Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-1683 State: PUBLISHED Published: 2024-02-23T00:02:52.403Z Last Updated: 2024-08-01T18:48:21.833Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L) Vendors: Tenable Products: Tenable Identity Exposure Secure Relay Problem Types: CWE-78 Description: A DLL injection vulnerability exists where an authenticated, low-privileged local attacker could modify application files on the TIE Secure Relay host, which could allow for overriding of the configuration and running of new Secure Relay services. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.tenable.com/security/tns-2024-03
CVE ID: CVE-2024-1684 State: PUBLISHED Published: 2024-03-13T15:27:05.116Z Last Updated: 2024-08-01T18:48:21.752Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Themisle Products: Otter Blocks PRO – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the contact form file field CSS metabox in all versions up to, and including, 2.6.3 due to insufficient input sanitization and output escaping. This
CSS metabox in all versions up to, and including, 2.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/934bf839-152d-4d10-9ac8-c64cf042dc18?source=cve - https://store.themeisle.com/?edd_action=view_changelog&name=Otter%20Pro
CVE ID: CVE-2024-1685 State: PUBLISHED Published: 2024-03-16T05:39:58.974Z Last Updated: 2025-04-10T20:31:08.720Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: sygnoos Products: Social Media Share Buttons Problem Types: CWE-502 Deserialization of Untrusted Data Description: The Social Media Share Buttons plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.0 via deserialization of untrusted input through the attachmentUrl parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP
criber-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9c17d18a-090f-4b35-a257-cfc0a16d5459?source=cve - https://plugins.trac.wordpress.org/browser/social-media-builder/trunk/classes/SgmbButton.php#L32
CVE ID: CVE-2024-1686 State: PUBLISHED Published: 2024-02-27T05:33:11.199Z Last Updated: 2024-08-01T18:48:21.539Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: mrt3vn Products: Thank You Page Customizer for WooCommerce – Increase Your Sales Problem Types: CWE-862 Missing Authorization Description: The Thank You Page Customizer for WooCommerce – Increase Your Sales plugin for WordPress is vulnerable to missing authorization e in all versions up to, and including, 1.1.2 via the apply_layout function due to a missing capability check. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve arbitrary order data w
akes it possible for authenticated attackers, with subscriber-level access and above, to retrieve arbitrary order data which may contain PII. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2e7ebc0c-6936-4632-a602-7131c7d8bd6a?source=cve - https://plugins.trac.wordpress.org/changeset/3041096/woo-thank-you-page-customizer/trunk/frontend/frontend.php
CVE ID: CVE-2024-1687 State: PUBLISHED Published: 2024-02-27T05:33:11.820Z Last Updated: 2024-08-01T18:48:21.921Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: mrt3vn Products: Thank You Page Customizer for WooCommerce – Increase Your Sales Problem Types: CWE-862 Missing Authorization Description: The Thank You Page Customizer for WooCommerce – Increase Your Sales plugin for WordPress is vulnerable to unauthorized execution of shortcodes due to a missing capability check on the get_text_editor_content() function in all versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to execut
including, 1.1.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/310afe02-3a51-4633-b359-65ae58d0c032?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3041096%40woo-thank-you-page-customizer&new=3041096%40woo-thank-you-page-customizer&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1688 State: PUBLISHED Published: 2024-05-02T16:52:10.808Z Last Updated: 2024-08-01T18:48:21.499Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: shivashankerbhatta Products: Woo Total Sales Problem Types: CWE-862 Missing Authorization Description: The Woo Total Sales plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_orders_archive() function in all versions up to, and including, 3.1.4. This makes it possible for unauthenticated attackers to retrieve sales reports for the store. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wor
for the store. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/630d5dcc-ee51-4c2d-b4fb-191637311d6b?source=cve - https://plugins.trac.wordpress.org/browser/woo-total-sales/trunk/includes/awts-backend-general-overview.php#L256
CVE ID: CVE-2024-1689 State: PUBLISHED Published: 2024-06-07T02:02:36.562Z Last Updated: 2024-08-01T18:48:21.738Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: themefarmer Products: WooCommerce Tools Problem Types: CWE-862 Missing Authorization Description: The WooCommerce Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the woocommerce_tool_toggle_module() function in all versions up to, and including, 1.2.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to deactivate arbitrary plugin modules. Additional Analyst Notes: - CISA ADP Vulnrichment: -
