deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-38504
Published: 2023-07-27
Description: Sails is a realtime MVC Framework for Node.js. In Sails apps prior to version 1.5.7,, an attacker can send a virtual request that will cause the node process to crash. This behavior was fixed in Sails v1.5.7. As a workaround, disable the sockets hook and remove the `sails.io.js` client.
CVSS Score: 7.5 (HIGH)
CWE: CWE-248
References: https://github.com/balderdashy/sails/commit/4a023dc5095a4b30fdc8535f705ed34cd22d2f7d; https://github.com/balderdashy/sails/pull/7287; https://github.com/balderdashy/sails/releases/tag/v1.5.7
CVE: CVE-2023-38505
Published: 2023-07-27
Description: DietPi-Dashboard is a web dashboard for the operating system DietPi. The dashboard only allows for one TLS handshake to be in process at a given moment. Once a TCP connection is established in HTTPS mode, it will assume that it should be waiting for a handshake, and will stay this way indefinitely until a handshake starts or some error occurs. In version 0.6.1, this can be exploited by simply not starting the handshake, preventing any other TLS handshakes from getting through. An attacker can lock the dashboard in a state where it is waiting for a TLS handshake from the attacker, who won't provide it. This prevents any legitimate traffic from getting to the dashboard, and can last indefinitely. Version 0.6.2 has a patch for this issue. As a workaround, do not use HTTPS mode on the open internet where anyone can connect. Instead, put a reverse proxy in front of the dashboard, and have it handle any HTTPS connections.
CVSS Score: 7.5 (HIGH)
CWE: CWE-410, CWE-412, CWE-667
References: https://asciinema.org/a/8nRKbdf7AkPLmP3QxFZUSmPwp?t=7; https://github.com/ravenclaw900/DietPi-Dashboard/commit/79cd78615d28f577454415e4baafe4dcd9d09666; https://github.com/ravenclaw900/DietPi-Dashboard/pull/606
CVE: CVE-2023-38510
Published: 2023-07-27
Description: Tolgee is an open-source localization platform. Starting in version 3.14.0 and prior to version 3.23.1, when a request is made using an API key, the backend fails to verify the permission scopes associated with the key, effectively bypassing permission checks entirely for some endpoints. It's important to note that this vulnerability only affects projects that have inadvertently exposed their API keys on the internet. Projects that have kept their API keys secure are not impacted. This issue is fixed in version 3.23.1.
CVSS Score: 8.1 (HIGH)
CWE: CWE-862
References: https://github.com/tolgee/tolgee-platform/commit/4776cba67e7bb8c1b0259376e3e5fa3bb46e45c7; https://github.com/tolgee/tolgee-platform/pull/1818; https://github.com/tolgee/tolgee-platform/releases/tag/v3.23.1
CVE: CVE-2023-3980
Published: 2023-07-27
Description: Cross-site Scripting (XSS) - Stored in GitHub repository omeka/omeka-s prior to 4.0.2.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/omeka/omeka-s/commit/c6833c0531a07bd914e9f85a61bbbc16e9b4c8df; https://huntr.dev/bounties/6eb3cb9a-5c78-451f-ae76-0b1e62fe5e54; https://github.com/omeka/omeka-s/commit/c6833c0531a07bd914e9f85a61bbbc16e9b4c8df
CVE: CVE-2023-3981
Published: 2023-07-27
Description: Server-Side Request Forgery (SSRF) in GitHub repository omeka/omeka-s prior to 4.0.2.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://github.com/omeka/omeka-s/commit/dc01ca1b03e845db8a6a6b665d8da36c8dcd2c31; https://huntr.dev/bounties/f5[PII_REDACTED]-415d-9675-d7e30934ff78; https://github.com/omeka/omeka-s/commit/dc01ca1b03e845db8a6a6b665d8da36c8dcd2c31
CVE: CVE-2023-3982
Published: 2023-07-27
Description: Cross-site Scripting (XSS) - Stored in GitHub repository omeka/omeka-s prior to 4.0.2.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/omeka/omeka-s/commit/27ff6575c88d970ce95e1d4096553a927e2003b9; https://huntr.dev/bounties/e5e889ee-5947-4c2a-a72e-9c90e2e2a845; https://github.com/omeka/omeka-s/commit/27ff6575c88d970ce95e1d4096553a927e2003b9
CVE: CVE-2020-22623
Published: 2023-07-27
