Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
RHSA-2024:2088 - https://access.redhat.com/errata/RHSA-2024:2833 - https://access.redhat.com/errata/RHSA-2024:3527 - https://access.redhat.com/errata/RHSA-2024:3989 - https://access.redhat.com/errata/RHSA-2024:4884 - https://access.redhat.com/security/cve/CVE-2024-1023 - https://bugzilla.redhat.com/show_bug.cgi?id=2260840 - https://github.com/eclipse-vertx/vert.x/issues/5078 - https://github.com/eclipse-vertx/vert.x/pull/5080 - https://github.com/eclipse-vertx/vert.x/pull/5082
CVE ID: CVE-2024-1024 State: PUBLISHED Published: 2024-01-30T00:31:05.431Z Last Updated: 2024-10-18T14:03:54.898Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Facebook News Feed Like Problem Types: CWE-79 Description: A vulnerability has been found in SourceCodester Facebook News Feed Like 1.0 and classified as problematic. This vulnerability affects unknown code of the component New Account Handler. The manipulation of the argument First Name/Last Name with the input <script>alert(1)</script> leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerab
can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252292. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252292 - https://vuldb.com/?ctiid.252292
CVE ID: CVE-2024-1026 State: PUBLISHED Published: 2024-01-30T01:00:10.307Z Last Updated: 2025-06-09T20:46:36.313Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Cogites Products: eReserv Problem Types: CWE-79 Description: A vulnerability was found in Cogites eReserv 7.7.58 and classified as problematic. This issue affects some unknown processing of the file front/admin/config.php. The manipulation of the argument id with the input %22%3E%3Cscript%3Ealert(%27XSS%27)%3C/script%3E leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-252293 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment
DB-252293 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252293 - https://vuldb.com/?ctiid.252293
CVE ID: CVE-2024-1027 State: PUBLISHED Published: 2024-01-30T03:00:06.789Z Last Updated: 2025-05-30T19:06:29.388Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Facebook News Feed Like Problem Types: CWE-434 Description: A vulnerability, which was classified as critical, was found in SourceCodester Facebook News Feed Like 1.0. Affected is an unknown function of the component Post Handler. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-252300. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252300 - htt
tional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252300 - https://vuldb.com/?ctiid.252300
CVE ID: CVE-2024-1028 State: PUBLISHED Published: 2024-01-30T04:31:04.641Z Last Updated: 2025-06-17T21:29:18.391Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Facebook News Feed Like Problem Types: CWE-79 Description: A vulnerability has been found in SourceCodester Facebook News Feed Like 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Post Handler. The manipulation of the argument Description with the input <marquee>HACKED</marquee> leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252301 was
ck can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252301 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252301 - https://vuldb.com/?ctiid.252301
CVE ID: CVE-2024-1029 State: PUBLISHED Published: 2024-01-30T05:31:05.090Z Last Updated: 2025-06-17T19:44:36.725Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Cogites Products: eReserv Problem Types: CWE-79 Description: A vulnerability was found in Cogites eReserv 7.7.58 and classified as problematic. Affected by this issue is some unknown functionality of the file /front/admin/tenancyDetail.php. The manipulation of the argument Nom with the input Dreux"><script>alert('XSS')</script> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-252302 is the identifier assigned to this vulnerability. Additi
it has been disclosed to the public and may be used. VDB-252302 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252302 - https://vuldb.com/?ctiid.252302
CVE ID: CVE-2024-1030 State: PUBLISHED Published: 2024-01-30T10:00:07.629Z Last Updated: 2025-06-17T21:29:18.517Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Cogites Products: eReserv Problem Types: CWE-79 Description: A vulnerability was found in Cogites eReserv 7.7.58. It has been classified as problematic. This affects an unknown part of the file /front/admin/tenancyDetail.php. The manipulation of the argument id leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-252303. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252303 - ht
