rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-25148 
In Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions the `doAsUserId` URL parameter may get leaked when creating linked content using the WYSIWYG editor and while impersonating a user. This may allow remote authenticated users to impersonate a user after accessing the linked content.
Problem types: cwe_id: CWE-201
description: CWE-201: Insertion of Sensitive Information Into Sent Data
Affected products: vendor: Liferay
product: Portal
default_status: unknown
vendor: Liferay
product: DXP
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Published: 2024-02-08T03:43:14.148Z
CVE-2024-25149 
Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not properly restrict membership of a child site when the "Limit membership to members of the parent site" option is enabled, which allows remote authenticated users to add users who are not a member of the parent site to a child site. The added user may obtain permission to perform unauthorized actions in the child site.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Liferay
product: Portal
default_status: unknown
vendor: Liferay
product: DXP
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Published: 2024-02-20T07:00:19.650Z
CVE-2024-25150 
Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions allows remote authenticated users to obtain a user's full name from the page's title by enumerating user screen names.
Problem types: cwe_id: CWE-201
description: CWE-201 Insertion of Sensitive Information Into Sent Data
Affected products: vendor: Liferay
product: Portal
default_status: unknown
vendor: Liferay
product: DXP
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Sahil Mehra
Published: 2024-02-20T08:11:28.312Z
CVE-2024-25151 
The Calendar module in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not escape user supplied data in the default notification email template, which allows remote authenticated users to inject arbitrary web script or HTML via the title of a calendar event or the user's name. This may lead to a content spoofing or cross-site scripting (XSS) attacks depending on the capability of the receiver's mail client.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Liferay
product: Portal
default_status: unknown
vendor: Liferay
product: DXP
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2024-02-21T03:17:37.167Z
CVE-2024-25152 
Stored cross-site scripting (XSS) vulnerability in Message Board widget in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via the filename of an attachment.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Liferay
product: Portal
default_status: unknown
vendor: Liferay
product: DXP
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2024-02-21T02:00:32.694Z
CVE-2024-25153 Remote Code Execution in FileCatalyst Workflow 5.x prior to 5.1.6 Build 114
A directory traversal within the ‘ftpservlet’ of the FileCatalyst Workflow Web Portal allows files to be uploaded outside of the intended ‘uploadtemp’ directory with a specially crafted POST request. In situations where a file is successfully uploaded to web portal’s DocumentRoot, specially crafted JSP files could be used to execute code, including web shells.
Problem types: cwe_id: CWE-472
description: CWE-472 External Control of Assumed-Immutable Web Parameter
Affected products: vendor: Fortra
product: FileCatalyst
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Tom Wedgbury, LRQA Nettitude
Published: 2024-03-13T14:10:36.029Z
CVE-2024-25154 Path Traversal in FileCatalyst Direct 3.8.8 and Earlier
Improper URL validation leads to path traversal in FileCatalyst Direct 3.8.8 and earlier allowing an encoded payload to cause the web server to return files located outside of the web root which may lead to data leakage.  
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Fortra
product: FileCatalyst
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2024-03-13T14:13:56.214Z
CVE-2024-25155 Reflected Cross-Site Scripting (XSS) in FileCatalyst Direct 3.8.8 and earlier
In FileCatalyst Direct 3.8.8 and earlier through 3.8.6, the web server does not properly sanitize illegal characters in a URL which is then displayed on a subsequent error page. A malicious actor could craft a URL which would then execute arbitrary code within an HTML script tag. 
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Fortra
product: FileCatalyst
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
version: 3.1
Published: 2024-03-13T14:15:54.156Z
CVE-2024-25156 Path traversal in GoAnywhere MFT 7.4.1 and Earlier

A path traversal vulnerability exists in GoAnywhere MFT prior to 7.4.2 which allows attackers to circumvent endpoint-specific permission checks in the GoAnywhere Admin and Web Clients.


Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Fortra
product: GoAnywhere MFT
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Mohammed Eldeeb & Islam Elrfai, Spark Engineering Consultants
lang: en
value: vcth4nh from VcsLab of Viettel Cyber Security
Published: 2024-03-14T14:06:01.498Z
CVE-2024-25157 Authentication bypass in GoAnywhere MFT prior to 7.6.0
An authentication bypass vulnerability in GoAnywhere MFT prior to 7.6.0 allows Admin Users with access to the Agent Console to circumvent some permission checks when attempting to visit other pages. This could lead to unauthorized information disclosure or modification.
