Update CVE sources 2024-08-24 17:55

0xMarcio · Aug 24, 2024 · 8d17e0c · 8d17e0c
1 parent 7f567c1
commit 8d17e0c
Show file tree

Hide file tree

Showing 184 changed files with 2,149 additions and 15 deletions.
diff --git a/2014/CVE-2014-4210.md b/2014/CVE-2014-4210.md
@@ -86,6 +86,7 @@ Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusi
 - https://github.com/password520/RedTeamer
 - https://github.com/pwnagelabs/VEF
 - https://github.com/qi4L/WeblogicScan.go
+- https://github.com/qiuluo-oss/Tiger
 - https://github.com/rabbitmask/WeblogicScan
 - https://github.com/rabbitmask/WeblogicScanLot
 - https://github.com/rabbitmask/WeblogicScanServer

diff --git a/2016/CVE-2016-3088.md b/2016/CVE-2016-3088.md
@@ -55,6 +55,7 @@ The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remot
 - https://github.com/pravinsrc/NOTES-windows-kernel-links
 - https://github.com/pudiding/CVE-2016-3088
 - https://github.com/qazbnm456/awesome-cve-poc
+- https://github.com/qiuluo-oss/Tiger
 - https://github.com/retr0-13/Goby
 - https://github.com/sponkmonk/Ladon_english_update
 - https://github.com/t0m4too/t0m4to

diff --git a/2017/CVE-2017-12615.md b/2017/CVE-2017-12615.md
@@ -91,6 +91,7 @@ When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.
 - https://github.com/q99266/saury-vulnhub
 - https://github.com/qazbnm456/awesome-cve-poc
 - https://github.com/qiantu88/Tomcat-Exploit
+- https://github.com/qiuluo-oss/Tiger
 - https://github.com/qiwentaidi/Slack
 - https://github.com/r0eXpeR/redteam_vul
 - https://github.com/safe6Sec/PentestNote

diff --git a/2017/CVE-2017-14849.md b/2017/CVE-2017-14849.md
@@ -41,6 +41,7 @@ No PoCs from references.
 - https://github.com/merlinepedra25/nuclei-templates
 - https://github.com/openx-org/BLEN
 - https://github.com/q99266/saury-vulnhub
+- https://github.com/qiuluo-oss/Tiger
 - https://github.com/ronoski/j2ee-rscan
 - https://github.com/snyk-labs/container-breaking-in-goof
 - https://github.com/sobinge/nuclei-templates

diff --git a/2017/CVE-2017-16894.md b/2017/CVE-2017-16894.md
@@ -26,5 +26,6 @@ In Laravel framework through 5.5.21, remote attackers can obtain sensitive infor
 - https://github.com/Threekiii/Awesome-POC
 - https://github.com/Z0fhack/Goby_POC
 - https://github.com/d4n-sec/d4n-sec.github.io
+- https://github.com/qiuluo-oss/Tiger
 - https://github.com/v4p0r/rooon-fiuuu
 
diff --git a/2017/CVE-2017-18349.md b/2017/CVE-2017-18349.md
@@ -37,4 +37,5 @@ parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0
 - https://github.com/luckyfuture0177/VULOnceMore
 - https://github.com/openx-org/BLEN
 - https://github.com/pan2013e/ppt4j
+- https://github.com/qiuluo-oss/Tiger
 
diff --git a/2018/CVE-2018-1273.md b/2018/CVE-2018-1273.md
@@ -67,6 +67,7 @@ Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older
 - https://github.com/nBp1Ng/SpringFramework-Vul
 - https://github.com/onewinner/VulToolsKit
 - https://github.com/qazbnm456/awesome-cve-poc
+- https://github.com/qiuluo-oss/Tiger
 - https://github.com/ronoski/j2ee-rscan
 - https://github.com/seal-community/patches
 - https://github.com/snowlovely/HacLang

diff --git a/2018/CVE-2018-18778.md b/2018/CVE-2018-18778.md
@@ -36,4 +36,5 @@ No PoCs from references.
 - https://github.com/openx-org/BLEN
 - https://github.com/petitfleur/prov_navigator
 - https://github.com/provnavigator/prov_navigator
+- https://github.com/qiuluo-oss/Tiger
 
