rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-0255 WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via icon_color
The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wprm-recipe-text-share' shortcode in all versions up to, and including, 9.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: brechtvds
product: WP Recipe Maker
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: wesley
Published: 2024-02-05T21:21:44.818Z
CVE-2024-0256 Starbox <= 3.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Display Name and Social Settings
The Starbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Profile Display Name and Social Settings in all versions up to, and including, 3.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: cifi
product: Starbox – the Author Box for Humans
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Lucio Sá
Published: 2024-02-07T04:31:24.549Z
CVE-2024-0257 RoboDK Heap-based Buffer Overflow

RoboDK v5.5.4

 is vulnerable to heap-based buffer overflow while processing a specific project file. The resulting memory corruption may crash the application.


Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: RoboDK
product: RoboDK
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: Hank Chen, while working with TXOne Networks, reported this vulnerability to CISA.
Published: 2024-04-17T19:53:36.328Z
CVE-2024-0258 
The issue was addressed with improved memory handling. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, watchOS 10.4. An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges.
Problem types: description: An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
vendor: Apple
product: watchOS
Published: 2024-03-08T01:36:10.920Z
CVE-2024-0259 Privilege Escalation in Robot Schedule Enterprise Agent for Windows prior to version 3.04
Fortra's Robot Schedule Enterprise Agent for Windows prior to version 3.04 is susceptible to privilege escalation. A low-privileged user can overwrite the service executable. When the service is restarted, the replaced binary runs with local system privileges, allowing a low-privileged user to gain elevated privileges.


Problem types: cwe_id: CWE-276
description: CWE-276 Incorrect Default Permissions
Affected products: vendor: Fortra
product: Robot Schedule Enterprise Agent
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Travis Dotseth, Prime Therapeutics
Published: 2024-03-28T14:31:07.986Z
CVE-2024-0260 SourceCodester Engineers Online Portal Password Change change_password_teacher.php session expiration
A vulnerability, which was classified as problematic, was found in SourceCodester Engineers Online Portal 1.0. Affected is an unknown function of the file change_password_teacher.php of the component Password Change. The manipulation leads to session expiration. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249816.
Problem types: cwe_id: CWE-613
description: CWE-613 Session Expiration
Affected products: vendor: SourceCodester
product: Engineers Online Portal
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
baseSeverity: MEDIUM
Credits: lang: en
value: ahmed8199 (VulDB User)
Published: 2024-01-07T00:00:07.682Z
CVE-2024-0261 Sentex FTPDMIN RNFR Command denial of service
A vulnerability has been found in Sentex FTPDMIN 0.96 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component RNFR Command Handler. The manipulation leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249817 was assigned to this vulnerability.
Problem types: cwe_id: CWE-404
description: CWE-404 Denial of Service
Affected products: vendor: Sentex
product: FTPDMIN
CVSS v3.1: version: 3.1
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: fernando.mengali (VulDB User)
Published: 2024-01-07T01:31:03.748Z
CVE-2024-0262 Online Job Portal Create News Page News.php cross site scripting
A vulnerability was found in Online Job Portal 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /Admin/News.php of the component Create News Page. The manipulation of the argument News with the input </title><scRipt>alert(0x00C57D)</scRipt> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249818 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: n/a
product: Online Job Portal
CVSS v3.1: version: 3.1
baseScore: 2.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: ahmed8199 (VulDB User)
Published: 2024-01-07T02:00:05.187Z
CVE-2024-0263 ACME Ultra Mini HTTPd HTTP GET Request denial of service
A vulnerability was found in ACME Ultra Mini HTTPd 1.21. It has been classified as problematic. This affects an unknown part of the component HTTP GET Request Handler. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-249819.
