Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-10484 State: PUBLISHED Published: 2024-12-03T05:33:26.364Z Last Updated: 2024-12-03T11:23:43.226Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: brainstormforce Products: Spectra – WordPress Gutenberg Blocks Problem Types: CWE-79 Description: The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Team' widget in all versions up to, and including, 2.16.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages
possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c218bf5e-b28b-4512-8bc7-7662b4a06f1e?source=cve - https://wordpress.org/plugins/ultimate-addons-for-gutenberg/#developers - https://plugins.trac.wordpress.org/changeset/3180325/
CVE ID: CVE-2024-10486 State: PUBLISHED Published: 2024-11-18T21:31:09.032Z Last Updated: 2024-11-19T15:22:14.000Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: automattic Products: Google for WooCommerce Problem Types: CWE-862 Description: The Google for WooCommerce plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 2.8.6. This is due to publicly accessible print_php_information.php file. This makes it possible for unauthenticated attackers to retrieve information about Webserver and PHP configuration, which can be used to aid other attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
nfiguration, which can be used to aid other attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/64bc7d47-6b63-4fd9-85d4-82126f86308a?source=cve - https://plugins.trac.wordpress.org/browser/google-listings-and-ads/tags/2.8.6/vendor/googleads/google-ads-php/scripts/print_php_information.php
CVE ID: CVE-2024-10487 State: PUBLISHED Published: 2024-10-29T21:55:42.286Z Last Updated: 2024-10-31T14:04:11.091Z Vendors: Google Products: Chrome Problem Types: CWE-787 Description: Out of bounds write in Dawn in Google Chrome prior to 130.0.6723.92 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Critical) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_29.html - https://issues.chromium.org/issues/375123371
CVE ID: CVE-2024-10488 State: PUBLISHED Published: 2024-10-29T21:55:42.729Z Last Updated: 2024-10-31T14:04:38.830Z Vendors: Google Products: Chrome Problem Types: CWE-416 Description: Use after free in WebRTC in Google Chrome prior to 130.0.6723.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_29.html - https://issues.chromium.org/issues/374310077
CVE ID: CVE-2024-10490 State: PUBLISHED Published: 2024-12-02T08:46:44.044Z Last Updated: 2024-12-02T22:11:21.408Z Vendors: B&R Industrial Automation GmbH Products: B&R mapp Cockpit, B&R mapp View, B&R mapp Services, B&R mapp Motion, B&R mapp Vision Problem Types: CWE-288 Description: An “Authentication Bypass Using an Alternate Path or Channel” vulnerability in the OPC UA Server configuration required for B&R mapp Cockpit before 6.0, B&R mapp View before 6.0, B&R mapp Services before 6.0, B&R mapp Motion before 6.0 and B&R mapp Vision before 6.0 may be used by an unauthenticated network-based attacker to cause information disclosure, unintended change of data, or denial of service condition
icated network-based attacker to cause information disclosure, unintended change of data, or denial of service conditions. B&R mapp Services is only affected, when mpUserX or mpCodeBox are used in the Automation Studio project. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.br-automation.com/fileadmin/SA22P014-90c4aa35.pdf
CVE ID: CVE-2024-10491 State: PUBLISHED Published: 2024-10-29T16:23:21.219Z Last Updated: 2024-10-29T19:44:30.890Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: express Products: express Problem Types: CWE-74 Description: A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used. The issue arises from improper sanitization in `Link` header values, which can allow a combination of characters like `,`, `;`, and `<>` to preload malicious resources. This vulnerability is especially relevant for dynamic parameters. Additional Analyst Notes: - CISA ADP Vuln
s resources. This vulnerability is especially relevant for dynamic parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.herodevs.com/vulnerability-directory/cve-2024-10491
CVE ID: CVE-2024-10492 State: PUBLISHED Published: 2024-11-25T07:37:30.572Z Last Updated: 2025-11-11T16:26:14.590Z Severity: LOW (CVSS 2.7 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: Red Hat Products: Red Hat build of Keycloak 24, Red Hat build of Keycloak 24.0.9, Red Hat build of Keycloak 26.0, Red Hat build of Keycloak 26.0.6, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat Single Sign-On 7 Problem Types: CWE-73 Description: A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context. This attacker must have prev
could read sensitive information from a Vault file that is not within the expected context. This attacker must have previous high access to the Keycloak server in order to perform resource creation, for example, an LDAP provider configuration and set up a Vault read file, which will only inform whether that file exists or not. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:10175 - https://access.redhat.com/errata/RHSA-2024:10176 - https://access.redhat.com/errata/RHSA-2024:10177 - https://access.redhat.com/errata/RHSA-2024:10178 - https://access.redhat.com/security/cve/CVE-2024-10492 - https://bugzilla.redhat.com/show_bug.cgi?id=23
RHSA-2024:10178 - https://access.redhat.com/security/cve/CVE-2024-10492 - https://bugzilla.redhat.com/show_bug.cgi?id=2322447
CVE ID: CVE-2024-10493 State: PUBLISHED Published: 2024-11-28T06:00:07.715Z Last Updated: 2024-11-29T15:46:42.137Z Vendors: Unknown Products: Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) WordPress plugin before 5.10.3 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst No
ld allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2e7f7196-054b-4cfd-9219-c60bb8275e8d/
CVE ID: CVE-2024-10494 State: PUBLISHED Published: 2024-12-10T15:49:13.763Z Last Updated: 2024-12-10T20:33:18.417Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: NI Products: LabVIEW Problem Types: CWE-1285 Description: An out of bounds read due to improper input validation in HeapObjMapImpl.cpp in NI LabVIEW may disclose information or result in arbitrary code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q3 and prior versions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ni.com/en/support/security/available-critical-and-security-u
t Notes: - CISA ADP Vulnrichment: References: - https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-bounds-read-vulnerabilities-in-ni-labview-.html
CVE ID: CVE-2024-10495 State: PUBLISHED Published: 2024-12-10T15:52:43.177Z Last Updated: 2024-12-10T20:18:12.830Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: NI Products: LabVIEW Problem Types: CWE-1285 Description: An out of bounds read due to improper input validation when loading the font table in fontmgr.cpp in NI LabVIEW may disclose information or result in arbitrary code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q3 and prior versions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ni.com/en/support/security/available-cr
ns. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-bounds-read-vulnerabilities-in-ni-labview-.html
CVE ID: CVE-2024-10496 State: PUBLISHED Published: 2024-12-10T15:55:46.698Z Last Updated: 2024-12-10T20:10:51.547Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: NI Products: LabVIEW Problem Types: CWE-1285 Description: An out of bounds read due to improper input validation in BuildFontMap in fontmgr.cpp in NI LabVIEW may disclose information or result in arbitrary code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q3 and prior versions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ni.com/en/support/security/available-critical-and-s
al Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-bounds-read-vulnerabilities-in-ni-labview-.html
CVE ID: CVE-2024-10497 State: PUBLISHED Published: 2025-01-17T10:27:52.954Z Last Updated: 2025-02-12T16:50:20.155Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: PowerLogic HDPM6000 Problem Types: CWE-639 Description: CWE-639: Authorization Bypass Through User-Controlled Key vulnerability exists that could allow an authorized attacker to modify values outside those defined by their privileges (Elevation of Privileges) when the attacker sends modified HTTPS requests to the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-014-08&p_enDocType=Sec
ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-014-08&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-014-08.pdf
CVE ID: CVE-2024-10498 State: PUBLISHED Published: 2025-01-17T10:30:21.046Z Last Updated: 2025-02-12T16:50:39.933Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Schneider Electric Products: PowerLogic HDPM6000 Problem Types: CWE-119 Description: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could allow an unauthorized attacker to modify configuration values outside of the normal range when the attacker sends specific Modbus write packets to the device which could result in invalid data or loss of web interface functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:/