ber-level access and above, to deactivate arbitrary plugin modules. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3830c901-be36-4c4b-976b-d388b6af0c67?source=cve - https://plugins.trac.wordpress.org/browser/woo-tools/trunk/admin/admin-init.php#L61 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3098165%40woo-tools&new=3098165%40woo-tools&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1690 State: PUBLISHED Published: 2024-03-13T15:26:34.506Z Last Updated: 2024-08-01T18:48:21.599Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: subratamal Products: TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds Problem Types: CWE-862 Missing Authorization Description: The TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the terawallet_export_user_search() function in all versions up to, and including, 1.4.10. This makes it possible for au
the terawallet_export_user_search() function in all versions up to, and including, 1.4.10. This makes it possible for authenticated attackers, with subscriber-level access and above, to export a list of registered users and their emails. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/18e24a2e-cbc6-4285-b846-bea513b6ff69?source=cve - https://plugins.trac.wordpress.org/changeset/3043412/woo-wallet/trunk/includes/class-woo-wallet-ajax.php
CVE ID: CVE-2024-1691 State: PUBLISHED Published: 2024-03-13T15:26:57.917Z Last Updated: 2024-08-01T18:48:21.614Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Themisle Products: Otter Blocks PRO – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file upload form, which allows SVG uploads, in all versions up to, and including, 2.6.3 due to insufficient input sanitization and output escapi
allows SVG uploads, in all versions up to, and including, 2.6.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note that the patch in 2.6.4 allows SVG uploads but the uploaded SVG files are sanitized. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/77838bf8-7809-4dd6-87f1-a9bda40275a6?source=cve - https://store.themeisle.com/?edd_action=view_changelog&name=Otter%20Pro
CVE ID: CVE-2024-1692 State: PUBLISHED Published: 2024-03-30T04:31:07.070Z Last Updated: 2025-03-25T14:37:30.353Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: boldgrid Products: BoldGrid Easy SEO – Simple and Effective SEO Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The BoldGrid Easy SEO – Simple and Effective SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the meta description field in all versions up to, and including, 1.6.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated
sufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0a308fde-1c44-4c34-ace5-6820dc949f53?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3054618%40boldgrid-easy-seo&new=3054618%40boldgrid-easy-seo&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1693 State: PUBLISHED Published: 2024-05-09T20:03:20.419Z Last Updated: 2024-08-01T18:48:21.928Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: smartypants Products: SP Project & Document Manager Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the cdm_save_category AJAX action in all versions up to, and including, 4.70. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary folder name that do not belong to
authenticated attackers, with subscriber-level access and above, to update arbitrary folder name that do not belong to them. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1951ad6c-17b5-44ae-85e2-376b99df742e?source=cve - https://plugins.trac.wordpress.org/browser/sp-client-document-manager/trunk/classes/ajax.php#L786
CVE ID: CVE-2024-1694 State: PUBLISHED Published: 2024-06-07T20:06:43.763Z Last Updated: 2025-03-14T19:00:49.399Z Vendors: Google Products: Omaha Problem Types: Inappropriate implementation Description: Inappropriate implementation in Google Updator prior to 1.3.36.351 in Google Chrome allowed a local attacker to bypass discretionary access control via a malicious file. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://issues.chromium.org/issues/40946325
CVE ID: CVE-2024-1695 State: PUBLISHED Published: 2024-05-06T20:47:35.746Z Last Updated: 2025-03-13T13:56:03.944Z Vendors: HP Inc. Products: HP Application Enabling Software Driver Description: A potential security vulnerability has been identified in the HP Application Enabling Software Driver for certain HP PC products, which might allow escalation of privilege. HP is releasing software updates to mitigate this potential vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hp.com/us-en/document/ish_10555591-10555627-16/hpsbhf03932
CVE ID: CVE-2024-1696 State: PUBLISHED Published: 2024-03-11T16:51:58.503Z Last Updated: 2024-08-12T20:31:28.073Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Santesoft Products: Sante FFT Imaging Problem Types: CWE-787 Description: In Santesoft Sante FFT Imaging versions 1.4.1 and prior once a user opens a malicious DCM file on affected FFT Imaging installations, a local attacker could perform an out-of-bounds write, which could allow for arbitrary code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-065-01
CVE ID: CVE-2024-1697 State: PUBLISHED Published: 2024-03-23T01:57:39.916Z Last Updated: 2024-08-01T18:48:21.674Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themelocation Products: Custom WooCommerce Checkout Fields Editor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Custom WooCommerce Checkout Fields Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the save_wcfe_options function in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber
insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9a92f44b-6f2b-439c-8245-ace189740425?source=cve - https://plugins.trac.wordpress.org/browser/add-fields-to-checkout-page-woocommerce/tags/1.2.9/classes/class-wc-checkout-field-editor.php#L1775 - https://plugins.trac.wordpress.org/browser/add-fields-to-checkout-page-woocommerce/tags/1.3.2/classes/class-wc
