cve,poc_name,poc_description,poc_url,poc_source,poc_stars,poc_date_discovered,cve_url,cve_title,cve_description,cve_vendor,cve_products,cve_cvssv3_base_score,cve_cvssv3_base_severity,cve_epss
CVE-2024-50603,CVE-2024-50603,CVE-2024-50603: Aviatrix Controller Unauthenticated Command Injection,https://github.com/th3gokul/CVE-2024-50603,github,2,2025-01-12T20:20:21.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-50603,Remote Code Execution Vulnerability in Aviatrix Controller by Aviatrix,"A vulnerability in Aviatrix Controller allows unauthenticated attackers to exploit improper handling of OS command elements. This security flaw enables the execution of arbitrary code through the manipulation of API requests by injecting shell metacharacters into the parameters 'cloud_type' and 'src_cloud_type'. If left unaddressed, this could lead to significant security breaches and unauthorized access to protected systems.",Aviatrix,Controller,10,CRITICAL,0.009619999676942825
CVE-2025-0398,CVE-2025-0398 - Proof of Concept,,https://github.com/longpi1/warehouse/issues/4#issue-2765524047,refferences,,2025-01-12T14:00:14.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0398,Cross Site Scripting Vulnerability in Longpi1 Warehouse Backend Component,"A Cross Site Scripting vulnerability has been discovered in the Longpi1 Warehouse version 1.0. This issue arises from a flaw in the backend component, specifically in the file located at /resources/..;/inport/updateInport. The vulnerability allows remote attackers to manipulate the 'remark' parameter, potentially leading to the execution of arbitrary scripts in the context of the user's browser. As this vulnerability has been publicly disclosed, it poses a significant risk to users and organizations utilizing the affected version of the software.",Longpi1,Warehouse,5.1,MEDIUM,0.01
CVE-2025-0397,CVE-2025-0397 - Proof of Concept,,https://github.com/LvZCh/SPPanAdmin/issues/3#issue-2765450314,refferences,,2025-01-12T12:31:04.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0397,Cross Site Scripting in reckcn SPPanAdmin by reckcn,"A vulnerability has been identified in the reckcn SPPanAdmin application that allows for cross site scripting (XSS) attacks. The flaw exists in an unknown function of the administration module located at '/admin/role/edit'. Attackers can manipulate the name parameter, which can potentially lead to security breaches through remote exploitation. The issue was made public after the vendor was notified but did not respond. Other parameters may also be susceptible to this vulnerability, increasing its potential impact.",Reckcn,Sppanadmin,5.3,MEDIUM,0.01
CVE-2024-12856,CVE-2024-12856,An exploit for Four-Faith routers to get a reverse shell,https://github.com/nu113d/CVE-2024-12856,github,0,2025-01-12T03:14:03.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-12856,OS Command Injection Vulnerability in Four-Faith Routers,"An operating system command injection vulnerability exists in specific models of Four-Faith routers, enabling authenticated and remote attackers to execute arbitrary OS commands through an HTTP request when modifying the system time. The vulnerability is compounded by the inclusion of default credentials in firmware version 2.0, making it possible for unauthorized users to exploit the vulnerability without authentication. Users should ensure that default credentials are changed and apply necessary security updates to mitigate exposure to this risk.",Four-faith,"F3x24,F3x36",7.2,HIGH,0.0004600000102072954
CVE-2019-17240,Bludit-3.9.2-Auth-Bruteforce-Bypass-CVE-2019-17240,Bludit 3.9.2 - Auth Bruteforce Bypass CVE:2019-17240 Refurbish In bash,https://github.com/0xDTC/Bludit-3.9.2-Auth-Bruteforce-Bypass-CVE-2019-17240,github,0,2025-01-12T01:48:45.000Z,https://securityvulnerability.io/vulnerability/CVE-2019-17240,,bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many different forged X-Forwarded-For or Client-IP HTTP headers.,Bludit,Bludit,3.7,LOW,0.08324000239372253
CVE-2025-0282,CVE-2025-0282-Ivanti-exploit,"CVE-2025-0282 is a critical vulnerability found in Ivanti Connect Secure, allowing Remote Command Execution (RCE) through a buffer overflow exploit.",https://github.com/absholi7ly/CVE-2025-0282-Ivanti-exploit,github,0,2025-01-11T11:06:51.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0282,Stack-Based Buffer Overflow in Ivanti Connect Secure and Policy Secure,"A stack-based buffer overflow vulnerability exists in Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA gateways, prior to designated versions. This flaw allows a remote unauthenticated attacker to execute arbitrary code on the affected systems, posing significant risks to security and data integrity. Users are advised to upgrade to the latest versions of these products to mitigate potential exploitation.",Ivanti,"Connect Secure,Policy Secure,Neurons For Zta Gateways",9,CRITICAL,0.019460000097751617
