deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-5260
Published: 2023-09-29
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Simple Membership System 1.0. This issue affects some unknown processing of the file group_validator.php. The manipulation of the argument club_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240869 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1even-321/Membership-System/blob/main/Simple-Membership-System%20group_validator.php%20has%20Sqlinjection.pdf; https://vuldb.com/?ctiid.240869; https://vuldb.com/?id.240869
CVE: CVE-2023-5261
Published: 2023-09-29
Description: A vulnerability, which was classified as critical, was found in Tongda OA 2017. Affected is an unknown function of the file general/hr/manage/staff_title_evaluation/delete.php. The manipulation of the argument EVALUATION_ID leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. VDB-240870 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/csbsong/bug_report/blob/main/sql2.md; https://vuldb.com/?ctiid.240870; https://vuldb.com/?id.240870
CVE: CVE-2023-5288
Published: 2023-09-29
Description: 
A remote unauthorized attacker may connect to the SIM1012, interact with the device and
change configuration settings. The adversary may also reset the SIM and in the worst case upload a
new firmware version to the device.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://sick.com/.well-known/csaf/white/2023/sca-2023-0008.json; https://sick.com/.well-known/csaf/white/2023/sca-2023-0008.pdf; https://sick.com/psirt
CVE: CVE-2023-43909
Published: 2023-09-29
Description: Hospital Management System thru commit 4770d was discovered to contain a SQL injection vulnerability via the app_contact parameter in appsearch.php.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89
References: https://www.notion.so/SQL-Injection-vulnerability-in-app_contact-parameter-on-appsearch-php-directory-2e3daa8975164ee18217c52c43ae1a22; https://www.notion.so/SQL-Injection-vulnerability-in-app_contact-parameter-on-appsearch-php-directory-2e3daa8975164ee18217c52c43ae1a22
CVE: CVE-2023-43944
Published: 2023-09-29
Description: A Stored Cross Site Scripting (XSS) vulnerability was found in SourceCodester Task Management System 1.0. It allows attackers to execute arbitrary code via parameter field in index.php?page=project_list.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://purring-climb-52a.notion.site/Reflected-Cross-site-scripting-b6fd50b94b464313847bb52d4049154f?pvs=4; https://purring-climb-52a.notion.site/Reflected-Cross-site-scripting-b6fd50b94b464313847bb52d4049154f?pvs=4
CVE: CVE-2023-39308
Published: 2023-09-29
Description: Unauth. Stored Cross-Site Scripting (XSS) vulnerability in UserFeedback Team User Feedback plugin <= 1.0.7 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/userfeedback-lite/wordpress-userfeedback-lite-plugin-1-0-7-cross-site-scripting-xss-vulnerability?_s_id=cve; https://revan-ar.medium.com/cve-2023-39308-wordpress-plugin-user-feedback-1-0-7-unauthenticated-stored-xss-db992a01686a; https://patchstack.com/database/vulnerability/userfeedback-lite/wordpress-userfeedback-lite-plugin-1-0-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-41655
Published: 2023-09-29
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Andreas Heigl authLdap plugin <= 2.5.9 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/authldap/wordpress-authldap-plugin-2-5-8-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/authldap/wordpress-authldap-plugin-2-5-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-41657
Published: 2023-09-29
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Groundhogg Inc. HollerBox plugin <= 2.3.2 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/holler-box/wordpress-hollerbox-plugin-2-3-2-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/holler-box/wordpress-hollerbox-plugin-2-3-2-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-41658
Published: 2023-09-29
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Photo Gallery Slideshow & Masonry Tiled Gallery plugin <= 1.0.13 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-responsive-photo-gallery/wordpress-photo-gallery-slideshow-masonry-tiled-gallery-plugin-1-0-13-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-responsive-photo-gallery/wordpress-photo-gallery-slideshow-masonry-tiled-gallery-plugin-1-0-13-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-41661
Published: 2023-09-29
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PressPage Entertainment Inc. Smarty for WordPress plugin <= 3.1.35 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/smarty-for-wordpress/wordpress-smarty-for-wordpress-plugin-3-1-35-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/smarty-for-wordpress/wordpress-smarty-for-wordpress-plugin-3-1-35-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-41662
