rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-42970 
A CWE-306: Missing Authentication for Critical Function The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. Affected Products: APC Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GA), APC Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GA-01-22261), Schneider Electric Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GS), Schneider Electric Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GS-01-22261)
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: Schneider Electric
product: APC Easy UPS Online Monitoring Software
vendor: Schneider Electric
product: APC Easy UPS Online Monitoring Software
vendor: Schneider Electric
product: Schneider Electric Easy UPS Online Monitoring Software
vendor: Schneider Electric
product: Schneider Electric Easy UPS Online Monitoring Software
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
Published: 2023-02-01T00:00:00.000Z
CVE-2022-42971 
A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could cause remote code execution when the attacker uploads a malicious JSP file. Affected Products: APC Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GA), APC Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GA-01-22261), Schneider Electric Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GS), Schneider Electric Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GS-01-22261)
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Schneider Electric
product: APC Easy UPS Online Monitoring Software
vendor: Schneider Electric
product: APC Easy UPS Online Monitoring Software
vendor: Schneider Electric
product: Schneider Electric Easy UPS Online Monitoring Software
vendor: Schneider Electric
product: Schneider Electric Easy UPS Online Monitoring Software
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
Published: 2023-02-01T00:00:00.000Z
CVE-2022-42972 
A CWE-732: Incorrect Permission Assignment for Critical Resource vulnerability exists that could cause local privilege escalation when a local attacker modifies the webroot directory. Affected Products: APC Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GA), APC Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GA-01-22261), Schneider Electric Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GS), Schneider Electric Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GS-01-22261)
Problem types: cwe_id: CWE-732
description: CWE-732 Incorrect Permission Assignment for Critical Resource
Affected products: vendor: Schneider Electric
product: APC Easy UPS Online Monitoring Software
vendor: Schneider Electric
product: APC Easy UPS Online Monitoring Software
vendor: Schneider Electric
product: Schneider Electric Easy UPS Online Monitoring Software
vendor: Schneider Electric
product: Schneider Electric Easy UPS Online Monitoring Software
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
Published: 2023-02-01T00:00:00.000Z
CVE-2022-42973 
A CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause local privilege escalation when local attacker connects to the database. Affected Products: APC Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GA), APC Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GA-01-22261), Schneider Electric Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GS), Schneider Electric Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GS-01-22261)
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: Schneider Electric
product: APC Easy UPS Online Monitoring Software
vendor: Schneider Electric
product: APC Easy UPS Online Monitoring Software
vendor: Schneider Electric
product: Schneider Electric Easy UPS Online Monitoring Software
vendor: Schneider Electric
product: Schneider Electric Easy UPS Online Monitoring Software
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
Published: 2023-02-01T00:00:00.000Z
CVE-2022-42974 
In Kostal PIKO 1.5-1 MP plus HMI OEM p 1.0.1, the web application for the Solar Panel is vulnerable to a Stored Cross-Site Scripting (XSS) attack on /file.bootloader.upload.html. The application fails to sanitize the parameter filename, in a POST request to /file.bootloader.upload.html for a system update, thus allowing one to inject HTML and/or JavaScript on the page that will then be processed and stored by the application. Any subsequent requests to pages that retrieve the malicious content will automatically exploit the vulnerability on the victim's browser. This also happens because the tag is loaded in the function innerHTML in the page HTML.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-21T00:00:00.000Z
CVE-2022-42975 
socket/transport.ex in Phoenix before 1.6.14 mishandles check_origin wildcarding. NOTE: LiveView applications are unaffected by default because of the presence of a LiveView CSRF token.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-17T00:00:00.000Z
CVE-2022-42977 
The Netic User Export add-on before 1.3.5 for Atlassian Confluence has the functionality to generate a list of users in the application, and export it. During export, the HTTP request has a fileName parameter that accepts any file on the system (e.g., an SSH private key) to be downloaded.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-15T00:00:00.000Z
CVE-2022-42978 
In the Netic User Export add-on before 1.3.5 for Atlassian Confluence, authorization is mishandled. An unauthenticated attacker could access files on the remote system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-15T00:00:00.000Z
CVE-2022-42979 
Information disclosure due to an insecure hostname validation in the RYDE application 5.8.43 for Android and iOS allows attackers to take over an account via a deep link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-06T00:00:00.000Z
CVE-2022-42980 
