rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-35313 
In Tor Arti before 1.2.3, circuits sometimes incorrectly have a length of 3 (with full vanguards), aka TROVE-2024-004.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-17T21:29:58.041Z
CVE-2024-35314 
A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance (MiVB SVI) 1.0.0.25, could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. A successful exploit requires user interaction and could allow an attacker to execute arbitrary scripts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-21T00:00:00.000Z
CVE-2024-35315 
A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance (MiVB SVI) 1.0.0.25, could allow an authenticated attacker to conduct a privilege escalation attack due to improper file validation. A successful exploit could allow an attacker to run arbitrary code with elevated privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-21T00:00:00.000Z
CVE-2024-35321 
MyNET up to v26.08 was discovered to contain a Reflected cross-site scripting (XSS) vulnerability via the msgtipo parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-22T00:00:00.000Z
CVE-2024-35322 
MyNET up to v26.08 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the ficheiro parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-24T00:00:00.000Z
CVE-2024-35324 
Douchat 4.0.5 suffers from an arbitrary file upload vulnerability via Public/Plugins/webuploader/server/preview.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-28T15:25:04.254Z
CVE-2024-35333 
A stack-buffer-overflow vulnerability exists in the read_charset_decl function of html2xhtml 1.3. This vulnerability occurs due to improper bounds checking when copying data into a fixed-size stack buffer. An attacker can exploit this vulnerability by providing a specially crafted input to the vulnerable function, causing a buffer overflow and potentially leading to arbitrary code execution, denial of service, or data corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-29T15:12:09.563Z
CVE-2024-35338 
Tenda i29V1.0 V1.0.0.5 was discovered to contain a hardcoded password for root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-16T00:00:00.000Z
CVE-2024-35339 
Tenda FH1206 V1.2.0.8(8155) was discovered to contain a command injection vulnerability via the mac parameter at ip/goform/WriteFacMac.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-24T14:49:47.452Z
CVE-2024-35340 
Tenda FH1206 V1.2.0.8(8155) was discovered to contain a command injection vulnerability via the cmdinput parameter at ip/goform/formexeCommand.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-24T14:50:56.175Z
CVE-2024-35341 
Certain Anpviz products allow unauthenticated users to download the running configuration of the device via a HTTP GET request to /ConfigFile.ini or /config.xml URIs. This configuration file contains usernames and encrypted passwords (encrypted with a hardcoded key common to all devices). This affects IPC-D250, IPC-D260, IPC-B850, IPC-D850, IPC-D350, IPC-D3150, IPC-D4250, IPC-D380, IPC-D880, IPC-D280, IPC-D3180, MC800N, YM500L, YM800N_N2, YMF50B, YM800SV2, YM500L8, and YM200E10 firmware v3.2.2.2 and lower and possibly more vendors/models of IP camera.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-28T16:57:11.701Z
CVE-2024-35342 
Certain Anpviz products allow unauthenticated users to modify or disable camera related settings such as microphone volume, speaker volume, LED lighting, NTP, motion detection, etc. This affects IPC-D250, IPC-D260, IPC-B850, IPC-D850, IPC-D350, IPC-D3150, IPC-D4250, IPC-D380, IPC-D880, IPC-D280, IPC-D3180, MC800N, YM500L, YM800N_N2, YMF50B, YM800SV2, YM500L8, and YM200E10 firmware v3.2.2.2 and lower and possibly more vendors/models of IP camera.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-28T16:52:06.723Z
CVE-2024-35343 
Certain Anpviz products allow unauthenticated users to download arbitrary files from the device's filesystem via a HTTP GET request to the /playback/ URI. This affects IPC-D250, IPC-D260, IPC-B850, IPC-D850, IPC-D350, IPC-D3150, IPC-D4250, IPC-D380, IPC-D880, IPC-D280, IPC-D3180, MC800N, YM500L, YM800N_N2, YMF50B, YM800SV2, YM500L8, and YM200E10 (IP Cameras) firmware v3.2.2.2 and lower and possibly more vendors/models of IP camera.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-28T16:46:52.274Z
CVE-2024-35344 
Certain Anpviz products contain a hardcoded cryptographic key stored in the firmware of the device. This affects IPC-D250, IPC-D260, IPC-B850, IPC-D850, IPC-D350, IPC-D3150, IPC-D4250, IPC-D380, IPC-D880, IPC-D280, IPC-D3180, MC800N, YM500L, YM800N_N2, YMF50B, YM800SV2, YM500L8, and YM200E10 firmware v3.2.2.2 and lower and possibly more vendors/models of IP camera.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-28T17:01:18.511Z
CVE-2024-35345 
A vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts unidentified code within the file /classes/Users.php. Manipulating the argument id results in cross-site scripting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-30T16:00:05.136Z
CVE-2024-35349 
A vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts an unidentified code within the file /admin/category/view_category.php. Manipulating the argument id can result in SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-30T16:20:38.130Z
CVE-2024-35350 
A vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts an unidentified code within the file /admin/?page=borrow/view_borrow. Manipulating the argument id can result in SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-30T16:19:14.033Z
CVE-2024-35351 
A vulnerability has been discovered in Diño Physics School Assistant version 2.3. This vulnerability impacts unidentified code within the file /classes/SystemSettings.php?f=update_settings. Manipulating the parameter name results in cross-site scripting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-30T16:18:10.045Z
CVE-2024-35352 
A vulnerability has been discovered in Diño Physics School Assistant version 2.3. This vulnerability impacts unidentified code within the file /classes/Users.php?f=save. Manipulating the parameter middlename results in cross-site scripting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-30T16:08:16.773Z
CVE-2024-35353 
A vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts an unidentified code within the file /classes/Users.php?f=save. Manipulating the argument id can result in improper authorization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-30T16:06:53.927Z
CVE-2024-35354 
A vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts an unidentified code within the file /classes/Master.php?f=save_category. Manipulating the argument id can result in SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-30T16:04:44.161Z
CVE-2024-35355 
A vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts an unidentified code within the file /classes/Master.php?f=delete_category. Manipulating the argument id can result in SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-30T16:03:33.740Z
CVE-2024-35356 
A vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts an unidentified code within the file /classes/Master.php?f=save_item. Manipulating the argument id can result in SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-30T16:02:45.390Z
CVE-2024-35357 
A vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts an unidentified code within the file /classes/Master.php?f=delete_item. Manipulating the argument id can result in SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-30T16:01:40.769Z
CVE-2024-35358 
A vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts an unidentified code within the file /classes/Master.php?f=view_category. Manipulating the argument id can result in SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-30T15:57:24.634Z
CVE-2024-35359 
A vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts an unidentified code within the file /classes/Master.php?f=view_item. Manipulating the argument id can result in SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-30T16:16:47.699Z
CVE-2024-35361 
MTab Bookmark v1.9.5 has an SQL injection vulnerability in /LinkStore/getIcon. An attacker can execute arbitrary SQL statements through this vulnerability without requiring any user rights.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-21T12:17:15.082Z
CVE-2024-35362 
Ecshop 3.6 is vulnerable to Cross Site Scripting (XSS) via ecshop/article_cat.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-22T15:44:43.671Z
CVE-2024-35365 
FFmpeg version n6.1.1 has a double-free vulnerability in the fftools/ffmpeg_mux_init.c component of FFmpeg, specifically within the new_stream_audio function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-03T00:00:00.000Z
CVE-2024-35366 
FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-29T00:00:00.000Z
CVE-2024-35367 
FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-29T00:00:00.000Z
CVE-2024-35368 
FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-29T00:00:00.000Z
CVE-2024-35369 
In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c module, a potential security vulnerability exists due to insufficient validation of certain parameters when parsing Speex codec extradata. This vulnerability could lead to integer overflow conditions, potentially resulting in undefined behavior or crashes during the decoding process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-29T00:00:00.000Z
CVE-2024-35371 
Ant-Media-Serverv2.8.2 is affected by Improper Output Neutralization for Logs. The vulnerability stems from insufficient input sanitization in the logging mechanism. Without proper filtering or validation, user-controllable data, such as identifiers or other sensitive information, can be included in log entries without restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-29T00:00:00.000Z
CVE-2024-35373 
Mocodo Mocodo Online 4.2.6 and below is vulnerable to Remote Code Execution via /web/rewrite.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-24T20:28:45.269Z
CVE-2024-35374 
Mocodo Mocodo Online 4.2.6 and below does not properly sanitize the sql_case input field in /web/generate.php, allowing remote attackers to execute arbitrary commands and potentially command injection, leading to remote code execution (RCE) under certain conditions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-24T20:29:35.384Z
CVE-2024-35375 
There is an arbitrary file upload vulnerability on the media add .php page in the backend of the website in version 5.7.114 of DedeCMS
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-23T18:53:33.398Z
CVE-2024-35384 
An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_array_length function in the mjs.c file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-21T13:38:34.570Z
CVE-2024-35385 
An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_mk_ffi_sig function in the mjs.c file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-21T13:39:56.028Z
CVE-2024-35386 
An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_do_gc function in the mjs.c file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-21T13:36:14.289Z
CVE-2024-35387 
TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the http_host parameter in the function loginAuth.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-24T18:05:29.300Z
CVE-2024-35388 
TOTOLINK NR1800X v9.1.0u.6681_B20230703 was discovered to contain a stack overflow via the password parameter in the function urldecode
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-24T18:08:57.640Z
CVE-2024-35395 
TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attackers to log in as root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-24T15:59:08.590Z
CVE-2024-35396 
TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a hardcoded password for telnet in /web_cste/cgi-bin/product.ini, which allows attackers to log in as root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-24T15:54:35.247Z
CVE-2024-35397 
TOTOLINK CP900L v4.1.5cu.798_B20221228 weas discovered to contain a command injection vulnerability in the NTPSyncWithHost function via the hostTime parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-28T14:33:46.331Z
CVE-2024-35398 
TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a stack overflow via the desc parameter in the function setMacFilterRules.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-28T14:38:04.495Z
CVE-2024-35399 
TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a stack overflow via the password parameter in the function loginAuth
