rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-26769 
Buffer Overflow vulnerability found in Liblouis Lou_Trace v.3.24.0 allows a remote attacker to cause a denial of service via the resolveSubtable function at compileTranslationTabel.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-16T00:00:00.000Z
CVE-2023-26770 
TaskCafe 0.3.2 lacks validation in the Cookie value. Any unauthenticated attacker who knows a registered UserID can change the password of that user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-04T00:00:00.000Z
CVE-2023-26771 
Taskcafe 0.3.2 is vulnerable to Cross Site Scripting (XSS). There is a lack of validation in the filetype when uploading a SVG profile picture with a XSS payload on it. An authenticated attacker can exploit this vulnerability by uploading a malicious picture which will trigger the payload when the victim opens the file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-04T00:00:00.000Z
CVE-2023-26773 
Cross Site Scripting vulnerability found in Sales Tracker Management System v.1.0 allows a remote attacker to gain privileges via the product list function in the Master.php file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-10T00:00:00.000Z
CVE-2023-26774 
An issue found in Sales Tracker Management System v.1.0 allows a remote attacker to access sensitive information via sales.php component of the admin/reports endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-10T00:00:00.000Z
CVE-2023-26775 
File Upload vulnerability found in Monitorr v.1.7.6 allows a remote attacker t oexecute arbitrary code via a crafted file upload to the assets/php/upload.php endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-04T00:00:00.000Z
CVE-2023-26776 
Cross Site Scripting vulnerability found in Monitorr v.1.7.6 allows a remote attacker to execute arbitrary code via the title parameter of the post_receiver-services.php file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-04T00:00:00.000Z
CVE-2023-26777 
Cross Site Scripting vulnerability found in : louislam Uptime Kuma v.1.19.6 and before allows a remote attacker to execute arbitrary commands via the description, title, footer, and incident creation parameter of the status_page.js endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-04T00:00:00.000Z
CVE-2023-26779 
CleverStupidDog yf-exam v 1.8.0 is vulnerable to Deserialization which can lead to remote code execution (RCE).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-03T00:00:00.000Z
CVE-2023-26780 
CleverStupidDog yf-exam v 1.8.0 is vulnerable to SQL Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-02T00:00:00.000Z
CVE-2023-26781 
SQL injection vulnerability in mccms 2.6 allows remote attackers to run arbitrary SQL commands via Author Center ->Reader Comments ->Search.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-28T00:00:00.000Z
CVE-2023-26782 
An issue discovered in mccms 2.6.1 allows remote attackers to cause a denial of service via Backend management interface ->System Configuration->Cache Configuration->Cache security characters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-28T00:00:00.000Z
CVE-2023-26784 
SQL Injection vulnerability found in Kirin Fortress Machine v.1.7-2020-0610 allows attackers to execute arbitrary code via the /admin.php?controller=admin_commonuser parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-16T00:00:00.000Z
CVE-2023-26785 
MariaDB v10.5 was discovered to contain a remote code execution (RCE) vulnerability via UDF Code in a Shared Object File, followed by a "create function" statement. NOTE: this is disputed by the MariaDB Foundation because no privilege boundary is crossed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-17T00:00:00.000Z
CVE-2023-26788 
Veritas Appliance v4.1.0.1 is affected by Host Header Injection attacks. HTTP host header can be manipulated and cause the application to behave in unexpected ways. Any changes made to the header would just cause the request to be sent to a completely different Domain/IP address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-10T00:00:00.000Z
CVE-2023-26789 
Veritas NetBackUp OpsCenter Version 9.1.0.1 is vulnerable to Reflected Cross-site scripting (XSS). The Web App fails to adequately sanitize special characters. By leveraging this issue, an attacker is able to cause arbitrary HTML and JavaScript code to be executed in a user's browser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-05T00:00:00.000Z
CVE-2023-26793 
libmodbus v3.1.10 has a heap-based buffer overflow vulnerability in read_io_status function in src/modbus.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-01T00:00:00.000Z
CVE-2023-26800 
Ruijie Networks RG-EW1200 Wireless Routers EW_3.0(1)B11P204 was discovered to contain a command injetion vulnerability via the params.path parameter in the upgradeConfirm function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-26T00:00:00.000Z
CVE-2023-26801 
