Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-11235 State: PUBLISHED Published: 2025-04-04T17:51:07.550Z Last Updated: 2025-04-05T03:55:36.686Z Vendors: PHP Group Products: PHP Problem Types: CWE-416 Description: In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code sequence involving __set handler or ??= operator and exceptions can lead to a use-after-free vulnerability. If the third party can control the memory layout leading to this, for example by supplying specially crafted inputs to the script, it could lead to remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/php/php-src/security/advisories/GHSA-rwp7-7vc6-8477
CVE ID: CVE-2024-11236 State: PUBLISHED Published: 2024-11-24T00:44:54.951Z Last Updated: 2025-11-03T21:51:54.520Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: PHP Group Products: PHP Problem Types: CWE-787 Description: In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/php/php-src/security/advisories/GHSA-5hqh-c84r-qjcv
CVE ID: CVE-2024-11237 State: PUBLISHED Published: 2024-11-15T12:00:15.886Z Last Updated: 2024-11-15T20:42:20.206Z Severity: N/A (CVSS 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C) Vendors: TP-Link Products: VN020 F3v(T) Problem Types: CWE-121, CWE-119 Description: A vulnerability, which was classified as critical, has been found in TP-Link VN020 F3v(T) TT_V6.2.1021. Affected by this issue is some unknown functionality of the component DHCP DISCOVER Packet Parser. The manipulation of the argument hostname leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - h
oit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.284672 - https://vuldb.com/?ctiid.284672 - https://vuldb.com/?submit.438408 - https://github.com/Zephkek/TP-Thumper - https://github.com/Zephkek/TP-Thumper/blob/main/poc.c - https://www.tp-link.com/
CVE ID: CVE-2024-11238 State: PUBLISHED Published: 2024-11-15T12:31:04.496Z Last Updated: 2024-11-15T20:23:10.217Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Landray Products: EKP Problem Types: CWE-22 Description: A vulnerability, which was classified as critical, was found in Landray EKP up to 16.0. This affects the function delPreviewFile of the file /sys/ui/sys_ui_component/sysUiComponent.do?method=delPreviewFile. The manipulation of the argument directoryPath leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but
The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.284673 - https://vuldb.com/?ctiid.284673 - https://vuldb.com/?submit.438291 - https://github.com/CoinIsMoney/TempGuide/blob/main/LL-exp-02.pdf
CVE ID: CVE-2024-11239 State: PUBLISHED Published: 2024-11-15T13:31:04.349Z Last Updated: 2024-11-15T20:21:15.845Z Severity: N/A (CVSS 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P) Vendors: Landray Products: EKP Problem Types: CWE-22 Description: A vulnerability has been found in Landray EKP up to 16.0 and classified as critical. This vulnerability affects the function deleteFile of the file /sys/common/import.do?method=deleteFile of the component API Interface. The manipulation of the argument folder leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any wa
closed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.284674 - https://vuldb.com/?ctiid.284674 - https://vuldb.com/?submit.438784 - https://github.com/CoinIsMoney/TempGuide/blob/main/LL-exp-03.pdf
CVE ID: CVE-2024-11240 State: PUBLISHED Published: 2024-11-15T13:31:06.183Z Last Updated: 2024-11-15T18:37:21.131Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: IBPhoenix Products: ibWebAdmin Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in IBPhoenix ibWebAdmin up to 1.0.2 and classified as problematic. This issue affects some unknown processing of the file /database.php of the component Banco de Dados Tab. The manipulation of the argument db_login_role leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in
een disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.284675 - https://vuldb.com/?ctiid.284675 - https://vuldb.com/?submit.438471 - https://docs.google.com/document/d/1_kk14QhqJuqMGzAD_SUlOSvCGwYdeF4gI8m7mVTPBAQ/edit?usp=sharing
CVE ID: CVE-2024-11241 State: PUBLISHED Published: 2024-11-15T14:31:04.777Z Last Updated: 2024-11-15T18:27:33.380Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: code-projects Products: Job Recruitment Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Job Recruitment 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file reset.php. The manipulation of the argument e leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.284677 - https:/
and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.284677 - https://vuldb.com/?ctiid.284677 - https://vuldb.com/?submit.442036 - https://github.com/Anti-Entropy-Zhurong/cve/blob/main/sql-1.md - https://code-projects.org/
CVE ID: CVE-2024-11242 State: PUBLISHED Published: 2024-11-15T14:31:06.459Z Last Updated: 2024-11-15T18:24:15.168Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: n/a Products: ZZCMS Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in ZZCMS 2023. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/ad_list.php?action=pass of the component Keyword Filtering. The manipulation of the argument keyword leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.284678
he public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.284678 - https://vuldb.com/?ctiid.284678 - https://vuldb.com/?submit.442038 - https://github.com/En0t5/vul/blob/main/zzcms/zzcms-add_list-sql-inject.md
