Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-13087 State: PUBLISHED Published: 2025-06-06T15:53:04.614Z Last Updated: 2025-06-06T16:35:52.407Z Vendors: QNAP Systems Inc. Products: QuRouter Problem Types: CWE-78 Description: A command injection vulnerability has been reported to affect QHora. If an attacker gains local network access who have also gained an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following version: QuRouter 2.4.6.028 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-15
CVE ID: CVE-2024-13088 State: PUBLISHED Published: 2025-06-06T15:53:09.479Z Last Updated: 2025-06-06T16:35:46.679Z Vendors: QNAP Systems Inc. Products: QuRouter Problem Types: CWE-287 Description: An improper authentication vulnerability has been reported to affect QHora. If an attacker gains local network access, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: QuRouter 2.5.0.140 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-15
CVE ID: CVE-2024-13089 State: PUBLISHED Published: 2025-06-10T10:29:40.282Z Last Updated: 2025-06-10T14:29:34.746Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Nozomi Networks Products: Guardian, CMC Problem Types: CWE-78 Description: An OS command injection vulnerability within the update functionality may allow an authenticated administrator to execute unauthorized arbitrary OS commands. Users with administrative privileges may upload update packages to upgrade the versions of Nozomi Networks Guardian and CMC. While these updates are signed and their signatures are validated prior to installation, an improper signature validation check has been identified
ned and their signatures are validated prior to installation, an improper signature validation check has been identified. This issue could potentially enable users to execute commands remotely on the appliance, thereby impacting confidentiality, integrity, and availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.nozominetworks.com/NN-2025:1-01
CVE ID: CVE-2024-13090 State: PUBLISHED Published: 2025-06-10T10:31:02.099Z Last Updated: 2025-06-10T14:28:19.863Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Nozomi Networks Products: Guardian, CMC Problem Types: CWE-250 Description: A privilege escalation vulnerability may enable a service account to elevate its privileges. The sudo rules configured for a local service account were excessively permissive, potentially allowing administrative access if a malicious actor could execute arbitrary commands as that account. It is important to note that no such vector has been identified in this instance. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
te that no such vector has been identified in this instance. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.nozominetworks.com/NN-2025:2-01
CVE ID: CVE-2024-13091 State: PUBLISHED Published: 2025-01-21T23:20:51.231Z Last Updated: 2025-01-22T18:41:37.557Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: QuantumCloud Products: WPBot Pro Wordpress Chatbot Problem Types: CWE-434 Description: The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'qcld_wpcfb_file_upload' function in all versions up to, and including, 13.5.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The exploit requires thee ChatBot Co
on the affected site's server which may make remote code execution possible. Note: The exploit requires thee ChatBot Conversational Forms plugin and the Conversational Form Builder Pro addon plugin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0f9b6979-2662-4d2f-9656-b880dd80832c?source=cve - https://www.wpbot.pro/
CVE ID: CVE-2024-13092 State: PUBLISHED Published: 2025-01-02T08:31:05.202Z Last Updated: 2025-01-06T20:24:46.965Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Job Recruitment Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in code-projects Job Recruitment 1.0. This vulnerability affects unknown code of the file /_parse/_call_job/search_ajax.php of the component Job Post Handler. The manipulation of the argument n leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://v
been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289900 - https://vuldb.com/?ctiid.289900 - https://vuldb.com/?submit.472441 - https://github.com/UnrealdDei/cve/blob/main/sql9.md - https://code-projects.org/
CVE ID: CVE-2024-13093 State: PUBLISHED Published: 2025-01-02T09:00:07.054Z Last Updated: 2025-01-09T08:20:35.427Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Job Recruitment Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in code-projects Job Recruitment 1.0. This issue affects some unknown processing of the file /_parse/_call_main_search_ajax.php of the component Seeker Profile Handler. The manipulation of the argument s1 leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichm
d remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289901 - https://vuldb.com/?ctiid.289901 - https://vuldb.com/?submit.472442 - https://github.com/UnrealdDei/cve/blob/main/sql10.md - https://code-projects.org/
CVE ID: CVE-2024-13094 State: PUBLISHED Published: 2025-01-27T06:00:10.933Z Last Updated: 2025-01-27T19:38:57.876Z Vendors: Unknown Products: WP Triggers Lite Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Triggers Lite WordPress plugin through 2.5.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7a75809e-824e-458e-bd01-50dadcea7713/
CVE ID: CVE-2024-13095 State: PUBLISHED Published: 2025-01-27T06:00:11.280Z Last Updated: 2025-01-28T20:33:45.787Z Vendors: Unknown Products: WP Triggers Lite Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Triggers Lite WordPress plugin through 2.5.3 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/74e95fb5-025b-4d4d-a279-844b6ee3e57d/
CVE ID: CVE-2024-13096 State: PUBLISHED Published: 2025-02-01T06:00:11.746Z Last Updated: 2025-02-04T20:48:51.013Z Vendors: Unknown Products: WP Finance Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP Finance WordPress plugin through 1.3.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ca65c478-30bf-4109-93e0-3aedbf4a8264/
CVE ID: CVE-2024-13097 State: PUBLISHED Published: 2025-02-01T06:00:13.224Z Last Updated: 2025-02-04T20:51:11.005Z Vendors: Unknown Products: WP Finance Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Finance WordPress plugin through 1.3.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d83d7274-55ae-4f35-b65e-6d6e19e36fac/
CVE ID: CVE-2024-13098 State: PUBLISHED Published: 2025-02-01T06:00:13.542Z Last Updated: 2025-02-04T20:53:08.692Z Vendors: Unknown Products: WordPress Email Newsletter Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WordPress Email Newsletter WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/eac71f70-993e-4353-8550-affb24c61c02/
CVE ID: CVE-2024-13099 State: PUBLISHED Published: 2025-02-01T06:00:13.840Z Last Updated: 2025-02-04T20:54:22.885Z Vendors: Unknown Products: Widget4Call Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Widget4Call WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a0cabf5c-7b01-4163-834b-a134db3a90b4/
CVE ID: CVE-2024-13100 State: PUBLISHED Published: 2025-01-31T06:00:14.115Z Last Updated: 2025-01-31T16:26:45.429Z Vendors: Unknown Products: OPSI Israel Domestic Shipments Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The OPSI Israel Domestic Shipments WordPress plugin through 2.6.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b9261010-ab55-4d18-8fd2-2003f8692ae8/
CVE ID: CVE-2024-13101 State: PUBLISHED Published: 2025-01-31T06:00:14.631Z Last Updated: 2025-03-19T17:11:54.213Z Vendors: Unknown Products: WP MediaTagger Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP MediaTagger WordPress plugin through 4.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/03f51b54-0ec2-40ce-a0fa-ef0c4ab0ea99/
CVE ID: CVE-2024-13102 State: PUBLISHED Published: 2025-01-02T09:31:05.191Z Last Updated: 2025-01-02T17:36:58.970Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: D-Link Products: DIR-816 A2 Problem Types: CWE-284, CWE-266 Description: A vulnerability classified as critical was found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210. This vulnerability affects unknown code of the file /goform/DDNS of the component DDNS Service. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.2
to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289918 - https://vuldb.com/?ctiid.289918 - https://vuldb.com/?submit.472074 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Unauthorized_Vulnerability/D-Link/DIR-816/DDNS.md - https://www.dlink.com/
CVE ID: CVE-2024-13103 State: PUBLISHED Published: 2025-01-02T10:00:19.082Z Last Updated: 2025-01-02T17:31:10.486Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: D-Link Products: DIR-816 A2 Problem Types: CWE-284, CWE-266 Description: A vulnerability, which was classified as critical, has been found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210. This issue affects some unknown processing of the file /goform/form2AddVrtsrv.cgi of the component Virtual Service Handler. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnri
ated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289919 - https://vuldb.com/?ctiid.289919 - https://vuldb.com/?submit.472075 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Unauthorized_Vulnerability/D-Link/DIR-816/form2AddVrtsrv.md - https://www.dlink.com/
CVE ID: CVE-2024-13104 State: PUBLISHED Published: 2025-01-02T10:31:05.831Z Last Updated: 2025-01-02T17:27:13.770Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: D-Link Products: DIR-816 A2 Problem Types: CWE-284, CWE-266 Description: A vulnerability, which was classified as critical, was found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210. Affected is an unknown function of the file /goform/form2AdvanceSetup.cgi of the component WiFi Settings Handler. The manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment:
motely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289920 - https://vuldb.com/?ctiid.289920 - https://vuldb.com/?submit.472076 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Unauthorized_Vulnerability/D-Link/DIR-816/form2AdvanceSetup.md - https://www.dlink.com/
CVE ID: CVE-2024-13105 State: PUBLISHED Published: 2025-01-02T11:00:15.898Z Last Updated: 2025-01-02T17:21:46.838Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: D-Link Products: DIR-816 A2 Problem Types: CWE-284, CWE-266 Description: A vulnerability has been found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /goform/form2Dhcpd.cgi of the component DHCPD Setting Handler. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnr
nched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289921 - https://vuldb.com/?ctiid.289921 - https://vuldb.com/?submit.472085 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Unauthorized_Vulnerability/D-Link/DIR-816/form2Dhcpd.md - https://www.dlink.com/
CVE ID: CVE-2024-13106 State: PUBLISHED Published: 2025-01-02T11:31:05.262Z Last Updated: 2025-01-02T17:20:25.291Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: D-Link Products: DIR-816 A2 Problem Types: CWE-284, CWE-266 Description: A vulnerability was found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210 and classified as critical. Affected by this issue is some unknown functionality of the file /goform/form2IPQoSTcAdd of the component IP QoS Handler. The manipulation leads to improper access controls. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
he exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289922 - https://vuldb.com/?ctiid.289922 - https://vuldb.com/?submit.472086 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Unauthorized_Vulnerability/D-Link/DIR-816/form2IPQoSTcAdd.md - https://www.dlink.com/
CVE ID: CVE-2024-13107 State: PUBLISHED Published: 2025-01-02T12:00:17.338Z Last Updated: 2025-01-02T17:18:39.749Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: D-Link Products: DIR-816 A2 Problem Types: CWE-284, CWE-266 Description: A vulnerability was found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210. It has been classified as critical. This affects an unknown part of the file /goform/form2LocalAclEditcfg.cgi of the component ACL Handler. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Refere
The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289923 - https://vuldb.com/?ctiid.289923 - https://vuldb.com/?submit.472087 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Unauthorized_Vulnerability/D-Link/DIR-816/form2LocalAclEditcfg.md - https://www.dlink.com/
CVE ID: CVE-2024-13108 State: PUBLISHED Published: 2025-01-02T12:31:05.759Z Last Updated: 2025-01-02T16:21:12.372Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: D-Link Products: DIR-816 A2 Problem Types: CWE-284, CWE-266 Description: A vulnerability was found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210. It has been declared as critical. This vulnerability affects unknown code of the file /goform/form2NetSniper.cgi. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289924
he public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289924 - https://vuldb.com/?ctiid.289924 - https://vuldb.com/?submit.472088 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Unauthorized_Vulnerability/D-Link/DIR-816/form2NetSniper.md - https://www.dlink.com/
CVE ID: CVE-2024-13109 State: PUBLISHED Published: 2025-01-02T13:00:15.272Z Last Updated: 2025-01-02T16:20:19.858Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Beijing Yunfan Internet Technology Products: Yunfan Learning Examination System Problem Types: CWE-285, CWE-266 Description: A vulnerability was found in Beijing Yunfan Internet Technology Yunfan Learning Examination System 1.9.2. It has been rated as critical. This issue affects some unknown processing of the file /doc.html. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes:
ttack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289925 - https://vuldb.com/?ctiid.289925 - https://vuldb.com/?submit.467695 - https://github.com/qiutiandefeng/yfexam-exam/issues/4 - https://github.com/qiutiandefeng/yfexam-exam/issues/4#issue-2754670219
CVE ID: CVE-2024-13110 State: PUBLISHED Published: 2025-01-02T13:31:05.521Z Last Updated: 2025-01-02T14:24:42.884Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Beijing Yunfan Internet Technology Products: Yunfan Learning Examination System Problem Types: CWE-200, CWE-284 Description: A vulnerability classified as problematic has been found in Beijing Yunfan Internet Technology Yunfan Learning Examination System 1.9.2. Affected is an unknown function of the file src/main/java/com/yf/exam/modules/paper/controller/PaperController.java， of the component Exam Answer Handler. The manipulation leads to information disclosure. It is possible to launch the attack
he component Exam Answer Handler. The manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289926 - https://vuldb.com/?ctiid.289926 - https://vuldb.com/?submit.467700 - https://github.com/qiutiandefeng/yfexam-exam/issues/5 - https://github.com/qiutiandefeng/yfexam-exam/issues/5#issue-2754675223
CVE ID: CVE-2024-13111 State: PUBLISHED Published: 2025-01-02T14:00:15.703Z Last Updated: 2025-01-02T16:19:03.479Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Beijing Yunfan Internet Technology Products: Yunfan Learning Examination System Problem Types: CWE-287 Description: A vulnerability classified as critical was found in Beijing Yunfan Internet Technology Yunfan Learning Examination System 1.9.2. Affected by this vulnerability is an unknown functionality of the file src/main/java/com/yf/exam/modules/sys/user/controller/SysUserControl of the component JWT Token Handler. The manipulation leads to improper authentication. The attack can be launched remo
l of the component JWT Token Handler. The manipulation leads to improper authentication. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289927 - https://vuldb.com/?ctiid.289927 - https://vuldb.com/?submit.467701 - https://github.com/qiutiandefeng/yfexam-exam/issues/6 - https://github.com/qiutiandefeng/yfexam-exam/issues/6#issue-2754680012
CVE ID: CVE-2024-13112 State: PUBLISHED Published: 2025-01-31T06:00:14.899Z Last Updated: 2025-03-13T14:35:59.438Z Vendors: Unknown Products: WP MediaTagger Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP MediaTagger WordPress plugin through 4.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/155df231-30ef-47bb-aa91-a7deb1779bd1/
CVE ID: CVE-2024-13113 State: PUBLISHED Published: 2025-02-26T06:00:07.971Z Last Updated: 2025-02-26T16:00:57.896Z Vendors: Unknown Products: Countdown Timer for Elementor Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Countdown Timer for Elementor WordPress plugin before 1.3.7 does not sanitise and escape some parameters when outputting them on the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ffc31d9d-d245-4c4b-992d-394a01798117/
CVE ID: CVE-2024-13114 State: PUBLISHED Published: 2025-02-04T06:00:02.307Z Last Updated: 2025-02-04T18:26:00.902Z Vendors: Unknown Products: WP Projects Portfolio with Client Testimonials Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Projects Portfolio with Client Testimonials WordPress plugin through 3.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0cecda12-590a-42a6-b10b-e0efe7fb3a3a/