deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-52181
Published: 2023-12-31
Description: Deserialization of Untrusted Data vulnerability in Presslabs Theme per user.This issue affects Theme per user: from n/a through 1.0.1.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/vulnerability/theme-per-user/wordpress-theme-per-user-plugin-1-0-1-unauthenticated-php-object-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/theme-per-user/wordpress-theme-per-user-plugin-1-0-1-unauthenticated-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2023-52182
Published: 2023-12-31
Description: Deserialization of Untrusted Data vulnerability in ARI Soft ARI Stream Quiz – WordPress Quizzes Builder.This issue affects ARI Stream Quiz – WordPress Quizzes Builder: from n/a through 1.3.0.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://patchstack.com/database/vulnerability/ari-stream-quiz/wordpress-ari-stream-quiz-plugin-1-3-0-php-object-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ari-stream-quiz/wordpress-ari-stream-quiz-plugin-1-3-0-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2023-6093
Published: 2023-12-31
Description: A clickjacking vulnerability has been identified in OnCell G3150A-LTE Series firmware versions v1.3 and prior.  This vulnerability is caused by incorrectly restricts frame objects, which can lead to user confusion about which interface the user is interacting with. This vulnerability may lead the attacker to trick the user into interacting with the application.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1021, CWE-1021
References: https://www.moxa.com/en/support/product-support/security-advisory/oncell-g3150a-lte-series-multiple-web-application-vulnerabilities-and-security-enhancement; https://www.moxa.com/en/support/product-support/security-advisory/oncell-g3150a-lte-series-multiple-web-application-vulnerabilities-and-security-enhancement
CVE: CVE-2023-6094
Published: 2023-12-31
Description: A vulnerability has been identified in OnCell G3150A-LTE Series firmware versions v1.3 and prior. The vulnerability results from lack of protection for sensitive information during transmission. An attacker eavesdropping on the traffic between the web browser and server may obtain sensitive information. This type of attack could be executed to gather sensitive information or to facilitate a subsequent attack against the target.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-319, CWE-319
References: https://www.moxa.com/en/support/product-support/security-advisory/oncell-g3150a-lte-series-multiple-web-application-vulnerabilities-and-security-enhancement; https://www.moxa.com/en/support/product-support/security-advisory/oncell-g3150a-lte-series-multiple-web-application-vulnerabilities-and-security-enhancement
CVE: CVE-2023-49777
Published: 2023-12-31
Description: Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Product Add-Ons.This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.3.0.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/vulnerability/yith-woocommerce-product-add-ons/wordpress-yith-woocommerce-product-add-ons-extra-options-plugin-4-3-0-php-object-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/yith-woocommerce-product-add-ons/wordpress-yith-woocommerce-product-add-ons-extra-options-plugin-4-3-0-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2023-52180
Published: 2023-12-31
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Really Simple Plugins Recipe Maker For Your Food Blog from Zip Recipes.This issue affects Recipe Maker For Your Food Blog from Zip Recipes: from n/a through 8.1.0.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/zip-recipes/wordpress-recipe-maker-for-your-food-blog-from-zip-recipes-plugin-8-1-0-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/zip-recipes/wordpress-recipe-maker-for-your-food-blog-from-zip-recipes-plugin-8-1-0-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2023-7183
Published: 2023-12-31
Description: A vulnerability has been found in 7-card Fakabao up to 1.0_build20230805 and classified as critical. Affected by this vulnerability is an unknown functionality of the file shop/alipay_notify.php. The manipulation of the argument out_trade_no leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-249385 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://note.zhaoj.in/share/NjPfD9xxhVRr; https://vuldb.com/?ctiid.249385; https://vuldb.com/?id.249385
CVE: CVE-2023-7184
Published: 2023-12-31
Description: A vulnerability was found in 7-card Fakabao up to 1.0_build20230805 and classified as critical. Affected by this issue is some unknown functionality of the file shop/notify.php. The manipulation of the argument out_trade_no leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-249386 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://note.zhaoj.in/share/Jo8N3eSeLx9c; https://vuldb.com/?ctiid.249386; https://vuldb.com/?id.249386
CVE: CVE-2023-7185
Published: 2023-12-31
Description: A vulnerability was found in 7-card Fakabao up to 1.0_build20230805. It has been classified as critical. This affects an unknown part of the file shop/wxpay_notify.php. The manipulation of the argument out_trade_no leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249387. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://note.zhaoj.in/share/mqHZlle8Pcg8; https://vuldb.com/?ctiid.249387; https://vuldb.com/?id.249387