LB-LINK BL-AC1900_2.0 v1.0.1, LB-LINK BL-WR9000 v2.4.9, LB-LINK BL-X26 v1.2.5, and LB-LINK BL-LTE300 v1.0.8 were discovered to contain a command injection vulnerability via the mac, time1, and time2 parameters at /goform/set_LimitClient_cfg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-26T00:00:00.000Z
CVE-2023-26802 
An issue in the component /network_config/nsg_masq.cgi of DCN (Digital China Networks) DCBI-Netlog-LAB v1.0 allows attackers to bypass authentication and execute arbitrary commands via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-26T00:00:00.000Z
CVE-2023-26805 
Tenda W20E v15.11.0.6 (US_W20EV4.0br_v15.11.0.6(1068_1546_841)_CN_TDC) is vulnerable to Buffer Overflow via function formIPMacBindModify.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-19T00:00:00.000Z
CVE-2023-26806 
Tenda W20E v15.11.0.6(US_W20EV4.0br_v15.11.0.6(1068_1546_841 is vulnerable to Buffer Overflow via function formSetSysTime,
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-19T00:00:00.000Z
CVE-2023-26813 
SQL injection vulnerability in com.xnx3.wangmarket.plugin.dataDictionary.controller.DataDictionaryPluginController.java in wangmarket CMS 4.10 allows remote attackers to run arbitrary SQL commands via the TableName parameter to /plugin/dataDictionary/tableView.do.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-28T00:00:00.000Z
CVE-2023-26817 
codefever before 2023.2.7-commit-b1c2e7f was discovered to contain a remote code execution (RCE) vulnerability via the component /controllers/api/user.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-07T00:00:00.000Z
CVE-2023-26818 
Telegram 9.3.1 and 9.4.0 allows attackers to access restricted files, microphone ,or video recording via the DYLD_INSERT_LIBRARIES flag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-19T00:00:00.000Z
CVE-2023-26819 
cJSON 1.7.15 might allow a denial of service via a crafted JSON document such as {"a": true, "b": [ null,9999999999999999999999999999999999999999999999912345678901234567]}.
Problem types: cwe_id: CWE-440
description: CWE-440 Expected Behavior Violation
Affected products: vendor: cJSON Project
product: cJSON
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 2.9
baseSeverity: LOW
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Published: 2025-04-19T00:00:00.000Z
CVE-2023-26820 
siteproxy v1.0 was discovered to contain a path traversal vulnerability via the component index.js.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-07T00:00:00.000Z
CVE-2023-26822 
D-Link Go-RT-AC750 revA_v101b03 was discovered to contain a command injection vulnerability via the service parameter at soapcgi.main.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-01T00:00:00.000Z
CVE-2023-26829 
An authentication bypass vulnerability in the Password Reset component of Gladinet CentreStack before 13.5.9808 allows remote attackers to set a new password for any valid user account, without needing the previous known password, resulting in a full authentication bypass.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-31T00:00:00.000Z
CVE-2023-26830 
An unrestricted file upload vulnerability in the administrative portal branding component of Gladinet CentreStack before 13.5.9808 allows authenticated attackers to execute arbitrary code by uploading malicious files to the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-31T00:00:00.000Z
CVE-2023-26839 
A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to edit information for existing people on the site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-25T00:00:00.000Z
CVE-2023-26840 
A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to set a person to a user and set that user to be an Administrator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-25T00:00:00.000Z
CVE-2023-26841 
A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to change any user's password except for the user that is currently logged in.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-25T00:00:00.000Z
CVE-2023-26842 
A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the OptionManager.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-31T00:00:00.000Z
CVE-2023-26843 
A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the NoteEditor.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-25T00:00:00.000Z
CVE-2023-26845 
A Cross-Site Request Forgery (CSRF) in OpenCATS 0.9.7 allows attackers to force users into submitting web requests via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-11T00:00:00.000Z
CVE-2023-26846 
A stored cross-site scripting (XSS) vulnerability in OpenCATS v0.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the city parameter at opencats/index.php?m=candidates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-11T00:00:00.000Z
CVE-2023-26847 
A stored cross-site scripting (XSS) vulnerability in OpenCATS v0.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the state parameter at opencats/index.php?m=candidates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-11T00:00:00.000Z
