Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-13506 State: PUBLISHED Published: 2025-02-11T11:10:03.593Z Last Updated: 2025-02-12T19:36:45.317Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: paoltaia Products: GeoDirectory – WP Business Directory Plugin and Classified Listings Directory Problem Types: CWE-79 Description: The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the display_name profile parameter in all versions up to, and including, 2.8.97 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level acces
input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d0d9ba14-c0c9-426e-927e-9139a0882f0d?source=cve - https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.97/includes/admin/class-geodir-admin-post-view.php#L317 - https://plugins.trac.wordpress.org/changeset/3225839
CVE ID: CVE-2024-13507 State: PUBLISHED Published: 2025-07-26T03:38:17.536Z Last Updated: 2025-07-28T15:04:21.496Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: paoltaia Products: GeoDirectory – WP Business Directory Plugin and Classified Listings Directory Problem Types: CWE-89 Description: The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to time-based SQL Injection via the dist parameter in all versions up to, and including, 2.8.97 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthentic
supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/30a15a22-d6f3-4829-995d-7fa14d1db7a9?source=cve - https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.97/includes/class-geodir-query.php#L733 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3225839%40geodirectory%2Ftrunk&old=3223673%40geodirectory%2Ftrunk&sfp_em
g/changeset?sfp_email=&sfph_mail=&reponame=&new=3225839%40geodirectory%2Ftrunk&old=3223673%40geodirectory%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13508 State: PUBLISHED Published: 2025-02-18T23:22:00.264Z Last Updated: 2025-02-19T15:00:21.524Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: masaakitanaka Products: Booking Package Problem Types: CWE-79 Description: The Booking Package plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the locale parameter in all versions up to, and including, 1.6.72 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional
ages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/212e8f84-22a9-4b9e-b440-280f8569846f?source=cve - https://plugins.trac.wordpress.org/browser/booking-package/tags/1.6.71/index.php#L1714
CVE ID: CVE-2024-13509 State: PUBLISHED Published: 2025-01-28T06:38:42.309Z Last Updated: 2025-01-28T15:14:40.231Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: westguard Products: WS Form LITE – Drag & Drop Contact Form Builder for WordPress Problem Types: CWE-79 Description: The WS Form LITE – Drag & Drop Contact Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the url parameter in all versions up to, and including, 1.10.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user
es it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability is partially fixed in 1.10.13 and completely fixed in 1.10.14. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/910d9b31-b63a-427e-830b-a4c6a7e77ade?source=cve - https://plugins.trac.wordpress.org/changeset/3226595/ws-form - https://plugins.trac.wordpress.org/changeset/3225862/ws-form - https://wsform.com/changelog/?utm_source=wp_plugins&utm_medium=readme
CVE ID: CVE-2024-13510 State: PUBLISHED Published: 2025-02-04T09:21:07.903Z Last Updated: 2025-02-12T19:44:15.265Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: shopsite Products: ShopSite Problem Types: CWE-352 Description: The ShopSite plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.10. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Note
ranted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c2fde092-0a12-42ab-abbb-7f5ff5de9af2?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3226553%40shopsite-plugin%2Ftrunk&old=3139879%40shopsite-plugin%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13511 State: PUBLISHED Published: 2025-01-23T09:21:08.768Z Last Updated: 2025-01-23T14:45:05.787Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: themehunk Products: Variation Swatches for WooCommerce Problem Types: CWE-352 Description: The Variation Swatches for WooCommerce plugin, in all versions starting at 1.0.8 up until 1.3.2, contains a vulnerability due to improper nonce verification in its settings reset functionality. The issue exists in the settings_init() function, which processes a reset action based on specific query parameters in the URL. The related delete_settings() function performs a faulty nonce validation check, making th
query parameters in the URL. The related delete_settings() function performs a faulty nonce validation check, making the reset operation insecure and susceptible to unauthorized access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6c43b9b4-4394-428a-b381-d6a776fcd130?source=cve - https://plugins.trac.wordpress.org/browser/th-variation-swatches/tags/1.3.1/inc/thvs-settings.php - https://plugins.trac.wordpress.org/changeset/3226822/th-variation-swatches/trunk/inc/thvs-settings.php
