rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-24095 
Code-projects Simple Stock System 1.0 is vulnerable to SQL Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-27T00:00:00.000Z
CVE-2024-24096 
Code-projects Computer Book Store 1.0 is vulnerable to SQL Injection via BookSBIN.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-27T00:00:00.000Z
CVE-2024-24097 
Cross Site Scripting (XSS) vulnerability in Code-projects Scholars Tracking System 1.0 allows attackers to run arbitrary code via the News Feed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-12T00:00:00.000Z
CVE-2024-24098 
Code-projects Scholars Tracking System 1.0 is vulnerable to SQL Injection via the News Feed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-05T00:00:00.000Z
CVE-2024-24099 
Code-projects Scholars Tracking System 1.0 is vulnerable to SQL Injection under Employment Status Information Update.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-27T00:00:00.000Z
CVE-2024-24100 
Code-projects Computer Book Store 1.0 is vulnerable to SQL Injection via PublisherID.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-27T00:00:00.000Z
CVE-2024-24101 
Code-projects Scholars Tracking System 1.0 is vulnerable to SQL Injection under Eligibility Information Update.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-12T00:00:00.000Z
CVE-2024-24105 
SQL Injection vulnerability in Code-projects Computer Science Time Table System 1.0 allows attackers to run arbitrary code via adminFormvalidation.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-13T00:00:00.000Z
CVE-2024-24110 
SQL Injection vulnerability in crmeb_java before v1.3.4 allows attackers to run arbitrary SQL commands via crafted GET request to the component /api/front/spread/people.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-29T00:00:00.000Z
CVE-2024-24112 
xmall v1.1 was discovered to contain a SQL injection vulnerability via the orderDir parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-06T00:00:00.000Z
CVE-2024-24113 
xxl-job =< 2.4.1 has a Server-Side Request Forgery (SSRF) vulnerability, which causes low-privileged users to control executor to RCE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-08T00:00:00.000Z
CVE-2024-24115 
A stored cross-site scripting (XSS) vulnerability in the Edit Page function of Cotonti CMS v0.9.24 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-08T00:00:00.000Z
CVE-2024-24116 
An issue in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release(9736) allows a remote attacker to gain privileges via the system/config_menu.htm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-02T00:00:00.000Z
CVE-2024-24117 
Insecure Permissions vulnerability in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release (9736) allows a remote attacker to gain privileges via the login check state component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-02T00:00:00.000Z
CVE-2024-24122 
A remote code execution vulnerability in the project management of Wanxing Technology's Yitu project which allows an attacker to use the exp.adpx file as a zip compressed file to construct a special file name, which can be used to decompress the project file into the system startup folder, restart the system, and automatically execute the constructed attack script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-02T00:00:00.000Z
CVE-2024-24130 
Mail2World v12 Business Control Center was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Usr parameter at resellercenter/login.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-07T00:00:00.000Z
CVE-2024-24131 
SuperWebMailer v9.31.0.01799 was discovered to contain a reflected cross-site scripting (XSS) vulenrability via the component api.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-07T00:00:00.000Z
CVE-2024-24133 
Atmail v6.6.0 was discovered to contain a SQL injection vulnerability via the username parameter on the login page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-07T00:00:00.000Z
CVE-2024-24134 
Sourcecodester Online Food Menu 1.0 is vulnerable to Cross Site Scripting (XSS) via the 'Menu Name' and 'Description' fields in the Update Menu section.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-29T00:00:00.000Z
CVE-2024-24135 
Product Name and Product Code in the 'Add Product' section of Sourcecodester Product Inventory with Export to Excel 1.0 are vulnerable to XSS attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-29T00:00:00.000Z
CVE-2024-24136 
The 'Your Name' field in the Submit Score section of Sourcecodester Math Game with Leaderboard v1.0 is vulnerable to Cross-Site Scripting (XSS) attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-29T00:00:00.000Z
CVE-2024-24139 
Sourcecodester Login System with Email Verification 1.0 allows SQL Injection via the 'user' parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-29T00:00:00.000Z
CVE-2024-24140 
Sourcecodester Daily Habit Tracker App 1.0 allows SQL Injection via the parameter 'tracker.'
