deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-41901
Published: 2023-09-15
Description: Rejected reason: Further research determined the issue is not a vulnerability.
CVE: CVE-2023-42439
Published: 2023-09-15
Description: GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. A SSRF vulnerability exists starting in version 3.2.0, bypassing existing controls on the software. This can allow a user to request internal services for a full read SSRF, returning any data from the internal network. The application is using a whitelist, but the whitelist can be bypassed. The bypass will trick the application that the first host is a whitelisted address, but the browser will use `@` or `%40` as a credential to the host geoserver on port 8080, this will return the data to that host on the response. Version 4.1.3.post1 is the first available version that contains a patch.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://github.com/GeoNode/geonode/commit/79ac6e70419c2e0261548bed91c159b54ff35b8d; https://github.com/GeoNode/geonode/releases/tag/4.1.3; https://github.com/GeoNode/geonode/security/advisories/GHSA-pxg5-h34r-7q8p
CVE: CVE-2023-42442
Published: 2023-09-15
Description: JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, OSS, or other cloud storage are not affected. The api `/api/v1/terminal/sessions/` permission control is broken and can be accessed anonymously. SessionViewSet permission classes set to `[RBACPermission | IsSessionAssignee]`, relation is or, so any permission matched will be allowed. Versions 3.5.5 and 3.6.4 have a fix. After upgrading, visit the api `$HOST/api/v1/terminal/sessions/?limit=1`. The expected http response code is 401 (`not_authenticated`).

CVSS Score: 8.2 (HIGH)
CWE: CWE-287, CWE-287
References: https://github.com/jumpserver/jumpserver/blob/v3.6.1/apps/terminal/api/session/session.py#L91; https://github.com/jumpserver/jumpserver/commit/0a58bba59cd275bab8e0ae58bf4b359fbc5eb74a; https://github.com/jumpserver/jumpserver/security/advisories/GHSA-633x-3f4f-v9rw
CVE: CVE-2023-36562
Published: 2023-09-15
Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVSS Score: 7.1 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36562; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36562; https://security.gentoo.org/glsa/202402-05
CVE: CVE-2023-36727
Published: 2023-09-15
Description: Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVSS Score: 6.1 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36727; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36727; https://security.gentoo.org/glsa/202402-05
CVE: CVE-2023-36735
Published: 2023-09-15
Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36735; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36735; https://security.gentoo.org/glsa/202402-05
CVE: CVE-2023-41626
Published: 2023-09-15
Description: Gradio v3.27.0 was discovered to contain an arbitrary file upload vulnerability via the /upload interface.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-434
References: https://gist.github.com/impose1/590472eb0544ef1ec36c8a5a40122adb; https://gist.github.com/impose1/590472eb0544ef1ec36c8a5a40122adb
CVE: CVE-2023-36160
Published: 2023-09-16
Description: An issue was discovered in Qubo Smart Plug10A version HSP02_01_01_14_SYSTEM-10 A, allows local attackers to gain sensitive information and other unspecified impact via UART console.
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/Yashodhanvivek/Qubo_smart_switch_security_assessment/blob/main/Qubo_Smart_Plug_10A_Security_Assessment.pdf; https://github.com/Yashodhanvivek/Qubo_smart_switch_security_assessment/blob/main/Qubo_Smart_Plug_10A_Security_Assessment.pdf
CVE: CVE-2023-41436
Published: 2023-09-16
Description: Cross Site Scripting vulnerability in CSZCMS v.1.3.0 allows a local attacker to execute arbitrary code via a crafted script to the Additional Meta Tag parameter in the Pages Content Menu component.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/sromanhu/CSZ-CMS-Stored-XSS---Pages-Content/blob/main/README.md; https://github.com/sromanhu/CSZ-CMS-Stored-XSS---Pages-Content/blob/main/README.md
CVE: CVE-2023-39612
Published: 2023-09-16
Description: A cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated attacker to escalate privileges to Administrator via user interaction with a crafted HTML file or URL.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79
