rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-7081 SQLi in PosTahsil's Online Payment System
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in POSTAHSİL Online Payment System allows SQL Injection.

This issue affects Online Payment System: before 14.02.2024.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: POSTAHSİL
product: Online Payment System
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Credits: lang: en
value: Ömer Kaan COŞKUN
Published: 2024-02-15T15:31:57.211Z
CVE-2023-7082 WP All Import < 3.7.3 - Admin+ Arbitrary File Upload to RCE
The Import any XML or CSV File to WordPress plugin before 3.7.3 accepts all zip files and automatically extracts the zip file into a publicly accessible directory without sufficiently validating the extracted file type. This may allows high privilege users such as administrator to upload an executable file type leading to remote code execution.
Problem types: description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Unknown
product: Import any XML or CSV File to WordPress
default_status: unaffected
Credits: lang: en
value: quangnt
lang: en
value: WPScan
Published: 2024-01-22T19:14:29.189Z
CVE-2023-7083 Voting Record <= 2.0 - Settings Update to Stored XSS via CSRF
The Voting Record WordPress plugin through 2.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
Problem types: description: CWE-352 Cross-Site Request Forgery (CSRF)
description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Voting Record
default_status: affected
Credits: lang: en
value: Daniel Ruf
lang: en
value: WPScan
Published: 2024-01-16T15:57:04.021Z
CVE-2023-7084 Voting Record <= 2.0 - Subscriber+ Stored XSS
The Voting Record WordPress plugin through 2.0 is missing sanitisation as well as escaping, which could allow any authenticated users, such as subscriber to perform Stored XSS attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Voting Record
default_status: affected
Credits: lang: en
value: Daniel Ruf
lang: en
value: WPScan
Published: 2024-01-16T15:57:03.277Z
CVE-2023-7085 Scalable Vector Graphics (SVG) <= 3.4 - Author+ Stored XSS via SVG
The Scalable Vector Graphics (SVG) WordPress plugin through 3.4 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Scalable Vector Graphics (SVG)
default_status: affected
Credits: lang: en
value: Bob Matyas
lang: en
value: WPScan
Published: 2024-03-18T19:05:50.838Z
CVE-2023-7086 SVG Uploads Support  <= 2.1.1 - Author+ Stored XSS via SVG
The SVG Uploads Support WordPress plugin through 2.1.1 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: SVG Uploads Support
default_status: affected
Credits: lang: en
value: Bob Matyas
lang: en
value: WPScan
Published: 2025-05-15T20:09:21.852Z
CVE-2023-7088 Add SVG Support for Media Uploader | inventivo <= 1.0.5 - Author+ Stored XSS via SVG
The Add SVG Support for Media Uploader | inventivo WordPress plugin through 1.0.5 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Add SVG Support for Media Uploader | inventivo
default_status: affected
Credits: lang: en
value: Bob Matyas
lang: en
value: WPScan
Published: 2025-05-15T20:09:22.054Z
CVE-2023-7089 Easy SVG Allow <= 1.0 - Author+ Stored XSS via SVG
The Easy SVG Allow WordPress plugin through 1.0 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Easy SVG Allow
default_status: affected
Credits: lang: en
value: Bob Matyas
lang: en
value: WPScan
Published: 2024-01-29T14:44:24.539Z
CVE-2023-7090 Sudo: improper handling of ipa_hostname leads to privilege mismanagement
A flaw was found in sudo in the handling of ipa_hostname, where ipa_hostname from /etc/sssd/sssd.conf was not propagated in sudo. Therefore, it leads to privilege mismanagement vulnerability in applications, where client hosts retain privileges even after retracting them.
Problem types: cwe_id: CWE-269
description: Improper Privilege Management
Affected products: vendor: n/a
product: sudo
vendor: Red Hat
product: Red Hat Enterprise Linux 6
cpes: cpe:/o:redhat:enterprise_linux:6
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9
default_status: unaffected
vendor: Fedora
product: Fedora
default_status: unaffected
vendor: Fedora
product: Fedora
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: This issue was discovered by Mohammad Tausif Siddiqui (Red Hat Product Security).
