rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-40091 
Vilo 5 Mesh WiFi System <= 5.16.1.33 lacks authentication in the Boa webserver, which allows remote, unauthenticated attackers to retrieve logs with sensitive system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-21T00:00:00.000Z
CVE-2024-40094 
GraphQL Java (aka graphql-java) before 21.5 does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service via introspection queries. 20.9 and 19.11 are also fixed versions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-30T00:00:00.000Z
CVE-2024-40096 
The com.cascadialabs.who (aka Who - Caller ID, Spam Block) application 15.0 for Android places sensitive information in the system log.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-05T00:00:00.000Z
CVE-2024-40101 
A Reflected Cross-site scripting (XSS) vulnerability exists in '/search' in microweber 2.0.15 and earlier allowing unauthenticated remote attackers to inject arbitrary web script or HTML via the 'keywords' parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-06T00:00:00.000Z
CVE-2024-40110 
Sourcecodester Poultry Farm Management System v1.0 contains an Unauthenticated Remote Code Execution (RCE) vulnerability via the productimage parameter at /farm/product.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-12T00:00:00.000Z
CVE-2024-40111 
A persistent (stored) cross-site scripting (XSS) vulnerability has been identified in Automad 2.0.0-alpha.4. This vulnerability enables an attacker to inject malicious JavaScript code into the template body. The injected code is stored within the flat file CMS and is executed in the browser of any user visiting the forum.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-23T00:00:00.000Z
CVE-2024-40112 
A Local File Inclusion (LFI) vulnerability exists in Sitecom WLX-2006 Wall Mount Range Extender N300 v1.5 and before, which allows an attacker to manipulate the "language" cookie to include arbitrary files from the server. This vulnerability can be exploited to disclose sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-02T00:00:00.000Z
CVE-2024-40113 
Sitecom WLX-2006 Wall Mount Range Extender N300 v.1.5 and before is vulnerable to Use of Default Credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-02T00:00:00.000Z
CVE-2024-40114 
A Cross Site Scripting (XSS) vulnerability in Sitecom WLX-2006 Wall Mount Range Extender N300 v1.5 and before allows an attacker to manipulate the language cookie to inject malicious JavaScript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-02T00:00:00.000Z
CVE-2024-40116 
An issue in Solar-Log 1000 before v2.8.2 and build 52-23.04.2013 was discovered to store plaintext passwords in the export.html, email.html, and sms.html files -- fixed with 3.0.0-60 11.10.2013 for SL 200, 500, 1000 / not existing for SL 250, 300, 1200, 2000, SL 50 Gateway, SL Base.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-26T00:00:00.000Z
CVE-2024-40117 
Incorrect access control in Solar-Log 1000 before v2.8.2 and build 52- 23.04.2013 allows attackers to obtain Administrative privileges via connecting to the web administration server. Not existing for SL 200, 500, 1000 / fixed in 4.2.8 for SL 250, 300, 1200, 2000, SL 50 Gateway / fixed in 5.1.2 / 6.0.0 for SL Base.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-26T00:00:00.000Z
CVE-2024-40119 
Nepstech Wifi Router xpon (terminal) model NTPL-Xpon1GFEVN v.1.0 Firmware V2.0.1 contains a Cross-Site Request Forgery (CSRF) vulnerability in the password change function, which allows remote attackers to change the admin password without the user's consent, leading to a potential account takeover.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-17T00:00:00.000Z
CVE-2024-40120 
seaweedfs v3.68 was discovered to contain a SQL injection vulnerability via the component /abstract_sql/abstract_sql_store.go.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-16T00:00:00.000Z
CVE-2024-40124 
Pydio Core <= 8.2.5 is vulnerable to Cross Site Scripting (XSS) via the New URL Bookmark feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-17T00:00:00.000Z
CVE-2024-40125 
An arbitrary file upload vulnerability in the Media Manager function of Closed-Loop Technology CLESS Server v4.5.2 allows attackers to execute arbitrary code via uploading a crafted PHP file to the upload endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-19T00:00:00.000Z
CVE-2024-40129 
Open5GS v2.6.4 is vulnerable to Buffer Overflow. via /lib/pfcp/context.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-16T00:00:00.000Z
CVE-2024-40130 
open5gs v2.6.4 is vulnerable to Buffer Overflow. via /lib/core/abts.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-16T00:00:00.000Z
CVE-2024-40137 
Dolibarr ERP CRM before 19.0.2-php8.2 was discovered to contain a remote code execution (RCE) vulnerability via the Computed field parameter under the Users Module Setup function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-24T00:00:00.000Z
CVE-2024-40239 