itional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252303 - https://vuldb.com/?ctiid.252303
CVE ID: CVE-2024-1031 State: PUBLISHED Published: 2024-01-30T13:00:07.747Z Last Updated: 2025-06-11T20:27:24.613Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: CodeAstro Products: Expense Management System Problem Types: CWE-79 Description: A vulnerability was found in CodeAstro Expense Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file templates/5-Add-Expenses.php of the component Add Expenses Page. The manipulation of the argument item leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252304. A
ely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252304. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252304 - https://vuldb.com/?ctiid.252304 - https://docs.qq.com/doc/DYmhqV3piekZ5dlZi
CVE ID: CVE-2024-1032 State: PUBLISHED Published: 2024-01-30T13:31:05.697Z Last Updated: 2024-08-27T20:30:58.534Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: n/a Products: openBI Problem Types: CWE-502 Description: A vulnerability classified as critical was found in openBI up to 1.0.8. Affected by this vulnerability is the function testConnection of the file /application/index/controller/Databasesource.php of the component Test Connection Handler. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252307. Additional Analyst Notes:
to the public and may be used. The associated identifier of this vulnerability is VDB-252307. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252307 - https://vuldb.com/?ctiid.252307 - https://note.zhaoj.in/share/6ISYe2urjlkI
CVE ID: CVE-2024-1033 State: PUBLISHED Published: 2024-01-30T14:00:09.769Z Last Updated: 2025-05-29T15:05:25.559Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: openBI Problem Types: CWE-200 Description: A vulnerability, which was classified as problematic, has been found in openBI up to 1.0.8. Affected by this issue is the function agent of the file /application/index/controller/Datament.php. The manipulation of the argument api leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252308. Additional Analyst Notes: - CVE P
sed to the public and may be used. The identifier of this vulnerability is VDB-252308. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252308 - https://vuldb.com/?ctiid.252308 - https://note.zhaoj.in/share/nD654ot6zRQZ
CVE ID: CVE-2024-1034 State: PUBLISHED Published: 2024-01-30T14:31:05.379Z Last Updated: 2024-11-12T20:39:27.678Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: n/a Products: openBI Problem Types: CWE-434 Description: A vulnerability, which was classified as critical, was found in openBI up to 1.0.8. This affects the function uploadFile of the file /application/index/controller/File.php. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252309 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
-252309 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252309 - https://vuldb.com/?ctiid.252309 - https://note.zhaoj.in/share/ABYkFE4wRPW5
CVE ID: CVE-2024-1035 State: PUBLISHED Published: 2024-01-30T16:00:07.279Z Last Updated: 2024-08-23T19:33:45.891Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: n/a Products: openBI Problem Types: CWE-434 Description: A vulnerability has been found in openBI up to 1.0.8 and classified as critical. This vulnerability affects the function uploadIcon of the file /application/index/controller/Icon.php. The manipulation of the argument image leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-252310 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - C
sed. VDB-252310 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252310 - https://vuldb.com/?ctiid.252310 - https://note.zhaoj.in/share/AIbnbytIW9Bq
CVE ID: CVE-2024-1036 State: PUBLISHED Published: 2024-01-30T17:31:04.867Z Last Updated: 2024-10-17T18:00:15.188Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: n/a Products: openBI Problem Types: CWE-434 Description: A vulnerability was found in openBI up to 1.0.8 and classified as critical. This issue affects the function uploadIcon of the file /application/index/controller/Screen.php of the component Icon Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252311. Additional Analyst Notes: - CVE Program Container: - CI