CVE: CVE-2023-7186
Published: 2023-12-31
Description: A vulnerability was found in 7-card Fakabao up to 1.0_build20230805. It has been declared as critical. This vulnerability affects unknown code of the file member/notify.php. The manipulation of the argument out_trade_no leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249388. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://note.zhaoj.in/share/xHPvSBwWtR4z; https://vuldb.com/?ctiid.249388; https://vuldb.com/?id.249388
CVE: CVE-2023-7187
Published: 2023-12-31
Description: A vulnerability was found in Totolink N350RT 9.3.5u.6139_B20201216. It has been rated as critical. This issue affects some unknown processing of the file /cgi-bin/cstecgi.cgi?action=login&flag=ie8 of the component HTTP POST Request Handler. The manipulation leads to stack-based buffer overflow. The exploit has been disclosed to the public and may be used. The identifier VDB-249389 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-121
References: https://github.com/jylsec/vuldb/blob/main/TOTOLINK/N350RT/1/README.md; https://vuldb.com/?ctiid.249389; https://vuldb.com/?id.249389
CVE: CVE-2023-7188
Published: 2023-12-31
Description: A vulnerability classified as critical has been found in Shipping 100 Fahuo100 up to 1.1. Affected is an unknown function of the file member/login.php. The manipulation of the argument M_pwd leads to sql injection. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. VDB-249390 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://note.zhaoj.in/share/az24SaQJn1UQ; https://vuldb.com/?ctiid.249390; https://vuldb.com/?id.249390
CVE: CVE-2023-7189
Published: 2023-12-31
Description: A vulnerability classified as critical was found in S-CMS up to 2.0_build20[PII_REDACTED]1006. Affected by this vulnerability is an unknown functionality of the file /s/index.php?action=statistics. The manipulation of the argument lid leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249391. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://note.zhaoj.in/share/9yaojoQvesLu; https://vuldb.com/?ctiid.249391; https://vuldb.com/?id.249391
CVE: CVE-2023-7190
Published: 2023-12-31
Description: A vulnerability, which was classified as critical, has been found in S-CMS up to 2.0_build20[PII_REDACTED]1006. Affected by this issue is some unknown functionality of the file /member/ad.php?action=ad. The manipulation of the argument A_text/A_url/A_contact leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249392. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://note.zhaoj.in/share/0ZY7hEQAskqM; https://vuldb.com/?ctiid.249392; https://vuldb.com/?id.249392
CVE: CVE-2023-7191
Published: 2023-12-31
Description: A vulnerability, which was classified as critical, was found in S-CMS up to 2.0_build20[PII_REDACTED]1006. This affects an unknown part of the file member/reg.php. The manipulation of the argument M_login/M_email leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-249393 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://note.zhaoj.in/share/Fmytf7wBINbP; https://vuldb.com/?ctiid.249393; https://vuldb.com/?id.249393
CVE: CVE-2023-52134
Published: 2023-12-31
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eyal Fitoussi GEO my WordPress.This issue affects GEO my WordPress: from n/a through 4.0.2.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/geo-my-wp/wordpress-geo-my-wordpress-plugin-4-0-2-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/geo-my-wp/wordpress-geo-my-wordpress-plugin-4-0-2-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2023-52185
Published: 2023-12-31
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Everestthemes Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin.This issue affects Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin: from n/a through 2.1.9.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://patchstack.com/database/vulnerability/everest-backup/wordpress-everest-backup-plugin-2-1-9-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/everest-backup/wordpress-everest-backup-plugin-2-1-9-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve
CVE: CVE-2023-7193
Published: 2023-12-31
Description: A vulnerability was found in MTab Bookmark up to 1.2.6 and classified as critical. This issue affects some unknown processing of the file public/install.php of the component Installation. The manipulation leads to improper access controls. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249395. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-284
References: https://note.zhaoj.in/share/StNQi1dYnB5w; https://vuldb.com/?ctiid.249395; https://vuldb.com/?id.249395
CVE: CVE-2023-51423
Published: 2023-12-31
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saleswonder Team Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition.This issue affects Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition: from n/a through 3.05.0.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/webinar-ignition/wordpress-webinarignition-plugin-3-05-0-unauthenticated-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/webinar-ignition/wordpress-webinarignition-plugin-3-05-0-unauthenticated-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2023-51469