An incorrect access control issue in Life: Personal Diary, Journal android app 17.5.0 allows a physically proximate attacker to escalate privileges via the fingerprint authentication function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-08T00:00:00.000Z
CVE-2024-40240 
An incorrect access control issue in HomeServe Home Repair' android app - 3.3.4 allows a physically proximate attacker to escalate privileges via the fingerprint authentication function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-08T00:00:00.000Z
CVE-2024-40317 
A reflected cross-site scripting (XSS) vulnerability in MyNET up to v26.08 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload into the parameter HTTP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-24T00:00:00.000Z
CVE-2024-40318 
An arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 allows attackers to execute arbitrary code via uploading a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-25T00:00:00.000Z
CVE-2024-40322 
An issue was discovered in JFinalCMS v.5.0.0. There is a SQL injection vulnerablity via /admin/div_data/data
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-16T00:00:00.000Z
CVE-2024-40324 
A CRLF injection vulnerability in E-Staff v5.1 allows attackers to insert Carriage Return (CR) and Line Feed (LF) characters into input fields, leading to HTTP response splitting and header manipulation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-25T00:00:00.000Z
CVE-2024-40328 
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/memberOnline_deal.php?mudi=del&dataType=&dataID=6
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-10T00:00:00.000Z
CVE-2024-40329 
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/softBak_deal.php?mudi=backup
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-10T00:00:00.000Z
CVE-2024-40331 
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/dbBakMySQL_deal.php?mudi=backup
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-10T00:00:00.000Z
CVE-2024-40332 
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/moneyRecord_deal.php?mudi=delRecord
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-10T00:00:00.000Z
CVE-2024-40333 
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/softBak_deal.php?mudi=del&dataID=2
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-10T00:00:00.000Z
CVE-2024-40334 
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/serverFile_deal.php?mudi=upFileDel&dataID=3
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-10T00:00:00.000Z
CVE-2024-40336 
idccms v1.35 is vulnerable to Cross Site Scripting (XSS) within the 'Image Advertising Management.'
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-10T00:00:00.000Z
CVE-2024-40347 
A reflected cross-site scripting (XSS) vulnerability in Hyland Alfresco Platform 23.2.1-r96 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload into the parameter htmlid.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-20T00:00:00.000Z
CVE-2024-40348 
An issue in the component /api/swaggerui/static of Bazaar v1.4.3 allows unauthenticated attackers to execute a directory traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-20T00:00:00.000Z
CVE-2024-40392 
SourceCodester Pharmacy/Medical Store Point of Sale System Using PHP/MySQL and Bootstrap Framework with Source Code 1.0 was discovered to contain a SQL injection vulnerability via the name parameter under addnew.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-16T00:00:00.000Z
CVE-2024-40393 
Online Clinic Management System In PHP With Free Source code v1.0 was discovered to contain a SQL injection vulnerability via the user parameter at login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-16T00:00:00.000Z
CVE-2024-40394 
Simple Library Management System Project Using PHP/MySQL v1.0 was discovered to contain an arbitrary file upload vulnerability via the component ajax.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-16T00:00:00.000Z
CVE-2024-40395 
An Insecure Direct Object Reference (IDOR) in PTC ThingWorx v9.5.0 allows attackers to view sensitive information, including PII, regardless of access level.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-27T00:00:00.000Z
CVE-2024-40400 
An arbitrary file upload vulnerability in the image upload function of Automad v2.0.0 allows attackers to execute arbitrary code via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-19T00:00:00.000Z
CVE-2024-40402 
A SQL injection vulnerability was found in 'ajax.php' of Sourcecodester Simple Library Management System 1.0. This vulnerability stems from insufficient user input validation of the 'username' parameter, allowing attackers to inject malicious SQL queries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-17T00:00:00.000Z
CVE-2024-40404 
Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain an access control issue in the API endpoint where Web Sockets connections are established.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-13T00:00:00.000Z
