rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-48044 WordPress ShortPixel Image Optimizer plugin <= 5.6.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShortPixel Image Optimizer: from n/a through <= 5.6.3.
Problem types: cwe_id: CWE-862
description: Missing Authorization
Affected products: vendor: ShortPixel
product: ShortPixel Image Optimizer
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: Rafie Muhammad | Patchstack Bug Bounty Program
Published: 2024-11-01T14:18:45.172Z
CVE-2024-48045 WordPress Happy Elementor Addons plugin <= 3.12.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Happy Addons for Elementor: from n/a through <= 3.12.3.
Problem types: cwe_id: CWE-862
description: Missing Authorization
Affected products: vendor: HappyMonster
product: Happy Addons for Elementor
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Rafie Muhammad | Patchstack Bug Bounty Program
Published: 2024-11-01T14:18:45.827Z
CVE-2024-48046 WordPress Contact Form by Supsystic plugin <= 1.7.28 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in supsystic Contact Form by Supsystic contact-form-by-supsystic allows Stored XSS.This issue affects Contact Form by Supsystic: from n/a through <= 1.7.28.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: supsystic
product: Contact Form by Supsystic
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: UKO | Patchstack Bug Bounty Program
Published: 2024-10-17T12:19:08.709Z
CVE-2024-48047 WordPress Linked Variation for WooCommerce plugin <= 1.0.5 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Razon Komar Pal Linked Variation for WooCommerce linked-variation-for-woocommerce allows Cross Site Request Forgery.This issue affects Linked Variation for WooCommerce: from n/a through <= 1.0.5.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: Razon Komar Pal
product: Linked Variation for WooCommerce
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Marek Mikita | Patchstack Bug Bounty Program
Published: 2024-10-17T12:10:49.961Z
CVE-2024-48048 WordPress Wsify Widget plugin <= 1.0 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in GabbyKhrmon Wsify Widget wsify-widget allows Stored XSS.This issue affects Wsify Widget: from n/a through <= 1.0.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: GabbyKhrmon
product: Wsify Widget
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Joshua Chan | Patchstack Bug Bounty Program
Published: 2024-10-17T12:17:31.221Z
CVE-2024-48049 WordPress Mighty Builder plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mighty Plugins Mighty Builder mighty-builder allows Stored XSS.This issue affects Mighty Builder: from n/a through <= 1.0.2.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Mighty Plugins
product: Mighty Builder
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Gab | Patchstack Bug Bounty Program
Published: 2024-10-20T07:54:23.053Z
CVE-2024-48050 
In agentscope <=v0.0.4, the file agentscope\web\workstation\workflow_utils.py has the function is_callable_expression. Within this function, the line result = eval(s) poses a security risk as it can directly execute user-provided commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-04T00:00:00.000Z
CVE-2024-48052 
In gradio <=4.42.0, the gr.DownloadButton function has a hidden server-side request forgery (SSRF) vulnerability. The reason is that within the save_url_to_cache function, there are no restrictions on the URL, which allows access to local target resources. This can lead to the download of local resources and sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-04T00:00:00.000Z
CVE-2024-48057 
localai <=2.20.1 is vulnerable to Cross Site Scripting (XSS). When calling the delete model API and passing inappropriate parameters, it can cause a one-time storage XSS, which will trigger the payload when a user accesses the homepage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-04T00:00:00.000Z
CVE-2024-48059 
gaizhenbiao/chuanhuchatgpt project, version <=20240802 is vulnerable to stored Cross-Site Scripting (XSS) in WebSocket session transmission. An attacker can inject malicious content into a WebSocket message. When a victim accesses this session, the malicious JavaScript is executed in the victim's browser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-04T00:00:00.000Z
CVE-2024-48061 
langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the components run on the local machine rather than in a sandbox.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-04T00:00:00.000Z
CVE-2024-48063 