CVE ID: CVE-2024-13512 State: PUBLISHED Published: 2025-01-30T13:41:56.907Z Last Updated: 2025-01-30T14:53:19.383Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: edigermatthew Products: Wonder FontAwesome Problem Types: CWE-352 Description: The Wonder FontAwesome plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.8. This is due to missing or incorrect nonce validation on one of its functions. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on
b scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/494f5c9f-ef5b-48d8-8f3a-27e5ed4bea5e?source=cve - https://wordpress.org/plugins/wonder-fontawesome/
CVE ID: CVE-2024-13513 State: PUBLISHED Published: 2025-02-15T07:33:40.895Z Last Updated: 2025-02-18T16:13:33.004Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: oliverpos Products: Oliver POS – A WooCommerce Point of Sale (POS) Problem Types: CWE-862 Description: The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.2.3 via the logging functionality. This makes it possible for unauthenticated attackers to extract sensitive data including the plugin's clientToken, which in turn can be used to change user account information including emails and acco
cluding the plugin's clientToken, which in turn can be used to change user account information including emails and account type. This allows attackers to then change account passwords resulting in a complete site takeover. Version 2.4.2.3 disabled logging but left sites with existing log files vulnerable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bf6b7d8d-fb13-4eb4-b0b4-d0a10ad2a21e?source=cve - https://plugins.trac.wordpress.org/browser/oliver-pos/trunk/includes/models/class-pos-bridge-user.php#L373 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3234731%40oliver-pos%2Ftrunk&
hp#L373 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3234731%40oliver-pos%2Ftrunk&old=3056051%40oliver-pos%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13514 State: PUBLISHED Published: 2025-02-04T07:21:00.282Z Last Updated: 2025-02-04T15:23:45.827Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: bplugins Products: B Slider- Gutenberg Slider Block for WP Problem Types: CWE-284 Description: The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.5 via the 'bsb-slider' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private posts that they should not have access to.
ckers, with Contributor-level access and above, to extract data from private posts that they should not have access to. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b0ab9274-35c8-473b-accb-602e53816528?source=cve - https://plugins.trac.wordpress.org/changeset/3228644/b-slider/trunk/custom-post.php
CVE ID: CVE-2024-13515 State: PUBLISHED Published: 2025-01-18T05:33:49.723Z Last Updated: 2025-01-22T14:19:12.329Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: webzunft Products: Image Source Control Lite – Show Image Credits and Captions Problem Types: CWE-79 Description: The Image Source Control Lite – Show Image Credits and Captions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'path' parameter in all versions up to, and including, 2.28.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can success
akes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c4debc89-d5ea-4cf1-8e69-197a75794d0b?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3188412%40image-source-control-isc&new=3188412%40image-source-control-isc&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3172639%40image-source-control-isc&new=3172639%40image-source-control-isc&
changeset?sfp_email=&sfph_mail=&reponame=&old=3172639%40image-source-control-isc&new=3172639%40image-source-control-isc&sfp_email=&sfph_mail= - https://github.com/webzunft/image-source-control/commit/d1461b886ed2991281c2eb95e98c9b211e737a93
CVE ID: CVE-2024-13516 State: PUBLISHED Published: 2025-01-18T05:33:50.087Z Last Updated: 2025-01-22T14:18:53.873Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: extendthemes Products: Kubio AI Page Builder Problem Types: CWE-79 Description: The Kubio AI Page Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'message' parameter in all versions up to, and including, 2.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a lin
scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d2246fac-0d95-4ff5-ad1e-aa1fefa03b4d?source=cve - https://plugins.trac.wordpress.org/changeset/3186251/kubio/trunk/static/kubio-iframe-loader.html
CVE ID: CVE-2024-13517 State: PUBLISHED Published: 2025-01-18T07:05:09.175Z Last Updated: 2025-01-21T21:24:23.702Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: smub Products: Easy Digital Downloads – eCommerce Payments and Subscriptions made easy Problem Types: CWE-79 Description: The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title value in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web script
ing. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8d745937-4b0a-480a-9771-8af3288ee98f?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3131805%40easy-digital-downloads&new=3131805%40easy-digital-downloads&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13518 State: PUBLISHED Published: 2025-03-01T04:21:49.340Z Last Updated: 2025-03-03T17:38:54.728Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: simplepress Products: Simple:Press Forum Problem Types: CWE-352 Description: The Simple:Press Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.10.11. This is due to missing or incorrect nonce validation on the 'sp_save_edited_post' function. This makes it possible for unauthenticated attackers to modify a forum post via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Addi
