deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-2707
Published: 2022-08-08
Description: A vulnerability classified as critical was found in SourceCodester Online Class and Exam Scheduling System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/faculty_sched.php. The manipulation of the argument faculty with the input ' OR (SELECT 2078 FROM(SELECT COUNT(*),CONCAT(0x716a717071,(SELECT (ELT(2078=2078,1))),0x717a706a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- uYCM leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-205831.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/anx0ing/CVE_demo/blob/main/2022/Online%20Class%20and%20Exam%20Scheduling%20System-SQL%20injections.md; https://vuldb.com/?id.205831; https://github.com/anx0ing/CVE_demo/blob/main/2022/Online%20Class%20and%20Exam%20Scheduling%20System-SQL%20injections.md
CVE: CVE-2022-2708
Published: 2022-08-08
Description: A vulnerability, which was classified as critical, was found in SourceCodester Gym Management System. This affects an unknown part of the file login.php. The manipulation of the argument user_login with the input 123@xx.com' OR (SELECT 9084 FROM(SELECT COUNT(*),CONCAT(0x[PII_REDACTED],(SELECT (ELT(9084=9084,1))),0x71767a6271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- dPvW leads to sql injection. Access to the local network is required for this attack. The exploit has been disclosed to the public and may be used. The identifier VDB-205833 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?id.205833; https://vuldb.com/?id.205833
CVE: CVE-2022-1323
Published: 2022-08-08
Description: The Discy WordPress theme before 5.0 lacks authorization checks then processing ajax requests to the discy_update_options action,  allowing any logged in users (with privileges as low as Subscriber,) to change Theme options by sending a crafted POST request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://wpscan.com/vulnerability/2d8020e1-6489-4555-9956-2dc190aaa61b; https://wpscan.com/vulnerability/2d8020e1-6489-4555-9956-2dc190aaa61b
CVE: CVE-2022-2046
Published: 2022-08-08
Description: The Directorist WordPress plugin before 7.2.3 allows administrators to download other plugins from the same vendor directly to the site, but does not check the URL domain it gets the zip files from. This could allow administrators to run code on the server, which is a problem in multisite configurations.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/changeset/2752034/directorist?contextall=1&old=2731298&old_path=%2Fdirectorist; https://wpscan.com/vulnerability/03a04eab-be47-4195-af77-0df2a32eb807; https://plugins.trac.wordpress.org/changeset/2752034/directorist?contextall=1&old=2731298&old_path=%2Fdirectorist
CVE: CVE-2022-2269
Published: 2022-08-08
Description: The Website File Changes Monitor WordPress plugin before 1.8.3 does not sanitise and escape user input before using it in a SQL statement via an action available to users with the manage_options capability (by default admins), leading to an SQL injection
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wpscan.com/vulnerability/bb348c92-d7e3-4a75-98aa-dd1c463bfd65; https://wpscan.com/vulnerability/bb348c92-d7e3-4a75-98aa-dd1c463bfd65
CVE: CVE-2022-2355
Published: 2022-08-08
Description: The Easy Username Updater WordPress plugin before 1.0.5 does not implement CSRF checks, which could allow attackers to make a logged in admin change any user's username includes the admin
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/426b5a0f-c16d-429a-9396-b3aea7922826; https://wpscan.com/vulnerability/426b5a0f-c16d-429a-9396-b3aea7922826
CVE: CVE-2022-2356
Published: 2022-08-08
Description: The Frontend File Manager & Sharing WordPress plugin before 1.1.3 does not filter file extensions when letting users upload files on the server, which may lead to malicious code being uploaded.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://wpscan.com/vulnerability/67f3948e-27d4-47a8-8572-616143b9cf43; https://wpscan.com/vulnerability/67f3948e-27d4-47a8-8572-616143b9cf43
CVE: CVE-2022-2357
Published: 2022-08-08
Description: The WSM Downloader WordPress plugin through 1.4.0 allows any visitor to use its remote file download feature to download any local files, including sensitive ones like wp-config.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-552
References: https://wpscan.com/vulnerability/42499b84-684e-42e1-b7f0-de206d4da553; https://wpscan.com/vulnerability/42499b84-684e-42e1-b7f0-de206d4da553
CVE: CVE-2022-2367
Published: 2022-08-08
Description: The WSM Downloader WordPress plugin through 1.4.0 allows only specific popular websites to download images/files from, this can be bypassed due to the lack of good "link" parameter validation
CVSS Score: 7.5 (HIGH)
CWE: CWE-639
References: https://wpscan.com/vulnerability/46afb0c6-2d0c-4a20-a9de-48f35ca93f0f; https://wpscan.com/vulnerability/46afb0c6-2d0c-4a20-a9de-48f35ca93f0f
CVE: CVE-2022-2371
Published: 2022-08-08
