Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-13228 State: PUBLISHED Published: 2025-03-11T07:05:16.631Z Last Updated: 2025-03-11T15:54:12.600Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: themeum Products: Qubely – Advanced Gutenberg Blocks Problem Types: CWE-359 Description: The Qubely – Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.13 via the 'qubely_get_content'. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, scheduled, password-protected, draft, and trashed post data. Additional Analyst Notes: - CISA ADP V
ve private, pending, scheduled, password-protected, draft, and trashed post data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/72c66e71-dddb-4142-ae13-da3caffd8714?source=cve - https://plugins.trac.wordpress.org/browser/qubely/trunk/core/QUBELY.php#L1172 - https://plugins.trac.wordpress.org/changeset/3253223/
CVE ID: CVE-2024-13229 State: PUBLISHED Published: 2025-02-13T04:21:45.803Z Last Updated: 2025-02-13T16:38:45.626Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: rankmath Products: Rank Math SEO – AI SEO Tools to Dominate SEO Rankings Problem Types: CWE-284 Description: The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the update_metadata() function in all versions up to, and including, 1.0.235. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete any schema metadata assigned to any post. Additional A
ted attackers, with Contributor-level access and above, to delete any schema metadata assigned to any post. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5776f689-56dd-413d-b02d-5551b97dd5eb?source=cve - https://plugins.trac.wordpress.org/browser/seo-by-rank-math/trunk/includes/rest/class-shared.php#L169 - https://rankmath.com/changelog/free/page/2/ - https://wordpress.org/plugins/seo-by-rank-math/#developers - https://plugins.trac.wordpress.org/changeset/3222905/
CVE ID: CVE-2024-13230 State: PUBLISHED Published: 2025-01-21T11:09:46.347Z Last Updated: 2025-01-21T15:03:37.698Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: the_champ Products: Social Share, Social Login and Social Comments Plugin – Super Socializer Problem Types: CWE-89 Description: The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to Limited SQL Injection via the ‘SuperSocializerKey’ parameter in all versions up to, and including, 7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthe
user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional values into the already existing query that can be used to extract user metadata from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4d7b2a7f-3c67-4df1-bb15-e7f4f0035953?source=cve - https://plugins.trac.wordpress.org/browser/super-socializer/trunk/super_socializer.php#L291 - https://plugins.trac.wordpress.org/changeset/3225440/
CVE ID: CVE-2024-13231 State: PUBLISHED Published: 2025-02-19T08:21:45.528Z Last Updated: 2025-02-19T15:30:55.558Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: portfoliohub Products: WordPress Portfolio Builder – Portfolio Gallery Problem Types: CWE-862 Description: The WordPress Portfolio Builder – Portfolio Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'add_video' function in all versions up to, and including, 1.1.7. This makes it possible for unauthenticated attackers to add arbitrary videos to any portfolio gallery. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
tackers to add arbitrary videos to any portfolio gallery. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/28d9ab98-c1ab-45ee-a371-6598a8347b10?source=cve - https://plugins.trac.wordpress.org/browser/uber-grid/tags/1.1.7/src/Admin.php#L14 - https://plugins.trac.wordpress.org/browser/uber-grid/tags/1.1.7/src/Admin.php#L76 - https://plugins.trac.wordpress.org/browser/uber-grid/tags/1.1.7/src/Admin.php#L86 - https://plugins.trac.wordpress.org/browser/uber-grid/tags/1.1.7/src/Admin.php#L149
CVE ID: CVE-2024-13232 State: PUBLISHED Published: 2025-03-05T09:21:50.957Z Last Updated: 2025-03-05T14:52:07.832Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ddeveloper Products: WordPress Awesome Import & Export Plugin - Import & Export WordPress Data Problem Types: CWE-862 Description: The WordPress Awesome Import & Export Plugin - Import & Export WordPress Data plugin for WordPress is vulnerable arbitrary SQL Execution and privilege escalation due to a missing capability check on the renderImport() function in all versions up to, and including, 4.1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute
including, 4.1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary SQL statements that can leveraged to create a new administrative user account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f24f0673-b5c8-4086-8795-692228a413af?source=cve - https://codecanyon.net/item/wordpress-awesome-import-export-plugin-v-24/12896266
