Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-12704 State: PUBLISHED Published: 2025-03-20T10:09:06.689Z Last Updated: 2025-10-15T12:50:18.666Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: run-llama Products: run-llama/llama_index Problem Types: CWE-835 Description: A vulnerability in the LangChainLLM class of the run-llama/llama_index repository, version v0.12.5, allows for a Denial of Service (DoS) attack. The stream_complete method executes the llm using a thread and retrieves the result via the get_response_gen method of the StreamingGeneratorCallbackHandler class. If the thread terminates abnormally before the _llm.predict is executed, there is no exception handling for this case,
. If the thread terminates abnormally before the _llm.predict is executed, there is no exception handling for this case, leading to an infinite loop in the get_response_gen function. This can be triggered by providing an input of an incorrect type, causing the thread to terminate and the process to continue running indefinitely. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/a0b638fd-21c6-4ba7-b381-6ab98472a02a - https://github.com/run-llama/llama_index/commit/d1ecfb77578d089cbe66728f18f635c09aa32a05
CVE ID: CVE-2024-12705 State: PUBLISHED Published: 2025-01-29T21:40:27.839Z Last Updated: 2025-02-07T17:02:44.473Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: BIND 9 Problem Types: CWE-770 Description: Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it with crafted valid or invalid HTTP/2 traffic. This issue affects BIND 9 versions 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, and 9.18.11-S1 through 9.18.32-S1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://kb.isc.org/docs/cve-2024-12705
CVE ID: CVE-2024-12706 State: PUBLISHED Published: 2025-04-28T17:59:56.359Z Last Updated: 2025-04-28T18:49:37.985Z Vendors: OpenText™ Products: Digital Asset Management. Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in OpenText™ Digital Asset Management. T he vulnerability could allow an authenticated user to run arbitrary SQL commands on the underlying database. This issue affects Digital Asset Management.: through 24.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.opentext.com/csm?id=ot_kb_unauthenticated&sysparm_article=KB0840263
CVE ID: CVE-2024-12708 State: PUBLISHED Published: 2025-01-30T06:00:10.821Z Last Updated: 2025-01-30T15:28:03.789Z Vendors: Unknown Products: Bulk Me Now! Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Bulk Me Now! WordPress plugin through 2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8f30a37e-b9d0-467b-a0e3-20dc0a9f2b61/
CVE ID: CVE-2024-12709 State: PUBLISHED Published: 2025-01-30T06:00:11.424Z Last Updated: 2025-01-30T15:26:36.949Z Vendors: Unknown Products: Bulk Me Now! Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The Bulk Me Now! WordPress plugin through 2.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d93056f1-1a6e-405f-a094-d4d270393f87/
CVE ID: CVE-2024-12710 State: PUBLISHED Published: 2024-12-24T04:22:44.268Z Last Updated: 2024-12-24T15:40:20.556Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: marcelismus Products: WP-Appbox Problem Types: CWE-79 Description: The WP-Appbox plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 4.5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes:
te if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/101451de-1ed4-4717-86c5-a41feafd4c7e?source=cve - https://plugins.trac.wordpress.org/changeset?old_path=/wp-appbox/tags/4.5.3&new_path=/wp-appbox/tags/4.5.4&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12711 State: PUBLISHED Published: 2025-01-07T11:11:11.944Z Last Updated: 2025-01-07T14:20:26.547Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: wpchill Products: RSVP and Event Management Problem Types: CWE-862 Description: The RSVP and Event Management plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX functions like bulk_delete_attendees() and bulk_delete_questions() in all versions up to, and including, 2.7.13. This makes it possible for unauthenticated attackers to delete questions and attendees and for authenticated users to update question menu orders. Additional Analyst Notes:
to delete questions and attendees and for authenticated users to update question menu orders. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d234212a-2019-477d-81d1-b2acc2321055?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3216473%40rsvp&new=3216473%40rsvp&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12712 State: PUBLISHED Published: 2025-01-08T09:18:35.684Z Last Updated: 2025-01-08T13:57:38.275Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: levelfourstorefront Products: Shopping Cart & eCommerce Store Problem Types: CWE-862 Description: The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the webhook function in all versions up to, and including, 5.7.8. This makes it possible for unauthenticated attackers to modify order statuses. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabili
ses. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/28a3f382-3801-4e98-9004-56c27a85f0a2?source=cve - https://plugins.trac.wordpress.org/changeset/3211285/wp-easycart/trunk/wpeasycart.php
CVE ID: CVE-2024-12713 State: PUBLISHED Published: 2025-01-08T03:18:10.248Z Last Updated: 2025-01-08T15:27:43.156Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: brainstormforce Products: SureForms – Drag and Drop Form Builder for WordPress Problem Types: CWE-862 Description: The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.2 via the handle_export_form() function due to a missing capability check. This makes it possible for unauthenticated attackers to export data from password protected, private, or draft posts that they should not have access to. A
ticated attackers to export data from password protected, private, or draft posts that they should not have access to. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/412d5fa7-08fc-402a-bcac-b2dff87de861?source=cve - https://plugins.trac.wordpress.org/changeset/3215338/sureforms/tags/1.2.3/inc/export.php
CVE ID: CVE-2024-12714 State: PUBLISHED Published: 2025-01-09T06:00:05.935Z Last Updated: 2025-01-09T15:18:50.514Z Vendors: Unknown Products: Backlink Monitoring Manager Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Backlink Monitoring Manager WordPress plugin through 0.1.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f7fb2aef-16ce-4ae7-927c-2ffbc45fbda5/
CVE ID: CVE-2024-12715 State: PUBLISHED Published: 2025-01-09T06:00:06.998Z Last Updated: 2025-01-09T15:15:59.047Z Vendors: Unknown Products: Asgard Security Scanner Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Asgard Security Scanner WordPress plugin through 0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e1456295-75ba-4dc2-9b1a-dc16a2000db2/
CVE ID: CVE-2024-12716 State: PUBLISHED Published: 2025-05-15T20:06:53.772Z Last Updated: 2025-05-20T19:32:33.083Z Vendors: Unknown Products: Simple Basic Contact Form Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Simple Basic Contact Form WordPress plugin before 20250114 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a9fa48f1-d7fd-4968-a122-937803f186a2/
CVE ID: CVE-2024-12717 State: PUBLISHED Published: 2025-01-09T06:00:07.297Z Last Updated: 2025-01-09T15:10:51.796Z Vendors: Unknown Products: Aklamator INfeed Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Aklamator INfeed WordPress plugin through 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5564926a-6b1d-43f4-8147-128472f6b93a/
CVE ID: CVE-2024-12718 State: PUBLISHED Published: 2025-06-03T12:59:10.908Z Last Updated: 2025-07-24T15:57:58.221Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Python Software Foundation Products: CPython Problem Types: CWE-22 Description: Allows modifying some file metadata (e.g. last modified) with filter="data" or file permissions (chmod) with filter="tar" of files outside the extraction directory. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters documentation
.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information. Only Python versions 3.12 or later are affected by these vulnerabilities, earlier versions don't include the extraction filter feature. Note that for Python 3.14 or later the default value of filter= changed from "no filtering" to `"data", so if you are relying on this new default behavior then your usage is also affected. Note that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already al
significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it's important to avoid installing source distributions with suspicious links. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/python/cpython/issues/135034 - https://github.com/python/cpython/pull/135037 - https://github.com/python/cpython/issues/127987 - https://mail.python.org/archives/list/security-announce@python.org/thread/MAXIJJCUUMCL7ATZNDVEGGHUMQMUUKLG/ - https://github.com/python/cpython/commit/3612d8f51741b11f36f8fb0494d79086bac93
hread/MAXIJJCUUMCL7ATZNDVEGGHUMQMUUKLG/ - https://github.com/python/cpython/commit/3612d8f51741b11f36f8fb0494d79086bac9390a - https://github.com/python/cpython/commit/9e0ac76d96cf80b49055f6d6b9a6763fb9215c2a - https://gist.github.com/sethmlarson/52398e33eff261329a0180ac1d54f42f - https://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951da - https://github.com/python/cpython/commit/28463dba112af719df1e8b0391c46787ad756dd9 - https://github.com/python/cpython/commit/4633f3f497b1ff70e4a35b6fe2c907cbe2d4cb2e - https://github.com/python/cpython/commit/9c1110ef6652687d7c55f590f909720eddde965a - https://github.com/python/cpython/commit/aa9eb5f757ceff461e6e996f12c89e5d9b583b01 -
ef6652687d7c55f590f909720eddde965a - https://github.com/python/cpython/commit/aa9eb5f757ceff461e6e996f12c89e5d9b583b01 - https://github.com/python/cpython/commit/dd8f187d0746da151e0025c51680979ac5b4cfb1
CVE ID: CVE-2024-12719 State: PUBLISHED Published: 2025-01-07T09:22:14.971Z Last Updated: 2025-01-07T16:11:34.092Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: nickboss Products: WordPress File Upload Problem Types: CWE-862 Description: The WordPress File Upload plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wfu_ajax_action_read_subfolders' function in all versions up to, and including, 4.24.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform limited path traversal to view directories and subdirectories in WordPress. Files cannot be viewed.
d above, to perform limited path traversal to view directories and subdirectories in WordPress. Files cannot be viewed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/314ae0f5-8a4e-4bf3-9fc9-49f5b036b99e?source=cve - https://plugins.trac.wordpress.org/browser/wp-file-upload/trunk/lib/wfu_ajaxactions.php#L849 - https://plugins.trac.wordpress.org/changeset/3217005/
CVE ID: CVE-2024-12720 State: PUBLISHED Published: 2025-03-20T10:11:15.586Z Last Updated: 2025-03-20T13:25:27.023Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: huggingface Products: huggingface/transformers Problem Types: CWE-1333 Description: A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file tokenization_nougat_fast.py. The vulnerability occurs in the post_process_single() function, where a regular expression processes specially crafted input. The issue stems from the regex exhibiting exponential time complexity under certain conditions, leading to excessive backt
e issue stems from the regex exhibiting exponential time complexity under certain conditions, leading to excessive backtracking. This can result in significantly high CPU usage and potential application downtime, effectively creating a Denial of Service (DoS) scenario. The affected version is v4.46.3 (latest). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/4bed1214-7835-4252-a853-22bbad891f98 - https://github.com/huggingface/transformers/commit/deac971c469bcbb182c2e52da0b82fb3bf54cccf
CVE ID: CVE-2024-12721 State: PUBLISHED Published: 2024-12-21T07:02:59.782Z Last Updated: 2024-12-28T00:50:48.179Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: webbuilder143 Products: Custom Product Tabs For WooCommerce Problem Types: CWE-502 Description: The Custom Product Tabs For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.4 via deserialization of untrusted input from the 'wb_custom_tabs' parameter. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain
level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3fdc6a04-ef39-498a-b739-f40d5d8af47e?source=cve - https://plugins.trac.wordpress.org/browser/wb-custom-product-tabs-for-woocommerce/trunk/includes/class-wb-custom-product-tabs-for-woocommerce.php#L366
CVE ID: CVE-2024-12722 State: PUBLISHED Published: 2025-05-15T20:06:53.961Z Last Updated: 2025-05-20T19:32:23.866Z Vendors: Unknown Products: Twitter Bootstrap Collapse aka Accordian Shortcode Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Twitter Bootstrap Collapse aka Accordian Shortcode WordPress plugin through 1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c3be5990-ca89-4ac4-b
. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c3be5990-ca89-4ac4-baae-49af55df9d57/
CVE ID: CVE-2024-12723 State: PUBLISHED Published: 2025-01-28T06:00:04.840Z Last Updated: 2025-01-28T15:15:18.941Z Vendors: Unknown Products: Infility Global Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Infility Global WordPress plugin through 2.9.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d9053b8b-c05c-42fd-913e-f85c799df807/
CVE ID: CVE-2024-12724 State: PUBLISHED Published: 2025-05-15T20:06:54.350Z Last Updated: 2025-05-20T19:32:13.047Z Vendors: Unknown Products: WP DeskLite Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP DeskLite WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/9dd3ffaa-9020-47a6-bf9a-7e1412b9e9d5/
CVE ID: CVE-2024-12725 State: PUBLISHED Published: 2025-05-15T20:06:54.556Z Last Updated: 2025-05-20T19:32:04.284Z Vendors: Unknown Products: Clasify Classified Listing Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Clasify Classified Listing WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a174c640-6994-4028-a8a3-c470d5612304/
CVE ID: CVE-2024-12726 State: PUBLISHED Published: 2025-05-15T20:06:54.762Z Last Updated: 2025-05-20T19:31:55.127Z Vendors: Unknown Products: ClipArt Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The ClipArt WordPress plugin through 0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/88d748fc-6c2f-4656-99c5-c00cbed9d7e0/
CVE ID: CVE-2024-12727 State: PUBLISHED Published: 2024-12-19T20:26:59.325Z Last Updated: 2024-12-21T04:55:59.875Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Sophos Products: Sophos Firewall Problem Types: CWE-89 Description: A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 (21.0.1) allows access to the reporting database and can lead to remote code execution if a specific configuration of Secure PDF eXchange (SPX) is enabled in combination with the firewall running in High Availability (HA) mode. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sophos.co
g in High Availability (HA) mode. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sophos.com/en-us/security-advisories/sophos-sa-20241219-sfos-rce
CVE ID: CVE-2024-12728 State: PUBLISHED Published: 2024-12-19T20:48:53.477Z Last Updated: 2024-12-21T04:55:57.132Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Sophos Products: Sophos Firewall Problem Types: CWE-1391 Description: A weak credentials vulnerability potentially allows privileged system access via SSH to Sophos Firewall older than version 20.0 MR3 (20.0.3). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sophos.com/en-us/security-advisories/sophos-sa-20241219-sfos-rce
CVE ID: CVE-2024-12729 State: PUBLISHED Published: 2024-12-19T20:58:52.187Z Last Updated: 2024-12-21T04:55:58.654Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Sophos Products: Sophos Firewall Problem Types: CWE-94 Description: A post-auth code injection vulnerability in the User Portal allows authenticated users to execute code remotely in Sophos Firewall older than version 21.0 MR1 (21.0.1). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sophos.com/en-us/security-advisories/sophos-sa-20241219-sfos-rce
CVE ID: CVE-2024-12731 State: PUBLISHED Published: 2025-01-09T06:00:08.319Z Last Updated: 2025-01-09T15:35:56.131Z Vendors: Unknown Products: Aklamator INfeed Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Aklamator INfeed WordPress plugin through 2.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e1c3754f-60e0-4a89-b4fc-89056dba3616/
CVE ID: CVE-2024-12732 State: PUBLISHED Published: 2025-05-15T20:06:54.967Z Last Updated: 2025-05-20T19:31:42.728Z Vendors: Unknown Products: AffiliateImporterEb Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The AffiliateImporterEb WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/bc46edd8-8d77-4567-873b-e9e90a01adcf/
CVE ID: CVE-2024-12733 State: PUBLISHED Published: 2025-05-15T20:06:55.176Z Last Updated: 2025-05-20T19:31:32.021Z Vendors: Unknown Products: AffiliateImporterEb Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The AffiliateImporterEb WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/61be935e-ecb4-45be-8553-65877dd42569/