deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-2076
Published: 2023-04-14
Description: A vulnerability classified as problematic was found in Campcodes Online Traffic Offense Management System 1.0. This vulnerability affects unknown code of the file /classes/Users.phpp. The manipulation of the argument id leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-226054 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Online%20Traffic%20Offense%20Management%20System/Online%20Traffic%20Offense%20Management%20System%20-%20vuln%204.pdf; https://vuldb.com/?ctiid.226054; https://vuldb.com/?id.226054
CVE: CVE-2023-2077
Published: 2023-04-14
Description: A vulnerability, which was classified as problematic, has been found in Campcodes Online Traffic Offense Management System 1.0. This issue affects some unknown processing of the file /admin/offenses/view_details.php. The manipulation of the argument id leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226055.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Online%20Traffic%20Offense%20Management%20System/Online%20Traffic%20Offense%20Management%20System%20-%20vuln%205.pdf; https://vuldb.com/?ctiid.226055; https://vuldb.com/?id.226055
CVE: CVE-2023-30535
Published: 2023-04-14
Description: Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Users of the Snowflake JDBC driver were vulnerable to a command injection vulnerability. An attacker could set up a malicious, publicly accessible server which responds to the SSO URL with an attack payload. If the attacker then tricked a user into visiting the maliciously crafted connection URL, the user’s local machine would render the malicious payload, leading to a remote code execution. The vulnerability was patched on March 17, 2023 as part of Snowflake JDBC driver Version 3.13.29. All users should immediately upgrade the Snowflake JDBC driver to the latest version: 3.13.29.
CVSS Score: 7.3 (HIGH)
CWE: CWE-20, CWE-77
References: https://community.snowflake.com/s/article/JDBC-Driver-Release-Notes; https://github.com/snowflakedb/snowflake-jdbc/security/advisories/GHSA-4g3j-c4wg-6j7x; https://community.snowflake.com/s/article/JDBC-Driver-Release-Notes
CVE: CVE-2023-25597
Published: 2023-04-14
Description: A vulnerability in the web conferencing component of Mitel MiCollab through 9.6.2.9 could allow an unauthenticated attacker to download a shared file via a crafted request - including the exact path and filename - due to improper authentication control. A successful exploit could allow access to sensitive information.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0002; https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0002
CVE: CVE-2023-29085
Published: 2023-04-14
Description: An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, Exynos 9110, and Exynos Auto T5123. Memory corruption can occur due to insufficient parameter validation while decoding an SIP status line.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787, CWE-787
References: http://packetstormsecurity.com/files/172288/Shannon-Baseband-SIP-Status-Line-Stack-Buffer-Overflow.html; https://semiconductor.samsung.com/support/quality-support/product-security-updates/; http://packetstormsecurity.com/files/172288/Shannon-Baseband-SIP-Status-Line-Stack-Buffer-Overflow.html
CVE: CVE-2023-29086
Published: 2023-04-14
Description: An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, Exynos 9110, and Exynos Auto T5123. Memory corruption can occur due to insufficient parameter validation while decoding an SIP Min-SE header.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787, CWE-787
References: http://packetstormsecurity.com/files/172293/Shannon-Baseband-SIP-Min-SE-Header-Stack-Buffer-Overflow.html; https://semiconductor.samsung.com/support/quality-support/product-security-updates/; http://packetstormsecurity.com/files/172293/Shannon-Baseband-SIP-Min-SE-Header-Stack-Buffer-Overflow.html
CVE: CVE-2023-29087
Published: 2023-04-14
Description: An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, Exynos 9110, and Exynos Auto T5123. Memory corruption can occur due to insufficient parameter validation while decoding an SIP Retry-After header.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787, CWE-787
References: http://packetstormsecurity.com/files/172295/Shannon-Baseband-SIP-Retry-After-Header-Heap-Buffer-Overflow.html; https://semiconductor.samsung.com/support/quality-support/product-security-updates/; http://packetstormsecurity.com/files/172295/Shannon-Baseband-SIP-Retry-After-Header-Heap-Buffer-Overflow.html
CVE: CVE-2023-29088
Published: 2023-04-14
Description: An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, Exynos 9110, and Exynos Auto T5123. Memory corruption can occur due to insufficient parameter validation while decoding an SIP Session-Expires header.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787, CWE-787