CVE-2024-40405 
Incorrect access control in Cybele Software Thinfinity Workspace before v7.0.3.109 allows attackers to gain access to a secondary broker via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-13T00:00:00.000Z
CVE-2024-40407 
A full path disclosure in Cybele Software Thinfinity Workspace before v7.0.2.113 allows attackers to obtain the root path of the application via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-13T00:00:00.000Z
CVE-2024-40408 
Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain an access control issue in the Create Profile section. This vulnerability allows attackers to create arbitrary user profiles with elevated privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-13T00:00:00.000Z
CVE-2024-40410 
Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain a hardcoded cryptographic key used for encryption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-13T00:00:00.000Z
CVE-2024-40412 
Tenda AX12 v1.0 v22.03.01.46 contains a stack overflow in the deviceList parameter of the sub_42E410 function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-10T00:00:00.000Z
CVE-2024-40414 
A vulnerability in /goform/SetNetControlList in the sub_656BC function in Tenda AX1806 1.0.0.1 firmware leads to stack-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-15T00:00:00.000Z
CVE-2024-40415 
A vulnerability in /goform/SetStaticRouteCfg in the sub_519F4 function in Tenda AX1806 1.0.0.1 firmware leads to stack-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-15T00:00:00.000Z
CVE-2024-40416 
A vulnerability in /goform/SetVirtualServerCfg in the sub_6320C function in Tenda AX1806 1.0.0.1 firmware leads to stack-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-15T00:00:00.000Z
CVE-2024-40417 
A vulnerability was found in Tenda AX1806 1.0.0.1. Affected by this issue is the function formSetRebootTimer of the file /goform/SetIpMacBind. The manipulation of the argument list leads to stack-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-10T00:00:00.000Z
CVE-2024-40422 
The snapshot_path parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack. An attacker can manipulate the snapshot_path parameter to traverse directories and access sensitive files on the server. This can potentially lead to unauthorized access to critical system files and compromise the confidentiality and integrity of the system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-24T00:00:00.000Z
CVE-2024-40425 
File Upload vulnerability in Nanjin Xingyuantu Technology Co Sparkshop (Spark Mall B2C Mall v.1.1.6 and before allows a remote attacker to execute arbitrary code via the contorller/common.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-16T00:00:00.000Z
CVE-2024-40427 
Stack Buffer Overflow in PX4-Autopilot v1.14.3, which allows attackers to execute commands to exploit this vulnerability and cause the program to refuse to execute
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-07T00:00:00.000Z
CVE-2024-40431 
A lack of input validation in Realtek SD card reader driver before 10.0.26100.21374 through the implementation of the IOCTL_SCSI_PASS_THROUGH control of the SD card reader driver allows an attacker to write to predictable kernel memory locations, even as a low-privileged user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-23T00:00:00.000Z
CVE-2024-40432 
A lack of input validation in Realtek SD card reader driver before 10.0.26100.21374 through the implementation of the IOCTL_SFFDISK_DEVICE_COMMAND control of the SD card reader driver allows a privileged attacker to crash the OS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-23T00:00:00.000Z
CVE-2024-40433 
Insecure Permissions vulnerability in Tencent wechat v.8.0.37 allows an attacker to escalate privileges via the web-view component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-26T00:00:00.000Z
CVE-2024-40441 
An issue in Doccano Open source annotation tools for machine learning practitioners v.1.8.4 and Doccano Auto Labeling Pipeline module to annotate a document automatically v.0.1.23 allows a remote attacker to escalate privileges via the model_attribs parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-23T00:00:00.000Z
CVE-2024-40442 
An issue in Doccano Open source annotation tools for machine learning practitioners v.1.8.4 and Doccano Auto Labeling Pipeline module to annotate a document automatically v.0.1.23 allows a remote attacker to escalate privileges via a crafted REST Request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-23T00:00:00.000Z
CVE-2024-40443 
SQL Injection vulnerability in Simple Laboratory Management System using PHP and MySQL v.1.0 allows a remote attacker to cause a denial of service via the delete_users function in the Useres.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-13T00:00:00.000Z
CVE-2024-40445 
A directory traversal vulnerability in forkosh Mime TeX before version 1.77 allows attackers on Windows systems to read or append arbitrary files by manipulating crafted input paths.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-22T00:00:00.000Z