Description: The YaySMTP WordPress plugin before 2.2.1 does not have proper authorisation when saving its settings, allowing users with a role as low as subscriber to change them, and use that to conduct Stored Cross-Site Scripting attack due to the lack of escaping in them as well.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/31405f1e-fc07-43f5-afc1-9cfbaf6911b7; https://wpscan.com/vulnerability/31405f1e-fc07-43f5-afc1-9cfbaf6911b7
CVE: CVE-2022-2372
Published: 2022-08-08
Description: The YaySMTP WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/941fadb6-0009-4751-b979-88e87ebb1e45; https://wpscan.com/vulnerability/941fadb6-0009-4751-b979-88e87ebb1e45
CVE: CVE-2022-2386
Published: 2022-08-08
Description: The Crowdsignal Dashboard WordPress plugin before 3.0.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/47855d4b-9f6a-4fc7-b231-4337f51c8886; https://wpscan.com/vulnerability/47855d4b-9f6a-4fc7-b231-4337f51c8886
CVE: CVE-2022-2391
Published: 2022-08-08
Description: The Inspiro PRO WordPress plugin does not sanitize the portfolio slider description, allowing users with privileges as low as Contributor to inject JavaScript into the description.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/dd6ebf6b-209b-437c-9fe4-527ab9e3b9e3; https://wpscan.com/vulnerability/dd6ebf6b-209b-437c-9fe4-527ab9e3b9e3
CVE: CVE-2022-2395
Published: 2022-08-08
Description: The weForms WordPress plugin before 1.6.14 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/5e442dd9-a49d-4a8e-959b-199a8689da4b; https://wpscan.com/vulnerability/5e442dd9-a49d-4a8e-959b-199a8689da4b
CVE: CVE-2022-2398
Published: 2022-08-08
Description: The WordPress Comments Fields WordPress plugin before 4.1 does not escape Field Error Message, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/0a218789-9a78-49ca-b919-fa61d33d5672; https://wpscan.com/vulnerability/0a218789-9a78-49ca-b919-fa61d33d5672
CVE: CVE-2022-2409
Published: 2022-08-08
Description: The Rough Chart WordPress plugin through 1.0.0 does not properly escape chart data label, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/fbf474d1-4ac2-4ed2-943c-497a4d5e9cea; https://wpscan.com/vulnerability/fbf474d1-4ac2-4ed2-943c-497a4d5e9cea
CVE: CVE-2022-2410
Published: 2022-08-08
Description: The mTouch Quiz WordPress plugin through 3.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/c7cd55c1-e28b-4287-bab7-eb36483e0b18; https://wpscan.com/vulnerability/c7cd55c1-e28b-4287-bab7-eb36483e0b18
CVE: CVE-2022-2411
Published: 2022-08-08
Description: The Auto More Tag WordPress plugin through 4.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/72e83ffb-14e4-4e32-9516-083447dc8294; https://wpscan.com/vulnerability/72e83ffb-14e4-4e32-9516-083447dc8294
CVE: CVE-2022-2412
Published: 2022-08-08
Description: The Better Tag Cloud WordPress plugin through 0.99.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/fc384cea-ae44-473c-8aa9-a84a2821bdc6; https://wpscan.com/vulnerability/fc384cea-ae44-473c-8aa9-a84a2821bdc6
CVE: CVE-2022-2423
Published: 2022-08-08
Description: The DW Promobar WordPress plugin through 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/714b4f2b-3f17-4730-8c25-21d8da4cb8d2; https://wpscan.com/vulnerability/714b4f2b-3f17-4730-8c25-21d8da4cb8d2
CVE: CVE-2022-2424
Published: 2022-08-08
Description: The Google Maps Anywhere WordPress plugin through 1.2.6.3 does not sanitise and escape any of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/2f9d3256-85c0-44fa-b0be-faa8989a1909; https://wpscan.com/vulnerability/2f9d3256-85c0-44fa-b0be-faa8989a1909
CVE: CVE-2022-2425
Published: 2022-08-08
Description: The WP DS Blog Map WordPress plugin through 3.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/ca684a25-28ba-4337-a6d4-9477b1643c9d; https://wpscan.com/vulnerability/ca684a25-28ba-4337-a6d4-9477b1643c9d
CVE: CVE-2022-2426
Published: 2022-08-08
Description: The Thinkific Uploader WordPress plugin through 1.0.0 does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks against other administrators.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/00e36ad9-b55b-4d17-96fb-e415eec47422; https://wpscan.com/vulnerability/00e36ad9-b55b-4d17-96fb-e415eec47422
CVE: CVE-2022-2460
Published: 2022-08-08
Description: The WPDating WordPress plugin before 7.4.0 does not properly escape user input before concatenating it to certain SQL queries, leading to multiple SQL injection vulnerabilities exploitable by unauthenticated users
CVSS Score: 9.8 (CRITICAL)
References: https://wpscan.com/vulnerability/694b6dfd-2424-41b4-8595-b6c305c390db; https://wpscan.com/vulnerability/694b6dfd-2424-41b4-8595-b6c305c390db
CVE: CVE-2022-35487
Published: 2022-08-08
Description: Zammad 5.2.0 suffers from Incorrect Access Control. Zammad did not correctly perform authorization on certain attachment endpoints. This could be abused by an unauthenticated attacker to gain access to attachments, such as emails or attached files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://zammad.com/de/advisories/zaa-2022-08; https://zammad.com/de/advisories/zaa-2022-08
CVE: CVE-2022-35488
Published: 2022-08-08
Description: In Zammad 5.2.0, an attacker could manipulate the rate limiting in the 'forgot password' feature of Zammad, and thereby send many requests for a known account to cause Denial Of Service by many generated emails which would also spam the victim.
