rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-55198 
User Enumeration via Discrepancies in Error Messages in the Celk Sistemas Celk Saude v.3.1.252.1 password recovery functionality which allows a remote attacker to enumerate users through discrepancies in the responses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-13T00:00:00.000Z
CVE-2024-55199 
A Stored Cross Site Scripting (XSS) vulnerability in Celk Sistemas Celk Saude v.3.1.252.1 allows a remote attacker to store JavaScript code inside a PDF file through the file upload feature. When the file is rendered, the injected code is executed on the user's browser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-10T00:00:00.000Z
CVE-2024-55210 
An issue in TOTVS Framework (Linha Protheus) 12.1.2310 allows attackers to bypass multi-factor authentication (MFA) via a crafted websocket message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-09T00:00:00.000Z
CVE-2024-55211 
An issue in Think Router Tk-Rt-Wr135G V3.0.2-X000 allows attackers to bypass authentication via a crafted cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-17T00:00:00.000Z
CVE-2024-55212 
DNNGo xBlog v6.5.0 was discovered to contain a SQL injection vulnerability via the Categorys parameter at /DNNGo_xBlog/Resource_Service.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-11T00:00:00.000Z
CVE-2024-55213 
Directory Traversal vulnerability in dhtmlxFileExplorer v.8.4.6 allows a remote attacker to obtain sensitive information via the File Listing function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-07T00:00:00.000Z
CVE-2024-55214 
Local File Inclusion vulnerability in dhtmlxFileExplorer v.8.4.6 allows a remote attacker to obtain sensitive information via the file download functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-07T00:00:00.000Z
CVE-2024-55215 
An issue in trojan v.2.0.0 through v.2.15.3 allows a remote attacker to escalate privileges via the initialization interface /auth/register.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-07T00:00:00.000Z
CVE-2024-55218 
IceWarp Server 10.2.1 is vulnerable to Cross Site Scripting (XSS) via the meta parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-07T00:00:00.000Z
CVE-2024-55224 
An HTML injection vulnerability in Vaultwarden prior to v1.32.5 allows attackers to execute arbitrary code via injecting a crafted payload into the username field of an e-mail message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-09T00:00:00.000Z
CVE-2024-55225 
An issue in the component src/api/identity.rs of Vaultwarden prior to v1.32.5 allows attackers to impersonate users, including Administrators, via a crafted authorization request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-09T00:00:00.000Z
CVE-2024-55226 
Vaultwarden v1.32.5 was discovered to contain an authenticated reflected cross-site scripting (XSS) vulnerability via the component /api/core/mod.rs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-09T00:00:00.000Z
CVE-2024-55227 
A cross-site scripting (XSS) vulnerability in the Events/Agenda module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a crafted payload injected into the Title parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-27T00:00:00.000Z
CVE-2024-55228 
A cross-site scripting (XSS) vulnerability in the Product module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a crafted payload injected into the Title parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-27T00:00:00.000Z
CVE-2024-55231 
An IDOR vulnerability in the edit-notes.php module of PHPGurukul Online Notes Sharing Management System v1.0 allows unauthorized users to modify notes belonging to other accounts due to missing authorization checks. This flaw exposes sensitive data and enables attackers to alter another user's information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-18T00:00:00.000Z
CVE-2024-55232 
An IDOR vulnerability in the manage-notes.php module in PHPGurukul Online Notes Sharing Management System v1.0 allows unauthorized users to delete notes belonging to other accounts due to missing authorization checks. This flaw enables attackers to delete another user's information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-18T00:00:00.000Z
CVE-2024-55238 
OpenMetadata <=1.4.1 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the WorkflowDAO interface. The workflowtype and status parameters can be used to build a SQL query.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:H/I:L/PR:L/S:U/UI:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 7.1
baseSeverity: HIGH
Published: 2025-04-17T00:00:00.000Z
CVE-2024-55239 
A reflected Cross-Site Scripting vulnerability in the standard documentation upload functionality in Portabilis i-Educar 2.9 allows attacker to craft malicious urls with arbitrary javascript in the 'titulo_documento' parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-18T00:00:00.000Z
CVE-2024-55241 
An issue in deep-diver LLM-As-Chatbot before commit 99c2c03 allows a remote attacker to execute arbitrary code via the modelsbyom.py component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-06T00:00:00.000Z