CVE-2025-0392,CVE-2025-0392 - Proof of Concept,,https://gitee.com/erzhongxmu/JEEWMS/issues/IBFK93,refferences,,2025-01-11T11:00:20.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0392,SQL Injection Vulnerability in Jeewms by Guangzhou Huayi Intelligent Technology,"A SQL injection vulnerability exists in the Jeewms product from Guangzhou Huayi Intelligent Technology, specifically in the datagridGraph function within the graphReportController.do file. This vulnerability allows an attacker to manipulate the store_code argument, permitting unauthorized remote access and potential data breaches. The public disclosure of this exploit underscores the importance of immediate action. Users are advised to upgrade to version 20250101 to mitigate the risk associated with this vulnerability.",Guangzhou Huayi Intelligent Technology,Jeewms,5.3,MEDIUM,0.01
CVE-2025-0391,CVE-2025-0391 - Proof of Concept,,https://gitee.com/erzhongxmu/JEEWMS/issues/IBFKA8,refferences,,2025-01-11T09:00:13.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0391,SQL Injection Vulnerability in Jeewms by Guangzhou Huayi Intelligent Technology,"A SQL injection vulnerability has been identified in Jeewms developed by Guangzhou Huayi Intelligent Technology, affecting versions up to 20241229. The issue is located in the saveOrUpdate function within the CgFormBuildController.java file. This vulnerability allows attackers to manipulate SQL queries by injecting malicious code, which could lead to unauthorized data access or modification. The vulnerability may be exploited remotely, enabling attackers to target systems without physical access. Users are strongly advised to upgrade to version 20250101 to mitigate this risk.",Guangzhou Huayi Intelligent Technology,Jeewms,5.3,MEDIUM,0.01
CVE-2025-0390,CVE-2025-0390 - Proof of Concept,,https://gitee.com/erzhongxmu/JEEWMS/issues/IBFKBM,refferences,,2025-01-11T07:31:09.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0390,Path Traversal Vulnerability in Jeewms by Guangzhou Huayi Intelligent Technology,"A path traversal vulnerability in Jeewms by Guangzhou Huayi Intelligent Technology allows an attacker to manipulate file paths within the application. This vulnerability affects the /wmOmNoticeHController.do file and can be exploited remotely. Attackers may exploit this flaw to access unauthorized files by using `../filedir` in their requests. Users are advised to upgrade to version 20250101 to mitigate this security risk, as it addresses the vulnerability effectively.",Guangzhou Huayi Intelligent Technology,Jeewms,6.9,MEDIUM,0.01
CVE-2024-12587,CVE-2024-12587 - Proof of Concept,,https://wpscan.com/vulnerability/7cb040f5-d154-48ea-a54e-80451054bad8/,refferences,,2025-01-11T06:00:02.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-12587,Reflected Cross-Site Scripting in Contact Form Master Plugin for WordPress,"The Contact Form Master plugin for WordPress, up to version 1.0.7, is susceptible to a reflected cross-site scripting (XSS) vulnerability. This flaw arises due to the plugin's failure to properly sanitize and escape user-input parameters before rendering them on the web page. As a result, an attacker could craft a malicious URL that exploits this vulnerability, potentially targeting users, particularly those with high privileges like administrators. If such a user interacts with the manipulated URL, it can lead to the execution of arbitrary scripts in the context of their session, posing substantial security risks.",WordPress,Contact Form Master,,,0.01
CVE-2024-53677,CVE-2024-53677,Vulnerable Environment and Exploit for CVE-2024-53677,https://github.com/SeanRickerd/CVE-2024-53677,github,1,2025-01-11T02:47:24.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-53677,Flawed File Upload Logic in Apache Struts Exposes Vulnerability,"A security flaw in the file upload mechanism of Apache Struts could allow an attacker to exploit file upload parameters. This vulnerability enables path traversal, leading to the possibility of uploading a malicious file that can facilitate remote code execution. To mitigate risks, users should upgrade to version 6.4.0 or later and adopt the new file upload mechanism provided by Apache Struts. Applications utilizing older file upload logic through FileuploadInterceptor remain vulnerable; however, those that don't use this outdated method are not affected.",Apache,Apache Struts,,,0.0004299999854993075
CVE-2024-3400,CVE-2024-3400-poc,CVE-2024-3400的攻击脚本,https://github.com/XiaomingX/CVE-2024-3400-poc,github,1,2025-01-10T11:20:26.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-3400,Palo Alto Networks PAN-OS Command Injection Vulnerability,"A vulnerability exists in the GlobalProtect feature of Palo Alto Networks PAN-OS software, allowing for arbitrary file creation. This issue can be exploited by an unauthenticated attacker to execute code with root privileges on the affected firewall systems. Specific configurations and versions are impacted, highlighting the need for careful management of firewall settings to mitigate risks. Cloud NGFW, Panorama appliances, and Prisma Access are not affected, reinforcing the importance of understanding the configurations and versions at risk.",Palo Alto Networks,"Pan-os,Cloud Ngfw,Prisma Access",10,CRITICAL,0.9633899927139282
