427
References: https://www.dell.com/support/kbdoc/en-us/000217701/dsa-2023-338-security-update-for-a-dell-update-package-dup-framework-vulnerability; https://www.dell.com/support/kbdoc/en-us/000217701/dsa-2023-338-security-update-for-a-dell-update-package-dup-framework-vulnerability
CVE: CVE-2023-48674
Published: 2024-03-01
Description: Dell Platform BIOS contains an Improper Null Termination vulnerability. A high privilege user with network access to the system could potentially send malicious data to the device in order to cause some services to cease to function.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-170
References: https://www.dell.com/support/kbdoc/en-us/000220410/dsa-2023-467; https://www.dell.com/support/kbdoc/en-us/000220410/dsa-2023-467
CVE: CVE-2024-24900
Published: 2024-03-01
Description: Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain an improper authorization vulnerability. An adjacent network low privileged attacker could potentially exploit this vulnerability, leading to unauthorized devices added to policies. Exploitation may lead to information disclosure and unauthorized access to the system.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-285
References: https://www.dell.com/support/kbdoc/en-us/000222330/dsa-2024-077-security-update-for-dell-secure-connect-gateway-policy-manager-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000222330/dsa-2024-077-security-update-for-dell-secure-connect-gateway-policy-manager-vulnerabilities
CVE: CVE-2024-24906
Published: 2024-03-01
Description: Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability in Policy page. An adjacent network high privileged attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted application data store. When a victim user accesses the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery.
CVSS Score: 7.6 (HIGH)
CWE: CWE-79
References: https://www.dell.com/support/kbdoc/en-us/000222330/dsa-2024-077-security-update-for-dell-secure-connect-gateway-policy-manager-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000222330/dsa-2024-077-security-update-for-dell-secure-connect-gateway-policy-manager-vulnerabilities
CVE: CVE-2024-2060
Published: 2024-03-01
Description: A vulnerability classified as critical has been found in SourceCodester Petrol Pump Management Software 1.0. This affects an unknown part of the file /admin/app/login_crud.php. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-255375.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Petrol%20pump%20management%20software/login_crud.php%20SQL%20Injection.md; https://vuldb.com/?ctiid.255375; https://vuldb.com/?id.255375
CVE: CVE-2024-2061
Published: 2024-03-01
Description: A vulnerability classified as critical was found in SourceCodester Petrol Pump Management Software 1.0. This vulnerability affects unknown code of the file /admin/edit_supplier.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-255376.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Petrol%20pump%20management%20software/edit_supplier.php%20SQL%20Injection.md; https://vuldb.com/?ctiid.255376; https://vuldb.com/?id.255376
CVE: CVE-2024-2062
Published: 2024-03-01
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Petrol Pump Management Software 1.0. This issue affects some unknown processing of the file /admin/edit_categories.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-255377 was assigned to this vulnerability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Petrol%20pump%20management%20software/edit_categories.php%20SQL%20Injection.md; https://vuldb.com/?ctiid.255377; https://vuldb.com/?id.255377
CVE: CVE-2024-2063
Published: 2024-03-01
Description: A vulnerability, which was classified as problematic, was found in SourceCodester Petrol Pump Management Software 1.0. Affected is an unknown function of the file /admin/app/profile_crud.php. The manipulation of the argument username leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-255378 is the identifier assigned to this vulnerability.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Petrol%20pump%20management%20software/profile_crud.php%20Unauthenticated%20STORED%20XSS.md; https://vuldb.com/?ctiid.255378; https://vuldb.com/?id.255378
CVE: CVE-2023-46950
Published: 2024-03-01
Description: Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to obtain sensitive information via a crafted URL to the filter functions.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/mhenrixon/sidekiq-unique-jobs/pull/829; https://github.com/mhenrixon/sidekiq-unique-jobs/releases/tag/v8.0.7; https://github.com/mhenrixon/sidekiq-unique-jobs/security/advisories/GHSA-cmh9-rx85-xj38
CVE: CVE-2023-46951
Published: 2024-03-01
Description: Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to obtain sensitive information via a crafted payload to the uniquejobs function.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/mhenrixon/sidekiq-unique-jobs/pull/829; https://github.com/mhenrixon/sidekiq-unique-jobs/releases/tag/v8.0.7; https://github.com/mhenrixon/sidekiq-unique-jobs/security/advisories/GHSA-cmh9-rx85-xj38
CVE: CVE-2023-52497
Published: 2024-03-01
Description: In the Linux kernel, the following vulnerability has been resolved:

erofs: fix lz4 inplace decompression

Currently EROFS can map another compressed buffer for inplace
decompression, that was used to handle the cases that some pages of
compressed data are actually not in-place I/O.

