Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-11995 State: PUBLISHED Published: 2024-11-29T21:00:12.797Z Last Updated: 2024-12-05T16:16:11.077Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: code-projects Products: Farmacia Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in code-projects Farmacia 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /pagamento.php. The manipulation of the argument total leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286411 - https:
and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286411 - https://vuldb.com/?ctiid.286411 - https://vuldb.com/?submit.453639 - https://github.com/5p4rk/cve/blob/main/xss.md - https://code-projects.org/
CVE ID: CVE-2024-11996 State: PUBLISHED Published: 2024-11-30T07:31:05.239Z Last Updated: 2024-12-05T16:12:22.018Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: code-projects Products: Farmacia Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in code-projects Farmacia 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /editar-fornecedor.php. The manipulation of the argument cidade leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
nd may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286412 - https://vuldb.com/?ctiid.286412 - https://vuldb.com/?submit.453702 - https://github.com/jaychou8023/cve/blob/main/xss1.md - https://code-projects.org/
CVE ID: CVE-2024-11997 State: PUBLISHED Published: 2024-11-30T08:00:14.848Z Last Updated: 2024-12-05T16:09:24.526Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: code-projects Products: Farmacia Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in code-projects Farmacia 1.0. It has been classified as problematic. This affects an unknown part of the file /vendas.php. The manipulation of the argument notaFiscal leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286413 - https://vuldb.com/?
sed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286413 - https://vuldb.com/?ctiid.286413 - https://vuldb.com/?submit.453703 - https://github.com/jaychou8023/cve/blob/main/xss2.md - https://code-projects.org/
CVE ID: CVE-2024-11998 State: PUBLISHED Published: 2024-11-30T09:31:04.641Z Last Updated: 2024-12-02T16:11:43.619Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Farmacia Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Farmacia 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /visualizer-forneccedor.chp. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286414 - https://vuldb.com/?c
ed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286414 - https://vuldb.com/?ctiid.286414 - https://vuldb.com/?submit.453706 - https://github.com/jaychou8023/cve/blob/main/sql1.md - https://code-projects.org/
CVE ID: CVE-2024-11999 State: PUBLISHED Published: 2024-12-17T06:13:00.636Z Last Updated: 2024-12-17T14:40:01.736Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: Harmony (Formerly Magelis) HMIST6, HMISTM6, HMIG3U, HMIG3X, HMISTO7 series with EcoStruxure Operator Terminal Expert runtime, PFXST6000, PFXSTM6000, PFXSP5000, PFXGP4100 series with Pro-face BLUE runtime Problem Types: CWE-1104 Description: CWE-1104: Use of Unmaintained Third-Party Components vulnerability exists that could cause complete control of the device when an authenticated user installs malicious code into HMI product. Additional Analyst Notes: - CISA ADP Vulnric
device when an authenticated user installs malicious code into HMI product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-345-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-345-02.pdf
CVE ID: CVE-2024-12000 State: PUBLISHED Published: 2024-11-30T12:00:16.935Z Last Updated: 2024-12-02T16:01:03.736Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: code-projects Products: Blood Bank System Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in code-projects Blood Bank System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /controllers/updatesettings.php of the component Setting Handler. The manipulation of the argument firstname leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Ad
d remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286415 - https://vuldb.com/?ctiid.286415 - https://vuldb.com/?submit.453717 - https://github.com/jaychou8023/cve/blob/main/xss3.md - https://code-projects.org/
CVE ID: CVE-2024-12001 State: PUBLISHED Published: 2024-11-30T12:31:03.958Z Last Updated: 2024-12-02T15:57:37.838Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: code-projects Products: Wazifa System Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic has been found in code-projects Wazifa System 1.0. Affected is an unknown function of the file /controllers/updatesettings.php of the component Setting Handler. The manipulation of the argument firstname leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analy
e exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286416 - https://vuldb.com/?ctiid.286416 - https://vuldb.com/?submit.453721 - https://github.com/jaychou8023/cve/blob/main/xss4.md - https://code-projects.org/
CVE ID: CVE-2024-12002 State: PUBLISHED Published: 2024-11-30T13:00:14.751Z Last Updated: 2024-12-02T15:54:21.033Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Tenda Products: FH451, FH1201, FH1202, FH1206 Problem Types: CWE-476, CWE-404 Description: A vulnerability classified as problematic was found in Tenda FH451, FH1201, FH1202 and FH1206 up to 20241129. Affected by this vulnerability is the function websReadEvent of the file /goform/GetIPTV. The manipulation of the argument Content-Length leads to null pointer dereference. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CI
k can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286417 - https://vuldb.com/?ctiid.286417 - https://vuldb.com/?submit.453974 - https://github.com/Kalvin2077/tenda-fh-cve - https://www.tenda.com.cn/
