deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-57011
Published: 2025-01-15
Description: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "minute" parameters in setScheduleCfg.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/tiger5671/Vulnerabilities/blob/main/TOTOLINK%20X5000R/setScheduleCfg/setScheduleCfg.md; https://www.totolink.net/
CVE: CVE-2024-57012
Published: 2025-01-15
Description: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "week" parameter in setScheduleCfg.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/tiger5671/Vulnerabilities/blob/main/TOTOLINK%20X5000R/setScheduleCfg/setScheduleCfg.md; https://www.totolink.net/
CVE: CVE-2024-57013
Published: 2025-01-15
Description: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "switch" parameter in setScheduleCfg.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/tiger5671/Vulnerabilities/blob/main/TOTOLINK%20X5000R/setScheduleCfg/setScheduleCfg.md; https://www.totolink.net/
CVE: CVE-2024-57014
Published: 2025-01-15
Description: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "recHour" parameter in setScheduleCfg.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/tiger5671/Vulnerabilities/blob/main/TOTOLINK%20X5000R/setScheduleCfg/setScheduleCfg.md; https://www.totolink.net/
CVE: CVE-2024-57015
Published: 2025-01-15
Description: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "hour" parameter in setScheduleCfg.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/tiger5671/Vulnerabilities/blob/main/TOTOLINK%20X5000R/setScheduleCfg/setScheduleCfg.md; https://www.totolink.net/
CVE: CVE-2024-57016
Published: 2025-01-15
Description: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "user" parameter in setVpnAccountCfg.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/tiger5671/Vulnerabilities/blob/main/TOTOLINK%20X5000R/setVpnAccountCfg/setVpnAccountCfg.md; https://www.totolink.net/
CVE: CVE-2024-57017
Published: 2025-01-15
Description: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "pass" parameter in setVpnAccountCfg.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/tiger5671/Vulnerabilities/blob/main/TOTOLINK%20X5000R/setVpnAccountCfg/setVpnAccountCfg.md; https://www.totolink.net/
CVE: CVE-2024-57018
Published: 2025-01-15
Description: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "desc" parameter in setVpnAccountCfg.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/tiger5671/Vulnerabilities/blob/main/TOTOLINK%20X5000R/setVpnAccountCfg/setVpnAccountCfg.md; https://www.totolink.net/
CVE: CVE-2024-57019
Published: 2025-01-15
Description: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "limit" parameter in setVpnAccountCfg.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/tiger5671/Vulnerabilities/blob/main/TOTOLINK%20X5000R/setVpnAccountCfg/setVpnAccountCfg.md; https://www.totolink.net/
CVE: CVE-2024-57020
Published: 2025-01-15
Description: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "sMinute" parameter in setWiFiScheduleCfg.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/tiger5671/Vulnerabilities/blob/main/TOTOLINK%20X5000R/setWiFiScheduleCfg/setWiFiScheduleCfg.md; https://www.totolink.net/
CVE: CVE-2024-57021
Published: 2025-01-15
Description: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "eHour" parameter in setWiFiScheduleCfg.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/tiger5671/Vulnerabilities/blob/main/TOTOLINK%20X5000R/setWiFiScheduleCfg/setWiFiScheduleCfg.md; https://www.totolink.net/
CVE: CVE-2024-57022
Published: 2025-01-15
Description: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "sHour" parameter in setWiFiScheduleCfg.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/tiger5671/Vulnerabilities/blob/main/TOTOLINK%20X5000R/setWiFiScheduleCfg/setWiFiScheduleCfg.md; https://www.totolink.net/
CVE: CVE-2024-57023
Published: 2025-01-15
Description: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "week" parameter in setWiFiScheduleCfg.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://github.com/tiger5671/Vulnerabilities/blob/main/TOTOLINK%20X5000R/setWiFiScheduleCfg/setWiFiScheduleCfg.md; https://www.totolink.net/; https://github.com/tiger5671/Vulnerabilities/blob/main/TOTOLINK%20X5000R/setWiFiScheduleCfg/setWiFiScheduleCfg.md
CVE: CVE-2024-57024
Published: 2025-01-15
Description: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "eMinute" parameter in setWiFiScheduleCfg.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://github.com/tiger5671/Vulnerabilities/blob/main/TOTOLINK%20X5000R/setWiFiScheduleCfg/setWiFiScheduleCfg.md; https://www.totolink.net/; https://github.com/tiger5671/Vulnerabilities/blob/main/TOTOLINK%20X5000R/setWiFiScheduleCfg/setWiFiScheduleCfg.md
CVE: CVE-2024-57025
Published: 2025-01-15
Description: TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "desc" parameter in setWiFiScheduleCfg.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://github.com/tiger5671/Vulnerabilities/blob/main/TOTOLINK%20X5000R/setWiFiScheduleCfg/setWiFiScheduleCfg.md; https://www.totolink.net/; https://github.com/tiger5671/Vulnerabilities/blob/main/TOTOLINK%20X5000R/setWiFiScheduleCfg/setWiFiScheduleCfg.md
CVE: CVE-2024-7085
Published: 2025-01-15
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ Solutions Business Manager (SBM) allows Stored XSS. 