Published: 2023-12-23T22:33:13.530Z
CVE-2023-7091 Dreamer CMS uploadFile unrestricted upload
A vulnerability was found in Dreamer CMS 4.1.3. It has been declared as problematic. This vulnerability affects unknown code of the file /upload/uploadFile. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-248938 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload
Affected products: vendor: Dreamer
product: CMS
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: hexixi (VulDB User)
Published: 2023-12-24T21:00:05.391Z
CVE-2023-7092 Uniway UW-302VP Admin Web Interface wlan_basic_set.cgi cross-site request forgery
A vulnerability was found in Uniway UW-302VP 2.0. It has been rated as problematic. This issue affects some unknown processing of the file /boaform/wlan_basic_set.cgi of the component Admin Web Interface. The manipulation of the argument wlanssid/password leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248939. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery
Affected products: vendor: Uniway
product: UW-302VP
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
baseSeverity: MEDIUM
Credits: lang: en
value: faiyazahmad (VulDB User)
Published: 2023-12-24T23:00:05.416Z
CVE-2023-7093 KylinSoft kylin-system-updater com.kylin.systemupgrade Service UpgradeStrategiesDbus.py os command injection
A vulnerability classified as critical has been found in KylinSoft kylin-system-updater up to 2.0.5.16-0k2.33. Affected is an unknown function of the file /usr/share/kylin-system-updater/SystemUpdater/UpgradeStrategiesDbus.py of the component com.kylin.systemupgrade Service. The manipulation of the argument SetDownloadspeedMax leads to os command injection. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248940. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-78
description: CWE-78 OS Command Injection
Affected products: vendor: KylinSoft
product: kylin-system-updater
CVSS v3.1: version: 3.1
baseScore: 5.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: glzjin (VulDB User)
Published: 2023-12-24T23:31:04.019Z
CVE-2023-7094 Netentsec NS-ASG Application Security Gateway nsasg6.0.tgz information disclosure
A vulnerability classified as problematic was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected by this vulnerability is an unknown functionality of the file /protocol/nsasg6.0.tgz. The manipulation leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248941 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Disclosure
Affected products: vendor: Netentsec
product: NS-ASG Application Security Gateway
CVSS v3.1: version: 3.1
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
baseSeverity: MEDIUM
Credits: lang: en
value: Jie Wang (VulDB User)
Published: 2023-12-25T00:00:06.687Z
CVE-2023-7095 Totolink A7100RU HTTP POST Request main buffer overflow
A vulnerability, which was classified as critical, has been found in Totolink A7100RU 7.4cu.2313_B20191024. Affected by this issue is the function main of the file /cgi-bin/cstecgi.cgi?action=login of the component HTTP POST Request Handler. The manipulation of the argument flag leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-248942 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Overflow
Affected products: vendor: Totolink
product: A7100RU
CVSS v3.1: version: 3.1
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
baseSeverity: CRITICAL
Credits: lang: en
value: unpWn4bl3 (VulDB User)
Published: 2023-12-25T00:31:04.022Z
CVE-2023-7096 code-projects Faculty Management System crud.php sql injection
A flaw has been found in code-projects Faculty Management System 1.0. The affected element is an unknown function of the file /admin/php/crud.php. This manipulation of the argument fieldname/tablename causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: code-projects
product: Faculty Management System
CVSS v3.1: version: 3.1
baseScore: 4.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: G1un (VulDB User)
Published: 2023-12-25T01:00:06.137Z
CVE-2023-7097 code-projects Water Billing System addbill.php sql injection
A vulnerability classified as critical has been found in code-projects Water Billing System 1.0. This affects an unknown part of the file /addbill.php. The manipulation of the argument owners_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248949 was assigned to this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: code-projects
product: Water Billing System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: G1un (VulDB User)
Published: 2023-12-25T01:31:03.664Z
CVE-2023-7098 icret EasyImages hide.php path traversal
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic was found in icret EasyImages 2.8.3. This vulnerability affects unknown code of the file app/hide.php. The manipulation of the argument key leads to path traversal: '../filedir'. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-248950 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Problem types: cwe_id: CWE-24
description: CWE-24 Path Traversal: '../filedir'
Affected products: vendor: icret
product: EasyImages
CVSS v3.1: version: 3.1
baseScore: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
baseSeverity: LOW
Credits: lang: en
value: glzjin (VulDB User)
Published: 2023-12-25T02:00:05.851Z
CVE-2023-7099 PHPGurukul Nipah Virus Testing Management System bwdates-report-result.php sql injection
A vulnerability, which was classified as critical, has been found in PHPGurukul Nipah Virus Testing Management System 1.0. This issue affects some unknown processing of the file bwdates-report-result.php. The manipulation of the argument fromdate leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248951.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: PHPGurukul
product: Nipah Virus Testing Management System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: heishou (VulDB User)
Published: 2023-12-25T02:31:04.313Z
CVE-2023-7100 PHPGurukul Restaurant Table Booking System bwdates-report-details.php sql injection
A vulnerability, which was classified as critical, was found in PHPGurukul Restaurant Table Booking System 1.0. Affected is an unknown function of the file /admin/bwdates-report-details.php. The manipulation of the argument fdate/tdate leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: PHPGurukul
product: Restaurant Table Booking System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: heishou (VulDB User)
lang: en
value: heishou (VulDB User)
Published: 2023-12-25T03:00:05.608Z
CVE-2023-7101 Arbitrary Code Execution (ACE) Vulnerability
Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.