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-29T00:00:00.000Z
CVE-2024-24141 
Sourcecodester School Task Manager App 1.0 allows SQL Injection via the 'task' parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-29T00:00:00.000Z
CVE-2024-24142 
Sourcecodester School Task Manager 1.0 allows SQL Injection via the 'subject' parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-13T00:00:00.000Z
CVE-2024-24146 
A memory leak issue discovered in parseSWF_DEFINEBUTTON in libming v0.4.8 allows attackers to cause s denial of service via a crafted SWF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-28T00:00:00.000Z
CVE-2024-24147 
A memory leak issue discovered in parseSWF_FILLSTYLEARRAY in libming v0.4.8 allows attackers to cause s denial of service via a crafted SWF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-28T00:00:00.000Z
CVE-2024-24148 
A memory leak issue discovered in parseSWF_FREECHARACTER in libming v0.4.8 allows attackers to cause a denial of service via a crafted SWF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-28T00:00:00.000Z
CVE-2024-24149 
A memory leak issue discovered in parseSWF_GLYPHENTRY in libming v0.4.8 allows attackers to cause a denial of service via a crafted SWF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-28T00:00:00.000Z
CVE-2024-24150 
A memory leak issue discovered in parseSWF_TEXTRECORD in libming v0.4.8 allows attackers to cause a denial of service via a crafted SWF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-28T00:00:00.000Z
CVE-2024-24155 
Bento4 v1.5.1-628 contains a Memory leak on AP4_Movie::AP4_Movie, parsing tracks and added into m_Tracks list, but mp42aac cannot correctly delete when we got an no audio track found error. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted mp4 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-28T00:00:00.000Z
CVE-2024-24156 
Cross Site Scripting (XSS) vulnerability in Gnuboard g6 before Github commit 58c737a263ac0c523592fd87ff71b9e3c07d7cf5, allows remote attackers execute arbitrary code via the wr_content parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-16T00:00:00.000Z
CVE-2024-24157 
Gnuboard g6 / https://github.com/gnuboard/g6 commit c2cc1f5069e00491ea48618d957332d90f6d40e4 is vulnerable to Cross Site Scripting (XSS) via board.py.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-09T18:18:38.592Z
CVE-2024-24160 
MRCMS 3.0 contains a Cross-Site Scripting (XSS) vulnerability via /admin/system/saveinfo.do.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-02T00:00:00.000Z
CVE-2024-24161 
MRCMS 3.0 contains an Arbitrary File Read vulnerability in /admin/file/edit.do as the incoming path parameter is not filtered.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-02T00:00:00.000Z
CVE-2024-24186 
Jsish v3.5.0 (commit 42c694c) was discovered to contain a stack-overflow via the component IterGetKeysCallback at /jsish/src/jsiValue.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-07T00:00:00.000Z
CVE-2024-24188 
Jsish v3.5.0 was discovered to contain a heap-buffer-overflow in ./src/jsiUtils.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-07T00:00:00.000Z
CVE-2024-24189 
Jsish v3.5.0 (commit 42c694c) was discovered to contain a use-after-free via the SplitChar at ./src/jsiUtils.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-07T00:00:00.000Z
CVE-2024-24192 
robdns commit d76d2e6 was discovered to contain a heap overflow via the component block->filename at /src/zonefile-insertion.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-06T21:23:15.103Z
CVE-2024-24194 
robdns commit d76d2e6 was discovered to contain a NULL pointer dereference via the item->tokens component at /src/conf-parse.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-06T21:23:49.003Z
CVE-2024-24195 
robdns commit d76d2e6 was discovered to contain a misaligned address at /src/zonefile-insertion.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-06T21:24:21.590Z
CVE-2024-24198 
smartdns commit 54b4dc was discovered to contain a misaligned address at smartdns/src/util.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-06T21:26:31.697Z
CVE-2024-24199 
smartdns commit 54b4dc was discovered to contain a misaligned address at smartdns/src/dns.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-06T21:27:05.388Z
CVE-2024-24202 
An arbitrary file upload vulnerability in /upgrade/control.php of ZenTao Community Edition v18.10, ZenTao Biz v8.10, and ZenTao Max v4.10 allows attackers to execute arbitrary code via uploading a crafted .txt file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-08T00:00:00.000Z
CVE-2024-24213 
Supabase PostgreSQL v15.1 was discovered to contain a SQL injection vulnerability via the component /pg_meta/default/query. NOTE: the vendor's position is that this is an intended feature; also, it exists in the Supabase dashboard product, not the Supabase PostgreSQL product. Specifically, /pg_meta/default/query is for SQL queries that are entered in an intended UI by an authorized user. Nothing is injected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-08T00:00:00.000Z
