rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-48780 WordPress WP Catalogue Plugin <= 1.7.6 is vulnerable to Cross Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EnigmaWeb WP Catalogue allows Stored XSS.This issue affects WP Catalogue: from n/a through 1.7.6.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: EnigmaWeb
product: WP Catalogue
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Abdi Pranata (Patchstack Alliance)
Published: 2023-12-14T16:57:13.066Z
CVE-2023-48781 WordPress MkRapel Regiones y Ciudades de Chile para WC Plugin <= 4.3.0 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in Marketing Rapel MkRapel Regiones y Ciudades de Chile para WC.This issue affects MkRapel Regiones y Ciudades de Chile para WC: from n/a through 4.3.0.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Marketing Rapel
product: MkRapel Regiones y Ciudades de Chile para WC
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: qilin_99 (Patchstack Alliance)
Published: 2023-12-18T22:05:43.614Z
CVE-2023-48782 
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 allows attacker to execute unauthorized code or commands via specifically crafted http get request parameters
Problem types: cwe_id: CWE-78
description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: FortiWLM
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:X
Published: 2023-12-13T06:37:42.217Z
CVE-2023-48783 
An Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] affecting PortiPortal version 7.2.1 and below, version 7.0.6 and below, version 6.0.14 and below, version 5.3.8 and below may allow a remote authenticated user with at least read-only permissions to access to other organization endpoints via crafted GET requests.
Problem types: cwe_id: CWE-639
description: Improper access control
Affected products: vendor: Fortinet
product: FortiPortal
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:P/RL:X/RC:R
Published: 2024-01-10T17:51:38.440Z
CVE-2023-48784 
A use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.1 and below, version 7.2.7 and below, 7.0 all versions, 6.4 all versions command line interface may allow a local privileged attacker with super-admin profile and CLI access to execute arbitrary code or commands via specially crafted requests.
Problem types: cwe_id: CWE-134
description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: FortiOS
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
Published: 2024-04-09T14:24:24.971Z
CVE-2023-48785 
An improper certificate validation vulnerability [CWE-295] in FortiNAC-F version 7.2.4 and below may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the HTTPS communication channel between the FortiOS device, an inventory, and FortiNAC-F.
Problem types: cwe_id: CWE-295
description: Information disclosure
Affected products: vendor: Fortinet
product: FortiNAC-F
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:X/RC:X
Published: 2025-03-14T15:46:57.799Z
CVE-2023-48786 
A server-side request forgery vulnerability [CWE-918] in Fortinet FortiClientEMS version 7.4.0 through 7.4.2 and before 7.2.6 may allow an authenticated attacker to perform internal requests via crafted HTTP or HTTPS requests.
Problem types: cwe_id: CWE-918
description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: FortiClientEMS
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.1
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C
Published: 2025-06-10T16:36:19.062Z
CVE-2023-48788 
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS 7.0.1 through 7.0.10 allows attacker to execute unauthorized code or commands via specially crafted packets.
Problem types: cwe_id: CWE-89
description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: FortiClientEMS
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.3
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C
Published: 2024-03-12T15:09:18.527Z
CVE-2023-48789 
A client-side enforcement of server-side security in Fortinet FortiPortal version 6.0.0 through 6.0.14 allows attacker to improper access control via crafted HTTP requests.
Problem types: cwe_id: CWE-602
description: Improper access control
Affected products: vendor: Fortinet
product: FortiPortal
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:X
Published: 2024-06-03T07:57:22.756Z
CVE-2023-48790 
A cross site request forgery vulnerability [CWE-352] in Fortinet FortiNDR version 7.4.0, 7.2.0 through 7.2.1 and 7.1.0 through 7.1.1 and before 7.0.5 may allow a remote unauthenticated attacker to execute unauthorized actions via crafted HTTP GET requests.
Problem types: cwe_id: CWE-352
description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: FortiNDR
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:X/RC:X
Published: 2025-03-11T14:54:31.599Z
CVE-2023-48791 
An improper neutralization of special elements used in a command ('Command Injection') vulnerability [CWE-77] in FortiPortal version 7.2.0, version 7.0.6 and below may allow a remote authenticated attacker with at least R/W permission to execute unauthorized commands via specifically crafted arguments in the Schedule System Backup page field.