CVE-2023-26848 
TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the org parameter at setting/delStaticDhcpRules.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-07T00:00:00.000Z
CVE-2023-26852 
An arbitrary file upload vulnerability in the upload plugin of Textpattern v4.8.8 and below allows attackers to execute arbitrary code by uploading a crafted PHP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-12T00:00:00.000Z
CVE-2023-26855 
The hashing algorithm of ChurchCRM v4.5.3 utilizes a non-random salt value which allows attackers to use precomputed hash tables or dictionary attacks to crack the hashed passwords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-04T00:00:00.000Z
CVE-2023-26856 
Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter at /admin/ajax.php?action=login.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-05T00:00:00.000Z
CVE-2023-26857 
An arbitrary file upload vulnerability in /admin/ajax.php?action=save_uploads of Dynamic Transaction Queuing System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-05T00:00:00.000Z
CVE-2023-26858 
SQL injection vulnerability found in PrestaSHp faqs v.3.1.6 allows a remote attacker to escalate privileges via the faqsBudgetModuleFrontController::displayAjaxGenerateBudget component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-31T00:00:00.000Z
CVE-2023-26859 
SQL injection vulnerability found in PrestaShop sendinblue v.4.0.15 and before allow a remote attacker to gain privileges via the ajaxOrderTracking.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-26T00:00:00.000Z
CVE-2023-26860 
SQL injection vulnerability found in PrestaShop Igbudget v.1.0.3 and before allow a remote attacker to gain privileges via the LgBudgetBudgetModuleFrontController::displayAjaxGenerateBudget component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-10T00:00:00.000Z
CVE-2023-26861 
SQL injection vulnerability found in PrestaShop vivawallet v.1.7.10 and before allows a remote attacker to gain privileges via the vivawallet() module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-11T00:00:00.000Z
CVE-2023-26864 
SQL injection vulnerability found in PrestaShop smplredirectionsmanager v.1.1.19 and before allow a remote attacker to gain privileges via the SmplTools::getMatchingRedirectionsFromPartscomponent.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-24T00:00:00.000Z
CVE-2023-26865 
SQL injection vulnerability found in PrestaShop bdroppy v.2.2.12 and before allowing a remote attacker to gain privileges via the BdroppyCronModuleFrontController::importProducts component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-24T00:00:00.000Z
CVE-2023-26866 
GreenPacket OH736's WR-1200 Indoor Unit, OT-235 with firmware versions M-IDU-1.6.0.3_V1.1 and MH-46360-2.0.3-R5-GP respectively are vulnerable to remote command injection. Commands are executed using pre-login execution and executed with root privileges allowing complete takeover.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-04T00:00:00.000Z
CVE-2023-26876 
SQL injection vulnerability found in Piwigo v.13.5.0 and before allows a remote attacker to execute arbitrary code via the filter_user_id parameter to the admin.php?page=history&filter_image_id=&filter_user_id endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-21T00:00:00.000Z
CVE-2023-26877 
File upload vulnerability found in Softexpert Excellence Suite v.2.1 allows attackers to execute arbitrary code via a .php file upload to the form/efms_exec_html/file_upload_parser.php endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-26T00:00:00.000Z
CVE-2023-26905 
An issue was discovered in Alphaware - Simple E-Commerce System v1.0. There is a SQL injection that can directly issue instructions to the background database system via /alphaware/details.php?id.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-19T00:00:00.000Z
CVE-2023-26911 
ASUS SetupAsusServices v1.0.5.1 in Asus Armoury Crate v5.3.4.0 contains an unquoted service path vulnerability which allows local users to launch processes with elevated privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-26T00:00:00.000Z
CVE-2023-26912 
Cross site scripting (XSS) vulnerability in xenv S-mall-ssm thru commit 3d9e77f7d80289a30f67aaba1ae73e375d33ef71 on Feb 17, 2020, allows local attackers to execute arbitrary code via the evaluate button.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-15T00:00:00.000Z
CVE-2023-26913 
EVOLUCARE ECSIMAGING (aka ECS Imaging) < 6.21.5 is vulnerable to Cross Site Scripting (XSS) via new_movie. php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-22T00:00:00.000Z
CVE-2023-26916 
libyang from v2.0.164 to v2.1.30 was discovered to contain a NULL pointer dereference via the function lys_parse_mem at lys_parse_mem.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-03T00:00:00.000Z
CVE-2023-26917 
