Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-9317 State: PUBLISHED Published: 2024-09-28T21:00:05.971Z Last Updated: 2024-09-30T15:37:33.124Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Eyewear Shop Problem Types: CWE-89 Description: A vulnerability classified as critical was found in SourceCodester Online Eyewear Shop 1.0. Affected by this vulnerability is the function delete_category of the file /classes/Master.php?f=delete_category. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.c
isclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.278821 - https://vuldb.com/?ctiid.278821 - https://vuldb.com/?submit.412748 - https://github.com/o0wll/cve/blob/main/sql.md - https://www.sourcecodester.com/
CVE ID: CVE-2024-9318 State: PUBLISHED Published: 2024-09-28T23:00:07.409Z Last Updated: 2024-09-30T15:28:46.364Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Advocate Office Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in SourceCodester Advocate Office Management System 1.0. Affected by this issue is some unknown functionality of the file /control/activate.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References
exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.278822 - https://vuldb.com/?ctiid.278822 - https://vuldb.com/?submit.412749 - https://github.com/para-paradise/webray.com.cn/blob/main/Advocate%20office%20management%20system/Advocate%20office%20management%20system%20activate.php%20error-based%20SQL%20Injection%20Vulnerability.md - https://www.sourcecodester.com/
CVE ID: CVE-2024-9319 State: PUBLISHED Published: 2024-09-28T23:31:05.469Z Last Updated: 2024-09-30T15:26:47.069Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Timesheet App Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in SourceCodester Online Timesheet App 1.0. This affects an unknown part of the file /endpoint/delete-timesheet.php. The manipulation of the argument timesheet leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.27
to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.278823 - https://vuldb.com/?ctiid.278823 - https://vuldb.com/?submit.413329 - https://github.com/zz0zz0/CVE/blob/main/Online%20Timesheet%20App%20--SQL%20injection/Online%20Timesheet%20App%20--SQL%20injection.md - https://www.sourcecodester.com/
CVE ID: CVE-2024-9320 State: PUBLISHED Published: 2024-09-29T00:00:06.732Z Last Updated: 2024-09-30T15:25:20.421Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Online Timesheet App Problem Types: CWE-79 Description: A vulnerability has been found in SourceCodester Online Timesheet App 1.0 and classified as problematic. This vulnerability affects unknown code of the file /endpoint/add-timesheet.php of the component Add Timesheet Form. The manipulation of the argument day/task leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment:
otely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.278824 - https://vuldb.com/?ctiid.278824 - https://vuldb.com/?submit.413331 - https://github.com/zz0zz0/CVE/blob/main/Online%20Timesheet%20App%20--XSS/Online%20Timesheet%20App%20--XSS.md - https://www.sourcecodester.com/
CVE ID: CVE-2024-9321 State: PUBLISHED Published: 2024-09-29T00:31:04.585Z Last Updated: 2024-09-30T19:10:24.165Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SourceCodester Products: Online Railway Reservation System Problem Types: CWE-284 Description: A vulnerability was found in SourceCodester Online Railway Reservation System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/inquiries/view_details.php. The manipulation of the argument id leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP V
initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.278825 - https://vuldb.com/?ctiid.278825 - https://vuldb.com/?submit.412491 - https://github.com/gurudattch/CVEs/blob/main/Sourcecodester-Online-Railway-Registraion-System-BAC.md - https://www.sourcecodester.com/
CVE ID: CVE-2024-9322 State: PUBLISHED Published: 2024-09-29T03:00:05.859Z Last Updated: 2024-09-30T19:13:55.203Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Supply Chain Management Problem Types: CWE-89 Description: A vulnerability was found in code-projects Supply Chain Management 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/edit_manufacturer.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.27882
the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.278826 - https://vuldb.com/?ctiid.278826 - https://vuldb.com/?submit.413337 - https://github.com/mengcehn/CVE/edit/main/Supply-Chain-Management-in-php-sql.md - https://code-projects.org/
