rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-38858 
Buffer Overflow vulnerability infaad2 v.2.10.1 allows a remote attacker to execute arbitrary code and cause a denial of service via the mp4info function in mp4read.c:1039.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-15T00:00:00.000Z
CVE-2023-38860 
An issue in LangChain v.0.0.231 allows a remote attacker to execute arbitrary code via the prompt parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-15T00:00:00.000Z
CVE-2023-38861 
An issue in Wavlink WL_WNJ575A3 v.R75A3_V1410_220513 allows a remote attacker to execute arbitrary code via username parameter of the set_sys_adm function in adm.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-15T00:00:00.000Z
CVE-2023-38862 
An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the destination parameter of sub_431F64 function in bin/webmgnt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-15T00:00:00.000Z
CVE-2023-38863 
An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the ifname and mac parameters in the sub_410074 function at bin/webmgnt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-15T00:00:00.000Z
CVE-2023-38864 
An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the protal_delete_picname parameter in the sub_41171C function at bin/webmgnt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-15T00:00:00.000Z
CVE-2023-38865 
COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub_4143F0. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter timestr.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-15T00:00:00.000Z
CVE-2023-38866 
COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub_415588. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter interface and display_name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-15T00:00:00.000Z
CVE-2023-38870 
A SQL injection vulnerability exists in gugoan Economizzer commit 3730880 (April 2023) and v.0.9-beta1. The cash book has a feature to list accomplishments by category, and the 'category_id' parameter is vulnerable to SQL Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-28T00:00:00.000Z
CVE-2023-38871 
The commit 3730880 (April 2023) and v.0.9-beta1 of gugoan Economizzer has a user enumeration vulnerability in the login and forgot password functionalities. The app reacts differently when a user or email address is valid, and when it's not. This may allow an attacker to determine whether a user or email address is valid, or brute force valid usernames and email addresses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-28T00:00:00.000Z
CVE-2023-38872 
An Insecure Direct Object Reference (IDOR) vulnerability in gugoan Economizzer commit 3730880 (April 2023) and v.0.9-beta1 allows any unauthenticated attacker to access cash book entry attachments of any other user, if they know the Id of the attachment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-28T00:00:00.000Z
CVE-2023-38873 
The commit 3730880 (April 2023) and v.0.9-beta1 of gugoan Economizzer is vulnerable to Clickjacking. Clickjacking, also known as a "UI redress attack", is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they were intending to click on the top-level page. Thus, the attacker is "hijacking" clicks meant for their page and routing them to another page, most likely owned by another application, domain, or both.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-28T00:00:00.000Z
CVE-2023-38874 
A remote code execution (RCE) vulnerability via an insecure file upload exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 (April 2023). A malicious attacker can upload a PHP web shell as an attachment when adding a new cash book entry. Afterwards, the attacker may visit the web shell and execute arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-28T00:00:00.000Z
CVE-2023-38875 
A reflected cross-site scripting (XSS) vulnerability in msaad1999's PHP-Login-System 2.0.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'validator' parameter in '/reset-password'.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-20T00:00:00.000Z
CVE-2023-38876 
A reflected cross-site scripting (XSS) vulnerability in msaad1999's PHP-Login-System 2.0.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'selector' parameter in '/reset-password'.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-20T00:00:00.000Z
CVE-2023-38877 
A host header injection vulnerability exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 (April 2023). By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server and thus leak the password reset token. This allows an attacker to reset other users' passwords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-28T00:00:00.000Z
CVE-2023-38878 
A reflected cross-site scripting (XSS) vulnerability in DevCode OpenSTAManager versions 2.4.24 to 2.4.47 may allow a remote attacker to execute arbitrary JavaScript in the web browser of a victim by injecting a malicious payload into the 'error' and 'error_description' parameters of 'oauth2.php'.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-11T00:00:00.000Z