Description: Directory traversal vulnerability in Jinfornet Jreport 15.6 allows unauthenticated attackers to gain sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://jinfornet.com; http://jreport.com; https://medium.com/%40nguyenhongphu/cve-2020-22623-jinfornet-jreport-unauthenticated-path-traversal-arbitrary-file-download-83224cef32c8
CVE: CVE-2023-36942
Published: 2023-07-27
Description: A cross-site scripting (XSS) vulnerability in PHPGurukul Online Fire Reporting System Using PHP and MySQL 1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the website title field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40ridheshgohil1092/cve-2023-36942-xss-on-online-fire-reporting-system-v-1-2-19357e54978c; https://packetstormsecurity.com; https://medium.com/%40ridheshgohil1092/cve-2023-36942-xss-on-online-fire-reporting-system-v-1-2-19357e54978c
CVE: CVE-2023-23764
Published: 2023-07-27
Description: An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect diff within the GitHub pull request UI. To do so, an attacker would need write access to the repository. This vulnerability affected GitHub Enterprise Server versions 3.7.0 and above and was fixed in versions 3.7.9, 3.8.2, and 3.9.1. This vulnerability was reported via the GitHub Bug Bounty program.


CVSS Score: 4.8 (MEDIUM)
CWE: CWE-697, CWE-697
References: https://docs.github.com/en/enterprise-server@3.7/admin/release-notes#3.7.9; https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.2; https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.1
CVE: CVE-2023-33742
Published: 2023-07-27
Description: TeleAdapt RoomCast TA-2400 1.0 through 3.1 suffers from Cleartext Storage of Sensitive Information: RSA private key in Update.exe.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: http://packetstormsecurity.com/files/173764/RoomCast-TA-2400-Cleartext-Private-Key-Improper-Access-Control.html; http://packetstormsecurity.com/files/173764/RoomCast-TA-2400-Cleartext-Private-Key-Improper-Access-Control.html
CVE: CVE-2023-33743
Published: 2023-07-27
Description: TeleAdapt RoomCast TA-2400 1.0 through 3.1 is vulnerable to Improper Access Control; specifically, Android Debug Bridge (adb) is available.
CVSS Score: 9.8 (CRITICAL)
References: http://packetstormsecurity.com/files/173764/RoomCast-TA-2400-Cleartext-Private-Key-Improper-Access-Control.html; http://packetstormsecurity.com/files/173764/RoomCast-TA-2400-Cleartext-Private-Key-Improper-Access-Control.html
CVE: CVE-2023-33744
Published: 2023-07-27
Description: TeleAdapt RoomCast TA-2400 1.0 through 3.1 suffers from Use of a Hard-coded Password (PIN): 385521, 843646, and 592671.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://packetstormsecurity.com/files/173764/RoomCast-TA-2400-Cleartext-Private-Key-Improper-Access-Control.html; http://packetstormsecurity.com/files/173764/RoomCast-TA-2400-Cleartext-Private-Key-Improper-Access-Control.html
CVE: CVE-2023-33745
Published: 2023-07-27
Description: TeleAdapt RoomCast TA-2400 1.0 through 3.1 is vulnerable to Improper Privilege Management: from the shell available after an adb connection, simply entering the su command provides root access (without requiring a password).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276
References: http://packetstormsecurity.com/files/173764/RoomCast-TA-2400-Cleartext-Private-Key-Improper-Access-Control.html; http://packetstormsecurity.com/files/173764/RoomCast-TA-2400-Cleartext-Private-Key-Improper-Access-Control.html
CVE: CVE-2022-43701
Published: 2023-07-27
Description: When the installation directory does not have sufficiently restrictive file permissions, an attacker can modify files in the installation directory to cause execution of malicious code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://developer.arm.com/documentation/ka005596/latest; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00930.html; https://developer.arm.com/documentation/ka005596/latest
CVE: CVE-2022-43702
Published: 2023-07-27
Description: When the directory containing the installer does not have sufficiently restrictive file permissions, an attacker can modify (or replace) the installer to execute malicious code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284, CWE-276