CVE ID: CVE-2024-9323 State: PUBLISHED Published: 2024-09-29T06:31:06.002Z Last Updated: 2024-09-30T19:19:12.307Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Inventory Management System Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Inventory Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /app/action/add_staff.php. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.c
isclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.278827 - https://vuldb.com/?ctiid.278827 - https://vuldb.com/?submit.413401 - https://hackmd.io/@SeaWind/rySx1IbR0 - https://www.sourcecodester.com/
CVE ID: CVE-2024-9324 State: PUBLISHED Published: 2024-09-29T07:00:05.883Z Last Updated: 2024-11-04T19:13:08.178Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Intelbras Products: InControl Problem Types: CWE-94, CWE-74, CWE-707 Description: A vulnerability was found in Intelbras InControl up to 2.21.57. It has been rated as critical. Affected by this issue is some unknown functionality of the file /v1/operador/ of the component Relatório de Operadores Page. The manipulation of the argument fields leads to code injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.21.58 is able to address this issue
The exploit has been disclosed to the public and may be used. Upgrading to version 2.21.58 is able to address this issue. It is recommended to upgrade the affected component. The vendor was informed early on 2024-07-19 about this issue. The release of a fixed version 2.21.58 was announced for the end of August 2024 but then was postponed until 2024-09-20. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.278828 - https://vuldb.com/?ctiid.278828 - https://vuldb.com/?submit.375614 - https://youtu.be/UdZVktPUy8A - https://backend.intelbras.com/sites/default/files/2024-10/Aviso%20de%20Seguran%C3%A7a%20-%20Incontrol%202.21.56%20e%202.21.57.pdf - https://downlo
com/sites/default/files/2024-10/Aviso%20de%20Seguran%C3%A7a%20-%20Incontrol%202.21.56%20e%202.21.57.pdf - https://download.cronos.intelbras.com.br/download/INCONTROL/INCONTROL-WEB/prod/INCONTROL-WEB-2.21.58-233dfd1ac1e2ca3eabb71c854005c78b.exe
CVE ID: CVE-2024-9325 State: PUBLISHED Published: 2024-09-29T07:31:04.316Z Last Updated: 2024-11-04T19:13:10.172Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Intelbras Products: InControl Problem Types: CWE-428, CWE-426 Description: A vulnerability classified as critical has been found in Intelbras InControl up to 2.21.56. This affects an unknown part of the file C:\Program Files (x86)\Intelbras\Incontrol Cliente\incontrol_webcam\incontrol-service-watchdog.exe. The manipulation leads to unquoted search path. It is possible to launch the attack on the local host. Upgrading to version 2.21.58 is able to address this issue. It is recommended to upgrade the af
ttack on the local host. Upgrading to version 2.21.58 is able to address this issue. It is recommended to upgrade the affected component. The vendor was informed early on 2024-08-05 about this issue. The release of a fixed version 2.21.58 was announced for the end of August 2024 but then was postponed until 2024-09-20. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.278829 - https://vuldb.com/?ctiid.278829 - https://vuldb.com/?submit.385397 - https://backend.intelbras.com/sites/default/files/2024-10/Aviso%20de%20Seguran%C3%A7a%20-%20Incontrol%202.21.56%20e%202.21.57.pdf - https://download.cronos.intelbras.com.br/download/INCONTROL/INCONTROL-WEB/prod/INC
control%202.21.56%20e%202.21.57.pdf - https://download.cronos.intelbras.com.br/download/INCONTROL/INCONTROL-WEB/prod/INCONTROL-WEB-2.21.58-233dfd1ac1e2ca3eabb71c854005c78b.exe
CVE ID: CVE-2024-9326 State: PUBLISHED Published: 2024-09-29T08:00:09.100Z Last Updated: 2024-09-30T19:38:58.076Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Online Shopping Portal Problem Types: CWE-89 Description: A vulnerability classified as critical was found in PHPGurukul Online Shopping Portal 2.0. This vulnerability affects unknown code of the file /shopping/admin/index.php of the component Admin Panel. The manipulation of the argument username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.co
sclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.278830 - https://vuldb.com/?ctiid.278830 - https://vuldb.com/?submit.414058 - https://hackmd.io/@SeaWind/ryBv7CGCR - https://phpgurukul.com/
