Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-6743 State: PUBLISHED Published: 2024-07-15T06:07:46.528Z Last Updated: 2024-08-01T21:41:04.627Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: AguardNet Products: Space Management System Problem Types: CWE-89 Description: AguardNet's Space Management System does not properly validate user input, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-7932-a6d4d-1.html - https://www.twcert.org.tw/en/cp-139-7933-9a38d-2.html
CVE ID: CVE-2024-6744 State: PUBLISHED Published: 2024-07-15T06:32:21.616Z Last Updated: 2024-08-01T21:41:04.572Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Cellopoint Products: Secure Email Gateway Problem Types: CWE-121 Description: The SMTP Listener of Secure Email Gateway from Cellopoint does not properly validate user input, leading to a Buffer Overflow vulnerability. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands on the remote server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-7936-f6381-1.html - https://www.
ulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-7936-f6381-1.html - https://www.twcert.org.tw/en/cp-139-7937-acbb5-2.html
CVE ID: CVE-2024-6745 State: PUBLISHED Published: 2024-07-15T11:00:06.332Z Last Updated: 2024-08-01T21:41:04.597Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: code-projects Products: Simple Ticket Booking Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in code-projects Simple Ticket Booking 1.0. Affected is an unknown function of the file adminauthenticate.php of the component Login. The manipulation of the argument email/password leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-271476. Additional Analyst Notes
en disclosed to the public and may be used. The identifier of this vulnerability is VDB-271476. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.271476 - https://vuldb.com/?ctiid.271476 - https://vuldb.com/?submit.374770 - https://github.com/xzyxiaohaha/cve/issues/2
CVE ID: CVE-2024-6746 State: PUBLISHED Published: 2024-07-15T12:00:06.186Z Last Updated: 2024-08-01T21:41:04.556Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: NaiboWang Products: EasySpider Problem Types: CWE-24 Description: A vulnerability classified as problematic was found in NaiboWang EasySpider 0.6.2 on Windows. Affected by this vulnerability is an unknown functionality of the file \EasySpider\resources\app\server.js of the component HTTP GET Request Handler. The manipulation with the input /../../../../../../../../../Windows/win.ini leads to path traversal: '../filedir'. The attack needs to be done within the local network. The exploit has been disc
i leads to path traversal: '../filedir'. The attack needs to be done within the local network. The exploit has been disclosed to the public and may be used. The identifier VDB-271477 was assigned to this vulnerability. NOTE: The code maintainer explains, that this is not a big issue "because the default is that the software runs locally without going through the Internet". Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.271477 - https://vuldb.com/?ctiid.271477 - https://vuldb.com/?submit.371998 - https://github.com/NaiboWang/EasySpider/issues/466
CVE ID: CVE-2024-6747 State: PUBLISHED Published: 2024-10-10T07:43:48.050Z Last Updated: 2024-10-10T13:44:21.470Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Checkmk GmbH Products: Checkmk Problem Types: CWE-201 Description: Information leakage in mknotifyd in Checkmk before 2.3.0p18, 2.2.0p36, 2.1.0p49 and in 2.0.0p39 (EOL) allows attacker to get potentially sensitive data Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://checkmk.com/werk/17145
CVE ID: CVE-2024-6748 State: PUBLISHED Published: 2024-07-29T16:20:16.449Z Last Updated: 2024-08-01T21:41:04.605Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: ManageEngine Products: OpManager Problem Types: CWE-89 Description: Zohocorp ManageEngine OpManager, OpManager Plus, OpManager MSP and RMM versions 128317 and below are vulnerable to authenticated SQL injection in the URL monitoring. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.manageengine.com/itom/advisory/cve-2024-6748.html
CVE ID: CVE-2024-6749 State: PUBLISHED Published: 2024-11-26T07:07:30.538Z Last Updated: 2024-11-26T14:09:25.817Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: Axis Communications AB Products: AXIS Camera Station Pro, AXIS Camera Station Problem Types: CWE-522 Description: Seth Fogie, member of the AXIS Camera Station Pro Bug Bounty Program, has found that the Incident report feature may expose sensitive credentials on the AXIS Camera Station windows client. If Incident report is not being used with credentials configured this flaw does not apply. Axis has released patched versions for the highlighted flaw. Please refer to the Axis security advisory for mo
ot apply. Axis has released patched versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axis.com/dam/public/e6/e8/1e/cve-2024-6749-en-US-455106.pdf
CVE ID: CVE-2024-6750 State: PUBLISHED Published: 2024-07-24T02:33:55.116Z Last Updated: 2024-08-01T21:41:04.583Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: WPWeb Products: Social Auto Poster Problem Types: CWE-862 Description: The Social Auto Poster plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 5.3.14. This makes it possible for unauthenticated attackers to add, modify, or delete post meta and plugin options. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence
options. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/36b58a4f-0761-4775-9010-9c77d4019c44?source=cve - https://codecanyon.net/item/social-auto-poster-wordpress-scheduler-marketing-plugin/5754169
CVE ID: CVE-2024-6751 State: PUBLISHED Published: 2024-07-24T02:33:57.454Z Last Updated: 2024-08-01T21:41:04.599Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: WPWeb Products: Social Auto Poster Problem Types: CWE-352 Description: The Social Auto Poster plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.3.14. This is due to missing or incorrect nonce validation on multiple functions. This makes it possible for unauthenticated attackers to add, modify, or delete post meta and plugin options. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/th
. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d7aceccc-7004-42f2-b085-eade9c45141c?source=cve - https://codecanyon.net/item/social-auto-poster-wordpress-scheduler-marketing-plugin/5754169
CVE ID: CVE-2024-6752 State: PUBLISHED Published: 2024-07-24T02:33:55.589Z Last Updated: 2024-08-01T21:41:04.585Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: WPWeb Products: Social Auto Poster Problem Types: CWE-79 Description: The Social Auto Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wp_name’ parameter in the 'wpw_auto_poster_map_wordpress_post_type' AJAX function in all versions up to, and including, 5.3.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execut
thenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/39b9e8a0-96bb-4b36-b4e8-ec9e3f137835?source=cve - https://codecanyon.net/item/social-auto-poster-wordpress-scheduler-marketing-plugin/5754169
CVE ID: CVE-2024-6753 State: PUBLISHED Published: 2024-07-24T02:33:56.070Z Last Updated: 2024-08-01T21:41:04.618Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: WPWeb Products: Social Auto Poster Problem Types: CWE-79 Description: The Social Auto Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mapTypes’ parameter in the 'wpw_auto_poster_map_wordpress_post_type' AJAX function in all versions up to, and including, 5.3.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected p
uthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3c268a6d-dfb4-4a9d-802e-80e5c1c53ca2?source=cve - https://codecanyon.net/item/social-auto-poster-wordpress-scheduler-marketing-plugin/5754169
CVE ID: CVE-2024-6754 State: PUBLISHED Published: 2024-07-24T02:33:56.552Z Last Updated: 2024-08-01T21:41:04.598Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: WPWeb Products: Social Auto Poster Problem Types: CWE-862 Description: The Social Auto Poster plugin for WordPress is vulnerable to unauthorized modification of data to a missing capability check on the ‘wpw_auto_poster_update_tweet_template’ function in all versions up to, and including, 5.3.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary post metadata. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Ref
bove, to update arbitrary post metadata. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/72934d2f-fd52-46d1-8cf9-9a20968899f7?source=cve - https://codecanyon.net/item/social-auto-poster-wordpress-scheduler-marketing-plugin/5754169
CVE ID: CVE-2024-6755 State: PUBLISHED Published: 2024-07-24T02:33:57.925Z Last Updated: 2024-08-01T21:41:04.553Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: WPWeb Products: Social Auto Poster Problem Types: CWE-862 Description: The Social Auto Poster plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the ‘wpw_auto_poster_quick_delete_multiple’ function in all versions up to, and including, 5.3.14. This makes it possible for unauthenticated attackers to delete arbitrary posts. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.c