References: https://febin0x4e4a.wordpress.com/2023/09/15/xss-in-filebrowser-leads-to-admin-account-takeover-in-filebrowser/; https://github.com/filebrowser/filebrowser/commit/b508ac3d4f7f0f75d6b49c99bdc661a6d2173f30; https://github.com/filebrowser/filebrowser/issues/2570
CVE: CVE-2023-39777
Published: 2023-09-16
Description: A cross-site scripting (XSS) vulnerability in the Admin Control Panel of vBulletin 5.7.5 and 6.0.0 allows attackers to execute arbitrary web scripts or HTML via the /login.php?do=login url parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/GiongfNef/8fe658dce4c7fcf3a7b4e6387e50141c; https://gist.github.com/GiongfNef/8fe658dce4c7fcf3a7b4e6387e50141c
CVE: CVE-2023-42336
Published: 2023-09-16
Description: An issue in NETIS SYSTEMS WF2409Ev4 v.1.0.1.705 allows a remote attacker to execute arbitrary code and obtain sensitive information via the password parameter in the /etc/shadow.sample component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://github.com/adhikara13/CVE/blob/main/netis_WF2409E/Root_Hard_Code.md; https://github.com/adhikara13/CVE/blob/main/netis_WF2409E/Root_Hard_Code.md
CVE: CVE-2023-4994
Published: 2023-09-16
Description: The Allow PHP in Posts and Pages plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.0.4 via the 'php' shortcode. This allows authenticated attackers with subscriber-level permissions or above, to execute code on the server.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-94
References: https://plugins.trac.wordpress.org/browser/allow-php-in-posts-and-pages/trunk/allowphp.php#L373; https://www.wordfence.com/threat-intel/vulnerabilities/id/3d8b4bb6-3715-40c1-8140-7fcf874ccec3?source=cve; https://plugins.trac.wordpress.org/browser/allow-php-in-posts-and-pages/trunk/allowphp.php#L373
CVE: CVE-2023-5001
Published: 2023-09-16
Description: The Horizontal scrolling announcement plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'horizontal-scrolling' shortcode in versions up to, and including, 9.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/horizontal-scrolling-announcement/trunk/horizontal-scrolling-announcement.php#L389; https://www.wordfence.com/threat-intel/vulnerabilities/id/d4f60e8c-2745-4930-9101-914bd73c6e1c?source=cve; https://plugins.trac.wordpress.org/browser/horizontal-scrolling-announcement/trunk/horizontal-scrolling-announcement.php#L389
CVE: CVE-2023-41157
Published: 2023-09-16
Description: Multiple stored cross-site scripting (XSS) vulnerabilities in Usermin 2.000 allow remote attackers to inject arbitrary web script or HTML via the folder name parameter while creating the folder to manage the folder tab, filter tab, and forward mail tab.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/shindeanik/Usermin-2.000/blob/main/CVE-2023-41157; https://webmin.com/tags/webmin-changelog/; https://github.com/shindeanik/Usermin-2.000/blob/main/CVE-2023-41157
CVE: CVE-2023-3025
Published: 2023-09-16
Description: The Dropbox Folder Share plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.9.7 via the 'link' parameter. This can allow unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
CVSS Score: 7.2 (HIGH)
CWE: CWE-918
References: https://plugins.trac.wordpress.org/browser/dropbox-folder-share/trunk/HynoTech/DropboxFolderShare/Principal.php#L118; https://www.wordfence.com/threat-intel/vulnerabilities/id/d62bd2bd-db01-479f-89e4-8031d69a912f?source=cve; https://plugins.trac.wordpress.org/browser/dropbox-folder-share/trunk/HynoTech/DropboxFolderShare/Principal.php#L118
CVE: CVE-2023-5012
Published: 2023-09-16
Description: A vulnerability, which was classified as problematic, was found in Topaz OFD 2.11.0.201. This affects an unknown part of the file C:\Program Files\Topaz OFD\Warsaw\core.exe of the component Protection Module Warsaw. The manipulation leads to unquoted search path. Attacking locally is a requirement. Upgrading to version 2.12.0.259 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-239853 was assigned to this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-428
References: https://vuldb.com/?ctiid.239853; https://vuldb.com/?id.239853; https://vuldb.com/?ctiid.239853
CVE: CVE-2023-5013
Published: 2023-09-16
Description: A vulnerability has been found in Pluck CMS 4.7.18 and classified as problematic. This vulnerability affects unknown code of the file install.php of the component Installation Handler. The manipulation of the argument contents with the input <script>alert('xss')</script> leads to cross site scripting. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-239854 is the identifier assigned to this vulnerability.
CVSS Score: 2.6 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/Jacky-Y/vuls/blob/main/vul3.md; https://vuldb.com/?ctiid.239854; https://vuldb.com/?id.239854
CVE: CVE-2023-5014
Published: 2023-09-17
Description: A vulnerability was found in Sakshi2610 Food Ordering Website 1.0 and classified as critical. This issue affects some unknown processing of the file categoryfood.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-239855.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/TheCyberDiver/Public-Disclosures-CVE-/blob/main/Food-Ordering-Website%20SQLi.md; https://vuldb.com/?ctiid.239855; https://vuldb.com/?id.239855
CVE: CVE-2023-5015
Published: 2023-09-17
Description: A vulnerability was found in UCMS 1.4.7. It has been classified as problematic. Affected is an unknown function of the file ajax.php?do=strarraylist. The manipulation of the argument strdefault leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-239856.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/Num-Nine/CVE/issues/3; https://vuldb.com/?ctiid.239856; https://vuldb.com/?id.239856
CVE: CVE-2023-5016
Published: 2023-09-17
Description: A vulnerability was found in spider-flow up to 0.5.0. It has been declared as critical. Affected by this vulnerability is the function DriverManager.getConnection of the file src/main/java/org/spiderflow/controller/DataSourceController.java of the component API. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-239857 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-502
References: https://github.com/bayuncao/vul-cve; https://github.com/bayuncao/vul-cve/blob/main/spider-flow%20fastjson%20jdbc%20deserialization; https://vuldb.com/?ctiid.239857
CVE: CVE-2023-5017
Published: 2023-09-17
Description: A vulnerability was found in lmxcms up to 1.41. It has been rated as critical. Affected by this issue is some unknown functionality of the file admin.php. The manipulation of the argument lid leads to sql injection. VDB-239858 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.239858; https://vuldb.com/?id.239858; https://vuldb.com/?ctiid.239858
CVE: CVE-2023-5018
Published: 2023-09-17
Description: A vulnerability classified as critical has been found in SourceCodester Lost and Found Information System 1.0. This affects an unknown part of the file /classes/Master.php?f=save_category of the component POST Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-239859.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.239859; https://vuldb.com/?id.239859; https://vuldb.com/?ctiid.239859
CVE: CVE-2023-5019
Published: 2023-09-17
Description: A vulnerability classified as critical was found in Tongda OA. This vulnerability affects unknown code of the file general/hr/manage/staff_reinstatement/delete.php. The manipulation of the argument REINSTATEMENT_ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-239860.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/ggg48966/cve/blob/main/sql.md; https://vuldb.com/?ctiid.239860; https://vuldb.com/?id.239860
CVE: CVE-2023-38040
Published: 2023-09-17
Description: A reflected XSS vulnerability exists in Revive Adserver 5.4.1 and earlier versions..
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://hackerone.com/reports/1694171; https://hackerone.com/reports/1694171
CVE: CVE-2023-5020
Published: 2023-09-17
Description: A vulnerability, which was classified as critical, has been found in 07FLY CRM V2. This issue affects some unknown processing of the file /index.php/sysmanage/Login/login_auth/ of the component Administrator Login Page. The manipulation of the argument account leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-239861 was assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/chosir/exp/tree/main; https://vuldb.com/?ctiid.239861; https://vuldb.com/?id.239861
CVE: CVE-2023-5021
Published: 2023-09-17
Description: A vulnerability, which was classified as problematic, was found in SourceCodester AC Repair and Services System 1.0. Affected is an unknown function of the file admin/?page=system_info/contact_information. The manipulation of the argument telephone/mobile/address leads to cross site scripting. It is possible to launch the attack remotely. VDB-239862 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.239862; https://vuldb.com/?id.239862; https://vuldb.com/?ctiid.239862
CVE: CVE-2023-5022
Published: 2023-09-17
Description: A vulnerability has been found in DedeCMS up to 5.7.100 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /include/dialog/select_templets_post.php. The manipulation of the argument activepath leads to absolute path traversal. The associated identifier of this vulnerability is VDB-239863.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-36
References: https://github.com/bayuncao/DEDEcms; https://vuldb.com/?ctiid.239863; https://vuldb.com/?id.239863
CVE: CVE-2023-5023
Published: 2023-09-17
Description: A vulnerability was found in Tongda OA 2017 and classified as critical. Affected by this issue is some unknown functionality of the file general/hr/manage/staff_relatives/delete.php. The manipulation of the argument RELATIVES_ID leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-239864.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/RCEraser/cve/blob/main/sql_inject_3.md; https://vuldb.com/?ctiid.239864; https://vuldb.com/?id.239864
CVE: CVE-2023-5024
Published: 2023-09-17
Description: A vulnerability was found in Planno 23.04.04. It has been classified as problematic. This affects an unknown part of the component Comment Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-239865 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.239865; https://vuldb.com/?id.239865; https://www.planno.fr/
CVE: CVE-2023-5025
Published: 2023-09-17
Description: A vulnerability was found in KOHA up to 23.05.03. It has been declared as problematic. This vulnerability affects unknown code of the file /cgi-bin/koha/catalogue/search.pl of the component MARC. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-239866 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.239866; https://vuldb.com/?id.239866; https://www.youtube.com/watch?v=b5107YkpgaM
CVE: CVE-2023-5026
Published: 2023-09-17
Description: A vulnerability classified as problematic has been found in Tongda OA 11.10. Affected is an unknown function of the file /general/ipanel/menu_code.php?MENU_TYPE=FAV. The manipulation of the argument OA_SUB_WINDOW leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-239868.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/Mykonos-x/cve/tree/main/cve/tongda/v11/xss; https://vuldb.com/?ctiid.239868; https://vuldb.com/?id.239868
CVE: CVE-2023-5028
Published: 2023-09-17
Description: A vulnerability, which was classified as problematic, has been found in China Unicom TEWA-800G 4.16L.04_CT2015_Yueme. Affected by this issue is some unknown functionality. The manipulation leads to information exposure through debug log file. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. VDB-239870 is the identifier assigned to this vulnerability.
