deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-46734
Published: 2025-05-05
Description: league/commonmark is a PHP Markdown parser. A cross-site scripting (XSS) vulnerability in the Attributes extension of the league/commonmark library (versions 1.5.0 through 2.6.x) allows remote attackers to insert malicious JavaScript calls into HTML. The league/commonmark library provides configuration options such as `html_input: 'strip'` and `allow_unsafe_links: false` to mitigate cross-site scripting (XSS) attacks by stripping raw HTML and disallowing unsafe links. However, when the Attributes Extension is enabled, it introduces a way for users to inject arbitrary HTML attributes into elements via Markdown syntax using curly braces. Version 2.7.0 contains three changes to prevent this XSS attack vector: All attributes starting with `on` are considered unsafe and blocked by default; support for an explicit allowlist of allowed HTML attributes; and manually-added `href` and `src` attributes now respect the existing `allow_unsafe_links` configuration option. If upgrading is not feasible, please consider disabling the `AttributesExtension` for untrusted users and/or filtering the rendered HTML through a library like HTMLPurifier.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/thephpleague/commonmark/commit/f0d626cf05ad3e99e6db26ebcb9091b6cd1cd89b; https://github.com/thephpleague/commonmark/security/advisories/GHSA-3527-qv2q-pfvx
CVE: CVE-2025-46813
Published: 2025-05-05
Description: Discourse is an open-source community platform. A data leak vulnerability affects sites deployed between commits 10df7fdee060d44accdee7679d66d778d1136510 and 82d84af6b0efbd9fa2aeec3e91ce7be1a768511b. On login-required sites, the leak meant that some content on the site's homepage could be visible to unauthenticated users. Only login-required sites that got deployed during this timeframe are affected, roughly between April 30 2025 noon EDT and May 2 2025, noon EDT. Sites on the stable branch are unaffected. Private content on an instance's homepage could be visible to unauthenticated users on login-required sites. Versions of 3.5.0.beta4 after commit 82d84af6b0efbd9fa2aeec3e91ce7be1a768511b are not vulnerable to the issue. No workarounds are available. Sites must upgrade to a non-vulnerable version of Discourse.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-200
References: https://github.com/discourse/discourse/commit/10df7fdee060d44accdee7679d66d778d1136510; https://github.com/discourse/discourse/commit/82d84af6b0efbd9fa2aeec3e91ce7be1a768511b; https://github.com/discourse/discourse/security/advisories/GHSA-v3h7-c287-pfg9
CVE: CVE-2025-4286
Published: 2025-05-05
Description: A vulnerability was found in Intelbras InControl up to 2.21.59. It has been classified as problematic. Affected is an unknown function of the component Dispositivos Edição Page. The manipulation of the argument Senha de Comunicação leads to unprotected storage of credentials. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. According to the vendor this issue should be fixed in a later release.
CVSS Score: 2.7 (LOW)
CWE: CWE-255, CWE-256
References: https://eldruin.notion.site/Intelbras-InControl-v2-21-57-Storing-password-in-insecure-format-17d27474cccb8003b647ea832186b162?pvs=4; https://vuldb.com/?ctiid.307392; https://vuldb.com/?id.307392
CVE: CVE-2025-4287
Published: 2025-05-05
Description: A vulnerability was found in PyTorch 2.6.0+cu124. It has been rated as problematic. Affected by this issue is the function torch.cuda.nccl.reduce of the file torch/cuda/nccl.py. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The patch is identified as 5827d2061dcb4acd05ac5f8e65d8693a481ba0f5. It is recommended to apply a patch to fix this issue.