libyang from v2.0.164 to v2.1.30 was discovered to contain a NULL pointer dereference via the function lysp_stmt_validate_value at lys_parse_mem.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-11T00:00:00.000Z
CVE-2023-26918 
Diasoft File Replication Pro 7.5.0 allows attackers to escalate privileges by replacing a legitimate file with a Trojan horse that will be executed as LocalSystem. This occurs because %ProgramFiles%\FileReplicationPro allows Everyone:(F) access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-13T00:00:00.000Z
CVE-2023-26919 
delight-nashorn-sandbox 0.2.4 and 0.2.5 is vulnerable to sandbox escape. When allowExitFunctions is set to false, the loadWithNewGlobal function can be used to invoke the exit and quit methods to exit the Java process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-10T00:00:00.000Z
CVE-2023-26920 
fast-xml-parser before 4.1.2 allows __proto__ for Prototype Pollution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-12T00:00:00.000Z
CVE-2023-26921 
OS Command Injection vulnerability in quectel AG550QCN allows attackers to execute arbitrary commands via ql_atfwd.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-04T00:00:00.000Z
CVE-2023-26922 
SQL injection vulnerability found in Varisicte matrix-gui v.2 allows a remote attacker to execute arbitrary code via the shell_exect parameter to the \www\pages\matrix-gui-2.0 endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-08T00:00:00.000Z
CVE-2023-26923 
Musescore 3.0 to 4.0.1 has a stack buffer overflow vulnerability that occurs when reading misconfigured midi files. If attacker can additional information, attacker can execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-28T00:00:00.000Z
CVE-2023-26924 
LLVM a0dab4950 has a segmentation fault in mlir::outlineSingleBlockRegion. NOTE: third parties dispute this because the LLVM security policy excludes "Language front-ends ... for which a malicious input file can cause undesirable behavior."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-27T00:00:00.000Z
CVE-2023-26925 
An information disclosure vulnerability exists in the Syslog functionality of D-LINK DIR-882 1.30. A specially crafted network request can lead to the disclosure of sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-31T00:00:00.000Z
CVE-2023-26930 
Buffer Overflow vulnerability found in XPDF v.4.04 allows an attacker to cause a Denial of Service via the PDFDoc malloc in the pdftotext.cc function. NOTE: Vendor states “it's an expected abort on out-of-memory error.”
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-26T00:00:00.000Z
CVE-2023-26941 
Weak encryption mechanisms in RFID Tags in Yale Conexis L1 v1.1.0 allows attackers to create a cloned tag via physical proximity to the original.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-04T00:00:00.000Z
CVE-2023-26942 
Weak encryption mechanisms in RFID Tags in Yale IA-210 Alarm v1.0 allows attackers to create a cloned tag via physical proximity to the original.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-04T00:00:00.000Z
CVE-2023-26943 
Weak encryption mechanisms in RFID Tags in Yale Keyless Lock v1.0 allows attackers to create a cloned tag via physical proximity to the original.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-04T00:00:00.000Z
CVE-2023-26948 
onekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/file/download.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-09T00:00:00.000Z
CVE-2023-26949 
An arbitrary file upload vulnerability in the component /admin1/config/update of onekeyadmin v1.3.9 allows attackers to execute arbitrary code via a crafted PHP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-06T00:00:00.000Z
CVE-2023-26950 
onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Title parameter under the Adding Categories module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-08T00:00:00.000Z
CVE-2023-26951 
onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Member List module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-16T00:00:00.000Z
CVE-2023-26952 
onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Menu module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-08T00:00:00.000Z
CVE-2023-26953 
onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Administrator module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-07T00:00:00.000Z
CVE-2023-26954 
onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the User Group module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-07T00:00:00.000Z
CVE-2023-26955 
onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Admin Group module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-07T00:00:00.000Z
CVE-2023-26956 
onekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/curd/code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-08T00:00:00.000Z
CVE-2023-26957 
onekeyadmin v1.3.9 was discovered to contain an arbitrary file delete vulnerability via the component \admin\controller\plugins.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-09T00:00:00.000Z