Problem types: cwe_id: CWE-303
description: CWE-303: Incorrect Implementation of Authentication Algorithm
Affected products: vendor: Fortra
product: GoAnywhere MFT
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Published: 2024-08-14T15:04:10.987Z
CVE-2024-25164 
iA Path Traversal vulnerability exists in iDURAR v2.0.0, that allows unauthenticated attackers to expose sensitive files via the download functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-04T00:00:00.000Z
CVE-2024-25165 
A global-buffer-overflow vulnerability was found in SWFTools v0.9.2, in the function LineText at lib/swf5compiler.flex.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-14T00:00:00.000Z
CVE-2024-25166 
Cross Site Scripting vulnerability in 71CMS v.1.0.0 allows a remote attacker to execute arbitrary code via the uploadfile action parameter in the controller.php file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-27T00:00:00.000Z
CVE-2024-25167 
Cross Site Scripting vulnerability in eblog v1.0 allows a remote attacker to execute arbitrary code via a crafted script to the argument description parameter when submitting a comment on a post.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-29T00:00:00.000Z
CVE-2024-25168 
SQL injection vulnerability in snow snow v.2.0.0 allows a remote attacker to execute arbitrary code via the dataScope parameter of the system/role/list interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-22T00:00:00.000Z
CVE-2024-25169 
An issue in Mezzanine v6.0.0 allows attackers to bypass access control mechanisms in the admin panel via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-28T00:00:00.000Z
CVE-2024-25170 
An issue in Mezzanine v6.0.0 allows attackers to bypass access controls via manipulating the Host header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-28T00:00:00.000Z
CVE-2024-25175 
An issue in Kickdler before v1.107.0 allows attackers to provide an XSS payload via a HTTP response splitting attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-25T00:00:00.000Z
CVE-2024-25176 
LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240626 have a stack-buffer-overflow in lj_strfmt_wfnum in lj_strfmt_num.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-07T00:00:00.000Z
CVE-2024-25177 
LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an unsinking of IR_FSTORE for NULL metatable, which leads to Denial of Service (DoS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-07T00:00:00.000Z
CVE-2024-25178 
LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an out-of-bounds read in the stack-overflow handler in lj_state.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-07T00:00:00.000Z
CVE-2024-25180 
An issue discovered in pdfmake 0.2.9 allows remote attackers to run arbitrary code via crafted POST request to the /pdf endpoint. NOTE: this is disputed because the behavior of the /pdf endpoint is intentional. The /pdf endpoint is only available after installing a test framework (that lives outside of the pdfmake applicaton). Anyone installing this is responsible for ensuring that it is only available to authorized testers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-29T00:00:00.000Z
CVE-2024-25181 
A critical vulnerability has been identified in givanz VvvebJs 1.7.2, which allows both Server-Side Request Forgery (SSRF) and arbitrary file reading. The vulnerability stems from improper handling of user-supplied URLs in the "file_get_contents" function within the "save.php" file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-29T00:00:00.000Z
CVE-2024-25182 
givanz VvvebJs 1.7.2 suffers from a File Upload vulnerability via save.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-29T00:00:00.000Z
CVE-2024-25183 
givanz VvvebJs 1.7.2 is vulnerable to Directory Traversal via scan.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-29T00:00:00.000Z
CVE-2024-25187 
Server Side Request Forgery (SSRF) vulnerability in 71cms v1.0.0, allows remote unauthenticated attackers to obtain sensitive information via getweather.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-02T00:00:00.000Z
CVE-2024-25189 
libjwt 1.15.3 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-08T00:00:00.000Z
CVE-2024-25190 
l8w8jwt 2.2.1 uses memcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-08T00:00:00.000Z
CVE-2024-25191 
php-jwt 1.0.0 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-08T00:00:00.000Z
CVE-2024-25196 
Open Robotics Robotic Operating Sytstem 2 (ROS2) and Nav2 humble versions were discovered to contain a buffer overflow via the nav2_controller process. This vulnerability is triggerd via sending a crafted .yaml file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-20T00:00:00.000Z
CVE-2024-25197 
Open Robotics Robotic Operating Sytstem 2 (ROS2) and Nav2 humble versions were discovered to contain a NULL pointer dereference via the isCurrent() function at /src/layered_costmap.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-20T00:00:00.000Z
CVE-2024-25198 
Inappropriate pointer order of laser_scan_filter_.reset() and tf_listener_.reset() (amcl_node.cpp) in Open Robotics Robotic Operating Sytstem 2 (ROS2) and Nav2 humble versions leads to a use-after-free.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-20T00:00:00.000Z
CVE-2024-25199 
Inappropriate pointer order of map_sub_ and map_free(map_) (amcl_node.cpp) in Open Robotics Robotic Operating Sytstem 2 (ROS2) and Nav2 humble versions leads to a use-after-free.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-20T00:00:00.000Z
CVE-2024-25200 
Espruino 2v20 (commit fcc9ba4) was discovered to contain a Stack Overflow via the jspeFactorFunctionCall at src/jsparse.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-07T00:00:00.000Z
CVE-2024-25201 
