deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-25077
Published: 2023-01-18
Description: A vulnerability was found in melnaron mel-spintax. It has been rated as problematic. Affected by this issue is some unknown functionality of the file lib/spintax.js. The manipulation of the argument text leads to inefficient regular expression complexity. The name of the patch is[PII_REDACTED]6e27b87b63004e30216e8f919637d3. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218456.
CVSS Score: 3.5 (LOW)
CWE: CWE-1333
References: https://github.com/melnaron/mel-spintax/commit/[PII_REDACTED]6e27b87b63004e30216e8f919637d3; https://vuldb.com/?ctiid.218456; https://vuldb.com/?id.218456
CVE: CVE-2020-36651
Published: 2023-01-18
Description: A vulnerability has been found in youngerheart nodeserver and classified as critical. Affected by this vulnerability is an unknown functionality of the file nodeserver.js. The manipulation leads to path traversal. The identifier of the patch is c4c0f0138ab5afbac58e03915d446680421bde28. It is recommended to apply a patch to fix this issue. The identifier VDB-218461 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/youngerheart/nodeserver/commit/c4c0f0138ab5afbac58e03915d446680421bde28; https://github.com/youngerheart/nodeserver/pull/6; https://vuldb.com/?ctiid.218461
CVE: CVE-2022-41989
Published: 2023-01-18
Description: Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 does not validate the length of RTLS report payloads during communication. This allows an attacker to send an exceedingly long payload, resulting in an out-of-bounds write to cause a denial-of-service condition or code execution.


CVSS Score: 9.0 (CRITICAL)
CWE: CWE-787
References: https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-01; https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-01
CVE: CVE-2022-43455
Published: 2023-01-18
Description: Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to improper input validation of user input to the service_start, service_stop, and service_restart modules of the software. This could allow an attacker to start, stop, or restart arbitrary services running on the server.


CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-01; https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-01
CVE: CVE-2022-43483
Published: 2023-01-18
Description: Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 does not properly validate the input module name to the monitor services of the software. This could allow a remote attacker to access sensitive functions of the application and execute arbitrary system commands.


CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78
References: https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-01; https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-01
CVE: CVE-2022-45127
Published: 2023-01-18
Description: Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to cross-site request forgery in its backup services. An attacker could take advantage of this vulnerability to execute arbitrary backup operations and cause a denial-of-service condition.


CVSS Score: 8.1 (HIGH)
CWE: CWE-352, CWE-352
References: https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-01; https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-01
CVE: CVE-2022-45444
Published: 2023-01-18
Description: Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 contains hard-coded passwords for select users in the application’s database. This could allow a remote attacker to login to the database with unrestricted access.


CVSS Score: 10.0 (CRITICAL)
CWE: CWE-259, CWE-798
References: https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-01; https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-01
CVE: CVE-2022-46733
Published: 2023-01-18
Description: Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to cross-site scripting in its backup services. An attacker could take advantage of this vulnerability to execute arbitrary commands.


CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-01; https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-01
CVE: CVE-2022-47395
Published: 2023-01-18
Description: Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to cross-site request forgery in its monitor services. An attacker could take advantage of this vulnerability to execute arbitrary maintenance operations and cause a denial-of-service condition.


CVSS Score: 8.1 (HIGH)
CWE: CWE-352
References: https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-01; https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-01
CVE: CVE-2022-47911
Published: 2023-01-18
Description: Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 does not properly validate the input module name to the backup services of the software. This could allow a remote attacker to access sensitive functions of the application and execute arbitrary system commands.


CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78
References: https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-01; https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-01
CVE: CVE-2022-47917
Published: 2023-01-18
Description: Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to improper input validation of user input to several modules and services of the software. This could allow an attacker to delete arbitrary files and cause a denial-of-service condition.


CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-01; https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-01
CVE: CVE-2023-21860
Published: 2023-01-18
Description: Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: Internal Operations).  Supported versions that are affected are 7.4.38 and prior, 7.5.28 and prior, 7.6.24 and prior and  8.0.31 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284
References: https://www.oracle.com/security-alerts/cpujan2023.html; https://www.oracle.com/security-alerts/cpujan2023.html
CVE: CVE-2023-0358
Published: 2023-01-18
Description: Use After Free in GitHub repository gpac/gpac prior to 2.3.0-DEV.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://github.com/gpac/gpac/commit/9971fb125cf91cefd081a080c417b90bbe4a467b; https://huntr.dev/bounties/93e128ed-253f-4c42-81ff-fbac7fd8f355; https://github.com/gpac/gpac/commit/9971fb125cf91cefd081a080c417b90bbe4a467b
CVE: CVE-2022-25901
Published: 2023-01-18
Description: Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the Cookie.parse function, which uses an insecure regular expression.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1333, CWE-1333
References: https://github.com/bmeck/node-cookiejar/blob/master/cookiejar.js%23L73; https://github.com/bmeck/node-cookiejar/pull/39; https://github.com/bmeck/node-cookiejar/pull/39/commits/eaa00021caf6ae09449dde826108153b578348e5
CVE: CVE-2010-10007
Published: 2023-01-18
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in lierdakil click-reminder. It has been rated as critical. This issue affects the function db_query of the file src/backend/include/BaseAction.php. The manipulation leads to sql injection. The identifier of the patch is 41213b660e8eb01b22c8074f06208f59a73ca8dc. It is recommended to apply a patch to fix this issue. The identifier VDB-218465 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/lierdakil/click-reminder/commit/41213b660e8eb01b22c8074f06208f59a73ca8dc; https://vuldb.com/?ctiid.218465; https://vuldb.com/?id.218465
CVE: CVE-2022-32490
Published: 2023-01-18
Description: 
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.






CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.dell.com/support/kbdoc/000204685; https://www.dell.com/support/kbdoc/000204685
CVE: CVE-2022-34393
Published: 2023-01-18
Description: 
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.






CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.dell.com/support/kbdoc/000204686; https://www.dell.com/support/kbdoc/000204686
CVE: CVE-2022-34401
Published: 2023-01-18
Description: 
Dell BIOS contains a stack based buffer overflow vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to send larger than expected input to a parameter in order to gain arbitrary code execution in SMRAM.






CVSS Score: 7.5 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.dell.com/support/kbdoc/000204679; https://www.dell.com/support/kbdoc/000204679
CVE: CVE-2022-34456
Published: 2023-01-18
Description: 
Dell EMC Metro node, Version(s) prior to 7.1, contain a Code Injection Vulnerability. An authenticated nonprivileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application.






CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-94
References: https://www.dell.com/support/kbdoc/en-us/000204057/dsa-2022-267-dell-emc-metronode-vs5-security-update-for-multiple-third-party-component-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000204057/dsa-2022-267-dell-emc-metronode-vs5-security-update-for-multiple-third-party-component-vulnerabilities
CVE: CVE-2022-34460
Published: 2023-01-18
Description: 
Prior Dell BIOS versions contain an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.






CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.dell.com/support/kbdoc/000204686; https://www.dell.com/support/kbdoc/000204686
CVE: CVE-2022-34442
Published: 2023-01-18
Description: 
Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerability.  An attacker with the knowledge of the hard-coded sensitive information, could potentially exploit this vulnerability to login to the system to gain LDAP user privileges.






CVSS Score: 8.0 (HIGH)
CWE: CWE-321, CWE-798
References: https://www.dell.com/support/kbdoc/en-us/000204995/dsa-2022-273-dell-secure-connect-gateway-policy-manager-security-update-for-multiple-proprietary-code-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000204995/dsa-2022-273-dell-secure-connect-gateway-policy-manager-security-update-for-multiple-proprietary-code-vulnerabilities
CVE: CVE-2022-34462
Published: 2023-01-18
Description: 
Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a Hard-coded Password Vulnerability. An attacker, with the knowledge of the hard-coded credentials, could potentially exploit this vulnerability to login to the system to gain admin privileges.






