rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-48654 
Cross Site Scripting vulnerability in Blood Bank v.1 allows a remote attacker to execute arbitrary code via a crafted script to the login.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-25T00:00:00.000Z
CVE-2024-48655 
An issue in Total.js CMS v.1.0 allows a remote attacker to execute arbitrary code via the func.js file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-25T00:00:00.000Z
CVE-2024-48656 
Cross Site Scripting vulnerability in student management system in php with source code v.1.0.0 allows a remote attacker to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-22T00:00:00.000Z
CVE-2024-48657 
SQL Injection vulnerability in hospital management system in php with source code v.1.0.0 allows a remote attacker to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-22T00:00:00.000Z
CVE-2024-48659 
An issue in DCME-320-L <=9.3.2.114 allows a remote attacker to execute arbitrary code via the log_u_umount.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-21T00:00:00.000Z
CVE-2024-48662 
Cross Site Scripting vulnerability in AdGuard Application v.7.18.1 (4778) and before allows an attacker to execute arbitrary code via a crafted payload to the fontMatrix component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-27T00:00:00.000Z
CVE-2024-48694 
File Upload vulnerability in Xi'an Daxi Information technology OfficeWeb365 v.8.6.1.0 and v7.18.23.0 allows a remote attacker to execute arbitrary code via the pw/savedraw component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-19T00:00:00.000Z
CVE-2024-48700 
Kliqqi-CMS has a background arbitrary code execution vulnerability that attackers can exploit to implant backdoors or getShell via the edit_page.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-25T00:00:00.000Z
CVE-2024-48702 
PHPGurukul Old Age Home Management System v1.0 is vulnerable to HTML Injection via the searchdata parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-23T00:00:00.000Z
CVE-2024-48703 
PhpGurukul Medical Card Generation System v1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/search-medicalcard.php via the searchdata parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-06T00:00:00.000Z
CVE-2024-48704 
Phpgurukul Medical Card Generation System v1.0 is vulnerable to HTML Injection in admin/contactus.php via the parameter pagedes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-23T00:00:00.000Z
CVE-2024-48705 
Wavlink AC1200 with firmware versions M32A3_V1410_230602 and M32A3_V1410_240222 are vulnerable to a post-authentication command injection while resetting the password. This vulnerability is specifically found within the "set_sys_adm" function of the "adm.cgi" binary, and is due to improper santization of the user provided "newpass" field
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-02T00:00:00.000Z
CVE-2024-48706 
Collabtive 3.1 is vulnerable to Cross-site scripting (XSS) via the title parameter with action=add or action=editform within the (a) managemessage.php file and (b) managetask.php file respectively.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-22T00:00:00.000Z
CVE-2024-48707 
Collabtive 3.1 is vulnerable to Cross-site scripting (XSS) via the name parameter under (a) action=add or action=edit within managemilestone.php file and (b) action=addpro within admin.php file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-22T00:00:00.000Z
CVE-2024-48708 
Collabtive 3.1 is vulnerable to Cross-Site Scripting (XSS) via the name parameter in (a) file tasklist.php under action = add/edit and in (b) file admin.php under action = adduser/edituser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-22T00:00:00.000Z
CVE-2024-48709 
CodeAstro Membership Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via the membershipType parameter in edit_type.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-21T00:00:00.000Z
CVE-2024-48710 
In TP-Link TL-WDR7660 1.0, the wlanTimerRuleJsonToBin function handles the parameter string name without checking it, which can lead to stack overflow vulnerabilities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-15T00:00:00.000Z
CVE-2024-48712 
In TP-Link TL-WDR7660 1.0, the rtRuleJsonToBin function handles the parameter string name without checking it, which can lead to stack overflow vulnerabilities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-15T00:00:00.000Z