CVE-2024-8743,CVE-2024-8743-PoC,Proof-of-Concept script for WordPress plugin Bit File Manager version <= 6.5.7 Authenticated (Subscriber+) Limited JavaScript File Upload (CVE-2024-8743) vulnerability,https://github.com/siunam321/CVE-2024-8743-PoC,github,0,2025-01-09T17:54:56.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-8743,Limited JavaScript File Upload Vulnerability in Bit File Manager,"The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to Limited JavaScript File Upload in all versions up to, and including, 6.5.7. This is due to a lack of proper checks on allowed file types. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an administrator, to upload .css and .js files, which could lead to Stored Cross-Site Scripting.",Bitpressadmin,Bit File Manager – 100% Free & Open Source File Manager And Code Editor For WordPress,6.8,MEDIUM,0.0005000000237487257
CVE-2025-0349,CVE-2025-0349 - Proof of Concept,,https://github.com/wy876/cve/issues/5,refferences,,2025-01-09T10:31:07.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0349,Stack-based Buffer Overflow in Tenda AC6 by Tenda,"A vulnerability exists in Tenda AC6 15.03.05.16 that allows for a stack-based buffer overflow through the GetParentControlInfo function located in /goform/GetParentControlInfo. Manipulating the 'src' argument could enable remote attackers to exploit the vulnerability, potentially affecting additional parameters. This issue has been publicly disclosed, raising significant concerns regarding its exploitability.",Tenda,Ac6,8.7,HIGH,0.00044999999227002263
CVE-2025-0348,CVE-2025-0348 - Proof of Concept,,https://github.com/shaturo1337/POCs/blob/main/Stored%20XSS%20Vulnerability%20in%20DepEd%20Equipment%20Inventory%20System.md,refferences,,2025-01-09T10:00:09.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0348,Cross-Site Scripting Vulnerability in CampCodes DepEd Equipment Inventory System,"A cross-site scripting vulnerability has been identified in CampCodes DepEd Equipment Inventory System version 1.0. The flaw is located in the /data/add_employee.php file, where user input is not adequately sanitized. This oversight allows attackers to inject malicious scripts, potentially compromising user data and sessions. The exploitation of this vulnerability can occur remotely, making it a serious security concern for users of the system. The vulnerability has been made public, highlighting the need for immediate corrective measures to ensure system integrity and user safety.",Campcodes,Deped Equipment Inventory System,5.3,MEDIUM,0.00044999999227002263
CVE-2025-0347,CVE-2025-0347 - Proof of Concept,,https://github.com/Curious-L/-/issues/3,refferences,,2025-01-09T09:31:05.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0347,SQL Injection Vulnerability in Admission Management System by Code-Projects,"A significant SQL injection vulnerability has been identified in the Admission Management System version 1.0 by Code-Projects. This flaw resides in the index.php file, specifically within the login component, where improper handling of the user identifier (u_id) parameter can allow attackers to execute malicious SQL statements. This vulnerability can be exploited remotely, potentially compromising sensitive data. Public knowledge of this exploit raises urgent concerns for users to secure their systems against potential attacks.",Code-projects,Admission Management System,6.9,MEDIUM,0.00044999999227002263
CVE-2025-0346,CVE-2025-0346 - Proof of Concept,,https://gist.github.com/Lytes/266e5fa6eb4506fe2c7e35166664249a,refferences,,2025-01-09T09:00:14.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0346,Unrestricted Upload Vulnerability in Code-Projects CMS Publish News Page,"A vulnerability exists in the code-projects Content Management System 1.0, specifically within the Publish News Page component located at /admin/publishnews.php. This issue allows for unrestricted file uploads through manipulation of the 'image' argument, enabling attackers to upload arbitrary files without appropriate validation. As a result, this could potentially lead to remote code execution or other malicious activities. The vulnerability has been publicly disclosed, increasing the urgency for users to assess and mitigate the risk associated with this flaw.",Code-projects,Content Management System,5.1,MEDIUM,0.00044999999227002263
CVE-2025-0345,CVE-2025-0345 - Proof of Concept,,https://github.com/d3do-23/cvelist/blob/main/cy-fast/sqli4.md,refferences,,2025-01-09T08:31:04.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0345,SQL Injection Vulnerability in Leiyuxi Cy-Fast 1.0,"A SQL injection vulnerability exists in the listData function of the Leiyuxi Cy-Fast 1.0 product. This security flaw occurs due to improper handling of input arguments, specifically in the argument order within the /sys/menu/listData file. This weakness allows an attacker to manipulate the SQL queries executed by the application, potentially leading to unauthorized access to sensitive data. The vulnerability can be exploited remotely, emphasizing the importance of immediate remediation to protect affected installations.",Leiyuxi,Cy-fast,5.3,MEDIUM,0.00044999999227002263
CVE-2025-0344,CVE-2025-0344 - Proof of Concept,,https://github.com/d3do-23/cvelist/blob/main/cy-fast/sqli3.md,refferences,,2025-01-09T08:00:11.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0344,SQL Injection Vulnerability in leiyuxi cy-fast 1.0,"A vulnerability exists in leiyuxi cy-fast version 1.0 within the listData function located in /commpara/listData. By manipulating the order of function arguments, attackers can exploit this vulnerability to perform SQL injection attacks remotely. This issue exposes sensitive information and may compromise the integrity of the database. Public disclosure of the exploit means that the vulnerability is readily accessible for potential attacks.",Leiyuxi,Cy-fast,5.3,MEDIUM,0.00044999999227002263