CVSS Score: 8.4 (HIGH)
CWE: CWE-321, CWE-798
References: https://www.dell.com/support/kbdoc/en-us/000204995/dsa-2022-273-dell-secure-connect-gateway-policy-manager-security-update-for-multiple-proprietary-code-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000204995/dsa-2022-273-dell-secure-connect-gateway-policy-manager-security-update-for-multiple-proprietary-code-vulnerabilities
CVE: CVE-2015-10068
Published: 2023-01-18
Description: A vulnerability classified as critical was found in danynab movify-j. This vulnerability affects the function getByMovieId of the file app/business/impl/ReviewServiceImpl.java. The manipulation of the argument movieId/username leads to sql injection. The name of the patch is c3085e01936a4d7eff1eda3093f25d56cc4d2ec5. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218476.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/danynab/movify-j/commit/c3085e01936a4d7eff1eda3093f25d56cc4d2ec5; https://vuldb.com/?ctiid.218476; https://vuldb.com/?id.218476
CVE: CVE-2020-36653
Published: 2023-01-18
Description: A vulnerability was found in GENI Portal. It has been rated as problematic. Affected by this issue is some unknown functionality of the file portal/www/portal/error-text.php. The manipulation of the argument error leads to cross site scripting. The attack may be launched remotely. The patch is identified as c2356cc[PII_REDACTED]3bfaa3a94d1ab074f554938. It is recommended to apply a patch to fix this issue. VDB-218474 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/GENI-NSF/geni-portal/commit/c2356cc[PII_REDACTED]3bfaa3a94d1ab074f554938; https://github.com/GENI-NSF/geni-portal/pull/1822; https://vuldb.com/?ctiid.218474
CVE: CVE-2020-36654
Published: 2023-01-18
Description: A vulnerability classified as problematic has been found in GENI Portal. This affects the function no_invocation_id_error of the file portal/www/portal/sliceresource.php. The manipulation of the argument invocation_id/invocation_user leads to cross site scripting. It is possible to initiate the attack remotely. The patch is named 39a96fb4b822bd3497442a96135de498d4a81337. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218475.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/GENI-NSF/geni-portal/commit/39a96fb4b822bd3497442a96135de498d4a81337; https://github.com/GENI-NSF/geni-portal/pull/1824; https://vuldb.com/?ctiid.218475
CVE: CVE-2023-0214
Published: 2023-01-18
Description: A cross-site scripting vulnerability in Skyhigh SWG in main releases 11.x prior to 11.2.6, 10.x prior to 10.2.17, and controlled release 12.x prior to 12.0.1 allows a remote attacker to craft SWG-specific internal requests with URL paths to any third-party website, causing arbitrary content to be injected into the response when accessed through SWG.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://kcm.trellix.com/corporate/index?page=content&id=SB10393; https://kcm.trellix.com/corporate/index?page=content&id=SB10393
CVE: CVE-2022-34399
Published: 2023-01-18
Description: 
Dell Alienware m17 R5 BIOS version prior to 1.2.2 contain a buffer access vulnerability. A malicious user with admin privileges could potentially exploit this vulnerability by sending input larger than expected in order to leak certain sections of SMRAM.






CVSS Score: 5.1 (MEDIUM)
CWE: CWE-805, CWE-119
References: https://www.dell.com/support/kbdoc/en-us/000205329/dsa-2022-317-dell-client-security-update-for-dell-client-bios; https://www.dell.com/support/kbdoc/en-us/000205329/dsa-2022-317-dell-client-security-update-for-dell-client-bios
CVE: CVE-2022-34435
Published: 2023-01-18
Description: 
Dell iDRAC9 version 6.00.02.00 and prior contain an improper input validation vulnerability in Racadm when the firmware lock-down configuration is set. A remote high privileged attacker could exploit this vulnerability to bypass the firmware lock-down configuration and perform a firmware update.






CVSS Score: 2.7 (LOW)
CWE: CWE-20, CWE-20
References: https://www.dell.com/support/kbdoc/000205346; https://www.dell.com/support/kbdoc/000205346
CVE: CVE-2022-34436
Published: 2023-01-18
Description: 
Dell iDRAC8 version 2.83.83.83 and prior contain an improper input validation vulnerability in Racadm when the firmware lock-down configuration is set. A remote high privileged attacker could exploit this vulnerability to bypass the firmware lock-down configuration and perform a firmware update.






CVSS Score: 2.7 (LOW)
CWE: CWE-20, CWE-20
References: https://www.dell.com/support/kbdoc/en-us/000205346/dsa-2022-265-dell-idrac8-and-dell-idrac9-security-update-for-a-racadm-vulnerability; https://www.dell.com/support/kbdoc/en-us/000205346/dsa-2022-265-dell-idrac8-and-dell-idrac9-security-update-for-a-racadm-vulnerability
CVE: CVE-2022-34457
Published: 2023-01-18
Description: 
Dell command configuration, version 4.8 and prior, contains improper folder permission when installed not to default path but to non-secured path which leads to privilege escalation. This is critical severity vulnerability as it allows non-admin to modify the files inside installed directory and able to make application unavailable for all users.






