Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
oads, enabling an attacker to execute arbitrary commands on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/7a42da2a-2ae5-442d-aff9-c9a3b47870eb
CVE ID: CVE-2024-8503 State: PUBLISHED Published: 2024-09-10T19:22:40.111Z Last Updated: 2025-11-04T16:16:05.997Z Vendors: VICIdial Products: VICIdial Problem Types: CWE-89 Description: An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records. By default, VICIdial stores plaintext credentials within the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://korelogic.com/Resources/Advisories/KL-001-2024-011.txt - https://www.vicidial.org/vicidial.php
CVE ID: CVE-2024-8504 State: PUBLISHED Published: 2024-09-10T19:23:39.327Z Last Updated: 2025-11-04T16:16:06.940Z Vendors: VICIdial Products: VICIdial Problem Types: CWE-78 Description: An attacker with authenticated access to VICIdial as an "agent" can execute arbitrary shell commands as the "root" user. This attack can be chained with CVE-2024-8503 to execute arbitrary shell commands starting from an unauthenticated perspective. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://korelogic.com/Resources/Advisories/KL-001-2024-012.txt - https://www.vicidial.org/vicidial.php
CVE ID: CVE-2024-8505 State: PUBLISHED Published: 2024-10-02T09:31:59.680Z Last Updated: 2024-10-02T15:10:22.363Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: connekthq Products: WordPress Infinite Scroll – Ajax Load More Problem Types: CWE-87 Description: The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘button_label’ parameter in all versions up to, and including, 7.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute when
ated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ca29158a-ca60-46c7-93a5-bcf76e7666e4?source=cve - https://plugins.trac.wordpress.org/browser/ajax-load-more/trunk/core/classes/class-alm-shortcode.php - https://wordpress.org/plugins/ajax-load-more/#developers - https://plugins.trac.wordpress.org/changeset/3160896/
CVE ID: CVE-2024-8507 State: PUBLISHED Published: 2024-10-16T06:43:44.555Z Last Updated: 2024-10-16T12:59:15.345Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: File Manager Products: File Manager Pro Problem Types: CWE-352 Description: The File Manager Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.3.9. This is due to missing or incorrect nonce validation on the 'mk_file_folder_manager' ajax action. This makes it possible for unauthenticated attackers to upload arbitrary files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Add
a a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/db70b37c-707a-47b8-a3a2-5a2b7d30de89?source=cve - https://filemanagerpro.io/
CVE ID: CVE-2024-8508 State: PUBLISHED Published: 2024-10-03T16:27:54.540Z Last Updated: 2024-11-14T21:02:40.473Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: NLnet Labs Products: Unbound Problem Types: CWE-606 Description: NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs to perform name compression for. Malicious upstreams responses with very large RRsets can cause Unbound to spend a considerable time applying name compression to downstream replies. This can lead to degraded performance and eventually denial of service in well orchestrated attacks. The vulnerability
This can lead to degraded performance and eventually denial of service in well orchestrated attacks. The vulnerability can be exploited by a malicious actor querying Unbound for the specially crafted contents of a malicious zone with very large RRsets. Before Unbound replies to the query it will try to apply name compression which was an unbounded operation that could lock the CPU until the whole packet was complete. Unbound version 1.21.1 introduces a hard limit on the number of name compression calculations it is willing to do per packet. Packets that need more compression will result in semi-compressed packets or truncated packets, even on TCP for huge messages, to avoid locking the CPU
on will result in semi-compressed packets or truncated packets, even on TCP for huge messages, to avoid locking the CPU for long. This change should not affect normal DNS traffic. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.nlnetlabs.nl/downloads/unbound/CVE-2024-8508.txt
CVE ID: CVE-2024-8509 State: PUBLISHED Published: 2024-09-06T15:17:49.225Z Last Updated: 2025-11-20T07:34:11.943Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: Migration Toolkit for Virtualization 2.6 Problem Types: CWE-285 Description: A vulnerability was found in Forklift Controller. There is no verification against the authorization header except to ensure it uses bearer authentication. Without an Authorization header and some form of a Bearer token, a 401 error occurs. The presence of a token value provides a 200 response with the requested information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redh