CVE-2024-48713 
In TP-Link TL-WDR7660 1.0, the wacWhitelistJsonToBin function handles the parameter string name without checking it, which can lead to stack overflow vulnerabilities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-15T00:00:00.000Z
CVE-2024-48714 
In TP-Link TL-WDR7660 v1.0, the guestRuleJsonToBin function handles the parameter string name without checking it, which can lead to stack overflow vulnerabilities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-15T00:00:00.000Z
CVE-2024-48729 
An issue in ETSI Open-Source MANO (OSM) 14.0.x before 14.0.3, 15.0.x before 15.0.2, 16.0.0, and 17.0.0 allows a remote authenticated attacker to escalate privileges via the /osm/admin/v1/users component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-25T00:00:00.000Z
CVE-2024-48730 
The default configuration in ETSI Open-Source MANO (OSM) v.14.x, v.15.x, v.16.x, v.17.x does not impose any restrictions on the authentication attempts performed by the default admin user, allowing a remote attacker to escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-25T00:00:00.000Z
CVE-2024-48733 
SQL injection vulnerability in /SASStudio/sasexec/sessions/{sessionID}/sql in SAS Studio 9.4 allows remote attacker to execute arbitrary SQL commands via the POST body request. NOTE: this is disputed by the vendor because SQL statement execution is allowed for authorized users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-30T00:00:00.000Z
CVE-2024-48734 
Unrestricted file upload in /SASStudio/SASStudio/sasexec/{sessionID}/{InternalPath} in SAS Studio 9.4 allows remote attacker to upload malicious files. NOTE: this is disputed by the vendor because file upload is allowed for authorized users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-30T00:00:00.000Z
CVE-2024-48735 
Directory Traversal in /SASStudio/sasexec/sessions/{sessionID}/workspace/{InternalPath} in SAS Studio 9.4 allows remote attacker to access internal files by manipulating default path during file download. NOTE: this is disputed by the vendor because these filesystem paths are allowed for authorized users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-30T00:00:00.000Z
CVE-2024-48743 
Cross Site Scripting vulnerability in Sentry v.6.0.9 allows a remote attacker to execute arbitrary code via the z parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-25T00:00:00.000Z
CVE-2024-48744 
A Reflected Cross Site Scripting (XSS) vulnerability was found in /trms/listed- teachers.php in PHPGurukul Teachers Record Management System v2.1, which allows remote attackers to execute arbitrary code via "searchinput" POST request parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-16T00:00:00.000Z
CVE-2024-48746 
An issue in Lens Visual integration with Power BI v.4.0.0.3 allows a remote attacker to execute arbitrary code via the Natural language processing component
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-05T00:00:00.000Z
CVE-2024-48747 
An issue in alist-tvbox v1.7.1 allows a remote attacker to execute arbitrary code via the /atv-cli file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-21T00:00:00.000Z
CVE-2024-48758 
dingfanzu CMS V1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the addPro parameter of the component doAdminAction.php which allows a remote attacker to execute arbitrary code
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-16T00:00:00.000Z
CVE-2024-48760 
An issue in GestioIP v3.5.7 allows a remote attacker to execute arbitrary code via the file upload function. The attacker can upload a malicious perlcmd.cgi file that overwrites the original upload.cgi file, enabling remote command execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-14T00:00:00.000Z
CVE-2024-48761 
Reflected XSS vulnerability in Celk Sistemas Celk Saude v.3.1.252.1 allows a remote attacker to inject arbitrary JavaScript code via the "erro" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-29T00:00:00.000Z
CVE-2024-48766 
NetAlertX 24.7.18 before 24.10.12 allows unauthenticated file reading because an HTTP client can ignore a redirect, and because of factors related to strpos and directory traversal, as exploited in the wild in May 2025. This is related to components/logs.php.
