rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-5338 Theme Blvd Shortcodes <= 1.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Theme Blvd Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.6.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: themeblvd
product: Theme Blvd Shortcodes
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: István Márton
Published: 2023-11-22T15:33:30.652Z
CVE-2023-5339 Mattermost Desktop logs all keystrokes during initial run after fresh installation 
Mattermost Desktop fails to set an appropriate log level during initial run after fresh installation resulting in logging all keystrokes including password entry being logged. 


Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Mattermost
product: Mattermost
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Patrice Kolb
Published: 2023-10-17T09:30:41.612Z
CVE-2023-5340 Five Star Restaurant Menu and Food Ordering < 2.4.11 - Unauthenticated PHP Object Injection
The Five Star Restaurant Menu and Food Ordering WordPress plugin before 2.4.11 unserializes user input via an AJAX action available to unauthenticated users, allowing them to perform PHP Object Injection when a suitable gadget is present on the blog.
Problem types: description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Unknown
product: Five Star Restaurant Menu and Food Ordering
default_status: unaffected
Credits: lang: en
value: Krzysztof Zając (CERT PL)
lang: en
value: WPScan
Published: 2023-11-20T18:55:01.256Z
CVE-2023-5341 Imagemagick: heap use-after-free in coders/bmp.c
A heap use-after-free flaw was found in coders/bmp.c in ImageMagick.
Problem types: cwe_id: CWE-416
description: Use After Free
Affected products: vendor: Red Hat
product: Red Hat Enterprise Linux 6
cpes: cpe:/o:redhat:enterprise_linux:6
default_status: unknown
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.2
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Hardik shah of Vehere (Dawn Treaders team) for reporting this issue.
Published: 2023-11-19T09:20:12.642Z
CVE-2023-5342 Shim: expired secure boot certificate
The Fedora Secure Boot CA certificate shipped with shim in Fedora was expired which could lead to old or invalid signed boot components being loaded.
Problem types: cwe_id: CWE-324
description: Use of a Key Past its Expiration Date
Affected products: default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 10
cpes: cpe:/o:redhat:enterprise_linux:10
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4.1
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Published: 2025-08-15T12:06:35.309Z
CVE-2023-5343 Popup Box < 3.7.9 - Admin+ Stored XSS
The Popup box WordPress plugin before 3.7.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Popup box
default_status: unaffected
Credits: lang: en
value: Rafael Aristodimou
lang: en
value: WPScan
Published: 2023-11-20T18:55:12.772Z
CVE-2023-5344 Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1969.
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: vim
product: vim/vim
Published: 2023-10-02T19:20:30.352Z
CVE-2023-5345 Use-after-free in Linux kernel's fs/smb/client component
A use-after-free vulnerability in the Linux kernel's fs/smb/client component can be exploited to achieve local privilege escalation.

In case of an error in smb3_fs_context_parse_param, ctx->password was freed but the field was not set to NULL which could lead to double free.