CVE ID: CVE-2024-9327 State: PUBLISHED Published: 2024-09-29T11:00:05.948Z Last Updated: 2024-09-30T19:43:27.268Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Blood Bank System Problem Types: CWE-89 Description: A vulnerability was found in code-projects Blood Bank System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /forgot.php. The manipulation of the argument useremail leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.278836 - https://vuldb.com/?c
ed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.278836 - https://vuldb.com/?ctiid.278836 - https://vuldb.com/?submit.415469 - https://github.com/Lynn1236-cell/cve1/blob/main/sql3.md - https://code-projects.org/
CVE ID: CVE-2024-9328 State: PUBLISHED Published: 2024-09-29T22:31:05.004Z Last Updated: 2024-09-30T19:44:35.442Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Advocate Office Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Advocate Office Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /control/edit_client.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vul
en disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.278837 - https://vuldb.com/?ctiid.278837 - https://vuldb.com/?submit.415695 - https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/2024/Advocate%20office%20management%20system%20-%20edit_client.php%20sql%20injection%20vulnerability.md - https://www.sourcecodester.com/
CVE ID: CVE-2024-9329 State: PUBLISHED Published: 2024-09-30T07:11:53.688Z Last Updated: 2024-10-07T15:59:12.662Z Vendors: Eclipse Foundation Products: Glassfish Problem Types: CWE-233 Description: In Eclipse Glassfish versions before 7.0.17, The Host HTTP parameter could cause the web application to redirect to the specified URL, when the requested endpoint is '/management/domain'. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/eclipse-ee4j/glassfish/pull/25106 - https://gitlab.eclipse.org/security/vulne
ontainer: References: - https://github.com/eclipse-ee4j/glassfish/pull/25106 - https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/232
CVE ID: CVE-2024-9333 State: PUBLISHED Published: 2024-10-02T05:57:40.568Z Last Updated: 2024-10-02T13:36:57.473Z Vendors: M-Files Corporation Products: M-Files Connector for Copilot Problem Types: CWE-281 Description: Permissions bypass in M-Files Connector for Copilot before version 24.9.3 allows authenticated user to access limited amount of documents via incorrect access control list calculation Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://product.m-files.com/security-advisories/cve-2024-9333/
CVE ID: CVE-2024-9334 State: PUBLISHED Published: 2025-02-27T13:54:44.319Z Last Updated: 2025-02-27T14:12:25.993Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: E-Kent Products: Pallium Vehicle Tracking Problem Types: CWE-798, CWE-921 Description: Use of Hard-coded Credentials, Storage of Sensitive Data in a Mechanism without Access Control vulnerability in E-Kent Pallium Vehicle Tracking allows Authentication Bypass.This issue affects Pallium Vehicle Tracking: before 17.10.2024. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0044
CVE ID: CVE-2024-9340 State: PUBLISHED Published: 2025-03-20T10:08:50.533Z Last Updated: 2025-07-15T10:48:56.065Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: zenml-io Products: zenml-io/zenml Problem Types: CWE-835 Description: A Denial of Service (DoS) vulnerability in zenml-io/zenml version 0.66.0 allows unauthenticated attackers to cause excessive resource consumption by sending malformed multipart requests with arbitrary characters appended to the end of multipart boundaries. This flaw in the multipart request boundary processing mechanism leads to an infinite loop, resulting in a complete denial of service for all users. Affected endpoints include `/a
anism leads to an infinite loop, resulting in a complete denial of service for all users. Affected endpoints include `/api/v1/login` and `/api/v1/device_authorization`. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/c9200654-7dc0-4c1d-8573-ab79a87fb4f6 - https://github.com/zenml-io/zenml/commit/cba152eb9ca3071c8372b0b91c02d9d3351de48d
CVE ID: CVE-2024-9341 State: PUBLISHED Published: 2024-10-01T18:52:00.686Z Last Updated: 2025-11-14T01:33:30.644Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4.12, Red Hat OpenShift Container Platform 4.13, Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 4.15, Red Hat OpenShift Container Platform 4.16, Red Hat OpenShift Container Platform 4.17, Red Hat Enterprise Linux 10, Red Hat OpenShift Container Platform 4 Problem Types: CWE-59 Description: A flaw was found in Go. When FIPS mode is enabled on a system, contai
