rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-42501 Authenticated Path Traversal Vulnerability Leads to a Remote Command Execution (RCE)
An authenticated Path Traversal vulnerabilities exists in the ArubaOS. Successful exploitation of this vulnerability allows an attacker to install unsigned packages on the underlying operating system, enabling the threat actor to execute arbitrary code or install implants.
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: Aruba OS
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: erikdejong
Published: 2024-09-17T17:13:34.722Z
CVE-2024-42502 Authenticated Remote Command Execution (RCE) Vulnerability in the AOS Command Line Interface
Authenticated command injection vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability result in the ability to inject shell commands on the underlying operating system.
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: Aruba OS
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: erikdejong
Published: 2024-09-17T17:14:54.458Z
CVE-2024-42503 Authenticated Remote Command Execution (RCE) Vulnerability in the Lua Package Within the AOS Command Line Interface (CLI)
Authenticated command execution vulnerability exist in the  ArubaOS command line interface (CLI). Successful exploitation of this vulnerabilities result in the ability to run arbitrary commands as a priviledge user on the underlying operating system.
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: Aruba OS
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: erikdejong
Published: 2024-09-17T17:16:10.361Z
CVE-2024-42504 HPE IceWall Agent products, Cross-Site Request Forgery (CSRF)
A security vulnerability in HPE IceWall Agent products could be exploited remotely to cause a Cross-Site Request Forgery (CSRF) in the login flow.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Hewlett Packard Enterprise
product: HPE IceWall Agent products
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Published: 2024-10-03T06:38:19.154Z
CVE-2024-42505 Unauthenticated Command Injection Vulnerabilities in the CLI Service Accessed by the PAPI Protocol
Command injection vulnerabilities in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: Aruba OS
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: erikdejong
Published: 2024-09-24T18:09:27.417Z
CVE-2024-42506 Unauthenticated Command Injection Vulnerabilities in the CLI Service Accessed by the PAPI Protocol
Command injection vulnerabilities in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: Aruba OS
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: erikdejong
Published: 2024-09-24T18:10:30.812Z
CVE-2024-42507 Unauthenticated Command Injection Vulnerabilities in the CLI Service Accessed by the PAPI Protocol
Command injection vulnerabilities in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: Aruba OS
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: erikdejong
Published: 2024-09-24T18:11:37.946Z
CVE-2024-42508 
This vulnerability could be exploited, leading to unauthorized disclosure of information to authenticated users.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE OneView
default_status: affected
Published: 2024-10-18T15:10:26.609Z
CVE-2024-42509 Unauthenticated Command Injection Vulnerability in the CLI Service Accessed by the PAPI Protocol
Command injection vulnerability in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: zzcentury from Ubisectech Sirius Team (https://www.ubisectech.com/)
Published: 2024-11-05T22:34:31.648Z
CVE-2024-42512 
Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when the deprecated Basic128Rsa15 security policy is enabled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-10T00:00:00.000Z
CVE-2024-42513 
Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when using HTTPS endpoints.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-10T00:00:00.000Z
CVE-2024-42514 
A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.1.0.4 could allow an unauthenticated attacker to conduct an unauthorized access attack due to inadequate access control checks. A successful exploit requires user interaction and could allow an attacker to access sensitive information and send unauthorized messages during an active chat session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-01T00:00:00.000Z
CVE-2024-42515 
Glossarizer through 1.5.2 improperly tries to convert text into HTML. Even though the application itself escapes special characters (e.g., <>), the underlying library converts these encoded characters into legitimate HTML, thereby possibly causing stored XSS. Attackers can append a XSS payload to a word that has a corresponding glossary entry.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-31T00:00:00.000Z
CVE-2024-42516 Apache HTTP Server: HTTP response splitting
HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response.

This vulnerability was described as CVE-2023-38709 but the patch included in Apache HTTP Server 2.4.59 did not address the issue.