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-28T14:43:06.850Z
CVE-2024-35400 
TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a stack overflow via the desc parameter in the function SetPortForwardRules
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-28T14:46:26.621Z
CVE-2024-35401 
TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadFirmwareFile function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-28T16:22:37.636Z
CVE-2024-35403 
TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a stack overflow via the desc parameter in the function setIpPortFilterRules
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-28T16:21:22.198Z
CVE-2024-35409 
WeBid 1.1.2 is vulnerable to SQL Injection via admin/tax.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-22T13:59:48.015Z
CVE-2024-35410 
wac commit 385e1 was discovered to contain a heap overflow via the interpret function at /wac-asan/wa.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted wasm file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-08T00:00:00.000Z
CVE-2024-35418 
wac commit 385e1 was discovered to contain a heap overflow via the setup_call function at /wac-asan/wa.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted wasm file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-08T00:00:00.000Z
CVE-2024-35419 
wac commit 385e1 was discovered to contain a heap overflow via the load_module function at /wac-asan/wa.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted wasm file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-08T00:00:00.000Z
CVE-2024-35420 
wac commit 385e1 was discovered to contain a heap overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-08T00:00:00.000Z
CVE-2024-35421 
vmir e8117 was discovered to contain a segmentation violation via the wasm_parse_block function at /src/vmir_wasm_parser.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-08T00:00:00.000Z
CVE-2024-35422 
vmir e8117 was discovered to contain a heap buffer overflow via the wasm_call function at /src/vmir_wasm_parser.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-08T00:00:00.000Z
CVE-2024-35423 
vmir e8117 was discovered to contain a heap buffer overflow via the wasm_parse_section_functions function at /src/vmir_wasm_parser.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-08T00:00:00.000Z
CVE-2024-35424 
vmir e8117 was discovered to contain a segmentation violation via the import_function function at /src/vmir_wasm_parser.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-08T00:00:00.000Z
CVE-2024-35425 
vmir e8117 was discovered to contain a segmentation violation via the function_prepare_parse function at /src/vmir_function.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-08T00:00:00.000Z
CVE-2024-35426 
vmir e8117 was discovered to contain a stack overflow via the init_local_vars function at /src/vmir_wasm_parser.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-08T00:00:00.000Z
CVE-2024-35427 
vmir e8117 was discovered to contain a segmentation violation via the export_function function at /src/vmir_wasm_parser.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-08T00:00:00.000Z
CVE-2024-35428 
ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via BaseMediaFile. An authenticated user can delete local files from the server which can lead to DoS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-30T17:02:20.057Z
CVE-2024-35429 
ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via eventRecord.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-30T16:20:53.690Z
CVE-2024-35430 
In ZKTeco ZKBio CVSecurity v6.1.1_R and earlier (fixed in 6.1.3_R) an authenticated user can bypass password checks while exporting data from the application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-30T15:55:46.314Z
CVE-2024-35431 
ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64. An unauthenticated user can download local files from the server. NOTE: Third parties have indicated other versions are also vulnerable including up to 6.4.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-30T16:10:50.419Z
CVE-2024-35432 
ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Cross Site Scripting (XSS) via an Audio File. An authenticated user can injection malicious JavaScript code to trigger a Cross Site Scripting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-30T16:05:05.907Z
CVE-2024-35433 
ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Incorrect Access Control. An authenticated user, without the permissions of managing users, can create a new admin user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-30T17:10:57.858Z
CVE-2024-35434 
Irontec Sngrep v1.8.1 was discovered to contain a heap buffer overflow via the function rtp_check_packet at /sngrep/src/rtp.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted SIP packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-29T19:06:12.561Z
CVE-2024-35451 
LinkStack 2.7.9 through 4.7.7 allows resources\views\components\favicon.blade.php link SSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-29T00:00:00.000Z
CVE-2024-35468 
A SQL injection vulnerability in /hrm/index.php in SourceCodester Human Resource Management System 1.0 allows attackers to execute arbitrary SQL commands via the password parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-30T17:17:28.654Z
CVE-2024-35469 
A SQL injection vulnerability in /hrm/user/ in SourceCodester Human Resource Management System 1.0 allows attackers to execute arbitrary SQL commands via the password parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-30T17:20:11.099Z
CVE-2024-35474 
A Directory Traversal vulnerability in iceice666 ResourcePack Server before v1.0.8 allows a remote attacker to disclose files on the server, via setPath in ResourcePackFileServer.kt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:L/S:U/UI:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
Published: 2024-06-10T00:00:00.000Z
CVE-2024-35475 
A Cross-Site Request Forgery (CSRF) vulnerability was discovered in OpenKM Community Edition on or before version 6.3.12. The vulnerability exists in /admin/DatabaseQuery, which allows an attacker to manipulate a victim with administrative privileges to execute arbitrary SQL commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-22T13:49:59.533Z