diff --git a/2019/CVE-2019-0232.md b/2019/CVE-2019-0232.md
@@ -41,6 +41,7 @@ When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in
 - https://github.com/nomi-sec/PoC-in-GitHub
 - https://github.com/pyn3rd/CVE-2019-0232
 - https://github.com/qazbnm456/awesome-cve-poc
+- https://github.com/qiuluo-oss/Tiger
 - https://github.com/r0eXpeR/redteam_vul
 - https://github.com/rootameen/vulpine
 - https://github.com/safe6Sec/PentestNote

diff --git a/2019/CVE-2019-11358.md b/2019/CVE-2019-11358.md
@@ -3598,6 +3598,7 @@ jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishan
 - https://github.com/pcrobotics2/2023-15425-CenterStage
 - https://github.com/pcrobotics2/2023-19545-CenterStage
 - https://github.com/pcrobotics2/2023-22130-CenterStage
+- https://github.com/perfectparadox8400/8400_2024
 - https://github.com/petergriffinnn/code
 - https://github.com/petthepotat-dump/FTC-22-23-Refactored
 - https://github.com/pgdev1729/FTC-Robot-Controller-Centerstage

diff --git a/2020/CVE-2020-10199.md b/2020/CVE-2020-10199.md
@@ -88,6 +88,7 @@ Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).
 - https://github.com/xuetusummer/Penetration_Testing_POC
 - https://github.com/yedada-wei/-
 - https://github.com/yedada-wei/gongkaishouji
+- https://github.com/zhaojunliing/awesome-stars
 - https://github.com/zhzyker/CVE-2020-10199_POC-EXP
 - https://github.com/zhzyker/exphub
 - https://github.com/zoroqi/my-awesome

diff --git a/2020/CVE-2020-10204.md b/2020/CVE-2020-10204.md
@@ -77,6 +77,7 @@ Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.
 - https://github.com/xuetusummer/Penetration_Testing_POC
 - https://github.com/yedada-wei/-
 - https://github.com/yedada-wei/gongkaishouji
+- https://github.com/zhaojunliing/awesome-stars
 - https://github.com/zhzyker/CVE-2020-10204
 - https://github.com/zhzyker/exphub
 - https://github.com/zoroqi/my-awesome

diff --git a/2020/CVE-2020-11444.md b/2020/CVE-2020-11444.md
@@ -48,6 +48,7 @@ Sonatype Nexus Repository Manager 3.x up to and including 3.21.2 has Incorrect A
 - https://github.com/soosmile/POC
 - https://github.com/weeka10/-hktalent-TOP
 - https://github.com/whoadmin/pocs
+- https://github.com/zhaojunliing/awesome-stars
 - https://github.com/zhzyker/CVE-2020-11444
 - https://github.com/zhzyker/exphub
 - https://github.com/zoroqi/my-awesome

diff --git a/2020/CVE-2020-13945.md b/2020/CVE-2020-13945.md
@@ -24,6 +24,7 @@ In Apache APISIX, the user enabled the Admin API and deleted the Admin API acces
 - https://github.com/bakery312/Vulhub-Reproduce
 - https://github.com/bigblackhat/oFx
 - https://github.com/openx-org/BLEN
+- https://github.com/qiuluo-oss/Tiger
 - https://github.com/samurai411/toolbox
 - https://github.com/t0m4too/t0m4to
 - https://github.com/tanjiti/sec_profile

diff --git a/2020/CVE-2020-14882.md b/2020/CVE-2020-14882.md
@@ -190,6 +190,7 @@ Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware
 - https://github.com/yichensec/Bug_writer
 - https://github.com/yyzsec/2021SecWinterTask
 - https://github.com/zer0yu/Awesome-CobaltStrike
+- https://github.com/zhaojunliing/awesome-stars
 - https://github.com/zhzyker/exphub
 - https://github.com/zhzyker/vulmap
 - https://github.com/zoroqi/my-awesome

diff --git a/2020/CVE-2020-1938.md b/2020/CVE-2020-1938.md
@@ -216,6 +216,7 @@ When using the Apache JServ Protocol (AJP), care must be taken when trusting inc
 - https://github.com/yedada-wei/gongkaishouji
 - https://github.com/yq1ng/Java
 - https://github.com/ze0r/GhostCat-LFI-exp
+- https://github.com/zhaojunliing/awesome-stars
 - https://github.com/zhzyker/exphub
 - https://github.com/zoroqi/my-awesome
 
