rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-42607 
Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_backup.php?dobackup=database
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42608 
Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/submit_page.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42609 
Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_backup.php?dobackup=avatars
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42610 
Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_backup.php?dobackup=files
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42611 
Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/admin_page.php?link_id=1&mode=delete
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42612 
Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/domain_management.php?whitelist_add
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42613 
Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_widgets.php?action=install&widget=akismet
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42616 
Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_widgets.php?action=remove&widget=Statistics
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42617 
Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_config.php?action=save&var_id=32
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42618 
Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /module.php?module=karma
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42619 
Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/domain_management.php?id=0&list=whitelist&remove=pligg.com
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42621 
Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_editor.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42623 
FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/layout/delete/1
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-12T00:00:00.000Z
CVE-2024-42624 
FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/page/delete/10.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-12T00:00:00.000Z
CVE-2024-42625 
FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/layout/add
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-12T00:00:00.000Z
CVE-2024-42626 
FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/snippet/add.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-12T00:00:00.000Z
CVE-2024-42627 
FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/snippet/delete/3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-12T00:00:00.000Z
CVE-2024-42628 
FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/snippet/edit/3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-12T00:00:00.000Z
CVE-2024-42629 
FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/page/edit/10.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-12T00:00:00.000Z
CVE-2024-42630 
FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/plugin/file_manager/create_file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-12T00:00:00.000Z
CVE-2024-42631 
FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/layout/edit/1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-12T00:00:00.000Z
CVE-2024-42632 
FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/page/add.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-12T00:00:00.000Z
CVE-2024-42633 
A Command Injection vulnerability exists in the do_upgrade_post function of the httpd binary in Linksys E1500 v1.0.06.001. As a result, an authenticated attacker can execute OS commands with root privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-19T00:00:00.000Z
CVE-2024-42634 
A Command Injection vulnerability exists in formWriteFacMac of the httpd binary in Tenda AC9 v15.03.06.42. As a result, attacker can execute OS commands with root privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-16T00:00:00.000Z
CVE-2024-42636 
DedeCMS V5.7.115 has a command execution vulnerability via file_manage_view.php?fmdo=newfile&activepath.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-23T00:00:00.000Z
CVE-2024-42637 
H3C R3010 v100R002L02 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-16T00:00:00.000Z
CVE-2024-42638 
H3C Magic B1ST v100R012 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-16T00:00:00.000Z
CVE-2024-42639 
H3C GR1100-P v100R009 was discovered to use a hardcoded password in /etc/shadow, which allows attackers to log in as root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-16T00:00:00.000Z
CVE-2024-42640 
angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Exploiting this vulnerability allows an attacker to upload arbitrary content to the server, which can subsequently be accessed through demo/uploads. This leads to the execution of previously uploaded content and enables the attacker to achieve code execution on the server. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-11T00:00:00.000Z
CVE-2024-42642 
Micron Crucial MX500 Series Solid State Drives M3CR046 is vulnerable to Buffer Overflow, which can be triggered by sending specially crafted ATA packets from the host to the drive controller. NOTE: The supplier states that this vulnerability was fully remediated in December 2024 and that updated firmware is available through Crucial’s official support page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-04T00:00:00.000Z
CVE-2024-42643 
Integer Overflow in fast_ping.c in SmartDNS Release46 allows remote attackers to cause a Denial of Service via misaligned memory access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-22T00:00:00.000Z
CVE-2024-42644 