The vulnerability could result in the exposure of private information to an unauthorized actor. 

This issue affects Solutions Business Manager (SBM): through 12.2.1.
CWE: CWE-79
References: https://portal.microfocus.com/s/article/KM000036201?language=en_US
CVE: CVE-2025-20036
Published: 2025-01-15
Description: Mattermost Mobile Apps versions <=2.22.0 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1287
References: https://mattermost.com/security-updates
CVE: CVE-2025-20086
Published: 2025-01-15
Description: Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1287
References: https://mattermost.com/security-updates
CVE: CVE-2025-20088
Published: 2025-01-15
Description: Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1287
References: https://mattermost.com/security-updates
CVE: CVE-2025-21083
Published: 2025-01-15
Description: Mattermost Mobile Apps versions <=2.22.0 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1287
References: https://mattermost.com/security-updates
CVE: CVE-2024-52005
Published: 2025-01-15
Description: Git is a source code management tool. When cloning from a server (or fetching, or pushing), informational or error messages are transported from the remote Git process to the client via the so-called "sideband channel". These messages will be prefixed with "remote:" and printed directly to the standard error output. Typically, this standard error output is connected to a terminal that understands ANSI escape sequences, which Git did not protect against. Most modern terminals support control sequences that can be used by a malicious actor to hide and misrepresent information, or to mislead the user into executing untrusted scripts. As requested on the git-security mailing list, the patches are under discussion on the public mailing list. Users are advised to update as soon as possible. Users unable to upgrade should avoid recursive clones unless they are from trusted sources.
CVSS Score: 8.8 (HIGH)
CWE: CWE-116, CWE-150
References: https://github.com/git/git/security/advisories/GHSA-7jjc-gg6m-3329; https://lore.kernel.org/git/1M9FnZ-1taoNo1wwh-00ESSd@mail.gmx.net
CVE: CVE-2025-0480
Published: 2025-01-15
Description: A vulnerability classified as problematic has been found in wuzhicms 4.1.0. This affects the function test of the file coreframe/app/search/admin/config.php. The manipulation of the argument sphinxhost/sphinxport leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/wuzhicms/wuzhicms/issues/212; https://github.com/wuzhicms/wuzhicms/issues/212#issue[PII_REDACTED]; https://vuldb.com/?ctiid.291915
CVE: CVE-2025-0502
Published: 2025-01-15
Description: Transmission of Private Resources into a New Sphere ('Resource Leak') vulnerability in CrafterCMS Engine on Linux, MacOS, x86, Windows, 64 bit, ARM allows Directory Indexing, Resource Leak Exposure.This issue affects CrafterCMS: from 4.0.0 before 4.0.8, from 4.1.0 before 4.1.6.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-402
References: https://craftercms.com/docs/current/security/advisory.html#cv[PII_REDACTED]
CVE: CVE-2025-23040
Published: 2025-01-15
Description: GitHub Desktop is an open-source Electron-based GitHub app designed for git development. An attacker convincing a user to clone a repository directly or through a submodule can allow the attacker access to the user's credentials through the use of maliciously crafted remote URL. GitHub Desktop relies on Git to perform all network related operations (such as cloning, fetching, and pushing). When a user attempts to clone a repository GitHub Desktop will invoke `git clone` and when Git encounters a remote which requires authentication it will request the credentials for that remote host from GitHub Desktop using the git-credential protocol. Using a maliciously crafted URL it's possible to cause the credential request coming from Git to be misinterpreted by Github Desktop such that it will send credentials for a different host than the host that Git is currently communicating with thereby allowing for secret exfiltration. GitHub username and OAuth token, or credentials for other Git remote hosts stored in GitHub Desktop could be improperly transmitted to an unrelated host. Users should update to GitHub Desktop 3.4.12 or greater which fixes this vulnerability. Users who suspect they may be affected should revoke any relevant credentials.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-522
References: https://docs.github.com/en/apps/using-github-apps/reviewing-and-revoking-authorization-of-github-apps; https://git-scm.com/docs/git-credential; https://github.com/desktop/desktop/security/advisories/GHSA-36mm-rh9q-cpqq
CVE: CVE-2025-0481
Published: 2025-01-15
Description: A vulnerability classified as problematic has been found in D-Link DIR-878 1.03. Affected is an unknown function of the file /dllog.cgi of the component HTTP POST Request Handler. The manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-284
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Unauthorized_Vulnerability/D-Link/DIR-878/dllog.md; https://vuldb.com/?ctiid.291924; https://vuldb.com/?id.291924