CVE-2024-55268 
A Reflected Cross Site Scripting (XSS) vulnerability was found in /covidtms/registered-user-testing.php in PHPGurukul COVID 19 Testing Management System 1.0 which allows remote attackers to execute arbitrary code via the regmobilenumber parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-06T00:00:00.000Z
CVE-2024-55270 
phpgurukul Student Management System 1.0 is vulnerable to SQL Injection in studentms/admin/search.php via the searchdata parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-17T00:00:00.000Z
CVE-2024-55271 
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in phpgurukul Gym Management System 1.0. This issue is present in the profile update functionality of the User Panel, specifically the /profile.php endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-17T00:00:00.000Z
CVE-2024-55272 
An issue in Brainasoft Braina v2.8 allows a remote attacker to obtain sensitive information via the chat window function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-07T00:00:00.000Z
CVE-2024-55279 
Uguu through 1.8.9 allows Cross Site Scripting (XSS) via JavaScript in XML files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-24T00:00:00.000Z
CVE-2024-55341 
A stored cross-site scripting (XSS) vulnerability in Piranha CMS 11.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by creating a page via the /manager/pages and then adding a markdown content with the XSS payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-20T00:00:00.000Z
CVE-2024-55342 
A file upload functionality in Piranha CMS 11.1 allows authenticated remote attackers to upload a crafted PDF file to /manager/media. This PDF can contain malicious JavaScript code, which is executed when a victim user opens or interacts with the PDF in their web browser, leading to a XSS vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-20T00:00:00.000Z
CVE-2024-55354 
Lucee before 5.4.7.3 LTS and 6 before 6.1.1.118, when an attacker can place files on the server, is vulnerable to a protection mechanism failure that can let an attacker run code that would be expected to be blocked and access resources that would be expected to be protected.
Problem types: cwe_id: CWE-807
description: CWE-807 Reliance on Untrusted Inputs in a Security Decision
Affected products: vendor: Lucee
product: Lucee Server
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 8.8
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Published: 2025-04-08T00:00:00.000Z
CVE-2024-55371 
Wallos <= 2.38.2 has a file upload vulnerability in the restore backup function, which allows authenticated users to restore backups by uploading a ZIP file. The contents of the ZIP file are extracted on the server. This functionality enables an authenticated attacker (being an administrator is not required) to upload malicious files to the server. Once a web shell is installed, the attacker gains the ability to execute arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-16T00:00:00.000Z
CVE-2024-55372 
Wallos <=2.38.2 has a file upload vulnerability in the restore database function, which allows unauthenticated users to restore database by uploading a ZIP file. The contents of the ZIP file are extracted on the server. This functionality enables an unauthenticated attacker to upload malicious files to the server. Once a web shell is installed, the attacker gains the ability to execute arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-16T00:00:00.000Z
CVE-2024-55374 
REDCap 14.3.13 allows an attacker to enumerate usernames due to an observable discrepancy between login attempts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-02T00:00:00.000Z
CVE-2024-55398 
4C Strategies Exonaut before v22.4 was discovered to contain insecure permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-06T00:00:00.000Z
CVE-2024-55399 
4C Strategies Exonaut before v21.6.2.1-1 was discovered to contain a Server-Side Request Forgery (SSRF).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-06T00:00:00.000Z
CVE-2024-55401 
An issue in 4C Strategies Exonaut before v22.4 allows attackers to execute a directory traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-07T00:00:00.000Z
CVE-2024-55402 
4C Strategies Exonaut before v22.4 was discovered to contain an access control issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-06T00:00:00.000Z
CVE-2024-55407 
An issue in the DeviceloControl function of ITE Tech. Inc ITE IO Access v1.0.0.0 allows attackers to perform arbitrary port read and write actions via supplying crafted IOCTL requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-06T00:00:00.000Z
CVE-2024-55408 
An improper access control vulnerability in the AsusSAIO.sys driver may lead to the misuse of software functionality utilizing the driver when crafted IOCTL requests are supplied.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: ASUS
product: ASCI
default_status: affected
Published: 2025-01-06T00:00:00.000Z
CVE-2024-55411 
