Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f0edfebc-bf6b-4346-9cd7-ce00007e3620?source=cve - https://plugins.trac.wordpress.org/browser/brizy/trunk/public/editor-build/282-wp/editor/js - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3086506%40brizy%2Ftrunk&old=3058896%40brizy%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-3668 State: PUBLISHED Published: 2024-06-08T04:32:36.859Z Last Updated: 2024-08-01T20:20:00.472Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: PowerPack Products: PowerPack Pro for Elementor Problem Types: CWE-732 Incorrect Permission Assignment for Critical Resource Description: The PowerPack Pro for Elementor plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.10.17. This is due to the plugin not restricting low privileged users from setting a default role for a registration form. This makes it possible for authenticated attackers, with contributor-level access and above, to create a registrat
form. This makes it possible for authenticated attackers, with contributor-level access and above, to create a registration form with administrator set as the default role and then register as an administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/249ccc77-0daf-41bc-b5c5-991bf17d645d?source=cve - https://powerpackelements.com/change-logs/
CVE ID: CVE-2024-3669 State: PUBLISHED Published: 2024-07-30T06:00:06.976Z Last Updated: 2024-08-01T20:20:01.025Z Vendors: Unknown Products: Web Directory Free Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Web Directory Free WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/3c37c9a9-1424-427a-adc7-c2336a47e9cf/
CVE ID: CVE-2024-3670 State: PUBLISHED Published: 2024-05-02T16:52:10.332Z Last Updated: 2024-08-01T20:20:01.156Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: harmr Products: Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mapsmarker' shortcode in all versions up to, and including, 3.12.8 due to insufficient input sanitization and output escaping on user supplied attributes such a
to, and including, 3.12.8 due to insufficient input sanitization and output escaping on user supplied attributes such as 'mapwidthunit'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/62ace939-3c14-4e68-897b-ec845182ca50?source=cve - https://plugins.trac.wordpress.org/changeset/3069915/leaflet-maps-marker/trunk/inc/showmap.php
CVE ID: CVE-2024-3671 State: PUBLISHED Published: 2024-05-22T07:37:21.172Z Last Updated: 2024-08-01T20:20:00.558Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: baden03 Products: Print-O-Matic Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Print-O-Matic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'print-me' shortcode in all versions up to, and including, 2.1.10 due to insufficient input sanitization and output escaping on user supplied attributes such as 'tag'. This makes it possible for authenticated attackers, with contributor-level access a
r supplied attributes such as 'tag'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/10ea8f3a-35d6-494e-90f6-9165320cf99c?source=cve - https://wordpress.org/plugins/print-o-matic/
CVE ID: CVE-2024-3672 State: PUBLISHED Published: 2024-04-16T12:51:47.349Z Last Updated: 2024-08-01T20:20:00.941Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bookingalgorithms Products: BA Book Everything Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'all-items' shortcode in all versions up to, and including, 1.6.8 due to insufficient input sanitization and output escaping on user supplied attributes such as 'classes'. This makes it possible for authenticated attackers, with co
tput escaping on user supplied attributes such as 'classes'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b0ce06d3-491e-4565-8b26-f33937aee3e8?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3070808%40ba-book-everything&new=3070808%40ba-book-everything&sfp_email=&sfph_mail=
CVE ID: CVE-2024-3673 State: PUBLISHED Published: 2024-08-30T06:00:02.162Z Last Updated: 2024-08-30T18:16:23.243Z Vendors: Unknown Products: Web Directory Free Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The Web Directory Free WordPress plugin before 1.7.3 does not validate a parameter before using it in an include(), which could lead to Local File Inclusion issues. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0e8930cb-e176-4406-a43f-a6032471debf/
CVE ID: CVE-2024-3674 State: PUBLISHED Published: 2024-05-02T16:52:05.733Z Last Updated: 2024-08-01T20:20:00.577Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: meitar Products: Inline Google Spreadsheet Viewer Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Inline Google Spreadsheet Viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gdoc' shortcode in all versions up to, and including, 0.13.2 due to insufficient input sanitization and output escaping on user supplied attributes such as 'chart_resolution'. This makes it possible for authentica
zation and output escaping on user supplied attributes such as 'chart_resolution'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/523e80a5-dffa-4eb6-8f7a-e179e0dc4d28?source=cve - https://wordpress.org/plugins/inline-google-spreadsheet-viewer/
CVE ID: CVE-2024-3675 State: PUBLISHED Published: 2024-05-02T16:51:56.892Z Last Updated: 2024-08-01T20:20:01.086Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wproyal Products: Royal Elementor Addons and Templates Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Flip Carousel, Flip Box, Post Grid, and Taxonomy List widgets in all versions up to, and including, 1.3.971 due to insufficient input sanitization and output escaping on user supplied attributes. This make