CVSS Score: 7.5 (HIGH)
References: https://zammad.com/de/advisories/zaa-2022-05; https://zammad.com/de/advisories/zaa-2022-05
CVE: CVE-2022-35489
Published: 2022-08-08
Description: In Zammad 5.2.0, customers who have secondary organizations assigned were able to see all organizations of the system rather than only those to which they are assigned.
CVSS Score: 6.5 (MEDIUM)
References: https://zammad.com/de/advisories/zaa-2022-06; https://zammad.com/de/advisories/zaa-2022-06
CVE: CVE-2022-35490
Published: 2022-08-08
Description: Zammad 5.2.0 is vulnerable to privilege escalation. Zammad has a prevention against brute-force attacks trying to guess login credentials. After a configurable amount of attempts, users are invalidated and logins prevented. An attacker might work around this prevention, enabling them to send more than the configured amount of requests before the user invalidation takes place.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307
References: https://zammad.com/de/advisories/zaa-2022-07; https://zammad.com/de/advisories/zaa-2022-07
CVE: CVE-2022-2713
Published: 2022-08-08
Description: Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-613
References: https://github.com/cockpit-hq/cockpit/commit/dd8d0314912fa6517ebd2cc9939d9fafbe68731b; https://huntr.dev/bounties/3080fc96-75d7-4868-84de-9fc8c9b90290; https://github.com/cockpit-hq/cockpit/commit/dd8d0314912fa6517ebd2cc9939d9fafbe68731b
CVE: CVE-2022-35493
Published: 2022-08-08
Description: A Cross-site scripting (XSS) vulnerability in json search parse and the json response in wrteam.in, eShop - Multipurpose Ecommerce Store Website version 3.0.4 allows remote attackers to inject arbitrary web script or HTML via the get_products?search parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Keyvanhardani/Exploit-eShop-Multipurpose-Ecommerce-Store-Website-3.0.4-Cross-Site-Scripting-XSS/blob/main/README.md; https://github.com/Keyvanhardani/Exploit-eShop-Multipurpose-Ecommerce-Store-Website-3.0.4-Cross-Site-Scripting-XSS/blob/main/README.md
CVE: CVE-2022-36264
Published: 2022-08-08
Description: In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists an Unauthenticated remote Arbitrary File Upload vulnerability which allows overwriting arbitrary files. A malicious actor can remotely upload a file of their choice and overwrite any file in the system by manipulating the filename and append a relative path that will be interpreted during the upload process. Using this method, it is possible to rewrite any file in the system or upload a new file.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-434
References: https://gist.github.com/Nwqda/e82b3155401b094372195fdaa9b54833; https://wdi.rfwel.com/cdn/techdocs/AirSpot5410.pdf; https://gist.github.com/Nwqda/e82b3155401b094372195fdaa9b54833
CVE: CVE-2022-36265
Published: 2022-08-08
Description: In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Hidden system command web page. After performing a reverse engineering of the firmware, it was discovered that a hidden page not listed in the administration management interface allows a user to execute Linux commands on the device with root privileges. An authenticated malicious threat actor can use this page to fully compromise the device.