Problem types: cwe_id: CWE-404
description: CWE-404 Denial of Service
Affected products: vendor: ACME
product: Ultra Mini HTTPd
CVSS v3.1: version: 3.1
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: fernando.mengali (VulDB User)
Published: 2024-01-07T03:31:03.968Z
CVE-2024-0264 SourceCodester Clinic Queuing System LoginRegistration.php authorization
A vulnerability was found in SourceCodester Clinic Queuing System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /LoginRegistration.php. The manipulation of the argument formToken leads to authorization bypass. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249820.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass
Affected products: vendor: SourceCodester
product: Clinic Queuing System
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: Echidonut (VulDB User)
Published: 2024-01-07T04:31:03.572Z
CVE-2024-0265 SourceCodester Clinic Queuing System GET Parameter index.php file inclusion
A vulnerability was found in SourceCodester Clinic Queuing System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /index.php of the component GET Parameter Handler. The manipulation of the argument page leads to file inclusion. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249821 was assigned to this vulnerability.
Problem types: cwe_id: CWE-73
description: CWE-73 File Inclusion
Affected products: vendor: SourceCodester
product: Clinic Queuing System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: Echidonut (VulDB User)
Published: 2024-01-07T05:00:04.362Z
CVE-2024-0266 Project Worlds Online Lawyer Management System User Registration cross site scripting
A vulnerability classified as problematic has been found in Project Worlds Online Lawyer Management System 1.0. Affected is an unknown function of the component User Registration. The manipulation of the argument First Name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249822 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: Project Worlds
product: Online Lawyer Management System
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
baseSeverity: MEDIUM
Credits: lang: en
value: Harikrishnan (VulDB User)
Published: 2024-01-07T05:31:03.312Z
CVE-2024-0267 Kashipara Hospital Management System Parameter login.php sql injection
A vulnerability classified as critical was found in Kashipara Hospital Management System up to 1.0. Affected by this vulnerability is an unknown functionality of the file login.php of the component Parameter Handler. The manipulation of the argument email/password leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249823.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Kashipara
product: Hospital Management System
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: SSL_Seven_Security Lab_WangZhiQiang_XiaoZiLong (VulDB User)
Published: 2024-01-07T06:00:06.814Z
CVE-2024-0268 Kashipara Hospital Management System registration.php sql injection
A vulnerability, which was classified as critical, has been found in Kashipara Hospital Management System up to 1.0. Affected by this issue is some unknown functionality of the file registration.php. The manipulation of the argument name/email/pass/gender/age/city leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249824.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Kashipara
product: Hospital Management System
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: SSL_Seven_Security Lab_WangZhiQiang_XiaoZiLong (VulDB User)
Published: 2024-01-07T07:31:04.120Z
CVE-2024-0269 SQL Injection
ManageEngine ADAudit Plus versions 7270 and below are vulnerable to the Authenticated SQL injection in File-Summary DrillDown. This issue has been fixed and released in version 7271.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: ManageEngine
product: ADAudit Plus
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Published: 2024-02-02T13:05:35.762Z
CVE-2024-0270 Kashipara Food Management System item_list_submit.php sql injection
A vulnerability, which was classified as critical, was found in Kashipara Food Management System up to 1.0. This affects an unknown part of the file item_list_submit.php. The manipulation of the argument item_name leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249825 was assigned to this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Kashipara
product: Food Management System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: SSL_Seven_Security Lab_WangZhiQiang_XiaoZiLong (VulDB User)
Published: 2024-01-07T08:00:04.999Z
CVE-2024-0271 Kashipara Food Management System addmaterial_edit.php sql injection
A vulnerability has been found in Kashipara Food Management System up to 1.0 and classified as critical. This vulnerability affects unknown code of the file addmaterial_edit.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-249826 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Kashipara
product: Food Management System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: SSL_Seven_Security Lab_WangZhiQiang_XiaoZiLong (VulDB User)
Published: 2024-01-07T08:31:03.929Z
CVE-2024-0272 Kashipara Food Management System addmaterialsubmit.php sql injection
A vulnerability was found in Kashipara Food Management System up to 1.0 and classified as critical. This issue affects some unknown processing of the file addmaterialsubmit.php. The manipulation of the argument material_name leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249827.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Kashipara
product: Food Management System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: SSL_Seven_Security Lab_WangZhiQiang_XiaoZiLong (VulDB User)
Published: 2024-01-07T10:31:03.624Z
CVE-2024-0273 Kashipara Food Management System addwaste_entry.php sql injection
