Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-12225 State: PUBLISHED Published: 2025-05-06T19:49:16.502Z Last Updated: 2025-11-20T07:12:24.461Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Red Hat Products: Red Hat build of Quarkus Problem Types: CWE-288 Description: A vulnerability was found in Quarkus in the quarkus-security-webauthn module. The Quarkus WebAuthn module publishes default REST endpoints for registering and logging users in while allowing developers to provide custom REST endpoints. When developers provide custom REST endpoints, the default endpoints remain accessible, potentially allowing attackers to obtain a login cookie that has no corresponding user in the Quar
ts remain accessible, potentially allowing attackers to obtain a login cookie that has no corresponding user in the Quarkus application or, depending on how the application is written, could correspond to an existing user that has no relation with the current attacker, allowing anyone to log in as an existing user by just knowing that user's user name. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2024-12225 - https://bugzilla.redhat.com/show_bug.cgi?id=2330484
CVE ID: CVE-2024-12226 State: PUBLISHED Published: 2025-01-16T06:48:20.279Z Last Updated: 2025-01-16T14:21:30.387Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Octopus Deploy Products: Kubernetes Worker or Kubernetes Agent Problem Types: CWE-532 Description: In affected versions of the Octopus Kubernetes worker or agent, sensitive variables could be written to the Kubernetes script pod log in clear-text. This was identified in Version 2 however it was determined that this could also be achieved in Version 1 and the fix was applied to both versions accordingly. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://advisories.octopus.com/
h versions accordingly. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://advisories.octopus.com/post/2024/sa2024-10/
CVE ID: CVE-2024-12227 State: PUBLISHED Published: 2024-12-05T13:31:05.008Z Last Updated: 2024-12-05T15:39:52.179Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: MSI Products: Dragon Center Problem Types: CWE-476, CWE-404 Description: A vulnerability, which was classified as problematic, was found in MSI Dragon Center up to 2.0.146.0. This affects the function MmUnMapIoSpace in the library NTIOLib_X64.sys of the component IOCTL Handler. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. Upgrading to version 2.0.148.0 is able to address this issue. It is recommended to upgrade the affected component. Ad
t. Upgrading to version 2.0.148.0 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286959 - https://vuldb.com/?ctiid.286959 - https://vuldb.com/?submit.456017 - https://shareforall.notion.site/MSI-Dragon-Center-NTIOLib_X64-0xC3506104-MmMapIoSpace-DOS-15160437bb1e801daf58d4aea052970e - https://www.msi.com/Landing/dragon-center-download/nb
CVE ID: CVE-2024-12228 State: PUBLISHED Published: 2024-12-05T13:31:09.200Z Last Updated: 2024-12-05T15:41:28.013Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Complaint Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in PHPGurukul Complaint Management System 1.0. Affected is an unknown function of the file /admin/user-search.php. The manipulation of the argument search leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.2869
the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286974 - https://vuldb.com/?ctiid.286974 - https://vuldb.com/?submit.455059 - https://github.com/PunyHunter/CVE/issues/2 - https://phpgurukul.com/
CVE ID: CVE-2024-12229 State: PUBLISHED Published: 2024-12-05T14:31:06.449Z Last Updated: 2024-12-05T14:42:11.309Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Complaint Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in PHPGurukul Complaint Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/complaint-search.php. The manipulation of the argument search leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286975 - https://vuldb.com/?ctiid.286975 - https://vuldb.com/?submit.455065 - https://github.com/qiyes233/CVE/issues/1 - https://phpgurukul.com/