CVE ID: CVE-2024-12003 State: PUBLISHED Published: 2024-12-06T08:24:48.974Z Last Updated: 2024-12-06T14:18:27.213Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: mikeyott Products: WP System Problem Types: CWE-352 Description: The WP System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. This is due to missing or incorrect nonce validation on the generate_wp_system_page_content() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additi
forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/05bb119f-06e4-4f56-afc8-0c5a25266b02?source=cve - https://plugins.trac.wordpress.org/browser/wp-system/trunk/wp-system.php#L70
CVE ID: CVE-2024-12004 State: PUBLISHED Published: 2024-12-11T08:57:28.026Z Last Updated: 2024-12-11T15:15:07.670Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: wpclever Products: WPC Order Notes for WooCommerce Problem Types: CWE-352 Description: The WPC Order Notes for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.2. This is due to missing or incorrect nonce validation on the ajax_update_order_note() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action
inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/05f40082-30ed-45f7-81d5-d5334a51fcea?source=cve - https://plugins.trac.wordpress.org/browser/woo-order-notes/trunk/wpc-order-notes.php#L416 - https://wordpress.org/plugins/woo-order-notes/#developers - https://plugins.trac.wordpress.org/changeset/3205072/
CVE ID: CVE-2024-12005 State: PUBLISHED Published: 2025-01-21T09:21:09.602Z Last Updated: 2025-01-21T15:34:45.418Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: zjhzxhz Products: WP-BibTeX Problem Types: CWE-352 Description: The WP-BibTeX plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on the wp_bibtex_option_page() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analys
uest granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/077538e2-ef9a-490f-9188-31f9cb82aaf7?source=cve - https://wordpress.org/plugins/wp-bibtex/#developers - https://plugins.trac.wordpress.org/browser/wp-bibtex/trunk/wp-bibtex-options.php#L55 - https://plugins.trac.wordpress.org/changeset/3225023
CVE ID: CVE-2024-12006 State: PUBLISHED Published: 2025-01-14T07:05:40.976Z Last Updated: 2025-01-14T14:47:20.679Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: boldgrid Products: W3 Total Cache Problem Types: CWE-862 Description: The W3 Total Cache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 2.8.1. This makes it possible for unauthenticated attackers to deactivate the plugin as well as activate and deactivate plugin extensions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulner
tensions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/329ad5dc-9339-4540-aba3-f21a78a74d4b?source=cve - https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.8.0/Extensions_Plugin_Admin.php#L186 - https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.8.0/Extensions_Plugin_Admin.php#L63 - https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.8.0/Extensions_Plugin_Admin.php#L220 - https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.8.0/Generic_Plugin_Admin.php#L212 - https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.8.0/Extensions_Plugin_Admin.php#L60
CVE ID: CVE-2024-12007 State: PUBLISHED Published: 2024-12-01T23:00:12.257Z Last Updated: 2024-12-02T22:15:29.922Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Farmacia Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in code-projects Farmacia 1.0. This affects an unknown part of the file /visualizar-produto.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286491 - https://vuldb.com/?ctiid
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.286491 - https://vuldb.com/?ctiid.286491 - https://vuldb.com/?submit.454715 - https://github.com/LamentXU123/cve/blob/main/cve-l.md - https://code-projects.org/
CVE ID: CVE-2024-12008 State: PUBLISHED Published: 2025-01-14T07:05:41.364Z Last Updated: 2025-01-14T14:47:01.317Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: boldgrid Products: W3 Total Cache Problem Types: CWE-200 Description: The W3 Total Cache plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.8.1 through the publicly exposed debug log file. This makes it possible for unauthenticated attackers to view potentially sensitive information in the exposed log file. For example, the log file may contain nonce values that can be used in further CSRF attacks. Note: the debug feature must be enabled for this to b
may contain nonce values that can be used in further CSRF attacks. Note: the debug feature must be enabled for this to be a concern, and it is disabled by default. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8292f23c-fb17-4082-9788-f643d1bb097e?source=cve - https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.8.0/Util_Environment.php#L430 - https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.8.0/Util_Debug.php#L29
CVE ID: CVE-2024-12009 State: PUBLISHED Published: 2025-03-11T01:37:54.500Z Last Updated: 2025-03-12T04:00:39.718Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Zyxel Products: EX5601-T1 firmware Problem Types: CWE-78 Description: A post-authentication command injection vulnerability in the "ZyEE" function of the Zyxel EX5601-T1 firmware version V5.70(ACDZ.3.6)C0 and earlier could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on a vulnerable device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-p
DP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-vulnerabilities-in-certain-dsl-ethernet-cpe-fiber-ont-and-wifi-extender-devices-03-11-2025
CVE ID: CVE-2024-12010 State: PUBLISHED Published: 2025-03-11T01:44:15.430Z Last Updated: 2025-03-12T04:00:41.041Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Zyxel Products: AX7501-B1 firmware Problem Types: CWE-78 Description: A post-authentication command injection vulnerability in the ”zyUtilMailSend” function of the Zyxel AX7501-B1 firmware version V5.17(ABPC.5.3)C0 and earlier could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on a vulnerable device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advi
: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-vulnerabilities-in-certain-dsl-ethernet-cpe-fiber-ont-and-wifi-extender-devices-03-11-2025