CVE ID: CVE-2024-13234 State: PUBLISHED Published: 2025-01-23T11:13:27.688Z Last Updated: 2025-01-23T14:40:38.246Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: woobewoo Products: Product Table by WBW Problem Types: CWE-89 Description: The Product Table by WBW plugin for WordPress is vulnerable to SQL Injection via the 'additionalCondition' parameter in all versions up to, and including, 2.1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sen
unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/67db430e-d796-4ace-b5d1-de492edb8ea8?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3221872%40woo-product-tables&new=3221872%40woo-product-tables&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13235 State: PUBLISHED Published: 2025-02-21T03:21:19.714Z Last Updated: 2025-02-21T21:28:33.336Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: dotonpaper Products: Pinpoint Booking System – #1 WordPress Booking Plugin Problem Types: CWE-89 Description: The Pinpoint Booking System – #1 WordPress Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the 'language' parameter in all versions up to, and including, 2.9.9.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and
paration on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/59cba7f0-cb06-4408-abba-49552dddd04c?source=cve - https://plugins.trac.wordpress.org/browser/booking-system/trunk/includes/translation/class-backend-translation.php#L125
CVE ID: CVE-2024-13236 State: PUBLISHED Published: 2025-01-23T11:13:28.519Z Last Updated: 2025-01-23T14:39:22.706Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: leogermani Products: Tainacan Problem Types: CWE-89 Description: The Tainacan plugin for WordPress is vulnerable to SQL Injection via the 'collection_id' parameter in all versions up to, and including, 0.21.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used
with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9638fb98-045b-44ec-8b53-15cfa3693ee7?source=cve - https://plugins.trac.wordpress.org/browser/tainacan/tags/0.21.12/classes/api/endpoints/class-tainacan-rest-reports-controller.php#L707 - https://plugins.trac.wordpress.org/browser/tainacan/tags/0.21.12/classes/api/endpoints/class-tainacan-rest-reports-controller.php#L732 - https://plugins.trac.wordpress.org/changeset/3226475/tainacan/trunk/classes/api/
acan-rest-reports-controller.php#L732 - https://plugins.trac.wordpress.org/changeset/3226475/tainacan/trunk/classes/api/endpoints/class-tainacan-rest-reports-controller.php
CVE ID: CVE-2024-13237 State: PUBLISHED Published: 2025-01-09T18:15:23.691Z Last Updated: 2025-01-09T20:58:24.055Z Vendors: Drupal Products: File Entity (fieldable files) Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal File Entity (fieldable files) allows Cross-Site Scripting (XSS).This issue affects File Entity (fieldable files): from 7.X-* before 7.X-2.38. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-001
CVE ID: CVE-2024-13238 State: PUBLISHED Published: 2025-01-09T18:33:30.339Z Last Updated: 2025-01-09T21:01:34.194Z Vendors: Drupal Products: Typogrify Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Typogrify allows Cross-Site Scripting (XSS).This issue affects Typogrify: from 0.0.0 before 1.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-002
CVE ID: CVE-2024-13239 State: PUBLISHED Published: 2025-01-09T18:35:46.333Z Last Updated: 2025-01-10T17:18:02.874Z Vendors: Drupal Products: Two-factor Authentication (TFA) Problem Types: CWE-1390 Description: Weak Authentication vulnerability in Drupal Two-factor Authentication (TFA) allows Authentication Abuse.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-003
CVE ID: CVE-2024-13240 State: PUBLISHED Published: 2025-01-09T18:46:57.503Z Last Updated: 2025-01-10T17:16:11.166Z Vendors: Drupal Products: Open Social Problem Types: CWE-284 Description: Improper Access Control vulnerability in Drupal Open Social allows Collect Data from Common Resource Locations.This issue affects Open Social: from 0.0.0 before 12.05. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-004
CVE ID: CVE-2024-13241 State: PUBLISHED Published: 2025-01-09T18:47:46.096Z Last Updated: 2025-01-10T17:14:22.344Z Vendors: Drupal Products: Open Social Problem Types: CWE-285 Description: Improper Authorization vulnerability in Drupal Open Social allows Collect Data from Common Resource Locations.This issue affects Open Social: from 0.0.0 before 12.0.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-005
CVE ID: CVE-2024-13242 State: PUBLISHED Published: 2025-01-09T18:49:16.322Z Last Updated: 2025-01-10T17:12:58.080Z Vendors: Drupal Products: Swift Mailer (abandoned) Problem Types: CWE-749 Description: Exposed Dangerous Method or Function vulnerability in Drupal Swift Mailer allows Resource Location Spoofing.This issue affects Swift Mailer: *.*. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-006