Problem types: cwe_id: CWE-77
description: Improper access control
Affected products: vendor: Fortinet
product: FortiPortal
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.9
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Published: 2023-12-13T06:45:22.196Z
CVE-2023-48792 
Zoho ManageEngine ADAudit Plus through 7250 is vulnerable to SQL Injection in the report export option.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-02T00:00:00.000Z
CVE-2023-48793 
Zoho ManageEngine ADAudit Plus through 7250 allows SQL Injection in the aggregate report feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-02T00:00:00.000Z
CVE-2023-48795 
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-18T00:00:00.000Z
CVE-2023-48796 Apache dolphinscheduler sensitive information disclosure
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.

The information exposed to unauthorized actors may include sensitive data such as database credentials.

Users who can't upgrade to the fixed version can also set environment variable `MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus` to workaround this, or add the following section in the `application.yaml` file

```
management:
  endpoints:
    web:
      exposure:
        include: health,metrics,prometheus
```

This issue affects Apache DolphinScheduler: from 3.0.0 before 3.0.2.

Users are recommended to upgrade to version 3.0.2, which fixes the issue.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Apache Software Foundation
product: Apache DolphinScheduler
default_status: unaffected
Published: 2023-11-24T07:56:43.542Z
CVE-2023-48799 
TOTOLINK-X6000R Firmware-V9.4.0cu.852_B20230719 is vulnerable to Command Execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-04T00:00:00.000Z
CVE-2023-48800 
In TOTOLINK X6000R_Firmware V9.4.0cu.852_B20230719, the shttpd file sub_417338 function obtains fields from the front-end, connects them through the snprintf function, and passes them to the CsteSystem function, resulting in a command execution vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-04T00:00:00.000Z
CVE-2023-48801 
In TOTOLINK X6000R_Firmware V9.4.0cu.852_B20230719, the shttpd file sub_415534 function obtains fields from the front-end, connects them through the snprintf function, and passes them to the CsteSystem function, resulting in a command execution vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-01T00:00:00.000Z
CVE-2023-48802 
In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-30T00:00:00.000Z
CVE-2023-48803 
In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-30T00:00:00.000Z
CVE-2023-48804 
In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-30T00:00:00.000Z
CVE-2023-48805 
In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-30T00:00:00.000Z
CVE-2023-48806 
In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-30T00:00:00.000Z
CVE-2023-48807 
In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-30T00:00:00.000Z
CVE-2023-48808 
In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-30T00:00:00.000Z
CVE-2023-48810 
In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-30T00:00:00.000Z
CVE-2023-48811 
In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function that when passed to the CsteSystem function creates a command execution vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-30T00:00:00.000Z
CVE-2023-48812 
In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function that when passed to the CsteSystem function creates a command execution vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-30T00:00:00.000Z
CVE-2023-48813 
Senayan Library Management Systems (Slims) 9 Bulian v9.6.1 is vulnerable to SQL Injection via admin/modules/reporting/customs/fines_report.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-01T00:00:00.000Z
CVE-2023-48815 
kkFileView v4.3.0 is vulnerable to Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-04T00:00:00.000Z
CVE-2023-48823 
A Blind SQL injection issue in ajax.php in GaatiTrack Courier Management System 1.0 allows an unauthenticated attacker to inject a payload via the email parameter during login.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-07T00:00:00.000Z
CVE-2023-48824 
BoidCMS 2.0.1 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the title, subtitle, footer, or keywords parameter in a page=create action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-07T00:00:00.000Z
CVE-2023-48825 
Availability Booking Calendar 5.0 is vulnerable to Multiple HTML Injection issues via SMS API Key or Default Country Code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-07T00:00:00.000Z
CVE-2023-48826 
