Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-6681 State: PUBLISHED Published: 2024-07-11T16:31:10.263Z Last Updated: 2024-08-01T21:41:04.230Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: witmy Products: my-springsecurity-plus Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in witmy my-springsecurity-plus up to 2024-07-04. Affected by this issue is some unknown functionality of the file /api/dept. The manipulation of the argument params.dataScope leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-271154 is the identifier assigned to this vulnerability. Additional Analyst Notes:
ed to the public and may be used. VDB-271154 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.271154 - https://vuldb.com/?ctiid.271154 - https://gitee.com/witmy/my-springsecurity-plus/issues/IAAGZY
CVE ID: CVE-2024-6684 State: PUBLISHED Published: 2024-08-12T12:49:24.591Z Last Updated: 2024-08-13T20:34:56.483Z Vendors: GST Electronics Products: inohom Nova Panel N7 Problem Types: CWE-288 Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in GST Electronics inohom Nova Panel N7 allows Authentication Bypass.This issue affects inohom Nova Panel N7: through 1.9.9.6. NOTE: The vendor was contacted and it was learned that the product is not supported. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1194
CVE ID: CVE-2024-6685 State: PUBLISHED Published: 2024-09-16T21:33:58.732Z Last Updated: 2024-09-17T15:25:59.042Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-639 Description: An issue was discovered in GitLab CE/EE affecting all versions starting from 16.7 prior to 17.1.7, 17.2 prior to 17.2.5, and 17.3 prior to 17.3.2, where group runners information was disclosed to unauthorised group members. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/472012 - https://hackerone.com/reports/2584372
CVE ID: CVE-2024-6687 State: PUBLISHED Published: 2024-08-01T01:59:32.153Z Last Updated: 2024-08-01T14:16:43.382Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: limpinho Products: CTT Expresso para WooCommerce Problem Types: CWE-200 Description: The CTT Expresso para WooCommerce plugin for WordPress is vulnerable to sensitive information exposure in all versions up to and including 3.2.12 via the /wp-content/uploads/cepw directory. The generated .pdf and log files are publicly accessible and contain sensitive information such as sender and receiver names, phone numbers, physical addresses, and email addresses Additional Analyst Notes: - CISA ADP Vulnrichmen
receiver names, phone numbers, physical addresses, and email addresses Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/13088645-8233-40fb-8755-cbdf44c0eaf7?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3127496%40ctt-expresso-para-woocommerce&new=3127496%40ctt-expresso-para-woocommerce&sfp_email=&sfph_mail=#file25
CVE ID: CVE-2024-6688 State: PUBLISHED Published: 2024-08-27T04:29:17.960Z Last Updated: 2024-08-27T17:46:41.034Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Oxygen Builder Products: Oxygen Builder Problem Types: CWE-862 Description: The Oxygen Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the oxy_save_css_from_admin AJAX action in all versions up to, and including, 4.8.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update stylesheets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-in
update stylesheets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/78c88402-52ca-44ff-8767-1f843fcb66fd?source=cve - https://oxygenbuilder.com/oxygen-4-9-now-available/
CVE ID: CVE-2024-6689 State: PUBLISHED Published: 2024-07-15T13:18:09.079Z Last Updated: 2024-08-01T21:41:04.324Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: baramundi Products: Management Agent Problem Types: CWE-749 Description: Local Privilege Escalation in MSI-Installer in baramundi Management Agent v23.1.172.0 on Windows allows a local unprivileged user to escalate privileges to SYSTEM. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.baramundi.com/en-us/security-info/s-2024-01/
CVE ID: CVE-2024-6690 State: PUBLISHED Published: 2025-05-15T20:07:08.750Z Last Updated: 2025-05-20T19:24:07.403Z Vendors: Unknown Products: wccp-pro Problem Types: CWE-601 URL Redirection to Untrusted Site ('Open Redirect') Description: The wccp-pro WordPress plugin before 15.3 contains an open-redirect flaw via the referrer parameter, allowing redirection of users to external sites Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/09c6848d-30dc-4382-ae74-b470f586e142/
