rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-9006 jeanmarc77 123solar config_invt1.php code injection
A vulnerability was found in jeanmarc77 123solar 1.8.4.5. It has been rated as critical. Affected by this issue is some unknown functionality of the file config/config_invt1.php. The manipulation of the argument PASSOx leads to code injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The patch is identified as f4a8c748ec436e5a79f91ccb6a6f73752b336aa5. It is recommended to apply a patch to fix this issue.
Problem types: cwe_id: CWE-94
description: Code Injection
Affected products: vendor: jeanmarc77
product: 123solar
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: hejiasheng (VulDB User)
Published: 2024-09-19T22:31:05.103Z
CVE-2024-9007 jeanmarc77 123solar detailed.php cross site scripting
A vulnerability classified as problematic has been found in jeanmarc77 123solar 1.8.4.5. This affects an unknown part of the file /detailed.php. The manipulation of the argument date1 leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The patch is named 94bf9ab7ad0ccb7fbdc02f172f37f0e2ea08d48f. It is recommended to apply a patch to fix this issue.
Problem types: cwe_id: CWE-79
description: Cross Site Scripting
Affected products: vendor: jeanmarc77
product: 123solar
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: hejiasheng (VulDB User)
Published: 2024-09-19T22:31:07.360Z
CVE-2024-9008 SourceCodester Best Online News Portal Comment Section news-details.php sql injection
A vulnerability classified as critical was found in SourceCodester Best Online News Portal 1.0. This vulnerability affects unknown code of the file /news-details.php of the component Comment Section. The manipulation of the argument name leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
Affected products: vendor: SourceCodester
product: Best Online News Portal
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: guru (VulDB User)
Published: 2024-09-19T23:00:07.887Z
CVE-2024-9009 code-projects Online Quiz Site showtest.php sql injection
A vulnerability, which was classified as critical, has been found in code-projects Online Quiz Site 1.0. This issue affects some unknown processing of the file showtest.php. The manipulation of the argument subid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
Affected products: vendor: code-projects
product: Online Quiz Site
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: TurNA (VulDB User)
Published: 2024-09-19T23:31:04.784Z
CVE-2024-9011 code-projects Crud Operation System updata.php sql injection
A vulnerability, which was classified as critical, was found in code-projects Crud Operation System 1.0. Affected is an unknown function of the file updata.php. The manipulation of the argument sid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
Affected products: vendor: code-projects
product: Crud Operation System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: eternalyzh (VulDB User)
Published: 2024-09-20T00:00:06.610Z
CVE-2024-9014 OAuth2 client id and secret exposed through the web browser in pgAdmin 4
pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.
Affected products: vendor: pgadmin.org
product: pgAdmin 4
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2024-09-23T17:04:00.264Z
CVE-2024-9017 PeepSo Core: Groups <= 6.4.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Group Description
The PeepSo Core: Groups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Group Description field in all versions up to, and including, 6.4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: PeepSo
product: PeepSo Core: Groups
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Bikram Kharal
Published: 2025-07-03T06:44:25.405Z
CVE-2024-9018 WP Easy Gallery <= 4.8.5 - Authenticated (Contributor+) SQL Injection via key Parameter
The WP Easy Gallery – WordPress Gallery Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the ‘key’ parameter in all versions up to, and including, 4.8.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: hahncgdev
product: WP Easy Gallery – WordPress Gallery Plugin
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: Peter Thaleikis
Published: 2024-10-01T08:30:16.968Z
CVE-2024-9019 SecuPress Free — WordPress Security <= 2.2.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via secupress_check_ban_ips_form Shortcode
The SecuPress Free — WordPress Security plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's secupress_check_ban_ips_form shortcode in all versions up to, and including, 2.2.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: secupress
product: SecuPress with Simple SSL – Simple and Performant Security
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Brian Sans-Souci
Published: 2025-02-28T08:23:15.912Z
