Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-12477 State: PUBLISHED Published: 2025-01-22T21:21:53.814Z Last Updated: 2025-01-22T22:01:57.646Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themefusion Products: Avada (Fusion) Builder Problem Types: CWE-79 Description: The Avada Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.11.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses
contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7c54588f-6436-406f-93cb-b08965586d11?source=cve - https://avada.com
CVE ID: CVE-2024-12478 State: PUBLISHED Published: 2024-12-16T10:31:04.893Z Last Updated: 2024-12-16T15:19:36.132Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: InvoicePlane Problem Types: CWE-434, CWE-284 Description: A vulnerability was found in InvoicePlane up to 1.6.1. It has been declared as critical. This vulnerability affects the function upload_file of the file /index.php/upload/upload_file/1/1. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.6.2-beta-1 is able to address this issue. It is recommended to upgrade th
public and may be used. Upgrading to version 1.6.2-beta-1 is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.288538 - https://vuldb.com/?ctiid.288538 - https://vuldb.com/?submit.459910 - https://github.com/InvoicePlane/InvoicePlane/pull/1141 - https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.6.2-beta-1
CVE ID: CVE-2024-12479 State: PUBLISHED Published: 2024-12-11T18:31:05.461Z Last Updated: 2024-12-11T19:22:38.584Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: cjbi Products: wetech-cms Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in cjbi wetech-cms 1.0/1.1/1.2 and classified as critical. This issue affects the function searchTopicByKeyword of the file wetech-cms-master\wetech-core\src\main\java\tech\wetech\cms\dao\TopicDao.java. The manipulation of the argument keyword leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did
exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.287861 - https://vuldb.com/?ctiid.287861 - https://vuldb.com/?submit.458849 - https://github.com/hadagaga/vuln/blob/master/wetech-cms/sql-1/SQL_injection_vulnerability.md
CVE ID: CVE-2024-12480 State: PUBLISHED Published: 2024-12-11T19:00:17.240Z Last Updated: 2024-12-13T17:43:35.525Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: cjbi Products: wetech-cms Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in cjbi wetech-cms 1.0/1.1/1.2. It has been classified as critical. Affected is the function searchTopic of the file wetech-cms-master\wetech-core\src\main\java\tech\wetech\cms\dao\TopicDao.java. The manipulation of the argument con leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not
ploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.287862 - https://vuldb.com/?ctiid.287862 - https://vuldb.com/?submit.458851 - https://github.com/hadagaga/vuln/blob/master/wetech-cms/sql-2/SQL_injection_vulnerability.md
CVE ID: CVE-2024-12481 State: PUBLISHED Published: 2024-12-11T19:31:04.913Z Last Updated: 2024-12-11T21:17:07.403Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: cjbi Products: wetech-cms Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in cjbi wetech-cms 1.0/1.1/1.2. It has been declared as critical. Affected by this vulnerability is the function findUser of the file wetech-cms-master\wetech-core\src\main\java\tech\wetech\cms\dao\UserDao.java. The manipulation of the argument searchValue/gId/rId leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this
unched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.287863 - https://vuldb.com/?ctiid.287863 - https://vuldb.com/?submit.458852 - https://github.com/hadagaga/vuln/blob/master/wetech-cms/sql-3/SQL_injection_vulnerability.md
CVE ID: CVE-2024-12482 State: PUBLISHED Published: 2024-12-11T19:31:06.607Z Last Updated: 2024-12-11T21:24:13.491Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: cjbi Products: wetech-cms Problem Types: CWE-24, CWE-23 Description: A vulnerability was found in cjbi wetech-cms 1.0/1.1/1.2. It has been rated as problematic. Affected by this issue is the function backup of the file wetech-cms-master\wetech-basic-common\src\main\java\tech\wetech\basic\util\BackupFileUtil.java of the component Database Backup Handler. The manipulation of the argument name leads to path traversal: '../filedir'. The attack may be launched remotely. The exploit has been disclosed to
ument name leads to path traversal: '../filedir'. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.287864 - https://vuldb.com/?ctiid.287864 - https://vuldb.com/?submit.458853 - https://github.com/hadagaga/vuln/blob/master/wetech-cms/Catalog_penetration/Catalog_penetration.md
CVE ID: CVE-2024-12483 State: PUBLISHED Published: 2024-12-11T20:00:15.323Z Last Updated: 2024-12-11T21:27:41.611Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Dromara Products: UJCMS Problem Types: CWE-639, CWE-285 Description: A vulnerability classified as problematic has been found in Dromara UJCMS up to 9.6.3. This affects an unknown part of the file /users/id of the component User ID Handler. The manipulation leads to authorization bypass. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Additional Analyst
xploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.287865 - https://vuldb.com/?ctiid.287865 - https://vuldb.com/?submit.458895 - https://github.com/cydtseng/Vulnerability-Research/blob/main/ujcms/IDOR-UsernameEnumeration.md
CVE ID: CVE-2024-12484 State: PUBLISHED Published: 2024-12-11T20:00:17.419Z Last Updated: 2024-12-11T21:28:26.660Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Codezips Products: Technical Discussion Forum Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in Codezips Technical Discussion Forum 1.0. This vulnerability affects unknown code of the file /signuppost.php. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.287866 - https://vuldb.com/?ctiid.287866 - https://vuldb.com/?submit.459076 - https://github.com/LiChaser/CVE/
CVE ID: CVE-2024-12485 State: PUBLISHED Published: 2024-12-11T20:31:05.271Z Last Updated: 2024-12-12T14:12:04.596Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Online Class and Exam Scheduling System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in code-projects Online Class and Exam Scheduling System 1.0. This issue affects some unknown processing of the file /pages/department.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment:
otely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.287867 - https://vuldb.com/?ctiid.287867 - https://vuldb.com/?submit.459077 - https://github.com/bjtyyy/CVE/blob/main/Online%20Class%20and%20Exam%20Scheduling%20System_department_php.docx - https://code-projects.org/
CVE ID: CVE-2024-12486 State: PUBLISHED Published: 2024-12-11T20:31:07.068Z Last Updated: 2024-12-12T14:10:32.158Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Online Class and Exam Scheduling System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in code-projects Online Class and Exam Scheduling System 1.0. Affected is an unknown function of the file /pages/rank_update.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.287868 - https://vuldb.com/?ctiid.287868 - https://vuldb.com/?submit.459081 - https://github.com/bjtyyy/CVE/blob/main/Online%20Class%20and%20Exam%20Scheduling%20System_rank_update_php.docx - https://code-projects.org/
CVE ID: CVE-2024-12487 State: PUBLISHED Published: 2024-12-11T21:00:15.807Z Last Updated: 2024-12-12T14:03:53.134Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Online Class and Exam Scheduling System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in code-projects Online Class and Exam Scheduling System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /pages/room_update.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnri
ched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.287869 - https://vuldb.com/?ctiid.287869 - https://vuldb.com/?submit.459083 - https://github.com/bjtyyy/CVE/blob/main/Online%20Class%20and%20Exam%20Scheduling%20System_room_update_php.docx - https://code-projects.org/
CVE ID: CVE-2024-12488 State: PUBLISHED Published: 2024-12-11T21:31:05.125Z Last Updated: 2024-12-12T16:33:35.612Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Online Class and Exam Scheduling System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Online Class and Exam Scheduling System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /pages/subject_update.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment:
otely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.287870 - https://vuldb.com/?ctiid.287870 - https://vuldb.com/?submit.459097 - https://github.com/bjtyyy/CVE/blob/main/Online%20Class%20and%20Exam%20Scheduling%20System_subject_update_php%20.docx - https://code-projects.org/
CVE ID: CVE-2024-12489 State: PUBLISHED Published: 2024-12-11T22:00:12.704Z Last Updated: 2024-12-12T16:39:32.736Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Online Class and Exam Scheduling System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Online Class and Exam Scheduling System 1.0. It has been classified as critical. This affects an unknown part of the file /pages/term.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
loit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.287871 - https://vuldb.com/?ctiid.287871 - https://vuldb.com/?submit.459113 - https://github.com/bjtyyy/CVE/blob/main/Online%20Class%20and%20Exam%20Scheduling%20System_term_php%20.docx - https://code-projects.org/
CVE ID: CVE-2024-12490 State: PUBLISHED Published: 2024-12-11T22:31:05.614Z Last Updated: 2024-12-12T16:31:44.865Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Online Class and Exam Scheduling System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Online Class and Exam Scheduling System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /pages/teacher_save.php. The manipulation of the argument salut leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional
y. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.287872 - https://vuldb.com/?ctiid.287872 - https://vuldb.com/?submit.459116 - https://github.com/bjtyyy/CVE/blob/main/Online%20Class%20and%20Exam%20Scheduling%20System_teacher_save_php.docx - https://code-projects.org/