posts. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d9b1044d-6858-498f-9b89-352650061858?source=cve - https://codecanyon.net/item/social-auto-poster-wordpress-scheduler-marketing-plugin/5754169
CVE ID: CVE-2024-6756 State: PUBLISHED Published: 2024-07-24T02:33:54.520Z Last Updated: 2024-08-01T21:41:04.577Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: WPWeb Products: Social Auto Poster Problem Types: CWE-434 Description: The Social Auto Poster plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpw_auto_poster_get_image_path' function in all versions up to, and including, 5.3.14. This makes it possible for authenticated attackers, with Contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible. An attacker can use
upload arbitrary files on the affected site's server which may make remote code execution possible. An attacker can use CVE-2024-6754 to exploit with subscriber-level access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/24e00c0d-08ff-4c68-a1dd-77b513545efd?source=cve - https://codecanyon.net/item/social-auto-poster-wordpress-scheduler-marketing-plugin/5754169
CVE ID: CVE-2024-6757 State: PUBLISHED Published: 2024-10-15T02:03:52.326Z Last Updated: 2024-10-15T13:19:04.948Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: elemntor Products: Elementor Website Builder – More than Just a Page Builder Problem Types: CWE-200 Description: The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Basic Information Exposure in all versions up to, and including, 3.23.5 via the get_image_alt function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract either excerpt data or titles of private or password-protected posts. Additional An
r-level access and above, to extract either excerpt data or titles of private or password-protected posts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/96fa9ed7-6c13-4356-8a25-8a309be2b0e9?source=cve - https://plugins.trac.wordpress.org/browser/elementor/tags/3.23.0/includes/controls/media.php#L413
CVE ID: CVE-2024-6758 State: PUBLISHED Published: 2024-08-12T10:20:10.039Z Last Updated: 2025-08-22T09:00:03.779Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Sprecher Automation Products: SPRECON-E Problem Types: CWE-266 Description: Improper Privilege Management in Sprecher Automation SPRECON-E below version 8.71j allows a remote attacker with low privileges to save unauthorized protection assignments. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sprecher-automation.com/fileadmin/itSecurity/PDF/SPR-2407171_de.pdf
CVE ID: CVE-2024-6759 State: PUBLISHED Published: 2024-08-11T02:45:15.024Z Last Updated: 2024-08-16T17:02:45.727Z Vendors: FreeBSD Products: FreeBSD Description: When mounting a remote filesystem using NFS, the kernel did not sanitize remotely provided filenames for the path separator character, "/". This allows readdir(3) and related functions to return filesystem entries with names containing additional path components. The lack of validation described above gives rise to a confused deputy problem. For example, a program copying files from an NFS mount could be tricked into copying from outside the intended source directory, and/or to a location outside the intended destination directory.
to copying from outside the intended source directory, and/or to a location outside the intended destination directory. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.freebsd.org/advisories/FreeBSD-SA-24:07.nfsclient.asc
CVE ID: CVE-2024-6760 State: PUBLISHED Published: 2024-08-11T02:40:03.814Z Last Updated: 2024-10-29T19:41:19.862Z Vendors: FreeBSD Products: FreeBSD Description: A logic bug in the code which disables kernel tracing for setuid programs meant that tracing was not disabled when it should have, allowing unprivileged users to trace and inspect the behavior of setuid programs. The bug may be used by an unprivileged user to read the contents of files to which they would not otherwise have access, such as the local password database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.freebsd.org/advisories/FreeBSD-SA-24:06.ktrace.asc
CVE ID: CVE-2024-6761 State: REJECTED Published: N/A Last Updated: 2024-07-29T11:07:38.756Z Description: No description available.
CVE ID: CVE-2024-6762 State: PUBLISHED Published: 2024-10-14T15:07:10.942Z Last Updated: 2025-11-03T19:34:37.967Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Eclipse Foundation Products: Jetty Problem Types: CWE-400 Description: Jetty PushSessionCacheFilter can be exploited by unauthenticated users to launch remote DoS attacks by exhausting the server’s memory. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/jetty/jetty.project/security/advisories/GHSA-r7m4-f9h5-gr79 - https://gitlab.eclipse.org/security/cve-assignement/-/issues/24 - https://github.com/jetty/jetty.project/pull/9715 - https://githu
tlab.eclipse.org/security/cve-assignement/-/issues/24 - https://github.com/jetty/jetty.project/pull/9715 - https://github.com/jetty/jetty.project/pull/9716 - https://github.com/jetty/jetty.project/pull/10756 - https://github.com/jetty/jetty.project/pull/10755
CVE ID: CVE-2024-6763 State: PUBLISHED Published: 2024-10-14T15:06:07.298Z Last Updated: 2025-03-07T00:10:46.301Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Eclipse Foundation Products: Jetty Problem Types: CWE-1286 Description: Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing. The HttpURI class does insufficient validation on the authority segment of a URI. However the behaviour of HttpURI differs from the common browsers in how it handles a URI that would be considered invalid if fully validated against the RRC. Specifically HttpURI and the browser may di
s a URI that would be considered invalid if fully validated against the RRC. Specifically HttpURI and the browser may differ on the value of the host extracted from an invalid URI and thus a combination of Jetty and a vulnerable browser may be vulnerable to a open redirect attack or to a SSRF attack if the URI is used after passing validation checks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/jetty/jetty.project/security/advisories/GHSA-qh8g-58pp-2wxh - https://gitlab.eclipse.org/security/cve-assignement/-/issues/25 - https://github.com/jetty/jetty.project/pull/12012
CVE ID: CVE-2024-6765 State: REJECTED Published: N/A Last Updated: 2024-07-17T13:53:16.438Z Description: No description available.
CVE ID: CVE-2024-6766 State: PUBLISHED Published: 2024-08-06T06:00:06.735Z Last Updated: 2024-08-06T13:29:57.531Z Vendors: Unknown Products: shortcodes-ultimate-pro Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The shortcodes-ultimate-pro WordPress plugin before 7.2.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/77bb1dcf-4e84-497a-955e-f3c0b649ad1c/
CVE ID: CVE-2024-6767 State: PUBLISHED Published: 2024-08-21T05:30:20.146Z Last Updated: 2024-08-21T13:32:54.383Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: sersis Products: WordSurvey Problem Types: CWE-79 Description: The WordSurvey plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘sounding_title’ parameter in all versions up to, and including, 3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site install
y web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/626dac34-6b25-42c9-8f7d-9899e4bcc039?source=cve - https://plugins.trac.wordpress.org/browser/wordsurvey/trunk/wordsurvey-add.php#L45 - https://wordpress.org/plugins/wordsurvey/#developers
CVE ID: CVE-2024-6768 State: PUBLISHED Published: 2024-08-12T18:29:30.770Z Last Updated: 2025-09-15T17:28:11.205Z Vendors: Microsoft Products: Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, Windows Server 2022 Problem Types: CWE-1284 Description: A Denial of Service in CLFS.sys in Microsoft Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, and Windows Server 2022 allows a malicious authenticated low-privilege user to cause a Blue Screen of Death via a forced call to the KeBugCheckEx function. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.fortra.com/security/advisories/research/fr-2024-001
CVE ID: CVE-2024-6769 State: PUBLISHED Published: 2024-09-26T20:18:38.460Z Last Updated: 2025-08-29T20:22:43.078Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Microsoft Products: Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, Windows Server 2022 Problem Types: CWE-426, CWE-427 Description: A DLL Hijacking caused by drive remapping combined with a poisoning of the activation cache in Microsoft Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, and Windows Server 2022 allows a malicious authenticated attacker to elevate from a medium integrity process to a high integrity process without the intervention of a UAC prompt. Add
ker to elevate from a medium integrity process to a high integrity process without the intervention of a UAC prompt. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.fortra.com/security/advisories/research/fr-2024-002
CVE ID: CVE-2024-6770 State: PUBLISHED Published: 2024-07-31T05:30:56.961Z Last Updated: 2024-07-31T14:15:01.038Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: vikasratudi Products: Lifetime free Drag & Drop Contact Form Builder for WordPress VForm Problem Types: CWE-79 Description: The Lifetime free Drag & Drop Contact Form Builder for WordPress VForm plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an i
e for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/61a63ba6-129a-4ce2-be40-89c2fa44a670?source=cve - https://wordpress.org/plugins/v-form/#developers - https://plugins.trac.wordpress.org/changeset/3128079/#file56 - https://plugins.trac.wordpress.org/changeset/3128079/#file58 - https://plugins.trac.wordpress.org/changeset/3128092/