CVE ID: CVE-2024-12230 State: PUBLISHED Published: 2024-12-05T14:31:09.399Z Last Updated: 2024-12-05T14:39:33.179Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Complaint Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in PHPGurukul Complaint Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/subcategory.php. The manipulation of the argument category leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
loit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286976 - https://vuldb.com/?ctiid.286976 - https://vuldb.com/?submit.456517 - https://github.com/wqywfvc/CVE/issues/2 - https://phpgurukul.com/
CVE ID: CVE-2024-12231 State: PUBLISHED Published: 2024-12-05T16:00:17.593Z Last Updated: 2024-12-09T18:59:14.120Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: CodeZips Products: Project Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in CodeZips Project Management System 1.0. This affects an unknown part of the file /index.php. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286977 - https://vu
may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286977 - https://vuldb.com/?ctiid.286977 - https://vuldb.com/?submit.455060 - https://github.com/SkGoing/CVE-repo_00/issues/3
CVE ID: CVE-2024-12232 State: PUBLISHED Published: 2024-12-05T16:00:19.365Z Last Updated: 2024-12-09T18:56:22.151Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: code-projects Products: Simple CRUD Functionality Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in code-projects Simple CRUD Functionality 1.0 and classified as problematic. This vulnerability affects unknown code of the file /index.php. The manipulation of the argument newtitle/newdescr leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb
disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286978 - https://vuldb.com/?ctiid.286978 - https://vuldb.com/?submit.456069 - https://github.com/LamentXU123/cve/blob/main/xss3.md - https://code-projects.org/
CVE ID: CVE-2024-12233 State: PUBLISHED Published: 2024-12-05T16:31:04.741Z Last Updated: 2024-12-09T18:53:59.612Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: code-projects Products: Online Notice Board Problem Types: CWE-434, CWE-284 Description: A vulnerability was found in code-projects Online Notice Board up to 1.0 and classified as critical. This issue affects some unknown processing of the file /registration.php of the component Profile Picture Handler. The manipulation of the argument img leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: R
tely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286979 - https://vuldb.com/?ctiid.286979 - https://vuldb.com/?submit.456458 - https://github.com/LamentXU123/cve/blob/main/RCE1.md - https://code-projects.org/
CVE ID: CVE-2024-12234 State: PUBLISHED Published: 2024-12-05T17:00:13.812Z Last Updated: 2024-12-06T16:02:59.135Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: 1000 Projects Products: Beauty Parlour Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in 1000 Projects Beauty Parlour Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/edit-customer-detailed.php. The manipulation of the argument name leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Ana
The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286980 - https://vuldb.com/?ctiid.286980 - https://vuldb.com/?submit.456519 - https://github.com/Hacker0xone/CVE/issues/17 - https://1000projects.org/
CVE ID: CVE-2024-12235 State: PUBLISHED Published: 2024-12-05T17:31:05.516Z Last Updated: 2024-12-06T16:29:47.484Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Shenzhen Dashi Tongzhou Information Technology Products: AgileBPM Problem Types: CWE-284, CWE-266 Description: A vulnerability was found in Shenzhen Dashi Tongzhou Information Technology AgileBPM up to 1.0.0. It has been declared as critical. Affected by this vulnerability is the function doFilter of the file \agile-bpm-basic-master\ab-auth\ab-auth-spring-security-oauth2\src\main\java\com\dstz\auth\filter\AuthorizationTokenCheckFilter.java. The manipulation leads to improper access controls. The attack can be launched
lter\AuthorizationTokenCheckFilter.java. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286981 - https://vuldb.com/?ctiid.286981 - https://vuldb.com/?submit.456529 - https://github.com/sweatxi/rce/blob/main/AgileBPM_vertical_overreach.md