CVSS Score: 7.2 (HIGH)
References: https://gist.github.com/Nwqda/e82b3155401b094372195fdaa9b54833; https://wdi.rfwel.com/cdn/techdocs/AirSpot5410.pdf; https://gist.github.com/Nwqda/e82b3155401b094372195fdaa9b54833
CVE: CVE-2022-36266
Published: 2022-08-08
Description: In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a stored XSS vulnerability. As the binary file /home/www/cgi-bin/login.cgi does not check if the user is authenticated, a malicious actor can craft a specific request on the login.cgi endpoint that contains a base32 encoded XSS payload that will be accepted and stored. A successful attack will results in the injection of malicious scripts into the user settings page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/168114/FLIX-AX8-1.46.16-Remote-Command-Execution.html; https://gist.github.com/Nwqda/e82b3155401b094372195fdaa9b54833; https://wdi.rfwel.com/cdn/techdocs/AirSpot5410.pdf
CVE: CVE-2022-36267
Published: 2022-08-08
Description: In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Unauthenticated remote command injection vulnerability. The ping functionality can be called without user authentication when crafting a malicious http request by injecting code in one of the parameters allowing for remote code execution. This vulnerability is exploited via the binary file /home/www/cgi-bin/diagnostics.cgi that accepts unauthenticated requests and unsanitized data. As a result, a malicious actor can craft a specific request and interact remotely with the device.
CVSS Score: 9.8 (CRITICAL)
References: http://packetstormsecurity.com/files/168047/AirSpot-5410-0.3.4.1-4-Remote-Command-Injection.html; https://gist.github.com/Nwqda/e82b3155401b094372195fdaa9b54833; https://wdi.rfwel.com/cdn/techdocs/AirSpot5410.pdf
CVE: CVE-2022-34293
Published: 2022-08-08
Description: wolfSSL before 5.4.0 allows remote attackers to cause a denial of service via DTLS because a check for return-routability can be skipped.
CVSS Score: 7.5 (HIGH)
References: http://www.openwall.com/lists/oss-security/2022/08/08/6; https://github.com/wolfSSL/wolfssl/releases/tag/v5.4.0-stable; http://www.openwall.com/lists/oss-security/2022/08/08/6
CVE: CVE-2017-12152
Published: 2022-08-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-15106
Published: 2022-08-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-15109
Published: 2022-08-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-15122
Published: 2022-08-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-2588
Published: 2022-08-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-2593
Published: 2022-08-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-2597
Published: 2022-08-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-2631
Published: 2022-08-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-2657
Published: 2022-08-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-7527
Published: 2022-08-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2021-41615
Published: 2022-08-08
Description: websda.c in GoAhead WebServer 2.1.8 has insufficient nonce entropy because the nonce calculation relies on the hardcoded onceuponatimeinparadise value, which does not follow the secret-data guideline for HTTP Digest Access Authentication in RFC 7616 section 3.3 (or RFC 2617 section 3.2.1). NOTE: 2.1.8 is a version from 2003; however, the affected websda.c code appears in multiple derivative works that may be used in 2021. Recent GoAhead software is unaffected.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-331
References: https://devel.rtems.org/browser/rtems/cpukit/httpd/websda.c?rev=c1427d2758079f0e9dd6a8de1662d78e0d6bc4ca; https://github.com/trenta3/goahead-versions/blob/master/2.1.8/230165webs218.tar.gz?raw=true; https://devel.rtems.org/browser/rtems/cpukit/httpd/websda.c?rev=c1427d2758079f0e9dd6a8de1662d78e0d6bc4ca
CVE: CVE-2022-25907
Published: 2022-08-09
Description: The package ts-deepmerge before 2.0.2 are vulnerable to Prototype Pollution due to missing sanitization of the merge function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1321
References: https://github.com/voodoocreation/ts-deepmerge/commit/9be[PII_REDACTED]c57be9de39728d6ead18eddf10b; https://github.com/voodoocreation/ts-deepmerge/releases/tag/2.0.2; https://security.snyk.io/vuln/SNYK-JS-TSDEEPMERGE-2959975
CVE: CVE-2022-2715
Published: 2022-08-09
Description: A vulnerability has been found in SourceCodester Employee Management System and classified as critical. This vulnerability affects unknown code of the file eloginwel.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-205834 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/vuls/vuls/blob/main/Employee%20Management%20System/Employee%20Management%20System%20eloginwel.php%20SQL%20Injection.pdf; https://vuldb.com/?id.205834; https://github.com/vuls/vuls/blob/main/Employee%20Management%20System/Employee%20Management%20System%20eloginwel.php%20SQL%20Injection.pdf
CVE: CVE-2022-2722
Published: 2022-08-09
Description: A vulnerability was found in SourceCodester Simple Student Information System and classified as critical. This issue affects some unknown processing of the file manage_course.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-205835.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://bewhale.github.io/post/PHP%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1%E2%80%94Simple%20Student%20Information%20System%20manage_course.php%20SQL%20Injection/; https://vuldb.com/?id.205835; https://bewhale.github.io/post/PHP%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1%E2%80%94Simple%20Student%20Information%20System%20manage_course.php%20SQL%20Injection/