An issue in the snxpcamd.sys component of SUNIX Multi I/O Card v10.1.0.0 allows attackers to perform arbitrary read and write actions via supplying crafted IOCTL requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-07T00:00:00.000Z
CVE-2024-55412 
A vulnerability exits in driver snxpsamd.sys in SUNIX Serial Driver x64 - 10.1.0.0, which allows low-privileged users to read and write arbitary i/o port via specially crafted IOCTL requests . This can be exploited for privilege escalation, code execution under high privileges, and information disclosure. These signed drivers can also be used to bypass the Microsoft driver-signing policy to deploy malicious code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-07T00:00:00.000Z
CVE-2024-55413 
A vulnerability exits in driver snxppamd.sys in SUNIX Parallel Driver x64 - 10.1.0.0, which allows low-privileged users to read and write arbitary i/o port via specially crafted IOCTL requests . This can be exploited for privilege escalation, code execution under high privileges, and information disclosure. These signed drivers can also be used to bypass the Microsoft driver-signing policy to deploy malicious code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-07T00:00:00.000Z
CVE-2024-55414 
A vulnerability exits in driver SmSerl64.sys in Motorola SM56 Modem WDM Driver v6.12.23.0, which allows low-privileged users to mapping physical memory via specially crafted IOCTL requests . This can be exploited for privilege escalation, code execution under high privileges, and information disclosure. These signed drivers can also be used to bypass the Microsoft driver-signing policy to deploy malicious code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-07T00:00:00.000Z
CVE-2024-55415 
DevDojo Voyager through 1.8.0 is vulnerable to path traversal at the /admin/compass.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-30T00:00:00.000Z
CVE-2024-55416 
DevDojo Voyager through version 1.8.0 is vulnerable to reflected XSS via /admin/compass. By manipulating an authenticated user to click on a link, arbitrary Javascript can be executed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-30T00:00:00.000Z
CVE-2024-55417 
DevDojo Voyager through version 1.8.0 is vulnerable to bypassing the file type verification when an authenticated user uploads a file via /admin/media/upload. An authenticated user can upload a web shell causing arbitrary code execution on the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-30T00:00:00.000Z
CVE-2024-55451 
A Stored Cross-Site Scripting (XSS) vulnerability exists in authenticated SVG file upload and viewing functionality in UJCMS 9.6.3. The vulnerability arises from insufficient sanitization of embedded attributes in uploaded SVG files. When a maliciously crafted SVG file is viewed by other backend users, it allows authenticated attackers to execute arbitrary JavaScript in the context of other backend users' browsers, potentially leading to the theft of sensitive tokens.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-16T00:00:00.000Z
CVE-2024-55452 
A URL redirection vulnerability exists in UJCMS 9.6.3 due to improper validation of URLs in the upload and rendering of new block / carousel items. This vulnerability allows authenticated attackers to redirect unprivileged users to an arbitrary, attacker-controlled webpage. When an authenticated user clicks on the malicious block item, they are redirected to the arbitrary untrusted domains, where sensitive tokens, such as JSON Web Tokens, can be stolen via a crafted webpage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-16T00:00:00.000Z
CVE-2024-55456 
lunasvg v3.0.1 was discovered to contain a segmentation violation via the component gray_find_cell
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-03T00:00:00.000Z
CVE-2024-55457 
MasterSAM Star Gate 11 is vulnerable to directory traversal via /adama/adama/downloadService. An attacker can exploit this vulnerability by manipulating the file parameter to access arbitrary files on the server, potentially exposing sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-20T00:00:00.000Z
CVE-2024-55459 
An issue in keras 3.7.0 allows attackers to write arbitrary files to the user's machine via downloading a crafted tar file through the get_file function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-08T00:00:00.000Z
CVE-2024-55460 
A time-based SQL injection vulnerability in the login page of BoardRoom Limited Dividend Distribution Tax Election System Version v2.0 allows attackers to execute arbitrary code via a crafted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-18T00:00:00.000Z
CVE-2024-55461 
SeaCMS <=13.0 is vulnerable to command execution in phome.php via the function Ebak_RepPathFiletext().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-18T00:00:00.000Z
CVE-2024-55466 
An arbitrary file upload vulnerability in the Image Gallery of ThingsBoard Community, ThingsBoard Cloud and ThingsBoard Professional v3.8.1 allows attackers to execute arbitrary code via uploading a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-12T00:00:00.000Z
