deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-43013
Published: 2023-09-28
Description: Asset Management System v1.0 is vulnerable to an

unauthenticated SQL Injection vulnerability on the

'email' parameter of index.php page, allowing an

external attacker to dump all the contents of the

database contents and bypass the login control.




CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://fluidattacks.com/advisories/nergal; https://projectworlds.in/; https://fluidattacks.com/advisories/nergal
CVE: CVE-2023-43740
Published: 2023-09-28
Description: Online Book Store Project v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'image' parameter of
admin_edit.php page, allowing an authenticated attacker to obtain Remote Code Execution on the server hosting
the application.

CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://fluidattacks.com/advisories/shagrath; https://projectworlds.in/; https://fluidattacks.com/advisories/shagrath
CVE: CVE-2023-44173
Published: 2023-09-28
Description: Online Movie Ticket Booking System v1.0 is vulnerable to

an authenticated Reflected Cross-Site Scripting vulnerability.




CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/harrison; https://projectworlds.in/; https://fluidattacks.com/advisories/harrison
CVE: CVE-2023-4316
Published: 2023-09-28
Description: Zod in versions 3.21.0 up to and including 3.22.3 allows an attacker to perform a denial of service while validating emails.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333, CWE-1333
References: https://fluidattacks.com/advisories/swift; https://www.npmjs.com/package/zod; https://fluidattacks.com/advisories/swift
CVE: CVE-2023-5004
Published: 2023-09-28
Description: Hospital management system version 378c157 allows to bypass authentication.

This is possible because the application is vulnerable to SQLI.




CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://fluidattacks.com/advisories/alcocer; https://github.com/projectworldsofficial/hospital-management-system-in-php/; https://fluidattacks.com/advisories/alcocer
CVE: CVE-2023-5053
Published: 2023-09-28
Description: Hospital management system version 378c157 allows to bypass authentication.

This is possible because the application is vulnerable to SQLI.




CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://fluidattacks.com/advisories/shierro; https://github.com/projectworldsofficial/hospital-management-system-in-php/; https://fluidattacks.com/advisories/shierro
CVE: CVE-2023-5185
Published: 2023-09-28
Description: Gym Management System Project v1.0 is vulnerable to

an Insecure File Upload vulnerability on the 'file'

parameter of profile/i.php page, allowing an

authenticated attacker to obtain Remote Code Execution

on the server hosting the application.




CVSS Score: 9.1 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://fluidattacks.com/advisories/orion; https://projectworlds.in/; https://fluidattacks.com/advisories/orion
CVE: CVE-2023-43014
Published: 2023-09-28
Description: Asset Management System v1.0 is vulnerable to

an Authenticated SQL Injection vulnerability

on the 'first_name' and 'last_name' parameters

of user.php page, allowing an authenticated

attacker to dump all the contents of the database

contents.




CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://fluidattacks.com/advisories/gaahl; https://projectworlds.in/; https://fluidattacks.com/advisories/gaahl
CVE: CVE-2023-43662
Published: 2023-09-28
Description: ShokoServer is a media server which specializes in organizing anime. In affected versions the `/api/Image/WithPath` endpoint is accessible without authentication and is supposed to return default server images. The endpoint accepts the parameter `serverImagePath`, which is not sanitized in any way before being passed to `System.IO.File.OpenRead`, which results in an arbitrary file read. This issue may lead to an arbitrary file read which is exacerbated in the windows installer which installs the ShokoServer as administrator. Any unauthenticated attacker may be able to access sensitive information and read files stored on the server. The `/api/Image/WithPath` endpoint has been removed in commit `6c57ba0f0` which will be included in subsequent releases. Users should limit access to the `/api/Image/WithPath` endpoint or manually patch their installations until a patched release is made. This issue was discovered by the GitHub Security lab and is also indexed as GHSL-2023-191.
CVSS Score: 8.6 (HIGH)
CWE: CWE-22
References: https://github.com/ShokoAnime/ShokoServer/commit/6c57ba0f073d6be5a4f508c46c2ce36727cbce80; https://github.com/ShokoAnime/ShokoServer/security/advisories/GHSA-mwcv-ghjq-8f2g; https://github.com/ShokoAnime/ShokoServer/commit/6c57ba0f073d6be5a4f508c46c2ce36727cbce80
CVE: CVE-2023-43739
Published: 2023-09-28
Description: The 'bookisbn' parameter of the cart.php resource

does not validate the characters received and they

are sent unfiltered to the database.




CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://fluidattacks.com/advisories/filth; https://projectworlds.in/; https://fluidattacks.com/advisories/filth
CVE: CVE-2023-44163
Published: 2023-09-28
Description: The 'search' parameter of the process_search.php resource

does not validate the characters received and they

are sent unfiltered to the database.




CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://fluidattacks.com/advisories/starr; https://projectworlds.in/; https://fluidattacks.com/advisories/starr
CVE: CVE-2023-44164
Published: 2023-09-28
Description: The 'Email' parameter of the process_login.php resource

does not validate the characters received and they

are sent unfiltered to the database.




CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://fluidattacks.com/advisories/starr; https://projectworlds.in/; https://fluidattacks.com/advisories/starr
CVE: CVE-2023-44165
Published: 2023-09-28
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-44166
Published: 2023-09-28
Description: The 'age' parameter of the process_registration.php resource

does not validate the characters received and they

are sent unfiltered to the database.




CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://fluidattacks.com/advisories/starr; https://projectworlds.in/; https://fluidattacks.com/advisories/starr
CVE: CVE-2023-44167
Published: 2023-09-28
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-44168
Published: 2023-09-28
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-44174
Published: 2023-09-28
Description: Online Movie Ticket Booking System v1.0 is vulnerable to

an authenticated Stored Cross-Site Scripting vulnerability.




CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fluidattacks.com/advisories/mccartney; https://projectworlds.in/; https://fluidattacks.com/advisories/mccartney
CVE: CVE-2023-43654
Published: 2023-09-28
Description: TorchServe is a tool for serving and scaling PyTorch models in production. TorchServe default configuration lacks proper input validation, enabling third parties to invoke remote HTTP download requests and write files to the disk. This issue could be taken advantage of to compromise the integrity of the system and sensitive data. This issue is present in versions 0.1.0 to 0.8.1. A user is able to load the model of their choice from any URL that they would like to use. The user of TorchServe is responsible for configuring both the allowed_urls and specifying the model URL to be used. A pull request to warn the user when the default value for allowed_urls is used has been merged in PR #2534. TorchServe release 0.8.2 includes this change. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-918
References: http://packetstormsecurity.com/files/175095/PyTorch-Model-Server-Registration-Deserialization-Remote-Code-Execution.html; https://github.com/pytorch/serve/pull/2534; https://github.com/pytorch/serve/releases/tag/v0.8.2
CVE: CVE-2023-3775
Published: 2023-09-29
Description: A Vault Enterprise Sentinel Role Governing Policy created by an operator to restrict access to resources in one namespace can be applied to requests outside in another non-descendant namespace, potentially resulting in denial of service. Fixed in Vault Enterprise 1.15.0, 1.14.4, 1.13.8.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-266
References: https://discuss.hashicorp.com/t/hcsec-2023-29-vault-enterprise-s-sentinel-rgp-policies-allowed-for-cross-namespace-denial-of-service/58653; https://discuss.hashicorp.com/t/hcsec-2023-29-vault-enterprise-s-sentinel-rgp-policies-allowed-for-cross-namespace-denial-of-service/58653
CVE: CVE-2023-5077
Published: 2023-09-29
Description: The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets. Fixed in Vault 1.13.0.
CVSS Score: 7.6 (HIGH)
CWE: CWE-266, CWE-732
References: https://discuss.hashicorp.com/t/hcsec-2023-30-vault-s-google-cloud-secrets-engine-removed-existing-iam-conditions-when-creating-updating-rolesets/58654; https://discuss.hashicorp.com/t/hcsec-2023-30-vault-s-google-cloud-secrets-engine-removed-existing-iam-conditions-when-creating-updating-rolesets/58654
CVE: CVE-2023-26146
Published: 2023-09-29
Description: All versions of the package ithewei/libhv are vulnerable to Cross-site Scripting (XSS) such that when a file with a name containing a malicious payload is served by the application, the filename is displayed without proper sanitization when it is rendered.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gist.github.com/dellalibera/c[PII_REDACTED]0cbe12257c4b413a90d20; https://security.snyk.io/vuln/SNYK-UNMANAGED-ITHEWEILIBHV-5730766; https://gist.github.com/dellalibera/c[PII_REDACTED]0cbe12257c4b413a90d20
CVE: CVE-2023-26147
Published: 2023-09-29
Description: All versions of the package ithewei/libhv are vulnerable to HTTP Response Splitting when untrusted user input is used to build headers values. An attacker can add the \r\n (carriage return line feeds) characters to end the HTTP response headers and inject malicious content, like for example additional headers or new response body, leading to a potential XSS vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-113, CWE-79
References: https://gist.github.com/dellalibera/2be265b56b7b3b00de1a777b9dec0c7b; https://security.snyk.io/vuln/SNYK-UNMANAGED-ITHEWEILIBHV-5730768; https://gist.github.com/dellalibera/2be265b56b7b3b00de1a777b9dec0c7b
CVE: CVE-2023-26148
Published: 2023-09-29
Description: All versions of the package ithewei/libhv are vulnerable to CRLF Injection when untrusted user input is used to set request headers. An attacker can add the \r\n (carriage return line feeds) characters and inject additional headers in the request sent.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-93, CWE-74
References: https://gist.github.com/dellalibera/65d136066fdd5ea4dddaadaa9b0ba90e; https://security.snyk.io/vuln/SNYK-UNMANAGED-ITHEWEILIBHV-5730769; https://gist.github.com/dellalibera/65d136066fdd5ea4dddaadaa9b0ba90e
CVE: CVE-2023-44464
Published: 2023-09-29
Description: pretix before 2023.7.2 allows Pillow to parse EPS files.
CVSS Score: 7.8 (HIGH)
References: https://github.com/pretix/pretix/commit/8583bfb7d97263e9e923ad5d7f123ca1cadc8f2e; https://github.com/pretix/pretix/compare/v2023.7.1...v2023.7.2; https://github.com/pretix/pretix/tags
CVE: CVE-2023-30591
Published: 2023-09-29
Description: Denial-of-service in NodeBB <= v2.8.10 allows unauthenticated attackers to trigger a crash, when invoking `eventName.startsWith()` or `eventName.toString()`, while processing Socket.IO messages via crafted Socket.IO messages containing array or object type for the event name respectively.
CVSS Score: 7.5 (HIGH)
CWE: CWE-241, CWE-754
References: https://github.com/NodeBB/NodeBB/commit/37b48b82a4bc7680c6e4c[PII_REDACTED]0cb239c2c; https://github.com/NodeBB/NodeBB/commit/4d2d76897a02e7068ab74c81d17a2febfae8bfb9; https://github.com/NodeBB/NodeBB/commit/830f142b7aea2e597294a84d52c05aab3a3539ca
CVE: CVE-2023-44466
Published: 2023-09-29
Description: An issue was discovered in net/ceph/messenger_v2.c in the Linux kernel before 6.4.5. There is an integer signedness error, leading to a buffer overflow and remote code execution via HELLO or one of the AUTH frames. This occurs because of an untrusted length taken from a TCP packet in ceph_decode_32.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a282a2f10539dce2aa619e71e1817570d557fc97; https://github.com/google/security-research/security/advisories/GHSA-jg27-jx6w-xwph; https://github.com/torvalds/linux/commit/a282a2f10539dce2aa619e71e1817570d557fc97
CVE: CVE-2023-0989
Published: 2023-09-29
Description: An information disclosure issue in GitLab CE/EE affecting all versions starting from 13.11 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows an attacker to extract non-protected CI/CD variables by tricking a user to visit a fork with a malicious CI/CD configuration.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-282
References: https://gitlab.com/gitlab-org/gitlab/-/issues/417275; https://hackerone.com/reports/1875515; https://gitlab.com/gitlab-org/gitlab/-/issues/417275
CVE: CVE-2023-2233
Published: 2023-09-29
Description: An improper authorization issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 16.2.8, all versions starting from 16.3 before 16.3.5 and all versions starting from 16.4 before 16.4.1. It allows a project reporter to leak the owner's Sentry instance projects.
CVSS Score: 3.1 (LOW)
CWE: CWE-862
References: https://gitlab.com/gitlab-org/gitlab/-/issues/408359; https://hackerone.com/reports/1947211; https://gitlab.com/gitlab-org/gitlab/-/issues/408359
CVE: CVE-2023-3115
Published: 2023-09-29
Description: An issue has been discovered in GitLab EE affecting all versions affecting all versions from 11.11 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Single Sign On restrictions were not correctly enforced for indirect project members accessing public members-only project repositories.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-286
References: https://gitlab.com/gitlab-org/gitlab/-/issues/414367; https://hackerone.com/reports/2004158; https://gitlab.com/gitlab-org/gitlab/-/issues/414367
CVE: CVE-2023-3906
Published: 2023-09-29
Description: An input validation issue in the asset proxy in GitLab EE, affecting all versions from 12.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1, allowed an authenticated attacker to craft image urls which bypass the asset proxy.
CVSS Score: 3.5 (LOW)
CWE: CWE-1287
References: https://gitlab.com/gitlab-org/gitlab/-/issues/419213; https://hackerone.com/reports/2071411; https://gitlab.com/gitlab-org/gitlab/-/issues/419213
CVE: CVE-2023-3914
Published: 2023-09-29
Description: A business logic error in GitLab EE affecting all versions prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows access to internal projects. A service account is not deleted when a namespace is deleted, allowing access to internal projects.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-286
References: https://gitlab.com/gitlab-org/gitlab/-/issues/418115; https://hackerone.com/reports/2040822; https://gitlab.com/gitlab-org/gitlab/-/issues/418115
CVE: CVE-2023-3917
Published: 2023-09-29
Description: Denial of Service in pipelines affecting all versions of Gitlab EE and CE prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows attacker to cause pipelines to fail.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1287
References: https://gitlab.com/gitlab-org/gitlab/-/issues/417896; https://hackerone.com/reports/2055158; https://gitlab.com/gitlab-org/gitlab/-/issues/417896
CVE: CVE-2023-3920
Published: 2023-09-29
Description: An issue has been discovered in GitLab affecting all versions starting from 11.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible that a maintainer to create a fork relationship between existing projects contrary to the documentation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://gitlab.com/gitlab-org/gitlab/-/issues/417481; https://hackerone.com/reports/2058121; https://gitlab.com/gitlab-org/gitlab/-/issues/417481
CVE: CVE-2023-3979
Published: 2023-09-29
Description: An issue has been discovered in GitLab affecting all versions starting from 10.6 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible that upstream members to collaborate with you on your branch get permission to write to the merge request’s source branch.
CVSS Score: 3.1 (LOW)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/gitlab/-/issues/419972; https://hackerone.com/reports/2082560; https://gitlab.com/gitlab-org/gitlab/-/issues/419972
CVE: CVE-2023-44469
Published: 2023-09-29
Description: A Server-Side Request Forgery issue in the OpenID Connect Issuer in LemonLDAP::NG before 2.17.1 allows authenticated remote attackers to send GET requests to arbitrary URLs through the request_uri authorization parameter. This is similar to CVE-2020-10770.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918
References: https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2998; https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.17.1; https://lists.debian.org/debian-lts-announce/2023/10/msg00014.html
CVE: CVE-2023-4532
Published: 2023-09-29
Description: An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. Users were capable of linking CI/CD jobs of private projects which they are not a member of.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/gitlab/-/issues/423357; https://hackerone.com/reports/2084199; https://gitlab.com/gitlab-org/gitlab/-/issues/423357
CVE: CVE-2023-32477
Published: 2023-09-29
Description: 
Dell Common Event Enabler 8.9.8.2 for Windows and prior, contain an improper access control vulnerability. A local low-privileged malicious user may potentially exploit this vulnerability to gain elevated privileges.


CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://www.dell.com/support/kbdoc/en-us/000218120/dsa-2023-310-security-update-for-dell-emc-common-event-enabler; https://www.dell.com/support/kbdoc/en-us/000218120/dsa-2023-310-security-update-for-dell-emc-common-event-enabler
CVE: CVE-2023-3922
Published: 2023-09-29
Description: An issue has been discovered in GitLab affecting all versions starting from 8.15 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible to hijack some links and buttons on the GitLab UI to a malicious page.
CVSS Score: 3.0 (LOW)
CWE: CWE-601, CWE-601
References: https://gitlab.com/gitlab-org/gitlab/-/issues/394770; https://hackerone.com/reports/1887323; https://gitlab.com/gitlab-org/gitlab/-/issues/394770
CVE: CVE-2023-5198
Published: 2023-09-29
Description: An issue has been discovered in GitLab affecting all versions prior to 16.2.7, all versions starting from 16.3 before 16.3.5, and all versions starting from 16.4 before 16.4.1. It was possible for a removed project member to write to protected branches using deploy keys.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/gitlab/-/issues/416957; https://hackerone.com/reports/2041789; https://gitlab.com/gitlab-org/gitlab/-/issues/416957
CVE: CVE-2023-3413
Published: 2023-09-29
Description: An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible to read the source code of a project through a fork created before changing visibility to only project members.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-201
References: https://gitlab.com/gitlab-org/gitlab/-/issues/416284; https://hackerone.com/reports/2027967; https://gitlab.com/gitlab-org/gitlab/-/issues/416284
CVE: CVE-2023-5159
Published: 2023-09-29
Description: Mattermost fails to properly verify the permissions when managing/updating a bot allowing a User Manager role with user edit permissions to manage/update bots.