CVSS Score: 3.3 (LOW)
CWE: CWE-404
References: https://github.com/Divigroup-RAP/PYTORCH/commit/5827d2061dcb4acd05ac5f8e65d8693a481ba0f5; https://github.com/pytorch/pytorch/issues/150836; https://github.com/pytorch/pytorch/issues/150836#issue[PII_REDACTED]
CVE: CVE-2025-0915
Published: 2025-05-05
Description: IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 



under specific configurations could allow an authenticated user to cause a denial of service due to insufficient release of allocated memory resources.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770
References: https://www.ibm.com/support/pages/node/7232529; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2025-1000
Published: 2025-05-05
Description: IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 

could allow an authenticated user to cause a denial of service when connecting to a z/OS database due to improper handling of automatic client rerouting.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770
References: https://www.ibm.com/support/pages/node/7232528; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2025-1493
Published: 2025-05-05
Description: IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 12.1.0 through 12.1.1 





could allow an authenticated user to cause a denial of service due to concurrent execution of shared resources.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-362
References: https://www.ibm.com/support/pages/node/7232518; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2025-4288
Published: 2025-05-05
Description: A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7. This affects an unknown part of the component RNFR Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://fitoxs.com/exploit/exploit-aab361888e671e1705f94c27c26f9bc7c9c63d3c66d5df89e31dcaf7fa17f528.txt; https://vuldb.com/?ctiid.307395; https://vuldb.com/?id.307395
CVE: CVE-2025-4289
Published: 2025-05-05
Description: A vulnerability classified as critical was found in PCMan FTP Server 2.0.7. This vulnerability affects unknown code of the component RNTO Command Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://fitoxs.com/exploit/exploit-0c70a8b6f3e2d1312bbfa8fcb8e44c802394c3adfb7c1f860a18e9fdc88d8e9c3.txt; https://vuldb.com/?ctiid.307396; https://vuldb.com/?id.307396
CVE: CVE-2025-44071
Published: 2025-05-05
Description: SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component phomebak.php. This vulnerability allows attackers to execute arbitrary code via a crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://github.com/[PII_REDACTED]06/CVE/blob/master/seacms/seacms_rce.md
CVE: CVE-2025-44072
Published: 2025-05-05
Description: SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_manager.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/[PII_REDACTED]06/CVE/blob/master/seacms/seacms_manage_sql.md
CVE: CVE-2025-44074
Published: 2025-05-05
Description: SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_topic.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/[PII_REDACTED]06/CVE/blob/master/seacms/seacms_topic_sql.md
CVE: CVE-2025-4290
Published: 2025-05-05
Description: A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7. This issue affects some unknown processing of the component SMNT Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://fitoxs.com/exploit/exploit-1d02cb01af712a1176c64e21664ade52d09ec09ab368d4501d7d09296bcd395b.txt; https://vuldb.com/?ctiid.307397; https://vuldb.com/?id.307397
CVE: CVE-2025-4291
Published: 2025-05-05
Description: A vulnerability, which was classified as critical, was found in IdeaCMS up to 1.6. Affected is the function saveUpload. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://gitee.com/ideacms/ideacms/issues/IC32SB; https://vuldb.com/?ctiid.307398; https://vuldb.com/?id.307398
CVE: CVE-2025-4292
Published: 2025-05-05
Description: A vulnerability has been found in MRCMS 3.1.3 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/user/edit.do of the component Edit User Page. The manipulation of the argument Username leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/bdkuzma/vuln/issues/1; https://vuldb.com/?ctiid.307399; https://vuldb.com/?id.307399
CVE: CVE-2025-4293
Published: 2025-05-05
Description: A vulnerability was found in MRCMS 3.1.3 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/group/edit.do of the component Group Edit Page. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/bdkuzma/vuln/issues/2; https://vuldb.com/?ctiid.307400; https://vuldb.com/?id.307400
CVE: CVE-2025-4297
Published: 2025-05-05
Description: A vulnerability was found in PHPGurukul Men Salon Management System 2.0. It has been classified as critical. This affects an unknown part of the file /admin/change-password.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Multiple parameters might be affected.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/lierran1/CVE/issues/1; https://phpgurukul.com/; https://vuldb.com/?ctiid.307401
CVE: CVE-2025-4298
Published: 2025-05-06
