rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-42768 
A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Hotel Management System v1.0 via /admin/delete_room.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-22T00:00:00.000Z
CVE-2024-42769 
A Reflected Cross Site Scripting (XSS) vulnerability was found in "/core/signup_user.php " of Kashipara Hotel Management System v1.0, which allows remote attackers to execute arbitrary code via "user_fname" and "user_lname" parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-22T00:00:00.000Z
CVE-2024-42770 
A Stored Cross Site Scripting (XSS) vulnerability was found in "/core/signup_user.php" of Kashipara Hotel Management System v1.0, which allows remote attackers to execute arbitrary code via the "user_email" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-22T00:00:00.000Z
CVE-2024-42771 
A Stored Cross Site Scripting (XSS) vulnerability was found in " /admin/edit_room_controller.php" of the Kashipara Hotel Management System v1.0, which allows remote attackers to execute arbitrary code via "room_name" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-22T00:00:00.000Z
CVE-2024-42772 
An Incorrect Access Control vulnerability was found in /admin/rooms.php in Kashipara Hotel Management System v1.0, which allows an unauthenticated attacker to view valid hotel room entries in administrator section.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-22T00:00:00.000Z
CVE-2024-42773 
An Incorrect Access Control vulnerability was found in /admin/edit_room_controller.php in Kashipara Hotel Management System v1.0, which allows an unauthenticated attacker to edit the valid hotel room entries in the administrator section.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-22T00:00:00.000Z
CVE-2024-42774 
An Incorrect Access Control vulnerability was found in /admin/delete_room.php in Kashipara Hotel Management System v1.0, which allows an unauthenticated attacker to delete valid hotel room entries in the administrator section.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-22T00:00:00.000Z
CVE-2024-42775 
An Incorrect Access Control vulnerability was found in /admin/add_room_controller.php in Kashipara Hotel Management System v1.0, which allows an unauthenticated attacker to add the valid hotel room entries in the administrator section via the direct URL access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-22T00:00:00.000Z
CVE-2024-42776 
Kashipara Hotel Management System v1.0 is vulnerable to Incorrect Access Control via /admin/users.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-22T00:00:00.000Z
CVE-2024-42777 
An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=signup" of Kashipara Music Management System v1.0, which allows attackers to execute arbitrary code via uploading a crafted PHP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-21T00:00:00.000Z
CVE-2024-42778 
An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=save_playlist" in Kashipara Music Management System v1.0. This allows attackers to execute arbitrary code via uploading a crafted PHP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-21T00:00:00.000Z
CVE-2024-42779 
An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=save_music" in Kashipara Music Management System v1.0. This allows attackers to execute arbitrary code via uploading a crafted PHP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-21T00:00:00.000Z
CVE-2024-42780 
An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=save_genre" in Kashipara Music Management System v1.0. This allows attackers to execute arbitrary code via uploading a crafted PHP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-21T00:00:00.000Z
CVE-2024-42781 
A SQL injection vulnerability in "/music/ajax.php?action=login" of Kashipara Music Management System v1.0 allows remote attackers to execute arbitrary SQL commands and bypass Login via the email parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-21T00:00:00.000Z
CVE-2024-42782 
A SQL injection vulnerability in "/music/ajax.php?action=find_music" in Kashipara Music Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "search" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-21T00:00:00.000Z
CVE-2024-42783 
Kashipara Music Management System v1.0 is vulnerable to SQL Injection via /music/manage_playlist_items.php. An attacker can execute arbitrary SQL commands via the "pid" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-21T00:00:00.000Z
CVE-2024-42784 
A SQL injection vulnerability in "/music/controller.php?page=view_music" in Kashipara Music Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "id" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-21T00:00:00.000Z
CVE-2024-42785 
A SQL injection vulnerability in /music/index.php?page=view_playlist in Kashipara Music Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "id" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-21T00:00:00.000Z
CVE-2024-42786 
A SQL injection vulnerability in "/music/view_user.php" in Kashipara Music Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "id" parameter of View User Profile Page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-21T00:00:00.000Z
CVE-2024-42787 
A Stored Cross Site Scripting (XSS) vulnerability was found in "/music/ajax.php?action=save_playlist" in Kashipara Music Management System v1.0. This vulnerability allows remote attackers to execute arbitrary code via "title" & "description" parameter fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-26T00:00:00.000Z
CVE-2024-42788 
A Stored Cross Site Scripting (XSS) vulnerability was found in "/music/ajax.php?action=save_music" in Kashipara Music Management System v1.0. This vulnerability allows remote attackers to execute arbitrary code via "title" & "artist" parameter fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-26T00:00:00.000Z
CVE-2024-42789 
A Reflected Cross Site Scripting (XSS) vulnerability was found in "/music/controller.php?page=test" in Kashipara Music Management System v1.0. This vulnerability allows remote attackers to execute arbitrary code via the "page" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-26T00:00:00.000Z
CVE-2024-42790 
