Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-10293 State: PUBLISHED Published: 2024-10-23T16:00:05.232Z Last Updated: 2024-10-23T17:01:30.348Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: ZZCMS Problem Types: CWE-434 Description: A vulnerability was found in ZZCMS 2023. It has been classified as critical. Affected is the function Ebak_SetGotoPak of the file 3/Ebbak5.1/upload/class/functions.php. The manipulation of the argument file leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281562 - https://vuldb.com/?ctiid.28
itional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281562 - https://vuldb.com/?ctiid.281562 - https://vuldb.com/?submit.427146 - https://github.com/LvZCh/zzcms2023/issues/6
CVE ID: CVE-2024-10294 State: PUBLISHED Published: 2024-11-09T02:32:03.300Z Last Updated: 2024-11-12T16:07:10.676Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: ce21com Products: CE21 Suite Problem Types: CWE-862 Description: The CE21 Suite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ce21_single_sign_on_save_api_settings' function in versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to change plugin settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cd6ce97c-fd80-4c4
otes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cd6ce97c-fd80-4c43-a4d2-02aa91d11fac?source=cve - https://plugins.trac.wordpress.org/browser/ce21-suite/trunk/includes/ce21-functions.php?rev=3097700#L340
CVE ID: CVE-2024-10295 State: PUBLISHED Published: 2024-10-24T17:55:10.314Z Last Updated: 2025-11-20T07:09:43.758Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: Red Hat 3scale API Management Platform 2 Problem Types: CWE-863 Description: A flaw was found in Gateway. Sending a non-base64 'basic' auth with special characters can cause APICast to incorrectly authenticate a request. A malformed basic authentication header containing special characters bypasses authentication and allows unauthorized access to the backend. This issue can occur due to a failure in the base64 decoding process, which causes APICast to skip the rest of the authentica
issue can occur due to a failure in the base64 decoding process, which causes APICast to skip the rest of the authentication checks and proceed with routing the request upstream. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2024-10295 - https://bugzilla.redhat.com/show_bug.cgi?id=2321258
CVE ID: CVE-2024-10296 State: PUBLISHED Published: 2024-10-23T17:00:07.415Z Last Updated: 2024-10-24T14:01:31.126Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: PHPGurukul Products: Medical Card Generation System Problem Types: CWE-89 Description: A vulnerability was found in PHPGurukul Medical Card Generation System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/card-bwdates-reports-details.php of the component Report of Medical Card Page. The manipulation of the argument fromdate/todate leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used
eads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281563 - https://vuldb.com/?ctiid.281563 - https://vuldb.com/?submit.427400 - https://phpgurukul.com/
CVE ID: CVE-2024-10297 State: PUBLISHED Published: 2024-10-23T17:31:05.102Z Last Updated: 2024-10-24T14:51:50.271Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: PHPGurukul Products: Medical Card Generation System Problem Types: CWE-89 Description: A vulnerability was found in PHPGurukul Medical Card Generation System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/changeimage.php of the component Managecard Edit Image Page. The manipulation of the argument editid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA A
y be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281564 - https://vuldb.com/?ctiid.281564 - https://phpgurukul.com/
CVE ID: CVE-2024-10298 State: PUBLISHED Published: 2024-10-23T18:31:04.521Z Last Updated: 2024-10-24T14:29:39.189Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: PHPGurukul Products: Medical Card Generation System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in PHPGurukul Medical Card Generation System 1.0. This affects an unknown part of the file /admin/edit-card-detail.php of the component Managecard Edit Card Detail Page. The manipulation of the argument editid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vu
e attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281565 - https://vuldb.com/?ctiid.281565 - https://vuldb.com/?submit.427403 - https://phpgurukul.com/
CVE ID: CVE-2024-10299 State: PUBLISHED Published: 2024-10-23T19:00:07.541Z Last Updated: 2024-10-23T19:32:58.512Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: PHPGurukul Products: Medical Card Generation System Problem Types: CWE-89 Description: A vulnerability classified as critical was found in PHPGurukul Medical Card Generation System 1.0. This vulnerability affects unknown code of the file /admin/view-card-detail.php of the component Managecard View Detail Page. The manipulation of the argument viewid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichmen
remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281566 - https://vuldb.com/?ctiid.281566 - https://phpgurukul.com/
CVE ID: CVE-2024-10300 State: PUBLISHED Published: 2024-10-23T19:31:05.026Z Last Updated: 2024-10-23T20:00:42.564Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: PHPGurukul Products: Medical Card Generation System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in PHPGurukul Medical Card Generation System 1.0. This issue affects some unknown processing of the file /admin/view-enquiry.php of the component View Enquiry Page. The manipulation of the argument viewid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnr
iated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281567 - https://vuldb.com/?ctiid.281567 - https://vuldb.com/?submit.427404 - https://phpgurukul.com/
CVE ID: CVE-2024-10301 State: PUBLISHED Published: 2024-10-23T19:31:07.192Z Last Updated: 2024-10-23T20:00:17.561Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: PHPGurukul Products: Medical Card Generation System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in PHPGurukul Medical Card Generation System 1.0. Affected is an unknown function of the file /admin/search-medicalcard.php of the component Search. The manipulation of the argument searchdata leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment:
otely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281568 - https://vuldb.com/?ctiid.281568 - https://vuldb.com/?submit.427405 - https://phpgurukul.com/
CVE ID: CVE-2024-10305 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:04:30.528Z Description: No description available.