FlashMQ v1.14.0 was discovered to contain an assertion failure in the function PublishCopyFactory::getNewPublish, which occurs when the QoS value of the publish object is greater than 0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-29T00:00:00.000Z
CVE-2024-42645 
An issue in FlashMQ v1.14.0 allows attackers to cause an assertion failure via sending a crafted retain message, leading to a Denial of Service (DoS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-29T00:00:00.000Z
CVE-2024-42646 
A segmentation fault in NanoMQ v0.21.10 allows attackers to cause a Denial of Service (DoS) via crafted messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-14T00:00:00.000Z
CVE-2024-42648 
NanoMQ v0.22.10 was discovered to contain a heap overflow which allows attackers to cause a Denial of Service (DoS) via a crafted CONNECT message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-14T00:00:00.000Z
CVE-2024-42649 
NanoMQ v0.22.10 was discovered to contain a memory leak which allows attackers to cause a Denial of Service (DoS) via a crafted PUBLISH message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-14T00:00:00.000Z
CVE-2024-42650 
NanoMQ 0.17.5 was discovered to contain a segmentation fault via the component /nanomq/pub_handler.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted PUBLISH message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-15T00:00:00.000Z
CVE-2024-42651 
NanoMQ v0.17.9 was discovered to contain a heap use-after-free vulnerability via the component sub_Ctx_handle. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted SUBSCRIBE message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-29T00:00:00.000Z
CVE-2024-42655 
An access control issue in NanoMQ v0.21.10 allows attackers to bypass security restrictions and access sensitive system topic messages using MQTT wildcard characters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-29T00:00:00.000Z
CVE-2024-42657 
An issue in wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 allows a remote attacker to obtain sensitive information via the lack of encryption during login process
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-19T00:00:00.000Z
CVE-2024-42658 
An issue in wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 allows a remote attacker to obtain sensitive information via the cookie's parameter
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-19T00:00:00.000Z
CVE-2024-42662 
An issue in apollocongif apollo v.2.2.0 allows a remote attacker to obtain sensitive information via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42671 
A Host Header Poisoning Open Redirect issue in slabiak Appointment Scheduler v.1.0.5 allows a remote attacker to redirect users to a malicious website, leading to potential credential theft, malware distribution, or other malicious activities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-31T00:00:00.000Z
CVE-2024-42676 
File Upload vulnerability in Huizhi enterprise resource management system v.1.0 and before allows a remote attacker to execute arbitrary code via the /nssys/common/Upload. Aspx? Action=DNPageAjaxPostBack component
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-15T00:00:00.000Z
CVE-2024-42677 
An issue in Huizhi enterprise resource management system v.1.0 and before allows a local attacker to obtain sensitive information via the /nssys/common/filehandle. Aspx component
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-15T00:00:00.000Z
CVE-2024-42678 
Cross Site Scripting vulnerability in Super easy enterprise management system v.1.0.0 and before allows a local attacker to execute arbitrary code via a crafted script to the /WebSet/DlgGridSet.html component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-15T00:00:00.000Z
CVE-2024-42679 
SQL Injection vulnerability in Super easy enterprise management system v.1.0.0 and before allows a local attacker to execute arbitrary code via a crafted script to the/ajax/Login.ashx component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-15T00:00:00.000Z
CVE-2024-42680 
An issue in Super easy enterprise management system v.1.0.0 and before allows a local attacker to obtain the server absolute path by entering a single quotation mark.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-15T00:00:00.000Z
CVE-2024-42681 
Insecure Permissions vulnerability in xxl-job v.2.4.1 allows a remote attacker to execute arbitrary code via the Sub-Task ID component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-15T00:00:00.000Z
CVE-2024-42697 
Cross Site Scripting vulnerability in Leotheme Leo Product Search Module v.2.1.6 and earlier allows a remote attacker to execute arbitrary code via the q parameter of the product search function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-20T00:00:00.000Z
CVE-2024-42698 
Roughly Enough Items (REI) v.16.0.729 and before contains an Improper Validation of Specified Index, Position, or Offset in Input vulnerability. The specific issue is a failure to validate slot index and decrement stack count in the Roughly Enough Items (REI) mod for Minecraft, which allows in-game item duplication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:N/I:L/PR:L/S:U/UI:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
Published: 2024-08-28T00:00:00.000Z
CVE-2024-42699 
Cross Site Scripting vulnerability in Create/Modify article function in Alkacon OpenCMS 17.0 allows remote attacker to inject javascript payload via image title sub-field in the image field
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-21T00:00:00.000Z
CVE-2024-42718 
A path traversal vulnerability in Croogo CMS 4.0.7 allows remote attackers to read arbitrary files via a specially crafted path in the 'edit-file' parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-26T00:00:00.000Z
CVE-2024-42733 
