Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
tack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256283. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.256283 - https://vuldb.com/?ctiid.256283 - https://github.com/vanitashtml/CVE-Dumps/blob/main/Blind%20SQL%20Injection%20Manage%20Category%20-%20Mobile%20Management%20Store.md
CVE ID: CVE-2024-2333 State: PUBLISHED Published: 2024-03-09T15:31:03.846Z Last Updated: 2024-08-01T19:11:53.044Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: CodeAstro Products: Membership Management System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in CodeAstro Membership Management System 1.0. Affected is an unknown function of the file /add_members.php. The manipulation of the argument fullname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256284. Additional Analyst Notes: - CISA ADP Vulnrichment: -
nd may be used. The identifier of this vulnerability is VDB-256284. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.256284 - https://vuldb.com/?ctiid.256284 - https://github.com/0x404Ming/CVE_Hunter/blob/main/SQLi-3.md
CVE ID: CVE-2024-2334 State: PUBLISHED Published: 2024-04-09T18:58:51.566Z Last Updated: 2024-08-01T19:11:53.460Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: envato Products: Template Kit – Import Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The Template Kit – Import plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the template upload functionality in all versions up to, and including, 1.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author access and above, to inject arbitrary web scripts in pages that will execute whene
authenticated attackers, with author access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6203a15d-f90f-4147-8e43-afc424bbb750?source=cve - https://plugins.trac.wordpress.org/browser/template-kit-import/trunk/vendor/template-kit-import/inc/class-importer.php#L61 - https://plugins.trac.wordpress.org/changeset/3058805/
CVE ID: CVE-2024-2335 State: PUBLISHED Published: 2024-04-09T18:59:09.386Z Last Updated: 2024-08-01T19:11:53.316Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: cssigniterteam Products: Elements Plus! Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Elements Plus! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widget link URLs in all versions up to, and including, 2.16.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions
er supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9efb7dc8-d0a1-4707-a465-6a55b2d4a426?source=cve - https://plugins.trac.wordpress.org/changeset?old_path=/elements-plus/tags/2.16.2&old=3051181&new_path=/elements-plus/tags/2.16.3&new=3051181&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2336 State: PUBLISHED Published: 2024-04-09T18:58:45.238Z Last Updated: 2024-08-01T19:11:53.527Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: danieliser Products: Popup Maker – Popup for opt-ins, lead gen, & more Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The Popup Maker – Popup for opt-ins, lead gen, & more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.18.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authentica
o insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/40e1215c-ac00-4fd6-b428-a57cef95aed1?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3053244%40popup-maker%2Ftrunk&old=2989642%40popup-maker%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2337 State: PUBLISHED Published: 2024-07-20T02:37:14.391Z Last Updated: 2024-08-01T19:11:52.484Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ghuger Products: Easy Testimonials Problem Types: CWE-79 Description: The Easy Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'testimonials_grid ' shortcode in all versions up to, and including, 3.9.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a
kers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2c470cb0-5cbc-4ae1-b75a-384668d07215?source=cve - https://plugins.trac.wordpress.org/browser/easy-testimonials/trunk/easy-testimonials.php#L1039
CVE ID: CVE-2024-2338 State: PUBLISHED Published: 2024-03-08T20:07:00.788Z Last Updated: 2024-08-01T19:11:53.446Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: DALIBO Products: PostgreSQL Anonymizer Problem Types: CWE-89 Description: PostgreSQL Anonymizer v1.2 contains a SQL injection vulnerability that allows a user who owns a table to elevate to superuser when dynamic masking is enabled. PostgreSQL Anonymizer enables users to set security labels on tables to mask specified columns. There is a flaw that allows complex expressions to be provided as a value. This expression is then later used as it to create the masked views leading to SQL Injection. If dynamic
ded as a value. This expression is then later used as it to create the masked views leading to SQL Injection. If dynamic masking is enabled, this will lead to privilege escalation to superuser after the label is created. Users that don't own a table, especially masked users cannot exploit this vulnerability. The problem is resolved in v1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/dalibo/postgresql_anonymizer/-/commit/f55daadba3fa8226029687964aa8889d01a79778