In PyTorch <=2.4.1, the RemoteModule has Deserialization RCE. NOTE: this is disputed by multiple parties because this is intended behavior in PyTorch distributed computing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-29T00:00:00.000Z
CVE-2024-48068 
A cross-site scripting (XSS) vulnerability in Shenzhen Landray Software Co.,LTD Landray EKP v16 and earlier allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-15T00:00:00.000Z
CVE-2024-48069 
A vulnerability was found in Weaver E-cology allows attackers use race conditions to bypass security mechanisms to upload malicious files and control server privileges
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-19T00:00:00.000Z
CVE-2024-48070 
An issue in Weaver E-cology v. attackers construct special requests to insert remote malicious code and to trigger malicious code execution, and control server privileges
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-19T00:00:00.000Z
CVE-2024-48071 
E-cology has a directory traversal vulnerability. An attacker can exploit this vulnerability to delete the server directory, causing the server to permanently deny service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-19T00:00:00.000Z
CVE-2024-48072 
Weaver Ecology v9.* was discovered to contain a SQL injection vulnerability via the component /mobilemode/Action.jsp?invoker=com.weaver.formmodel.mobile.mec.servlet.MECAction&action=getFieldTriggerValue&searchField=*&fromTable=HrmResourceManager&whereClause=1%3d1&triggerCondition=1&expression=%3d&fieldValue=1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-19T00:00:00.000Z
CVE-2024-48073 
sunniwell HT3300 before 1.0.0.B022.2 is vulnerable to Insecure Permissions. The /usr/local/bin/update program, which is responsible for updating the software in the HT3300 device, is given the execution mode of sudo NOPASSWD. This program is vulnerable to a command injection vulnerability, which could allow an attacker to pass commands to this program via command line arguments to gain elevated root privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-08T00:00:00.000Z
CVE-2024-48074 
An authorized RCE vulnerability exists in the DrayTek Vigor2960 router version 1.4.4, where an attacker can place a malicious command into the table parameter of the doPPPoE function in the cgi-bin/mainfunction.cgi route, and finally the command is executed by the system function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-28T00:00:00.000Z
CVE-2024-48075 
A Heap buffer overflow in the server-site handshake implementation in Real Time Logic SharkSSL from 09/09/24 and earlier allows a remote attacker to trigger a Denial-of-Service via a malformed TLS Client Key Exchange message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-12T00:00:00.000Z
CVE-2024-48077 
NanoMQ v0.22.7 is vulnerable to Denial of Service (DoS) due to improper resource throttling. A crafted sequence of requests causes the recv-q queue to saturate, leading to the rapid exhaustion of system file descriptors (FDs). This exhaustion triggers a process crash, rendering the broker unable to provide services.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-15T00:00:00.000Z
CVE-2024-48080 
An issue in aedes v0.51.2 allows attackers to cause a Denial of Service(DoS) via a crafted request. NOTE: the Supplier indicates that exploitation cannot occur because of the protection mechanism in the validateTopic function in lib/utils.js.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-03T00:00:00.000Z
CVE-2024-48091 
Tally Prime Edit Log v2.1 was discovered to contain a DLL hijacking vulnerability via the component TextShaping.dll. This vulnerability allows attackers to execute arbitrary code via a crafted DLL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-07T00:00:00.000Z
CVE-2024-48093 
Unrestricted File Upload in the Discussions tab in Operately v.0.1.0 allows a privileged user to achieve Remote Code Execution via uploading and executing malicious files without validating file extensions or content types.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-30T00:00:00.000Z
CVE-2024-48107 
SparkShop <=1.1.7 is vulnerable to server-side request forgery (SSRF). This vulnerability allows attacks to scan ports on the Intranet or local network where the server resides, attack applications running on the Intranet or local network, or read metadata on the cloud server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-28T00:00:00.000Z
CVE-2024-48112 
A deserialization vulnerability in the component \controller\Index.php of Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-30T00:00:00.000Z
CVE-2024-48119 
Vtiger CRM v8.2.0 has a HTML Injection vulnerability in the module parameter. Authenticated users can inject arbitrary HTML.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-14T00:00:00.000Z