CVE-2024-9020 List category posts < 0.90.3 - Author+ Stored XSS
The List category posts WordPress plugin before 0.90.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: List category posts
default_status: unaffected
Credits: lang: en
value: Dmitrii Ignatyev
lang: en
value: WPScan
Published: 2025-01-18T06:00:05.173Z
CVE-2024-9021 Relevanssi < 4.23.1 - Contributor+ Stored XSS
In the process of testing the Relevanssi  WordPress plugin before 4.23.1, a vulnerability was found that allows you to implement Stored XSS on behalf of the Contributor+ by embedding malicious script, which entails account takeover backdoor
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Relevanssi
default_status: unaffected
Credits: lang: en
value: Krugov Artyom
lang: en
value: WPScan
Published: 2024-10-08T06:00:05.067Z
CVE-2024-9022 TS Poll – Survey, Versus Poll, Image Poll, Video Poll <= 2.4.0 - Authenticated (Administrator+) SQL Injection via orderby Parameter
The TS Poll – Survey, Versus Poll, Image Poll, Video Poll plugin for WordPress is vulnerable to SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 2.4.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: totalsoft
product: TS Poll – Survey, Versus Poll, Image Poll, Video Poll
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
baseScore: 7.2
baseSeverity: HIGH
Published: 2024-10-10T02:06:11.579Z
CVE-2024-9023 WP-WebAuthn <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wwa_login_form Shortcode
The WP-WebAuthn plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wwa_login_form shortcode in all versions up to, and including, 1.3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: axton
product: WP-WebAuthn
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Peter Thaleikis
Published: 2024-09-28T02:04:26.402Z
CVE-2024-9024 Material Design Icons <= 0.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via mdi-icon Shortcode
The Material Design Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mdi-icon shortcode in all versions up to, and including, 0.0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: braginteractive
product: Material Design Icons
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Brian Sans-Souci
Published: 2024-09-25T02:05:20.456Z
CVE-2024-9025 Sight – Professional Image Gallery and Portfolio <= 1.1.2 - Missing Authorization to Sensitive Information Exposure in handler_post_title
The Sight – Professional Image Gallery and Portfolio plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handler_post_title' function in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to expose private, pending, trashed, and draft post titles. Successful exploitation requires the Elementor plugin to be installed and activated.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: codesupplyco
product: Sight – Professional Image Gallery and Portfolio
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
baseScore: 5.3
baseSeverity: MEDIUM
Credits: lang: en
value: Francesco Carlucci
Published: 2024-09-26T08:29:46.489Z
CVE-2024-9026 PHP-FPM logs from children may be altered
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log message content. Additionally, if PHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability.
Problem types: cwe_id: CWE-158
description: CWE-158: Improper Neutralization of Null Byte or NUL Character
cwe_id: CWE-117
description: CWE-117: Improper Output Neutralization for Logs
Affected products: vendor: PHP Group
product: PHP
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Sébastien Rolland
Published: 2024-10-08T04:07:33.452Z
CVE-2024-9027 WPZOOM Shortcodes <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via box Shortcode
The WPZOOM Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'box' shortcode in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: wpzoom
product: WPZOOM Shortcodes
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Peter Thaleikis
Published: 2024-09-25T02:05:04.117Z
CVE-2024-9028 WP GPX Maps <= 1.7.08 - Authenticated (Contributor+) Stored Cross-Site Scripting via sgpx Shortcode
The WP GPX Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sgpx' shortcode in all versions up to, and including, 1.7.08 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: bastianonm
product: WP GPX Maps
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Peter Thaleikis
Published: 2024-09-25T02:05:18.987Z
CVE-2024-9029 Freeimage: heap buffer overflow in tiff_read_iptc_profile
A flaw was found in the freeimage library. Processing a crafted image can cause a buffer over-read of 1 byte in the read_iptc_profile function in the Source/Metadata/IPTC.cpp file because the size of the profile is not being sanitized, causing a crash in the application linked to the library, resulting in a denial of service.