id data or loss of web interface functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-014-08&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-014-08.pdf
CVE ID: CVE-2024-10499 State: PUBLISHED Published: 2024-12-12T06:00:09.432Z Last Updated: 2024-12-12T15:17:51.374Z Vendors: Unknown Products: AI Engine Problem Types: CWE-89 SQL Injection Description: The AI Engine WordPress plugin before 2.6.5 does not sanitize and escape a parameter from one of its RESP API endpoint before using it in a SQL statement, allowing admins to perform SQL injection attacks Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8606a93a-f61d-40df-a67e-0ac75eeadee8/
CVE ID: CVE-2024-10500 State: PUBLISHED Published: 2024-10-30T00:00:09.706Z Last Updated: 2024-10-30T15:00:14.178Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: ESAFENET Products: CDG Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in ESAFENET CDG 5. Affected by this issue is some unknown functionality of the file /com/esafenet/servlet/policy/HookWhiteListService.java. The manipulation of the argument policyId leads to sql injection. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:/
this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282440 - https://vuldb.com/?ctiid.282440 - https://vuldb.com/?submit.427397 - https://flowus.cn/share/a582f7be-7e33-41f1-bce9-a1eb3578229f?code=G8A6P3
CVE ID: CVE-2024-10501 State: PUBLISHED Published: 2024-10-30T00:00:12.843Z Last Updated: 2024-10-30T15:00:04.338Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: ESAFENET Products: CDG Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in ESAFENET CDG 5. This affects the function findById of the file /com/esafenet/servlet/document/ExamCDGDocService.java. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - C
used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282441 - https://vuldb.com/?ctiid.282441 - https://vuldb.com/?submit.427398 - https://flowus.cn/share/95cc2cb9-7ab2-4eba-969f-f836fac1deb4?code=G8A6P3
CVE ID: CVE-2024-10502 State: PUBLISHED Published: 2024-10-30T01:00:08.673Z Last Updated: 2024-10-30T14:59:52.645Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: ESAFENET Products: CDG Problem Types: CWE-89 Description: A vulnerability has been found in ESAFENET CDG 5 and classified as critical. This vulnerability affects the function getOneFileDirectory of the file /com/esafenet/servlet/fileManagement/FileDirectoryService.java. The manipulation of the argument directoryId leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
osed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282442 - https://vuldb.com/?ctiid.282442 - https://vuldb.com/?submit.427399 - https://flowus.cn/share/f1f8c6bd-057f-406b-9421-ab6cee169980?code=G8A6P3
CVE ID: CVE-2024-10503 State: PUBLISHED Published: 2024-10-30T01:00:09.924Z Last Updated: 2024-10-30T14:59:45.804Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Klokan Products: MapTiler tileserver-gl Problem Types: CWE-79 Description: A vulnerability was found in Klokan MapTiler tileserver-gl 2.3.1 and classified as problematic. This issue affects some unknown processing of the component URL Handler. The manipulation of the argument key leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - C
used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282443 - https://vuldb.com/?ctiid.282443 - https://vuldb.com/?submit.427302
CVE ID: CVE-2024-10504 State: PUBLISHED Published: 2025-05-15T20:06:44.219Z Last Updated: 2025-05-20T15:31:47.781Z Vendors: Unknown Products: Contact Form, Survey, Quiz & Popup Form Builder Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Contact Form, Survey, Quiz & Popup Form Builder WordPress plugin before 1.7.1 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/9a22df11-0e24-4248-a8f3-da8f23ccb313/
CVE ID: CVE-2024-10505 State: PUBLISHED Published: 2024-10-30T01:31:04.245Z Last Updated: 2024-10-30T14:59:37.991Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: wuzhicms Problem Types: CWE-94 Description: A vulnerability was found in wuzhicms 4.1.0. It has been classified as critical. Affected is the function add/edit of the file www/coreframe/app/content/admin/block.php. The manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Initially two separate issues were created by the researcher for the different function calls. The vendor was contacted early about this disclosur