CVE-2025-0342,CVE-2025-0342 - Proof of Concept,,https://github.com/shaturo1337/POCs/blob/main/Stored%20XSS%20Vulnerability%20in%20Computer%20Laboratory%20Management%20System.md,refferences,,2025-01-09T07:31:07.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0342,Cross-Site Scripting Vulnerability in CampCodes Computer Laboratory Management System,"A cross-site scripting vulnerability exists in the CampCodes Computer Laboratory Management System version 1.0, primarily affecting the file located at /class/edit/edit. This security flaw can be exploited by manipulating the 's_lname' argument, potentially allowing remote attackers to execute arbitrary scripts in the context of the affected web application. Given the public disclosure of this exploit, it is crucial for users to adopt protective measures. Other parameters may also be prone to similar vulnerabilities.",Campcodes,Computer Laboratory Management System,5.3,MEDIUM,0.00044999999227002263
CVE-2025-0341,CVE-2025-0341 - Proof of Concept,,https://github.com/shaturo1337/POCs/blob/main/Remote%20Code%20Execution%20via%20Arbitrary%20File%20Upload%20in%20Computer%20Laboratory%20Management%20System.md,refferences,,2025-01-09T07:31:05.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0341,Unrestricted File Upload in CampCodes Computer Laboratory Management System,"A vulnerability has been identified in CampCodes Computer Laboratory Management System 1.0, specifically in the functionality of the file /class/edit/edit. This weakness allows an attacker to manipulate the argument e_photo, leading to unrestricted file uploads. Such attacks can be executed remotely, permitting potential malicious exploitation without proper authentication or access controls. The details regarding this issue have been disclosed publicly, indicating a serious security risk requiring immediate attention.",Campcodes,Computer Laboratory Management System,5.3,MEDIUM,0.00044999999227002263
CVE-2025-0336,CVE-2025-0336 - Proof of Concept,,https://github.com/fuulof/CVE/issues/1,refferences,,2025-01-09T06:31:04.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0336,SQL Injection Vulnerability in Codezips Project Management System by Codezips,"The Codezips Project Management System 1.0 contains a vulnerability in the /pages/forms/teacher.php file that allows remote SQL injection through manipulation of the argument name. This flaw enables attackers to execute arbitrary SQL queries on the database, potentially leading to unauthorized access and data leakage. The exploit has been made public, increasing the risk of attacks on vulnerable systems.",Codezips,Project Management System,5.3,MEDIUM,0.00044999999227002263
CVE-2024-6324,CVE-2024-6324 - Proof of Concept,,https://hackerone.com/reports/2553716,refferences,,2025-01-09T06:02:46.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-6324,Denial of Service Vulnerability in GitLab CE/EE by GitLab,"A Denial of Service vulnerability was identified in GitLab CE/EE that could allow attackers to create cyclic references between epics, leading to resource exhaustion and potential service disruption. This issue affects all versions from 15.7 to 17.5.5, 17.6 from its release to 17.6.3, and 17.7 up until 17.7.1. Properly handling of epics is crucial to prevent this vulnerability from being exploited.",Gitlab,Gitlab,4.3,MEDIUM,0.00044999999227002263
CVE-2025-0335,CVE-2025-0335 - Proof of Concept,,https://github.com/Huandtx/cve/blob/main/cve/Online%20Bike%20Rental%20System/File_upload1.md,refferences,,2025-01-09T06:00:10.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0335,Unrestricted Upload Vulnerability in Online Bike Rental System by Code-Projects,"A vulnerability exists in the Online Bike Rental System 1.0 developed by Code-Projects, centered around the Change Image Handler component. This flaw allows attackers to upload files without proper restrictions, which may lead to unauthorized access and exploitation. The potential for remote attacks raises significant security concerns, with the exploit having been publicly disclosed. Other components may also be affected, emphasizing the need for immediate attention and remediation.",Code-projects,Online Bike Rental System,5.3,MEDIUM,0.00044999999227002263
CVE-2024-12736,CVE-2024-12736 - Proof of Concept,,https://wpscan.com/vulnerability/d3c6a4c1-8358-4f8b-b58d-3f712052668f/,refferences,,2025-01-09T06:00:09.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-12736,Reflected Cross-Site Scripting Vulnerability in BU Section Editing WordPress Plugin,"The BU Section Editing WordPress plugin fails to properly sanitize and escape user-supplied input, leading to a reflected cross-site scripting vulnerability. This flaw poses a significant risk for high privilege users such as administrators, as it can allow attackers to inject malicious scripts that execute in the context of the user's session, potentially leading to unauthorized actions or data exposure.",WordPress,Bu Section Editing,,,0.0004299999854993075