Problem types: cwe_id: CWE-698
description: CWE-698 Execution After Redirect (EAR)
Affected products: vendor: NetAlertX
product: NetAlertX
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 8.6
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Published: 2025-05-13T00:00:00.000Z
CVE-2024-48768 
An issue in almaodo GmbH appinventor.ai_google.almando_control 2.3.1 allows a remote attacker to obtain sensitive information via the firmware update process
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-11T00:00:00.000Z
CVE-2024-48769 
An issue in BURG-WCHTER KG de.burgwachter.keyapp.app 4.5.0 allows a remote attacker to obtain sensitve information via the firmware update process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-11T00:00:00.000Z
CVE-2024-48770 
An issue in Plug n Play Camera com.wisdomcity.zwave 1.1.0 allows a remote attacker to obtain sensitive information via the firmware update process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-11T00:00:00.000Z
CVE-2024-48771 
An issue in almando GmbH Almando Play APP (com.almando.play) 1.8.2 allows a remote attacker to obtain sensitive information via the firmware update process
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-11T00:00:00.000Z
CVE-2024-48772 
An issue in C-CHIP (com.cchip.cchipamaota) v.1.2.8 allows a remote attacker to obtain sensitive information via the firmware update process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-11T00:00:00.000Z
CVE-2024-48773 
An issue in WoFit v.7.2.3 allows a remote attacker to obtain sensitive information via the firmware update process
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-11T00:00:00.000Z
CVE-2024-48774 
An issue in Fermax Asia Pacific Pte Ltd com.fermax.vida 2.4.6 allows a remote attacker to obtain sensitve information via the firmware update process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-11T00:00:00.000Z
CVE-2024-48775 
An issue in Plug n Play Camera com.ezset.delaney 1.2.0 allows a remote attacker to obtain sensitive information via the firmware update process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-11T00:00:00.000Z
CVE-2024-48776 
An issue in Shelly com.home.shelly 1.0.4 allows a remote attacker to obtain sensitive information via the firmware update process
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-11T00:00:00.000Z
CVE-2024-48777 
LEDVANCE com.ledvance.smartplus.eu 2.1.10 allows a remote attacker to obtain sensitive information via the firmware update process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-11T00:00:00.000Z
CVE-2024-48778 
An issue in GIANT MANUFACTURING CO., LTD RideLink (tw.giant.ridelink) 2.0.7 allows a remote attacker to obtain sensitive information via the firmware update process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-11T00:00:00.000Z
CVE-2024-48779 
An issue in Wanxing Technology's Yitu project Management Software 3.2.2 allows a remote attacker to execute arbitrary code via the platformpluginpath parameter to specify that the qt plugin loads the directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-15T00:00:00.000Z
CVE-2024-48781 
An issue in Wanxing Technology Yitu Project Management Kirin Edition 2.3.6 allows a remote attacker to execute arbitrary code via a specially constructed so file/opt/EdrawProj-2/plugins/imageformat.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-15T00:00:00.000Z
CVE-2024-48782 
File Upload vulnerability in DYCMS Open-Source Version v2.0.9.41 allows a remote attacker to execute arbitrary code via the application only detecting the extension of image files in the front-end.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-15T00:00:00.000Z
CVE-2024-48783 
An issue in Ruijie NBR3000D-E Gateway allows a remote attacker to obtain sensitive information via the /tool/shell/postgresql.conf component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-15T00:00:00.000Z
CVE-2024-48784 
An Incorrect Access Control issue in SAMPMAX com.sampmax.homemax 2.1.2.7 allows a remote attacker to obtain sensitive information via the firmware update process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-11T00:00:00.000Z
CVE-2024-48786 
An issue in SWITCHBOT INC SwitchBot (com.theswitchbot.switchbot) 5.0.4 allows a remote attacker to obtain sensitive information via the firmware update process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-11T00:00:00.000Z
CVE-2024-48787 
An issue in Revic Optics Revic Ops (us.revic.revicops) 1.12.5 allows a remote attacker to obtain sensitive information via the firmware update process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-11T00:00:00.000Z
CVE-2024-48788 
An issue in YESCAM (com.yescom.YesCam.zwave) 1.0.2 allows a remote attacker to obtain sensitive information via the firmware update process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-11T00:00:00.000Z
CVE-2024-48789 
An issue in INATRONIC com.inatronic.drivedeck.home 2.6.23 allows a remote attacker to obtain sensitve information via the firmware update process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-14T00:00:00.000Z
CVE-2024-48790 
An issue in ILIFE com.ilife.home.global 1.8.7 allows a remote attacker to obtain sensitive information via the firmware update process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-14T00:00:00.000Z
CVE-2024-48791 
An issue in Plug n Play Camera com.starvedia.mCamView.zwave 5.5.1 allows a remote attacker to obtain sensitive information via the firmware update process
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-14T00:00:00.000Z
CVE-2024-48792 
