rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-25370 Unauth Stored XSS vulnerability in the Birt plugin of Apache OFBiz
Apache OFBiz uses the Birt plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports. In Apache OFBiz release 18.12.05, and earlier versions, by leveraging a vulnerability in Birt (https://bugs.eclipse.org/bugs/show_bug.cgi?id=538142), an unauthenticated malicious user could perform a stored XSS attack in order to inject a malicious payload and execute it using the stored XSS.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Apache Software Foundation
product: Apache OFBiz
Credits: lang: en
value: Nikita Podotykin from Positive Technologies <npodotykin@ptsecurity.com>
lang: en
value: Positive Technologies  zeroday <zeroday@ptsecurity.com>
Published: 2022-09-02T07:10:16.000Z
CVE-2022-25371 Unauth Path Traversal with file corruption affecting the Birt plugin of Apache OFBiz
Apache OFBiz uses the Birt project plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports. By leveraging a bug in Birt (https://bugs.eclipse.org/bugs/show_bug.cgi?id=538142) it is possible to perform a remote code execution (RCE) attack in Apache OFBiz, release 18.12.05 and earlier.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Apache Software Foundation
product: Apache OFBiz
Credits: lang: en
value: Nikita Podotykin from Positive Technologies <npodotykin@ptsecurity.com>
lang: en
value: Positive Technologies  zeroday <zeroday@ptsecurity.com>
Published: 2022-09-02T07:10:17.000Z
CVE-2022-25372 
Pritunl Client through 1.2.3019.52 on Windows allows local privilege escalation, related to an ACL entry for CREATOR OWNER in platform_windows.go.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-20T19:17:02.000Z
CVE-2022-25373 
Zoho ManageEngine SupportCenter Plus before 11020 allows Stored XSS in the request history.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-05T18:30:13.000Z
CVE-2022-25374 
HashiCorp Terraform Enterprise v202112-1, v202112-2, v202201-1, and v202201-2 were configured to log inbound HTTP requests in a manner that may capture sensitive data. Fixed in v202202-1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-25T12:25:04.000Z
CVE-2022-25375 
An issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10. The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-20T19:47:01.000Z
CVE-2022-25377 
The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary local files via ../ directory traversal. In order to be vulnerable, APP_STORAGE_CERTIFICATES/.well-known/acme-challenge must exist on disk. (This pathname is automatically created if the user chooses to install Let's Encrypt certificates via Appwrite.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-22T00:00:00.000Z
CVE-2022-25389 
DCN Firewall DCME-520 was discovered to contain an arbitrary file download vulnerability via the path parameter in the file /audit/log/log_management.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-18T21:31:16.000Z
CVE-2022-25390 
DCN Firewall DCME-520 was discovered to contain a remote command execution (RCE) vulnerability via the host parameter in the file /system/tool/ping.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-18T21:31:17.000Z
CVE-2022-25393 
Simple Bakery Shop Management v1.0 was discovered to contain a SQL injection vulnerability via the username parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-02T22:39:26.000Z
CVE-2022-25394 
Medical Store Management System v1.0 was discovered to contain a SQL injection vulnerability via the cid parameter under customer-add.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-02T22:39:26.000Z
CVE-2022-25395 
Cosmetics and Beauty Product Online Store v1.0 was discovered to contain multiple reflected cross-site scripting (XSS) attacks via the search parameter under the /cbpos/ app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-02T22:39:27.000Z
CVE-2022-25396 
Cosmetics and Beauty Product Online Store v1.0 was discovered to contain a SQL injection vulnerability via the search parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-02T22:39:28.000Z
CVE-2022-25398 
Auto Spare Parts Management v1.0 was discovered to contain a SQL injection vulnerability via the user parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-02T22:39:30.000Z
CVE-2022-25399 
Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-02T22:39:31.000Z
CVE-2022-25401 
The copy function of the file manager in Cuppa CMS v1.0 allows any file to be copied to the current directory, granting attackers read access to arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-23T21:11:22.000Z
CVE-2022-25402 
An incorrect access control issue in HMS v1.0 allows unauthenticated attackers to read and modify all PHP files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-23T21:11:21.000Z
CVE-2022-25403 
HMS v1.0 was discovered to contain a SQL injection vulnerability via the component admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-23T21:11:21.000Z
CVE-2022-25404 
Tongda2000 v11.10 was discovered to contain a SQL injection vulnerability in delete.php via the DELETE_STR parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-23T21:11:20.000Z
CVE-2022-25405 
Tongda2000 v11.10 was discovered to contain a SQL injection vulnerability in change_box.php via the DELETE_STR parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-23T21:11:27.000Z
CVE-2022-25406 
Tongda2000 v11.10 was discovered to contain a SQL injection vulnerability in delete_query.php via the DELETE_STR parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-23T21:11:19.000Z
CVE-2022-25407 
Hospital Management System v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Doctor parameter at /admin-panel1.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-28T22:55:17.000Z
CVE-2022-25408 
Hospital Management System v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the dpassword parameter at /admin-panel1.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-28T22:55:17.000Z
CVE-2022-25409 
Hospital Management System v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the demail parameter at /admin-panel1.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-28T22:55:18.000Z