Description: A vulnerability was found in Tenda AC1206 up to 15.03.06.23. It has been declared as critical. This vulnerability affects the function formSetCfm of the file /goform/setcfm. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/CH13hh/tmp_store_cc/blob/main/AC1206/AC1206formSetCfm/formSetCfm.md; https://vuldb.com/?ctiid.307402; https://vuldb.com/?id.307402
CVE: CVE-2025-4299
Published: 2025-05-06
Description: A vulnerability was found in Tenda AC1206 up to 15.03.06.23. It has been rated as critical. This issue affects the function setSchedWifi of the file /goform/openSchedWifi. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/CH13hh/tmp_store_cc/blob/main/AC1206/AC1206setSchedWifi/setSchedWifi.md; https://vuldb.com/?ctiid.307403; https://vuldb.com/?id.307403
CVE: CVE-2025-4300
Published: 2025-05-06
Description: A vulnerability classified as critical has been found in itsourcecode Content Management System 1.0. Affected is an unknown function of the file /search_list.php. The manipulation of the argument Search leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/6BXK6/cve/issues/1; https://itsourcecode.com/; https://vuldb.com/?ctiid.307404
CVE: CVE-2025-2509
Published: 2025-05-06
Description: Out-of-Bounds Read in Virglrenderer in ChromeOS  16093.57.0 allows a malicious guest VM to achieve arbitrary address access within the crosvm sandboxed process, potentially leading to 
VM escape via crafted vertex elements data triggering an out-of-bounds read in util_format_description.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://issues.chromium.org/issues/b/385851796; https://issuetracker.google.com/issues/385851796
CVE: CVE-2025-46728
Published: 2025-05-06
Description: cpp-httplib is a C++ header-only HTTP/HTTPS server and client library. Prior to version 0.20.1, the library fails to enforce configured size limits on incoming request bodies when `Transfer-Encoding: chunked` is used or when no `Content-Length` header is provided. A remote attacker can send a chunked request without the terminating zero-length chunk, causing uncontrolled memory allocation on the server. This leads to potential exhaustion of system memory and results in a server crash or unresponsiveness. Version 0.20.1 fixes the issue by enforcing limits during parsing. If the limit is exceeded at any point during reading, the connection is terminated immediately. A short-term workaround through a Reverse Proxy is available. If updating the library immediately is not feasible, deploy a reverse proxy (e.g., Nginx, HAProxy) in front of the `cpp-httplib` application. Configure the proxy to enforce maximum request body size limits, thereby stopping excessively large requests before they reach the vulnerable library code.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/yhirose/cpp-httplib/commit/7b752106ac42bd5b907793950d9125a0972c8e8e; https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-px83-72rx-v57c
CVE: CVE-2025-4301
Published: 2025-05-06
Description: A vulnerability classified as critical was found in itsourcecode Content Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /search-notice.php. The manipulation of the argument searchdata leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/6BXK6/cve/issues/2; https://itsourcecode.com/; https://vuldb.com/?ctiid.307405
CVE: CVE-2025-4303
Published: 2025-05-06
Description: A vulnerability, which was classified as critical, has been found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. Affected by this issue is some unknown functionality of the file /add-phlebotomist.php. The manipulation of the argument empid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/eneover/myCVE/issues/1; https://phpgurukul.com/; https://vuldb.com/?ctiid.307406
CVE: CVE-2024-39442
Published: 2025-05-06
Description: In sprd ssense service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
CVSS Score: 6.2 (MEDIUM)
References: https://www.unisoc.com/en_us/secy/announcementDetail/[PII_REDACTED]86395905
CVE: CVE-2025-4304
Published: 2025-05-06
Description: A vulnerability, which was classified as critical, was found in PHPGurukul Cyber Cafe Management System 1.0. This affects an unknown part of the file /adminprofile.php. The manipulation of the argument mobilenumber leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/[PII_REDACTED]/myCVE/issues/3; https://phpgurukul.com/; https://vuldb.com/?ctiid.307407
CVE: CVE-2025-4305
Published: 2025-05-06
Description: A vulnerability has been found in kefaming mayi up to 1.3.9 and classified as critical. This vulnerability affects the function Upload of the file app/tools/controller/File.php. The manipulation of the argument File leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://github.com/caigo8/CVE-md/blob/main/%E8%9A%82%E8%9A%81%E6%88%90%E7%BB%A9%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F/%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0RCE.md; https://vuldb.com/?ctiid.307408; https://vuldb.com/?id.307408
CVE: CVE-2025-3609
Published: 2025-05-06