diff --git a/2020/CVE-2020-2551.md b/2020/CVE-2020-2551.md
@@ -176,6 +176,7 @@ Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware
 - https://github.com/yedada-wei/-
 - https://github.com/yedada-wei/gongkaishouji
 - https://github.com/zema1/oracle-vuln-crawler
+- https://github.com/zhaojunliing/awesome-stars
 - https://github.com/zhzyker/exphub
 - https://github.com/zoroqi/my-awesome
 - https://github.com/zzwlpx/weblogicPoc

diff --git a/2020/CVE-2020-2555.md b/2020/CVE-2020-2555.md
@@ -163,6 +163,7 @@ Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (compo
 - https://github.com/xuetusummer/Penetration_Testing_POC
 - https://github.com/yedada-wei/-
 - https://github.com/yedada-wei/gongkaishouji
+- https://github.com/zhaojunliing/awesome-stars
 - https://github.com/zhzyker/exphub
 - https://github.com/zhzyker/vulmap
 - https://github.com/zoroqi/my-awesome

diff --git a/2020/CVE-2020-2883.md b/2020/CVE-2020-2883.md
@@ -125,6 +125,7 @@ Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware
 - https://github.com/xuetusummer/Penetration_Testing_POC
 - https://github.com/yedada-wei/-
 - https://github.com/yedada-wei/gongkaishouji
+- https://github.com/zhaojunliing/awesome-stars
 - https://github.com/zhzyker/exphub
 - https://github.com/zhzyker/vulmap
 - https://github.com/zoroqi/my-awesome

diff --git a/2020/CVE-2020-5410.md b/2020/CVE-2020-5410.md
@@ -71,6 +71,7 @@ No PoCs from references.
 - https://github.com/pen4uin/vulnerability-research
 - https://github.com/pen4uin/vulnerability-research-list
 - https://github.com/pentration/gongkaishouji
+- https://github.com/qiuluo-oss/Tiger
 - https://github.com/readloud/Awesome-Stars
 - https://github.com/ronoski/j2ee-rscan
 - https://github.com/shadowsock5/spring-cloud-config-starter

diff --git a/2021/CVE-2021-21315.md b/2021/CVE-2021-21315.md
@@ -49,6 +49,7 @@ No PoCs from references.
 - https://github.com/mmk-1/kubernetes-poc
 - https://github.com/n1sh1th/CVE-POC
 - https://github.com/peiqiF4ck/WebFrameworkTools-5.1-main
+- https://github.com/qiuluo-oss/Tiger
 - https://github.com/slimtoolkit/slim
 - https://github.com/soosmile/POC
 - https://github.com/superlink996/chunqiuyunjingbachang

diff --git a/2021/CVE-2021-3129.md b/2021/CVE-2021-3129.md
@@ -119,6 +119,7 @@ Ignition before 2.5.2, as used in Laravel and other products, allows unauthentic
 - https://github.com/pen4uin/vulnerability-research
 - https://github.com/pen4uin/vulnerability-research-list
 - https://github.com/qingchenhh/Tools-collection
+- https://github.com/qiuluo-oss/Tiger
 - https://github.com/r3volved/CVEAggregate
 - https://github.com/ramimac/aws-customer-security-incidents
 - https://github.com/randolphcyg/nuclei-plus

diff --git a/2021/CVE-2021-45232.md b/2021/CVE-2021-45232.md
@@ -57,6 +57,7 @@ No PoCs from references.
 - https://github.com/pen4uin/awesome-vulnerability-research
 - https://github.com/pen4uin/vulnerability-research
 - https://github.com/pen4uin/vulnerability-research-list
+- https://github.com/qiuluo-oss/Tiger
 - https://github.com/soosmile/POC
 - https://github.com/t0m4too/t0m4to
 - https://github.com/trhacknon/Pocingit

diff --git a/2022/CVE-2022-1526.md b/2022/CVE-2022-1526.md
@@ -11,6 +11,7 @@ A vulnerability, which was classified as problematic, was found in Emlog Pro up
 
 #### Reference
 - https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/emlog%3C=pro-1.2.2%20Stored%20Cross-Site%20Scripting(XSS).md
+- https://vuldb.com/?id.198705
 