We recommend upgrading past commit e6e43b8aa7cd3c3af686caf0c2e11819a886d705.
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: Linux
product: Kernel
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published: 2023-10-03T02:33:06.684Z
CVE-2023-5346 
Type confusion in V8 in Google Chrome prior to 117.0.5938.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Problem types: description: Type Confusion
Affected products: vendor: Google
product: Chrome
Published: 2023-10-05T17:13:03.435Z
CVE-2023-5347 Unauthenticated Firmware Upgrade
An Improper Verification of Cryptographic Signature vulnerability in the update process of Korenix JetNet Series allows replacing the whole operating system including Trusted Executables. This issue affects JetNet devices older than firmware version 2024/01.
Problem types: cwe_id: CWE-347
description: CWE-347 Improper Verification of Cryptographic Signature
cwe_id: CWE-327
description: CWE-327 Use of a Broken or Risky Cryptographic Algorithm
Affected products: vendor: Korenix
product: JetNet Series
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: S. Dietz (CyberDanube)
Published: 2024-01-09T09:54:59.664Z
CVE-2023-5348 Product Catalog Enquiry for WooCommerce < 5.0.3 - Unauthenticated Stored XSS via Arbitrary Setting Update
The Product Catalog Mode For WooCommerce WordPress plugin before 5.0.3 does not properly authorize settings updates or escape settings values, leading to stored XSS by unauthenticated users.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Product Catalog Mode For WooCommerce
default_status: unaffected
Credits: lang: en
value: Krzysztof Zając (CERT PL)
lang: en
value: WPScan
Published: 2023-12-18T20:07:59.959Z
CVE-2023-5349 Draw while calling getdrawinfo()
A memory leak flaw was found in ruby-magick, an interface between Ruby and ImageMagick. This issue can lead to a denial of service (DOS) by memory exhaustion.
Problem types: cwe_id: CWE-401
description: Missing Release of Memory after Effective Lifetime
Affected products: vendor: n/a
product: rmagick
default_status: affected
vendor: Red Hat
product: Red Hat 3scale API Management Platform 2
cpes: cpe:/a:redhat:red_hat_3scale_amp:2
default_status: unknown
vendor: Fedora
product: Fedora
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2023-10-30T20:27:59.972Z
CVE-2023-5350 SQL Injection in salesagility/suitecrm
 SQL Injection in GitHub repository salesagility/suitecrm prior to 7.14.1.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command
Affected products: vendor: salesagility
product: salesagility/suitecrm
Published: 2023-10-03T11:45:41.765Z
CVE-2023-5351 Cross-site Scripting (XSS) - Stored in salesagility/suitecrm
Cross-site Scripting (XSS) - Stored in GitHub repository salesagility/suitecrm prior to 7.14.1.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: salesagility
product: salesagility/suitecrm
Published: 2023-10-03T11:58:01.156Z
CVE-2023-5352 Awesome Support < 6.1.5 - Insufficient permission check in wpas_edit_reply
The Awesome Support WordPress plugin before 6.1.5 does not correctly authorize the wpas_edit_reply function, allowing users to edit posts for which they do not have permission.
Problem types: description: CWE-284 Improper Access Control
Affected products: vendor: Unknown
product: Awesome Support
default_status: unaffected
Credits: lang: en
value: Krzysztof Zając
lang: en
value: WPScan
Published: 2023-11-06T20:40:54.117Z
CVE-2023-5353 Improper Access Control in salesagility/suitecrm
Improper Access Control in GitHub repository salesagility/suitecrm prior to 7.14.1.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: salesagility
product: salesagility/suitecrm
Published: 2023-10-03T12:15:20.097Z
CVE-2023-5354 Awesome Support < 6.1.5 - Reflected Cross-Site Scripting
The Awesome Support WordPress plugin before 6.1.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Problem types: description: CWE-284 Improper Access Control
description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Awesome Support
default_status: unaffected
Credits: lang: en
value: Alex Sanford
lang: en
value: WPScan
Published: 2023-11-06T20:40:28.644Z
CVE-2023-5355 Awesome Support < 6.1.5 - Submitter+ Arbitrary File Deletion
The Awesome Support WordPress plugin before 6.1.5 does not sanitize file paths when deleting temporary attachment files, allowing a ticket submitter to delete arbitrary files on the server.
Problem types: description: CWE-284 Improper Access Control
Affected products: vendor: Unknown
product: Awesome Support
default_status: unaffected
Credits: lang: en
value: Alex Sanford
lang: en
value: WPScan
Published: 2023-11-06T20:41:57.821Z
CVE-2023-5356 Incorrect Authorization in GitLab
Incorrect authorization checks in GitLab CE/EE from all versions starting from 8.13 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2, allows a user to abuse slack/mattermost integrations to execute slash commands as another user.
Problem types: cwe_id: CWE-863
description: CWE-863: Incorrect Authorization
Affected products: vendor: GitLab
product: GitLab
cpes: cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 7.3
baseSeverity: HIGH
Credits: lang: en
value: Thanks [yvvdwf](https://hackerone.com/yvvdwf) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2024-01-12T13:56:51.714Z
CVE-2023-5357 Instagram for WordPress <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Instagram for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: esemono
product: Instagram for WordPress
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: István Márton
Published: 2023-10-04T01:52:38.787Z
CVE-2023-5358 
Improper access control in Report log filters feature in Devolutions Server 2023.2.10.0 and earlier allows attackers to retrieve logs from vaults or entries they are not allowed to access via the report request url query parameters.
Affected products: vendor: Devolutions
product: Devolutions Server
default_status: unaffected
Published: 2023-11-01T17:17:31.501Z
CVE-2023-5359 W3 Total Cache <= 2.7.5 - Sensitive Credentials Stored in Plaintext
The W3 Total Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.5 via Google OAuth API secrets stored in plaintext in the publicly visible plugin source. This can allow unauthenticated attackers to impersonate W3 Total Cache and gain access to user account information in successful conditions. This would not impact the WordPress users site in any way.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: boldgrid
product: W3 Total Cache
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
baseScore: 3.7
baseSeverity: LOW
Credits: lang: en
value: Ivan Kuzymchak
Published: 2024-09-24T07:30:45.348Z
CVE-2023-5360 Royal Elementor Addons and Templates < 1.3.79 - Unauthenticated Arbitrary File Upload
The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE.
Problem types: description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Unknown
product: Royal Elementor Addons and Templates
default_status: unaffected
Credits: lang: en
value: Fioravante Souza
lang: en
value: WPScan
Published: 2023-10-31T13:54:42.111Z
CVE-2023-5362 Carousel, Recent Post Slider and Banner Slider <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Carousel, Recent Post Slider and Banner Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'spice_post_slider' shortcode in versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: spicethemes
product: Carousel, Recent Post Slider and Banner Slider
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: István Márton
Published: 2023-10-30T13:49:01.699Z
CVE-2023-5363 Incorrect cipher key & IV length processing
Issue summary: A bug has been identified in the processing of key and
initialisation vector (IV) lengths.  This can lead to potential truncation
or overruns during the initialisation of some symmetric ciphers.