CVSS Score: 7.3 (HIGH)
CWE: CWE-284, CWE-732
References: https://www.dell.com/support/kbdoc/000205633; https://www.dell.com/support/kbdoc/000205633
CVE: CVE-2020-22007
Published: 2023-01-18
Description: OS Command Injection vulnerability in OKER G955V1 v1.03.02.20161128, allows physical attackers to interrupt the boot sequence and execute arbitrary commands with root privileges.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-862, CWE-862
References: http://www.okerthai.com; https://gist.github.com/tanprathan/69fbf6fbac11988e12f44069ec5b18ea#file-cve-2020-22007-txt; https://www.dropbox.com/s/cnzwbxhxl0ahzoa/OKER_UART_2.mp4
CVE: CVE-2021-36630
Published: 2023-01-18
Description: DDOS reflection amplification vulnerability in eAut module of Ruckus Wireless SmartZone controller that allows remote attackers to perform DOS attacks via crafted request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-770
References: http://ruckus.com; http://smartzone-100.com; https://anquan.baidu.com/article/1434
CVE: CVE-2021-33959
Published: 2023-01-18
Description: Plex media server 1.21 and before is vulnerable to ddos reflection attack via plex service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-346, CWE-346
References: https://github.com/lixiang957/CVE-2021-33959; https://www.freebuf.com/articles/web/260338.html; https://github.com/lixiang957/CVE-2021-33959
CVE: CVE-2022-41417
Published: 2023-01-18
Description: BlogEngine.NET v3.3.8.0 allows an attacker to create any folder with "files" prefix under ~/App_Data/.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862, CWE-862
References: https://gist.github.com/tree-chtsec/22a0a531ea188fd5b76fe11d32f41e95; https://github.com/BlogEngine/BlogEngine.NET/commit/7f927567db94462ffd37e128c0a53c11c1f81a8d; https://gist.github.com/tree-chtsec/22a0a531ea188fd5b76fe11d32f41e95
CVE: CVE-2017-20172
Published: 2023-01-18
Description: A vulnerability was found in ridhoq soundslike. It has been classified as critical. Affected is the function get_song_relations of the file app/api/songs.py. The manipulation leads to sql injection. The patch is identified as 90bb4fb667d9253d497b619b9adaac83bf0ce0f8. It is recommended to apply a patch to fix this issue. VDB-218490 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/ridhoq/soundslike/commit/90bb4fb667d9253d497b619b9adaac83bf0ce0f8; https://github.com/ridhoq/soundslike/pull/5; https://vuldb.com/?ctiid.218490
CVE: CVE-2022-45103
Published: 2023-01-18
Description: 
Dell Unisphere for PowerMax vApp, VASA Provider vApp, and Solution Enabler vApp version 9.2.3.x contain an information disclosure vulnerability. A low privileged remote attacker could potentially exploit this vulnerability, leading to read arbitrary files on the underlying file system.






CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://www.dell.com/support/kbdoc/en-us/000207177/dsa-2022-340-dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000207177/dsa-2022-340-dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities
CVE: CVE-2022-47881
Published: 2023-01-18
Description: Foxit PDF Reader and PDF Editor 11.2.1.53537 and earlier has an Out-of-Bounds Read vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://hacksys.io/advisories/HI-2022-005; https://www.foxit.com/support/security-bulletins.html; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2023-0385
Published: 2023-01-18
Description: The Custom 404 Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.7.1. This is due to missing or incorrect nonce validation on the custom_404_pro_admin_init function. This makes it possible for unauthenticated attackers to delete logs, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/custom-404-pro/tags/3.7.1/admin/AdminClass.php#L114; https://www.wordfence.com/threat-intel/vulnerabilities/id/968920b9-febf-4d76-a16b-f27954cd72e5?source=cve; https://plugins.trac.wordpress.org/browser/custom-404-pro/tags/3.7.1/admin/AdminClass.php#L114
CVE: CVE-2011-10001
Published: 2023-01-18
Description: A vulnerability was found in iamdroppy phoenixcf. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file content/2-Community/articles.cfm. The manipulation leads to sql injection. The patch is named d156faf8bc36cd49c3b10d3697ef14167ad451d8. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218491.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/iamdroppy/phoenixcf/commit/d156faf8bc36cd49c3b10d3697ef14167ad451d8; https://vuldb.com/?ctiid.218491; https://vuldb.com/?id.218491
CVE: CVE-2012-10006
Published: 2023-01-18
Description: A vulnerability classified as critical has been found in ale7714 sigeprosi. This affects an unknown part. The manipulation leads to sql injection. The identifier of the patch is 5291886f6c992316407c376145d331169c55f25b. It is recommended to apply a patch to fix this issue. The identifier VDB-218493 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/ale7714/sigeprosi/commit/5291886f6c992316407c376145d331169c55f25b; https://vuldb.com/?ctiid.218493; https://vuldb.com/?id.218493
CVE: CVE-2017-20173
Published: 2023-01-18
Description: A vulnerability was found in AlexRed contentmap. It has been rated as critical. Affected by this issue is the function Load of the file contentmap.php. The manipulation of the argument contentid leads to sql injection. The name of the patch is dd265d23ff4abac[PII_REDACTED]2c6a47f45ae2a66. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218492.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/AlexRed/contentmap/commit/dd265d23ff4abac[PII_REDACTED]2c6a47f45ae2a66; https://vuldb.com/?ctiid.218492; https://vuldb.com/?id.218492