CVE: CVE-2025-0500
Published: 2025-01-15
Description: An issue in the native clients for Amazon WorkSpaces (when running Amazon DCV protocol), Amazon AppStream 2.0, and Amazon DCV Clients may allow an attacker to access remote sessions via man-in-the-middle.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: https://aws.amazon.com/security/security-bulletins/AWS-2025-001/; https://docs.aws.amazon.com/appstream2/latest/developerguide/client-release-versions.html; https://docs.aws.amazon.com/dcv/latest/adminguide/doc-history-release-notes.html#dcv-2023-1-16388jul
CVE: CVE-2025-0501
Published: 2025-01-15
Description: An issue in the native clients for Amazon WorkSpaces (when running PCoIP protocol) may allow an attacker to access remote sessions via man-in-the-middle.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: https://aws.amazon.com/security/security-bulletins/AWS-2025-001/; https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-android-client.html#android-release-notes; https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-linux-client.html#linux-release-notes
CVE: CVE-2024-27856
Published: 2025-01-15
Description: The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. Processing a file may lead to unexpected app termination or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94, CWE-94
References: https://support.apple.com/en-us/120896; https://support.apple.com/en-us/120898; https://support.apple.com/en-us/120901
CVE: CVE-2024-40771
Published: 2025-01-15
Description: The issue was addressed with improved memory handling. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7, tvOS 17.5, visionOS 1.2, watchOS 10.5. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-863
References: https://support.apple.com/en-us/120898; https://support.apple.com/en-us/120899; https://support.apple.com/en-us/120900
CVE: CVE-2024-40839
Published: 2025-01-15
Description: This issue was addressed through improved state management. This issue is fixed in iOS 17.5 and iPadOS 17.5. An attacker with physical access to an iOS device may be able to view notification contents from the Lock Screen.
CVSS Score: 2.4 (LOW)
CWE: CWE-862, CWE-862
References: https://support.apple.com/en-us/120905
CVE: CVE-2024-40854
Published: 2025-01-15
Description: A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An app may be able to cause unexpected system termination.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/121563; https://support.apple.com/en-us/121564; https://support.apple.com/en-us/121567
CVE: CVE-2024-44136
Published: 2025-01-15
Description: This issue was addressed through improved state management. This issue is fixed in iOS 17.5 and iPadOS 17.5. An attacker with physical access to a device may be able to disable Stolen Device Protection.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-863
References: https://support.apple.com/en-us/120905
CVE: CVE-2024-54470
Published: 2025-01-15
Description: A logic issue was addressed with improved checks. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1. An attacker with physical access may be able to access contacts from the lock screen.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-862
References: https://support.apple.com/en-us/121563; https://support.apple.com/en-us/121567
CVE: CVE-2024-54535
Published: 2025-01-15
Description: A path handling issue was addressed with improved logic. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, visionOS 2.1, watchOS 11.1. An attacker with access to calendar data could also read reminders.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://support.apple.com/en-us/121563; https://support.apple.com/en-us/121564; https://support.apple.com/en-us/121565
CVE: CVE-2024-54540
Published: 2025-01-15
Description: The issue was addressed with improved input sanitization. This issue is fixed in Apple Music 1.5.0.152 for Windows. Processing maliciously crafted web content may disclose internal states of the app.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://support.apple.com/en-us/122043
CVE: CVE-2025-0482
Published: 2025-01-15
Description: A vulnerability, which was classified as critical, was found in Fanli2012 native-php-cms 1.0. This affects an unknown part of the file /fladmin/user_recoverpwd.php. The manipulation leads to use of default credentials. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-1392
References: https://github.com/Fanli2012/native-php-cms/issues/4; https://github.com/Fanli2012/native-php-cms/issues/4#issue[PII_REDACTED]; https://vuldb.com/?ctiid.291927
CVE: CVE-2025-0483
Published: 2025-01-15
Description: A vulnerability has been found in Fanli2012 native-php-cms 1.0 and classified as problematic. This vulnerability affects unknown code of the file /fladmin/jump.php. The manipulation of the argument message/error leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/Fanli2012/native-php-cms/issues/5; https://github.com/Fanli2012/native-php-cms/issues/5#issue[PII_REDACTED]; https://vuldb.com/?ctiid.291928
CVE: CVE-2025-0484
Published: 2025-01-15
