Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282926 - https://vuldb.com/?ctiid.282926 - https://vuldb.com/?submit.436391 - https://github.com/secuserx/CVE/blob/main/%5BXSS%20vulnerability%5D%20found%20in%20Online%20Shopping%20Portal%202.0%20-%20(js_data.php).md - https://phpgurukul.com/
CVE ID: CVE-2024-10758 State: PUBLISHED Published: 2024-11-04T03:31:04.265Z Last Updated: 2024-11-04T17:01:46.227Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: code-projects, anirbandutta9 Products: Content Management System, News-Buzz Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in code-projects/anirbandutta9 Content Management System and News-Buzz 1.0. This affects an unknown part of the file /index.php. The manipulation of the argument user_name leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product is distributed under two entirely
k remotely. The exploit has been disclosed to the public and may be used. This product is distributed under two entirely different names. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282927 - https://vuldb.com/?ctiid.282927 - https://vuldb.com/?submit.436395 - https://github.com/EmilGallajov/zero-day/blob/main/content_management_system_sqli.md
CVE ID: CVE-2024-10759 State: PUBLISHED Published: 2024-11-04T04:00:07.603Z Last Updated: 2024-11-04T17:55:07.852Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: Farm Management System Problem Types: CWE-89 Description: A vulnerability has been found in itsourcecode Farm Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /edit-pig.php. The manipulation of the argument pigno/weight/arrived/breed/remark/status leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory only mentions the parameter "pigno" to be af
en disclosed to the public and may be used. The initial researcher advisory only mentions the parameter "pigno" to be affected. But it must be assumed that other parameters are affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282928 - https://vuldb.com/?ctiid.282928 - https://vuldb.com/?submit.436418 - https://github.com/liujiaquan1122/cve/issues/2 - https://itsourcecode.com/
CVE ID: CVE-2024-10760 State: PUBLISHED Published: 2024-11-04T04:31:04.451Z Last Updated: 2024-11-04T17:42:04.260Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: University Event Management System Problem Types: CWE-89 Description: A vulnerability was found in code-projects University Event Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /dodelete.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282
o the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282929 - https://vuldb.com/?ctiid.282929 - https://vuldb.com/?submit.436442 - https://github.com/MurphyEutopia/cve/blob/main/sql15.md - https://code-projects.org/
CVE ID: CVE-2024-10761 State: PUBLISHED Published: 2024-11-04T05:00:06.691Z Last Updated: 2025-01-22T07:47:21.294Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: Umbraco Products: CMS Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in Umbraco CMS up to 10.7.7/12.3.6/13.5.2/14.3.1/15.1.1. It has been classified as problematic. Affected is an unknown function of the file /Umbraco/preview/frame?id{} of the component Dashboard. The manipulation of the argument culture leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 10.8.8, 13.5.3, 14.3.2 and 15.1.2 is a
he exploit has been disclosed to the public and may be used. Upgrading to version 10.8.8, 13.5.3, 14.3.2 and 15.1.2 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282930 - https://vuldb.com/?ctiid.282930 - https://vuldb.com/?submit.427091 - https://drive.google.com/file/d/1YoZgdlS3QT7Xu005j9RO-FFUT8RbB0Da/view?usp=sharing - https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-69cg-w8vm-h229
CVE ID: CVE-2024-10762 State: PUBLISHED Published: 2025-03-20T10:09:35.139Z Last Updated: 2025-03-20T18:37:15.812Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-862 Description: In lunary-ai/lunary before version 1.5.9, the /v1/evaluators/ endpoint allows users to delete evaluators of a project by sending a DELETE request. However, the route lacks proper access control, such as middleware to ensure that only users with appropriate roles can delete evaluator data. This vulnerability allows low-privilege users to delete evaluators data, causing permanent data loss and potentially hindering operations. Add
ows low-privilege users to delete evaluators data, causing permanent data loss and potentially hindering operations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/23ab508e-d956-4861-b28f-0569d3b404a6 - https://github.com/lunary-ai/lunary/commit/91587496673da24cb7ddedfbbd6e602592b20ef6
CVE ID: CVE-2024-10763 State: PUBLISHED Published: 2025-02-13T04:21:47.006Z Last Updated: 2025-02-13T14:34:06.218Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ApusTheme Products: Campress Problem Types: CWE-22 Description: The Campress theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.35 via the 'campress_woocommerce_get_ajax_products' function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases
e in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d818b467-a893-4f4f-b623-abff99ef37b4?source=cve - https://themeforest.net/item/campress-responsive-education-courses-and-events-wordpress-theme/19355619
CVE ID: CVE-2024-10764 State: PUBLISHED Published: 2024-11-04T15:31:04.401Z Last Updated: 2024-11-05T15:24:52.251Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Codezips Products: Online Institute Management System Problem Types: CWE-434, CWE-284, CWE-266 Description: A vulnerability classified as critical has been found in Codezips Online Institute Management System 1.0. This affects an unknown part of the file /pages/save_user.php. The manipulation of the argument image leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