go-admin (aka GO Admin) 2.0.12 uses the string go-admin as a production JWT key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-17T00:00:00.000Z
CVE-2022-42982 
BKG Professional NtripCaster 2.0.39 allows querying information over the UDP protocol without authentication. The NTRIP sourcetable is typically quite long (tens of kBs) and can be requested with a packet of only 30 bytes. This presents a vector that can be used for UDP amplification attacks. Normally, only authenticated streaming data will be provided over UDP and not the sourcetable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-17T00:00:00.000Z
CVE-2022-42983 
anji-plus AJ-Report 0.9.8.6 allows remote attackers to bypass login authentication by spoofing JWT Tokens.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-17T00:00:00.000Z
CVE-2022-42984 
WoWonder Social Network Platform 4.1.4 was discovered to contain a SQL injection vulnerability via the offset parameter at requests.php?f=search&s=recipients.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-14T00:00:00.000Z
CVE-2022-42985 
The ScratchLogin extension through 1.1 for MediaWiki does not escape verification failure messages, which allows users with administrator privileges to perform cross-site scripting (XSS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:H/S:C/UI:R
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
Published: 2022-11-17T00:00:00.000Z
CVE-2022-42989 
ERP Sankhya before v4.11b81 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Caixa de Entrada.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-22T00:00:00.000Z
CVE-2022-42990 
Food Ordering Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /foms/all-orders.php?status=Cancelled%20by%20Customer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-07T00:00:00.000Z
CVE-2022-42991 
A stored cross-site scripting (XSS) vulnerability in Simple Online Public Access Catalog v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Edit Account Full Name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-27T00:00:00.000Z
CVE-2022-42992 
Multiple stored cross-site scripting (XSS) vulnerabilities in Train Scheduler App v1.0 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Train Code, Train Name, and Destination text fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-27T00:00:00.000Z
CVE-2022-42993 
Password Storage Application v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Setup page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-27T00:00:00.000Z
CVE-2022-42998 
D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the srcip parameter at /goform/form2IPQoSTcAdd.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-26T00:00:00.000Z
CVE-2022-42999 
D-Link DIR-816 A2 1.10 B05 was discovered to contain multiple command injection vulnerabilities via the admuser and admpass parameters at /goform/setSysAdm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-26T00:00:00.000Z
CVE-2022-43000 
D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the wizardstep4_pskpwd parameter at /goform/form2WizardStep4.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-26T00:00:00.000Z
CVE-2022-43001 
D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the pskValue parameter in the setSecurity function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-26T00:00:00.000Z
CVE-2022-43002 
D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the wizardstep54_pskpwd parameter at /goform/form2WizardStep54.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-26T00:00:00.000Z
CVE-2022-43003 
D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the pskValue parameter in the setRepeaterSecurity function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-26T00:00:00.000Z
CVE-2022-43014 
OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the joborderID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-19T00:00:00.000Z
CVE-2022-43015 
OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the entriesPerPage parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-19T00:00:00.000Z
CVE-2022-43016 
OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callback component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-19T00:00:00.000Z
CVE-2022-43017 
OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the indexFile component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-19T00:00:00.000Z
CVE-2022-43018 
OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the email parameter in the Check Email function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-19T00:00:00.000Z
CVE-2022-43019 
OpenCATS v0.9.6 was discovered to contain a remote code execution (RCE) vulnerability via the getDataGridPager's ajax functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-19T00:00:00.000Z
CVE-2022-43020 
OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the tag_id variable in the Tag update function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-19T00:00:00.000Z
CVE-2022-43021 
OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the entriesPerPage variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-19T00:00:00.000Z
CVE-2022-43022 
OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the tag_id variable in the Tag deletion function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-19T00:00:00.000Z
CVE-2022-43023 
OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-19T00:00:00.000Z
CVE-2022-43024 
Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the list parameter at /goform/SetVirtualServerCfg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-19T00:00:00.000Z
CVE-2022-43025 
Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the startIp parameter at /goform/SetPptpServerCfg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-19T00:00:00.000Z
CVE-2022-43026 
Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the endIp parameter at /goform/SetPptpServerCfg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-19T00:00:00.000Z