CVE-2022-25410 
Maxsite CMS v180 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the parameter f_file_description at /admin/files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-28T22:55:18.000Z
CVE-2022-25411 
A Remote Code Execution (RCE) vulnerability at /admin/options in Maxsite CMS v180 allows attackers to execute arbitrary code via a crafted PHP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-28T22:55:19.000Z
CVE-2022-25412 
Maxsite CMS v180 was discovered to contain multiple arbitrary file deletion vulnerabilities in /admin_page/all-files-update-ajax.php via the dir and deletefile parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-28T22:55:20.000Z
CVE-2022-25413 
Maxsite CMS v108 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the parameter f_tags at /admin/page_edit/3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-28T22:55:21.000Z
CVE-2022-25414 
Tenda AC9 V15.03.2.21_cn was discovered to contain a stack overflow via the parameter NPTR.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-22T22:44:14.000Z
CVE-2022-25417 
Tenda AC9 V15.03.2.21_cn was discovered to contain a stack overflow via the function saveparentcontrolinfo.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-22T22:44:16.000Z
CVE-2022-25418 
Tenda AC9 V15.03.2.21_cn was discovered to contain a stack overflow via the function openSchedWifi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-22T22:44:17.000Z
CVE-2022-25420 
NTT Resonant Incorporated goo blog App Web Application 1.0 is vulnerable to CLRF injection. This vulnerability allows attackers to execute arbitrary code via a crafted HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-29T01:05:26.000Z
CVE-2022-25427 
Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the schedendtime parameter in the openSchedWifi function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-18T20:52:57.000Z
CVE-2022-25428 
Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the deviceId parameter in the saveparentcontrolinfo function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-18T20:53:02.000Z
CVE-2022-25429 
Tenda AC9 v15.03.2.21 was discovered to contain a buffer overflow via the time parameter in the saveparentcontrolinfo function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-18T20:53:00.000Z
CVE-2022-25431 
Tenda AC9 v15.03.2.21 was discovered to contain multiple stack overflows via the NPTR, V12, V10 and V11 parameter in the Formsetqosband function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-18T20:53:01.000Z
CVE-2022-25433 
Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the urls parameter in the saveparentcontrolinfo function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-18T20:53:05.000Z
CVE-2022-25434 
Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the firewallen parameter in the SetFirewallCfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-18T20:53:06.000Z
CVE-2022-25435 
Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the list parameter in the SetStaticRoutecfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-18T20:53:07.000Z
CVE-2022-25437 
Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the list parameter in the SetVirtualServerCfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-18T20:53:10.000Z
CVE-2022-25438 
Tenda AC9 v15.03.2.21 was discovered to contain a remote command execution (RCE) vulnerability via the SetIPTVCfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-18T20:53:11.000Z
CVE-2022-25439 
Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the list parameter in the SetIpMacBind function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-18T20:53:11.000Z
CVE-2022-25440 
Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the ntpserver parameter in the SetSysTimeCfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-18T20:53:12.000Z
CVE-2022-25441 
Tenda AC9 v15.03.2.21 was discovered to contain a remote command execution (RCE) vulnerability via the vlanid parameter in the SetIPTVCfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-18T20:53:13.000Z
CVE-2022-25445 
Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the time parameter in the PowerSaveSet function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-18T20:53:16.000Z
CVE-2022-25446 
Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the schedstarttime parameter in the openSchedWifi function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-18T20:53:17.000Z
CVE-2022-25447 
Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the schedendtime parameter in the openSchedWifi function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-18T20:53:17.000Z
CVE-2022-25448 
Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the day parameter in the openSchedWifi function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-18T20:53:18.000Z
CVE-2022-25449 
Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the deviceId parameter in the saveParentControlInfo function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-18T20:53:19.000Z
CVE-2022-25450 
Tenda AC6 V15.03.05.09_multi was discovered to contain a stack overflow via the list parameter in the SetVirtualServerCfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-18T20:53:19.000Z
CVE-2022-25451 
Tenda AC6 V15.03.05.09_multi was discovered to contain a stack overflow via the list parameter in the setstaticroutecfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-18T20:53:20.000Z
CVE-2022-25452 
Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the URLs parameter in the saveParentControlInfo function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-18T20:53:21.000Z
CVE-2022-25453 
Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the time parameter in the saveParentControlInfo function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-18T20:53:21.000Z
CVE-2022-25454 
Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the loginpwd parameter in the SetFirewallCfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-18T20:53:22.000Z
CVE-2022-25455 
Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the list parameter in the SetIpMacBind function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-18T20:53:23.000Z
CVE-2022-25456 
Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the security_5g parameter in the WifiBasicSet function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-18T20:53:23.000Z
CVE-2022-25457 
Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the ntpserver parameter in the SetSysTimeCfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-18T20:53:24.000Z
CVE-2022-25458 
Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the cmdinput parameter in the exeCommand function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-18T20:53:25.000Z
CVE-2022-25459 
Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the S1 parameter in the SetSysTimeCfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-18T20:53:26.000Z
CVE-2022-25460 
Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the endip parameter in the SetPptpServerCfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-18T20:53:29.000Z
CVE-2022-25461 
Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the startip parameter in the SetPptpServerCfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-18T20:53:28.000Z
CVE-2022-25462 
Yafu v2.0 contains a segmentation fault via the component /factor/avx-ecm/vecarith52.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-20T19:33:14.000Z
CVE-2022-25464 
A stored cross-site scripting (XSS) vulnerability in the component /admin/contenttemp of DoraCMS v2.1.8 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-20T18:34:58.000Z
CVE-2022-25465 
Espruino 2v11 release was discovered to contain a stack buffer overflow via src/jsvar.c in jsvGetNextSibling.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-05T01:01:56.000Z
CVE-2022-25471 
An Insecure Direct Object Reference (IDOR) vulnerability in OpenEMR 6.0.0 allows any authenticated attacker to access and modify unauthorized areas via a crafted POST request to /modules/zend_modules/public/Installer/register.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-02T23:07:04.000Z
CVE-2022-25477 
Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Reader (RtsUer.sys) before 10.0.22000.31274 leaks driver logs that contain addresses of kernel mode objects, weakening KASLR.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-02T00:00:00.000Z
CVE-2022-25478 
Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Reader (RtsUer.sys) before 10.0.22000.31274 provides read and write access to the PCI configuration space of the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-02T00:00:00.000Z
CVE-2022-25479 
Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Reader (RtsUer.sys) before 10.0.22000.31274 allows for the leakage of kernel memory from both the stack and the heap.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-02T00:00:00.000Z
CVE-2022-25480 
Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Reader (RtsUer.sys) before 10.0.22000.31274 allows writing to kernel memory beyond the SystemBuffer of the IRP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-02T00:00:00.000Z
CVE-2022-25481 
ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters from index.php. NOTE: this is disputed by a third party because system environment exposure is an intended feature of the debugging mode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-20T00:00:00.000Z
CVE-2022-25484 
tcpprep v4.4.1 has a reachable assertion (assert(l2len > 0)) in packet2tree() at tree.c in tcpprep v4.4.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-22T16:49:01.000Z
CVE-2022-25485 
CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertLightbox.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-15T17:41:10.000Z
CVE-2022-25486 
CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertConfigField.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-15T17:41:02.000Z
CVE-2022-25487 
Atom CMS v2.0 was discovered to contain a remote code execution (RCE) vulnerability via /admin/uploads.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-15T17:40:55.000Z
CVE-2022-25488 
Atom CMS v2.0 was discovered to contain a SQL injection vulnerability via the id parameter in /admin/ajax/avatar.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-15T17:40:48.000Z
CVE-2022-25489 
Atom CMS v2.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the "A" parameter in /widgets/debug.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-15T17:40:40.000Z
CVE-2022-25490 
HMS v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in department.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-15T17:40:33.000Z
CVE-2022-25491 
HMS v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in appointment.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-15T17:38:11.000Z
CVE-2022-25492 
HMS v1.0 was discovered to contain a SQL injection vulnerability via the medicineid parameter in ajaxmedicine.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-15T17:37:15.000Z
CVE-2022-25493 
HMS v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via treatmentrecord.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-15T17:36:21.000Z
CVE-2022-25494 
Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via staff_login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-15T17:34:41.000Z
CVE-2022-25495 
The component /jquery_file_upload/server/php/index.php of CuppaCMS v1.0 allows attackers to upload arbitrary files and execute arbitrary code via a crafted PHP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-15T17:33:35.000Z
CVE-2022-25497 
CuppaCMS v1.0 was discovered to contain an arbitrary file read via the copy function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-15T17:31:35.000Z
CVE-2022-25498 
CuppaCMS v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the saveConfigData function in /classes/ajax/Functions.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-15T17:29:35.000Z
CVE-2022-25505 
Taocms v3.0.2 was discovered to contain a SQL injection vulnerability via the id parameter in \include\Model\Category.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-21T00:01:11.000Z