CVE-2024-12731,CVE-2024-12731 - Proof of Concept,,https://wpscan.com/vulnerability/e1c3754f-60e0-4a89-b4fc-89056dba3616/,refferences,,2025-01-09T06:00:08.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-12731,Reflected Cross-Site Scripting Vulnerability in Aklamator INfeed Plugin for WordPress,"The Aklamator INfeed WordPress plugin, up to version 2.0.0, has a security flaw where it fails to properly sanitize and escape a certain parameter before displaying it on the web page. This vulnerability can expose high-privilege users, such as administrators, to reflected cross-site scripting attacks, potentially allowing attackers to execute arbitrary scripts in their browsers. This can lead to unauthorized actions being performed on behalf of users, highlighting the importance of applying security best practices and ensuring prompt updates to the plugin for protection.",WordPress,Aklamator Infeed,,,0.0004299999854993075
CVE-2024-12717,CVE-2024-12717 - Proof of Concept,,https://wpscan.com/vulnerability/5564926a-6b1d-43f4-8147-128472f6b93a/,refferences,,2025-01-09T06:00:07.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-12717,Stored Cross-Site Scripting Vulnerability in Aklamator INfeed Plugin from Aklamator,"The Aklamator INfeed WordPress plugin, up to version 2.0.0, is susceptible to Stored Cross-Site Scripting due to improper sanitization and escaping of its settings. This vulnerability permits high privilege users, such as administrators, to conduct attacks that could lead to malicious scripts being stored and executed within the site. Such a flaw remains exploitable even when capabilities that would normally restrict HTML input, such as unfiltered_html, are disabled, posing a significant security risk in environments like multisite setups.",Aklamator,Aklamator Infeed,,,0.0004299999854993075
CVE-2025-0334,CVE-2025-0334 - Proof of Concept,,https://github.com/d3do-23/cvelist/blob/main/cy-fast/sqli2.md,refferences,,2025-01-09T06:00:07.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0334,SQL Injection Vulnerability in Leiyuxi Cy-Fast Web Application,"A vulnerability exists in Leiyuxi Cy-Fast version 1.0, specifically in the listData function located in the /sys/user/listData file. This vulnerability arises due to inadequate validation of input parameters, allowing attackers to manipulate the order of arguments. As a result, it opens the door to SQL injection attacks that can be executed remotely. This security flaw poses a significant risk as it can compromise the application's database integrity and expose sensitive data.",Leiyuxi,Cy-fast,5.3,MEDIUM,0.00044999999227002263
CVE-2024-12715,CVE-2024-12715 - Proof of Concept,,https://wpscan.com/vulnerability/e1456295-75ba-4dc2-9b1a-dc16a2000db2/,refferences,,2025-01-09T06:00:06.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-12715,Reflected Cross-Site Scripting in Asgard Security Scanner WordPress Plugin,"The Asgard Security Scanner plugin for WordPress, specifically versions up to 0.7, contains a security flaw that arises from inadequate sanitization and escaping of user-supplied input. This oversight can lead to reflected cross-site scripting (XSS) attacks, potentially targeting high-privilege users, including administrators. An attacker could exploit this vulnerability to execute malicious scripts in the context of the affected user's session, which may result in unauthorized actions or data exposure.",WordPress,Asgard Security Scanner,,,0.0004299999854993075
CVE-2024-12714,CVE-2024-12714 - Proof of Concept,,https://wpscan.com/vulnerability/f7fb2aef-16ce-4ae7-927c-2ffbc45fbda5/,refferences,,2025-01-09T06:00:05.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-12714,Reflected Cross-Site Scripting Vulnerability in Backlink Monitoring Manager Plugin by WordPress,"The Backlink Monitoring Manager plugin for WordPress, up to version 0.1.3, is vulnerable to reflected cross-site scripting. This occurs due to insufficient sanitization and escaping of parameters before rendering them on the page. Attackers may exploit this weakness to inject malicious scripts, potentially targeting high-privilege users such as administrators. Admins visiting compromised links could inadvertently execute scripts, leading to data leaks or further compromise of the site.",WordPress,Backlink Monitoring Manager,,,0.0004299999854993075
CVE-2024-10815,CVE-2024-10815 - Proof of Concept,,https://wpscan.com/vulnerability/309a445a-6261-4bd1-bac0-a78096d0c12b/,refferences,,2025-01-09T06:00:04.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-10815,Reflected Cross-Site Scripting Vulnerability in PostLists Plugin for WordPress,"The PostLists WordPress plugin, up to version 2.0.2, is vulnerable to a reflected cross-site scripting (XSS) issue due to improper handling of the $_SERVER['REQUEST_URI'] parameter. This flaw allows malicious actors to inject harmful scripts into the web page, potentially compromising user data in older web browsers that do not adequately protect against such attacks. Users should consider updating their plugins promptly to mitigate risks associated with this vulnerability.",WordPress,Postlists,,,0.0004299999854993075