Time Slots Booking Calendar 4.0 is vulnerable to CSV Injection via the unique ID field of the Reservations List.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-07T00:00:00.000Z
CVE-2023-48827 
Time Slots Booking Calendar 4.0 is vulnerable to Multiple HTML Injection issues via the name, plugin_sms_api_key, plugin_sms_country_code, calendar_id, title, country name, or customer_name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-07T00:00:00.000Z
CVE-2023-48828 
Time Slots Booking Calendar 4.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the name, plugin_sms_api_key, plugin_sms_country_code, calendar_id, title, country name, or customer_name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-07T00:00:00.000Z
CVE-2023-48830 
Shuttle Booking Software 2.0 is vulnerable to CSV Injection in the Languages section via an export.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-07T00:00:00.000Z
CVE-2023-48831 
A lack of rate limiting in pjActionAJaxSend in Availability Booking Calendar 5.0 allows attackers to cause resource exhaustion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-07T00:00:00.000Z
CVE-2023-48833 
A lack of rate limiting in pjActionAJaxSend in Time Slots Booking Calendar 4.0 allows attackers to cause resource exhaustion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-07T00:00:00.000Z
CVE-2023-48834 
A lack of rate limiting in pjActionAjaxSend in Car Rental v3.0 allows attackers to cause resource exhaustion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-07T00:00:00.000Z
CVE-2023-48835 
Car Rental Script v3.0 is vulnerable to CSV Injection via a Language > Labels > Export action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-07T00:00:00.000Z
CVE-2023-48836 
Car Rental Script 3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the name, plugin_sms_api_key, plugin_sms_country_code, calendar_id, title, country name, or customer_name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-07T00:00:00.000Z
CVE-2023-48837 
Car Rental Script 3.0 is vulnerable to Multiple HTML Injection issues via SMS API Key or Default Country Code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-07T00:00:00.000Z
CVE-2023-48838 
Appointment Scheduler 3.0 is vulnerable to Multiple HTML Injection issues via the SMS API Key or Default Country Code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-07T00:00:00.000Z
CVE-2023-48839 
Appointment Scheduler 3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the name, plugin_sms_api_key, plugin_sms_country_code, calendar_id, title, country name, or customer_name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-07T00:00:00.000Z
CVE-2023-48840 
A lack of rate limiting in pjActionAjaxSend in Appointment Scheduler 3.0 allows attackers to cause resource exhaustion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-07T00:00:00.000Z
CVE-2023-48841 
Appointment Scheduler 3.0 is vulnerable to CSV Injection via a Language > Labels > Export action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-07T00:00:00.000Z
CVE-2023-48842 
D-Link Go-RT-AC750 revA_v101b03 was discovered to contain a command injection vulnerability via the service parameter at hedwig.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-01T00:00:00.000Z
CVE-2023-48848 
An arbitrary file read vulnerability in ureport v2.2.9 allows a remote attacker to arbitrarily read files on the server by inserting a crafted path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-28T00:00:00.000Z
CVE-2023-48849 
Ruijie EG Series Routers version EG_3.0(1)B11P216 and before allows unauthenticated attackers to remotely execute arbitrary code due to incorrect filtering.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-06T00:00:00.000Z
CVE-2023-48858 
A Cross-site scripting (XSS) vulnerability in login page php code in Armex ABO.CMS 5.9 allows remote attackers to inject arbitrary web script or HTML via the login.php? URL part.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-17T00:00:00.000Z
CVE-2023-48859 
TOTOLINK A3002RU version 2.0.0-B20190902.1958 has a post-authentication RCE due to incorrect access control, allows attackers to bypass front-end security restrictions and execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-06T00:00:00.000Z
CVE-2023-48860 
TOTOLINK N300RT version 3.2.4-B20180730.0906 has a post-authentication RCE due to incorrect access control, allows attackers can bypass front-end security restrictions and execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-07T00:00:00.000Z
CVE-2023-48861 
DLL hijacking vulnerability in TTplayer version 7.0.2, allows local attackers to escalate privileges and execute arbitrary code via urlmon.dll.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-07T00:00:00.000Z