ues were created by the researcher for the different function calls. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282444 - https://vuldb.com/?ctiid.282444 - https://vuldb.com/?submit.427401 - https://github.com/wuzhicms/wuzhicms/issues/209
CVE ID: CVE-2024-10506 State: PUBLISHED Published: 2024-10-30T02:00:09.163Z Last Updated: 2024-10-30T14:08:11.065Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Blood Bank System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in code-projects Blood Bank System 1.0. This affects an unknown part of the file /admin/blood/update/B-.php. The manipulation of the argument Bloodname leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282447 - https://vul
may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282447 - https://vuldb.com/?ctiid.282447 - https://vuldb.com/?submit.432688 - https://github.com/xxx-www/cve/blob/main/sql8.md - https://code-projects.org/
CVE ID: CVE-2024-10507 State: PUBLISHED Published: 2024-10-30T02:31:04.367Z Last Updated: 2024-10-30T14:59:09.833Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Codezips Products: Free Exam Hall Seating Management System Problem Types: CWE-89 Description: A vulnerability classified as critical was found in Codezips Free Exam Hall Seating Management System 1.0. This vulnerability affects unknown code of the file /login.php. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282448 -
public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282448 - https://vuldb.com/?ctiid.282448 - https://vuldb.com/?submit.432719 - https://github.com/ppp-src/CVE/issues/26
CVE ID: CVE-2024-10508 State: PUBLISHED Published: 2024-11-09T07:35:07.908Z Last Updated: 2024-11-12T18:32:01.806Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: metagauss Products: RegistrationMagic – User Registration Plugin with Custom Registration Forms Problem Types: CWE-230 Description: The RegistrationMagic – User Registration Plugin with Custom Registration Forms plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0.2.6. This is due to the plugin not properly validating the password reset token prior to updating a user's password. This makes it possible for unauthenticated attacke
idating the password reset token prior to updating a user's password. This makes it possible for unauthenticated attackers to reset the password of arbitrary users, including administrators, and gain access to these accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c4679fa7-be6b-4f50-8cdf-ff9822794f19?source=cve - https://plugins.trac.wordpress.org/browser/custom-registration-form-builder-with-submission-manager/tags/6.0.2.6/public/controllers/class_rm_login_controller.php#L241 - https://plugins.trac.wordpress.org/changeset/3181174/custom-registration-form-builder-with-submission-manager/trunk/public/controlle
ins.trac.wordpress.org/changeset/3181174/custom-registration-form-builder-with-submission-manager/trunk/public/controllers/class_rm_login_controller.php - https://plugins.trac.wordpress.org/browser/custom-registration-form-builder-with-submission-manager/tags/6.0.2.6/public/controllers/class_rm_login_controller.php#L239
CVE ID: CVE-2024-10509 State: PUBLISHED Published: 2024-10-30T02:31:05.861Z Last Updated: 2024-10-30T14:58:55.440Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Codezips Products: Online Institute Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in Codezips Online Institute Management System 1.0. This issue affects some unknown processing of the file /login.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.
d to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282449 - https://vuldb.com/?ctiid.282449 - https://vuldb.com/?submit.432720 - https://github.com/ppp-src/CVE/issues/27
CVE ID: CVE-2024-10510 State: PUBLISHED Published: 2024-11-28T06:00:10.944Z Last Updated: 2024-11-29T15:43:46.794Z Vendors: Unknown Products: adBuddy+ (AdBlocker Detection) by NetfunkDesign Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The adBuddy+ (AdBlocker Detection) by NetfunkDesign WordPress plugin through 1.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ca499752-b516-42e7-8c2f-18e
ional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ca499752-b516-42e7-8c2f-18e4428a92c7/