CVE-2025-0333,CVE-2025-0333 - Proof of Concept,,https://github.com/d3do-23/cvelist/blob/main/cy-fast/sqli1.md,refferences,,2025-01-09T05:00:12.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0333,SQL Injection Vulnerability in leiyuxi cy-fast Product,"A vulnerability exists in the leiyuxi cy-fast application, specifically within the listData function located in the file /sys/role/listData. This issue arises from poorly validated input that allows attackers to manipulate the order of function arguments, resulting in SQL injection attacks. Such vulnerabilities can be exploited remotely, exposing sensitive data and potentially compromising the integrity of the database. The exploit for this vulnerability has been publicly disclosed, increasing the urgency for users to take proactive security measures.",Leiyuxi,Cy-fast,5.3,MEDIUM,0.00044999999227002263
CVE-2025-0331,CVE-2025-0331 - Proof of Concept,,https://note.zhaoj.in/share/DsijzdQDJSAp,refferences,,2025-01-09T04:31:09.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0331,Arbitrary Password Reset Vulnerability in YunzMall HTTP POST Request,"A vulnerability has been identified in YunzMall versions up to 2.4.2, specifically within the changePwd function of the ResetpwdController.php file. This weakness allows for remote manipulation of the password recovery process, potentially enabling unauthorized access to user accounts through weak recovery mechanisms. The exploit has been publicly disclosed, raising significant security concerns. Despite early notification, the vendor has not acknowledged this issue.",YunzMall,Yunzmall,6.9,MEDIUM,0.00044999999227002263
CVE-2025-0328,CVE-2025-0328 - Proof of Concept,,https://note.zhaoj.in/share/ASPsoVCrLqKK,refferences,,2025-01-09T04:31:06.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0328,Command Injection Vulnerability in KaiYuanTong ECT Platform Affects Remote Functionality,"A command injection vulnerability exists within the KaiYuanTong ECT Platform, particularly in the /public/server/runCode.php file used for handling HTTP POST requests. An attacker can manipulate the 'code' argument, potentially allowing unauthorized commands to be executed on the server. This issue can be exploited remotely, exposing the system to significant risks. Despite prior notification to the vendor, no response has been received regarding the problem.",Kaiyuantong,Ect Platform,6.9,MEDIUM,0.00044999999227002263
CVE-2024-13213,CVE-2024-13213 - Proof of Concept,,https://github.com/SingMR/HouseRent/issues/15#issue-2762127702,refferences,,2025-01-09T04:00:15.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-13213,Cross-Site Scripting Vulnerability in SingMR HouseRent Web Application,"A cross-site scripting vulnerability has been identified in the SingMR HouseRent application version 1.0. This weakness exists in the code handling requests to the endpoint /toAdminUpdateHousePage?hID=30, allowing an attacker to inject malicious scripts. The attack can be executed remotely, posing a significant risk to users' data and the overall integrity of the application. Publicly disclosed exploits may be available, emphasizing the urgency for affected users to apply security measures.",Singmr,Houserent,5.3,MEDIUM,0.00044999999227002263
CVE-2024-13212,CVE-2024-13212 - Proof of Concept,,https://github.com/SingMR/HouseRent/issues/13#issue-2762125363,refferences,,2025-01-09T04:00:12.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-13212,Unrestricted File Upload Vulnerability in SingMR HouseRent 1.0,"A serious vulnerability exists in SingMR HouseRent 1.0, allowing attackers to exploit the singleUpload/upload function found in AddHouseController.java. This flaw enables the manipulation of the file argument, leading to unrestricted file uploads. Given that this vulnerability can be exploited remotely, it poses significant risks to users of the affected product. The public disclosure of this exploit heightens the urgency for immediate remediation.",Singmr,Houserent,5.3,MEDIUM,0.00044999999227002263
CVE-2024-13211,CVE-2024-13211 - Proof of Concept,,https://github.com/SingMR/HouseRent/issues/12#issue-2762124045,refferences,,2025-01-09T03:31:06.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-13211,Improper Access Control in SingMR HouseRent 1.0,"A significant vulnerability has been identified in SingMR HouseRent version 1.0, specifically within the file AdminController.java. This flaw results in improper access controls, allowing unauthorized users to manipulate functionalities that should be restricted. The vulnerability can be exploited remotely, posing a risk of sensitive operations being performed by attackers. Public disclosure of the exploit has increased the urgency for affected users to address this security issue promptly.",Singmr,Houserent,5.3,MEDIUM,0.00044999999227002263
CVE-2024-13210,CVE-2024-13210 - Proof of Concept,,https://github.com/donglight/bookstore/issues/10#issue-2760923048,refferences,,2025-01-09T03:31:04.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-13210,Unrestricted File Upload in Donglight Bookstore System 1.0,"A vulnerability has been identified in Donglight Bookstore System 1.0, specifically in the uploadPicture function of the AdminBookController located in src/main/java/org/zdd/bookstore/web/controller/admin. An attacker can exploit this flaw to perform unrestricted file uploads, which may lead to further attacks, including remote code execution. This vulnerability poses significant security risks as it allows malicious users to upload arbitrary files, potentially compromising the system integrity. The possibility of remote exploitation makes this issue urgent and necessitates a prompt response from users to mitigate risks.",Donglight,Bookstore电商书城系统说明,5.1,MEDIUM,0.00044999999227002263