CVE ID: CVE-2024-11243 State: PUBLISHED Published: 2024-11-15T15:00:09.181Z Last Updated: 2024-11-15T18:59:49.052Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: code-projects Products: Online Shop Store Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic has been found in code-projects Online Shop Store 1.0. This affects an unknown part of the file /signup.php. The manipulation of the argument m2 with the input <svg%20onload=alert(document.cookie)> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
e exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.284679 - https://vuldb.com/?ctiid.284679 - https://vuldb.com/?submit.442075 - https://github.com/sh3rl0ckpggp/0day/blob/main/code-projects_online-shop_CrossSiteScripting.md - https://youtu.be/QThAqddl5Dk - https://code-projects.org/
CVE ID: CVE-2024-11244 State: PUBLISHED Published: 2024-11-15T15:31:04.987Z Last Updated: 2024-11-15T16:44:38.176Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Farmacia Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in code-projects Farmacia 1.0. This vulnerability affects unknown code of the file /editar-cliente.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.284680 - https://vuldb.com/?ctiid.284680 - https
yst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.284680 - https://vuldb.com/?ctiid.284680 - https://vuldb.com/?submit.443177 - https://github.com/zsx020121/cve/blob/main/sql.md - https://code-projects.org/
CVE ID: CVE-2024-11245 State: PUBLISHED Published: 2024-11-15T15:31:06.619Z Last Updated: 2024-11-15T16:42:26.323Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Farmacia Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in code-projects Farmacia 1.0. This issue affects some unknown processing of the file /editar-produto.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.284681 - https://vuldb.com/?
sed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.284681 - https://vuldb.com/?ctiid.284681 - https://vuldb.com/?submit.443188 - https://github.com/WEFNNTT/cve/blob/main/sql.md - https://code-projects.org/
CVE ID: CVE-2024-11246 State: PUBLISHED Published: 2024-11-15T16:00:10.038Z Last Updated: 2024-11-15T16:31:32.741Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: code-projects Products: Farmacia Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, was found in code-projects Farmacia 1.0. Affected is an unknown function of the file /adicionar-cliente.php. The manipulation of the argument nome/cpf/dataNascimento leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory mentions the parameter "nome" to be affected. But further i
the public and may be used. The initial researcher advisory mentions the parameter "nome" to be affected. But further inspection indicates that other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.284682 - https://vuldb.com/?ctiid.284682 - https://vuldb.com/?submit.443189 - https://github.com/curry136/cve/blob/main/xss8.md - https://code-projects.org/
CVE ID: CVE-2024-11247 State: PUBLISHED Published: 2024-11-15T16:31:05.234Z Last Updated: 2024-11-15T17:08:49.087Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Online Eyewear Shop Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in SourceCodester Online Eyewear Shop 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /oews/classes/Master.php?f=save_product of the component Inventory Page. The manipulation of the argument brand leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters migh
The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.284683 - https://vuldb.com/?ctiid.284683 - https://vuldb.com/?submit.443194 - https://github.com/Fl4g-Pshacker/cve/blob/main/xss.md - https://www.sourcecodester.com/
CVE ID: CVE-2024-11248 State: PUBLISHED Published: 2024-11-15T17:00:12.864Z Last Updated: 2024-11-15T19:30:31.322Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: AC10 Problem Types: CWE-121, CWE-119 Description: A vulnerability was found in Tenda AC10 16.03.10.13 and classified as critical. Affected by this issue is the function formSetRebootTimer of the file /goform/SetSysAutoRebbotCfg. The manipulation of the argument rebootTime leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.284684 - http
ic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.284684 - https://vuldb.com/?ctiid.284684 - https://vuldb.com/?submit.443204 - https://tasty-foxtrot-3a8.notion.site/Tenda-AC10v4-formSetRebootTimer-stack-overflow-13d0448e619580bf8ab1df7cfb6c018b - https://www.tenda.com.cn/
CVE ID: CVE-2024-11250 State: PUBLISHED Published: 2024-11-15T17:31:04.583Z Last Updated: 2024-11-15T18:18:54.247Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Inventory Management Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Inventory Management up to 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /model/editProduct.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.2846
the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.284686 - https://vuldb.com/?ctiid.284686 - https://vuldb.com/?submit.443272 - https://github.com/sh3rl0ckpggp/0day/blob/main/inventory-management_authenticated_sqli.md - https://code-projects.org/
CVE ID: CVE-2024-11251 State: PUBLISHED Published: 2024-11-15T18:00:12.868Z Last Updated: 2024-11-19T16:11:57.733Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: erzhongxmu Products: Jeewms Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in erzhongxmu Jeewms up to 20241108. It has been rated as critical. This issue affects some unknown processing of the file cgReportController.do of the component AuthInterceptor. The manipulation of the argument begin_date leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and
isclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.284687 - https://vuldb.com/?ctiid.284687 - https://gitee.com/erzhongxmu/JEEWMS/issues/IB2XZG
