rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-24156 
A command injection vulnerability in the ip parameter in the function recvSlaveUpgstatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2023-24157 
A command injection vulnerability in the serverIp parameter in the function updateWifiInfo of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2023-24159 
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the admpass parameter in the setPasswordCfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-14T00:00:00.000Z
CVE-2023-24160 
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the admuser parameter in the setPasswordCfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-14T00:00:00.000Z
CVE-2023-24161 
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the webWlanIdx parameter in the setWebWlanIdx function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-14T00:00:00.000Z
CVE-2023-24162 
Deserialization vulnerability in Dromara Hutool v5.8.11 allows attacker to execute arbitrary code via the XmlUtil.readObjectFromXml parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-31T00:00:00.000Z
CVE-2023-24163 
SQL Inection vulnerability in Dromara hutool before 5.8.21 allows attacker to execute arbitrary code via the aviator template engine.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-31T00:00:00.000Z
CVE-2023-24164 
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via /goform/FUN_000c2318.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-26T00:00:00.000Z
CVE-2023-24165 
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via /goform/initIpAddrInfo.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-26T00:00:00.000Z
CVE-2023-24166 
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via /goform/formWifiBasicSet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-26T00:00:00.000Z
CVE-2023-24167 
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via /goform/add_white_node.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-26T00:00:00.000Z
CVE-2023-24169 
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via /goform/FUN_0007343c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-26T00:00:00.000Z
CVE-2023-24170 
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via /goform/fromSetWirelessRepeat.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-26T00:00:00.000Z
CVE-2023-24180 
Libelfin v0.3 was discovered to contain an integer overflow in the load function at elf/mmap_loader.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted elf file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-14T00:00:00.000Z
CVE-2023-24181 
LuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /openvpn/pageswitch.htm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-10T00:00:00.000Z
CVE-2023-24182 
LuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the component /system/sshkeys.js.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-11T00:00:00.000Z
CVE-2023-24184 
TOTOLink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-21T00:00:00.000Z
CVE-2023-24187 
An XML External Entity (XXE) vulnerability in ureport v2.2.9 allows attackers to execute arbitrary code via uploading a crafted XML file to /ureport/designer/saveReportFile.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-14T00:00:00.000Z
CVE-2023-24188 
ureport v2.2.9 was discovered to contain a directory traversal vulnerability via the deletion function which allows for arbitrary files to be deleted.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-13T00:00:00.000Z
CVE-2023-24189 
An XML External Entity (XXE) vulnerability in urule v2.1.7 allows attackers to execute arbitrary code via uploading a crafted XML file to /urule/common/saveFile.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-24T00:00:00.000Z
CVE-2023-24191 
Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the redirect parameter in signup.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-06T00:00:00.000Z
CVE-2023-24192 
Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the redirect parameter in login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-06T00:00:00.000Z
CVE-2023-24194 
Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the page parameter in navbar.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-06T00:00:00.000Z
CVE-2023-24195 
Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the page parameter in index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-06T00:00:00.000Z
CVE-2023-24197 
Online Food Ordering System v2 was discovered to contain a SQL injection vulnerability via the id parameter at view_order.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-06T00:00:00.000Z
CVE-2023-24198 
Raffle Draw System v1.0 was discovered to contain multiple SQL injection vulnerabilities at save_winner.php via the ticket_id and draw parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-06T00:00:00.000Z
CVE-2023-24199 
Raffle Draw System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at delete_ticket.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-06T00:00:00.000Z
CVE-2023-24200 
Raffle Draw System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at save_ticket.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-06T00:00:00.000Z
CVE-2023-24201 
Raffle Draw System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at get_ticket.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-06T00:00:00.000Z
CVE-2023-24202 
Raffle Draw System v1.0 was discovered to contain a local file inclusion vulnerability via the page parameter in index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-06T00:00:00.000Z
CVE-2023-24203 
Cross Site Scripting vulnerability in SourceCodester Simple Customer Relationship Management System v1.0 allows attacker to execute arbitary code via the company or query parameter(s).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-14T16:18:38.122Z
CVE-2023-24204 
SQL injection vulnerability in SourceCodester Simple Customer Relationship Management System v1.0 allows attacker to execute arbitrary code via the name parameter in get-quote.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-14T16:22:07.598Z
CVE-2023-24205 
Clash for Windows v0.20.12 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via overwriting the configuration file (cfw-setting.yaml).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-23T00:00:00.000Z
CVE-2023-24206 
Davinci v0.3.0-rc was discovered to contain a SQL injection vulnerability via the copyDisplay function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-27T00:00:00.000Z
CVE-2023-24212 
Tenda AX3 V16.03.12.11 was discovered to contain a stack overflow via the timeType function at /goform/SetSysTimeCfg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-23T00:00:00.000Z
CVE-2023-24215 
Incorrect access control in the /uci/get/ endpoint of NOVUS AirGate 4G firmware v1.1.16 allows unauthenticated attackers to obtain administrator credentials via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-18T00:00:00.000Z
CVE-2023-24217 
AgileBio Electronic Lab Notebook v4.234 was discovered to contain a local file inclusion vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-06T00:00:00.000Z
CVE-2023-24219 
LuckyframeWEB v3.5 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /system/UserMapper.xml.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-17T00:00:00.000Z
CVE-2023-24220 
LuckyframeWEB v3.5 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /system/RoleMapper.xml.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-17T00:00:00.000Z
CVE-2023-24221 
LuckyframeWEB v3.5 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /system/DeptMapper.xml.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-17T00:00:00.000Z
CVE-2023-24229 
DrayTek Vigor2960 v1.5.1.4 allows an authenticated attacker with network access to the web management interface to inject operating system commands via the mainfunction.cgi 'parameter' parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-15T00:00:00.000Z
CVE-2023-24230 
A stored cross-site scripting (XSS) vulnerability in the component /formwork/panel/dashboard of Formwork v1.12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page title parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-10T00:00:00.000Z
CVE-2023-24231 
A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/categories.php of Inventory Management System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Categories Name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-10T00:00:00.000Z
CVE-2023-24232 
A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/product.php of Inventory Management System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-10T00:00:00.000Z
CVE-2023-24233 
A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/orders.php?o=add of Inventory Management System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Client Name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-10T00:00:00.000Z
CVE-2023-24234 
A stored cross-site scripting (XSS) vulnerability in the component php-inventory-management-system/brand.php of Inventory Management System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Brand Name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-10T00:00:00.000Z
CVE-2023-24236 
TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the province parameter at setting/delStaticDhcpRules.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-16T00:00:00.000Z
CVE-2023-24238 
TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the city parameter at setting/delStaticDhcpRules.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-16T00:00:00.000Z
CVE-2023-24241 
Forget Heart Message Box v1.1 was discovered to contain a SQL injection vulnerability via the name parameter at /admin/loginpost.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-31T00:00:00.000Z