CVE-2024-48120 
X2CRM v8.5 is vulnerable to a stored Cross-Site Scripting (XSS) in the "Opportunities" module. An attacker can inject malicious JavaScript code into the "Name" field when creating a list.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-14T00:00:00.000Z
CVE-2024-48121 
The HI-SCAN 6040i Hitrax HX-03-19-I was discovered to transmit user credentials in cleartext over the GIOP protocol. This allows attackers to possibly gain access to sensitive information via a man-in-the-middle attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-15T00:00:00.000Z
CVE-2024-48122 
Insecure default configurations in HI-SCAN 6040i Hitrax HX-03-19-I allow authenticated attackers with low-level privileges to escalate to root-level privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-15T00:00:00.000Z
CVE-2024-48123 
An issue in the USB Autorun function of HI-SCAN 6040i Hitrax HX-03-19-I allows attackers to execute arbitrary code via uploading a crafted script from a USB device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-15T00:00:00.000Z
CVE-2024-48125 
An issue in the AsDB service of HI-SCAN 6040i Hitrax HX-03-19-I allows attackers to enumerate user credentials via crafted GIOP protocol requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-15T00:00:00.000Z
CVE-2024-48126 
HI-SCAN 6040i Hitrax HX-03-19-I was discovered to contain hardcoded credentials for access to vendor support and service access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-15T00:00:00.000Z
CVE-2024-48138 
A remote code execution (RCE) vulnerability in the component /PluXml/core/admin/parametres_edittpl.php of PluXml v5.8.16 and lower allows attackers to execute arbitrary code via injecting a crafted payload into a template.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-29T00:00:00.000Z
CVE-2024-48139 
A prompt injection vulnerability in the chatbox of Blackbox AI v1.3.95 allows attackers to access and exfiltrate all previous and subsequent chat data between the user and the AI assistant via a crafted message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-24T00:00:00.000Z
CVE-2024-48140 
A prompt injection vulnerability in the chatbox of Butterfly Effect Limited Monica Your AI Copilot powered by ChatGPT4 v6.3.0 allows attackers to access and exfiltrate all previous and subsequent chat data between the user and the AI assistant via a crafted message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-24T00:00:00.000Z
CVE-2024-48141 
A prompt injection vulnerability in the chatbox of Zhipu AI CodeGeeX v2.17.0 allows attackers to access and exfiltrate all previous and subsequent chat data between the user and the AI assistant via a crafted message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-24T00:00:00.000Z
CVE-2024-48142 
A prompt injection vulnerability in the chatbox of Butterfly Effect Limited Monica ChatGPT AI Assistant v2.4.0 allows attackers to access and exfiltrate all previous and subsequent chat data between the user and the AI assistant via a crafted message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-24T00:00:00.000Z
CVE-2024-48143 
A lack of rate limiting in the OTP validation component of Digitory Multi Channel Integrated POS v1.0 allows attackers to gain access to the ordering system and place an excessive amount of food orders.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-24T00:00:00.000Z
CVE-2024-48144 
A prompt injection vulnerability in the chatbox of Fusion Chat Chat AI Assistant Ask Me Anything v1.2.4.0 allows attackers to access and exfiltrate all previous and subsequent chat data between the user and the AI assistant via a crafted message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-24T00:00:00.000Z
CVE-2024-48145 
A prompt injection vulnerability in the chatbox of Netangular Technologies ChatNet AI Version v1.0 allows attackers to access and exfiltrate all previous and subsequent chat data between the user and the AI assistant via a crafted message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-24T00:00:00.000Z
CVE-2024-48150 
D-Link DIR-820L 1.05B03 has a stack overflow vulnerability in the sub_451208 function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-14T00:00:00.000Z
CVE-2024-48153 
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the get_subconfig function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-14T00:00:00.000Z
CVE-2024-48168 
A stack overflow vulnerability exists in the sub_402280 function of the HNAP service of D-Link DCS-960L 1.09, allowing an attacker to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-14T00:00:00.000Z