However, like most simple LZ77 algorithms, LZ4 expects the compressed
data is arranged at the end of the decompressed buffer and it
explicitly uses memmove() to handle overlapping:
  __________________________________________________________
 |_ direction of decompression --> ____ |_ compressed data _|

Although EROFS arranges compressed data like this, it typically maps two
individual virtual buffers so the relative order is uncertain.
Previously, it was hardly observed since LZ4 only uses memmove() for
short overlapped literals and x86/arm64 memmove implementations seem to
completely cover it up and they don't have this issue.  Juhyung reported
that EROFS data corruption can be found on a new Intel x86 processor.
After some analysis, it seems that recent x86 processors with the new
FSRM feature expose this issue with "rep movsb".

Let's strictly use the decompressed buffer for lz4 inplace
decompression for now.  Later, as an useful improvement, we could try
to tie up these two buffers together in the correct order.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-787
References: https://git.kernel.org/stable/c/33bf23c9940dbd3a22aad7f0cda4c84ed5701847; https://git.kernel.org/stable/c/3c12466b6b7bf1e56f9b32c366a3d83d87afb4de; https://git.kernel.org/stable/c/77cbc04a1a8610e303a0e0d74f[PII_REDACTED]a184
CVE: CVE-2024-24903
Published: 2024-03-01
Description: Dell Secure Connect Gateway (SCG) Policy Manager, version 5.10+, contain a weak password recovery mechanism for forgotten passwords. An adjacent network low privileged attacker could potentially exploit this vulnerability, leading to unauthorized access to the application with privileges of the compromised account. The attacker could retrieve the reset password token without authorization and then perform the password change.
CVSS Score: 8.0 (HIGH)
CWE: CWE-640
References: https://www.dell.com/support/kbdoc/en-us/000222330/dsa-2024-077-security-update-for-dell-secure-connect-gateway-policy-manager-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000222330/dsa-2024-077-security-update-for-dell-secure-connect-gateway-policy-manager-vulnerabilities
CVE: CVE-2024-24904
Published: 2024-03-01
Description: Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability. An adjacent network high privileged attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted application data store. When a victim user accesses the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery.
CVSS Score: 7.6 (HIGH)
CWE: CWE-79
References: https://www.dell.com/support/kbdoc/en-us/000222330/dsa-2024-077-security-update-for-dell-secure-connect-gateway-policy-manager-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000222330/dsa-2024-077-security-update-for-dell-secure-connect-gateway-policy-manager-vulnerabilities
CVE: CVE-2024-24905
Published: 2024-03-01
Description: Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability. An adjacent network high privileged attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted application data store. When a victim user accesses the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery.
CVSS Score: 7.6 (HIGH)
CWE: CWE-79
References: https://www.dell.com/support/kbdoc/en-us/000222330/dsa-2024-077-security-update-for-dell-secure-connect-gateway-policy-manager-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000222330/dsa-2024-077-security-update-for-dell-secure-connect-gateway-policy-manager-vulnerabilities
CVE: CVE-2024-24907
Published: 2024-03-01
Description: Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability in the Filters page. An adjacent network high privileged attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted application data store. When a victim user accesses the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery.
CVSS Score: 7.6 (HIGH)
CWE: CWE-79
References: https://www.dell.com/support/kbdoc/en-us/000222330/dsa-2024-077-security-update-for-dell-secure-connect-gateway-policy-manager-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000222330/dsa-2024-077-security-update-for-dell-secure-connect-gateway-policy-manager-vulnerabilities
CVE: CVE-2024-27567
Published: 2024-03-01
Description: LBT T300- T390 v2.2.1.8 were discovered to contain a stack overflow via the vpn_client_ip parameter in the config_vpn_pptp function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121
References: https://github.com/cvdyfbwa/IoT_LBT_Router/blob/main/config_vpn_pptp.md; https://github.com/cvdyfbwa/IoT_LBT_Router/blob/main/config_vpn_pptp.md
CVE: CVE-2024-27568
Published: 2024-03-01
Description: LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the apn_name_3g parameter in the setupEC20Apn function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121
References: https://github.com/cvdyfbwa/IoT_LBT_Router/blob/main/setupEC20Apn.md; https://github.com/cvdyfbwa/IoT_LBT_Router/blob/main/setupEC20Apn.md
CVE: CVE-2024-27569
Published: 2024-03-01
Description: LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the ApCliSsid parameter in the init_nvram function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121
References: https://github.com/cvdyfbwa/IoT_LBT_Router/blob/main/init_nvram.md; https://github.com/cvdyfbwa/IoT_LBT_Router/blob/main/init_nvram.md
CVE: CVE-2024-27570
Published: 2024-03-01
Description: LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the ApCliSsid parameter in the generate_conf_router function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-121
References: https://github.com/cvdyfbwa/IoT_LBT_Router/blob/main/generate_conf_router.md; https://github.com/cvdyfbwa/IoT_LBT_Router/blob/main/generate_conf_router.md
CVE: CVE-2024-27571
Published: 2024-03-01
Description: LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the ApCliSsid parameter in the makeCurRemoteApList function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://github.com/cvdyfbwa/IoT_LBT_Router/blob/main/makeCurRemoteApList.md; https://github.com/cvdyfbwa/IoT_LBT_Router/blob/main/makeCurRemoteApList.md
CVE: CVE-2024-27572
Published: 2024-03-01
Description: LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the ApCliSsid parameter in the updateCurAPlist function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://github.com/cvdyfbwa/IoT_LBT_Router/blob/main/updateCurAPlist.md; https://github.com/cvdyfbwa/IoT_LBT_Router/blob/main/updateCurAPlist.md
CVE: CVE-2024-2064
Published: 2024-03-01
Description: A vulnerability has been found in rahman SelectCours 1.0 and classified as problematic. Affected by this vulnerability is the function getCacheNames of the file CacheController.java of the component Template Handler. The manipulation of the argument fragment leads to injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-255379.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-74
References: https://github.com/Andriesces/SelectCours-_Sever-side-Template-injection/blob/main/README.md; https://vuldb.com/?ctiid.255379; https://vuldb.com/?id.255379
CVE: CVE-2023-50378
Published: 2024-03-01
Description: Lack of proper input validation and constraint enforcement in Apache Ambari prior to 2.7.8  