CVE ID: CVE-2024-13243 State: PUBLISHED Published: 2025-01-09T18:49:49.688Z Last Updated: 2025-01-10T17:11:34.905Z Vendors: Drupal Products: Entity Delete Log Problem Types: CWE-862 Description: Missing Authorization vulnerability in Drupal Entity Delete Log allows Forceful Browsing.This issue affects Entity Delete Log: from 0.0.0 before 1.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-007
CVE ID: CVE-2024-13244 State: PUBLISHED Published: 2025-01-09T18:50:23.406Z Last Updated: 2025-01-10T17:10:22.748Z Vendors: Drupal Products: Migrate Tools Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Drupal Migrate Tools allows Cross Site Request Forgery.This issue affects Migrate Tools: from 0.0.0 before 6.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-008
CVE ID: CVE-2024-13245 State: PUBLISHED Published: 2025-01-09T18:51:18.052Z Last Updated: 2025-01-09T21:02:07.840Z Vendors: Drupal Products: CKEditor 4 LTS - WYSIWYG HTML editor Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CKEditor 4 LTS - WYSIWYG HTML editor allows Cross-Site Scripting (XSS).This issue affects CKEditor 4 LTS - WYSIWYG HTML editor: from 1.0.0 before 1.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-009
CVE ID: CVE-2024-13246 State: PUBLISHED Published: 2025-01-09T18:52:31.142Z Last Updated: 2025-01-10T19:34:34.972Z Vendors: Drupal Products: Node Access Rebuild Progressive Problem Types: CWE-282 Description: Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.This issue affects Node Access Rebuild Progressive: from 0.0.0 before 2.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-010
CVE ID: CVE-2024-13247 State: PUBLISHED Published: 2025-01-09T18:53:15.187Z Last Updated: 2025-01-09T21:03:36.274Z Vendors: Drupal Products: Coffee Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Coffee allows Cross-Site Scripting (XSS).This issue affects Coffee: from 0.0.0 before 1.4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-011
CVE ID: CVE-2024-13248 State: PUBLISHED Published: 2025-01-09T18:53:58.956Z Last Updated: 2025-01-10T21:18:54.261Z Vendors: Drupal Products: Private content Problem Types: CWE-266 Description: Incorrect Privilege Assignment vulnerability in Drupal Private content allows Target Influence via Framing.This issue affects Private content: from 0.0.0 before 2.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-012
CVE ID: CVE-2024-13249 State: PUBLISHED Published: 2025-01-09T18:55:21.700Z Last Updated: 2025-01-10T21:24:31.894Z Vendors: Drupal Products: Node Access Rebuild Progressive Problem Types: CWE-282 Description: Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.This issue affects Node Access Rebuild Progressive: from 7.X-1.0 before 7.X-1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-013
CVE ID: CVE-2024-13250 State: PUBLISHED Published: 2025-01-09T18:57:50.019Z Last Updated: 2025-01-10T17:09:26.669Z Vendors: Drupal Products: Drupal Symfony Mailer Lite Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Drupal Drupal Symfony Mailer Lite allows Cross Site Request Forgery.This issue affects Drupal Symfony Mailer Lite: from 0.0.0 before 1.0.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-014
CVE ID: CVE-2024-13251 State: PUBLISHED Published: 2025-01-09T18:58:16.356Z Last Updated: 2025-01-10T17:06:53.687Z Vendors: Drupal Products: Registration role Problem Types: CWE-266 Description: Incorrect Privilege Assignment vulnerability in Drupal Registration role allows Privilege Escalation.This issue affects Registration role: from 0.0.0 before 2.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-015
CVE ID: CVE-2024-13252 State: PUBLISHED Published: 2025-01-09T18:58:53.806Z Last Updated: 2025-01-09T21:05:46.806Z Vendors: Drupal Products: TacJS Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal TacJS allows Cross-Site Scripting (XSS).This issue affects TacJS: from 0.0.0 before 6.5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-016
CVE ID: CVE-2024-13253 State: PUBLISHED Published: 2025-01-09T18:59:22.054Z Last Updated: 2025-01-10T17:05:28.885Z Vendors: Drupal Products: Advanced PWA inc Push Notifications Problem Types: CWE-863 Description: Incorrect Authorization vulnerability in Drupal Advanced PWA inc Push Notifications allows Forceful Browsing.This issue affects Advanced PWA inc Push Notifications: from 0.0.0 before 1.5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-017