Published: 2023-09-29
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ulf Benjaminsson WP-dTree plugin <= 4.4.5 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-dtree-30/wordpress-wp-dtree-plugin-4-4-5-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-dtree-30/wordpress-wp-dtree-plugin-4-4-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-41663
Published: 2023-09-29
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Giovambattista Fazioli WP Bannerize Pro plugin <= 1.6.9 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-bannerize-pro/wordpress-wp-bannerize-pro-plugin-1-6-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-bannerize-pro/wordpress-wp-bannerize-pro-plugin-1-6-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-41666
Published: 2023-09-29
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Stockdio Stock Quotes List plugin <= 2.9.9 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/stock-quotes-list/wordpress-stock-quotes-list-plugin-2-9-9-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/stock-quotes-list/wordpress-stock-quotes-list-plugin-2-9-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-41687
Published: 2023-09-29
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Irina Sokolovskaya Goods Catalog plugin <= 2.4.1 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/goods-catalog/wordpress-goods-catalog-plugin-2-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/goods-catalog/wordpress-goods-catalog-plugin-2-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-41691
Published: 2023-09-29
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Pensopay WooCommerce PensoPay plugin <= 6.3.1 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/woo-pensopay/wordpress-woocommerce-pensopay-plugin-6-3-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woo-pensopay/wordpress-woocommerce-pensopay-plugin-6-3-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-5262
Published: 2023-09-29
Description: A vulnerability has been found in OpenRapid RapidCMS 1.3.1 and classified as critical. Affected by this vulnerability is the function isImg of the file /admin/config/uploadicon.php. The manipulation of the argument fileName leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240871.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/OpenRapid/rapidcms/issues/10; https://github.com/yhy217/rapidcms-vul/issues/5; https://vuldb.com/?ctiid.240871
CVE: CVE-2023-5263
Published: 2023-09-29
Description: A vulnerability was found in ZZZCMS 2.1.7 and classified as critical. Affected by this issue is the function restore of the file /admin/save.php of the component Database Backup File Handler. The manipulation leads to permission issues. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240872.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-275
References: https://github.com/yhy217/zzzcms-vul/issues/1; https://vuldb.com/?ctiid.240872; https://vuldb.com/?id.240872
CVE: CVE-2023-5289
Published: 2023-09-29
Description: Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.8.4.
CVSS Score: 8.8 (HIGH)
CWE: CWE-770
References: https://github.com/ikus060/rdiffweb/commit/06f89b43469aae70e8833e[PII_REDACTED]3f86c5a2; https://huntr.dev/bounties/8d0e0804-d3fd-49fe-bfa4-7a91135767ce; https://github.com/ikus060/rdiffweb/commit/06f89b43469aae70e8833e[PII_REDACTED]3f86c5a2
CVE: CVE-2023-5264
Published: 2023-09-29
Description: A vulnerability classified as critical was found in huakecms 3.0. Affected by this vulnerability is an unknown functionality of the file /admin/cms_content.php. The manipulation of the argument cid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240877 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/yhy217/huakecms-vul/issues/1; https://vuldb.com/?ctiid.240877; https://vuldb.com/?id.240877
CVE: CVE-2023-5265
Published: 2023-09-29
Description: A vulnerability, which was classified as critical, has been found in Tongda OA 2017. Affected by this issue is some unknown functionality of the file general/hr/manage/staff_transfer/delete.php. The manipulation of the argument TRANSFER_ID leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. VDB-240878 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/YaGaoT/cve/blob/main/sql.md; https://vuldb.com/?ctiid.240878; https://vuldb.com/?id.240878
CVE: CVE-2023-5266
Published: 2023-09-29
Description: A vulnerability, which was classified as critical, was found in DedeBIZ 6.2. This affects an unknown part of the file /src/admin/tags_main.php. The manipulation of the argument ids leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240879.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/yhy217/dedebiz--vul/blob/main/time_injection.zip; https://github.com/yhy217/dedebiz--vul/issues/1; https://vuldb.com/?ctiid.240879
CVE: CVE-2023-5267
Published: 2023-09-29