t has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282951 - https://vuldb.com/?ctiid.282951 - https://vuldb.com/?submit.436477 - https://github.com/xiaobsss/CVE/issues/1
CVE ID: CVE-2024-10765 State: PUBLISHED Published: 2024-11-04T15:31:05.931Z Last Updated: 2024-11-04T16:49:25.815Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Codezips Products: Online Institute Management System Problem Types: CWE-434, CWE-284, CWE-266 Description: A vulnerability classified as critical was found in Codezips Online Institute Management System up to 1.0. This vulnerability affects unknown code of the file /profile.php. The manipulation of the argument old_image leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https
has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282952 - https://vuldb.com/?ctiid.282952 - https://vuldb.com/?submit.436520 - https://github.com/hbuzs/CVE/issues/1
CVE ID: CVE-2024-10766 State: PUBLISHED Published: 2024-11-04T17:31:04.507Z Last Updated: 2024-11-04T18:30:25.484Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Codezips Products: Free Exam Hall Seating Management System Problem Types: CWE-434, CWE-284, CWE-266 Description: A vulnerability, which was classified as critical, has been found in Codezips Free Exam Hall Seating Management System 1.0. This issue affects some unknown processing of the file /pages/save_user.php. The manipulation of the argument image leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The initial researcher disclosure contai
itiated remotely. The exploit has been disclosed to the public and may be used. The initial researcher disclosure contains confusing vulnerability classes and file names. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282953 - https://vuldb.com/?ctiid.282953 - https://vuldb.com/?submit.436478 - https://github.com/Charlotte008/cve/issues/3
CVE ID: CVE-2024-10768 State: PUBLISHED Published: 2024-11-04T18:31:06.063Z Last Updated: 2024-11-04T19:20:02.988Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: PHPGurukul Products: Online Shopping Portal Problem Types: CWE-79, CWE-74, CWE-707 Description: A vulnerability classified as problematic was found in PHPGurukul Online Shopping Portal 2.0. This vulnerability affects unknown code of the file /admin/assets/plugins/DataTables/media/unit_testing/templates/two_tables.php. The manipulation of the argument scripts leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA A
be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282988 - https://vuldb.com/?ctiid.282988 - https://vuldb.com/?submit.436531 - https://github.com/secuserx/CVE/blob/main/%5BXSS%20vulnerability%5D%20found%20in%20Online%20Shopping%20Portal%202.0%20-%20(two_tables.php).md - https://phpgurukul.com/
CVE ID: CVE-2024-10770 State: PUBLISHED Published: 2024-11-09T04:32:25.665Z Last Updated: 2024-11-11T11:56:34.458Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: envothemes Products: Envo Extra Problem Types: CWE-639 Description: The Envo Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.3 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to. Additional Analyst
to extract data from private or draft posts created by Elementor that they should not have access to. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/08b0f5e0-f68a-4fea-9d62-468956012a6d?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3182181%40envo-extra&new=3182181%40envo-extra&sfp_email=&sfph_mail=
CVE ID: CVE-2024-10771 State: PUBLISHED Published: 2024-12-06T12:24:40.610Z Last Updated: 2024-12-09T14:47:30.064Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SICK AG Products: SICK InspectorP61x, SICK InspectorP62x, TiM3xx Problem Types: CWE-94 Description: Due to missing input validation during one step of the firmware update process, the product is vulnerable to remote code execution. With network access and the user level ”Service”, an attacker can execute arbitrary system commands in the root user’s contexts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://cdn.sick.com/media/docs/1/11/411/Special_infor
: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf - https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.json
CVE ID: CVE-2024-10772 State: PUBLISHED Published: 2024-12-06T12:28:56.564Z Last Updated: 2024-12-09T14:46:03.214Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SICK AG Products: SICK InspectorP61x, SICK InspectorP62x Problem Types: CWE-649 Description: Since the firmware update is not validated, an attacker can install modified firmware on the device. This has a high impact on the availabilty, integrity and confidentiality up to the complete compromise of the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF - h
sick.com/psirt - https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf - https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.json
CVE ID: CVE-2024-10773 State: PUBLISHED Published: 2024-12-06T12:31:10.776Z Last Updated: 2024-12-09T14:44:36.597Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: SICK AG Products: SICK InspectorP61x, SICK InspectorP62x, TiM3xx Problem Types: CWE-912 Description: The product is vulnerable to pass-the-hash attacks in combination with hardcoded credentials of hidden user levels. This means that an attacker can log in with the hidden user levels and gain full access to the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM00844