CVE ID: CVE-2024-12236 State: PUBLISHED Published: 2024-12-10T15:07:40.230Z Last Updated: 2025-01-30T09:03:11.836Z Vendors: Google Cloud Platform Products: Vertex Gemini API Problem Types: CWE-755 Description: A security issue exists in Vertex Gemini API for customers using VPC-SC. By utilizing a custom crafted file URI for image input, data exfiltration is possible due to requests being routed outside the VPC-SC security perimeter, circumventing the intended security restrictions of VPC-SC. No further fix actions are needed. Google Cloud Platform implemented a fix to return an error message when a media file URL is specified in the fileUri parameter and VPC Service Controls is enabled. Othe
n an error message when a media file URL is specified in the fileUri parameter and VPC Service Controls is enabled. Other use cases are unaffected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cloud.google.com/vertex-ai/generative-ai/docs/security-bulletins#gcp-2024-063
CVE ID: CVE-2024-12237 State: PUBLISHED Published: 2025-01-03T22:22:05.828Z Last Updated: 2025-01-06T15:29:01.440Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: nik00726 Products: Photo Gallery Slideshow & Masonry Tiled Gallery Problem Types: CWE-918 Description: The Photo Gallery Slideshow & Masonry Tiled Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.15 via the rjg_get_youtube_info_justified_gallery_callback function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web applicatio
with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to retrieve limited information from internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/08e44434-8908-4c63-9e5b-9a8b387255d9?source=cve - https://plugins.trac.wordpress.org/browser/wp-responsive-photo-gallery/tags/1.0.15/wp-responsive-photo-gallery.php#L3023 - https://plugins.trac.wordpress.org/browser/wp-responsive-photo-gallery/tags/1.0.15/wp-responsive-photo-gallery.php#L3044
CVE ID: CVE-2024-12238 State: PUBLISHED Published: 2024-12-29T05:22:53.627Z Last Updated: 2024-12-31T17:03:31.881Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: kstover Products: Ninja Forms – The Contact Form Builder That Grows With You Problem Types: CWE-94 Description: The The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.8.22. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level acc
idate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/524a2143-b15f-4edc-98de-dafef4c5bc00?source=cve - https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.8.20/includes/Display/Preview.php#L68
CVE ID: CVE-2024-12239 State: PUBLISHED Published: 2024-12-17T01:45:15.497Z Last Updated: 2024-12-17T14:35:57.246Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: ideaboxcreations Products: PowerPack Lite for Beaver Builder Problem Types: CWE-79 Description: The PowerPack Lite for Beaver Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the navigate parameter in all versions up to, and including, 1.3.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrative user into p
ckers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrative user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5138ed4c-3e9c-45da-917e-e8d8396a62f1?source=cve - https://plugins.trac.wordpress.org/browser/powerpack-addon-for-beaver-builder/trunk/includes/admin-settings-templates.php#L62
CVE ID: CVE-2024-12240 State: PUBLISHED Published: 2025-01-14T11:08:35.888Z Last Updated: 2025-01-14T14:18:56.912Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: gpriday Products: Page Builder by SiteOrigin Problem Types: CWE-79 Description: The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the row label parameter in all versions up to, and including, 2.31.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page
l access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/abe8c6b0-b16b-4391-88b4-dca507c973fc?source=cve - https://plugins.trac.wordpress.org/browser/siteorigin-panels/tags/2.31.0/tpl/metabox-panels.php#L17
CVE ID: CVE-2024-12242 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:05:07.928Z Description: No description available.
CVE ID: CVE-2024-12243 State: PUBLISHED Published: 2025-02-10T15:28:10.328Z Last Updated: 2025-11-20T18:22:16.667Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Discovery 1.14, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 4 Problem Types: CWE-407 Description: A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficient algorithm in libtasn1, de
was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficient algorithm in libtasn1, decoding certain DER-encoded certificate data can take excessive time, leading to increased resource consumption. This flaw allows a remote attacker to send a specially crafted certificate, causing GnuTLS to become unresponsive or slow, resulting in a denial-of-service condition. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2025:17361 - https://access.redhat.com/errata/RHSA-2025:4051 - https://access.redhat.com/errata/RHSA-2025:7076 - https://access.redhat.com/errata/RHSA-2025:8020 - https://ac
25:4051 - https://access.redhat.com/errata/RHSA-2025:7076 - https://access.redhat.com/errata/RHSA-2025:8020 - https://access.redhat.com/errata/RHSA-2025:8385 - https://access.redhat.com/security/cve/CVE-2024-12243 - https://bugzilla.redhat.com/show_bug.cgi?id=2344615 - https://gitlab.com/gnutls/libtasn1/-/issues/52
CVE ID: CVE-2024-12244 State: PUBLISHED Published: 2025-04-24T07:31:11.125Z Last Updated: 2025-04-24T15:23:11.499Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-862 Description: An issue has been discovered in access controls could allow users to view certain restricted project information even when related features are disabled in GitLab EE, affecting all versions from 17.7 prior to 17.9.7, 17.10 prior to 17.10.5, and 17.11 prior to 17.11.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/508046 - https://hackerone.com/reports/2862754
CVE ID: CVE-2024-12245 State: PUBLISHED Published: 2025-03-14T18:11:14.218Z Last Updated: 2025-03-18T17:05:58.045Z Vendors: LogicalDOC Products: LogicalDOC Community, LogicalDOC Enterprise Problem Types: CWE-89 Description: Logout functionality contains a blind SQL injection that can be exploited by unauthenticated attackers. Using a time-based blind SQLi technique the attacker can disclose all database contents. Account takeover is a potential outcome depending on the presence or lack thereof entries in certain database tables. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.blackduck.com/blog/cyrc-advisory-logicaldoc.html
CVE ID: CVE-2024-12246 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:05:07.100Z Description: No description available.
CVE ID: CVE-2024-12247 State: PUBLISHED Published: 2024-12-05T15:20:49.383Z Last Updated: 2024-12-05T16:58:59.768Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-863 Description: Mattermost versions 9.7.x <= 9.7.5, 9.8.x <= 9.8.2 and 9.9.x <= 9.9.2 fail to properly propagate permission scheme updates across cluster nodes which allows a user to keep old permissions, even if the permission scheme has been updated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-12248 State: PUBLISHED Published: 2025-01-30T18:17:22.814Z Last Updated: 2025-02-12T16:53:16.892Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Contec Health Products: CMS8000 Patient Monitor Problem Types: CWE-787 Description: Contec Health CMS8000 Patient Monitor is vulnerable to an out-of-bounds write, which could allow an attacker to send specially formatted UDP requests in order to write arbitrary data. This could result in remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-030-01 - https://www.fda.gov/medical-devices/safety-communi
s://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-030-01 - https://www.fda.gov/medical-devices/safety-communications/cybersecurity-vulnerabilities-certain-patient-monitors-contec-and-epsimed-fda-safety-communication
CVE ID: CVE-2024-12249 State: PUBLISHED Published: 2025-01-09T11:10:55.369Z Last Updated: 2025-01-09T14:47:00.556Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: samdani Products: GS Insever Portfolio Problem Types: CWE-862 Description: The GS Insever Portfolio plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_settings() function in all versions up to, and including, 1.4.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's CSS settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/
e the plugin's CSS settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/36f3e9be-9a4e-458d-92b3-687afc44696a?source=cve - https://plugins.trac.wordpress.org/browser/gs-instagram-portfolio/tags/1.4.5/admin/includes/Ajax.php - https://plugins.trac.wordpress.org/browser/gs-instagram-portfolio/tags/1.4.5/admin/Backend_Builder.php
CVE ID: CVE-2024-12250 State: PUBLISHED Published: 2024-12-18T03:22:06.983Z Last Updated: 2024-12-18T16:34:14.436Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: zealopensource Products: Accept Authorize.NET Payments Using Contact Form 7 Problem Types: CWE-200 Description: The Accept Authorize.NET Payments Using Contact Form 7 plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2 via the cf7adn-info.php file. This makes it possible for unauthenticated attackers to extract configuration data which can be used to aid in other attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wo
ich can be used to aid in other attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d8801b9a-afcb-483b-a018-4f68448e96de?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3208517%40accept-authorize-net-payments-using-contact-form-7&new=3208517%40accept-authorize-net-payments-using-contact-form-7&sfp_email=&sfph_mail=