A Reflected Cross Site Scripting (XSS) vulnerability was found in "/music/index.php?page=test" in Kashipara Music Management System v1.0. This vulnerability allows remote attackers to execute arbitrary code via the "page" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-26T00:00:00.000Z
CVE-2024-42791 
A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Music Management System v1.0 via /music/ajax.php?action=delete_genre.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-26T00:00:00.000Z
CVE-2024-42792 
A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Music Management System v1.0 via /music/ajax.php?action=delete_playlist page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-26T00:00:00.000Z
CVE-2024-42793 
A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Music Management System v1.0 via a crafted request to the /music/ajax.php?action=save_user page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-28T00:00:00.000Z
CVE-2024-42794 
Kashipara Music Management System v1.0 is vulnerable to Incorrect Access Control via /music/ajax.php?action=save_user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-16T00:00:00.000Z
CVE-2024-42795 
An Incorrect Access Control vulnerability was found in /music/view_user.php?id=3 and /music/controller.php?page=edit_user&id=3 in Kashipara Music Management System v1.0. This vulnerability allows an unauthenticated attacker to view valid user details.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-16T00:00:00.000Z
CVE-2024-42796 
An Incorrect Access Control vulnerability was found in /music/ajax.php?action=delete_genre in Kashipara Music Management System v1.0. This vulnerability allows an unauthenticated attacker to delete the valid music genre entries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-16T00:00:00.000Z
CVE-2024-42797 
An Incorrect Access Control vulnerability was found in /music/ajax.php?action=delete_playlist in Kashipara Music Management System v1.0. This vulnerability allows an unauthenticated attacker to delete the valid music playlist entries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-24T00:00:00.000Z
CVE-2024-42798 
An Incorrect Access Control vulnerability was found in /music/index.php?page=user_list and /music/index.php?page=edit_user in Kashipara Music Management System v1.0. This allows a low privileged attacker to take over the administrator account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-16T00:00:00.000Z
CVE-2024-42812 
In D-Link DIR-860L v2.03, there is a buffer overflow vulnerability due to the lack of length verification for the SID field in gena.cgi. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-19T00:00:00.000Z
CVE-2024-42813 
In TRENDnet TEW-752DRU FW1.03B01, there is a buffer overflow vulnerability due to the lack of length verification for the service field in gena.cgi. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-19T00:00:00.000Z
CVE-2024-42815 
In the TP-Link RE365 V1_180213, there is a buffer overflow vulnerability due to the lack of length verification for the USER_AGENT field in /usr/bin/httpd. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-19T00:00:00.000Z
CVE-2024-42816 
A cross-site scripting (XSS) vulnerability in the Create Product function of fastapi-admin pro v0.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-26T00:00:00.000Z
CVE-2024-42818 
A cross-site scripting (XSS) vulnerability in the Config-Create function of fastapi-admin pro v0.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-26T00:00:00.000Z
CVE-2024-42831 
A reflected cross-site scripting (XSS) vulnerability in Elaine's Realtime CRM Automation v6.18.17 allows attackers to execute arbitrary JavaScript code in the web browser of a user via injecting a crafted payload into the dialog parameter at wrapper_dialog.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-07T00:00:00.000Z
CVE-2024-42834 
A stored cross-site scripting (XSS) vulnerability in the Create Customer API in Incognito Service Activation Center (SAC) UI v14.11 allows authenticated attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the lastName parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-13T00:00:00.000Z
CVE-2024-42835 
langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-31T00:00:00.000Z
CVE-2024-42843 
Projectworlds Online Examination System v1.0 is vulnerable to SQL Injection via the subject parameter in feed.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-15T00:00:00.000Z
CVE-2024-42844 
A SQL Injection vulnerability has been identified in EPICOR Prophet 21 (P21) up to 23.2.5232. This vulnerability allows authenticated remote attackers to execute arbitrary SQL commands through unsanitized user input fields to obtain unauthorized information
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-06T00:00:00.000Z
CVE-2024-42845 
An eval Injection vulnerability in the component invesalius/reader/dicom.py of InVesalius 3.1.99991 through 3.1.99998 allows attackers to execute arbitrary code via loading a crafted DICOM file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-23T00:00:00.000Z
CVE-2024-42849 
An issue in Silverpeas v.6.4.2 and lower allows a remote attacker to cause a denial of service via the password change function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-16T00:00:00.000Z
CVE-2024-42850 
An issue in the password change function of Silverpeas v6.4.2 and lower allows for the bypassing of password complexity requirements.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-16T00:00:00.000Z
CVE-2024-42851 
Buffer Overflow vulnerability in open source exiftags v.1.01 allows a local attacker to execute arbitrary code via the paresetag function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-27T00:00:00.000Z
CVE-2024-42852 
Cross Site Scripting vulnerability in AcuToWeb server v.10.5.0.7577C8b allows a remote attacker to execute arbitrary code via the index.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-23T00:00:00.000Z
CVE-2024-42861 
An issue in IEEE 802.1AS linuxptp v.4.2 and before allowing a remote attacker to cause a denial of service via a crafted Pdelay_Req message to the time synchronization function
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-23T00:00:00.000Z
CVE-2024-42885 