An issue in Docmosis Tornado v.2.9.7 and before allows a remote attacker to execute arbitrary code via a crafted script to the UNC path input
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-07T00:00:00.000Z
CVE-2024-42736 
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in addBlacklist. Authenticated Attackers can send malicious packet to execute arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-13T00:00:00.000Z
CVE-2024-42737 
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in delBlacklist. Authenticated Attackers can send malicious packet to execute arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-13T00:00:00.000Z
CVE-2024-42738 
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setDmzCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-13T00:00:00.000Z
CVE-2024-42739 
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setAccessDeviceCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-13T00:00:00.000Z
CVE-2024-42740 
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setLedCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-13T00:00:00.000Z
CVE-2024-42741 
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setL2tpServerCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-12T00:00:00.000Z
CVE-2024-42742 
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setUrlFilterRules. Authenticated Attackers can send malicious packet to execute arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-12T00:00:00.000Z
CVE-2024-42743 
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setSyslogCfg . Authenticated Attackers can send malicious packet to execute arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-12T00:00:00.000Z
CVE-2024-42744 
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setModifyVpnUser. Authenticated Attackers can send malicious packet to execute arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-12T00:00:00.000Z
CVE-2024-42745 
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setUPnPCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-12T00:00:00.000Z
CVE-2024-42747 
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setWanIeCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-12T00:00:00.000Z
CVE-2024-42748 
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setWiFiWpsCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-12T00:00:00.000Z
CVE-2024-42749 
Cross Site Scripting vulnerability in Alto CMS v.1.1.13 allows a local attacker to execute arbitrary code via a crafted script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-11-14T00:00:00.000Z
CVE-2024-42756 
An issue in Netgear DGN1000WW v.1.1.00.45 allows a remote attacker to execute arbitrary code via the Diagnostics page
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-23T00:00:00.000Z
CVE-2024-42757 
Command injection vulnerability in Asus RT-N15U 3.0.0.4.376_3754 allows a remote attacker to execute arbitrary code via the netstat function page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-15T00:00:00.000Z
CVE-2024-42758 
A Cross-site Scripting (XSS) vulnerability exists in version v2024-01-05 of the indexmenu plugin when is used and enabled in Dokuwiki (Open Source Wiki Engine). A malicious attacker can input XSS payloads for example when creating or editing existing page, to trigger the XSS on Dokuwiki, which is then stored in .txt file (due to nature of how Dokuwiki is designed), which presents stored XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-16T00:00:00.000Z
CVE-2024-42759 
An issue in Ellevo v.6.2.0.38160 allows a remote attacker to escalate privileges via the /api/usuario/cadastrodesuplente endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-09T00:00:00.000Z
CVE-2024-42760 
SQL Injection vulnerability in Ellevo v.6.2.0.38160 allows a remote attacker to obtain sensitive information via the /api/mob/instrucao/conta/destinatarios component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-11T00:00:00.000Z
CVE-2024-42761 
A Stored Cross Site Scripting (XSS) vulnerability was found in "/admin_schedule.php" in Kashipara Bus Ticket Reservation System v1.0, which allows remote attackers to execute arbitrary code via scheduleDurationPHP parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-22T00:00:00.000Z
CVE-2024-42762 
A Stored Cross Site Scripting (XSS) vulnerability was found in "/history.php" in Kashipara Bus Ticket Reservation System v1.0, which allows remote attackers to execute arbitrary code via the Name, Phone, and Email parameter fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-22T00:00:00.000Z
CVE-2024-42763 
A Reflected Cross Site Scripting (XSS) vulnerability was found in the "/schedule.php" page of the Kashipara Bus Ticket Reservation System v1.0, which allows remote attackers to execute arbitrary code via the "bookingdate" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-22T00:00:00.000Z
CVE-2024-42764 
Kashipara Bus Ticket Reservation System v1.0 is vulnerable to Cross Site Request Forgery (CSRF) via /deleteTicket.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-23T00:00:00.000Z
CVE-2024-42765 
A SQL injection vulnerability in "/login.php" of the Kashipara Bus Ticket Reservation System v1.0 allows remote attackers to execute arbitrary SQL commands and bypass Login via the "email" or "password" Login page parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-23T00:00:00.000Z
CVE-2024-42766 
Kashipara Bus Ticket Reservation System v1.0 0 is vulnerable to Incorrect Access Control via /deleteTicket.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-23T00:00:00.000Z
CVE-2024-42767 
Kashipara Hotel Management System v1.0 is vulnerable to Unrestricted File Upload RCE via /admin/add_room_controller.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-22T00:00:00.000Z