References: https://developer.arm.com/documentation/ka005596/latest; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00930.html; https://developer.arm.com/documentation/ka005596/latest
CVE: CVE-2022-43703
Published: 2023-07-27
Description: An installer that loads or executes files using an unconstrained search path may be vulnerable to substitute files under control of an attacker being loaded or executed instead of the intended files.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://developer.arm.com/documentation/ka005596/latest; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00930.html; https://developer.arm.com/documentation/ka005596/latest
CVE: CVE-2023-3774
Published: 2023-07-28
Description: An unhandled error in Vault Enterprise's namespace creation may cause the Vault process to crash, potentially resulting in denial of service. Fixed in 1.14.1, 1.13.5, and 1.12.9.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-248, CWE-755
References: https://discuss.hashicorp.com/t/hcsec-2023-23-vault-enterprise-namespace-creation-may-lead-to-denial-of-service/56617; https://discuss.hashicorp.com/t/hcsec-2023-23-vault-enterprise-namespace-creation-may-lead-to-denial-of-service/56617
CVE: CVE-2022-31454
Published: 2023-07-28
Description: Yii 2 v2.0.45 was discovered to contain a cross-site scripting (XSS) vulnerability via the endpoint /books. NOTE: this is disputed by the vendor because the cve-2022-31454-8e8555c31fd3 page does not describe why /books has a relationship to Yii 2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40rohitgautam26/cve-2022-31454-8e8555c31fd3; https://medium.com/%40rohitgautam26/cve-2022-31454-8e8555c31fd3
CVE: CVE-2023-38331
Published: 2023-07-28
Description: Zoho ManageEngine Support Center Plus 14001 and below is vulnerable to stored XSS in the products module.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://manageengine.com; https://www.manageengine.com/products/service-desk/CVE-2023-38331.html; https://manageengine.com
CVE: CVE-2023-3984
Published: 2023-07-28
Description: A vulnerability, which was classified as critical, was found in phpscriptpoint RecipePoint 1.9. This affects an unknown part of the file /recipe-result. The manipulation of the argument text/category/type/difficulty/cuisine/cooking_method leads to sql injection. It is possible to initiate the attack remotely. The identifier VDB-235605 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.235605; https://vuldb.com/?id.235605; https://vuldb.com/?ctiid.235605
CVE: CVE-2023-0958
Published: 2023-07-28
Description: Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for authenticated attackers with minimal permissions, such as subscribers, to install select plugins from Inisev on vulnerable sites. CVE-2023-38514 appears to be a duplicate of this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.2.7/includes/banner/misc.php#L427; https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.2.8/includes/banner/misc.php#L434; https://plugins.trac.wordpress.org/browser/copy-delete-posts/tags/1.3.8/banner/misc.php#L426
CVE: CVE-2023-28203
Published: 2023-07-28
Description: The issue was addressed with improved checks. This issue is fixed in Apple Music 4.2.0 for Android. An app may be able to access contacts.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/HT213833; https://support.apple.com/en-us/HT213833
CVE: CVE-2023-32427
Published: 2023-07-28
Description: This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in Apple Music 4.2.0 for Android. An attacker in a privileged network position may be able to intercept network traffic.
CVSS Score: 5.9 (MEDIUM)
References: https://support.apple.com/en-us/HT213833; https://support.apple.com/en-us/HT213833
CVE: CVE-2023-32444
Published: 2023-07-28
Description: A logic issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.7.9, macOS Monterey 12.6.8, macOS Ventura 13.5. A sandboxed process may be able to circumvent sandbox restrictions.