 #### Github
 No PoCs found on GitHub currently.

diff --git a/2022/CVE-2022-40734.md b/2022/CVE-2022-40734.md
@@ -23,4 +23,5 @@ UniSharp laravel-filemanager (aka Laravel Filemanager) before 2.6.4 allows downl
 - https://github.com/Miraitowa70/POC-Notes
 - https://github.com/Threekiii/Awesome-POC
 - https://github.com/d4n-sec/d4n-sec.github.io
+- https://github.com/qiuluo-oss/Tiger
 
diff --git a/2022/CVE-2022-41678.md b/2022/CVE-2022-41678.md
@@ -20,6 +20,7 @@ No PoCs from references.
 - https://github.com/Threekiii/Vulhub-Reproduce
 - https://github.com/bakery312/Vulhub-Reproduce
 - https://github.com/d4n-sec/d4n-sec.github.io
+- https://github.com/qiuluo-oss/Tiger
 - https://github.com/tanjiti/sec_profile
 - https://github.com/wjlin0/poc-doc
 - https://github.com/wy876/POC

diff --git a/2022/CVE-2022-43634.md b/2022/CVE-2022-43634.md
@@ -13,5 +13,6 @@ This vulnerability allows remote attackers to execute arbitrary code on affected
 No PoCs from references.
 
 #### Github
+- https://github.com/DiRaltvein/memory-corruption-examples
 - https://github.com/fkie-cad/nvd-json-data-feeds
 
diff --git a/2023/CVE-2023-0926.md b/2023/CVE-2023-0926.md
@@ -0,0 +1,17 @@
+### [CVE-2023-0926](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0926)
+![](https://img.shields.io/static/v1?label=Product&message=Custom%20Permalinks&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=*%3C%3D%202.6.0%20&color=brighgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brighgreen)
+
+### Description
+
+The Custom Permalinks plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.0 due to insufficient input sanitization and output escaping on tag names. This allows authenticated users, with editor-level permissions or greater to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, even when 'unfiltered_html' has been disabled.
+
+### POC
+
+#### Reference
+- https://github.com/samiahmedsiddiqui/custom-permalinks/pull/96
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2023/CVE-2023-2414.md b/2023/CVE-2023-2414.md
@@ -1,11 +1,11 @@
 ### [CVE-2023-2414](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2414)
 ![](https://img.shields.io/static/v1?label=Product&message=Online%20Booking%20%26%20Scheduling%20Calendar%20for%20WordPress%20by%20vcita&color=blue)
-![](https://img.shields.io/static/v1?label=Version&message=*%3C%3D%204.2.10%20&color=brighgreen)
+![](https://img.shields.io/static/v1?label=Version&message=*%3C%3D%204.4.6%20&color=brighgreen)
 ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%20Missing%20Authorization&color=brighgreen)
 
 ### Description
 
-The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_save_settings_callback function in versions up to, and including, 4.2.10. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to modify the plugins settings, upload media files, and inject malicious JavaScript.
+The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_save_settings_callback function in versions up to, and including, 4.4.6. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to modify the plugins settings, upload arbitrary files, and inject malicious JavaScript (before 4.3.2).
 
 ### POC
 

diff --git a/2023/CVE-2023-27772.md b/2023/CVE-2023-27772.md
@@ -0,0 +1,17 @@
+### [CVE-2023-27772](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27772)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)
+
+### Description
+
+libiec61850 v1.5.1 was discovered to contain a segmentation violation via the function ControlObjectClient_setOrigin() at /client/client_control.c.
+
+### POC
+
+#### Reference
+- https://github.com/mz-automation/libiec61850/issues/442
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2023/CVE-2023-38646.md b/2023/CVE-2023-38646.md
@@ -83,6 +83,7 @@ Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 all
 - https://github.com/passwa11/2023Hvv_
 - https://github.com/passwa11/CVE-2023-38646
 - https://github.com/peiqiF4ck/WebFrameworkTools-5.1-main
+- https://github.com/qiuluo-oss/Tiger
 - https://github.com/raytheon0x21/CVE-2023-38646
 - https://github.com/robotmikhro/CVE-2023-38646
 - https://github.com/samurai411/toolbox

diff --git a/2023/CVE-2023-41101.md b/2023/CVE-2023-41101.md
@@ -0,0 +1,17 @@
+### [CVE-2023-41101](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-41101)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)
+
+### Description
+
+An issue was discovered in the captive portal in OpenNDS before version 10.1.3. get_query in http_microhttpd.c does not validate the length of the query string of GET requests. This leads to a stack-based buffer overflow in versions 9.x and earlier, and to a heap-based buffer overflow in versions 10.x and later. Attackers may exploit the issue to crash OpenNDS (Denial-of-Service condition) or to inject and execute arbitrary bytecode (Remote Code Execution). Affected OpenNDS before version 10.1.3 fixed in OpenWrt master and OpenWrt 23.05 on 23. November by updating OpenNDS to version 10.2.0.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/DiRaltvein/memory-corruption-examples
+
diff --git a/2023/CVE-2023-4442.md b/2023/CVE-2023-4442.md
@@ -10,7 +10,7 @@ A vulnerability was found in SourceCodester Free Hospital Management System for
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://vuldb.com/?id.237563
 