SQL Injection vulnerability in ESAFENET CDG 5.6 and before allows an attacker to execute arbitrary code via the id parameter of the data.jsp page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-05T00:00:00.000Z
CVE-2024-42898 
A cross-site scripting (XSS) vulnerability in Nagios XI 2024R1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter in the Account Settings page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-09T00:00:00.000Z
CVE-2024-42900 
Ruoyi v4.7.9 and before was discovered to contain a cross-site scripting (XSS) vulnerability via the sql parameter of the createTable() function at /tool/gen/create.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-28T00:00:00.000Z
CVE-2024-42901 
A CSV injection vulnerability in Lime Survey v6.5.12 allows attackers to execute arbitrary code via uploading a crafted CSV file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-03T00:00:00.000Z
CVE-2024-42902 
An issue in the js_localize.php function of LimeSurvey v6.6.2 and before allows attackers to execute arbitrary code via injecting a crafted payload into the lng parameter of the js_localize.php function
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-03T00:00:00.000Z
CVE-2024-42903 
A Host header injection vulnerability in the password reset function of LimeSurvey v.6.6.1+240806 and before allows attackers to send users a crafted password reset link that will direct victims to a malicious domain.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-03T00:00:00.000Z
CVE-2024-42904 
A cross-site scripting (XSS) vulnerability in SysPass 3.2.x allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name parameter at /Controllers/ClientController.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-03T00:00:00.000Z
CVE-2024-42905 
Beijing Digital China Cloud Technology Co., Ltd. DCME-320 v.7.4.12.60 has a command execution vulnerability, which can be exploited to obtain device administrator privileges via the getVar function in the code/function/system/tool/ping.php file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-28T00:00:00.000Z
CVE-2024-42906 
TestLink before v.1.9.20 is vulnerable to Cross Site Scripting (XSS) via the pop-up on upload file. When uploading a file, the XSS payload can be entered into the file name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-26T00:00:00.000Z
CVE-2024-42911 
ECOVACS Robotics Deebot T20 OMNI and T20e OMNI before 1.24.0 was discovered to contain a WiFi Remote Code Execution vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-14T00:00:00.000Z
CVE-2024-42912 
A cross-site scripting (XSS) vulnerability in META-INF Kft. Email This Issue (Data Center) before 9.13.0-GA allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the recipient field of an e-mail message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-16T00:00:00.000Z
CVE-2024-42913 
RuoYi CMS v4.7.9 was discovered to contain a SQL injection vulnerability via the job_id parameter at /sasfs1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-26T00:00:00.000Z
CVE-2024-42914 
A host header injection vulnerability exists in the forgot password functionality of ArrowCMS version 1.0.0. By sending a specially crafted host header in the forgot password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server and thus leak the password reset token. This may allow an attacker to reset other users' passwords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-23T00:00:00.000Z
CVE-2024-42915 
A host header injection vulnerability in Staff Appraisal System v1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This will allow attackers to arbitrarily reset other users' passwords and compromise their accounts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-23T00:00:00.000Z
CVE-2024-42918 
itsourcecode Online Accreditation Management System contains a Cross Site Scripting vulnerability, which allows an attacker to execute arbitrary code via a crafted payload to the SCHOOLNAME, EMAILADDRES, CONTACTNO, COMPANYNAME and COMPANYCONTACTNO parameters in controller.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-23T00:00:00.000Z
CVE-2024-42919 
eScan Management Console 14.0.1400.2281 is vulnerable to Incorrect Access Control via acteScanAVReport.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42922 
AAPanel v7.0.7 was discovered to contain an OS command injection vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-21T00:00:00.000Z
CVE-2024-42930 
PbootCMS 3.2.8 is vulnerable to URL Redirect.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-28T00:00:00.000Z
CVE-2024-42934 
OpenIPMI before 2.0.36 has an out-of-bounds array access (for authentication type) in the ipmi_sim simulator, resulting in denial of service or (with very low probability) authentication bypass or code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-09T00:00:00.000Z
CVE-2024-42936 
The mqlink.elf is service component in Ruijie RG-EW300N with firmware ReyeeOS 1.300.1422 is vulnerable to Remote Code Execution via a modified MQTT broker message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-21T00:00:00.000Z
CVE-2024-42939 
A cross-site scripting (XSS) vulnerability in the component /index/index.html of YZNCMS v1.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the configured remarks text field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-21T00:00:00.000Z
CVE-2024-42940 
Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromP2pListFilter function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-15T00:00:00.000Z
CVE-2024-42941 
Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the wanmode parameter in the fromAdvSetWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-15T00:00:00.000Z
CVE-2024-42942 
Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the frmL7ImForm function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-15T00:00:00.000Z
CVE-2024-42943 
Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the PPPOEPassword parameter in the fromAdvSetWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-15T00:00:00.000Z
CVE-2024-42944 
Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromNatlimit function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-15T00:00:00.000Z
CVE-2024-42945 
Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromAddressNat function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-15T00:00:00.000Z