Published: 2023-12-31
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mestres do WP Checkout Mestres WP.This issue affects Checkout Mestres WP: from n/a through 7.1.9.6.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/checkout-mestres-wp/wordpress-checkout-mestres-wp-plugin-7-1-9-6-unauthenticated-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/checkout-mestres-wp/wordpress-checkout-mestres-wp-plugin-7-1-9-6-unauthenticated-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2023-51503
Published: 2023-12-31
Description: Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 6.9.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-639
References: https://patchstack.com/database/vulnerability/woocommerce-payments/wordpress-woopayments-plugin-6-6-2-unauthenticated-insecure-direct-object-references-idor-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-payments/wordpress-woopayments-plugin-6-6-2-unauthenticated-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE: CVE-2023-51547
Published: 2023-12-31
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPManageNinja LLC Fluent Support – WordPress Helpdesk and Customer Support Ticket Plugin.This issue affects Fluent Support – WordPress Helpdesk and Customer Support Ticket Plugin: from n/a through 1.7.6.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/fluent-support/wordpress-fluent-support-plugin-1-7-6-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/fluent-support/wordpress-fluent-support-plugin-1-7-6-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2023-52131
Published: 2023-12-31
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Zinc Page Generator.This issue affects Page Generator: from n/a through 1.7.1.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/page-generator/wordpress-page-generator-plugin-1-7-1-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/page-generator/wordpress-page-generator-plugin-1-7-1-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2023-52132
Published: 2023-12-31
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jewel Theme WP Adminify.This issue affects WP Adminify: from n/a through 3.1.6.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/adminify/wordpress-wp-adminify-plugin-3-1-6-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/adminify/wordpress-wp-adminify-plugin-3-1-6-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2023-52133
Published: 2023-12-31
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WhileTrue Most And Least Read Posts Widget.This issue affects Most And Least Read Posts Widget: from n/a through 2.5.16.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/most-and-least-read-posts-widget/wordpress-most-and-least-read-posts-widget-plugin-2-5-16-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/most-and-least-read-posts-widget/wordpress-most-and-least-read-posts-widget-plugin-2-5-16-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-21732
Published: 2024-01-01
Description: FlyCms through abbaa5a allows XSS via the permission management feature.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/Ghostfox2003/cms/blob/main/1.md; https://github.com/Ghostfox2003/cms/blob/main/1.md
CVE: CVE-2023-5877
Published: 2024-01-01
Description: The affiliate-toolkit WordPress plugin before 3.4.3 lacks authorization and authentication for requests to it's affiliate-toolkit-starter/tools/atkp_imagereceiver.php endpoint, allowing unauthenticated visitors to make requests to arbitrary URL's, including RFC1918 private addresses, leading to a Server Side Request Forgery (SSRF) issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://wpscan.com/vulnerability/39ed4934-3d91-4924-8acc-25759fef9e81; https://wpscan.com/vulnerability/39ed4934-3d91-4924-8acc-25759fef9e81
CVE: CVE-2023-6000
Published: 2024-01-01
Description: The Popup Builder WordPress plugin before 4.2.3 does not prevent simple visitors from updating existing popups, and injecting raw JavaScript in them, which could lead to Stored XSS attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/blog/stored-xss-fixed-in-popup-builder-4-2-3/; https://wpscan.com/vulnerability/cdb3a8bd-4ee0-4ce0-9[PII_REDACTED]bcfc8; https://wpscan.com/blog/stored-xss-fixed-in-popup-builder-4-2-3/
CVE: CVE-2023-6037
Published: 2024-01-01
Description: The WP TripAdvisor Review Slider WordPress plugin before 11.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/753df046-9fd7-4d15-9114-45cde6d6539b; https://wpscan.com/vulnerability/753df046-9fd7-4d15-9114-45cde6d6539b
CVE: CVE-2023-6064
Published: 2024-01-01
Description: The PayHere Payment Gateway WordPress plugin before 2.2.12 automatically creates publicly-accessible log files containing sensitive information when transactions occur.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: https://wpscan.com/vulnerability/423c8881-628b-4380-9677-65b3f5165efe; https://wpscan.com/vulnerability/423c8881-628b-4380-9677-65b3f5165efe
CVE: CVE-2023-6113
Published: 2024-01-01
Description: The WP STAGING WordPress Backup Plugin before 3.1.3 and WP STAGING Pro WordPress Backup Plugin before 5.1.3 do not prevent visitors from leaking key information about ongoing backups processes, allowing unauthenticated attackers to download said backups later.
