Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-0624 State: PUBLISHED Published: 2024-01-25T01:55:02.762Z Last Updated: 2024-10-18T15:24:41.407Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: strangerstudios Products: Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.12.7. This is due to missing or incorrect nonce validation on the pmpro_update_level_order() function. This makes it possible for u
is due to missing or incorrect nonce validation on the pmpro_update_level_order() function. This makes it possible for unauthenticated attackers to update the order of levels via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ae68d083-b6e2-409b-8c91-d4eb7e62dba9?source=cve - https://plugins.trac.wordpress.org/browser/paid-memberships-pro/trunk/includes/services.php#L139 - https://plugins.trac.wordpress.org/changeset/3025164/paid-memberships-pro/tags/2.12.8/includes/services.php
CVE ID: CVE-2024-0625 State: PUBLISHED Published: 2024-01-25T02:32:36.487Z Last Updated: 2025-05-29T15:19:31.929Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: syammohanm Products: WPFront Notification Bar Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WPFront Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpfront-notification-bar-options[custom_class]’ parameter in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-l
ficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/19a5a9f3-637c-42af-9775-5651a14cf516?source=cve - https://plugins.trac.wordpress.org/browser/wpfront-notification-bar/trunk/templates/template-wpfront-notification-bar.php#L94 - https://plugins.trac.wordpress.org/ch
front-notification-bar/trunk/templates/template-wpfront-notification-bar.php#L94 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3025472%40wpfront-notification-bar&new=3025472%40wpfront-notification-bar&sfp_email=&sfph_mail=
CVE ID: CVE-2024-0626 State: PUBLISHED Published: 2024-04-09T18:58:50.178Z Last Updated: 2024-08-01T20:01:07.389Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: elbanyaoui Products: WooCommerce Clover Payment Gateway Problem Types: CWE-284 Improper Access Control Description: The WooCommerce Clover Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the callback_handler function in all versions up to, and including, 1.3.1. This makes it possible for unauthenticated attackers to mark orders as paid. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
tackers to mark orders as paid. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/57aacffa-0f49-4a33-ae40-d1c151363284?source=cve - https://plugins.trac.wordpress.org/browser/woo-clover-gateway-by-zaytech/trunk/zaytech-woo-commerce-clover-integration.php?rev=2998654#L218 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3055678%40woo-clover-gateway-by-zaytech%2Ftrunk&old=2998658%40woo-clover-gateway-by-zaytech%2Ftrunk&sfp_email=&sfph_mail=#file3
CVE ID: CVE-2024-0627 State: PUBLISHED Published: 2024-06-11T02:01:55.753Z Last Updated: 2024-08-01T18:11:35.654Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: hiroaki-miyashita Products: Custom Field Template Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom field name column in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping on user supplied custom fields. This makes it possible for authenticated attackers with contribut
on and output escaping on user supplied custom fields. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/637f07c6-68cd-4ac6-83fd-65dbaab882fc?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3069937%40custom-field-template&new=3069937%40custom-field-template&sfp_email=&sfph_mail=
CVE ID: CVE-2024-0628 State: PUBLISHED Published: 2024-02-07T06:46:56.404Z Last Updated: 2024-11-07T20:23:55.846Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N) Vendors: jeangalea Products: WP RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging Problem Types: CWE-918 Server-Side Request Forgery (SSRF) Description: The WP RSS Aggregator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.23.5 via the RSS feed source in admin settings. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web a
ckers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2154383e-eabb-4964-8991-423dd68d5efb?source=cve - https://plugins.trac.wordpress.org/changeset/3029525/wp-rss-aggregator
CVE ID: CVE-2024-0629 State: PUBLISHED Published: 2024-05-02T16:52:33.005Z Last Updated: 2024-08-01T18:11:35.678Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: nmedia Products: 2Checkout Payment Gateway for WooCommerce Problem Types: CWE-862 Missing Authorization Description: The 2Checkout Payment Gateway for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the sniff_ins function in all versions up to, and including, 6.2. This makes it possible for unauthenticated attackers to make changes to orders and mark them as paid. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program
ackers to make changes to orders and mark them as paid. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bcc6a4a5-b133-4ee1-a345-a7c812624b03?source=cve - https://wordpress.org/plugins/woocommerce-2checkout-payment/
CVE ID: CVE-2024-0630 State: PUBLISHED Published: 2024-02-05T21:21:53.514Z Last Updated: 2024-08-01T18:11:35.686Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: jeangalea Products: WP RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WP RSS Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the RSS feed source in all versions up to, and including, 4.23.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-l
ficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/93cb3b29-b1a0-4d40-a057-1b41f3b181f2?source=cve - https://plugins.trac.wordpress.org/changeset/3026269/wp-rss-aggregator