Impact summary: A truncation in the IV can result in non-uniqueness,
which could result in loss of confidentiality for some cipher modes.

When calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or
EVP_CipherInit_ex2() the provided OSSL_PARAM array is processed after
the key and IV have been established.  Any alterations to the key length,
via the "keylen" parameter or the IV length, via the "ivlen" parameter,
within the OSSL_PARAM array will not take effect as intended, potentially
causing truncation or overreading of these values.  The following ciphers
and cipher modes are impacted: RC2, RC4, RC5, CCM, GCM and OCB.

For the CCM, GCM and OCB cipher modes, truncation of the IV can result in
loss of confidentiality.  For example, when following NIST's SP 800-38D
section 8.2.1 guidance for constructing a deterministic IV for AES in
GCM mode, truncation of the counter portion could lead to IV reuse.

Both truncations and overruns of the key and overruns of the IV will
produce incorrect results and could, in some cases, trigger a memory
exception.  However, these issues are not currently assessed as security
critical.

Changing the key and/or IV lengths is not considered to be a common operation
and the vulnerable API was recently introduced. Furthermore it is likely that
application developers will have spotted this problem during testing since
decryption would fail unless both peers in the communication were similarly
vulnerable. For these reasons we expect the probability of an application being
vulnerable to this to be quite low. However if an application is vulnerable then
this issue is considered very serious. For these reasons we have assessed this
issue as Moderate severity overall.

The OpenSSL SSL/TLS implementation is not affected by this issue.

The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this because
the issue lies outside of the FIPS provider boundary.