CVE-2024-13209,CVE-2024-13209 - Proof of Concept,,https://geochen.medium.com/redaxo-cms-5-18-1-cross-site-scripting-7c9a872c72f6,refferences,,2025-01-09T03:00:15.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-13209,Cross Site Scripting Vulnerability in Redaxo CMS Structure Management Page,"An exploitable cross site scripting vulnerability exists in the Structure Management Page of Redaxo CMS version 5.18.1. This vulnerability is triggered by manipulating the 'Article Name' parameter within the index.php file, allowing attackers to inject malicious scripts. The attack can be executed remotely, and despite early notifications to the vendor regarding the issue, no remedial actions have been taken. This situation poses a significant security risk to users of Redaxo CMS, as it could lead to unauthorized access and data compromise.",Redaxo,Cms,5.1,MEDIUM,0.00044999999227002263
CVE-2024-13206,CVE-2024-13206 - Proof of Concept,,https://github.com/hawkteam404/RnD_Public/blob/main/reve_av_multiple_vuln.md,refferences,,2025-01-09T03:00:09.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-13206,Incorrect Default Permissions in REVE Antivirus for Linux,"A vulnerability has been identified in REVE Antivirus version 1.0.0.0 on Linux, resulting in incorrect default permissions for a component within the file /usr/local/reveantivirus/tmp/reveinstall. This security flaw allows local attackers to exploit these permissions, leading to potential unauthorized access and manipulation. Although the vendor was notified of this issue prior to public disclosure, they did not respond. The vulnerability has been publicly disclosed and may be exploited.",Reve,Antivirus,8.5,HIGH,0.00044999999227002263
CVE-2024-13205,CVE-2024-13205 - Proof of Concept,,https://www.websecurityinsights.my.id/2024/12/ecommerce-php-by-kurniaramadhan-sql.html?m=1,refferences,,2025-01-09T02:31:04.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-13205,SQL Injection Vulnerability in E-Commerce-PHP by kurniaramadhan,"A SQL injection vulnerability exists in the E-Commerce-PHP 1.0 web application, specifically within the Create Product Page at /admin/create_product.php. This vulnerability allows an attacker to manipulate the 'Name' argument, potentially leading to unauthorized access or manipulation of the database. The flaw can be exploited remotely, posing a significant risk to users. Despite early notifications to the vendor regarding this security issue, no response has been received, leaving the issue unaddressed and exposing users to possible exploits.",Kurniaramadhan,E-commerce-PHP,5.1,MEDIUM,0.00044999999227002263
CVE-2024-13204,CVE-2024-13204 - Proof of Concept,,https://www.websecurityinsights.my.id/2024/12/ecommerce-php-by-kurniaramadhan-sql.html?m=1,refferences,,2025-01-09T02:00:17.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-13204,SQL Injection Vulnerability in E-Commerce-PHP by Kurniaramadhan,"A remote SQL injection vulnerability exists in E-Commerce-PHP 1.0, specifically within the /blog-details.php file. This flaw arises from improper handling of the blog_id parameter, allowing attackers to manipulate database queries. As a result, unauthorized access to sensitive data could occur. The vendor has not responded to initial reports regarding this issue, increasing the potential risks for those using the affected version.",Kurniaramadhan,E-commerce-PHP,5.3,MEDIUM,0.00044999999227002263
CVE-2024-13202,CVE-2024-13202 - Proof of Concept,,https://github.com/wander-chu/SpringBoot-Blog/issues/7#issue-2761643235,refferences,,2025-01-09T01:31:06.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-13202,Cross-Site Scripting Flaw in wander-chu SpringBoot-Blog by wander-chu,"A cross-site scripting vulnerability was identified in the Blog Article Handler of wander-chu SpringBoot-Blog 1.0. The issue arises from improper handling of user-supplied content within the modifiyArticle function in the PageController.java file. This flaw can be exploited remotely, allowing attackers to inject malicious scripts that can compromise user sessions or manipulate web content displayed to users. The vulnerability's public disclosure raises concerns as it might facilitate exploitation attacks against unpatched applications.",Wander-chu,Springboot-blog,5.1,MEDIUM,0.00044999999227002263
CVE-2024-13201,CVE-2024-13201 - Proof of Concept,,https://github.com/wander-chu/SpringBoot-Blog/issues/6#issue-2761640788,refferences,,2025-01-09T01:31:04.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-13201,Unrestricted File Upload Vulnerability in wander-chu SpringBoot-Blog 1.0,"A vulnerability exists in the Admin Attachment Handler of wander-chu's SpringBoot-Blog 1.0, specifically in the file upload function located in the AttachtController.java file. This flaw allows attackers to manipulate the file upload argument, resulting in unrestricted file uploads. This can lead to various malicious activities, including the ability to execute arbitrary files on the server. The attack can be conducted remotely, and despite early disclosure to the vendor, there has been no response or remediation reported.",Wander-chu,Springboot-blog,5.1,MEDIUM,0.00044999999227002263
CVE-2024-13200,CVE-2024-13200 - Proof of Concept,,https://github.com/wander-chu/SpringBoot-Blog/issues/4#issue-2761636207,refferences,,2025-01-09T01:00:14.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-13200,Improper Access Control in wander-chu SpringBoot-Blog Affects Remote Functionality,"A vulnerability exists in the wander-chu SpringBoot-Blog application version 1.0, located in the preHandle function of the BaseInterceptor.java file. This flaw results in improper access controls that can be exploited to perform unauthorized actions remotely. The potential for exploitation has been made public, raising concerns for users as the vendor has not responded to disclosures regarding this vulnerability. Users are advised to take immediate precautions to mitigate risk.",Wander-chu,Springboot-blog,6.9,MEDIUM,0.00044999999227002263
CVE-2024-13199,CVE-2024-13199 - Proof of Concept,,https://github.com/cydtseng/Vulnerability-Research/blob/main/mblog/ReflectedXSS-Search.md,refferences,,2025-01-09T00:31:06.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-13199,Cross-Site Scripting Vulnerability in langhsu Mblog Blog System,"A cross-site scripting vulnerability has been identified in the langhsu Mblog Blog System version 3.5.0, specifically within the Search Bar component. This flaw arises from improper handling of the 'kw' parameter in the '/search' file, allowing remote attackers to execute arbitrary JavaScript in the context of the affected application. Exploitation of this vulnerability poses significant security risks, including potential theft of sensitive data or session hijacking. Despite early notification, the vendor has not responded to the disclosure, highlighting the importance of prompt action from users to mitigate any risks associated with this vulnerability.",Langhsu,Mblog Blog System,5.3,MEDIUM,0.00044999999227002263
CVE-2024-13198,CVE-2024-13198 - Proof of Concept,,https://github.com/cydtseng/Vulnerability-Research/blob/main/mblog/ObservableDiscrepancy-UserLogin.md,refferences,,2025-01-09T00:31:04.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-13198,Observable Response Discrepancy in langhsu Mblog Blog System by langhsu,"A vulnerability has been identified within the langhsu Mblog Blog System version 3.5.0, specifically impacting the login functionality. This vulnerability allows attackers to exploit an observable response discrepancy, providing them the potential to execute remote attacks. The complexity of the attack is deemed high, and though public disclosure has occurred, the vendor has yet to respond to indications of the threat. Given the intricate nature of this vulnerability, prompt assessment and mitigative measures are recommended for users of the affected version.",Langhsu,Mblog Blog System,6.3,MEDIUM,0.00044999999227002263
CVE-2024-50603,CVE-2024-50603,CVE-2024-50603-nuclei-poc,https://github.com/newlinesec/CVE-2024-50603,github,0,2025-01-08T21:00:38.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-50603,Remote Code Execution Vulnerability in Aviatrix Controller by Aviatrix,"A vulnerability in Aviatrix Controller allows unauthenticated attackers to exploit improper handling of OS command elements. This security flaw enables the execution of arbitrary code through the manipulation of API requests by injecting shell metacharacters into the parameters 'cloud_type' and 'src_cloud_type'. If left unaddressed, this could lead to significant security breaches and unauthorized access to protected systems.",Aviatrix,Controller,10,CRITICAL,0.009619999676942825
CVE-2024-11613,CVE-2024-11613-wp-file-upload,Exploit by Chirag Artani for CVE-2024-11613 in WordPress File Upload,https://github.com/Sachinart/CVE-2024-11613-wp-file-upload,github,0,2025-01-08T19:06:00.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-11613,Remote Code Execution and File Manipulation in WordPress File Upload Plugin,"The WordPress File Upload plugin suffers from a significant security vulnerability that allows unauthenticated attackers to exploit the 'wfu_file_downloader.php' file. This is attributed to insufficient sanitization of the 'source' parameter, enabling attackers to dictate a directory path. Consequently, attackers can perform actions such as executing arbitrary code on the server, reading files without authorization, and deleting files. This makes it critical for users to update to the latest versions and implement additional security measures to safeguard against potential exploitation.",Nickboss,WordPress File Upload,9.8,CRITICAL,0.0015200000489130616
CVE-2015-9251,CVE-2015-9251,"This repository contains a Proof of Concept (PoC) for CVE-2015-9251, a vulnerability in jQuery versions prior to 3.0.0 that allows attackers to perform Cross-Site Scripting (XSS) attacks under certain conditions.",https://github.com/hackgiver/CVE-2015-9251,github,0,2025-01-08T19:03:02.000Z,https://securityvulnerability.io/vulnerability/CVE-2015-9251,,"jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.",Jquery,Jquery,6.1,MEDIUM,0.008679999969899654