CVE ID: CVE-2024-0631 State: PUBLISHED Published: 2024-03-13T15:27:07.880Z Last Updated: 2024-08-01T18:11:35.666Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: rayhanduitku Products: Duitku Payment Gateway Problem Types: CWE-284 Improper Access Control Description: The Duitku Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the check_duitku_response function in all versions up to, and including, 2.11.4. This makes it possible for unauthenticated attackers to change the payment status of orders to failed. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Re
e the payment status of orders to failed. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a33de35f-1c9d-4fc9-9be8-0a1c7d9352ec?source=cve - https://plugins.trac.wordpress.org/browser/duitku-social-payment-gateway/trunk/woocommerce-gateway-duitku.php#L409
CVE ID: CVE-2024-0632 State: PUBLISHED Published: 2024-05-22T07:37:22.692Z Last Updated: 2024-08-01T18:11:35.676Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: juangirini Products: Automatic Translator with Google Translate Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The Automatic Translator with Google Translate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom font setting in all versions up to, and including, 1.5.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level acces
put sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4727154c-c48f-4958-9520-cc5204927ee4?source=cve - https://wordpress.org/plugins/auto-translate/
CVE ID: CVE-2024-0637 State: PUBLISHED Published: 2024-04-01T21:45:52.634Z Last Updated: 2024-08-01T18:11:35.640Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Centreon Products: Centreon Problem Types: CWE-89 Description: Centreon updateDirectory SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the updateDirectory function. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can le
rom the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-22294. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-118/
CVE ID: CVE-2024-0638 State: PUBLISHED Published: 2024-03-22T10:25:35.675Z Last Updated: 2024-08-02T14:54:20.182Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Checkmk GmbH Products: Checkmk Problem Types: CWE-272 Description: Least privilege violation in the Checkmk agent plugins mk_oracle, mk_oracle.ps1, and mk_oracle_crs before Checkmk 2.3.0b4 (beta), 2.2.0p24, 2.1.0p41 and 2.0.0 (EOL) allows local users to escalate privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://checkmk.com/werk/16232
CVE ID: CVE-2024-0639 State: PUBLISHED Published: 2024-01-17T15:14:47.088Z Last Updated: 2025-11-20T18:09:35.744Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-833 Description: A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket.c in the Linux kernel’s SCTP subsystem. This flaw allows guests with local user privileges to trigger a deadlock and potentially crash the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References
and potentially crash the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2024-0639 - https://bugzilla.redhat.com/show_bug.cgi?id=2258754 - https://github.com/torvalds/linux/commit/6feb37b3b06e9049e20dcf7e23998f92c9c5be9a
CVE ID: CVE-2024-0640 State: PUBLISHED Published: 2025-03-20T10:10:52.310Z Last Updated: 2025-03-20T14:25:04.236Z Severity: MEDIUM (CVSS 5.6 CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N) Vendors: chatwoot Products: chatwoot/chatwoot Problem Types: CWE-79 Description: A stored cross-site scripting (XSS) vulnerability exists in chatwoot/chatwoot versions 3.0.0 to 3.5.1. This vulnerability allows an admin user to inject malicious JavaScript code via the dashboard app settings, which can then be executed by another admin user when they access the affected dashboard app. The issue is fixed in version 3.5.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bountie
ue is fixed in version 3.5.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/08b3bebf-ce3c-4416-b75e-1927ba61de85 - https://github.com/chatwoot/chatwoot/commit/e39c14460b860d5e3d23d989dd6af48404ad1bb4
CVE ID: CVE-2024-0641 State: PUBLISHED Published: 2024-01-17T15:15:45.272Z Last Updated: 2025-11-20T18:09:42.000Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-833 Description: A denial of service vulnerability was found in tipc_crypto_key_revoke in net/tipc/crypto.c in the Linux kernel’s TIPC subsystem. This flaw allows guests with local user privileges to trigger a deadlock and potentially crash the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://acces
rash the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2024-0641 - https://bugzilla.redhat.com/show_bug.cgi?id=2258757 - https://github.com/torvalds/linux/commit/08e50cf071847323414df0835109b6f3560d44f5
CVE ID: CVE-2024-0642 State: PUBLISHED Published: 2024-01-17T13:43:28.433Z Last Updated: 2025-06-02T15:05:45.346Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Cires21 Products: C21 Live Encoder and Live Mosaic Problem Types: CWE-284 Description: Inadequate access control in the C21 Live Encoder and Live Mosaic product, version 5.3. This vulnerability allows a remote attacker to access the application as an administrator user through the application endpoint, due to lack of proper credential management. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vul
rogram Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cires21-products
CVE ID: CVE-2024-0643 State: PUBLISHED Published: 2024-01-17T13:44:19.779Z Last Updated: 2025-06-02T15:05:37.586Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Cires21 Products: C21 Live Encoder and Live Mosaic Problem Types: CWE-434 Description: Unrestricted upload of dangerous file types in the C21 Live Encoder and Live Mosaic product, version 5.3. This vulnerability allows a remote attacker to upload different file extensions without any restrictions, resulting in a full system compromise. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities
iner: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cires21-products
CVE ID: CVE-2024-0644 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:06:04.897Z Description: No description available.