References: http://packetstormsecurity.com/files/172289/Shannon-Baseband-SIP-Session-Expires-Header-Stack-Buffer-Overflow.html; https://semiconductor.samsung.com/support/quality-support/product-security-updates/; http://packetstormsecurity.com/files/172289/Shannon-Baseband-SIP-Session-Expires-Header-Stack-Buffer-Overflow.html
CVE: CVE-2023-29089
Published: 2023-04-14
Description: An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, Exynos 9110, and Exynos Auto T5123. Memory corruption can occur due to insufficient parameter validation while decoding SIP multipart messages.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-125, CWE-125
References: http://packetstormsecurity.com/files/172292/Shannon-Baseband-Negative-Size-Memcpy-Out-Of-Bounds-Read.html; https://semiconductor.samsung.com/support/quality-support/product-security-updates/; http://packetstormsecurity.com/files/172292/Shannon-Baseband-Negative-Size-Memcpy-Out-Of-Bounds-Read.html
CVE: CVE-2023-29090
Published: 2023-04-14
Description: An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, Exynos 9110, and Exynos Auto T5123. Memory corruption can occur due to insufficient parameter validation while decoding an SIP Via header.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787, CWE-787
References: http://packetstormsecurity.com/files/172287/Shannon-Baseband-Via-Header-Decoder-Stack-Buffer-Overflow.html; https://semiconductor.samsung.com/support/quality-support/product-security-updates/; http://packetstormsecurity.com/files/172287/Shannon-Baseband-Via-Header-Decoder-Stack-Buffer-Overflow.html
CVE: CVE-2023-29091
Published: 2023-04-14
Description: An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, Exynos 9110, and Exynos Auto T5123. Memory corruption can occur due to insufficient parameter validation while decoding an SIP URI.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787, CWE-1173
References: http://packetstormsecurity.com/files/172282/Shannon-Baseband-SIP-URI-Decoder-Stack-Buffer-Overflow.html; https://semiconductor.samsung.com/support/quality-support/product-security-updates/; http://packetstormsecurity.com/files/172282/Shannon-Baseband-SIP-URI-Decoder-Stack-Buffer-Overflow.html
CVE: CVE-2023-2004
Published: 2023-04-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-2008
Published: 2023-04-14
Description: A flaw was found in the Linux kernel's udmabuf device driver. The specific flaw exists within a fault handler. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an array. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129, CWE-129
References: https://bugzilla.redhat.com/show_bug.cgi?id=2186862; https://github.com/torvalds/linux/commit/05b252cccb2e5c3f56119d25de684b4f810ba4; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-24934
Published: 2023-04-14
Description: Microsoft Defender Security Feature Bypass Vulnerability
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-306
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24934; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24934
CVE: CVE-2023-29383
Published: 2023-04-14
Description: In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account.
CVSS Score: 3.3 (LOW)
CWE: CWE-74, CWE-125
References: https://github.com/shadow-maint/shadow/commit/e5905c4b84d4fb90aefcd96ee618411ebfac663d; https://github.com/shadow-maint/shadow/pull/687; https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2023-29383-abusing-linux-chfn-to-misrepresent-etc-passwd/
CVE: CVE-2021-46880
Published: 2023-04-15
Description: x509/x509_verify.c in LibreSSL before 3.4.2, and OpenBSD before 7.0 errata 006, allows authentication bypass because an error for an unverified certificate chain is sometimes discarded.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-295, CWE-295
References: https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.4.2-relnotes.txt; https://ftp.openbsd.org/pub/OpenBSD/patches/7.0/common/006_x509.patch.sig; https://github.com/openbsd/src/commit/3f851282810fa0ab4b90b3b1ecec2e8717ef16f8
CVE: CVE-2023-26463
Published: 2023-04-15
Description: strongSwan 5.9.8 and 5.9.9 potentially allows remote code execution because it uses a variable named "public" for two different purposes within the same function. There is initially incorrect access control, later followed by an expired pointer dereference. One attack vector is sending an untrusted client certificate during EAP-TLS. A server is affected only if it loads plugins that implement TLS-based EAP methods (EAP-TLS, EAP-TTLS, EAP-PEAP, or EAP-TNC). This is fixed in 5.9.10.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-295, CWE-476, CWE-295, CWE-476
References: https://github.com/strongswan/strongswan/releases; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.strongswan.org/blog/2023/03/02/strongswan-vulnerability-%28cve-2023-26463%29.html