Problem types: cwe_id: CWE-95
description: CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Affected products: vendor: Douglas Wilson
product: Spreadsheet::ParseExcel
default_status: affected
Credits: lang: en
value: Le Dinh Hai (https://github.com/haile01/perl_spreadsheet_excel_rce_poc/tree/main)
lang: en
value: Barracuda Networks Inc.  https://www.barracuda.com/
Published: 2023-12-24T21:34:46.527Z
CVE-2023-7102 Remote Code Execution (RCE) Vulnerability
Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection.This issue affected Barracuda ESG Appliance, from 5.1.3.001 through 9.2.1.001, until Barracuda removed the vulnerable logic.


Problem types: cwe_id: CWE-1104
description: CWE-1104: Use of Unmaintained Third Party Components
Affected products: vendor: Barracuda Networks Inc.
product: Barracuda ESG Appliance
default_status: unaffected
Credits: lang: en
value: Barracuda Networks Inc. - https://www.barracuda.com/
lang: en
value: Barracuda Networks Inc. - https://www.barracuda.com/
lang: en
value: Barracuda Networks Inc. - https://www.barracuda.com/
Published: 2023-12-24T21:47:20.453Z
CVE-2023-7103 Authentication Bypass in ZKSoftware's UFace 5
Authentication Bypass by Primary Weakness vulnerability in ZKSoftware Biometric Security Solutions UFace 5 allows Authentication Bypass.

This issue affects UFace 5: through 12022024.
Problem types: cwe_id: CWE-305
description: CWE-305 Authentication Bypass by Primary Weakness
Affected products: vendor: ZKSoftware Biometric Security Solutions
product: UFace 5
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Credits: lang: en
value: Efe Özel
lang: en
value: Ömer Yılmaz
lang: en
value: Cemil Sefa Özcan
lang: en
value: fordefence.com
Published: 2024-03-05T12:57:32.926Z
CVE-2023-7104 SQLite SQLite3 make alltest sqlite3session.c sessionReadRecord heap-based overflow
A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-248999.
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: SQLite
product: SQLite3
CVSS v3.1: version: 3.1
baseScore: 5.5
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: Junwha Hong
lang: en
value: Wonil Jang
lang: en
value: qbit (VulDB User)
Published: 2023-12-25T21:00:05.997Z
CVE-2023-7105 code-projects E-Commerce Website index_search.php sql injection
A vulnerability was found in code-projects E-Commerce Website 1.0. It has been classified as critical. Affected is an unknown function of the file index_search.php. The manipulation of the argument search leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249000.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: code-projects
product: E-Commerce Website
CVSS v3.1: version: 3.1
baseScore: 4.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: Hamdi Sevben (VulDB User)
Published: 2023-12-25T22:31:04.133Z
CVE-2023-7106 code-projects E-Commerce Website sql injection
A vulnerability was found in code-projects E-Commerce Website 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file product_details.php?prod_id=11. The manipulation of the argument prod_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249001 was assigned to this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: code-projects
product: E-Commerce Website
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: Hamdi Sevben (VulDB User)
Published: 2023-12-25T23:00:06.432Z
CVE-2023-7107 code-projects E-Commerce Website user_signup.php sql injection
A vulnerability was found in code-projects E-Commerce Website 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file user_signup.php. The manipulation of the argument firstname/middlename/email/address/contact/username leads to sql injection. The attack may be launched remotely. VDB-249002 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: code-projects
product: E-Commerce Website
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: Hamdi Sevben (VulDB User)
Published: 2023-12-25T23:31:04.346Z
CVE-2023-7108 code-projects E-Commerce Website user_signup.php cross site scripting
A vulnerability classified as problematic has been found in code-projects E-Commerce Website 1.0. This affects an unknown part of the file user_signup.php. The manipulation of the argument firstname with the input <video/src=x onerror=alert(document.domain)> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249003.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: code-projects
product: E-Commerce Website
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
baseSeverity: MEDIUM
Credits: lang: en
value: Hamdi Sevben (VulDB User)
Published: 2023-12-26T00:00:07.088Z
CVE-2023-7109 code-projects Library Management System login.php sql injection
A vulnerability classified as critical was found in code-projects Library Management System 2.0. This vulnerability affects unknown code of the file /admin/login.php. The manipulation of the argument username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249004.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: code-projects
product: Library Management System
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: Hamdi Sevben (VulDB User)
Published: 2023-12-26T01:31:04.249Z
CVE-2023-7110 code-projects Library Management System login.php sql injection
A vulnerability, which was classified as critical, has been found in code-projects Library Management System 2.0. This issue affects some unknown processing of the file login.php. The manipulation of the argument student leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249005 was assigned to this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: code-projects
product: Library Management System
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: Hamdi Sevben (VulDB User)
Published: 2023-12-26T02:00:06.004Z