CVE ID: CVE-2024-0645 State: PUBLISHED Published: 2024-01-17T13:47:48.575Z Last Updated: 2024-09-10T18:14:36.621Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: explorerplusplus Products: Explorer++.exe Problem Types: CWE-119 Description: Buffer overflow vulnerability in Explorer++ affecting version 1.3.5.531. A local attacker could execute arbitrary code via a long filename argument by monitoring Structured Exception Handler (SEH) records. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/buffer-overflow-vulnerability-explorer
CVE ID: CVE-2024-0646 State: PUBLISHED Published: 2024-01-17T15:16:45.148Z Last Updated: 2025-11-06T20:51:54.670Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux 8.
8.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Extended Update Support, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Virtualization 4 for Red Hat Enterprise Linux 8, RHOL-5.8-RHEL-9, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-787 Description: An out-of-bounds memory write flaw was found in the Linux kernel’s Transport Layer Security functionality in how a user calls a function splice with a ktls socket as the destination. This flaw allows a local user to crash or potentially escalate their
tion splice with a ktls socket as the destination. This flaw allows a local user to crash or potentially escalate their privileges on the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:0723 - https://access.redhat.com/errata/RHSA-2024:0724 - https://access.redhat.com/errata/RHSA-2024:0725 - https://access.redhat.com/errata/RHSA-2024:0850 - https://access.redhat.com/errata/RHSA-2024:0851 - https://access.redhat.com/errata/RHSA-2024:0876 - https://access.redhat.com/errata/RHSA-2024:0881 - https://access.redhat.com/errata/RHSA-2024:0897 - https://access.redhat.com/errata/RHSA-2024:1248 - https://access
881 - https://access.redhat.com/errata/RHSA-2024:0897 - https://access.redhat.com/errata/RHSA-2024:1248 - https://access.redhat.com/errata/RHSA-2024:1250 - https://access.redhat.com/errata/RHSA-2024:1251 - https://access.redhat.com/errata/RHSA-2024:1253 - https://access.redhat.com/errata/RHSA-2024:1268 - https://access.redhat.com/errata/RHSA-2024:1269 - https://access.redhat.com/errata/RHSA-2024:1278 - https://access.redhat.com/errata/RHSA-2024:1306 - https://access.redhat.com/errata/RHSA-2024:1367 - https://access.redhat.com/errata/RHSA-2024:1368 - https://access.redhat.com/errata/RHSA-2024:1377 - https://access.redhat.com/errata/RHSA-2024:1382 - https://access.redhat.com/errata/RHSA-2024:1
m/errata/RHSA-2024:1377 - https://access.redhat.com/errata/RHSA-2024:1382 - https://access.redhat.com/errata/RHSA-2024:1404 - https://access.redhat.com/errata/RHSA-2024:2094 - https://access.redhat.com/security/cve/CVE-2024-0646 - https://bugzilla.redhat.com/show_bug.cgi?id=2253908 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c5a595000e267
CVE ID: CVE-2024-0647 State: PUBLISHED Published: 2024-01-17T18:31:04.100Z Last Updated: 2024-10-21T11:51:13.090Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: Sparksuite Products: SimpleMDE Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in Sparksuite SimpleMDE up to 1.11.2. This affects an unknown part of the component iFrame Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-251373 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: R
251373 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.251373 - https://vuldb.com/?ctiid.251373 - https://www.youtube.com/watch?v=KtDjoJlrpAc
CVE ID: CVE-2024-0648 State: PUBLISHED Published: 2024-01-17T22:31:03.787Z Last Updated: 2025-06-17T21:19:19.398Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Yunyou Products: CMS Problem Types: CWE-434 Description: A vulnerability has been found in Yunyou CMS up to 2.2.6 and classified as critical. This vulnerability affects unknown code of the file /app/index/controller/Common.php. The manipulation of the argument templateFile leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-251374 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA AD
DB-251374 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.251374 - https://vuldb.com/?ctiid.251374 - https://note.zhaoj.in/share/FO8AL78oAeTS
CVE ID: CVE-2024-0649 State: PUBLISHED Published: 2024-01-17T23:00:07.012Z Last Updated: 2025-06-17T21:19:19.528Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: ZhiHuiYun Problem Types: CWE-918 Description: A vulnerability was found in ZhiHuiYun up to 4.4.13 and classified as critical. This issue affects the function download_network_image of the file /app/Http/Controllers/ImageController.php of the component Search. The manipulation of the argument url leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-251375. Additional An