CVE ID: CVE-2024-10306 State: PUBLISHED Published: 2025-04-23T09:59:49.150Z Last Updated: 2025-11-08T07:11:48.337Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat JBoss Core Services Problem Types: CWE-863 Description: A vulnerability was found in mod_proxy_cluster. The issue is that the <Directory> directive should be replaced by the <Location> directive as the former does not restrict IP/host access as `Require ip IP_ADDRESS` would suggest. This means that anyone with access to the host might send MCMP requests that may r
Require ip IP_ADDRESS` would suggest. This means that anyone with access to the host might send MCMP requests that may result in adding/removing/updating nodes for the balancing. However, this host should not be accessible to the public network as it does not serve the general traffic. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHBA-2025:2973 - https://access.redhat.com/errata/RHBA-2025:5309 - https://access.redhat.com/errata/RHSA-2025:9434 - https://access.redhat.com/errata/RHSA-2025:9466 - https://access.redhat.com/errata/RHSA-2025:9997 - https://access.redhat.com/security/cve/CVE-2024-10306 - https://bugzilla.redhat.com/show_bug.cgi?i
rata/RHSA-2025:9997 - https://access.redhat.com/security/cve/CVE-2024-10306 - https://bugzilla.redhat.com/show_bug.cgi?id=2321302
CVE ID: CVE-2024-10307 State: PUBLISHED Published: 2025-03-28T10:02:23.294Z Last Updated: 2025-03-28T13:42:16.490Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: CWE-770 Description: An issue has been discovered in GitLab EE/CE affecting all versions from 12.10 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. A maliciously crafted file can cause uncontrolled CPU consumption when viewing the associated merge request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/500497 - https://hackerone.com/reports/2775113
CVE ID: CVE-2024-10308 State: PUBLISHED Published: 2024-11-26T11:04:30.982Z Last Updated: 2024-11-26T14:09:22.493Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: jegtheme Products: Jeg Elementor Kit Problem Types: CWE-79 Description: The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's JKit - Countdown widget in all versions up to, and including, 2.6.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user ac
, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/98aed079-672c-43bb-a5eb-faf8ffc04b71?source=cve - https://plugins.trac.wordpress.org/changeset/3193980/jeg-elementor-kit
CVE ID: CVE-2024-10309 State: PUBLISHED Published: 2025-01-30T06:00:05.682Z Last Updated: 2025-01-30T16:09:08.050Z Vendors: Unknown Products: Tracking Code Manager Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Tracking Code Manager WordPress plugin before 2.4.0 does not sanitise and escape some of its metabox settings when outputing them in the page, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/9eb21250-34bd-4600-a0a5-7c5117f69f04/
CVE ID: CVE-2024-10310 State: PUBLISHED Published: 2024-11-02T02:03:04.606Z Last Updated: 2024-11-02T16:43:39.622Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bdthemes Products: Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) Problem Types: CWE-79 Description: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom Gallery Widget 'image_title' parameter in all versions up to, and including, 5.10.1 due to insufficient input sanitization and output escaping. This makes i
er in all versions up to, and including, 5.10.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/144d755a-e61a-4ecd-9d9a-9c6e3a1e6ea2?source=cve - https://plugins.trac.wordpress.org/changeset/3176764/bdthemes-element-pack-lite/trunk/modules/custom-gallery/widgets/custom-gallery.php
CVE ID: CVE-2024-10311 State: PUBLISHED Published: 2024-11-15T09:29:40.406Z Last Updated: 2024-11-18T15:05:31.021Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: cmorillas1 Products: External Database Based Actions Problem Types: CWE-288 Description: The External Database Based Actions plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 0.1. This is due to a missing capability check in the 'edba_admin_handle' function. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to update the plugin settings and log in as any existing user on the site, such as an administrator. Addi
ons and above, to update the plugin settings and log in as any existing user on the site, such as an administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d41a8c39-8b06-45b2-afe4-8c695faf8cb8?source=cve - https://plugins.trac.wordpress.org/browser/external-database-based-actions/trunk/lib/edba-admin-ajax-controller.php?rev=1785239#L8
CVE ID: CVE-2024-10312 State: PUBLISHED Published: 2024-10-29T07:30:55.243Z Last Updated: 2024-10-29T13:49:00.325Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: timstrifler Products: Exclusive Addons for Elementor Problem Types: CWE-200 Description: The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.4 via the render function in elements/tabs/tabs.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
extract sensitive private, pending, and draft template data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dc931943-13f3-4ab1-b70f-c234253ca269?source=cve - https://plugins.trac.wordpress.org/changeset/3175285/exclusive-addons-for-elementor