and including, 1.3.971 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/337cbec1-c8a8-41b5-8c32-779be671120f?source=cve - https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/modules/flip-carousel/widgets/wpr-flip-carousel.php#L1191 - https://plugins.trac.wordpress.org/browser/royal-elementor-addon
les/flip-carousel/widgets/wpr-flip-carousel.php#L1191 - https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/modules/flip-box/widgets/wpr-flip-box.php#L1903 - https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/modules/grid/widgets/wpr-grid.php#L8567 - https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/modules/taxonomy-list/widgets/wpr-taxonomy-list.php#L621 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3072880%40royal-elementor-addons&new=3072880%40royal-elementor-addons&sfp_email=&sfph_mail=
CVE ID: CVE-2024-3676 State: PUBLISHED Published: 2024-05-14T19:07:19.420Z Last Updated: 2024-08-01T20:19:59.948Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Proofpoint Products: Enterprise Protection Problem Types: CWE-20 Description: The Proofpoint Encryption endpoint of Proofpoint Enterprise Protection contains an Improper Input Validation vulnerability that allows an unauthenticated remote attacker with a specially crafted HTTP request to create additional Encryption user accounts under the attacker's control. These accounts are able to send spoofed email to any users within the domains configured by the Administrator. Additional Analyst Notes: - CISA
to send spoofed email to any users within the domains configured by the Administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2024-0002
CVE ID: CVE-2024-3677 State: PUBLISHED Published: 2024-05-02T16:52:16.923Z Last Updated: 2024-08-15T14:24:24.062Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: tinyweb Products: Ultimate 410 Gone Status Code Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Ultimate 410 Gone Status Code plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 410 entries in all versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary
caping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7c10be28-43ff-4b43-8186-6ad9a487321e?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3074532%40ultimate-410&new=3074532%40ultimate-410&sfp_email=&sfph_mail=
CVE ID: CVE-2024-3678 State: PUBLISHED Published: 2024-04-26T07:28:18.777Z Last Updated: 2024-08-01T20:20:00.497Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: pr-gateway Products: Blog2Social: Social Media Auto Post & Scheduler Problem Types: CWE-862 Missing Authorization Description: The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.4.2. This makes it possible for unauthenticated attackers to view limited information from password protected posts. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://w
ord protected posts. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2dea1bcb-14c2-4ec9-8a4d-087bac2db486?source=cve - https://plugins.trac.wordpress.org/changeset/3069574/blog2social/trunk/includes/Meta.php - https://plugins.trac.wordpress.org/changeset/3074883/blog2social/trunk/includes/Meta.php
CVE ID: CVE-2024-3679 State: PUBLISHED Published: 2024-08-29T12:31:10.777Z Last Updated: 2024-08-29T13:16:08.799Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: calinvingan Products: Premium SEO Pack – WP SEO Plugin Problem Types: CWE-200 Description: The Premium SEO Pack – WP SEO Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.001. This makes it possible for unauthenticated attackers to view limited information from password protected posts through the social meta data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ccb65de5-bfb5-47db-87c9-ad46e65924b8?source=cve - https://wordpress.org/plugins/premium-seo-pack/
CVE ID: CVE-2024-3680 State: PUBLISHED Published: 2024-05-09T20:03:22.341Z Last Updated: 2024-08-01T20:20:01.043Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themelooks Products: Enter Addons – Ultimate Template Builder for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Enter Addons – Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Animation Title widget's img tag in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticat
and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/29cc82cb-f3fd-4de5-9731-7ceb1212b0f9?source=cve - https://wordpress.org/plugins/enteraddons/
CVE ID: CVE-2024-3681 State: PUBLISHED Published: 2024-05-02T16:57:17.296Z Last Updated: 2024-08-01T20:20:00.689Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: cmoreira Products: Interactive World Maps Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Interactive World Maps plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search (s) parameter in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if th
caping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c9295b82-27c1-4f35-b40c-1ac40ebe5d5e?source=cve - https://codecanyon.net/item/interactive-world-maps/2874264
CVE ID: CVE-2024-3682 State: PUBLISHED Published: 2024-04-26T09:29:51.745Z Last Updated: 2024-08-01T20:20:00.842Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: renehermi, WPStaging Products: WP STAGING WordPress Backup Plugin – Migration Backup Restore, WP STAGING Pro WordPress Backup Plugin Problem Types: CWE-200 Information Exposure Description: The WP STAGING and WP STAGING Pro plugins for WordPress are vulnerable to Sensitive Information Exposure in versions up to, and including, 3.4.3, and versions up to, and including, 5.4.3, respectively, via the ajaxSendReport function. This makes it possible for unauthenticated attackers to extract sensitive data