CVE ID: CVE-2024-2339 State: PUBLISHED Published: 2024-03-08T20:07:14.838Z Last Updated: 2024-08-02T19:53:36.167Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: DALIBO Products: PostgreSQL Anonymizer Problem Types: CWE-20 Description: PostgreSQL Anonymizer v1.2 contains a vulnerability that allows a user who owns a table to elevate to superuser. A user can define a masking function for a column and place malicious code in that function. When a privileged user applies the masking rules using the static masking or the anonymous dump method, the malicious code is executed and can grant escalated privileges to the malicious user. PostgreSQL Anonymizer v1.2 does pro
malicious code is executed and can grant escalated privileges to the malicious user. PostgreSQL Anonymizer v1.2 does provide a protection against this risk with the restrict_to_trusted_schemas option, but that protection is incomplete. Users that don't own a table, especially masked users cannot exploit this vulnerability. The problem is resolved in v1.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/dalibo/postgresql_anonymizer/-/commit/e517b38e62e50871b04011598e73a7308bdae9d9
CVE ID: CVE-2024-2340 State: PUBLISHED Published: 2024-04-09T18:59:06.567Z Last Updated: 2024-08-08T18:27:14.000Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: ThemeFusion Products: Avada | Website Builder For WordPress & WooCommerce Problem Types: CWE-548 Information Exposure Through Directory Listing Description: The Avada theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.11.6 via the '/wp-content/uploads/fusion-forms/' directory. This makes it possible for unauthenticated attackers to extract sensitive data uploaded via an Avada created form with a file upload mechanism. Additional Analyst Notes:
ers to extract sensitive data uploaded via an Avada created form with a file upload mechanism. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8db8bbc3-43ca-4ef5-a44d-2987c8597961?source=cve - https://avada.com/documentation/avada-changelog/
CVE ID: CVE-2024-2341 State: PUBLISHED Published: 2024-04-09T18:59:30.048Z Last Updated: 2024-08-01T19:11:53.335Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: croixhaug Products: Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the keys parameter in all versions up to, and including, 1.6.7.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparat
p to, and including, 1.6.7.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e4930b03-9142-464e-98ae-a910dfa46f2a?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3054815%40simply-schedule-appointments%2Ftrunk&old=3
ns.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3054815%40simply-schedule-appointments%2Ftrunk&old=3054636%40simply-schedule-appointments%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2342 State: PUBLISHED Published: 2024-04-09T18:58:31.245Z Last Updated: 2024-08-01T19:11:53.461Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: croixhaug Products: Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the customer_id parameter in all versions up to, and including, 1.6.7.7 due to insufficient escaping on the user supplied parameter and lack of sufficient p
sions up to, and including, 1.6.7.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0c0dd466-a78a-4b79-b9bd-5363f69d9a4c?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3054815%40simply-schedule-appointments%2Ftru
://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3054815%40simply-schedule-appointments%2Ftrunk&old=3054636%40simply-schedule-appointments%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2343 State: PUBLISHED Published: 2024-04-09T18:59:03.916Z Last Updated: 2024-08-01T19:11:53.437Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ThemeFusion Products: Avada | Website Builder For WordPress & WooCommerce Problem Types: CWE-918 Server-Side Request Forgery (SSRF) Description: The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.11.6 via the form_to_url_action function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from th
ated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/87ca07ac-6080-45d7-a8f5-74a918adec43?source=cve - https://gist.github.com/Xib3rR4dAr/55d41870c7ce0e95f454d00100bc10dc - https://avada.com/documentation/avada-changelog/
CVE ID: CVE-2024-2344 State: PUBLISHED Published: 2024-04-09T18:59:22.329Z Last Updated: 2024-08-08T20:22:32.259Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: ThemeFusion Products: Avada | Website Builder For WordPress & WooCommerce Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Avada theme for WordPress is vulnerable to SQL Injection via the 'entry' parameter in all versions up to, and including, 7.11.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticted attackers, with ed
and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticted attackers, with editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ccf0d2ca-2891-45d1-8ea2-90dd435b359f?source=cve - https://gist.github.com/Xib3rR4dAr/05a32f63d75082ab05de27e313e70fa3 - https://avada.com/documentation/avada-changelog/
