rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-53296 
Dell PowerProtect DD versions prior to 7.10.1.50 and 7.13.1.20 contain a Stack-based Buffer Overflow vulnerability in the RestAPI. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: Dell
product: PowerProtect DD
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 2.7
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: Dell would like to thank zzcentury for reporting this issue.
Published: 2025-02-01T03:56:38.147Z
CVE-2024-53298 
Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.0.1, contains a missing authorization vulnerability in the NFS export. An unauthenticated attacker with remote access could potentially exploit this vulnerability leading to unauthorized filesystem access. The attacker may be able to read, modify, and delete arbitrary files. This vulnerability is considered critical as it can be leveraged to fully compromise the system. Dell recommends customers to upgrade at the earliest opportunity.
Problem types: cwe_id: CWE-862
description: CWE-862: Missing Authorization
Affected products: vendor: Dell
product: PowerScale OneFS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-06-20T13:51:04.102Z
CVE-2024-53299 Apache Wicket: An attacker can intentionally trigger a memory leak
The request handling in the core in Apache Wicket 7.0.0 on any platform allows an attacker to create a DOS via multiple requests to server resources.
Users are recommended to upgrade to versions 9.19.0 or 10.3.0, which fixes this issue.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: Apache Software Foundation
product: Apache Wicket
default_status: unaffected
Credits: lang: en
value: Pedro Santos
Published: 2025-01-23T08:37:05.687Z
CVE-2024-53303 
A remote code execution (RCE) vulnerability in the upload_file function of LRQA Nettitude PoshC2 after commit 123db87 allows authenticated attackers to execute arbitrary code via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-16T00:00:00.000Z
CVE-2024-53304 
An issue in LRQA Nettitude PoshC2 after commit 09ee2cf allows unauthenticated attackers to connect to the C2 server and execute arbitrary commands via posing as an infected machine.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-16T00:00:00.000Z
CVE-2024-53305 
An issue in the component /models/config.py of Whoogle search v0.9.0 allows attackers to execute arbitrary code via supplying a crafted search query.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-16T00:00:00.000Z
CVE-2024-53307 
A reflected cross-site scripting (XSS) vulnerability in the /mw/ endpoint of Evisions MAPS v6.10.2.267 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-10T00:00:00.000Z
CVE-2024-53309 
A stack-based buffer overflow vulnerability exists in Effectmatrix Total Video Converter Command Line (TVCC) 2.50 when an overly long string is passed to the "-f" parameter. This can lead to memory corruption, potentially allowing arbitrary code execution or causing a denial of service via specially crafted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-13T00:00:00.000Z
CVE-2024-53310 
A Structured Exception Handler based buffer overflow vulnerability exists in Effectmatrix Total Video Converter Command Line (TVCC) 2.50 when a specially crafted file is passed to the -ff parameter. The vulnerability occurs due to improper handling of file input with overly long characters, leading to memory corruption. This can result in arbitrary code execution or denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-13T00:00:00.000Z
CVE-2024-53311 
A Stack buffer overflow in the arguments parameter in Immunity Inc. Immunity Debugger v1.85 allows attackers to execute arbitrary code via a crafted input that exceeds the buffer size.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-13T00:00:00.000Z
CVE-2024-53319 
A heap buffer overflow in the XML Text Escaping component of Qualisys C++ SDK commit a32a21a allows attackers to cause Denial of Service (DoS) via escaping special XML characters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-31T00:00:00.000Z
CVE-2024-53320 
Qualisys C++ SDK commit a32a21a was discovered to contain multiple stack buffer overflows via the GetCurrentFrame, SaveCapture, and LoadProject functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-31T00:00:00.000Z
CVE-2024-53326 
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(), leading to code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-08T00:00:00.000Z
CVE-2024-53333 
TOTOLINK EX200 v4.0.3c.7646_B20201211 was found to contain a command insertion vulnerability in the setUssd function. This vulnerability allows an attacker to execute arbitrary commands via the "ussd" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-21T00:00:00.000Z
CVE-2024-53334 
TOTOLINK A810R V4.1.2cu.5182_B20201026 is vulnerable to Buffer Overflow in infostat.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-21T00:00:00.000Z
CVE-2024-53335 