p#L1775 - https://plugins.trac.wordpress.org/browser/add-fields-to-checkout-page-woocommerce/tags/1.3.2/classes/class-wc-checkout-field-editor.php#L1788
CVE ID: CVE-2024-1698 State: PUBLISHED Published: 2024-02-27T05:33:12.316Z Last Updated: 2024-08-27T19:10:40.200Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: wpdevteam Products: NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor plugin for WordPress is vulnerable to SQL Injection via the 'type' parameter in all versions up to, and including, 2.8.2 due to insufficient escap
lnerable to SQL Injection via the 'type' parameter in all versions up to, and including, 2.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e110ea99-e2fa-4558-bcf3-942a35af0b91?source=cve - https://plugins.trac.wordpress.org/changeset/3040809/notificationx/trunk/includes/Core/Database.php
af0b91?source=cve - https://plugins.trac.wordpress.org/changeset/3040809/notificationx/trunk/includes/Core/Database.php - https://plugins.trac.wordpress.org/changeset/3040809/notificationx/trunk/includes/Core/Rest/Analytics.php
CVE ID: CVE-2024-1700 State: PUBLISHED Published: 2024-02-21T15:31:04.565Z Last Updated: 2024-08-08T19:45:22.196Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: keerti1924 Products: PHP-MYSQL-User-Login-System Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in keerti1924 PHP-MYSQL-User-Login-System 1.0. Affected is an unknown function of the file /signup.php. The manipulation of the argument username with the input <script>alert("xss")</script> leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-25438
emotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-254388. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.254388 - https://vuldb.com/?ctiid.254388 - https://github.com/omarexala/PHP-MYSQL-User-Login-System---Stored-XSS
CVE ID: CVE-2024-1701 State: PUBLISHED Published: 2024-02-21T15:31:06.175Z Last Updated: 2024-08-08T20:59:36.866Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: keerti1924 Products: PHP-MYSQL-User-Login-System Problem Types: CWE-284 Description: A vulnerability has been found in keerti1924 PHP-MYSQL-User-Login-System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /edit.php. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-254389 was assigned to this vulnerability. NOTE: The vendor wa
sclosed to the public and may be used. The identifier VDB-254389 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.254389 - https://vuldb.com/?ctiid.254389 - https://github.com/omarexala/PHP-MYSQL-User-Login-System---Broken-Access-Control
CVE ID: CVE-2024-1702 State: PUBLISHED Published: 2024-02-21T16:31:04.593Z Last Updated: 2024-08-01T18:48:22.025Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: keerti1924 Products: PHP-MYSQL-User-Login-System Problem Types: CWE-89 Description: A vulnerability was found in keerti1924 PHP-MYSQL-User-Login-System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /edit.php. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-254390 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but d
54390 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.254390 - https://vuldb.com/?ctiid.254390 - https://github.com/omarexala/PHP-MYSQL-User-Login-System---SQL-Injection
CVE ID: CVE-2024-1703 State: PUBLISHED Published: 2024-02-21T17:00:09.614Z Last Updated: 2024-08-27T14:29:52.020Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: ZhongBangKeJi Products: CRMEB Problem Types: CWE-36 Description: A vulnerability was found in ZhongBangKeJi CRMEB 5.2.2. It has been classified as problematic. This affects the function openfile of the file /adminapi/system/file/openfile. The manipulation leads to absolute path traversal. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-254391. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. A
ulnerability is VDB-254391. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.254391 - https://vuldb.com/?ctiid.254391 - https://github.com/Echosssy/-CRMEB-Mall-commercial-version-of-any-file-read-vulnerability/blob/main/README.md
CVE ID: CVE-2024-1704 State: PUBLISHED Published: 2024-02-21T17:31:04.410Z Last Updated: 2024-08-01T18:48:21.812Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: ZhongBangKeJi Products: CRMEB Problem Types: CWE-22 Description: A vulnerability was found in ZhongBangKeJi CRMEB 5.2.2. It has been declared as critical. This vulnerability affects the function save/delete of the file /adminapi/system/crud. The manipulation leads to path traversal. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-254392. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Anal
s VDB-254392. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.254392 - https://vuldb.com/?ctiid.254392 - https://github.com/Echosssy/CVE/blob/main/%E4%BC%97%E9%82%A6%E7%A7%91%E6%8A%80CRMEB%20Mall%20business%20edition%20overrides%20any%20file.docx
CVE ID: CVE-2024-1705 State: PUBLISHED Published: 2024-02-21T17:31:07.682Z Last Updated: 2024-08-01T18:48:22.007Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: Shopwind Problem Types: CWE-94 Description: A vulnerability was found in Shopwind up to 4.6. It has been rated as critical. This issue affects the function actionCreate of the file /public/install/controllers/DefaultController.php of the component Installation. The manipulation leads to code injection. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.