CVE ID: CVE-2024-12491 State: PUBLISHED Published: 2025-01-09T11:11:02.963Z Last Updated: 2025-01-09T14:30:59.897Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: reichertbrothers Products: SimplyRETS Real Estate IDX Problem Types: CWE-79 Description: The SimplyRETS Real Estate IDX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sr_search_form' shortcode in all versions up to, and including, 2.11.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that w
le for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/aa5c2d05-f6cb-4f97-b174-653ad3577b02?source=cve - https://wordpress.org/plugins/simply-rets/
CVE ID: CVE-2024-12492 State: PUBLISHED Published: 2024-12-11T23:00:16.332Z Last Updated: 2024-12-12T15:39:11.302Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Farmacia Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Farmacia 1.0. It has been rated as critical. This issue affects some unknown processing of the file /visualizar-usuario.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.287873 - https://vuldb.com/?ctiid
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.287873 - https://vuldb.com/?ctiid.287873 - https://vuldb.com/?submit.459115 - https://github.com/A1ph4D3v1l/cve/blob/main/sql-x.md - https://code-projects.org/
CVE ID: CVE-2024-12493 State: PUBLISHED Published: 2025-01-09T11:10:54.340Z Last Updated: 2025-01-09T15:06:49.689Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: blueberryacc Products: Files Download Delay Problem Types: CWE-79 Description: The Files Download Delay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fddwrap' shortcode in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a u
ackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/217f3595-3c35-46c1-a02c-e8829732a719?source=cve - https://plugins.trac.wordpress.org/browser/files-download-delay/trunk/post.php - https://wordpress.org/plugins/files-download-delay/
CVE ID: CVE-2024-12494 State: PUBLISHED Published: 2025-01-24T09:21:51.989Z Last Updated: 2025-02-12T17:14:33.264Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: otrok7 Products: BMLT Meeting Map Problem Types: CWE-79 Description: The BMLT Meeting Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bmlt_meeting_map' shortcode in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user a
s, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/73c01967-262c-48ab-a464-401b1cadd4be?source=cve - https://plugins.trac.wordpress.org/browser/bmlt-meeting-map/tags/2.6.0/meeting_map.php#L33 - https://plugins.trac.wordpress.org/browser/bmlt-meeting-map/tags/2.6.0/meeting_map.php#L462
CVE ID: CVE-2024-12495 State: PUBLISHED Published: 2025-01-07T06:40:58.027Z Last Updated: 2025-01-07T16:12:34.530Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: virgial Products: Bootstrap Blocks for WP Editor v2 Problem Types: CWE-79 Description: The Bootstrap Blocks for WP Editor v2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gtb-bootstrap/column' block in all versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user acc
with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4e9e9afc-89a0-444d-ad5b-975e0f3c19d5?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3213432%40wp-editor-bootstrap-blocks&new=3213432%40wp-editor-bootstrap-blocks&sfp_email=&sfph_mail=#file33
CVE ID: CVE-2024-12496 State: PUBLISHED Published: 2025-01-09T11:10:54.739Z Last Updated: 2025-01-09T15:06:27.704Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: linearoy Products: Linear Problem Types: CWE-79 Description: The Linear plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'linear_block_buy_commissions' shortcode in all versions up to, and including, 2.7.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user access
th contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/25d6ee47-2a7b-486e-856b-336964b387ae?source=cve - https://plugins.trac.wordpress.org/browser/linear/trunk/blocks/buy-commissions/buy-commissions.php#L213 - https://wordpress.org/plugins/linear
CVE ID: CVE-2024-12497 State: PUBLISHED Published: 2024-12-11T23:31:05.741Z Last Updated: 2024-12-12T15:43:06.761Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: 1000 Projects Products: Attendance Tracking Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in 1000 Projects Attendance Tracking Management System 1.0. Affected is an unknown function of the file /admin/check_admin_login.php. The manipulation of the argument admin_user_name leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment:
motely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.287874 - https://vuldb.com/?ctiid.287874 - https://vuldb.com/?submit.459239 - https://github.com/Ta0k1a/CVE/issues/1 - https://1000projects.org/
CVE ID: CVE-2024-12498 State: REJECTED Published: N/A Last Updated: 2025-07-16T22:17:51.989Z Description: No description available.
CVE ID: CVE-2024-12499 State: PUBLISHED Published: 2025-01-07T06:40:58.481Z Last Updated: 2025-01-07T16:12:20.409Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: biztechc Products: WP jQuery DataTable Problem Types: CWE-79 Description: The WP jQuery DataTable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_jdt' shortcode in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user acc
with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5c6a6422-8255-4a3c-9ddf-b5986e1d393f?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3213340%40wp-jquery-datatable&new=3213340%40wp-jquery-datatable&sfp_email=&sfph_mail=