. The associated identifier of this vulnerability is VDB-252311. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252311 - https://vuldb.com/?ctiid.252311 - https://note.zhaoj.in/share/X1ASzPP5rHel
CVE ID: CVE-2024-1037 State: PUBLISHED Published: 2024-02-07T06:46:56.951Z Last Updated: 2024-08-01T18:26:30.414Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: davidanderson Products: All-In-One Security (AIOS) – Security and Firewall Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The All-In-One Security (AIOS) – Security and Firewall plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 5.2.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to i
.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b50772e5-5142-4f50-b5c0-6116a8821cba?source=cve - https://plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/trunk/admin/wp-security-list-404.php#L32 - https://plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/trunk/admin/wp-security-list-404.php#L5
- https://plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/trunk/admin/wp-security-list-404.php#L50 - https://plugins.trac.wordpress.org/changeset/3032127/all-in-one-wp-security-and-firewall/tags/5.2.6/admin/wp-security-list-404.php
CVE ID: CVE-2024-1038 State: PUBLISHED Published: 2024-03-13T15:27:20.273Z Last Updated: 2024-08-01T18:26:30.362Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: justinbusa Products: Beaver Builder – WordPress Page Builder Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via a 'playground.wordpress.net' parameter in all versions up to, and including, 2.7.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacker
2.7.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e2cc2776-9496-42b5-a242-c572ae5462fb?source=cve - https://plugins.trac.wordpress.org/browser/beaver-builder-lite-version/tags/2.7.4.2/js/fl-builder.js#L1578 - https://plugins.trac.wordpress.org/changeset/3032809/beaver-builder-lite-version/tags/2.7.4.3/js/fl-builder.js?old=3012561&ol
://plugins.trac.wordpress.org/changeset/3032809/beaver-builder-lite-version/tags/2.7.4.3/js/fl-builder.js?old=3012561&old_path=beaver-builder-lite-version/tags/2.7.4.2/js/fl-builder.js
CVE ID: CVE-2024-1039 State: PUBLISHED Published: 2024-02-01T21:38:48.454Z Last Updated: 2025-08-07T18:28:32.629Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Gessler GmbH Products: WEB-MASTER Problem Types: CWE-798 Description: Gessler GmbH WEB-MASTER has a restoration account that uses weak hard coded credentials and if exploited could allow an attacker control over the web management of the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-032-01
CVE ID: CVE-2024-1040 State: PUBLISHED Published: 2024-02-01T21:41:08.954Z Last Updated: 2025-08-07T18:30:57.997Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Gessler GmbH Products: WEB-MASTER Problem Types: CWE-327 Description: Gessler GmbH WEB-MASTER user account is stored using a weak hashing algorithm. The attacker can restore the passwords by breaking the hashes stored on the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-032-01
CVE ID: CVE-2024-1041 State: PUBLISHED Published: 2024-04-10T04:30:18.707Z Last Updated: 2024-08-01T18:26:30.401Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: princeahmed Products: WP Radio – Worldwide Online Radio Stations Directory for WordPress Problem Types: CWE-862 Missing Authorization Description: The WP Radio – Worldwide Online Radio Stations Directory for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's settings in all versions up to, and including, 3.1.9 due to insufficient input sanitization and output escaping as well as insufficient access control on the settings. This makes it possible for authenti
tization and output escaping as well as insufficient access control on the settings. This makes it possible for authenticated attackers, with subscriber access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/486ffdc9-a3e7-4f4c-89b1-b668a5d41aa5?source=cve - https://wordpress.org/plugins/wp-radio/
CVE ID: CVE-2024-1042 State: PUBLISHED Published: 2024-04-10T04:30:21.118Z Last Updated: 2024-08-01T18:26:30.468Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: princeahmed Products: WP Radio – Worldwide Online Radio Stations Directory for WordPress Problem Types: CWE-862 Missing Authorization Description: The WP Radio – Worldwide Online Radio Stations Directory for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in all versions up to, and including, 3.1.9. This makes it possible for authenticated attackers, with subscriber access and above, to import radio statio