CVSS Score: 2.0 (LOW)
CWE: CWE-534, CWE-532
References: https://github.com/pinglan123/-/wiki/%E4%B8%AD%E5%9B%BD%E8%81%94%E9%80%9A%E5%AE%B6%E7%94%A8%E7%BD%91%E5%85%B3; https://vuldb.com/?ctiid.239870; https://vuldb.com/?id.239870
CVE: CVE-2023-5027
Published: 2023-09-17
Description: A vulnerability classified as critical was found in SourceCodester Simple Membership System 1.0. Affected by this vulnerability is an unknown functionality of the file club_validator.php. The manipulation of the argument club leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-239869 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/LianghaoW/CveHub/blob/main/Simple-Membership-System%20club_validator.php%20has%20Sqlinjection.pdf; https://vuldb.com/?ctiid.239869; https://vuldb.com/?id.239869
CVE: CVE-2023-5029
Published: 2023-09-17
Description: A vulnerability, which was classified as critical, was found in mccms 2.6. This affects an unknown part of the file /category/order/hits/copyright/46/finish/1/list/1. The manipulation with the input '"1 leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-239871.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/[PII_REDACTED]/cve/blob/main/README.md; https://vuldb.com/?ctiid.239871; https://vuldb.com/?id.239871
CVE: CVE-2023-5030
Published: 2023-09-17
Description: A vulnerability has been found in Tongda OA up to 11.10 and classified as critical. This vulnerability affects unknown code of the file general/hr/recruit/plan/delete.php. The manipulation of the argument PLAN_ID leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-239872.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/husterdjx/cve/blob/main/sql1.md; https://vuldb.com/?ctiid.239872; https://vuldb.com/?id.239872
CVE: CVE-2023-5031
Published: 2023-09-18
Description: A vulnerability was found in OpenRapid RapidCMS 1.3.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/article/article-add.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-239875.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/yhy217/rapidcms-vul/issues/1; https://vuldb.com/?ctiid.239875; https://vuldb.com/?id.239875
CVE: CVE-2023-35850
Published: 2023-09-18
Description: 
SUNNET WMPro portal's file management function has a vulnerability of insufficient filtering for user input. A remote attacker with administrator privilege or a privileged account can exploit this vulnerability to inject and execute arbitrary system commands to perform arbitrary system operations or disrupt service.


CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.twcert.org.tw/tw/cp-132-7373-4ef46-1.html; https://www.twcert.org.tw/tw/cp-132-7373-4ef46-1.html
CVE: CVE-2023-35851
Published: 2023-09-18
Description: 
SUNNET WMPro portal's FAQ function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL commands to obtain sensitive information via a database.


CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://www.twcert.org.tw/tw/cp-132-7372-3994a-1.html; https://www.twcert.org.tw/tw/cp-132-7372-3994a-1.html
CVE: CVE-2023-41349
Published: 2023-09-18
Description: 
ASUS router RT-AX88U has a vulnerability of using externally controllable format strings within its Advanced Open VPN function. An authenticated remote attacker can exploit the exported OpenVPN configuration to execute an externally-controlled format string attack, resulting in sensitivity information leakage, or forcing the device to reset and permanent denial of service.


CVSS Score: 8.8 (HIGH)
CWE: CWE-134
References: https://www.twcert.org.tw/tw/cp-132-7371-aecf1-1.html; https://www.twcert.org.tw/tw/cp-132-7371-aecf1-1.html
CVE: CVE-2023-5032
Published: 2023-09-18
Description: A vulnerability was found in OpenRapid RapidCMS 1.3.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/article/article-edit-run.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-239876.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/yhy217/rapidcms-vul/issues/2; https://vuldb.com/?ctiid.239876; https://vuldb.com/?id.239876