Problem types: cwe_id: CWE-126
description: Buffer Over-read
Affected products: default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2024-09-27T06:51:07.624Z
CVE-2024-9030 CodeCanyon CRMGo SaaS note cross site scripting
A vulnerability classified as problematic was found in CodeCanyon CRMGo SaaS 7.2. This vulnerability affects unknown code of the file /deal/{note_id}/note. The manipulation of the argument notes leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-79
description: Cross Site Scripting
Affected products: vendor: CodeCanyon
product: CRMGo SaaS
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: Jobyer Ahmed
Published: 2024-09-20T12:00:09.070Z
CVE-2024-9031 CodeCanyon CRMGo SaaS show cross site scripting
A vulnerability, which was classified as problematic, has been found in CodeCanyon CRMGo SaaS up to 7.2. This issue affects some unknown processing of the file /project/task/{task_id}/show. The manipulation of the argument comment leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-79
description: Cross Site Scripting
Affected products: vendor: CodeCanyon
product: CRMGo SaaS
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: Jobyer Ahmed
lang: en
value: suffer (VulDB User)
Published: 2024-09-20T12:00:12.698Z
CVE-2024-9032 SourceCodester Simple Forum-Discussion System index.php path traversal
A vulnerability, which was classified as critical, was found in SourceCodester Simple Forum-Discussion System 1.0. Affected is an unknown function of the file /index.php. The manipulation of the argument page leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-22
description: Path Traversal
Affected products: vendor: SourceCodester
product: Simple Forum-Discussion System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: ShawRoot (VulDB User)
Published: 2024-09-20T13:00:12.813Z
CVE-2024-9033 SourceCodester Best House Rental Management System ajax.php cross site scripting
A vulnerability has been found in SourceCodester Best House Rental Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=save_category. The manipulation of the argument name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-79
description: Cross Site Scripting
Affected products: vendor: SourceCodester
product: Best House Rental Management System
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: webray.com.cn (VulDB User)
Published: 2024-09-20T14:31:05.544Z
CVE-2024-9034 code-projects Patient Record Management System login.php sql injection
A vulnerability was found in code-projects Patient Record Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file login.php. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
Affected products: vendor: code-projects
product: Patient Record Management System
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: keepgoing2077 (VulDB User)
Published: 2024-09-20T15:00:08.438Z
CVE-2024-9035 code-projects Blood Bank Management System Admin Login login.php sql injection
A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/login.php of the component Admin Login. The manipulation of the argument username/password leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
Affected products: vendor: code-projects
product: Blood Bank Management System
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: kinsomnia (VulDB User)
Published: 2024-09-20T15:00:10.306Z
CVE-2024-9036 itsourcecode Online Bookstore admin_add.php unrestricted upload
A vulnerability was found in itsourcecode Online Bookstore 1.0. It has been rated as critical. This issue affects some unknown processing of the file admin_add.php. The manipulation of the argument image leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-434
description: Unrestricted Upload
Affected products: vendor: itsourcecode
product: Online Bookstore
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: kinsomnia (VulDB User)
Published: 2024-09-20T15:31:08.700Z
CVE-2024-9037 Codezips Internal Marks Calculation index.php sql injection
A vulnerability classified as critical has been found in Codezips Internal Marks Calculation 1.0. Affected is an unknown function of the file index.php. The manipulation of the argument tid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
Affected products: vendor: Codezips
product: Internal Marks Calculation
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: N3xu5Cr4ck37 (VulDB User)
Published: 2024-09-20T15:31:11.155Z
CVE-2024-9038 Codezips Online Shopping Portal insert-product.php unrestricted upload
A vulnerability classified as problematic was found in Codezips Online Shopping Portal 1.0. Affected by this vulnerability is an unknown functionality of the file insert-product.php. The manipulation of the argument productimage1/productimage2/productimage3 leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-434
description: Unrestricted Upload
Affected products: vendor: Codezips
product: Online Shopping Portal
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
baseSeverity: MEDIUM
Credits: lang: en
value: N3xu5Cr4ck37 (VulDB User)
Published: 2024-09-20T16:00:06.215Z