tively, via the ajaxSendReport function. This makes it possible for unauthenticated attackers to extract sensitive data from a log file, including system information and (in the Pro version) license keys. Successful exploitation requires an administrator to have used the 'Contact Us' functionality along with the "Enable this option to automatically submit the log files." option. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/75eab54b-dbe0-4440-b4ab-601c5041e180?source=cve - https://wp-staging.com/wp-staging-changelog/ - https://wp-staging.com/wp-staging-pro-changelog/ - https://plugins.trac.w
https://wp-staging.com/wp-staging-changelog/ - https://wp-staging.com/wp-staging-pro-changelog/ - https://plugins.trac.wordpress.org/changeset/3076275/wp-staging
CVE ID: CVE-2024-3684 State: PUBLISHED Published: 2024-04-19T14:25:24.638Z Last Updated: 2024-08-01T20:20:00.537Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: GitHub Products: Enterprise Server Problem Types: CWE-88 Description: A server side request forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin access to the appliance when configuring the Artifacts & Logs and Migrations Storage. Exploitation of this vulnerability required access to the GitHub Enterprise Server instance and access to the Management Console with the editor role. This vulnerability affected a
tHub Enterprise Server instance and access to the Management Console with the editor role. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in versions 3.12.2, 3.11.8, 3.10.10, and 3.9.13. This vulnerability was reported via the GitHub Bug Bounty program. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.13 - https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.10 - https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.8 - https://docs.github.com/en/enterprise-server@3.12/admin/release-notes
nterprise-server@3.11/admin/release-notes#3.11.8 - https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.2
CVE ID: CVE-2024-3685 State: PUBLISHED Published: 2024-04-12T13:00:08.343Z Last Updated: 2024-08-12T13:07:36.782Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: DedeCMS Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in DedeCMS 5.7.112-UTF8. Affected is an unknown function of the file stepselect_main.php. The manipulation of the argument ids leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-260472. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Addit
rability is VDB-260472. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.260472 - https://vuldb.com/?ctiid.260472 - https://vuldb.com/?submit.309447 - https://github.com/Echosssy/CVE/blob/main/Dedecms%E6%9C%80%E6%96%B0%E7%89%88SQL%E6%B3%A8%E5%85%A5.docx
CVE ID: CVE-2024-3686 State: PUBLISHED Published: 2024-04-12T13:31:04.514Z Last Updated: 2024-08-15T15:44:09.447Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: n/a Products: DedeCMS Problem Types: CWE-24 Description: A vulnerability has been found in DedeCMS 5.7.112-UTF8 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file update_guide.php. The manipulation of the argument files leads to path traversal: '../filedir'. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260473 was assigned to this vulnerability. NOTE: The vendor was contacted ea
public and may be used. The identifier VDB-260473 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.260473 - https://vuldb.com/?ctiid.260473 - https://vuldb.com/?submit.309454 - https://github.com/Echosssy/CVE/blob/main/Dedecms%E6%9C%80%E6%96%B0%E7%89%88%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E5%88%A0%E9%99%A4%E7%BB%95%E8%BF%87.pdf
CVE ID: CVE-2024-3687 State: PUBLISHED Published: 2024-04-12T14:00:06.271Z Last Updated: 2024-08-01T20:20:01.418Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: bihell Products: Dice Problem Types: CWE-79 Description: A vulnerability was found in bihell Dice 3.1.0 and classified as problematic. Affected by this issue is some unknown functionality of the component Comment Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-260474 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https:/
to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.260474 - https://vuldb.com/?ctiid.260474 - https://vuldb.com/?submit.309445 - https://github.com/fubxx/CVE/blob/main/DiceCMS-XSS.md
CVE ID: CVE-2024-3688 State: PUBLISHED Published: 2024-04-12T14:00:07.951Z Last Updated: 2024-08-01T20:20:00.489Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Xiamen Four-Faith Products: RMP Router Management Platform Problem Types: CWE-89 Description: A vulnerability was found in Xiamen Four-Faith RMP Router Management Platform 5.2.2. It has been declared as critical. This vulnerability affects unknown code of the file /Device/Device/GetDeviceInfoList?deviceCode=&searchField=&deviceState=. The manipulation of the argument groupId leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this
attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-260476. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.260476 - https://vuldb.com/?ctiid.260476 - https://vuldb.com/?submit.309455 - https://github.com/Echosssy/CVE/tree/main