CVE-2022-43027 
Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the firewallEn parameter at /goform/SetFirewallCfg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-19T00:00:00.000Z
CVE-2022-43028 
Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the timeZone parameter at /goform/SetSysTimeCfg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-19T00:00:00.000Z
CVE-2022-43029 
Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the time parameter at /goform/SetSysTimeCfg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-19T00:00:00.000Z
CVE-2022-43030 
Siyucms v6.1.7 was discovered to contain a remote code execution (RCE) vulnerability in the background. SIYUCMS is a content management system based on ThinkPaP5 AdminLTE. SIYUCMS has a background command execution vulnerability, which can be used by attackers to gain server privileges
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-14T00:00:00.000Z
CVE-2022-43031 
DedeCMS v6.1.9 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add Administrator accounts and modify Admin passwords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-09T00:00:00.000Z
CVE-2022-43032 
An issue was discovered in Bento4 v1.6.0-639. There is a memory leak in AP4_DescriptorFactory::CreateDescriptorFromStream in Core/Ap4DescriptorFactory.cpp, as demonstrated by mp42aac.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-19T00:00:00.000Z
CVE-2022-43033 
An issue was discovered in Bento4 1.6.0-639. There is a bad free in the component AP4_HdlrAtom::~AP4_HdlrAtom() which allows attackers to cause a Denial of Service (DoS) via a crafted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-19T00:00:00.000Z
CVE-2022-43034 
An issue was discovered in Bento4 v1.6.0-639. There is a heap buffer overflow vulnerability in the AP4_BitReader::SkipBits(unsigned int) function in mp42ts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-19T00:00:00.000Z
CVE-2022-43035 
An issue was discovered in Bento4 v1.6.0-639. There is a heap-buffer-overflow in AP4_Dec3Atom::AP4_Dec3Atom at Ap4Dec3Atom.cpp, leading to a Denial of Service (DoS), as demonstrated by mp42aac.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-19T00:00:00.000Z
CVE-2022-43037 
An issue was discovered in Bento4 1.6.0-639. There is a memory leak in the function AP4_File::ParseStream in /Core/Ap4File.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-19T00:00:00.000Z
CVE-2022-43038 
Bento4 v1.6.0-639 was discovered to contain a heap overflow via the AP4_BitReader::ReadCache() function in mp42ts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-19T00:00:00.000Z
CVE-2022-43039 
GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a segmentation violation via the function gf_isom_meta_restore_items_ref at /isomedia/meta.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-19T00:00:00.000Z
CVE-2022-43040 
GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a heap buffer overflow via the function gf_isom_box_dump_start_ex at /isomedia/box_funcs.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-19T00:00:00.000Z
CVE-2022-43042 
GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a heap buffer overflow via the function FixSDTPInTRAF at isomedia/isom_intern.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-19T00:00:00.000Z
CVE-2022-43043 
GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a segmentation violation via the function BD_CheckSFTimeOffset at /bifs/field_decode.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-19T00:00:00.000Z
CVE-2022-43044 
GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a segmentation violation via the function gf_isom_get_meta_item_info at /isomedia/meta.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-19T00:00:00.000Z
CVE-2022-43045 
GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a segmentation violation via the function gf_dump_vrml_sffield at /scene_manager/scene_dump.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-19T00:00:00.000Z
CVE-2022-43046 
Food Ordering Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /foms/place-order.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-07T00:00:00.000Z
CVE-2022-43049 
Canteen Management System Project v1.0 was discovered to contain a SQL injection vulnerability via the component /youthappam/add-food.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-07T00:00:00.000Z
CVE-2022-43050 
Online Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload vulnerability in the component update_profile.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-07T00:00:00.000Z
CVE-2022-43051 
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/classes/Users.php?f=delete_test.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-07T00:00:00.000Z
CVE-2022-43052 
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/classes/Users.php?f=delete.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-07T00:00:00.000Z
CVE-2022-43058 
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms//classes/Master.php?f=delete_activity.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-09T00:00:00.000Z
CVE-2022-43061 
Online Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload vulnerability in the component /operations/travellers.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-03T00:00:00.000Z
CVE-2022-43062 
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_appointment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-03T00:00:00.000Z
CVE-2022-43063 
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Users.php?f=delete_client.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-03T00:00:00.000Z
CVE-2022-43066 
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/classes/Master.php?f=delete_message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-02T00:00:00.000Z