CVE-2023-38879 
The Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to read arbitrary files via a directory traversal vulnerability in the 'filename' parameter of 'DownloadWindow.php'.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-20T00:00:00.000Z
CVE-2023-38880 
The Community Edition version 9.0 of OS4ED's openSIS Classic has a broken access control vulnerability in the database backup functionality. Whenever an admin generates a database backup, the backup is stored in the web root while the file name has a format of "opensisBackup<date>.sql" (e.g. "opensisBackup07-20-2023.sql"), i.e. can easily be guessed. This file can be accessed by any unauthenticated actor and contains a dump of the whole database including password hashes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-20T00:00:00.000Z
CVE-2023-38881 
A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into any of the 'calendar_id', 'school_date', 'month' or 'year' parameters in 'CalendarModal.php'.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-20T00:00:00.000Z
CVE-2023-38882 
A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'include' parameter in 'ForExport.php'
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-20T00:00:00.000Z
CVE-2023-38883 
A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'ajax' parameter in 'ParentLookup.php'.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-20T00:00:00.000Z
CVE-2023-38884 
An Insecure Direct Object Reference (IDOR) vulnerability in the Community Edition version 9.0 of openSIS Classic allows an unauthenticated remote attacker to access any student's files by visiting '/assets/studentfiles/<studentId>-<filename>'
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-20T00:00:00.000Z
CVE-2023-38885 
OpenSIS Classic Community Edition version 9.0 lacks cross-site request forgery (CSRF) protection throughout the whole app. This may allow an attacker to trick an authenticated user into performing any kind of state changing request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-20T00:00:00.000Z
CVE-2023-38886 
An issue in Dolibarr ERP CRM v.17.0.1 and before allows a remote privileged attacker to execute arbitrary code via a crafted command/script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-20T00:00:00.000Z
CVE-2023-38887 
File Upload vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to execute arbitrary code and obtain sensitive information via the extension filtering and renaming functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-20T00:00:00.000Z
CVE-2023-38888 
Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the REST API module, related to analyseVarsForSqlAndScriptsInjection and testSqlAndScriptInject.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-20T00:00:00.000Z
CVE-2023-38889 
An issue in Alluxio v.2.9.3 and before allows an attacker to execute arbitrary code via a crafted script to the username parameter of lluxio.util.CommonUtils.getUnixGroups(java.lang.String).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-15T00:00:00.000Z
CVE-2023-38890 
Online Shopping Portal Project 3.1 allows remote attackers to execute arbitrary SQL commands/queries via the login form, leading to unauthorized access and potential data manipulation. This vulnerability arises due to insufficient validation of user-supplied input in the username field, enabling SQL Injection attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-18T00:00:00.000Z
CVE-2023-38891 
SQL injection vulnerability in Vtiger CRM v.7.5.0 allows a remote authenticated attacker to escalate privileges via the getQueryColumnsList function in ReportRun.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-14T00:00:00.000Z
CVE-2023-38894 
A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code via the extend function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-16T00:00:00.000Z
CVE-2023-38896 
An issue in Harrison Chase langchain v.0.0.194 and before allows a remote attacker to execute arbitrary code via the from_math_prompt and from_colored_object_prompt functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-15T00:00:00.000Z
CVE-2023-38898 
An issue in Python cpython v.3.7 allows an attacker to obtain sensitive information via the _asyncio._swap_current_task component. NOTE: this is disputed by the vendor because (1) neither 3.7 nor any other release is affected (it is a bug in some 3.12 pre-releases); (2) there are no common scenarios in which an adversary can call _asyncio._swap_current_task but does not already have the ability to call arbitrary functions; and (3) there are no common scenarios in which sensitive information, which is not already accessible to an adversary, becomes accessible through this bug.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-15T00:00:00.000Z
CVE-2023-38899 