nse with the requested information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:6487 - https://access.redhat.com/security/cve/CVE-2024-8509 - https://bugzilla.redhat.com/show_bug.cgi?id=2310406
CVE ID: CVE-2024-8510 State: PUBLISHED Published: 2025-03-17T19:01:36.361Z Last Updated: 2025-03-18T14:41:47.223Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: N-able Products: N-central Problem Types: CWE-22, CWE-23 Description: N-central is vulnerable to a path traversal that allows unintended access to the Apache Tomcat WEB-INF directory. Customer data is not exposed. This vulnerability is present in all deployments of N-central prior to N-central 2024.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2024.6_Release_Notes.htm - https://me.n-able.com/s/securit
ation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2024.6_Release_Notes.htm - https://me.n-able.com/s/security-advisory/aArVy0000000XgjKAE/cve20248510-ncentral-path-traversal
CVE ID: CVE-2024-8512 State: PUBLISHED Published: 2024-10-30T11:00:59.962Z Last Updated: 2024-10-30T14:04:13.997Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: w3speedster Products: W3SPEEDSTER Problem Types: CWE-95 Description: The W3SPEEDSTER plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.26 via the 'script' parameter of the hookBeforeStartOptimization() function. This is due to the plugin passing user supplied input to eval(). This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server. Additional Analyst Notes: - CISA ADP Vulnrichment
h Administrator-level access and above, to execute code on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2a56eb63-ba5c-4452-8ab9-f5aeaf53adda?source=cve - https://plugins.trac.wordpress.org/browser/w3speedster-wp/trunk/w3speedster.php#L740 - https://plugins.trac.wordpress.org/changeset/3175640/
CVE ID: CVE-2024-8513 State: PUBLISHED Published: 2024-10-10T02:06:04.718Z Last Updated: 2024-10-10T17:54:59.740Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: quarka Products: QA Analytics – Web Analytics Tool with Heatmaps & Session Replay Across All Pages Problem Types: CWE-862 Description: The QA Analytics – Web Analytics Tool with Heatmaps & Session Replay Across All Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_save_plugin_config() function in all versions up to, and including, 4.1.0.0. This makes it possible for unauthenticated attackers to update the plugin's settings. Ad
up to, and including, 4.1.0.0. This makes it possible for unauthenticated attackers to update the plugin's settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/15d29d58-9e28-4e18-aeb9-9c63cb308673?source=cve - https://plugins.trac.wordpress.org/browser/qa-heatmap-analytics/trunk/class-qahm-admin-page-config.php#L801
CVE ID: CVE-2024-8514 State: PUBLISHED Published: 2024-09-25T03:27:39.955Z Last Updated: 2024-09-25T14:10:27.990Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: prisna Products: Prisna GWT – Google Website Translator Problem Types: CWE-502 Description: The Prisna GWT – Google Website Translator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.11 via deserialization of untrusted input from the 'prisna_import' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP ch
or-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4183c3f7-7794-45f3-8fad-b87ffec3639c?source=cve - https://plugins.trac.wordpress.org/browser/google-website-translator/tags/1.4.11/classes/admin.class.php#L267 - https://plugins.trac.wordpress.org/changeset/3155285/
CVE ID: CVE-2024-8515 State: PUBLISHED Published: 2024-09-25T03:27:39.268Z Last Updated: 2024-09-25T13:27:54.972Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themesflat Products: Themesflat Addons For Elementor Problem Types: CWE-79 Description: The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets like 'TF E Slider Widget', 'TF Video Widget', 'TF Team Widget' and more in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping on URL attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inje
on URL attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1603c61b-11a3-41e5-b339-a9411b02f383?source=cve - https://plugins.trac.wordpress.org/browser/themesflat-addons-for-elementor/trunk/widgets/widget-flex-slide.php#L2522 - https://plugins.trac.wordpress.org/browser/themesflat-addons-for-elementor/trunk/widgets/widget-video.php#L318 - https://plugins.trac.wordpress.org/browser/themesflat-addons-for-elementor/trunk