CVE ID: CVE-2024-6691 State: PUBLISHED Published: 2024-08-10T02:01:19.896Z Last Updated: 2024-08-12T14:32:55.588Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: smub Products: Easy Digital Downloads – eCommerce Payments and Subscriptions made easy Problem Types: CWE-79 Description: The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the currency value in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, t
sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0459a6bd-334d-43b7-b289-271108564a53?source=cve - https://plugins.trac.wordpress.org/changeset/3131805/easy-digital-downloads/tags/3.3.3/src/Admin/Settings/Sanitize.php
CVE ID: CVE-2024-6692 State: PUBLISHED Published: 2024-08-10T02:01:23.075Z Last Updated: 2024-08-12T14:50:45.563Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N) Vendors: smub Products: Easy Digital Downloads – eCommerce Payments and Subscriptions made easy Problem Types: CWE-79 Description: The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Agreement Text value in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access
ut sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e54d5ab2-40ba-4ad8-9a77-44aba37f0283?source=cve - https://plugins.trac.wordpress.org/changeset/3131805/easy-digital-downloads/tags/3.3.3/includes/checkout/template.php
CVE ID: CVE-2024-6693 State: PUBLISHED Published: 2025-05-15T20:07:08.961Z Last Updated: 2025-05-20T19:23:57.320Z Vendors: Unknown Products: wccp-pro Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The wccp-pro WordPress plugin before 15.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2b1af7eb-452a-43f4-aae9-edd8e7312fe8/
CVE ID: CVE-2024-6694 State: PUBLISHED Published: 2024-07-20T03:20:31.783Z Last Updated: 2024-08-01T21:41:04.257Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: smub Products: WP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin Problem Types: CWE-257 Description: The WP Mail SMTP plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 4.0.1. This is due to plugin providing the SMTP password in the SMTP Password field when viewing the settings. This makes it possible for authenticated attackers, with administrative-level access and above, to view the SMTP password for the supplied server. Although this w
ttackers, with administrative-level access and above, to view the SMTP password for the supplied server. Although this would not be useful for attackers in most cases, if an administrator account becomes compromised this could be useful information to an attacker in a limited environment. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2d4e9daf-d414-4ace-9efd-4c3e16deeb8f?source=cve - https://plugins.trac.wordpress.org/changeset/3120454/wp-mail-smtp/trunk/src/Providers/OptionsAbstract.php
CVE ID: CVE-2024-6695 State: PUBLISHED Published: 2024-07-31T06:00:04.649Z Last Updated: 2024-07-31T15:06:31.038Z Vendors: Unknown Products: User Profile Builder Problem Types: CWE-287 Improper Authentication Description: it's possible for an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions. This is due to improper logic flow on the user registration process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/4afa5c85-ce27-4ca7-bba2-61fb39c53a5b/
CVE ID: CVE-2024-6696 State: PUBLISHED Published: 2025-02-19T23:29:43.131Z Last Updated: 2025-02-20T17:21:02.881Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Hitachi Vantara Products: Pentaho Data Integration & Analytics, Pentaho Business Analytics Server Problem Types: CWE-1220 Description: The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensiti
, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets. (CWE-1220) Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, do not correctly perform an authorization check in the user console trash content An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.pentaho.com/hc/en-us/articles/34296877157517--Resolved-Hitachi-Vantara-Pe
DP Vulnrichment: References: - https://support.pentaho.com/hc/en-us/articles/34296877157517--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Insufficient-Granularity-of-Access-Control-Versions-before-10-2-0-0-and-9-3-0-9-including-8-3-x-Impacted-CVE-2024-6696
CVE ID: CVE-2024-6697 State: PUBLISHED Published: 2025-02-19T23:32:18.713Z Last Updated: 2025-02-20T17:23:54.281Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Hitachi Vantara Products: Pentaho Data Integration & Analytics, Pentaho Business Analytics Server Problem Types: CWE-280 Description: The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state. (CWE-280) Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x