Users are recommended to upgrade to version 2.4.64, which fixes this issue.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Apache Software Foundation
product: Apache HTTP Server
default_status: unaffected
Published: 2025-07-10T16:53:13.201Z
CVE-2024-42520 
TOTOLINK A3002R v4.0.0-B20230531.1404 contains a buffer overflow vulnerability in /bin/boa via formParentControl.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-12T00:00:00.000Z
CVE-2024-42523 
publiccms V4.0.202302.e and before is vulnerable to Any File Upload via publiccms/admin/cmsTemplate/saveMetaData
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-23T00:00:00.000Z
CVE-2024-42531 
Ezviz Internet PT Camera CS-CV246 D15655150 allows an unauthenticated host to access its live video stream by crafting a set of RTSP packets with a specific set of URLs that can be used to redirect the camera feed. NOTE: the vendor's perspective is that the Anonymous120386 sample code can establish RTSP protocol communictaion, but cannot obtain video or audio data; thus, there is no risk.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-23T00:00:00.000Z
CVE-2024-42533 
SQL injection vulnerability in the authentication module in Convivance StandVoice 4.5 through 6.2 allows remote attackers to execute arbitrary code via the GEST_LOGIN parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-25T00:00:00.000Z
CVE-2024-42543 
TOTOLINK A3700R v9.1.2u.5822_B20200513 has a buffer overflow vulnerability in the http_host parameter in the loginauth function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-12T00:00:00.000Z
CVE-2024-42545 
TOTOLINK A3700R v9.1.2u.5822_B20200513 has a buffer overflow vulnerability in the ssid parameter in setWizardCfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-12T00:00:00.000Z
CVE-2024-42546 
TOTOLINK A3100R V4.1.2cu.5050_B20200504 has a buffer overflow vulnerability in the password parameter in the loginauth function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-12T00:00:00.000Z
CVE-2024-42547 
TOTOLINK A3100R V4.1.2cu.5050_B20200504 has a buffer overflow vulnerability in the http_host parameter in the loginauth function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-12T00:00:00.000Z
CVE-2024-42550 
A cross-site scripting (XSS) vulnerability in the component /email/welcome.php of Mini Inventory and Sales Management System commit 18aa3d allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-21T00:00:00.000Z
CVE-2024-42552 
Hotel Management System commit 91caab8 was discovered to contain a SQL injection vulnerability via the book_id parameter at admin_room_history.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42553 
A Cross-Site Request Forgery (CSRF) in the component admin_room_added.php of Hotel Management System commit 91caab8 allows attackers to escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42554 
Hotel Management System commit 91caab8 was discovered to contain a SQL injection vulnerability via the room_type parameter at admin_room_added.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42555 
A Cross-Site Request Forgery (CSRF) in the component admin_room_removed.php of Hotel Management System commit 91caab8 allows attackers to escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42556 
Hotel Management System commit 91caab8 was discovered to contain a SQL injection vulnerability via the room_type parameter at admin_room_removed.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42557 
A Cross-Site Request Forgery (CSRF) in the component admin_modify_room.php of Hotel Management System commit 91caab8 allows attackers to escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42558 
Hotel Management System commit 91caab8 was discovered to contain a SQL injection vulnerability via the book_id parameter at admin_modify_room.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42559 
An issue in the login component (process_login.php) of Hotel Management System commit 79d688 allows attackers to authenticate without providing a valid password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42560 
A cross-site scripting (XSS) vulnerability in the component update_page_details.php of Blood Bank And Donation Management System commit dc9e039 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page Details parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42561 
Pharmacy Management System commit a2efc8 was discovered to contain a SQL injection vulnerability via the invoice_number parameter at sales_report.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42562 
Pharmacy Management System commit a2efc8 was discovered to contain a SQL injection vulnerability via the invoice_number parameter at preview.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42563 
An arbitrary file upload vulnerability in ERP commit 44bd04 allows attackers to execute arbitrary code via uploading a crafted HTML file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42564 
ERP commit 44bd04 was discovered to contain a SQL injection vulnerability via the id parameter at /index.php/basedata/inventory/delete?action=delete.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42565 
ERP commit 44bd04 was discovered to contain a SQL injection vulnerability via the id parameter at /index.php/basedata/contact/delete?action=delete.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42566 
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the password parameter at login.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42567 
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the sid parameter at /search.php?action=2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42568 
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the transport parameter at vehicle.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42569 
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at paidclass.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42570 
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at admininsert.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42571 
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at insertattendance.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42572 
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at unitmarks.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42573 
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at dtmarks.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42574 
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at attendance.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42575 
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at substaff.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42576 
A Cross-Site Request Forgery (CSRF) in the component edit_categorie.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42577 
A Cross-Site Request Forgery (CSRF) in the component add_product.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42578 
A Cross-Site Request Forgery (CSRF) in the component edit_product.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42579 
A Cross-Site Request Forgery (CSRF) in the component add_group.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42580 
A Cross-Site Request Forgery (CSRF) in the component edit_group.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42581 
A Cross-Site Request Forgery (CSRF) in the component delete_group.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42582 
A Cross-Site Request Forgery (CSRF) in the component delete_categorie.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42583 
A Cross-Site Request Forgery (CSRF) in the component delete_user.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42584 
A Cross-Site Request Forgery (CSRF) in the component delete_product.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42585 
A Cross-Site Request Forgery (CSRF) in the component delete_media.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42586 
A Cross-Site Request Forgery (CSRF) in the component categorie.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42598 
SeaCMS 13.0 has a remote code execution vulnerability. The reason for this vulnerability is that although admin_editplayer.php imposes restrictions on edited files, attackers can still bypass these restrictions and write code, allowing authenticated attackers to exploit the vulnerability to execute arbitrary commands and gain system privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42599 
SeaCMS 13.0 has a remote code execution vulnerability. The reason for this vulnerability is that although admin_files.php imposes restrictions on edited files, attackers can still bypass these restrictions and write code, allowing authenticated attackers to exploit the vulnerability to execute arbitrary commands and gain system privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-22T00:00:00.000Z
CVE-2024-42603 
Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_backup.php?dobackup=clearall
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42604 
Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_group.php?mode=delete&group_id=3
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42605 
Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/edit_page.php?link_id=1
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z
CVE-2024-42606 
Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_log.php?clear=1
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-20T00:00:00.000Z