ing, 3.1.9. This makes it possible for authenticated attackers, with subscriber access and above, to import radio stations, remove countries, and modify the plugin's settings, which can lead to Cross-Site Scripting, tracked separately in CVE-2024-1041. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b46e9771-37ff-4825-9af9-02ecde424653?source=cve - https://wordpress.org/plugins/wp-radio/
CVE ID: CVE-2024-1043 State: PUBLISHED Published: 2024-02-20T18:56:51.608Z Last Updated: 2024-08-01T18:26:30.399Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: mohammed_kaludi Products: AMP for WP – Accelerated Mobile Pages Problem Types: CWE-285 Improper Authorization Description: The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'amppb_remove_saved_layout_data' function in all versions up to, and including, 1.0.93.1. This makes it possible for authenticated attackers, with contributor access and above, to delete arbitrary posts on the site. Additional Analyst
or authenticated attackers, with contributor access and above, to delete arbitrary posts on the site. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ffb70e82-355b-48f3-92d0-19659ed2550e?source=cve - https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.0.93.1/pagebuilder/inc/adminAjaxContents.php#L134 - https://wordpress.org/plugins/accelerated-mobile-pages/ - https://plugins.trac.wordpress.org/changeset/3030425/accelerated-mobile-pages/tags/1.0.93.2/pagebuilder/inc/adminAjaxContents.php?old=3025105&old_path=accelerated-mobile-pages%2Ftags%2F1.0.93.1%2Fpagebuilder%2Finc%2
ebuilder/inc/adminAjaxContents.php?old=3025105&old_path=accelerated-mobile-pages%2Ftags%2F1.0.93.1%2Fpagebuilder%2Finc%2FadminAjaxContents.php
CVE ID: CVE-2024-1044 State: PUBLISHED Published: 2024-02-20T18:56:28.134Z Last Updated: 2024-08-11T13:29:43.855Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: ivole Products: Customer Reviews for WooCommerce Problem Types: CWE-284 Improper Access Control Description: The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submit_review' function in all versions up to, and including, 5.38.12. This makes it possible for unauthenticated attackers to submit reviews with arbitrary email addresses regardless of whether reviews are globally enabled. Additional Analyst
to submit reviews with arbitrary email addresses regardless of whether reviews are globally enabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4420c334-1ea4-4549-b391-150702abc2f8?source=cve - https://plugins.trac.wordpress.org/changeset?old_path=%2Fcustomer-reviews-woocommerce%2Ftags%2F5.38.12&old=3032310&new_path=%2Fcustomer-reviews-woocommerce%2Ftags%2F5.39.0&new=3032310&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1046 State: PUBLISHED Published: 2024-02-05T21:21:51.417Z Last Updated: 2024-08-01T18:26:30.426Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: collizo4sky Products: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin 'reg-number-field' shortcode in all versi
ugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin 'reg-number-field' shortcode in all versions up to, and including, 4.14.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7911c774-3fb0-4d6c-a847-101e5ad8637a?source=cve - https://plugins.trac.wordpress.org/changeset/3030229/wp-user-av
ies/id/7911c774-3fb0-4d6c-a847-101e5ad8637a?source=cve - https://plugins.trac.wordpress.org/changeset/3030229/wp-user-avatar/trunk/src/ShortcodeParser/Builder/FieldsShortcodeCallback.php
CVE ID: CVE-2024-1047 State: PUBLISHED Published: 2024-02-02T05:33:14.536Z Last Updated: 2025-06-17T21:29:24.238Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: themeisle Products: Orbit Fox by ThemeIsle Problem Types: CWE-862 Missing Authorization Description: The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the register_reference() function in all versions up to, and including, 2.10.28. This makes it possible for unauthenticated attackers to update the connected API keys. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://w
connected API keys. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6147582f-578a-47ad-b16c-65c37896783d?source=cve - https://plugins.trac.wordpress.org/browser/themeisle-companion/trunk/vendor/codeinwp/themeisle-sdk/src/Modules/Promotions.php#L175 - https://plugins.trac.wordpress.org/changeset/3029507/themeisle-companion/tags/2.10.29/vendor/codeinwp/themeisle-sdk/src/Modules/Promotions.php