SQL injection vulnerability in berkaygediz O_Blog v.1.0 allows a local attacker to escalate privileges via the secure_file_priv component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-21T00:00:00.000Z
CVE-2023-38902 
A command injection vulnerability in RG-EW series home routers and repeaters v.EW_3.0(1)B11P219, RG-NBS and RG-S1930 series switches v.SWITCH_3.0(1)B11P219, RG-EG series business VPN routers v.EG_3.0(1)B11P219, EAP and RAP series wireless access points v.AP_3.0(1)B11P219, and NBC series wireless controllers v.AC_3.0(1)B11P219 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /cgi-bin/luci/api/cmd via the remoteIp field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-17T00:00:00.000Z
CVE-2023-38904 
A Cross Site Scripting (XSS) vulnerability in Netlify CMS v.2.10.192 allows a remote attacker to execute arbitrary code via a crafted payload to the body parameter of the new post function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-16T00:00:00.000Z
CVE-2023-38905 
SQL injection vulnerability in Jeecg-boot v.3.5.0 and before allows a local attacker to cause a denial of service via the Benchmark, PG_Sleep, DBMS_Lock.Sleep, Waitfor, DECODE, and DBMS_PIPE.RECEIVE_MESSAGE functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-17T00:00:00.000Z
CVE-2023-38906 
An issue in TPLink Smart Bulb Tapo series L530 1.1.9, L510E 1.0.8, L630 1.0.3, P100 1.4.9, Smart Camera Tapo series C200 1.1.18, and Tapo Application 2.8.14 allows a remote attacker to obtain sensitive information via the authentication code for the UDP message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-21T00:00:00.000Z
CVE-2023-38907 
An issue in TPLink Smart Bulb Tapo series L530 before 1.2.4, L510E before 1.1.0, L630 before 1.0.4, P100 before 1.5.0, and Tapo Application 2.8.14 allows a remote attacker to replay old messages encrypted with a still valid session key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-25T00:00:00.000Z
CVE-2023-38908 
An issue in TPLink Smart Bulb Tapo series L530 before 1.2.4, L510E before 1.1.0, L630 before 1.0.4, P100 before 1.5.0, and Tapo Application 2.8.14 allows a remote attacker to obtain sensitive information via the TSKEP authentication function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-22T00:00:00.000Z
CVE-2023-38909 
An issue in TPLink Smart Bulb Tapo series L530 before 1.2.4, L510E before 1.1.0, L630 before 1.0.4, P100 before 1.5.0, and Tapo Application 2.8.14 allows a remote attacker to obtain sensitive information via the IV component in the AES128-CBC function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-22T00:00:00.000Z
CVE-2023-38910 
CSZ CMS 1.3.0 is vulnerable to cross-site scripting (XSS), which allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered in the 'Carousel Wiget' section and choosing our carousel widget created above, in 'Photo URL' and 'YouTube URL' plugin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-18T00:00:00.000Z
CVE-2023-38911 
A Cross-Site Scripting (XSS) vulnerability in CSZ CMS 1.3.0 allows attackers to execute arbitrary code via a crafted payload to the Gallery parameter in the YouTube URL fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-18T00:00:00.000Z
CVE-2023-38912 
SQL injection vulnerability in Super Store Finder PHP Script v.3.6 allows a remote attacker to execute arbitrary code via a crafted payload to the username parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-14T00:00:00.000Z
CVE-2023-38913 
SQL injection vulnerability in anirbandutta9 NEWS-BUZZ v.1.0 allows a remote attacker to execute arbitrary code via a crafted script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-15T00:00:00.000Z
CVE-2023-38915 
File Upload vulnerability in Wolf-leo EasyAdmin8 v.1.0 allows a remote attacker to execute arbtirary code via the upload type function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-15T00:00:00.000Z
CVE-2023-38916 
SQL Injection vulnerability in eVotingSystem-PHP v.1.0 allows a remote attacker to execute arbitrary code and obtain sensitive information via the user input fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-15T00:00:00.000Z
CVE-2023-38920 
Cross Site Scripting vulnerability in Cyber Cafe Management System v.1.0 allows a local attacker to execute arbitrary code via a crafted script to the adminname parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-13T00:00:00.000Z
CVE-2023-38921 
Netgear WG302v2 v5.2.9 and WAG302v2 v5.1.19 were discovered to contain multiple command injection vulnerabilities in the upgrade_handler function via the firmwareRestore and firmwareServerip parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-07T00:00:00.000Z
CVE-2023-38922 
Netgear JWNR2000v2 v1.0.0.11, XWN5001 v0.4.1.1, and XAVN2001v2 v0.4.0.7 were discovered to contain multiple buffer overflows via the http_passwd and http_username parameters in the update_auth function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-07T00:00:00.000Z
CVE-2023-38924 