TOTOLINK A810R V4.1.2cu.5182_B20201026 is vulnerable to Buffer Overflow in downloadFlile.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-21T00:00:00.000Z
CVE-2024-53345 
An authenticated arbitrary file upload vulnerability in Car Rental Management System v1.0 to v1.3 allows attackers to execute arbitrary code via uploading a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-07T00:00:00.000Z
CVE-2024-53348 
LoxiLB v.0.9.7 and before is vulnerable to Incorrect Access Control which allows attackers to obtain sensitive information and escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-21T00:00:00.000Z
CVE-2024-53349 
Insecure permissions in kuadrant v0.11.3 allow attackers to gain access to the service account's token, leading to escalation of privileges via the secretes component in the k8s cluster
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-21T00:00:00.000Z
CVE-2024-53350 
Insecure permissions in kubeslice v1.3.1 allow attackers to gain access to the service account's token, leading to escalation of privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-21T00:00:00.000Z
CVE-2024-53351 
Insecure permissions in pipecd v0.49 allow attackers to gain access to the service account's token, leading to escalation of privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-21T00:00:00.000Z
CVE-2024-53354 
Multiple SQL injection vulnerabilities in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote authenticated attackers to execute arbitrary SQL commands via the (1) user parameter to /api/management/findfilterlist; the (2) user or (3) filter parameter to /api/audit/findmetawatcher; the (4) user parameter to /api/audit/findmetaalert; the (5) user parameter to /api/management/ds; the (6) user or (7) filter parameter to /api/audit/findmetarunalert; the (7) user parameter to /api/management/findtimeview; the (8) user, (9) filter or (10) target parameter to /api/management/getihmsettings; the (11) user or (12) filter parameter to /api/management/elementstype; the (14) login, (15) user, (16) is_local, (17) is_ldap, or (18) is_openid parameter to /api/user/addalias; the (19) role parameter to /api/user/addrole; the (20) user or (21) filter parameter to /api/management/addtimeview; the (22) TIMEAGO, (23) IDENTIFIER, (24) USER, (25) NAME, or (26) COST parameter to /api/management/addtagcosts; the (27) USER, or (28) VM_COST parameter to /api/management/updategenericcpucost; the (29) VM, (30) HOST, or (31) STORAGE parameter to /api/management/updatecostinfo; the (32) user, (33) filter, or (34) timeago parameter to /api/management/addfilter; the (35) user parameter to /api/report/getreporthistory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-31T00:00:00.000Z
CVE-2024-53355 
Multiple incorrect access control issues in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote authenticated attackers, with low privileges, to (1) add an admin user via the /api/user/addalias route; (2) modifiy a user via the /api/user/updatealias route; (4) delete users via the /api/user/delalias route; (4) get users via the /api/user/aliases route; (5) add a root group via the /api/user/adduser route; (6) modifiy a group via the /api/user/updateuser route; (7) delete a group via the /api/user/deluser route; (8) get groups via the /api/user/users route; (9) add an admin role via the /api/user/addrole route; (10) modifiy a role via the /api/user/updaterole route; (11) delete a role via the /api/user/delrole route; (12) get roles via the /api/user/roles route.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-31T00:00:00.000Z
CVE-2024-53356 
Weak JWT Secret vulnerabilitiy in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote attackers to generate JWT for privilege escalation. The HMAC secret used for generating tokens is hardcoded as "somerandomaccesstoken". A weak HMAC secret poses a risk because attackers can use the predictable secret to create valid JSON Web Tokens (JWTs), allowing them access to important information and actions within the application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-31T00:00:00.000Z
CVE-2024-53357 
Multiple SQL injection vulnerabilities in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote authenticated attackers, with low privileges, to (1) add an admin user via the /api/user/addalias route; (2) modifiy a user via the /api/user/updatealiasroute; (4) delete users via the /api/user/delalias route; (4) get users via the /api/user/aliases route; (5) add a root group via the /api/user/adduserroute; (6) modifiy a group via the /api/user/updateuser route; (7) delete a group via the /api/user/deluser route; (8) get groups via the /api/user/usersroute; (9) add an admin role via the /api/user/addrole route; (10) modifiy a role via the /api/user/updaterole route; (11) delete a role via the /api/user/delrole route; (12) get roles via the /api/user/roles route.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-31T00:00:00.000Z
CVE-2024-53359 
An issue in Zalo v23.09.01 allows attackers to obtain sensitive user information via a crafted GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-20T00:00:00.000Z