r/trunk/widgets/widget-video.php#L318 - https://plugins.trac.wordpress.org/browser/themesflat-addons-for-elementor/trunk/widgets/widget-team.php#L1234 - https://plugins.trac.wordpress.org/browser/themesflat-addons-for-elementor/trunk/widgets/widget-team.php#L1285 - https://plugins.trac.wordpress.org/browser/themesflat-addons-for-elementor/trunk/assets/js/tf-testimonial.js#L41 - https://plugins.trac.wordpress.org/browser/themesflat-addons-for-elementor/trunk/assets/js/tf-carousel.js#L41 - https://plugins.trac.wordpress.org/browser/themesflat-addons-for-elementor/trunk/assets/js/tf-post.js#L42 - https://plugins.trac.wordpress.org/browser/themesflat-addons-for-elementor/trunk/assets/js/tf-woo-p
/js/tf-post.js#L42 - https://plugins.trac.wordpress.org/browser/themesflat-addons-for-elementor/trunk/assets/js/tf-woo-product.js#L42
CVE ID: CVE-2024-8516 State: PUBLISHED Published: 2024-09-25T03:27:40.542Z Last Updated: 2024-09-25T13:27:00.186Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: themesflat Products: Themesflat Addons For Elementor Problem Types: CWE-200 Description: The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.1 via the render() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract limited post information from draft and future scheduled posts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.word
from draft and future scheduled posts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/75c5d4e6-9ef3-4b12-9ee9-67121dbb0fcd?source=cve - https://plugins.trac.wordpress.org/browser/themesflat-addons-for-elementor/trunk/widgets/widget-posts.php#L3327
CVE ID: CVE-2024-8517 State: PUBLISHED Published: 2024-09-06T15:55:35.349Z Last Updated: 2025-11-22T12:11:38.221Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SPIP Products: SPIP Problem Types: CWE-73, CWE-78 Description: SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://thinkloveshare.com/hacking/spip_preauth_rce_2024_part_2_a_big_upload/ - https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP
cking/spip_preauth_rce_2024_part_2_a_big_upload/ - https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-3-2-SPIP-4-2-16-SPIP-4-1-18.html - https://vulncheck.com/advisories/spip-upload-rce - https://vozec.fr/researchs/spip-preauth-rce-2024-big-upload/
CVE ID: CVE-2024-8518 State: PUBLISHED Published: 2024-10-08T10:12:52.204Z Last Updated: 2024-10-08T13:51:42.894Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: Schneider Electric Products: Zelio Soft 2 Problem Types: CWE-20 Description: CWE-20: Improper Input Validation vulnerability exists that could cause a crash of the Zelio Soft 2 application when a specially crafted project file is loaded by an application user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-282-06&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-282-06.pdf
CVE ID: CVE-2024-8519 State: PUBLISHED Published: 2024-10-04T02:32:23.121Z Last Updated: 2024-10-04T14:00:48.783Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ultimatemember Products: Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin Problem Types: CWE-79 Description: The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'um_loggedin' shortcode in all versions up to, and including, 2.8.6 due to insufficient input sanitization and output escaping on user
hortcode in all versions up to, and including, 2.8.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9e394bb2-d505-4bf1-b672-fea3504bf936?source=cve - https://github.com/ultimatemember/ultimatemember/blob/7b8a7a7c039bde4539c07e049b19036192f1c133/includes/core/class-shortcodes.php#L433 - https://wordpress.org/plugins/ultimate-member/ - https
9c07e049b19036192f1c133/includes/core/class-shortcodes.php#L433 - https://wordpress.org/plugins/ultimate-member/ - https://github.com/ultimatemember/ultimatemember/pull/1545 - https://plugins.trac.wordpress.org/changeset/3160947/ultimate-member/tags/2.8.7/includes/core/class-shortcodes.php
CVE ID: CVE-2024-8520 State: PUBLISHED Published: 2024-10-04T02:32:22.432Z Last Updated: 2024-10-04T14:03:08.903Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: ultimatemember Products: Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin Problem Types: CWE-352 Description: The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.6. This is due to missing or incorrect nonce validation on the admin_init or user_action_hook function. This m