CVE-2024-24215 
An issue in the component /cgi-bin/GetJsonValue.cgi of Cellinx NVT Web Server 5.0.0.014 allows attackers to leak configuration information via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-08T00:00:00.000Z
CVE-2024-24216 
Zentao v18.0 to v18.10 was discovered to contain a remote code execution (RCE) vulnerability via the checkConnection method of /app/zentao/module/repo/model.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-08T00:00:00.000Z
CVE-2024-24230 
Komm.One CMS 10.4.2.14 has a Server-Side Template Injection (SSTI) vulnerability via the Velocity template engine. It allows remote attackers to execute arbitrary code via a URL that specifies java.lang.Runtime in conjunction with getRuntime().exec followed by an OS command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-18T00:00:00.000Z
CVE-2024-24245 
An issue in Canimaan Software LTD ClamXAV v3.1.2 through v3.6.1 and fixed in v.3.6.2 allows a local attacker to escalate privileges via the ClamXAV helper tool component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-09T00:00:00.000Z
CVE-2024-24246 
Heap Buffer Overflow vulnerability in qpdf 11.9.0 allows attackers to crash the application via the std::__shared_count() function at /bits/shared_ptr_base.h.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-29T00:00:00.000Z
CVE-2024-24254 
PX4 Autopilot 1.14 and earlier, due to the lack of synchronization mechanism for loading geofence data, has a Race Condition vulnerability in the geofence.cpp and mission_feasibility_checker.cpp. This will result in the drone uploading overlapping geofences and mission routes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-06T00:00:00.000Z
CVE-2024-24255 
A Race Condition discovered in geofence.cpp and mission_feasibility_checker.cpp in PX4 Autopilot 1.14 and earlier allows attackers to send drones on unintended missions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-06T00:00:00.000Z
CVE-2024-24256 
SQL Injection vulnerability in Yonyou space-time enterprise information integration platform v.9.0 and before allows an attacker to obtain sensitive information via the gwbhAIM parameter in the saveMove.jsp in the hr_position directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-15T00:00:00.000Z
CVE-2024-24257 
An issue in skteco.com Central Control Attendance Machine web management platform v.3.0 allows an attacker to obtain sensitive information via a crafted script to the csl/user component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-26T00:00:00.000Z
CVE-2024-24258 
freeglut 3.4.0 was discovered to contain a memory leak via the menuEntry variable in the glutAddSubMenu function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-05T00:00:00.000Z
CVE-2024-24259 
freeglut through 3.4.0 was discovered to contain a memory leak via the menuEntry variable in the glutAddMenuEntry function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-05T00:00:00.000Z
CVE-2024-24260 
media-server v1.0.0 was discovered to contain a Use-After-Free (UAF) vulnerability via the sip_subscribe_remove function at /uac/sip-uac-subscribe.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-05T00:00:00.000Z
CVE-2024-24262 
media-server v1.0.0 was discovered to contain a Use-After-Free (UAF) vulnerability via the sip_uac_stop_timer function at /uac/sip-uac-transaction.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-05T00:00:00.000Z
CVE-2024-24263 
Lotos WebServer v0.1.1 was discovered to contain a Use-After-Free (UAF) vulnerability via the response_append_status_line function at /lotos/src/response.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-05T00:00:00.000Z
CVE-2024-24265 
gpac v2.2.1 was discovered to contain a memory leak via the dst_props variable in the gf_filter_pid_merge_properties_internal function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-05T00:00:00.000Z
CVE-2024-24266 
gpac v2.2.1 was discovered to contain a Use-After-Free (UAF) vulnerability via the dasher_configure_pid function at /src/filters/dasher.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-05T00:00:00.000Z
CVE-2024-24267 
gpac v2.2.1 (fixed in v2.4.0) was discovered to contain a memory leak via the gfio_blob variable in the gf_fileio_from_blob function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-05T00:00:00.000Z
CVE-2024-24272 
An issue in iTop DualSafe Password Manager & Digital Vault before 1.4.24 allows a local attacker to obtain sensitive information via leaked credentials as plaintext in a log file that can be accessed by the local user without knowledge of the master secret.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-21T00:00:00.000Z
CVE-2024-24275 
Cross Site Scripting vulnerability in Teamwire Windows desktop client v.2.0.1 through v.2.4.0 allows a remote attacker to obtain sensitive information via a crafted payload to the global search function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-05T00:00:00.000Z
CVE-2024-24276 