CVE-2024-53364 
A SQL injection vulnerability was found in PHPGURUKUL Vehicle Parking Management System v1.13 in /users/view-detail.php. This vulnerability affects the viewid parameter, where improper input sanitization allows attackers to inject malicious SQL queries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-02T00:00:00.000Z
CVE-2024-53365 
A stored cross-site scripting (XSS) vulnerability was identified in PHPGURUKUL Vehicle Parking Management System v1.13 in /users/profile.php. This vulnerability allows authenticated users to inject malicious XSS scripts into the profile name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-26T00:00:00.000Z
CVE-2024-53375 
An Authenticated Remote Code Execution (RCE) vulnerability affects the TP-Link Archer router series. A vulnerability exists in the "tmp_get_sites" function of the HomeShield functionality provided by TP-Link. This vulnerability is still exploitable without the activation of the HomeShield functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-02T00:00:00.000Z
CVE-2024-53376 
CyberPanel before 2.3.8 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the phpSelection field to the websites/submitWebsiteCreation URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-16T00:00:00.000Z
CVE-2024-53379 
Heap buffer overflow in the server site handshake implementation in Real Time Logic LLC's SharkSSL version (from 05/05/24) commit 64808a5e12c83b38f85c943dee0112e428dc2a43 allows a remote attacker to trigger a Denial-of-Service via a malformed Client-Hello message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-23T00:00:00.000Z
CVE-2024-53382 
Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: PrismJS
product: Prism
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 4.9
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
Published: 2025-03-03T00:00:00.000Z
CVE-2024-53384 
A DOM Clobbering vulnerability in tsup v8.3.4 allows attackers to execute arbitrary code via a crafted script in the import.meta.url to document.currentScript in cjs_shims.js components
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-03T00:00:00.000Z
CVE-2024-53386 
Stage.js through 0.8.10 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Piqnt
product: Stage.js
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 4.9
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
Published: 2025-03-03T00:00:00.000Z
CVE-2024-53387 
A DOM Clobbering vulnerability in umeditor v1.2.3 allows attackers to execute arbitrary code via supplying a crafted HTML element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-03T00:00:00.000Z
CVE-2024-53388 
A DOM Clobbering vulnerability in mavo v0.3.2 allows attackers to execute arbitrary code via supplying a crafted HTML element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-03T00:00:00.000Z
CVE-2024-53406 
Espressif Esp idf v5.3.0 is vulnerable to Insecure Permissions resulting in Authentication bypass. In the reconnection phase, the device reuses the session key from a previous connection session, creating an opportunity for attackers to execute security bypass attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-13T00:00:00.000Z
CVE-2024-53407 
In Phiewer 4.1.0, a dylib injection leads to Command Execution which allow attackers to inject dylib file potentially leading to remote control and unauthorized access to sensitive user data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-15T00:00:00.000Z
CVE-2024-53408 
AVE System Web Client v2.1.131.13992 was discovered to contain a cross-site scripting (XSS) vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-27T00:00:00.000Z
CVE-2024-53412 
Command injection in the connect function in NietThijmen ShoppingCart 0.0.2 allows an attacker to execute arbitrary shell commands and achieve remote code execution via injection of malicious payloads into the Port field
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-15T00:00:00.000Z
CVE-2024-53423 
An issue in Open Network Foundation ONOS v2.7.0 allows attackers to cause a Denial of Service (DoS) via supplying crafted packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-29T00:00:00.000Z
CVE-2024-53425 
A heap-buffer-overflow vulnerability was discovered in the SkipSpacesAndLineEnd function in Assimp v5.4.3. This issue occurs when processing certain malformed MD5 model files, leading to an out-of-bounds read and potential application crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-21T00:00:00.000Z
CVE-2024-53426 
A heap-buffer-overflow vulnerability has been identified in ntopng 6.2 in the Flow::dissectMDNS function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-21T00:00:00.000Z
CVE-2024-53427 
decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflow and out-of-bounds write, as demonstrated by use of --slurp with subtraction, such as a filter of .-. when the input has a certain form of digit string with NaN (e.g., "1 NaN123" immediately followed by many more digits).