CVSS Score: 7.5 (HIGH)
References: https://support.apple.com/en-us/HT213843; https://support.apple.com/en-us/HT213844; https://support.apple.com/en-us/HT213845
CVE: CVE-2023-32445
Published: 2023-07-28
Description: This issue was addressed with improved checks. This issue is fixed in Safari 16.6, watchOS 9.6, iOS 15.7.8 and iPadOS 15.7.8, tvOS 16.6, iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. Processing a document may lead to a cross site scripting attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.apple.com/en-us/HT213841; https://support.apple.com/en-us/HT213842; https://support.apple.com/en-us/HT213843
CVE: CVE-2023-32654
Published: 2023-07-28
Description: A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.5. A user may be able to read information belonging to another user.
CVSS Score: 6.5 (MEDIUM)
References: https://support.apple.com/en-us/HT213843; https://support.apple.com/kb/HT213843; https://support.apple.com/en-us/HT213843
CVE: CVE-2023-34425
Published: 2023-07-28
Description: The issue was addressed with improved memory handling. This issue is fixed in watchOS 9.6, macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, macOS Big Sur 11.7.9, iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 9.8 (CRITICAL)
References: https://support.apple.com/en-us/HT213841; https://support.apple.com/en-us/HT213842; https://support.apple.com/en-us/HT213843
CVE: CVE-2023-36495
Published: 2023-07-28
Description: An integer overflow was addressed with improved input validation. This issue is fixed in watchOS 9.6, macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, tvOS 16.6, iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://support.apple.com/en-us/HT213841; https://support.apple.com/en-us/HT213842; https://support.apple.com/en-us/HT213843
CVE: CVE-2023-37285
Published: 2023-07-28
Description: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 15.7.8 and iPadOS 15.7.8, macOS Big Sur 11.7.9, macOS Monterey 12.6.8, macOS Ventura 13.5. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://support.apple.com/en-us/HT213842; https://support.apple.com/en-us/HT213843; https://support.apple.com/en-us/HT213844
CVE: CVE-2023-38571
Published: 2023-07-28
Description: This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Big Sur 11.7.9, macOS Monterey 12.6.8, macOS Ventura 13.5. An app may be able to bypass Privacy preferences.
CVSS Score: 7.5 (HIGH)
References: https://support.apple.com/en-us/HT213843; https://support.apple.com/en-us/HT213844; https://support.apple.com/en-us/HT213845
CVE: CVE-2023-38590
Published: 2023-07-28
Description: A buffer overflow issue was addressed with improved memory handling. This issue is fixed in watchOS 9.6, macOS Big Sur 11.7.9, iOS 15.7.8 and iPadOS 15.7.8, macOS Monterey 12.6.8, tvOS 16.6, iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. A remote user may be able to cause unexpected system termination or corrupt kernel memory.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://support.apple.com/en-us/HT213841; https://support.apple.com/en-us/HT213842; https://support.apple.com/en-us/HT213843
CVE: CVE-2023-38592
Published: 2023-07-28
Description: A logic issue was addressed with improved restrictions. This issue is fixed in iOS 16.6 and iPadOS 16.6, watchOS 9.6, tvOS 16.6, macOS Ventura 13.5. Processing web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
References: http://www.openwall.com/lists/oss-security/2023/08/02/1; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJ4DG5LHWG2INDOTPB7MO4JVJN6LKL3M/; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KQXJYKTGLKI6TJEFJCKPHCNY7PS72OER/
CVE: CVE-2023-38598
Published: 2023-07-28
Description: A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 9.6, macOS Big Sur 11.7.9, iOS 15.7.8 and iPadOS 15.7.8, macOS Monterey 12.6.8, tvOS 16.6, iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://support.apple.com/en-us/HT213841; https://support.apple.com/en-us/HT213842; https://support.apple.com/en-us/HT213843
CVE: CVE-2023-38599
Published: 2023-07-28
Description: A logic issue was addressed with improved state management. This issue is fixed in Safari 16.6, watchOS 9.6, iOS 15.7.8 and iPadOS 15.7.8, tvOS 16.6, iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. A website may be able to track sensitive user information.