Cross Site Scripting (XSS) vulnerability in Teamwire Windows desktop client v.2.0.1 through v.2.4.0 allows a remote attacker to obtain sensitive information via a crafted payload to the chat name, message preview, username and group name components.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-05T00:00:00.000Z
CVE-2024-24278 
An issue in Teamwire Windows desktop client v.2.0.1 through v.2.4.0 allows a remote attacker to obtain sensitive information via a crafted payload to the message function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-05T00:00:00.000Z
CVE-2024-24279 
An issue in secdiskapp 1.5.1 (management program for NewQ Fingerprint Encryption Super Speed Flash Disk) allows attackers to gain escalated privileges via vsVerifyPassword and vsSetFingerPrintPower functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-08T00:00:00.000Z
CVE-2024-24291 
An issue in the component /member/index/login of yzmcms v7.0 allows attackers to direct users to malicious sites via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-06T00:00:00.000Z
CVE-2024-24292 
A Prototype Pollution issue in Aliconnect /sdk v.0.0.6 allows an attacker to execute arbitrary code via the aim function in the aim.js component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-28T00:00:00.000Z
CVE-2024-24293 
A Prototype Pollution issue in MiguelCastillo @bit/loader v.10.0.3 allows an attacker to execute arbitrary code via the M function e argument in index.js.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-20T17:26:31.851Z
CVE-2024-24294 
A Prototype Pollution issue in Blackprint @blackprint/engine v.0.9.0 allows an attacker to execute arbitrary code via the _utils.setDeepProperty function of engine.min.js.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-20T16:25:50.992Z
CVE-2024-24300 
4ipnet EAP-767 v3.42.00 is vulnerable to Incorrect Access Control. The device uses the same set of credentials, regardless of how many times a user logs in, the content of the cookie remains unchanged.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-14T00:00:00.000Z
CVE-2024-24301 
Command Injection vulnerability discovered in 4ipnet EAP-767 device v3.42.00 within the web interface of the device allows attackers with valid credentials to inject arbitrary shell commands to be executed by the device with root privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-14T00:00:00.000Z
CVE-2024-24302 
An issue was discovered in Tunis Soft "Product Designer" (productdesigner) module for PrestaShop before version 1.178.36, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via the postProcess() method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-03T00:00:00.000Z
CVE-2024-24303 
SQL Injection vulnerability in HiPresta "Gift Wrapping Pro" (hiadvancedgiftwrapping) module for PrestaShop before version 1.4.1, allows remote attackers to escalate privileges and obtain sensitive information via the HiAdvancedGiftWrappingGiftWrappingModuleFrontController::addGiftWrappingCartValue() method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-07T00:00:00.000Z
CVE-2024-24304 
In the module "Mailjet" (mailjet) from Mailjet for PrestaShop before versions 3.5.1, a guest can download technical information without restriction.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-07T00:00:00.000Z
CVE-2024-24307 
Path Traversal vulnerability in Tunis Soft "Product Designer" (productdesigner) module for PrestaShop before version 1.178.36, allows a remote attacker to escalate privileges and obtain sensitive information via the ajaxProcessCropImage() method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-03T00:00:00.000Z
CVE-2024-24308 
SQL Injection vulnerability in Boostmyshop (boostmyshopagent) module for Prestashop versions 1.1.9 and before, allows remote attackers to escalate privileges and obtain sensitive information via changeOrderCarrier.php, relayPoint.php, and shippingConfirmation.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-09T00:00:00.000Z
CVE-2024-24309 
In the module "Survey TMA" (ecomiz_survey_tma) up to version 2.0.0 from Ecomiz for PrestaShop, a guest can download personal information without restriction.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-23T00:00:00.000Z
CVE-2024-24310 
In the module "Generate barcode on invoice / delivery slip" (ecgeneratebarcode) from Ether Creation <= 1.2.0 for PrestaShop, a guest can perform SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-23T00:00:00.000Z
CVE-2024-24311 
Path Traversal vulnerability in Linea Grafica "Multilingual and Multistore Sitemap Pro - SEO" (lgsitemaps) module for PrestaShop before version 1.6.6, a guest can download personal information without restriction.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-07T00:00:00.000Z
CVE-2024-24312 
SQL injection vulnerability in Vaales Technologies V_QRS v.2024-01-17 allows a remote attacker to obtain sensitive information via the Models/UserModel.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-01T00:00:00.000Z
CVE-2024-24313 
An issue in Vaales Technologies V_QRS v.2024-01-17 allows a remote attacker to obtain sensitive information via the Models/FormModel.php and QRModel.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-01T00:00:00.000Z