CVE: CVE-2023-27571
Published: 2023-04-15
Description: An issue was discovered in DG3450 Cable Gateway AR01.02.056.18_041520_711.NCS.10. The troubleshooting_logs_download.php log file download functionality does not check the session cookie. Thus, an attacker can download all log files.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306, CWE-306
References: https://sec-consult.com/en/vulnerability-lab/advisories/index.html; https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-in-arris-dg3450-cable-gateway/; https://www.sec-consult.com/en/blog/
CVE: CVE-2023-27572
Published: 2023-04-15
Description: An issue was discovered in CommScope Arris DG3450 Cable Gateway AR01.02.056.18_041520_711.NCS.10. A reflected XSS vulnerability was discovered in the https_redirect.php web page via the page parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://sec-consult.com/en/vulnerability-lab/advisories/index.html; https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-in-arris-dg3450-cable-gateway/; https://www.sec-consult.com/en/blog/
CVE: CVE-2022-48177
Published: 2023-04-15
Description: X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the adin/importModels Import Records Model field (model parameter). This vulnerability allows attackers to create malicious JavaScript that will be executed by the victim user's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://packetstormsecurity.com/files/171792/X2CRM-6.6-6.9-Cross-Site-Scripting.html; https://sourceforge.net/projects/x2engine/; http://packetstormsecurity.com/files/171792/X2CRM-6.6-6.9-Cross-Site-Scripting.html
CVE: CVE-2022-48178
Published: 2023-04-15
Description: X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Create Action function, aka an index.php/actions/update URI.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://packetstormsecurity.com/files/171792/X2CRM-6.6-6.9-Cross-Site-Scripting.html; https://sourceforge.net/projects/x2engine/; http://packetstormsecurity.com/files/171792/X2CRM-6.6-6.9-Cross-Site-Scripting.html
CVE: CVE-2023-22669
Published: 2023-04-15
Description: Parsing of DWG files in Open Design Alliance Drawings SDK before 2023.6 lacks proper validation of the length of user-supplied XRecord data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.opendesign.com/security-advisories; https://www.opendesign.com/security-advisories
CVE: CVE-2023-22670
Published: 2023-04-15
Description: A heap-based buffer overflow exists in the DXF file reading procedure in Open Design Alliance Drawings SDK before 2023.6. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of the length of user-supplied XRecord data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.opendesign.com/security-advisories; https://www.opendesign.com/security-advisories
CVE: CVE-2023-24607
Published: 2023-04-15
Description: Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used and the size of SQLTCHAR is 4. The affected versions are 5.x before 5.15.13, 6.x before 6.2.8, and 6.3.x before 6.4.3.
CVSS Score: 7.5 (HIGH)
References: https://codereview.qt-project.org/c/qt/qtbase/+/456216; https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/456217; https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/456238
CVE: CVE-2022-43696
Published: 2023-04-15
Description: OX App Suite before 7.10.6-rev20 allows XSS via upsell ads.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://open-xchange.com; https://seclists.org/fulldisclosure/2023/Feb/3; https://open-xchange.com
CVE: CVE-2022-43697
Published: 2023-04-15
Description: OX App Suite before 7.10.6-rev30 allows XSS via an activity tracking adapter defined by jslob.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://open-xchange.com; https://seclists.org/fulldisclosure/2023/Feb/3; https://open-xchange.com
CVE: CVE-2022-43698
Published: 2023-04-15
Description: OX App Suite before 7.10.6-rev30 allows SSRF because changing a POP3 account disregards the deny-list.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://open-xchange.com; https://seclists.org/fulldisclosure/2023/Feb/3; https://open-xchange.com
CVE: CVE-2022-43699
Published: 2023-04-15
Description: OX App Suite before 7.10.6-rev30 allows SSRF because e-mail account discovery disregards the deny-list and thus can be attacked by an adversary who controls the DNS records of an external domain (found in the host part of an e-mail address).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://open-xchange.com; https://seclists.org/fulldisclosure/2023/Feb/3; https://open-xchange.com
CVE: CVE-2022-45030
Published: 2023-04-15
Description: A SQL injection vulnerability in rConfig 3.9.7 exists via lib/ajaxHandlers/ajaxCompareGetCmdDates.php?command= (this may interact with secure-file-priv).