iner Platform 4 Problem Types: CWE-59 Description: A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:10147 - https://access.redhat.com/errata/RHSA-2024:10818 - https://access.redha
tps://access.redhat.com/errata/RHSA-2024:10147 - https://access.redhat.com/errata/RHSA-2024:10818 - https://access.redhat.com/errata/RHSA-2024:7925 - https://access.redhat.com/errata/RHSA-2024:8039 - https://access.redhat.com/errata/RHSA-2024:8112 - https://access.redhat.com/errata/RHSA-2024:8238 - https://access.redhat.com/errata/RHSA-2024:8263 - https://access.redhat.com/errata/RHSA-2024:8428 - https://access.redhat.com/errata/RHSA-2024:8690 - https://access.redhat.com/errata/RHSA-2024:8694 - https://access.redhat.com/errata/RHSA-2024:8846 - https://access.redhat.com/errata/RHSA-2024:9454 - https://access.redhat.com/errata/RHSA-2024:9459 - https://access.redhat.com/security/cve/CVE-2024-93
ta/RHSA-2024:9454 - https://access.redhat.com/errata/RHSA-2024:9459 - https://access.redhat.com/security/cve/CVE-2024-9341 - https://bugzilla.redhat.com/show_bug.cgi?id=2315691 - https://github.com/containers/common/blob/384f77532f67afc8a73d8e0c4adb0d195df57714/pkg/subscriptions/subscriptions.go#L169 - https://github.com/containers/common/blob/384f77532f67afc8a73d8e0c4adb0d195df57714/pkg/subscriptions/subscriptions.go#L349
CVE ID: CVE-2024-9342 State: PUBLISHED Published: 2025-07-16T10:14:28.966Z Last Updated: 2025-07-16T14:39:49.251Z Vendors: Eclipse Foundation Products: Eclipse Glassfish Problem Types: CWE-307 Description: In Eclipse GlassFish version 7.0.16 or earlier it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login attempts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.eclipse.org/security/cve-assignement/-/issues/33
CVE ID: CVE-2024-9343 State: PUBLISHED Published: 2025-07-16T10:47:55.853Z Last Updated: 2025-07-16T14:39:10.179Z Vendors: Eclipse Foundation Products: Eclipse Glassfish Problem Types: CWE-79 Description: In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Console. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.eclipse.org/security/cve-assignement/-/issues/37
CVE ID: CVE-2024-9344 State: PUBLISHED Published: 2024-10-02T08:31:49.822Z Last Updated: 2024-10-02T18:07:53.538Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: thevisionofhamza Products: BerqWP – Automated All-In-One PageSpeed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript Problem Types: CWE-79 Description: The BerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping. This m
parameter in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/01d5e5b5-033c-4690-9857-3339e2831340?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3160806%40searchpro&new=3160806%40searchpro&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/browser/searchpro/trunk/simple
rchpro&new=3160806%40searchpro&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/browser/searchpro/trunk/simplehtmldom/example/scraping/example_scraping_general.php?rev=3138385
CVE ID: CVE-2024-9345 State: PUBLISHED Published: 2024-10-04T02:04:50.886Z Last Updated: 2024-10-04T14:03:54.458Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: tychesoftwares Products: Product Delivery Date for WooCommerce – Lite Problem Types: CWE-79 Description: The Product Delivery Date for WooCommerce – Lite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.7.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an
ttackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is only exploitable when notices are present. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1127a5f3-1698-45e9-85bd-4eebfdbe56d4?source=cve - https://plugins.trac.wordpress.org/browser/product-delivery-date-for-woocommerce-lite/tags/-2.7.3/includes/component/pro-notices-in-lite/ts-pro-notices.php#L102 - https://plugins.trac.wordpress.org/changeset/3161353/product-delivery-date-for-woocommerce-lite/tags/2.7.4/includes/component/pro-notices-in-lite/ts-pro-notic
ngeset/3161353/product-delivery-date-for-woocommerce-lite/tags/2.7.4/includes/component/pro-notices-in-lite/ts-pro-notices.php
CVE ID: CVE-2024-9346 State: PUBLISHED Published: 2024-10-11T06:50:15.988Z Last Updated: 2024-10-11T13:44:09.571Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: michaelzangl Products: Embed videos and respect privacy Problem Types: CWE-79 Description: The Embed videos and respect privacy plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'v' parameter in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clic