CVE ID: CVE-2024-12011 State: PUBLISHED Published: 2025-02-13T15:59:23.264Z Last Updated: 2025-02-13T16:54:02.337Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L) Vendors: Zettler Products: 130.8005 Problem Types: CWE-126 Description: A CWE-126 “Buffer Over-read” was discovered affecting the 130.8005 TCP/IP Gateway running firmware version 12h. The information disclosure can be triggered by leveraging a memory leak affecting the web server. A remote unauthenticated attacker can exploit this vulnerability in order to leak valid authentication tokens from the process memory associated to users currently logged to the system and bypass the authentication mechanism. Additi
om the process memory associated to users currently logged to the system and bypass the authentication mechanism. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-12011
CVE ID: CVE-2024-12012 State: PUBLISHED Published: 2025-02-13T16:01:29.526Z Last Updated: 2025-02-13T16:53:38.046Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: Zettler Products: 130.8005 Problem Types: CWE-598 Description: A CWE-598 “Use of GET Request Method with Sensitive Query Strings” was discovered affecting the 130.8005 TCP/IP Gateway running firmware version 12h. Both the SHA-1 hash of the password as well as the session tokens are included as part of the URL and therefore exposed to information leakage scenarios. An attacker capable of accessing such values (e.g., victim browser, network traffic inspection) can exploit this vulnerability to leak b
ble of accessing such values (e.g., victim browser, network traffic inspection) can exploit this vulnerability to leak both the password hash as well as session tokens and bypass the authentication mechanism using a pass-the-hash attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-12012
CVE ID: CVE-2024-12013 State: PUBLISHED Published: 2025-02-13T16:03:02.948Z Last Updated: 2025-02-13T16:53:17.702Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L) Vendors: Zettler Products: 130.8005 Problem Types: CWE-1392 Description: A CWE-1392 “Use of Default Credentials” was discovered affecting the 130.8005 TCP/IP Gateway running firmware version 12h. The device exposes an FTP server with default and easy-to-guess admin credentials. A remote attacker capable of interacting with the FTP server could gain access and perform changes over resources exposed by the service such as configuration files where password hashes are saved or where network settings are stored.
xposed by the service such as configuration files where password hashes are saved or where network settings are stored. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-12013
CVE ID: CVE-2024-12014 State: PUBLISHED Published: 2024-12-20T12:58:02.961Z Last Updated: 2025-05-20T14:36:56.171Z Vendors: Lleidanet PKI Products: eSigna Problem Types: CWE-20 Description: Path Traversal vulnerability in the eSignaViewer component in eSigna product versions 1.0 to 1.5 on all platforms allow an unauthenticated attacker to access arbitrary files in the document system via manipulation of file paths and object identifiers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://edgewatch.com/vulnerability-advisories/path-traversal-and-idor-vulnerabilities-in-esignaviewer-allow-unauthorized-file-access/
CVE ID: CVE-2024-12015 State: PUBLISHED Published: 2024-12-02T13:23:50.027Z Last Updated: 2024-12-02T19:18:41.867Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: WeDevs Products: WP Project Manager Problem Types: CWE-89 Description: The 'Project Manager' WordPress Plugin is affected by an authenticated SQL injection vulnerability in the 'orderby' parameter in the '/pm/v2/activites' route. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2024-47
CVE ID: CVE-2024-12016 State: PUBLISHED Published: 2025-03-20T07:25:11.647Z Last Updated: 2025-03-20T15:09:41.232Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: CM Informatics Products: CM News Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CM Informatics CM News allows SQL Injection.This issue affects CM News: through 6.0. NOTE: The vendor was contacted and it was learned that the product is not supported. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0072
CVE ID: CVE-2024-12018 State: PUBLISHED Published: 2024-12-12T05:24:20.501Z Last Updated: 2024-12-12T14:53:56.371Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: aliakro Products: Snippet Shortcodes Problem Types: CWE-862 Description: The Snippet Shortcodes plugin for WordPress is vulnerable to unauthorized Shortcode Deletion due to missing authorization in all versions up to, and including, 4.1.6. Note that a nonce is used as authentication here, but the value is leaked. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's Shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References
level access and above, to delete the plugin's Shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4e6e8f68-6977-478a-b62e-0ec9385eb2af?source=cve - https://wordpress.org/plugins/shortcode-variables/ - https://plugins.trac.wordpress.org/changeset/3205481/shortcode-variables/trunk/includes/hooks.php
CVE ID: CVE-2024-12019 State: PUBLISHED Published: 2025-03-14T18:07:01.253Z Last Updated: 2025-03-18T16:26:57.725Z Vendors: LogicalDOC Products: LogicalDOC Community, LogicalDOC Enterprise Problem Types: CWE-23 Description: The API used to interact with documents in the application contains a flaw that allows an authenticated attacker to read the contents of files on the underlying operating system. An account with ‘read’ and ‘download’ privileges on at least one existing document in the application is required to exploit the vulnerability. Exploitation of this vulnerability would allow an attacker to read the contents of any file available within the privileges of the system user running th
y would allow an attacker to read the contents of any file available within the privileges of the system user running the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.blackduck.com/blog/cyrc-advisory-logicaldoc.html