CVE-2024-48170 
PHPGurukul Small CRM 3.0 is vulnerable to Cross Site Scripting (XSS) via a crafted payload injected into the name in the profile.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-10T00:00:00.000Z
CVE-2024-48176 
Lylme Spage v1.9.5 is vulnerable to Incorrect Access Control. There is no limit on the number of login attempts, and the verification code will not be refreshed after a failed login, which allows attackers to blast the username and password and log into the system backend.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-05T00:00:00.000Z
CVE-2024-48177 
MRCMS 3.1.2 contains a SQL injection vulnerability via the RID parameter in /admin/article/delete.do.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-28T00:00:00.000Z
CVE-2024-48178 
newbee-mall v1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via the goodsCoverImg parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-28T00:00:00.000Z
CVE-2024-48180 
ClassCMS <=4.8 is vulnerable to file inclusion in the nowView method in/class/cms/cms.php, which can include a file uploaded to the/class/template directory to execute PHP code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-16T00:00:00.000Z
CVE-2024-48191 
dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/doAdminAction.php?act=delAdmin&id=17
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-28T00:00:00.000Z
CVE-2024-48192 
Tenda G3 v15.01.0.5(2848_755)_EN was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to log in as root
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-17T00:00:00.000Z
CVE-2024-48195 
Cross Site Scripting vulnerability in eyouCMS v.1.6.7 allows a remote attacker to obtain sensitive information via a crafted script to the post parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-28T00:00:00.000Z
CVE-2024-48196 
An issue in eyouCMS v.1.6.7 allows a remote attacker to obtain sensitive information via a crafted script to the post parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-28T00:00:00.000Z
CVE-2024-48197 
Cross Site Scripting vulnerability in Audiocodes MP-202b v.4.4.3 allows a remote attacker to escalate privileges via the login page of the web interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-02T00:00:00.000Z
CVE-2024-48200 
An issue in MobaXterm v24.2 allows a local attacker to escalate privileges and execute arbitrary code via the remove function of the MobaXterm MSI is spawning one Administrative cmd (conhost.exe)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-31T00:00:00.000Z
CVE-2024-48202 
icecms <=3.4.7 has a File Upload vulnerability in FileUtils.java,uploadFile.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-30T00:00:00.000Z
CVE-2024-48204 
SQL injection vulnerability in Hanzhou Haobo network management system 1.0 allows a remote attacker to execute arbitrary code via a crafted script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-25T00:00:00.000Z
CVE-2024-48206 
A Deserialization of Untrusted Data vulnerability in chainer v7.8.1.post1 leads to execution of arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-29T00:00:00.000Z
CVE-2024-48208 
pure-ftpd before 1.0.52 is vulnerable to Buffer Overflow. There is an out of bounds read in the domlsd() function of the ls.c file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-24T00:00:00.000Z
CVE-2024-48213 
RockOA v2.6.5 is vulnerable to Directory Traversal in webmain/system/beifen/beifenAction.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-23T00:00:00.000Z
CVE-2024-48214 
KERUI HD 3MP 1080P Tuya Camera 1.0.4 has a command injection vulnerability in the module that connects to the local network via a QR code. This vulnerability allows an attacker to create a custom, unauthenticated QR code and abuse one of the parameters, either SSID or PASSWORD, in the JSON data contained within the QR code. By that, the attacker can execute arbitrary code on the camera.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-30T00:00:00.000Z
CVE-2024-48217 
An Insecure Direct Object Reference (IDOR) in the dashboard of SiSMART v7.4.0 allows attackers to execute a horizontal-privilege escalation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-01T00:00:00.000Z
CVE-2024-48218 
Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/list.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-25T00:00:00.000Z
CVE-2024-48222 
Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/edit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-25T00:00:00.000Z
CVE-2024-48223 
Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/fieldlist.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-25T00:00:00.000Z