ding, 2.8.6. This is due to missing or incorrect nonce validation on the admin_init or user_action_hook function. This makes it possible for unauthenticated attackers to modify a users membership status via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7ffddc03-d4ae-460e-972a-98804d947d09?source=cve - https://github.com/ultimatemember/ultimatemember/blob/7b8a7a7c039bde4539c07e049b19036192f1c133/includes/admin/class-admin.php#L1948C1-L1959C6 - https://github.com/ultimatemember/ultimatemember/blob/7b8a7a7
192f1c133/includes/admin/class-admin.php#L1948C1-L1959C6 - https://github.com/ultimatemember/ultimatemember/blob/7b8a7a7c039bde4539c07e049b19036192f1c133/includes/admin/class-admin.php#L70C4-L70C84 - https://github.com/ultimatemember/ultimatemember/blob/7b8a7a7c039bde4539c07e049b19036192f1c133/includes/admin/class-admin.php#L1880 - https://github.com/ultimatemember/ultimatemember/blob/7b8a7a7c039bde4539c07e049b19036192f1c133/includes/admin/core/class-admin-users.php#L41C4-L41C90 - https://github.com/ultimatemember/ultimatemember/blob/7b8a7a7c039bde4539c07e049b19036192f1c133/includes/admin/core/class-admin-users.php#L146C1-L173C12 - https://github.com/ultimatemember/ultimatemember/blob/7b8a7a
/includes/admin/core/class-admin-users.php#L146C1-L173C12 - https://github.com/ultimatemember/ultimatemember/blob/7b8a7a7c039bde4539c07e049b19036192f1c133/includes/admin/class-admin.php#L1945 - https://github.com/ultimatemember/ultimatemember/blob/7b8a7a7c039bde4539c07e049b19036192f1c133/includes/admin/core/class-admin-users.php#L175C1-L178C7 - https://github.com/ultimatemember/ultimatemember/pull/1549 - https://plugins.trac.wordpress.org/changeset/3160947/ultimate-member/trunk/includes/admin/class-admin.php
CVE ID: CVE-2024-8521 State: PUBLISHED Published: 2024-09-07T08:00:06.674Z Last Updated: 2024-09-09T13:47:42.099Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: n/a Products: Wavelog Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in Wavelog up to 1.8.0. Affected is the function index of the file /qso of the component Live QSO. The manipulation of the argument manual leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.8.1 is able to address this issue. The patch is identified as b31002cec6b71ab5f738881806bb546430ec692e. I
g to version 1.8.1 is able to address this issue. The patch is identified as b31002cec6b71ab5f738881806bb546430ec692e. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276726 - https://vuldb.com/?ctiid.276726 - https://vuldb.com/?submit.399819 - https://github.com/wavelog/wavelog/pull/744 - https://github.com/GithubUser843205/CVEs/tree/main/CVE-2024-8521 - https://github.com/wavelog/wavelog/commit/b31002cec6b71ab5f738881806bb546430ec692e - https://github.com/wavelog/wavelog/releases/tag/1.8.1
CVE ID: CVE-2024-8522 State: PUBLISHED Published: 2024-09-12T08:30:46.615Z Last Updated: 2024-09-12T13:07:40.179Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: thimpress Products: LearnPress – WordPress LMS Plugin Problem Types: CWE-89 Description: The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_only_fields' parameter of the /wp-json/learnpress/v1/courses REST API endpoint in all versions up to, and including, 4.2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append addit
f sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e495507d-7eac-4f38-ab6f-b8f0809b2be4?source=cve - https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/jwt/rest-api/version1/class-lp-rest-courses-v1-controller.php#L441 - https://plugins.trac.wordpress.org/changeset/3148560/learnpress/tags/4.2.7.1/inc/jwt/rest-api/version1/class-lp-rest-courses-v1-controller.php?old=3138586&ol
angeset/3148560/learnpress/tags/4.2.7.1/inc/jwt/rest-api/version1/class-lp-rest-courses-v1-controller.php?old=3138586&old_path=learnpress%2Ftags%2F4.2.7%2Finc%2Fjwt%2Frest-api%2Fversion1%2Fclass-lp-rest-courses-v1-controller.php
CVE ID: CVE-2024-8523 State: PUBLISHED Published: 2024-09-07T09:00:04.600Z Last Updated: 2024-09-09T14:02:50.625Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: n/a Products: lmxcms Problem Types: CWE-94 Description: A vulnerability was found in lmxcms up to 1.4 and classified as critical. Affected by this issue is the function formatData of the file /admin.php?m=Acquisi&a=testcj&lid=1 of the component SQL Command Execution Module. The manipulation of the argument data leads to code injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Add
to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276728 - https://vuldb.com/?ctiid.276728 - https://vuldb.com/?submit.399916 - https://github.com/gaorenyusi/gaorenyusi/blob/main/lmx.md