CVE ID: CVE-2024-10313 State: PUBLISHED Published: 2024-10-24T17:41:56.069Z Last Updated: 2024-10-24T18:29:45.979Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: iniNet Solutions Products: SpiderControl SCADA PC HMI Editor Problem Types: CWE-22 Description: iniNet Solutions SpiderControl SCADA PC HMI Editor has a path traversal vulnerability. When the software loads a malicious ‘ems' project template file constructed by an attacker, it can write files to arbitrary directories. This can lead to overwriting system files, causing system paralysis, or writing to startup items, resulting in remote control. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
, or writing to startup items, resulting in remote control. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-298-02
CVE ID: CVE-2024-10314 State: PUBLISHED Published: 2024-11-11T14:11:12.415Z Last Updated: 2025-01-29T19:43:07.659Z Vendors: Helix Products: Helix Core Problem Types: CWE-400 Description: In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the auto-generation function was identified. Reported by Karol Więsek. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portal.perforce.com/s/detail/a91PA000001SZNFYA4
CVE ID: CVE-2024-10315 State: PUBLISHED Published: 2024-11-11T19:12:28.760Z Last Updated: 2024-11-18T21:28:49.880Z Vendors: Gliffy Products: Gliffy Online Problem Types: CWE-942 Description: In Gliffy Online an insecure configuration was discovered in versions before 4.14.0-6. Reported by Alpha Inferno PVT LTD. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portal.perforce.com/s/detail/a91PA000001SZVJYA4
CVE ID: CVE-2024-10316 State: PUBLISHED Published: 2024-11-21T11:02:19.230Z Last Updated: 2024-11-21T14:00:31.564Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: jetmonsters Products: Stratum – Elementor Widgets Problem Types: CWE-200 Description: The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.4 in includes/templates/content-switcher.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:
itive private, pending, and draft template data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0a1cf60b-47bd-4e67-8fe4-6cf46809f2b2?source=cve - https://plugins.trac.wordpress.org/changeset/3189021
CVE ID: CVE-2024-10318 State: PUBLISHED Published: 2024-11-06T16:48:56.128Z Last Updated: 2024-11-06T16:57:40.692Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: F5 Products: NGINX OpenID Connect, NGINX Instance Manager, NGINX API Connectivity Manager, NGINX Ingress Controller Problem Types: CWE-384 Description: A session fixation issue was discovered in the NGINX OpenID Connect reference implementation, where a nonce was not checked at login time. This flaw allows an attacker to fix a victim's session to an attacker-controlled account. As a result, although the attacker cannot log in as the victim, they can force the session to associate it with the attack
a result, although the attacker cannot log in as the victim, they can force the session to associate it with the attacker-controlled account, leading to potential misuse of the victim's session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000148232
CVE ID: CVE-2024-10319 State: PUBLISHED Published: 2024-11-05T11:00:47.752Z Last Updated: 2024-11-05T14:52:09.136Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: xpro Products: 140+ Widgets | Xpro Addons For Elementor – FREE Problem Types: CWE-200 Description: The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6 via the render function in widgets/content-toggle/layout/frontend.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data. Additional
rs, with Contributor-level access and above, to extract sensitive private, pending, and draft template data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/382a46c2-9fec-4642-93b0-c06b9ed1c086?source=cve - https://plugins.trac.wordpress.org/changeset/3179221/xpro-elementor-addons
CVE ID: CVE-2024-10320 State: PUBLISHED Published: 2024-12-06T08:24:54.348Z Last Updated: 2024-12-06T17:35:21.834Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: iamjonasmarlo Products: Cookielay Problem Types: CWE-79 Description: The Cookielay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cookielay shortcode in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injec
tor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8e014aa5-4fdf-458b-a975-e3ced7186dc2?source=cve - https://wordpress.org/plugins/cookielay/#developers
CVE ID: CVE-2024-10321 State: PUBLISHED Published: 2025-03-08T08:22:55.687Z Last Updated: 2025-03-10T16:08:55.753Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: themesgrove Products: All-in-One Addons for Elementor – WidgetKit Problem Types: CWE-200 Description: The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.4 in elements/advanced-tab/template/view.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data. Additional Analyst Notes: - CISA ADP Vu
ccess and above, to extract sensitive private, pending, and draft template data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2e470017-c453-435d-8342-66874a794537?source=cve - https://plugins.trac.wordpress.org/browser/widgetkit-for-elementor/trunk/elements/advanced-tab/template/view.php#L68
CVE ID: CVE-2024-10322 State: PUBLISHED Published: 2025-02-12T12:22:09.050Z Last Updated: 2025-02-12T16:06:25.400Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themefusecom Products: Brizy – Page Builder Problem Types: CWE-79 Description: The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 2.6.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional An
d above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3b2ef7c3-4610-4e8b-ab27-2d6cbdbed097?source=cve - https://wordpress.org/plugins/brizy/#developers - https://plugins.trac.wordpress.org/changeset/3231744/brizy/trunk/admin/svg/main.php - https://plugins.trac.wordpress.org/changeset/3231744/