CVSS Score: 7.5 (HIGH)
References: https://research.cleantalk.org/cve-2023-6113-wp-staging-unauth-sensitive-data-exposure-to-account-takeover-poc-exploit/; https://wpscan.com/vulnerability/5a71049a-09a6-40ab-a4e8-44634869d4fb; https://research.cleantalk.org/cve-2023-6113-wp-staging-unauth-sensitive-data-exposure-to-account-takeover-poc-exploit/
CVE: CVE-2023-6271
Published: 2024-01-01
Description: The Backup Migration WordPress plugin before 1.3.6 stores in-progress backups information in easy to find, publicly-accessible files, which may allow attackers monitoring those to leak sensitive information from the site's backups.
CVSS Score: 7.5 (HIGH)
References: https://research.cleantalk.org/cve-2023-6271-backup-migration-unauth-sensitive-data-exposure-to-full-control-of-the-site-poc-exploit; https://wpscan.com/vulnerability/7ac217db-f332-404b-a265-6dc86fe747b9; https://research.cleantalk.org/cve-2023-6271-backup-migration-unauth-sensitive-data-exposure-to-full-control-of-the-site-poc-exploit
CVE: CVE-2023-6421
Published: 2024-01-01
Description: The Download Manager WordPress plugin before 3.2.83 does not protect file download's passwords, leaking it upon receiving an invalid one.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: https://wpscan.com/vulnerability/244c7c00-fc8d-4a73-bbe0-7865c621d410; https://wpscan.com/vulnerability/244c7c00-fc8d-4a73-bbe0-7865c621d410
CVE: CVE-2023-6485
Published: 2024-01-01
Description: The Html5 Video Player WordPress plugin before 2.5.19 does not sanitise and escape some of its player settings, which combined with missing capability checks around the plugin could allow any authenticated users, such as low as subscribers to perform Stored Cross-Site Scripting attacks against high privilege users like admins
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/759b3866-c619-42cc-94a8-0af6d199cc81; https://wpscan.com/vulnerability/759b3866-c619-42cc-94a8-0af6d199cc81
CVE: CVE-2024-0181
Published: 2024-01-01
Description: A vulnerability was found in RRJ Nueva Ecija Engineer Online Portal 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/admin_user.php of the component Admin Panel. The manipulation of the argument Firstname/Lastname/Username leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249433 was assigned to this vulnerability.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://mega.nz/file/3Yc2iRzY#Uv7ECzLwUvff__JXEcyPG9oxJ0A1fsBIFGVaS35pvtA; https://vuldb.com/?ctiid.249433; https://vuldb.com/?id.249433
CVE: CVE-2023-50094
Published: 2024-01-01
Description: reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. The attack places shell metacharacters in an api/tools/waf_detector/?url= string. The commands are executed as root via subprocess.check_output.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/yogeshojha/rengine/blob/53d9f505f04861a5040195ea71f20907ff90577a/web/api/views.py#L268-L275; https://github.com/yogeshojha/rengine/blob/5e120bd5f9dfbd1da82a193e8c9702e483d38d22/web/api/views.py#L195; https://github.com/yogeshojha/rengine/commit/3d5f1724dd12cf[PII_REDACTED]e7d7c02ff8c75a6f
CVE: CVE-2023-50096
Published: 2024-01-01
Description: STMicroelectronics STSAFE-A1xx middleware before 3.3.7 allows MCU code execution if an adversary has the ability to read from and write to the I2C bus. This is caused by an StSafeA_ReceiveBytes buffer overflow in the X-CUBE-SAFEA1 Software Package for STSAFE-A sample applications (1.2.0), and thus can affect user-written code that was derived from a published sample application.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/elttam/publications/blob/master/writeups/CVE-2023-50096.md; https://github.com/elttam/publications/blob/master/writeups/CVE-2023-50096.md
CVE: CVE-2024-0182
Published: 2024-01-01
Description: A vulnerability was found in SourceCodester Engineers Online Portal 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/ of the component Admin Login. The manipulation of the argument username/password leads to sql injection. The attack may be launched remotely. The identifier of this vulnerability is VDB-249440.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://vuldb.com/?ctiid.249440; https://vuldb.com/?id.249440; https://vuldb.com/?ctiid.249440