Description: A vulnerability has been found in Tongda OA 2017 and classified as critical. This vulnerability affects unknown code of the file general/hr/recruit/hr_pool/delete.php. The manipulation of the argument EXPERT_ID leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-240880.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/kpz-wm/cve/blob/main/sql.md; https://vuldb.com/?ctiid.240880; https://vuldb.com/?id.240880
CVE: CVE-2023-5268
Published: 2023-09-29
Description: A vulnerability was found in DedeBIZ 6.2 and classified as critical. This issue affects some unknown processing of the file /src/admin/makehtml_taglist_action.php. The manipulation of the argument mktime leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240881 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/yhy217/dedebiz--vul/issues/2; https://vuldb.com/?ctiid.240881; https://vuldb.com/?id.240881
CVE: CVE-2023-5269
Published: 2023-09-29
Description: A vulnerability was found in SourceCodester Best Courier Management System 1.0. It has been classified as critical. Affected is an unknown function of the file parcel_list.php of the component GET Parameter Handler. The manipulation of the argument id/s leads to sql injection. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Best%20courier%20management%20system/Best%20courier%20management%20system%20project%20in%20php%20-%20vuln%201.pdf; https://vuldb.com/?ctiid.240882; https://vuldb.com/?id.240882
CVE: CVE-2023-5270
Published: 2023-09-29
Description: A vulnerability was found in SourceCodester Best Courier Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file view_parcel.php. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240883.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Best%20courier%20management%20system/Best%20courier%20management%20system%20project%20in%20php%20-%20vuln%202.pdf; https://vuldb.com/?ctiid.240883; https://vuldb.com/?id.240883
CVE: CVE-2023-5271
Published: 2023-09-29
Description: A vulnerability was found in SourceCodester Best Courier Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file edit_parcel.php. The manipulation of the argument email leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240884.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Best%20courier%20management%20system/Best%20courier%20management%20system%20project%20in%20php%20-%20vuln%203.pdf; https://vuldb.com/?ctiid.240884; https://vuldb.com/?id.240884
CVE: CVE-2023-39410
Published: 2023-09-29
Description: When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system.

This issue affects Java applications using Apache Avro Java SDK up to and including 1.11.2.  Users should update to apache-avro version 1.11.3 which addresses this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-502, CWE-502
References: https://lists.apache.org/thread/q142wj99cwdd0jo5lvdoxzoymlqyjdds; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.openwall.com/lists/oss-security/2023/09/29/6
CVE: CVE-2023-3024
Published: 2023-09-29
Description: Forcing the Bluetooth LE stack to segment 'prepare write response' packets can lead to an out-of-bounds memory access.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-787, CWE-119
References: https://github.com/SiliconLabs/gecko_sdk; https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000ViQvHQAV/?operationContext=S1; https://github.com/SiliconLabs/gecko_sdk
CVE: CVE-2023-5272
Published: 2023-09-29
Description: A vulnerability classified as critical has been found in SourceCodester Best Courier Management System 1.0. This affects an unknown part of the file edit_parcel.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-240885 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Best%20courier%20management%20system/Best%20courier%20management%20system%20project%20in%20php%20-%20vuln%204.pdf; https://vuldb.com/?ctiid.240885; https://vuldb.com/?id.240885
CVE: CVE-2023-5273
Published: 2023-09-29
Description: A vulnerability classified as problematic was found in SourceCodester Best Courier Management System 1.0. This vulnerability affects unknown code of the file manage_parcel_status.php. The manipulation of the argument id leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-240886 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Best%20courier%20management%20system/Best%20courier%20management%20system%20project%20in%20php%20-%20vuln%206.pdf; https://vuldb.com/?ctiid.240886; https://vuldb.com/?id.240886
CVE: CVE-2023-26218
Published: 2023-09-29
Description: The Web Client component of TIBCO Software Inc.'s TIBCO Nimbus contains easily exploitable Reflected Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker to social engineer a legitimate user with network access to execute scripts targeting the affected system or the victim's local system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO Nimbus: versions 10.6.0 and below.