CVE ID: CVE-2024-2345 State: PUBLISHED Published: 2024-05-02T16:51:46.891Z Last Updated: 2024-10-18T00:09:58.207Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ninjateam Products: FileBird – WordPress Media Library Folders & File Manager Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the folder name parameter in all versions up to, and including, 5.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,
g, 5.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/129cc3b0-4f48-4846-902e-be5cd339f537?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3060898%40filebird%2Ftrunk&old=3049188%40filebird%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2346 State: PUBLISHED Published: 2024-05-02T16:52:18.829Z Last Updated: 2024-08-01T19:11:53.414Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: ninjateam Products: FileBird – WordPress Media Library Folders & File Manager Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.3 via folder deletion due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author access or higher, to delete
n on a user controlled key. This makes it possible for authenticated attackers, with author access or higher, to delete folders created by other users and make their file uploads visible. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/82cde234-ae87-438f-911e-bdd0e3ac1132?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3060898%40filebird%2Ftrunk&old=3049188%40filebird%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2347 State: PUBLISHED Published: 2024-04-09T18:59:31.932Z Last Updated: 2024-08-01T19:11:53.309Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: brainstormforce Products: Astra Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Astra theme for WordPress is vulnerable to Stored Cross-Site Scripting via a user's display name in all versions up to, and including, 4.6.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will exe
authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ed914e67-4cf7-49b1-96be-ed8c604e6dce?source=cve - https://themes.trac.wordpress.org/changeset/221725/astra
CVE ID: CVE-2024-2348 State: PUBLISHED Published: 2024-04-09T18:59:13.691Z Last Updated: 2025-08-27T21:02:57.063Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: celomitan Products: Gum Elementor Addon Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Gum Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Meta widget in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts i
makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ade1eddf-cfcc-4956-8015-8d9a592cc252?source=cve - https://plugins.trac.wordpress.org/browser/gum-elementor-addon/trunk/widgets/blog_post_meta.php#L1171 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3051383%40gum-elementor-addon&new=3051383%40gum-elementor-addon&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2349 State: PUBLISHED Published: 2024-05-02T16:52:37.633Z Last Updated: 2024-08-01T19:11:53.424Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: hosseinhashemi Products: Fancy Elementor Flipbox Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Fancy Elementor Flipbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Fancy Elementor Flipbox widget in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to in
and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c877ac24-a6da-4e61-a669-a0224c9e3bb5?source=cve - https://plugins.trac.wordpress.org/browser/fancy-elementor-flipbox/trunk/widgets/fancy-elementor-flipbox.php#L744
CVE ID: CVE-2024-2350 State: PUBLISHED Published: 2024-06-06T02:03:01.411Z Last Updated: 2024-08-01T19:11:53.406Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: zootemplate Products: Clever Addons for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Clever Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the CAFE Icon, CAFE Team Member, and CAFE Slider widgets in all versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-le
fficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ca5befe9-7769-4367-84cf-05aabeced67a?source=cve - https://plugins.trac.wordpress.org/browser/cafe-lite/trunk/src/widgets/class-clever-icon.php#L396 - https://plugins.trac.wordpress.org/browser/cafe-lite/trunk/src/widgets/class-clever-team-member.php#L948 - https://plugins.trac.wordpress.org/browser/cafe-lit
wser/cafe-lite/trunk/src/widgets/class-clever-team-member.php#L948 - https://plugins.trac.wordpress.org/browser/cafe-lite/trunk/src/widgets/class-clever-slider.php#L1394
CVE ID: CVE-2024-2351 State: PUBLISHED Published: 2024-03-09T22:31:08.594Z Last Updated: 2024-08-01T19:11:53.534Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: CodeAstro Products: Ecommerce Site Problem Types: CWE-89 Description: A vulnerability classified as critical was found in CodeAstro Ecommerce Site 1.0. Affected by this vulnerability is an unknown functionality of the file action.php of the component Search. The manipulation of the argument cat_id/brand_id/keyword leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256303. Additional Analyst Note