Description: The Reales WP STPT plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 2.1.2. This is due to the 'reales_user_signup_form' AJAX action not verifying if user registration is enabled, prior to registering a user. This makes it possible for unauthenticated attackers to create new user accounts, which can be leveraged with CVE-XX to achieve privilege escalation.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: https://themeforest.net/item/reales-wp-real-estate-wordpress-theme/10330568; https://www.wordfence.com/threat-intel/vulnerabilities/id/f9f3250f-39a1-4ba1-b9a2-222926635ca0?source=cve
CVE: CVE-2025-3610
Published: 2025-05-06
Description: The Reales WP STPT plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.1.2. This is due to the plugin not properly validating a user's identity prior to updating their details like password. This makes it possible for authenticated attackers, with subscriber-level access and above, to change arbitrary user's passwords and email addresses, including administrators, and leverage that to gain access to their account. This can be combined with CVE-2025-3609 to achieve remote code execution as an originally unauthenticated user with no account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-639
References: https://themeforest.net/item/reales-wp-real-estate-wordpress-theme/10330568; https://www.wordfence.com/threat-intel/vulnerabilities/id/38c6b149-39d7-491a-9f3a-261087a52a03?source=cve
CVE: CVE-2025-4306
Published: 2025-05-06
Description: A vulnerability was found in PHPGurukul Nipah Virus Testing Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /edit-phlebotomist.php. The manipulation of the argument mobilenumber leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/xiguala123/myCVE/issues/3; https://phpgurukul.com/; https://vuldb.com/?ctiid.307409
CVE: CVE-2025-4307
Published: 2025-05-06
Description: A vulnerability was found in PHPGurukul Art Gallery Management System 1.1. It has been classified as critical. Affected is an unknown function of the file /admin/add-art-medium.php. The manipulation of the argument artmed leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/[PII_REDACTED]/myCVE/issues/4; https://phpgurukul.com/; https://vuldb.com/?ctiid.307410
CVE: CVE-2025-4308
Published: 2025-05-06
Description: A vulnerability was found in PHPGurukul Art Gallery Management System 1.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/add-art-type.php. The manipulation of the argument arttype leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/[PII_REDACTED]/myCVE/issues/5; https://phpgurukul.com/; https://vuldb.com/?ctiid.307411
CVE: CVE-2025-4309
Published: 2025-05-06
Description: A vulnerability was found in PHPGurukul Art Gallery Management System 1.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/add-art-type.php. The manipulation of the argument arttype leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/lierran1/CVE/issues/3; https://phpgurukul.com/; https://vuldb.com/?ctiid.307412
CVE: CVE-2025-4310
Published: 2025-05-06
Description: A vulnerability classified as critical has been found in itsourcecode Content Management System 1.0. This affects an unknown part of the file /admin/add_topic.php?category=BBS. The manipulation of the argument Cover Image leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/ZhaoxuepengS/CVE-vul/issues/1; https://itsourcecode.com/; https://vuldb.com/?ctiid.307413
CVE: CVE-2025-4311
Published: 2025-05-06
Description: A vulnerability classified as critical was found in itsourcecode Content Management System 1.0. This vulnerability affects unknown code of the file /admin/update_main_topic_img.php?topic_id=529. The manipulation of the argument stopic_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/ZhaoxuepengS/CVE-vul/issues/2; https://itsourcecode.com/; https://vuldb.com/?ctiid.307414
CVE: CVE-2025-4312
Published: 2025-05-06
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Advanced Web Store 1.0. This issue affects some unknown processing of the file /productdetail.php. The manipulation of the argument prodid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Samsamue1/CVE/issues/1; https://vuldb.com/?ctiid.307415; https://vuldb.com/?id.307415
CVE: CVE-2025-2802
Published: 2025-05-06
Description: The LayoutBoxx plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 0.3.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVSS Score: 7.3 (HIGH)
CWE: CWE-94
References: https://plugins.svn.wordpress.org/layoutboxx/trunk/layoutboxx.php; https://wordpress.org/plugins/layoutboxx/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/fc3fcb8f-f130-4008-8f11-d98efa30f1a8?source=cve
CVE: CVE-2025-4313
Published: 2025-05-06
Description: A vulnerability, which was classified as critical, was found in SourceCodester Advanced Web Store 1.0. Affected is an unknown function of the file /admin/admin_addnew_product.php. The manipulation of the argument txtProdId leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Samsamue1/CVE/issues/2; https://vuldb.com/?ctiid.307416; https://vuldb.com/?id.307416
CVE: CVE-2025-4314
Published: 2025-05-06
Description: A vulnerability has been found in SourceCodester Advanced Web Store 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/index.php. The manipulation of the argument txtLogin leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Samsamue1/CVE/issues/3; https://vuldb.com/?ctiid.307417; https://vuldb.com/?id.307417