CVE-2024-40446 
An issue in forkosh Mime Tex before v.1.77 allows an attacker to execute arbitrary code via a crafted script
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-22T00:00:00.000Z
CVE-2024-40453 
squirrellyjs squirrelly v9.0.0 and fixed in v.9.0.1 was discovered to contain a code injection vulnerability via the component options.varName.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-21T00:00:00.000Z
CVE-2024-40455 
An arbitrary file deletion vulnerability in ThinkSAAS v3.7 allows attackers to delete arbitrary files via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-16T00:00:00.000Z
CVE-2024-40456 
ThinkSAAS v3.7.0 was discovered to contain a SQL injection vulnerability via the name parameter at \system\action\update.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-16T00:00:00.000Z
CVE-2024-40457 
No-IP Dynamic Update Client (DUC) v3.x uses cleartext credentials that may occur on a command line or in a file. NOTE: the vendor's position is that cleartext in /etc/default/noip-duc is recommended and is the intentional behavior.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-12T00:00:00.000Z
CVE-2024-40458 
An issue in Ocuco Innovation Tracking.exe v.2.10.24.51 allows a local attacker to escalate privileges via the modification of TCP packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-22T00:00:00.000Z
CVE-2024-40459 
An issue in Ocuco Innovation APPMANAGER.EXE v.2.10.24.51 allows a local attacker to escalate privileges via the application manager function
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-22T00:00:00.000Z
CVE-2024-40460 
An issue in Ocuco Innovation v.2.10.24.51 allows a local attacker to escalate privileges via the JOBENTRY.EXE
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-22T00:00:00.000Z
CVE-2024-40461 
An issue in Ocuco Innovation v.2.10.24.51 allows a local attacker to escalate privileges via the STOCKORDERENTRY.EXE component
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-22T00:00:00.000Z
CVE-2024-40462 
An issue in Ocuco Innovation v.2.10.24.51 allows a local attacker to escalate privileges via the SETTINGSVATIGATOR.EXE component
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-22T00:00:00.000Z
CVE-2024-40464 
An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the sendMail function located in beego/core/logs/smtp.go file
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-31T00:00:00.000Z
CVE-2024-40465 
An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the getCacheFileName function in file.go file
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-31T00:00:00.000Z
CVE-2024-40472 
Sourcecodester Daily Calories Monitoring Tool v1.0 is vulnerable to SQL Injection via "delete-calorie.php."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-09T00:00:00.000Z
CVE-2024-40473 
A Stored Cross Site Scripting (XSS) vulnerability was found in "manage_houses.php" in SourceCodester Best House Rental Management System v1.0. It allows remote attackers to execute arbitrary code via "House_no" and "Description" parameter fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-08T00:00:00.000Z
CVE-2024-40474 
A Reflected Cross Site Scripting (XSS) vulnerability was found in "edit-cate.php" in SourceCodester House Rental Management System v1.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-08T00:00:00.000Z
CVE-2024-40475 
SourceCodester Best House Rental Management System v1.0 is vulnerable to Incorrect Access Control via /rental/payment_report.php, /rental/balance_report.php, /rental/invoices.php, /rental/tenants.php, and /rental/users.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-08T00:00:00.000Z
CVE-2024-40476 
A Cross-Site Request Forgery (CSRF) vulnerability was found in SourceCodester Best House Rental Management System v1.0. This could lead to an attacker tricking the administrator into adding/modifying/deleting valid tenant data via a crafted HTML page, as demonstrated by a Delete Tenant action at the /rental/ajax.php?action=delete_tenant.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-08T00:00:00.000Z
CVE-2024-40477 
A SQL injection vulnerability in "/oahms/admin/forgot-password.php" in PHPGurukul Old Age Home Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "email" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-08T00:00:00.000Z
CVE-2024-40478 
A Stored Cross Site Scripting (XSS) vulnerability was found in "/admin/afeedback.php" in Kashipara Online Exam System v1.0, which allows remote attackers to execute arbitrary code via "rname" and "email" parameter fields
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-09T00:00:00.000Z
CVE-2024-40479 
A SQL injection vulnerability in "/admin/quizquestion.php" in Kashipara Online Exam System v1.0 allows remote attackers to execute arbitrary SQL commands via the "eid" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-09T00:00:00.000Z