CVSS Score: 8.0 (HIGH)
CWE: CWE-79, CWE-79
References: https://www.tibco.com/services/support/advisories; https://www.tibco.com/services/support/advisories
CVE: CVE-2023-5276
Published: 2023-09-29
Description: A vulnerability classified as critical was found in SourceCodester Engineers Online Portal 1.0. This vulnerability affects unknown code of the file downloadable_student.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The identifier of this vulnerability is VDB-240904.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/llixixi/Engineers-Online-Portal-System/blob/main/Engineers%20Online%20Portal%20System%20downloadable_student.php%20has%20Sqlinjection.pdf; https://vuldb.com/?ctiid.240904; https://vuldb.com/?id.240904
CVE: CVE-2023-5277
Published: 2023-09-29
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Engineers Online Portal 1.0. This issue affects some unknown processing of the file student_avatar.php. The manipulation of the argument change leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240905 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/llixixi/Engineers-Online-Portal-System/blob/main/Engineers%20Online%20Portal%20System%20has%20a%20file%20upload%20(RCE)%20vulnerability.pdf; https://vuldb.com/?ctiid.240905; https://vuldb.com/?id.240905
CVE: CVE-2023-5278
Published: 2023-09-29
Description: A vulnerability, which was classified as critical, was found in SourceCodester Engineers Online Portal 1.0. Affected is an unknown function of the file login.php. The manipulation of the argument username/password leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-240906 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/llixixi/Engineers-Online-Portal-System/blob/main/Engineers%20Online%20Portal%20System%20login.php%20has%20Sqlinjection.pdf; https://vuldb.com/?ctiid.240906; https://vuldb.com/?id.240906
CVE: CVE-2023-5279
Published: 2023-09-29
Description: A vulnerability has been found in SourceCodester Engineers Online Portal 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file my_classmates.php. The manipulation of the argument teacher_class_student_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240907.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/llixixi/Engineers-Online-Portal-System/blob/main/Engineers%20Online%20Portal%20System%20my_classmates.php%20%20has%20Sqlinjection.pdf; https://vuldb.com/?ctiid.240907; https://vuldb.com/?id.240907
CVE: CVE-2023-5280
Published: 2023-09-29
Description: A vulnerability was found in SourceCodester Engineers Online Portal 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file my_students.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240908.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/llixixi/Engineers-Online-Portal-System/blob/main/Engineers%20Online%20Portal%20System%20my_students.php%20has%20Sqlinjection.pdf; https://vuldb.com/?ctiid.240908; https://vuldb.com/?id.240908
CVE: CVE-2023-5281
Published: 2023-09-29
Description: A vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been classified as critical. This affects an unknown part of the file remove_inbox_message.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240909 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/llixixi/Engineers-Online-Portal-System/blob/main/Engineers%20Online%20Portal%20System%20remove_inbox_message.php%20has%20Sqlinjection.pdf; https://vuldb.com/?ctiid.240909; https://vuldb.com/?id.240909
CVE: CVE-2023-5282
Published: 2023-09-29
Description: A vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been declared as critical. This vulnerability affects unknown code of the file seed_message_student.php. The manipulation of the argument teacher_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-240910 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/llixixi/Engineers-Online-Portal-System/blob/main/Engineers%20Online%20Portal%20System%20seed_message_student.php%20has%20Sqlinjection.pdf; https://vuldb.com/?ctiid.240910; https://vuldb.com/?id.240910