Netgear DGN3500 1.1.00.37 was discovered to contain a buffer overflow via the http_password parameter at setup.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-07T00:00:00.000Z
CVE-2023-38925 
Netgear DC112A 1.0.0.64, EX6200 1.0.3.94 and R6300v2 1.0.4.8 were discovered to contain a buffer overflow via the http_passwd parameter in password.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-07T00:00:00.000Z
CVE-2023-38926 
Netgear EX6200 v1.0.3.94 was discovered to contain a buffer overflow via the wla_temp_ssid parameter at acosNvramConfig_set.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-07T00:00:00.000Z
CVE-2023-38928 
Netgear R7100LG 1.0.0.78 was discovered to contain a command injection vulnerability via the password parameter at usb_remote_invite.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-07T00:00:00.000Z
CVE-2023-38929 
Tenda 4G300 v1.01.42 was discovered to contain a stack overflow via the page parameter at /VirtualSer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-07T00:00:00.000Z
CVE-2023-38930 
Tenda AC7 V1.0,V15.03.06.44, F1203 V2.0.1.6, AC5 V1.0,V15.03.06.28, AC9 V3.0,V15.03.06.42_multi and FH1205 V2.0.0.7(775) were discovered to contain a stack overflow via the deviceId parameter in the addWifiMacFilter function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-07T00:00:00.000Z
CVE-2023-38931 
Tenda AC10 V1.0 V15.03.06.23, AC1206 V15.03.06.23, AC8 v4 V16.03.34.06, AC6 V2.0 V15.03.06.23, AC7 V1.0 V15.03.06.44, F1203 V2.0.1.6, AC5 V1.0 V15.03.06.28, AC10 v4.0 V16.03.10.13 and FH1203 V2.0.1.6 were discovered to contain a stack overflow via the list parameter in the setaccount function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-07T00:00:00.000Z
CVE-2023-38932 
Tenda F1202 V1.2.0.9, PA202 V1.1.2.5, PW201A V1.1.2.5 and FH1202 V1.2.0.9 were discovered to contain a stack overflow via the page parameter in the SafeEmailFilter function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-07T00:00:00.000Z
CVE-2023-38933 
Tenda AC6 V2.0 V15.03.06.23, AC7 V1.0 V15.03.06.44, F1203 V2.0.1.6, AC5 V1.0 V15.03.06.28, FH1203 V2.0.1.6 and AC9 V3.0 V15.03.06.42_multi, and FH1205 V2.0.0.7(775) were discovered to contain a stack overflow via the deviceId parameter in the formSetClientState function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-07T00:00:00.000Z
CVE-2023-38934 
Tenda F1203 V2.0.1.6, FH1203 V2.0.1.6 and FH1205 V2.0.0.7(775) was discovered to contain a stack overflow via the deviceId parameter in the formSetDeviceName function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-07T00:00:00.000Z
CVE-2023-38935 
Tenda AC1206 V15.03.06.23, AC8 V4 V16.03.34.06, AC5 V1.0 V15.03.06.28, AC10 v4.0 V16.03.10.13 and AC9 V3.0 V15.03.06.42_multi were discovered to contain a tack overflow via the list parameter in the formSetQosBand function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-07T00:00:00.000Z
CVE-2023-38936 
Tenda AC10 V1.0 V15.03.06.23, AC1206 V15.03.06.23, AC6 V2.0 V15.03.06.23, AC7 V1.0 V15.03.06.44, AC5 V1.0 V15.03.06.28, FH1203 V2.0.1.6, AC9 V3.0 V15.03.06.42_multi and FH1205 V2.0.0.7(775) were discovered to contain a stack overflow via the speed_dir parameter in the formSetSpeedWan function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-07T00:00:00.000Z
CVE-2023-38937 
Tenda AC10 V1.0 V15.03.06.23, AC1206 V15.03.06.23, AC8 v4 V16.03.34.06, AC6 V2.0 V15.03.06.23, AC7 V1.0 V15.03.06.44, AC5 V1.0 V15.03.06.28, AC9 V3.0 V15.03.06.42_multi and AC10 v4.0 V16.03.10.13 were discovered to contain a stack overflow via the list parameter in the formSetVirtualSer function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-07T00:00:00.000Z
CVE-2023-38938 
Tenda F1202 V1.2.0.9, PA202 V1.1.2.5, PW201A V1.1.2.5 and FH1202 V1.2.0.9 were discovered to contain a stack overflow via the page parameter at /L7Im.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-07T00:00:00.000Z
CVE-2023-38939 
Tenda F1202 V1.2.0.9 and FH1202 V1.2.0.9 were discovered to contain a stack overflow via the mit_ssid parameter in the formWrlsafeset function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-07T00:00:00.000Z
CVE-2023-38940 
Tenda F1203 V2.0.1.6, FH1203 V2.0.1.6 and FH1205 V2.0.0.7(775) were discovered to contain a stack overflow via the ssid parameter in the form_fast_setting_wifi_set function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-07T00:00:00.000Z
CVE-2023-38941 
django-sspanel v2022.2.2 was discovered to contain a remote command execution (RCE) vulnerability via the component sspanel/admin_view.py -> GoodsCreateView._post.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-03T00:00:00.000Z
CVE-2023-38942 
Dango-Translator v4.5.5 was discovered to contain a remote command execution (RCE) vulnerability via the component app/config/cloud_config.json.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-03T00:00:00.000Z
CVE-2023-38943 
ShuiZe_0x727 v1.0 was discovered to contain a remote command execution (RCE) vulnerability via the component /iniFile/config.ini.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-05T00:00:00.000Z