CVE-2024-55470 
Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. By manipulating the entityid parameter, attackers can bypass passcode validation and successfully log into the application or access restricted data without proper authorization. The lack of server-side validation exacerbates the issue, as the application relies on client-side information for authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-20T00:00:00.000Z
CVE-2024-55471 
Oqtane Framework is vulnerable to Insecure Direct Object Reference (IDOR) in Oqtane.Controllers.UserController. This allows unauthorized users to access sensitive information of other users by manipulating the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-20T00:00:00.000Z
CVE-2024-55488 
A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. NOTE: This has been disputed by the vendor since this potential attack is only possible via authenticated users who have been manually allowed access to the CMS. There was a deliberate decision made not to apply HTML sanitization at the product level.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-22T00:00:00.000Z
CVE-2024-55492 
Winmail Server 4.4 is vulnerable to f_user=%22%3E%3Csvg%20onload Cross Site Scripting (XSS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-18T00:00:00.000Z
CVE-2024-55494 
A PHP Code Injection vulnerability that can lead to Remote Code Execution (RCE) and XSS in Opencode Mobile Collect Call v5.4.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the op_func parameter at /occontrolpanel/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-09T00:00:00.000Z
CVE-2024-55496 
A vulnerability has been found in the 1000projects Bookstore Management System PHP MySQL Project 1.0. This issue affects some unknown functionality of add_company.php. Actions on the delete parameter result in SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-17T00:00:00.000Z
CVE-2024-55500 
Cross-Site Request Forgery (CSRF) in Avenwu Whistle v.2.9.90 and before allows attackers to perform malicious API calls, resulting in the execution of arbitrary code on the victim's machine.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-10T00:00:00.000Z
CVE-2024-55503 
An issue in termius before v.9.9.0 allows a local attacker to execute arbitrary code via a crafted script to the DYLD_INSERT_LIBRARIES component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-15T00:00:00.000Z
CVE-2024-55504 
An issue in RAR Extractor - Unarchiver Free and Pro v.6.4.0 allows local attackers to inject arbitrary code potentially leading to remote control and unauthorized access to sensitive user data via the exploit_combined.dylib component on MacOS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-21T00:00:00.000Z
CVE-2024-55505 
An issue in CodeAstro Complaint Management System v.1.0 allows a remote attacker to escalate privileges via the mess-view.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-18T00:00:00.000Z
CVE-2024-55506 
An IDOR vulnerability in CodeAstro's Complaint Management System v1.0 (version with 0 updates) enables an attacker to execute arbitrary code and obtain sensitive information via the delete.php file and modifying the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-18T00:00:00.000Z
CVE-2024-55507 
An issue in CodeAstro Complaint Management System v.1.0 allows a remote attacker to escalate privileges via the delete_e.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-03T00:00:00.000Z
CVE-2024-55509 
SQL injection vulnerability in CodeAstro Complaint Management System v.1.0 allows a remote attacker to execute arbitrary code and escalate privileges via the id parameter of the delete.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-20T00:00:00.000Z
CVE-2024-55511 
A null pointer dereference vulnerability in Macrium Reflect prior to 8.1.8017 allows a local attacker to cause a system crash or potentially elevate their privileges via executing a specially crafted executable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-16T00:00:00.000Z
CVE-2024-55513 
A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 3.90. The component affected by this issue is /upload_netaction.php on the web interface. By crafting a suitable form name, arbitrary files can be uploaded, potentially leading to unauthorized access to server permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-17T00:00:00.000Z
CVE-2024-55514 
A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 3.90. The component affected by this issue is /upload_sfmig.php on the web interface. By crafting a suitable form name, arbitrary files can be uploaded, potentially leading to unauthorized access to server permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-17T00:00:00.000Z
CVE-2024-55515 
A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 3.90. The component affected by this issue is /upload_ipslib.php on the web interface. By crafting a suitable form name, arbitrary files can be uploaded.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-17T00:00:00.000Z