 #### Github
 - https://github.com/fkie-cad/nvd-json-data-feeds

diff --git a/2023/CVE-2023-4449.md b/2023/CVE-2023-4449.md
@@ -0,0 +1,17 @@
+### [CVE-2023-4449](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4449)
+![](https://img.shields.io/static/v1?label=Product&message=Free%20and%20Open%20Source%20Inventory%20Management%20System&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3D%201.0%20&color=brighgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%20SQL%20Injection&color=brighgreen)
+
+### Description
+
+A vulnerability was found in SourceCodester Free and Open Source Inventory Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /index.php?page=member. The manipulation of the argument columns[0][data] leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-237570 is the identifier assigned to this vulnerability.
+
+### POC
+
+#### Reference
+- https://vuldb.com/?id.237570
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2023/CVE-2023-44709.md b/2023/CVE-2023-44709.md
@@ -13,5 +13,5 @@ PlutoSVG commit 336c02997277a1888e6ccbbbe674551a0582e5c4 and before was discover
 - https://github.com/sammycage/plutosvg/issues/7
 
 #### Github
-No PoCs found on GitHub currently.
+- https://github.com/DiRaltvein/memory-corruption-examples
 
diff --git a/2023/CVE-2023-4741.md b/2023/CVE-2023-4741.md
@@ -10,7 +10,7 @@ A vulnerability has been found in IBOS OA 4.5.5 and classified as critical. This
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://vuldb.com/?id.238630
 
 #### Github
 - https://github.com/nomi-sec/PoC-in-GitHub

diff --git a/2023/CVE-2023-4745.md b/2023/CVE-2023-4745.md
@@ -11,6 +11,7 @@ A vulnerability was found in Byzoro Smart S45F Multi-Service Secure Gateway Inte
 
 #### Reference
 - https://github.com/Jacky-Y/vuls/blob/main/vul6.md
+- https://vuldb.com/?id.238634
 
 #### Github
 No PoCs found on GitHub currently.

diff --git a/2023/CVE-2023-49485.md b/2023/CVE-2023-49485.md
@@ -0,0 +1,17 @@
+### [CVE-2023-49485](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49485)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)
+
+### Description
+
+JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the column management department.
+
+### POC
+
+#### Reference
+- https://github.com/Rabb1ter/cms/blob/main/There%20is%20a%20storage%20type%20XSS%20in%20the%20column%20management%20department.md
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2023/CVE-2023-4987.md b/2023/CVE-2023-4987.md
@@ -11,6 +11,7 @@ A vulnerability, which was classified as critical, has been found in infinitiete
 
 #### Reference
 - http://packetstormsecurity.com/files/174760/Taskhub-2.8.7-SQL-Injection.html
+- https://vuldb.com/?id.239798
 
 #### Github
 No PoCs found on GitHub currently.

diff --git a/2023/CVE-2023-4991.md b/2023/CVE-2023-4991.md
@@ -0,0 +1,17 @@
+### [CVE-2023-4991](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4991)
+![](https://img.shields.io/static/v1?label=Product&message=QWAlerter&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3D%204.50%20&color=brighgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-428%20Unquoted%20Search%20Path&color=brighgreen)
+
+### Description
+
+A vulnerability was found in NextBX QWAlerter 4.50. It has been rated as critical. Affected by this issue is some unknown functionality of the file QWAlerter.exe. The manipulation leads to unquoted search path. It is possible to launch the attack on the local host. The identifier of this vulnerability is VDB-239804. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
+
+### POC
+
+#### Reference
+- https://vuldb.com/?id.239804
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2024/CVE-2024-20767.md b/2024/CVE-2024-20767.md
@@ -24,6 +24,7 @@ No PoCs from references.
 - https://github.com/m-cetin/CVE-2024-20767
 - https://github.com/netlas-io/netlas-dorks
 - https://github.com/nomi-sec/PoC-in-GitHub
+- https://github.com/qiuluo-oss/Tiger
 - https://github.com/tanjiti/sec_profile
 - https://github.com/trganda/starrlist
 - https://github.com/wjlin0/poc-doc