CVSS Score: 3.8 (LOW)
CWE: CWE-863, CWE-863
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-5193
Published: 2023-09-29
Description: Mattermost fails to properly check permissions when retrieving a post allowing for a System Role with the permission to manage channels to read the posts of a DM conversation.


CVSS Score: 4.9 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-5194
Published: 2023-09-29
Description: Mattermost fails to properly validate permissions when demoting and deactivating a user allowing for a system/user manager to demote / deactivate another manager


CVSS Score: 2.7 (LOW)
CWE: CWE-863, CWE-863
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-5195
Published: 2023-09-29
Description: Mattermost fails to properly validate the permissions when soft deleting a team allowing a team member to soft delete other teams that they are not part of


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-5196
Published: 2023-09-29
Description: Mattermost fails to enforce character limits in all possible notification props allowing an attacker to send a really long value for a notification_prop resulting in the server consuming an abnormal quantity of computing resources and possibly becoming temporarily unavailable for its users. 




CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-5257
Published: 2023-09-29
Description: A vulnerability was found in WhiteHSBG JNDIExploit 1.4 on Windows. It has been rated as problematic. Affected by this issue is the function handleFileRequest of the file src/main/java/com/feihong/ldap/HTTPServer.java. The manipulation leads to path traversal. The exploit has been disclosed to the public and may be used. VDB-240866 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-22
References: https://github.com/WhiteHSBG/JNDIExploit/issues/10; https://vuldb.com/?ctiid.240866; https://vuldb.com/?id.240866
CVE: CVE-2023-5258
Published: 2023-09-29
Description: A vulnerability classified as critical has been found in OpenRapid RapidCMS 1.3.1. This affects an unknown part of the file /resource/addgood.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240867.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/OpenRapid/rapidcms/issues/9; https://github.com/yhy217/rapidcms-vul/issues/4; https://vuldb.com/?ctiid.240867
CVE: CVE-2023-5259
Published: 2023-09-29
Description: A vulnerability classified as problematic was found in ForU CMS. This vulnerability affects unknown code of the file /admin/cms_admin.php. The manipulation of the argument del leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The identifier of this vulnerability is VDB-240868.
CVSS Score: 2.7 (LOW)
CWE: CWE-404
References: https://github.com/RCEraser/cve/blob/main/ForU-CMS.md; https://vuldb.com/?ctiid.240868; https://vuldb.com/?id.240868