CVE ID: CVE-2024-11252 State: PUBLISHED Published: 2024-11-30T05:41:11.487Z Last Updated: 2024-12-01T23:07:52.153Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: heateor Products: Social Sharing Plugin – Sassy Social Share Problem Types: CWE-79 Description: The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the heateor_mastodon_share parameter in all versions up to, and including, 3.3.69 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user
r unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3d065c2a-da7d-469a-b57d-f2fd5b760ff4?source=cve - https://plugins.trac.wordpress.org/browser/sassy-social-share/tags/3.3.69/public/class-sassy-social-share-public.php#L1478 - https://plugins.trac.wordpress.org/browser/sassy-social-share/tags/3.3.69/public/class-sassy-social-share-public.php#L1481
CVE ID: CVE-2024-11253 State: PUBLISHED Published: 2025-03-11T01:29:00.993Z Last Updated: 2025-03-12T04:00:35.853Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Zyxel Products: VMG8825-T50K firmware Problem Types: CWE-78 Description: A post-authentication command injection vulnerability in the "DNSServer” parameter of the diagnostic function in the Zyxel VMG8825-T50K firmware version V5.50(ABOM.8.5)C0 and earlier could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on a vulnerable device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-a
ice. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-vulnerabilities-in-certain-dsl-ethernet-cpe-fiber-ont-and-wifi-extender-devices-03-11-2025
CVE ID: CVE-2024-11254 State: PUBLISHED Published: 2024-12-18T03:22:05.525Z Last Updated: 2024-12-18T16:35:04.395Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: mohammed_kaludi Products: AMP for WP – Accelerated Mobile Pages Problem Types: CWE-79 Description: The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the disqus_name parameter in all versions up to, and including, 1.1.1 due to insufficient input validation. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as cl
t arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5da82149-c827-4574-8269-b2b798edca59?source=cve - https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.0.93/includes/disqus.html?rev=3024147#L34
CVE ID: CVE-2024-11256 State: PUBLISHED Published: 2024-11-15T19:31:04.276Z Last Updated: 2024-11-19T16:13:29.112Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: 1000 Projects Products: Portfolio Management System MCA Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in 1000 Projects Portfolio Management System MCA 1.0 and classified as critical. This issue affects some unknown processing of the file /login.php. The manipulation of the argument username leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?i
sed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.284711 - https://vuldb.com/?ctiid.284711 - https://vuldb.com/?submit.443370 - https://github.com/Hacker0xone/CVE/issues/8 - https://1000projects.org/
CVE ID: CVE-2024-11257 State: PUBLISHED Published: 2024-11-15T19:31:05.826Z Last Updated: 2024-11-19T16:14:29.773Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: 1000 Projects Products: Beauty Parlour Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in 1000 Projects Beauty Parlour Management System 1.0. This affects an unknown part of the file /admin/forgot-password.php. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.284715 - https://vuldb.com/?ctiid.284715 - https://vuldb.com/?submit.443385 - https://github.com/Hacker0xone/CVE/issues/10 - https://1000projects.org/
CVE ID: CVE-2024-11258 State: PUBLISHED Published: 2024-11-15T20:00:06.969Z Last Updated: 2024-11-19T16:22:11.846Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: 1000 Projects Products: Beauty Parlour Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in 1000 Projects Beauty Parlour Management System 1.0. This vulnerability affects unknown code of the file /admin/index.php. The manipulation of the argument username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?
osed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.284716 - https://vuldb.com/?ctiid.284716 - https://vuldb.com/?submit.443386 - https://github.com/Hacker0xone/CVE/issues/11 - https://1000projects.org/
CVE ID: CVE-2024-11259 State: PUBLISHED Published: 2024-11-15T20:00:12.174Z Last Updated: 2024-11-19T16:23:48.912Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: code-projects Products: Farmacia Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, has been found in code-projects Farmacia 1.0. This issue affects some unknown processing of the file /fornecedores.php. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.284717 - https://vuldb.com/?ctiid.284717
al Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.284717 - https://vuldb.com/?ctiid.284717 - https://vuldb.com/?submit.443398 - https://github.com/13u11erFly/cve/blob/main/xss.md - https://code-projects.org/
CVE ID: CVE-2024-11260 State: PUBLISHED Published: 2025-02-21T05:22:32.400Z Last Updated: 2025-02-21T14:19:16.963Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: netweblogic Products: Events Manager – Calendar, Bookings, Tickets, and more! Problem Types: CWE-89 Description: The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the active_status parameter in all versions up to, and including, 6.6.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append addition
ufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/925402a5-e203-4976-b0a9-88c974b540b9?source=cve - https://plugins.trac.wordpress.org/browser/events-manager/tags/6.6.3/classes/em-events.php#L606