CVSS Score: 6.5 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2023/08/02/1; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJ4DG5LHWG2INDOTPB7MO4JVJN6LKL3M/; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KQXJYKTGLKI6TJEFJCKPHCNY7PS72OER/
CVE: CVE-2023-38601
Published: 2023-07-28
Description: This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Big Sur 11.7.9, macOS Monterey 12.6.8, macOS Ventura 13.5. An app may be able to modify protected parts of the file system.
CVSS Score: 7.5 (HIGH)
References: https://support.apple.com/en-us/HT213843; https://support.apple.com/en-us/HT213844; https://support.apple.com/en-us/HT213845
CVE: CVE-2023-38604
Published: 2023-07-28
Description: An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in watchOS 9.6, macOS Big Sur 11.7.9, iOS 15.7.8 and iPadOS 15.7.8, macOS Monterey 12.6.8, tvOS 16.6, iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://support.apple.com/en-us/HT213841; https://support.apple.com/en-us/HT213842; https://support.apple.com/en-us/HT213843
CVE: CVE-2023-38609
Published: 2023-07-28
Description: An injection issue was addressed with improved input validation. This issue is fixed in macOS Ventura 13.5. An app may be able to bypass certain Privacy preferences.
CVSS Score: 7.5 (HIGH)
CWE: CWE-74
References: https://support.apple.com/en-us/HT213843; https://support.apple.com/kb/HT213843; https://support.apple.com/en-us/HT213843
CVE: CVE-2023-3977
Published: 2023-07-28
Description: Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for unauthenticated attackers to install plugins from the limited list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.2.7/includes/banner/misc.php#L427; https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.2.8/includes/banner/misc.php#L434; https://plugins.trac.wordpress.org/browser/copy-delete-posts/tags/1.3.8/banner/misc.php#L426
CVE: CVE-2023-3985
Published: 2023-07-28
Description: A vulnerability has been found in SourceCodester Online Jewelry Store 1.0 and classified as critical. This vulnerability affects unknown code of the file login.php. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-235606 is the identifier assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/MaxLiu98/Jewelry-Store-System/blob/main/Jewelry%20Store%20System%20login.php%20has%20Sqlinjection.pdf; https://vuldb.com/?ctiid.235606; https://vuldb.com/?id.235606
CVE: CVE-2023-3986
Published: 2023-07-28
Description: A vulnerability was found in SourceCodester Simple Online Mens Salon Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file /admin/?page=user/list. The manipulation of the argument First Name/Last Name/Username leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-235607.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/draco1725/POC/blob/main/Exploit/Simple%20Online%20Men's%20Salon%20Management%20System/Stored%20XSS; https://vuldb.com/?ctiid.235607; https://vuldb.com/?id.235607
CVE: CVE-2023-3987
Published: 2023-07-28
Description: A vulnerability was found in SourceCodester Simple Online Mens Salon Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/?page=user/manage_user&id=3. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-235608.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/draco1725/POC/blob/main/Exploit/Simple%20Online%20Men's%20Salon%20Management%20System/SQL%20Injection; https://vuldb.com/?ctiid.235608; https://vuldb.com/?id.235608
CVE: CVE-2023-3988
Published: 2023-07-28
Description: A vulnerability was found in Cafe Billing System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file index.php of the component Order Handler. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-235609 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/excuses0217/CveHub/blob/main/Cafe%20Billing%20System%20index.php%20has%20Sqlinjection.md; https://vuldb.com/?ctiid.235609; https://vuldb.com/?id.235609
CVE: CVE-2023-3989
Published: 2023-07-28
Description: A vulnerability was found in SourceCodester Jewelry Store System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file add_customer.php. The manipulation leads to cross site scripting. The attack may be launched remotely. VDB-235610 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/zouzuo1994321/Jewelry-Store-System/blob/main/Jewelry%20Store%20System%20add_customer.php%20has%20Cross%20Site%20Scripting(Xss)%20vulnerability.pdf; https://vuldb.com/?ctiid.235610; https://vuldb.com/?id.235610