 Impact : As it will be stored XSS, Could be exploited to perform unauthorized actions, varying from data access to session hijacking and delivering malicious payloads. 

Users are recommended to upgrade to version  2.7.8 which fixes this issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://lists.apache.org/thread/6hn0thq743vz9gh283s2d87wz8tqh37c; http://www.openwall.com/lists/oss-security/2024/03/01/5; https://lists.apache.org/thread/6hn0thq743vz9gh283s2d87wz8tqh37c
CVE: CVE-2024-0967
Published: 2024-03-01
Description: A potential vulnerability has been identified in OpenText / Micro Focus ArcSight Enterprise Security Manager (ESM). The vulnerability could be remotely exploited.
CVSS Score: 4.3 (MEDIUM)
References: https://portal.microfocus.com/s/article/KM000027060; https://portal.microfocus.com/s/article/KM000027060
CVE: CVE-2024-27497
Published: 2024-03-01
Description: Linksys E2000 Ver.1.0.06 build 1 is vulnerable to authentication bypass via the position.js file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://warp-desk-89d.notion.site/Linksys-E-2000-efcd532d8dcf4710a4af13fca131a5b8; https://warp-desk-89d.notion.site/Linksys-E-2000-efcd532d8dcf4710a4af13fca131a5b8
CVE: CVE-2024-2065
Published: 2024-03-01
Description: A vulnerability was found in SourceCodester Barangay Population Monitoring System up to 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /endpoint/update-resident.php. The manipulation of the argument full_name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-255380.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Barangay%20Population%20Monitoring%20System/Stored%20XSS%20update-resident.php%20.md; https://vuldb.com/?ctiid.255380; https://vuldb.com/?id.255380
CVE: CVE-2024-2066
Published: 2024-03-01
Description: A vulnerability was found in SourceCodester Computer Inventory System 1.0. It has been classified as problematic. This affects an unknown part of the file /endpoint/add-computer.php. The manipulation of the argument model leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-255381 was assigned to this vulnerability.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Computer%20Inventory%20System%20Using%20PHP/STORED%20XSS%20add-computer.php%20.md; https://vuldb.com/?ctiid.255381; https://vuldb.com/?id.255381