Problem types: cwe_id: CWE-843
description: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
Affected products: vendor: jqlang
product: jq
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 8.1
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Published: 2025-02-26T00:00:00.000Z
CVE-2024-53429 
Open62541 v1.4.6 is has an assertion failure in fuzz_binary_decode, which leads to a crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-21T00:00:00.000Z
CVE-2024-53432 
While parsing certain malformed PLY files, PCL version 1.14.1 crashes due to an uncaught std::out_of_range exception in PCLPointCloud2::at. This issue could potentially be exploited to cause a denial-of-service (DoS) attack when processing untrusted PLY files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-21T00:00:00.000Z
CVE-2024-53438 
EventAttendance.php in ChurchCRM 5.7.0 is vulnerable to SQL injection. An attacker can exploit this vulnerability by manipulating the 'Event' parameter, which is directly interpolated into the SQL query without proper sanitization or validation, allowing attackers to execute arbitrary SQL commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-22T00:00:00.000Z
CVE-2024-53441 
An issue in the index.js decryptCookie function of cookie-encrypter v1.0.1 allows attackers to execute a bit flipping attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-09T00:00:00.000Z
CVE-2024-53442 
whapa v1.59 is vulnerable to Command Injection via a crafted filename to the HTML reports component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-05T00:00:00.000Z
CVE-2024-53450 
RAGFlow 0.13.0 suffers from improper access control in document-hooks.ts, allowing unauthorized access to user documents.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-09T00:00:00.000Z
CVE-2024-53457 
A stored cross-site scripting (XSS) vulnerability in the Device Settings section of LibreNMS v24.9.0 to v24.10.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Display Name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-05T00:00:00.000Z
CVE-2024-53458 
Sysax Multi Server 6.99 is vulnerable to a denial of service (DoS) condition when processing specially crafted SSH packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2024-53459 
Sysax Multi Server 6.99 is vulnerable to Cross Site Scripting (XSS) via the /scgi?sid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-02T00:00:00.000Z
CVE-2024-53470 
Multiple stored cross-site scripting (XSS) vulnerabilities in the component /configuracao/gateway_pagamento.php of WeGIA v3.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the id or name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-05T00:00:00.000Z
CVE-2024-53471 
Multiple stored cross-site scripting (XSS) vulnerabilities in the component /configuracao/meio_pagamento.php of WeGIA v3.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the id or name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-05T00:00:00.000Z
CVE-2024-53472 
WeGIA v3.2.0 was discovered to contain a Cross-Site Request Forgery (CSRF).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-05T00:00:00.000Z
CVE-2024-53473 
WeGIA 3.2.0 before 3998672 does not verify permission to change a password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-07T00:00:00.000Z
CVE-2024-53476 
A race condition vulnerability in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f allows attackers to bypass inventory restrictions by simultaneously submitting purchase requests from multiple accounts for the same product. This can lead to overselling when stock is limited, as the system fails to accurately track inventory under high concurrency, resulting in potential loss and unfulfilled orders.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-27T00:00:00.000Z
CVE-2024-53477 
JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of deserialization in the file ApiForm.java
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-02T00:00:00.000Z
CVE-2024-53480 
Phpgurukul's Beauty Parlour Management System v1.1 is vulnerable to SQL Injection in `login.php` via the `emailcont` parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-10T00:00:00.000Z
CVE-2024-53481 
A Cross Site Scripting (XSS) vulnerability in the profile.php of PHPGurukul Beauty Parlour Management System v1.1 allows remote attackers to execute arbitrary code by injecting arbitrary HTML into the "Firstname" and "Last name" parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-10T00:00:00.000Z
CVE-2024-53484 
Ever Traduora 0.20.0 and below is vulnerable to Privilege Escalation due to the use of a hard-coded JWT signing key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-02T00:00:00.000Z