A vulnerability was found in Kashipara Food Management System up to 1.0. It has been classified as critical. Affected is an unknown function of the file addwaste_entry.php. The manipulation of the argument item_name leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249828.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Kashipara
product: Food Management System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: SSL_Seven_Security Lab_WangZhiQiang_XiaoZiLong (VulDB User)
Published: 2024-01-07T11:00:05.780Z
CVE-2024-0274 Kashipara Food Management System billAjax.php sql injection
A vulnerability was found in Kashipara Food Management System up to 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file billAjax.php. The manipulation of the argument item_name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249829 was assigned to this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Kashipara
product: Food Management System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: SSL_Seven_Security Lab_WangZhiQiang_XiaoZiLong (VulDB User)
Published: 2024-01-07T11:31:03.585Z
CVE-2024-0275 Kashipara Food Management System item_edit_submit.php sql injection
A vulnerability was found in Kashipara Food Management System up to 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file item_edit_submit.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249830 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Kashipara
product: Food Management System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: SSL_Seven_Security Lab_WangZhiQiang_XiaoZiLong (VulDB User)
Published: 2024-01-07T12:00:05.191Z
CVE-2024-0276 Kashipara Food Management System rawstock_used_damaged_smt.php sql injection
A vulnerability classified as critical has been found in Kashipara Food Management System up to 1.0. This affects an unknown part of the file rawstock_used_damaged_smt.php. The manipulation of the argument product_name leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249831.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Kashipara
product: Food Management System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: SSL_Seven_Security Lab_WangZhiQiang_XiaoZiLong (VulDB User)
Published: 2024-01-07T12:31:04.048Z
CVE-2024-0277 Kashipara Food Management System party_submit.php sql injection
A vulnerability classified as critical was found in Kashipara Food Management System up to 1.0. This vulnerability affects unknown code of the file party_submit.php. The manipulation of the argument party_name leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249832.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Kashipara
product: Food Management System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: SSL_Seven_Security Lab_WangZhiQiang_XiaoZiLong (VulDB User)
Published: 2024-01-07T13:00:05.458Z
CVE-2024-0278 Kashipara Food Management System partylist_edit_submit.php sql injection
A vulnerability, which was classified as critical, has been found in Kashipara Food Management System up to 1.0. This issue affects some unknown processing of the file partylist_edit_submit.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249833 was assigned to this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Kashipara
product: Food Management System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: SSL_Seven_Security Lab_WangZhiQiang_XiaoZiLong (VulDB User)
Published: 2024-01-07T13:31:03.800Z
CVE-2024-0279 Kashipara Food Management System item_list_edit.php sql injection
A vulnerability, which was classified as critical, was found in Kashipara Food Management System up to 1.0. Affected is an unknown function of the file item_list_edit.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249834 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Kashipara
product: Food Management System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: SSL_Seven_Security Lab_WangZhiQiang_XiaoZiLong (VulDB User)
Published: 2024-01-07T14:00:04.215Z
CVE-2024-0280 Kashipara Food Management System item_type_submit.php sql injection
A vulnerability has been found in Kashipara Food Management System up to 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file item_type_submit.php. The manipulation of the argument type_name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249835.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Kashipara
product: Food Management System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: SSL_Seven_Security Lab_WangZhiQiang_XiaoZiLong (VulDB User)
Published: 2024-01-07T14:31:03.462Z
CVE-2024-0281 Kashipara Food Management System loginCheck.php sql injection
A vulnerability was found in Kashipara Food Management System up to 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file loginCheck.php. The manipulation of the argument password leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249836.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Kashipara
product: Food Management System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: SSL_Seven_Security Lab_WangZhiQiang_XiaoZiLong (VulDB User)
Published: 2024-01-07T15:00:06.256Z
CVE-2024-0282 Kashipara Food Management System addmaterialsubmit.php cross site scripting
A vulnerability was found in Kashipara Food Management System up to 1.0. It has been classified as problematic. This affects an unknown part of the file addmaterialsubmit.php. The manipulation of the argument tin leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249837 was assigned to this vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: Kashipara
product: Food Management System
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: SSL_Seven_Security Lab_WangZhiQiang_XiaoZiLong (VulDB User)
Published: 2024-01-07T15:31:03.431Z