- https://sick.com/psirt - https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf - https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.json
CVE ID: CVE-2024-10774 State: PUBLISHED Published: 2024-12-06T12:35:03.327Z Last Updated: 2024-12-09T14:48:43.228Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: SICK AG Products: SICK InspectorP61x, SICK InspectorP62x Problem Types: CWE-306 Description: Unauthenticated CROWN APIs allow access to critical functions. This leads to the accessibility of large parts of the web application without authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF - https://www.cisa.gov/resources-tools/resources/ics-recommended-
ial_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf - https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.json
CVE ID: CVE-2024-10775 State: PUBLISHED Published: 2025-01-15T09:25:54.399Z Last Updated: 2025-01-15T15:04:07.508Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: piotnetdotcom Products: Piotnet Addons For Elementor Problem Types: CWE-639 Description: The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.4.32 via the 'pafe-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not
ontributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5fdbc9bc-70cf-4440-b12d-dd98844d33bc?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3221445%40piotnet-addons-for-elementor&new=3221445%40piotnet-addons-for-elementor&sfp_email=&sfph_mail=
CVE ID: CVE-2024-10776 State: PUBLISHED Published: 2024-12-06T12:38:55.781Z Last Updated: 2024-12-09T14:06:40.506Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: SICK AG Products: SICK InspectorP61x, SICK InspectorP62x Problem Types: CWE-306 Description: Lua apps can be deployed, removed, started, reloaded or stopped without authorization via AppManager. This allows an attacker to remove legitimate apps creating a DoS attack, read and write files or load apps that use all features of the product available to a customer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://cdn.sick.com/media/docs/1/11/411/Special_in
tes: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf - https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.json
CVE ID: CVE-2024-10777 State: PUBLISHED Published: 2024-12-05T09:23:07.356Z Last Updated: 2024-12-05T11:13:24.346Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: wpvibes Products: AnyWhere Elementor Problem Types: CWE-639 Description: The AnyWhere Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.11 via the 'INSERT_ELEMENTOR' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to. Additi
and above, to extract data from private or draft posts created by Elementor that they should not have access to. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c2138634-c149-4fd1-a33d-351bbf633ea3?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3198665%40anywhere-elementor&new=3198665%40anywhere-elementor&sfp_email=&sfph_mail=
CVE ID: CVE-2024-10778 State: PUBLISHED Published: 2024-11-13T02:02:28.016Z Last Updated: 2024-11-13T18:44:00.598Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: staxwp Products: BuddyPress Builder for Elementor – BuddyBuilder Problem Types: CWE-639 Description: The BuddyPress Builder for Elementor – BuddyBuilder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.7.4 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts crated
for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts crated by Elementor that they should not have access to. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/067dde3a-f2d6-44c6-b64e-c8a850dd4d37?source=cve - https://wordpress.org/plugins/stax-buddy-builder/
CVE ID: CVE-2024-10779 State: PUBLISHED Published: 2024-11-09T02:32:03.779Z Last Updated: 2024-11-11T16:13:05.677Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: codelessthemes Products: Cowidgets – Elementor Addons Problem Types: CWE-639 Description: The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.0 via the 'ce_template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not h
tributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ec005f9f-3f63-4d73-9bd5-dc9c4c4b8bfe?source=cve - https://wordpress.org/plugins/cowidgets-elementor-addons/
CVE ID: CVE-2024-10780 State: PUBLISHED Published: 2024-11-28T09:47:12.280Z Last Updated: 2024-11-29T19:14:28.499Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: nicheaddons Products: Restaurant & Cafe Addon for Elementor Problem Types: CWE-639 Description: The Restaurant & Cafe Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.5.9 via the 'narestaurant_elementor_template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created
r authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a8c29cbd-6c39-4a54-a2a2-bc4c8feeeb70?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3197286%40restaurant-cafe-addon-for-elementor&new=3197286%40restaurant-cafe-addon-for-elementor&sfp_email=&sfph_mail=
CVE ID: CVE-2024-10781 State: PUBLISHED Published: 2024-11-26T05:33:00.910Z Last Updated: 2024-11-26T15:52:48.847Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: cleantalk Products: Spam protection, Anti-Spam, FireWall by CleanTalk Problem Types: CWE-703 Description: The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an missing empty value check on the 'api_key' value in the 'perform' function in all versions up to, and including, 6.44. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote