Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-11739 State: PUBLISHED Published: 2025-06-27T15:41:18.551Z Last Updated: 2025-06-27T15:57:49.040Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Case Informatics Products: Case ERP Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Case Informatics Case ERP allows SQL Injection.This issue affects Case ERP: before V2.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0139
CVE ID: CVE-2024-11740 State: PUBLISHED Published: 2024-12-19T05:24:55.981Z Last Updated: 2024-12-19T16:38:30.488Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: codename065 Products: Download Manager Problem Types: CWE-94 Description: The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.3.03. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
ted attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4a7be578-5883-4cd3-963d-bf81c3af2003?source=cve - https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.02/src/Package/views/shortcode-iframe.php#L203 - https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.02/src/Package/Hooks.php#L42
CVE ID: CVE-2024-11741 State: PUBLISHED Published: 2025-01-31T15:12:29.122Z Last Updated: 2025-05-09T20:03:33.716Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Grafana Products: Grafana Problem Types: CWE-200 Description: Grafana is an open-source platform for monitoring and observability. The Grafana Alerting VictorOps integration was not properly protected and could be exposed to users with Viewer permission. Fixed in versions 11.5.0, 11.4.1, 11.3.3, 11.2.6, 11.1.11, 11.0.11 and 10.4.15 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://grafana.com/security/security-advisories/cve-2024-11741/
CVE ID: CVE-2024-11742 State: PUBLISHED Published: 2024-11-26T20:00:13.454Z Last Updated: 2024-11-28T06:47:31.047Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Best House Rental Management System Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, has been found in SourceCodester Best House Rental Management System 1.0. This issue affects some unknown processing of the file /rental/ajax.php?action=save_tenant. The manipulation of the argument lastname/firstname/middlename leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other pa
scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286139 - https://vuldb.com/?ctiid.286139 - https://vuldb.com/?submit.449683 - https://github.com/YasserREED/YasserREED-CVEs/blob/main/Best%20house%20rental%20management%20system%20project%20in%20php/Stored%20Cross-Site%20Scripting%20(XSS).md - https://www.sourcecodester.com/
CVE ID: CVE-2024-11743 State: PUBLISHED Published: 2024-11-26T20:00:16.395Z Last Updated: 2024-11-28T06:47:43.135Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: SourceCodester Products: Best House Rental Management System Problem Types: CWE-352, CWE-862 Description: A vulnerability, which was classified as problematic, was found in SourceCodester Best House Rental Management System 1.0. Affected is an unknown function of the file /rental/ajax.php?action=delete_user of the component POST Request Handler. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analy
s possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286140 - https://vuldb.com/?ctiid.286140 - https://vuldb.com/?submit.449697 - https://github.com/YasserREED/YasserREED-CVEs/blob/main/Best%20house%20rental%20management%20system%20project%20in%20php/Cross-Site%20Request%20Forgery%20(CSRF).md - https://www.sourcecodester.com/
CVE ID: CVE-2024-11744 State: PUBLISHED Published: 2024-11-26T20:31:04.293Z Last Updated: 2024-11-26T21:28:27.960Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: 1000 Projects Products: Portfolio Management System MCA Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in 1000 Projects Portfolio Management System MCA 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /register.php. The manipulation of the argument name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Not
oit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286141 - https://vuldb.com/?ctiid.286141 - https://vuldb.com/?submit.449734 - https://github.com/zdwf-klm/CVE/issues/1 - https://1000projects.org/
CVE ID: CVE-2024-11745 State: PUBLISHED Published: 2024-11-26T21:00:12.592Z Last Updated: 2024-11-26T21:20:43.347Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: AC8 Problem Types: CWE-121, CWE-119 Description: A vulnerability was found in Tenda AC8 16.03.34.09 and classified as critical. Affected by this issue is the function route_static_check of the file /goform/SetStaticRouteCfg. The manipulation of the argument list leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286142 - https://vuldb.
be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286142 - https://vuldb.com/?ctiid.286142 - https://vuldb.com/?submit.449893 - https://tasty-foxtrot-3a8.notion.site/Tenda-AC8v4-route_static_check-stack-overflow-1460448e6195803087a5d39755d2bb6b?pvs=74 - https://www.tenda.com.cn/
CVE ID: CVE-2024-11746 State: PUBLISHED Published: 2025-02-12T04:22:14.170Z Last Updated: 2025-02-12T15:58:11.498Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: samdani Products: Discover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands Plugin Problem Types: CWE-79 Description: The Discover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'product_brand' shortcode in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it pos
cluding, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/443cfb7b-4566-4a71-ac31-5a5361c58aa2?source=cve - https://plugins.trac.wordpress.org/browser/gs-woo-brands/tags/1.3.1/woocommerce-brand.php#L299 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3235325%40gs-woo-brands&new=3235325%40gs-woo-brands
ins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3235325%40gs-woo-brands&new=3235325%40gs-woo-brands&sfp_email=&sfph_mail=
CVE ID: CVE-2024-11747 State: PUBLISHED Published: 2024-12-04T02:40:28.091Z Last Updated: 2024-12-04T21:05:55.602Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpenhanced Products: Responsive Videos Problem Types: CWE-79 Description: The Responsive Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'somryv' shortcode in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesse
h contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f723be00-79f1-4a24-8502-2c5844ccc5de?source=cve - https://plugins.trac.wordpress.org/browser/responsive-youtube-videos/trunk/includes/somryv-shortcodes.php - https://wordpress.org/plugins/responsive-youtube-videos/
CVE ID: CVE-2024-11748 State: PUBLISHED Published: 2024-12-18T02:08:59.494Z Last Updated: 2024-12-18T16:36:48.159Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: taeggie Products: Taeggie Feed Problem Types: CWE-79 Description: The Taeggie Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'taeggie-feed' shortcode in all versions up to, and including, 0.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an
tributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/65d11459-5cad-4d8b-a81d-7f0dd4342a52?source=cve - https://plugins.trac.wordpress.org/browser/taeggie-feed/trunk/taeggie_feed.php#L40 - https://wordpress.org/plugins/taeggie-feed/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3207857%40taeggie-feed&new=3207857%40taeggie-feed&sfp_email=&sfph_mail=
CVE ID: CVE-2024-11749 State: PUBLISHED Published: 2025-01-07T05:23:52.179Z Last Updated: 2025-01-07T16:16:59.892Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: appizy Products: App Embed Problem Types: CWE-79 Description: The App Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'appizy' shortcode in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page
l access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/111a0507-aa51-4e4e-a582-9007041c811b?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3216285%40appizy-app-embed&new=3216285%40appizy-app-embed&sfp_email=&sfph_mail=
CVE ID: CVE-2024-11750 State: PUBLISHED Published: 2024-12-12T04:23:09.984Z Last Updated: 2024-12-12T15:03:04.964Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: onlyoffice Products: ONLYOFFICE DocSpace Problem Types: CWE-79 Description: The ONLYOFFICE DocSpace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'onlyoffice-docspace' shortcode in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute when
ated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/25f24bdd-0b78-4ec3-821b-6331e5bf65e8?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3200973%40onlyoffice-docspace&new=3200973%40onlyoffice-docspace&sfp_email=&sfph_mail=
CVE ID: CVE-2024-11751 State: PUBLISHED Published: 2024-12-14T04:23:40.894Z Last Updated: 2024-12-16T20:06:38.141Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: tcoder Products: TCBD Popover Problem Types: CWE-79 Description: The TCBD Popover plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tcbd-popover-image ' shortcode in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses
contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3b08f533-9c74-4be3-99ff-70a3d9b90358?source=cve - https://plugins.trac.wordpress.org/browser/tcbd-popover/tags/1.2/plugin-hook.php#L75 - https://plugins.trac.wordpress.org/browser/tcbd-popover/tags/1.2/plugin-hook.php#L86 - https://plugins.trac.wordpress.org/browser/tcbd-popover/tags/1.2/plugin-hook.php#L98 - https://plugins.trac.wordpress.org/browser/tcbd-popover/tags/1.2/plugin-hook.php#L110
CVE ID: CVE-2024-11752 State: PUBLISHED Published: 2024-12-14T05:34:15.672Z Last Updated: 2024-12-16T17:48:42.146Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: babo2015 Products: Eveeno Problem Types: CWE-79 Description: The Eveeno plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'eveeno' shortcode in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Addi
ss and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e254f0ba-9008-44e9-bf8f-31c9614d6f64?source=cve - https://plugins.trac.wordpress.org/browser/eveeno/trunk/eveeno.php#L150 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3202716%40eveeno&new=3202716%40eveeno&sfp_email=&sfph_mail=
CVE ID: CVE-2024-11753 State: PUBLISHED Published: 2025-02-19T07:32:12.244Z Last Updated: 2025-02-19T14:37:49.938Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: umichitswebhosting Products: UMich OIDC Login Problem Types: CWE-79 Description: The UMich OIDC Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'umich_oidc_button' shortcode in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute when
ated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b372ad3a-0056-45fb-9a0e-7604f4fdf240?source=cve - https://plugins.trac.wordpress.org/browser/umich-oidc-login/tags/1.2.0/includes/class-run.php#L248 - https://plugins.trac.wordpress.org/browser/umich-oidc-login/tags/1.2.0/includes/site/class-shortcodes.php#L248 - https://plugins.trac.wordpress.org/browser/umich-oidc-login/tags/1.2.0/includes/site/class-shortcodes.php#L158
CVE ID: CVE-2024-11754 State: PUBLISHED Published: 2024-12-13T08:24:49.866Z Last Updated: 2024-12-16T20:07:35.535Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ameliabooking Products: Booking System Trafft Problem Types: CWE-79 Description: The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'trafftbooking' shortcode in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whe
cated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/84adbde0-9a9b-4a76-9333-56880fcc139d?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3207016%40booking-system-trafft&new=3207016%40booking-system-trafft&sfp_email=&sfph_mail=
CVE ID: CVE-2024-11755 State: PUBLISHED Published: 2024-12-14T04:23:40.159Z Last Updated: 2024-12-16T20:06:59.782Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: acewebx Products: IMS Countdown Problem Types: CWE-79 Description: The IMS Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown post settings in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst No
inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2de22728-4f67-406c-9db5-33cbba4c15eb?source=cve - https://plugins.trac.wordpress.org/browser/ims-countdown/trunk/shortcode/shortcode.php
CVE ID: CVE-2024-11756 State: PUBLISHED Published: 2025-01-07T05:24:09.502Z Last Updated: 2025-01-07T16:13:15.827Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: sweepwidget Products: SweepWidget Contests, Giveaways, Photo Contests, Competitions Problem Types: CWE-79 Description: The SweepWidget Contests, Giveaways, Photo Contests, Competitions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sweepwidget' shortcode in all versions up to, and including, 2.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level acce
ut escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f1ec6957-28c0-4441-8801-80b226569df9?source=cve - https://plugins.trac.wordpress.org/browser/sweepwidget/trunk/sweepwidget.php#L936
CVE ID: CVE-2024-11757 State: PUBLISHED Published: 2024-12-12T05:24:22.604Z Last Updated: 2024-12-12T14:45:24.695Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: sojahu Products: WP GeoNames Problem Types: CWE-79 Description: The WP GeoNames plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp-geonames' shortcode in all versions up to, and including, 1.9.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an in
ibutor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/930802e6-437b-437a-b530-7992094073f9?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3203122%40wp-geonames&new=3203122%40wp-geonames&sfp_email=&sfph_mail=
CVE ID: CVE-2024-11758 State: PUBLISHED Published: 2025-01-11T07:21:50.585Z Last Updated: 2025-01-13T17:17:20.322Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: milmor Products: WP SPID Italia Problem Types: CWE-79 Description: The WP SPID Italia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0cdadbf2-8b5d-4018-8cee-0d0fb07696f9?source=cve - https://plugins.trac.wordpress.org/browser/wp-spid-italia/trunk/frontend-ui.php#L109
CVE ID: CVE-2024-11759 State: PUBLISHED Published: 2024-12-14T04:23:41.251Z Last Updated: 2024-12-16T20:06:29.674Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bukza Products: Bukza Problem Types: CWE-79 Description: The Bukza plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bukza' shortcode in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Addition
nd above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3e348b24-4c49-43ed-b4f3-b31f0f709830?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3207300%40bukza&new=3207300%40bukza&sfp_email=&sfph_mail=