Description: A vulnerability was found in Fanli2012 native-php-cms 1.0 and classified as critical. This issue affects some unknown processing of the file /fladmin/sysconfig_doedit.php of the component Backend. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-266, CWE-285
References: https://github.com/Fanli2012/native-php-cms/issues/6; https://github.com/Fanli2012/native-php-cms/issues/6#issue[PII_REDACTED]; https://vuldb.com/?ctiid.291929
CVE: CVE-2025-0485
Published: 2025-01-15
Description: A vulnerability was found in Fanli2012 native-php-cms 1.0. It has been classified as problematic. Affected is an unknown function of the file /fladmin/sysconfig_doedit.php. The manipulation of the argument info leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/Fanli2012/native-php-cms/issues/7; https://github.com/Fanli2012/native-php-cms/issues/7#issue[PII_REDACTED]; https://vuldb.com/?ctiid.291930
CVE: CVE-2025-22146
Published: 2025-01-15
Description: Sentry is a developer-first error tracking and performance monitoring tool. A critical vulnerability was discovered in the SAML SSO implementation of Sentry. It was reported to us via our private bug bounty program. The vulnerability allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance. The victim email address must be known in order to exploit this vulnerability. The Sentry SaaS fix was deployed on Jan 14, 2025. For self hosted users; if only a single organization is allowed `(SENTRY_SINGLE_ORGANIZATION = True)`, then no action is needed. Otherwise, users should upgrade to version 25.1.0 or higher. There are no known workarounds for this vulnerability.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287
References: https://github.com/getsentry/sentry/pull/83407; https://github.com/getsentry/sentry/security/advisories/GHSA-7pq6-v88g-wf3w
CVE: CVE-2024-48121
Published: 2025-01-15
Description: The HI-SCAN 6040i Hitrax HX-03-19-I was discovered to transmit user credentials in cleartext over the GIOP protocol. This allows attackers to possibly gain access to sensitive information via a man-in-the-middle attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-319
References: https://kth.diva-portal.org/smash/get/diva2:1876534/FULLTEXT01.pdf
CVE: CVE-2024-48122
Published: 2025-01-15
Description: Insecure default configurations in HI-SCAN 6040i Hitrax HX-03-19-I allow authenticated attackers with low-level privileges to escalate to root-level privileges.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-1188
References: https://kth.diva-portal.org/smash/get/diva2:1876534/FULLTEXT01.pdf
CVE: CVE-2024-48123
Published: 2025-01-15
Description: An issue in the USB Autorun function of HI-SCAN 6040i Hitrax HX-03-19-I allows attackers to execute arbitrary code via uploading a crafted script from a USB device.
CVSS Score: 8.4 (HIGH)
CWE: CWE-426
References: https://kth.diva-portal.org/smash/get/diva2:1876534/FULLTEXT01.pdf
CVE: CVE-2024-48125
Published: 2025-01-15
Description: An issue in the AsDB service of HI-SCAN 6040i Hitrax HX-03-19-I allows attackers to enumerate user credentials via crafted GIOP protocol requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://kth.diva-portal.org/smash/get/diva2:1876534/FULLTEXT01.pdf
CVE: CVE-2024-48126
Published: 2025-01-15
Description: HI-SCAN 6040i Hitrax HX-03-19-I was discovered to contain hardcoded credentials for access to vendor support and service access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://kth.diva-portal.org/smash/get/diva2:1876534/FULLTEXT01.pdf
CVE: CVE-2025-0486
Published: 2025-01-15
Description: A vulnerability was found in Fanli2012 native-php-cms 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /fladmin/login.php. The manipulation of the argument username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Fanli2012/native-php-cms/issues/8; https://github.com/Fanli2012/native-php-cms/issues/8#issue[PII_REDACTED]; https://vuldb.com/?ctiid.291931
CVE: CVE-2025-0487
Published: 2025-01-15
Description: A vulnerability was found in Fanli2012 native-php-cms 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /fladmin/cat_edit.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Fanli2012/native-php-cms/issues/9; https://github.com/Fanli2012/native-php-cms/issues/9#issue[PII_REDACTED]; https://vuldb.com/?ctiid.291932
CVE: CVE-2025-0488
Published: 2025-01-15
Description: A vulnerability classified as critical has been found in Fanli2012 native-php-cms 1.0. This affects an unknown part of the file product_list.php. The manipulation of the argument cat leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/Fanli2012/native-php-cms/issues/10; https://github.com/Fanli2012/native-php-cms/issues/10#issue[PII_REDACTED]; https://vuldb.com/?ctiid.291933
CVE: CVE-2024-36751
Published: 2025-01-15
Description: An issue in parse-uri v1.0.9 allows attackers to cause a Regular expression Denial of Service (ReDoS) via a crafted URL.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1333
References: https://gist.github.com/6en6ar/78168687da94e8aa2e0357f2456b0233; https://github.com/Kikobeats/parse-uri/issues/14