CVE ID: CVE-2024-13254 State: PUBLISHED Published: 2025-01-09T18:59:46.386Z Last Updated: 2025-01-10T17:04:06.584Z Vendors: Drupal Products: REST Views Problem Types: CWE-201 Description: Insertion of Sensitive Information Into Sent Data vulnerability in Drupal REST Views allows Forceful Browsing.This issue affects REST Views: from 0.0.0 before 3.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-018
CVE ID: CVE-2024-13255 State: PUBLISHED Published: 2025-01-09T19:00:43.339Z Last Updated: 2025-01-10T17:02:14.839Z Vendors: Drupal Products: RESTful Web Services Problem Types: CWE-202 Description: Exposure of Sensitive Information Through Data Queries vulnerability in Drupal RESTful Web Services allows Forceful Browsing.This issue affects RESTful Web Services: from 7.X-2.0 before 7.X-2.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-019
CVE ID: CVE-2024-13256 State: PUBLISHED Published: 2025-01-09T19:03:47.618Z Last Updated: 2025-01-10T17:00:06.490Z Vendors: Drupal Products: Email Contact Problem Types: CWE-1220 Description: Insufficient Granularity of Access Control vulnerability in Drupal Email Contact allows Forceful Browsing.This issue affects Email Contact: from 0.0.0 before 2.0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-020
CVE ID: CVE-2024-13257 State: PUBLISHED Published: 2025-01-09T19:04:57.424Z Last Updated: 2025-01-10T16:50:24.727Z Vendors: Drupal Products: Commerce View Receipt Problem Types: CWE-863 Description: Incorrect Authorization vulnerability in Drupal Commerce View Receipt allows Forceful Browsing.This issue affects Commerce View Receipt: from 0.0.0 before 1.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-021
CVE ID: CVE-2024-13258 State: PUBLISHED Published: 2025-01-09T19:05:29.925Z Last Updated: 2025-01-10T16:46:12.472Z Vendors: Drupal Products: Drupal REST & JSON API Authentication Problem Types: CWE-863 Description: Incorrect Authorization vulnerability in Drupal Drupal REST & JSON API Authentication allows Forceful Browsing.This issue affects Drupal REST & JSON API Authentication: from 0.0.0 before 2.0.13. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-022
CVE ID: CVE-2024-13259 State: PUBLISHED Published: 2025-01-09T19:11:25.339Z Last Updated: 2025-01-10T16:44:21.601Z Vendors: Drupal Products: Image Sizes Problem Types: CWE-201 Description: Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Image Sizes allows Forceful Browsing.This issue affects Image Sizes: from 0.0.0 before 3.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-023
CVE ID: CVE-2024-13260 State: PUBLISHED Published: 2025-01-09T19:12:11.941Z Last Updated: 2025-01-10T16:42:29.368Z Vendors: Drupal Products: Migrate queue importer Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Drupal Migrate queue importer allows Cross Site Request Forgery.This issue affects Migrate queue importer: from 0.0.0 before 2.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-024
CVE ID: CVE-2024-13261 State: PUBLISHED Published: 2025-01-09T19:14:19.954Z Last Updated: 2025-01-10T21:26:25.938Z Vendors: Drupal Products: Acquia DAM Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Drupal Acquia DAM allows Cross Site Request Forgery.This issue affects Acquia DAM: from 0.0.0 before 1.0.13, from 1.1.0 before 1.1.0-beta3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-025
CVE ID: CVE-2024-13262 State: PUBLISHED Published: 2025-01-09T19:14:50.335Z Last Updated: 2025-01-09T21:07:32.789Z Vendors: Drupal Products: View Password Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal View Password allows Cross-Site Scripting (XSS).This issue affects View Password: from 0.0.0 before 6.0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-026
CVE ID: CVE-2024-13263 State: PUBLISHED Published: 2025-01-09T19:15:18.382Z Last Updated: 2025-01-10T21:27:31.833Z Vendors: Drupal Products: Opigno group manager Problem Types: CWE-96 Description: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno group manager allows PHP Local File Inclusion.This issue affects Opigno group manager: from 0.0.0 before 3.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-027
CVE ID: CVE-2024-13264 State: PUBLISHED Published: 2025-01-09T19:15:52.754Z Last Updated: 2025-01-10T16:36:51.312Z Vendors: Drupal Products: Opigno module Problem Types: CWE-96 Description: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno module allows PHP Local File Inclusion.This issue affects Opigno module: from 0.0.0 before 3.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-028
CVE ID: CVE-2024-13265 State: PUBLISHED Published: 2025-01-09T19:16:21.090Z Last Updated: 2025-01-14T16:28:09.972Z Vendors: Drupal Products: Opigno Learning path Problem Types: CWE-96 Description: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno Learning path allows PHP Local File Inclusion.This issue affects Opigno Learning path: from 0.0.0 before 3.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2024-029