Espruino 2v20 (commit fcc9ba4) was discovered to contain an Out-of-bounds Read via jsvStringIteratorPrintfCallback at src/jsvar.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-07T00:00:00.000Z
CVE-2024-25202 
Cross Site Scripting vulnerability in Phpgurukul User Registration & Login and User Management System 1.0 allows attackers to run arbitrary code via the search bar.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-28T00:00:00.000Z
CVE-2024-25207 
Barangay Population Monitoring System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the Add Resident function at /barangay-population-monitoring-system/masterlist.php. This vulnerabiity allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Contact Number parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-14T00:00:00.000Z
CVE-2024-25208 
Barangay Population Monitoring System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the Add Resident function at /barangay-population-monitoring-system/masterlist.php. This vulnerabiity allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Full Name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-14T00:00:00.000Z
CVE-2024-25209 
Barangay Population Monitoring System 1.0 was discovered to contain a SQL injection vulnerability via the resident parameter at /endpoint/delete-resident.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-14T00:00:00.000Z
CVE-2024-25210 
Simple Expense Tracker v1.0 was discovered to contain a SQL injection vulnerability via the expense parameter at /endpoint/delete_expense.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-14T00:00:00.000Z
CVE-2024-25211 
Simple Expense Tracker v1.0 was discovered to contain a SQL injection vulnerability via the category parameter at /endpoint/delete_category.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-14T00:00:00.000Z
CVE-2024-25212 
Employee Managment System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /delete.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-14T00:00:00.000Z
CVE-2024-25213 
Employee Managment System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /edit.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-14T00:00:00.000Z
CVE-2024-25214 
An issue in Employee Managment System v1.0 allows attackers to bypass authentication via injecting a crafted payload into the E-mail and Password parameters at /alogin.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-14T00:00:00.000Z
CVE-2024-25215 
Employee Managment System v1.0 was discovered to contain a SQL injection vulnerability via the pwd parameter at /aprocess.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-14T00:00:00.000Z
CVE-2024-25216 
Employee Managment System v1.0 was discovered to contain a SQL injection vulnerability via the mailud parameter at /aprocess.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-14T00:00:00.000Z
CVE-2024-25217 
Online Medicine Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /omos/?p=products/view_product.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-14T00:00:00.000Z
CVE-2024-25218 
A cross-site scripting (XSS) vulnerability in Task Manager App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Project Name parameter /TaskManager/Projects.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-14T00:00:00.000Z
CVE-2024-25219 
A cross-site scripting (XSS) vulnerability in Task Manager App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Task Name parameter /TaskManager/Task.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-14T00:00:00.000Z
CVE-2024-25220 
Task Manager App v1.0 was discovered to contain a SQL injection vulnerability via the taskID parameter at /TaskManager/EditTask.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-14T00:00:00.000Z
CVE-2024-25221 
A cross-site scripting (XSS) vulnerability in Task Manager App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Note Section parameter at /TaskManager/Tasks.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-14T00:00:00.000Z
CVE-2024-25222 
Task Manager App v1.0 was discovered to contain a SQL injection vulnerability via the projectID parameter at /TaskManager/EditProject.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-14T00:00:00.000Z
CVE-2024-25223 
Simple Admin Panel App v1.0 was discovered to contain a SQL injection vulnerability via the orderID parameter at /adminView/viewEachOrder.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-14T00:00:00.000Z
CVE-2024-25224 
A cross-site scripting (XSS) vulnerability in Simple Admin Panel App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Size Number parameter under the Add Size function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-14T00:00:00.000Z
CVE-2024-25225 
A cross-site scripting (XSS) vulnerability in Simple Admin Panel App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Category Name parameter under the Add Category function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-14T00:00:00.000Z
CVE-2024-25226 
A cross-site scripting (XSS) vulnerability in Simple Admin Panel App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Category Name parameter under the Add Category function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-14T00:00:00.000Z
CVE-2024-25227 
SQL Injection vulnerability in ABO.CMS version 5.8, allows remote attackers to execute arbitrary code, cause a denial of service (DoS), escalate privileges, and obtain sensitive information via the tb_login parameter in admin login page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-15T00:00:00.000Z
CVE-2024-25228 
Vinchin Backup and Recovery 7.2 and Earlier is vulnerable to Authenticated Remote Code Execution (RCE) via the getVerifydiyResult function in ManoeuvreHandler.class.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-14T00:00:00.000Z