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: http://packetstormsecurity.com/files/171613/rconfig-3.9.7-SQL-Injection.html; https://www.rconfig.com/downloads/rconfig-3.9.7.zip; http://packetstormsecurity.com/files/171613/rconfig-3.9.7-SQL-Injection.html
CVE: CVE-2022-47522
Published: 2023-04-15
Description: The IEEE 802.11 specifications through 802.11ax allow physically proximate attackers to intercept (possibly cleartext) target-destined frames by spoofing a target's MAC address, sending Power Save frames to the access point, and then sending other frames to the access point (such as authentication frames or re-association frames) to remove the target's original security context. This behavior occurs because the specifications do not require an access point to purge its transmit queue before removing a client's pairwise encryption key.
CVSS Score: 7.5 (HIGH)
CWE: CWE-290, CWE-290
References: https://papers.mathyvanhoef.com/usenix2023-wifi.pdf; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0006; https://www.freebsd.org/security/advisories/FreeBSD-SA-23:11.wifi.asc
CVE: CVE-2023-2027
Published: 2023-04-15
Description: The ZM Ajax Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.2. This is due to insufficient verification on the user being supplied during a Facebook login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288, CWE-287
References: https://plugins.trac.wordpress.org/browser/zm-ajax-login-register/trunk/src/ALRSocial/ALRSocialFacebook.php#L58; https://www.wordfence.com/threat-intel/vulnerabilities/id/b10d01ec-54ef-456b-9410-ed013343a962?source=cve; https://plugins.trac.wordpress.org/browser/zm-ajax-login-register/trunk/src/ALRSocial/ALRSocialFacebook.php#L58
CVE: CVE-2023-2089
Published: 2023-04-15
Description: A vulnerability was found in SourceCodester Complaint Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/userprofile.php of the component GET Parameter Handler. The manipulation of the argument uid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226097 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/winkle175/bug_report/blob/main/SQLi-1.md; https://vuldb.com/?ctiid.226097; https://vuldb.com/?id.226097
CVE: CVE-2023-2090
Published: 2023-04-15
Description: A vulnerability classified as critical has been found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. Affected is an unknown function of the file /admin/maintenance/view_designation.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-226098 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/4O4NtFd/bug_report/blob/main/SQLI1/SQLi-1.md; https://vuldb.com/?ctiid.226098; https://vuldb.com/?id.226098
CVE: CVE-2023-2091
Published: 2023-04-15
Description: A vulnerability classified as critical was found in KylinSoft youker-assistant on KylinOS. Affected by this vulnerability is the function adjust_cpufreq_scaling_governer. The manipulation leads to os command injection. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.4.13 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-226099.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://github.com/i900008/vulndb/blob/main/youker-assistant_vuln.md; https://kylinos.cn/support/loophole/patch/3375.html; https://vuldb.com/?ctiid.226099
CVE: CVE-2023-2092
Published: 2023-04-15
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Vehicle Service Management System 1.0. Affected by this issue is some unknown functionality of the file view_service.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-226100.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Vehicle%20Service%20Management%20System/Vehicle%20Service%20Management%20System%20-%20vuln%201.pdf; https://vuldb.com/?ctiid.226100; https://vuldb.com/?id.226100
CVE: CVE-2023-2093
Published: 2023-04-15
Description: A vulnerability, which was classified as critical, was found in SourceCodester Vehicle Service Management System 1.0. This affects an unknown part of the file /classes/Login.php. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226101 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Vehicle%20Service%20Management%20System/Vehicle%20Service%20Management%20System%20-%20vuln%202.pdf; https://vuldb.com/?ctiid.226101; https://vuldb.com/?id.226101
CVE: CVE-2023-2094
Published: 2023-04-15
Description: A vulnerability has been found in SourceCodester Vehicle Service Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/mechanics/manage_mechanic.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-226102 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Vehicle%20Service%20Management%20System/Vehicle%20Service%20Management%20System%20-%20vuln%203.pdf; https://vuldb.com/?ctiid.226102; https://vuldb.com/?id.226102
CVE: CVE-2023-2095
Published: 2023-04-15
Description: A vulnerability was found in SourceCodester Vehicle Service Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/maintenance/manage_category.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226103.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Vehicle%20Service%20Management%20System/Vehicle%20Service%20Management%20System%20-%20vuln%204.pdf; https://vuldb.com/?ctiid.226103; https://vuldb.com/?id.226103