a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4484fa86-5878-426d-92b9-8eb0751075e5?source=cve - https://plugins.trac.wordpress.org/browser/simplepress/trunk/forum/database/sp-db-management.php#L173
CVE ID: CVE-2024-13519 State: PUBLISHED Published: 2025-01-18T07:05:08.206Z Last Updated: 2025-01-21T21:26:23.548Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: webwizardsdev Products: MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution Problem Types: CWE-79 Description: The MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's settings in all versions up to, and including, 1.9.80 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Shop Manager-level permissions and above, to inject arbi
aping. This makes it possible for authenticated attackers, with Shop Manager-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5061e0be-1785-476a-9528-d6f95656bd61?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3180752%40marketking-multivendor-marketplace-for-woocommerce&new=3180752%40marketking-multivendor-marketplace-for-woocommerce&sfp_email=
king-multivendor-marketplace-for-woocommerce&new=3180752%40marketking-multivendor-marketplace-for-woocommerce&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13520 State: PUBLISHED Published: 2025-02-20T09:21:36.119Z Last Updated: 2025-02-20T14:26:57.528Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: codemenschen Products: Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) Problem Types: CWE-862 Description: The Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) plugin for WordPress is vulnerable to unauthorized modification of data|loss of data due to a missing capability check on the 'update_voucher_price', 'update_voucher_date', 'update_voucher_note' functions in all versions up to, and including, 4.4.6. This makes it possible for unauthenticated attackers to update
e' functions in all versions up to, and including, 4.4.6. This makes it possible for unauthenticated attackers to update the value, expiration date, and user note for any gift voucher. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/190a21cd-9716-4a57-a793-63309c339427?source=cve - https://plugins.trac.wordpress.org/browser/gift-voucher/trunk/include/edit-order-voucher.php#L5 - https://plugins.trac.wordpress.org/browser/gift-voucher/trunk/include/edit-order-voucher.php#L30 - https://plugins.trac.wordpress.org/browser/gift-voucher/trunk/include/edit-order-voucher.php#L56
CVE ID: CVE-2024-13521 State: PUBLISHED Published: 2025-01-28T07:21:41.381Z Last Updated: 2025-01-28T15:14:14.436Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: ghera74 Products: MailUp Auto Subscription Problem Types: CWE-352 Description: The MailUp Auto Subscription plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing or incorrect nonce validation on the mas_options function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as
malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9ee9b2e9-e3fe-43b2-9caf-7246a4201fe9?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3060078%40mailup-auto-subscribtion%2Ftags%2F1.1.0&new=3229728%40mailup-auto-subscribtion%2Ftags%2F1.2.0
CVE ID: CVE-2024-13522 State: PUBLISHED Published: 2025-02-18T04:21:09.652Z Last Updated: 2025-02-18T19:28:25.298Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: magayo Products: magayo Lottery Results Problem Types: CWE-352 Description: The magayo Lottery Results plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.12. This is due to missing or incorrect nonce validation on the 'magayo-lottery-results' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action su
ject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/03c5f9c6-3346-43fc-beb3-d0269b5599d1?source=cve - https://wordpress.org/plugins/magayo-lottery-results/
CVE ID: CVE-2024-13523 State: PUBLISHED Published: 2025-02-18T07:02:26.288Z Last Updated: 2025-02-18T15:49:40.447Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: shenyanzhi Products: MemorialDay Problem Types: CWE-352 Description: The MemorialDay plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analy
quest granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/96cec16e-7bb3-4279-8c17-eca88d413ad8?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3232363%40memorialday%2Ftrunk&old=3207291%40memorialday%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13524 State: PUBLISHED Published: 2025-01-20T02:00:22.350Z Last Updated: 2025-02-12T19:45:06.260Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: obsproject Products: OBS Studio Problem Types: CWE-426 Description: A vulnerability has been found in obsproject OBS Studio up to 30.0.2 on Windows and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to untrusted search path. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. It is recommended to apply a patch to fix this issue. The vendor disagrees that this i
oitation appears to be difficult. It is recommended to apply a patch to fix this issue. The vendor disagrees that this issue is "something worth reporting, as every attack surface requires privileged access/user compromise". Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.292495 - https://vuldb.com/?ctiid.292495 - https://vuldb.com/?submit.480875 - https://github.com/obsproject/obs-studio/pull/11569