state. (CWE-280) Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, do not handle invalid and missing permissions correctly, resulting in a denial of service. An adversary leverages a legitimate capability of an application in such a way as to achieve a negative technical impact. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.pentaho.com/hc/en-us/articles/34296654642701--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Improper-Handling-of-Insufficient-Permissions-or-Privileges-Versions-before-10-2-0-0-and-9-3-0-9-including-8-3-x-Impacted-CVE-2024-6697
CVE ID: CVE-2024-6698 State: PUBLISHED Published: 2024-08-01T03:29:58.918Z Last Updated: 2024-08-01T14:10:21.095Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: xpeedstudio Products: FundEngine – Donation and Crowdfunding Platform Problem Types: CWE-862 Description: The FundEngine plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.0. This is due to the plugin not properly verifying user meta updated through the update_user_meta function. This makes it possible for authenticated attackers, with subscriber-level access and above, to update their user meta which can be leveraged to update their capabilities to ga
h subscriber-level access and above, to update their user meta which can be leveraged to update their capabilities to gain administrator access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2ec6cf42-291b-452d-ad14-80ae1cd5ec5c?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3128099%40wp-fundraising-donation%2Ftrunk&old=3072093%40wp-fundraising-donation%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-6699 State: PUBLISHED Published: 2024-07-30T12:29:42.810Z Last Updated: 2024-08-12T20:49:02.080Z Vendors: Mikafon Electronic Inc. Products: Mikafon MA7 Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mikafon Electronic Inc. Mikafon MA7 allows SQL Injection.This issue affects Mikafon MA7: from v3.0 before v3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-24-1105
CVE ID: CVE-2024-6700 State: PUBLISHED Published: 2024-09-12T14:24:08.681Z Last Updated: 2024-09-12T15:06:40.532Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N) Vendors: Pegasystems Products: Pega Infinity Problem Types: CWE-79 Description: Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with App name. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.pega.com/support-doc/pega-security-advisory-c24-vulnerability-remediation-note
CVE ID: CVE-2024-6701 State: PUBLISHED Published: 2024-09-12T14:25:28.473Z Last Updated: 2024-09-12T15:05:49.076Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N) Vendors: Pegasystems Products: Pega Infinity Problem Types: CWE-79 Description: Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with case type. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.pega.com/support-doc/pega-security-advisory-c24-vulnerability-remediation-note
CVE ID: CVE-2024-6702 State: PUBLISHED Published: 2024-09-12T14:25:44.692Z Last Updated: 2024-09-12T15:04:50.576Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N) Vendors: Pegasystems Products: Pega Infinity Problem Types: CWE-74 Description: Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an HTML Injection issue with Stage. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.pega.com/support-doc/pega-security-advisory-c24-vulnerability-remediation-note
CVE ID: CVE-2024-6703 State: PUBLISHED Published: 2024-07-27T12:30:05.686Z Last Updated: 2024-08-01T21:41:04.267Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: techjewel Products: Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder Problem Types: CWE-79 Description: The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘description’ and 'btn_txt' parameters in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for attackers with the Form Mana
1.19 due to insufficient input sanitization and output escaping. This makes it possible for attackers with the Form Manager permissions and Subscriber+ user role, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/69dc9236-8079-434f-b2b5-060a0c5eba46?source=cve - https://plugins.trac.wordpress.org/browser/fluentform/trunk/app/Services/FluentConversational/Classes/Elements/WelcomeScreen.php - https://plugins.trac.wordpress.org/changeset/3125227/
CVE ID: CVE-2024-6704 State: PUBLISHED Published: 2024-08-02T10:59:33.380Z Last Updated: 2024-08-02T15:30:39.774Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: advancedcoding Products: Comments – wpDiscuz Problem Types: CWE-79 Description: The Comments – wpDiscuz plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 7.6.21. This is due to a lack of filtering of HTML tags in comments. This makes it possible for unauthenticated attackers to add HTML such as hyperlinks to comments when rich editing is disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabi
abled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fa3501a4-7975-4f90-8037-f8a06c293c07?source=cve - https://plugins.trac.wordpress.org/browser/wpdiscuz/trunk/class.WpdiscuzCore.php#L335 - https://plugins.trac.wordpress.org/changeset/3124810/
CVE ID: CVE-2024-6705 State: PUBLISHED Published: 2024-07-18T02:03:58.037Z Last Updated: 2024-08-01T21:41:04.317Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: ericmann Products: RegLevel Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The RegLevel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will exe
icated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b6ead872-76a7-49c3-af07-d87a4c68183f?source=cve - https://plugins.trac.wordpress.org/browser/reglevel/trunk/includes/admin.php#L73 - https://wordpress.org/plugins/reglevel/#developers - https://plugins.trac.wordpress.org/browser/reglevel/trunk/includes/functions.php#L11
CVE ID: CVE-2024-6706 State: PUBLISHED Published: 2024-08-07T23:01:15.473Z Last Updated: 2024-08-08T15:02:48.839Z Vendors: Open WebUI Products: Open WebUI Problem Types: CWE-79 Description: Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://korelogic.com/Resources/Advisories/KL-001-2024-005.txt
CVE ID: CVE-2024-6707 State: PUBLISHED Published: 2024-08-07T23:04:45.137Z Last Updated: 2024-08-08T15:02:49.851Z Vendors: Open WebUI Products: Open WebUI Problem Types: CWE-22, CWE-434 Description: Attacker controlled files can be uploaded to arbitrary locations on the web server's filesystem by abusing a path traversal vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://korelogic.com/Resources/Advisories/KL-001-2024-006.txt
CVE ID: CVE-2024-6708 State: PUBLISHED Published: 2025-05-15T20:07:09.159Z Last Updated: 2025-05-20T19:23:48.654Z Vendors: Unknown Products: User Profile Builder Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The User Profile Builder WordPress plugin before 3.12.2 does not sanitise and escape some parameters before outputting its content on the admin area, which allows Admin+ users to perform Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b6822bd9-f9f9-41a4-ad19-019b1f03bd4c/
CVE ID: CVE-2024-6709 State: PUBLISHED Published: 2024-08-03T11:37:37.807Z Last Updated: 2024-08-05T19:44:02.179Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: kp4coder Products: Sync Post With Other Site Problem Types: CWE-862 Description: The Sync Post With Other Site plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'sps_add_update_post' function in all versions up to, and including, 1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create new draft posts and update existing posts. Additional Analyst Notes: - CISA ADP Vulnrichment: References
bove, to create new draft posts and update existing posts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3d97eee1-0f72-4dd3-998a-acb454fa5e8a?source=cve - https://plugins.trac.wordpress.org/browser/sync-post-with-other-site/trunk/includes/sps_sync.class.php#L231 - https://plugins.trac.wordpress.org/changeset/3128945/
CVE ID: CVE-2024-6710 State: PUBLISHED Published: 2024-08-05T06:00:08.327Z Last Updated: 2024-08-07T20:27:21.053Z Vendors: Unknown Products: Ditty Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Ditty WordPress plugin before 3.1.45 does not sanitise and escape some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1afcf9d4-c2f9-4d47-8d9e-d7fa6ae2358d/
CVE ID: CVE-2024-6711 State: PUBLISHED Published: 2025-05-15T20:09:46.782Z Last Updated: 2025-11-13T20:59:18.331Z Vendors: Unknown Products: Event Tickets with Ticket Scanner Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Event Tickets with Ticket Scanner WordPress plugin before 2.3.8 does not sanitise and escape some parameters, which could allow users with a role as low as admin to perform Cross-Site Scripting attacks Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/bf431b81-2db9-4fcb-841c-9b51d1870bf8/