OpenSSL 3.1 and 3.0 are vulnerable to this issue.
Problem types: cwe_id: CWE-684
description: CWE-684 Incorrect Provision of Specified Functionality
Affected products: vendor: OpenSSL
product: OpenSSL
default_status: unaffected
Credits: lang: en
value: Tony Battersby (Cybernetics)
lang: en
value: Dr Paul Dale
Published: 2023-10-24T15:31:40.890Z
CVE-2023-5365 HP LIFE Android Mobile – Potential Escalation of Privilege, Information Disclosure
HP LIFE Android Mobile application is potentially vulnerable to escalation of privilege and/or information disclosure.
Affected products: vendor: HP Inc.
product: HP LIFE Android Mobile 
default_status: affected
Published: 2023-10-09T15:17:20.863Z
CVE-2023-5368 msdosfs data disclosure
On an msdosfs filesystem, the 'truncate' or 'ftruncate' system calls under certain circumstances populate the additional space in the file with unallocated data from the underlying disk device, rather than zero bytes.

This may permit a user with write access to files on a msdosfs filesystem to read unintended data (e.g. from a previously deleted file).


Problem types: cwe_id: CWE-1188
description: CWE-1188 Insecure Default Initialization of Resource
Affected products: vendor: FreeBSD
product: FreeBSD
default_status: unknown
Credits: lang: en
value: Maxim Suhanov
Published: 2023-10-04T03:38:09.357Z
CVE-2023-5369 copy_file_range insufficient capability rights check
Before correction, the copy_file_range system call checked only for the CAP_READ and CAP_WRITE capabilities on the input and output file descriptors, respectively.  Using an offset is logically equivalent to seeking, and the system call must additionally require the CAP_SEEK capability.

This incorrect privilege check enabled sandboxed processes with only read or write but no seek capability on a file descriptor to read data from or write data to an arbitrary location within the file corresponding to that file descriptor.
Problem types: cwe_id: CWE-273
description: CWE-273 Improper Check for Dropped Privileges
Affected products: vendor: FreeBSD
product: FreeBSD
default_status: unknown
Credits: lang: en
value: David Chisnall
Published: 2023-10-04T03:48:53.559Z
CVE-2023-5370 arm64 boot CPUs may lack speculative execution protections
On CPU 0 the check for the SMCCC workaround is called before SMCCC support has been initialized. This resulted in no speculative execution workarounds being installed on CPU 0.
Problem types: cwe_id: CWE-665
description: CWE-665 Improper Initialization
Affected products: vendor: FreeBSD
product: FreeBSD
default_status: unknown
Published: 2023-10-04T03:59:45.199Z
CVE-2023-5371 Memory Allocation with Excessive Size Value in Wireshark
RTPS dissector memory leak in Wireshark 4.0.0 to 4.0.8 and 3.6.0 to 3.6.16 allows denial of service via packet injection or crafted capture file
Problem types: cwe_id: CWE-789
description: CWE-789: Memory Allocation with Excessive Size Value
Affected products: vendor: Wireshark Foundation
product: Wireshark
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Published: 2023-10-04T16:01:48.187Z
CVE-2023-5372 
The post-authentication command injection vulnerability in Zyxel NAS326 firmware versions through V5.21(AAZF.15)C0 and NAS542 firmware versions through V5.21(ABAG.12)C0 could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands by sending a crafted query parameter attached to the URL of an affected device’s web management interface.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Zyxel
product: NAS326 firmware
default_status: unaffected
vendor: Zyxel
product: NAS542 firmware
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-01-30T00:55:33.090Z
CVE-2023-5373 SourceCodester Online Computer and Laptop Store Master.php register sql injection
A vulnerability classified as critical has been found in SourceCodester Online Computer and Laptop Store 1.0. Affected is the function register of the file Master.php. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-241254 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: SourceCodester
product: Online Computer and Laptop Store
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: szlllc (VulDB User)
Published: 2023-10-04T12:31:04.960Z