An issue in Hideez com.hideez 2.7.8.3 allows a remote attacker to obtain sensitive information via the firmware update process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-14T00:00:00.000Z
CVE-2024-48793 
An issue in INATRONIC com.inatronic.bmw 2.7.1 allows a remote attacker to obtain sensitive information via the firmware update process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-14T00:00:00.000Z
CVE-2024-48795 
An issue in Creative Labs Pte Ltd com.creative.apps.xficonnect 2.00.02 allows a remote attacker to obtain sensitive information via the firmware update process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-14T00:00:00.000Z
CVE-2024-48796 
An issue in EQUES com.eques.plug 1.0.1 allows a remote attacker to obtain sensitive information via the firmware update process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-14T00:00:00.000Z
CVE-2024-48797 
An issue in PCS Engineering Preston Cinema (com.prestoncinema.app) 0.2.0 allows a remote attacker to obtain sensitive information via the firmware update process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-14T00:00:00.000Z
CVE-2024-48798 
An issue in Hubble Connected (com.hubbleconnected.vervelife) 2.00.81 allows a remote attacker to obtain sensitive information via the firmware update process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-14T00:00:00.000Z
CVE-2024-48799 
An issue in LOREX TECHNOLOGY INC com.lorexcorp.lorexping 1.4.22 allows a remote attacker to obtain sensitive information via the firmware update process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-14T00:00:00.000Z
CVE-2024-48806 
Buffer Overflow vulnerability in Neat Board NFC v.1.20240620.0015 allows a physically proximate attackers to escalate privileges via a crafted payload to the password field
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-09T00:00:00.000Z
CVE-2024-48807 
Cross Site Scripting vulnerability in PHPGurukul Doctor Appointment Management System v.1.0 allows a local attacker to execute arbitrary code via the search parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-30T00:00:00.000Z
CVE-2024-48809 
An issue in Open Networking Foundations sdran-in-a-box v.1.4.3 and onos-a1t v.0.2.3 allows a remote attacker to cause a denial of service via the onos-a1t component of the sdran-in-a-box, specifically the DeleteWatcher function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-04T00:00:00.000Z
CVE-2024-48813 
SQL injection vulnerability in employee-management-system-php-and-mysql-free-download.html taskmatic 1.0 allows a remote attacker to execute arbitrary code via the admin_id parameter of the /update-employee.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-11T00:00:00.000Z
CVE-2024-48814 
SQL Injection vulnerability in Silverpeas 6.4.1 allows a remote attacker to obtain sensitive information via the ViewType parameter of the findbywhereclause function
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-03T00:00:00.000Z
CVE-2024-48818 
An issue in IIT Bombay, Mumbai, India Bodhitree of cs101 version allows a remote attacker to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-25T00:00:00.000Z
CVE-2024-48821 
Cross Site Scripting vulnerability in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote attacker to escalate privileges via the FtpConfig.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-14T00:00:00.000Z
CVE-2024-48822 
Privilege escalation in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote attacker to escalate privileges via the FtpConfig.php page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-14T00:00:00.000Z
CVE-2024-48823 
Local file inclusion in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote attacker to escalate privileges via the PassageAutoServer.php page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-14T00:00:00.000Z
CVE-2024-48824 
An issue in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote attacker to obtain sensitive information via the Racine & FileName parameters in the download-file.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-14T00:00:00.000Z
CVE-2024-48825 
Tenda AC7 v.15.03.06.44 ate_ifconfig_set has pre-authentication command injection allowing remote attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-28T00:00:00.000Z
CVE-2024-48826 
Tenda AC7 v.15.03.06.44 ate_iwpriv_set has pre-authentication command injection allowing remote attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-28T00:00:00.000Z
CVE-2024-48827 
An issue in sbondCo Watcharr v.1.43.0 allows a remote attacker to execute arbitrary code and escalate privileges via the Change Password function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-11T00:00:00.000Z
CVE-2024-48828 
Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Improper Privilege Management vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.
Problem types: cwe_id: CWE-269
description: CWE-269: Improper Privilege Management
Affected products: vendor: Dell
product: SmartFabric OS10 Software
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Dell would like to thank n3k from TIANGONG Team of Legendsec at QI-ANXIN Group for reporting this issue.
Published: 2025-03-17T17:10:05.434Z
CVE-2024-48829 
Dell SmartFabric OS10 Software, versions prior to 10.6.1.0, contain an Improper Control of Generation of Code ('Code Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution.
Problem types: cwe_id: CWE-94
description: CWE-94: Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Dell
product: SmartFabric OS10 Software
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Dell would like to thank n3k from TIANGONG Team of Legendsec at QI-ANXIN Group for reporting this issue.
Published: 2025-11-12T19:50:02.934Z