Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-10829 State: PUBLISHED Published: 2025-03-20T10:09:50.524Z Last Updated: 2025-10-15T12:50:11.331Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: eosphoros-ai Products: eosphoros-ai/db-gpt Problem Types: CWE-835 Description: A Denial of Service (DoS) vulnerability in the multipart request boundary processing mechanism of eosphoros-ai/db-gpt v0.6.0 allows unauthenticated attackers to cause excessive resource consumption. The server fails to handle excessive characters appended to the end of multipart boundaries, leading to an infinite loop and complete denial of service for all users. This vulnerability affects all endpoints processing multipar
infinite loop and complete denial of service for all users. This vulnerability affects all endpoints processing multipart/form-data requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/e3a4a0ad-a2e0-497f-a2e0-e3c0ec7c4de4
CVE ID: CVE-2024-10830 State: PUBLISHED Published: 2025-03-20T10:11:19.024Z Last Updated: 2025-03-20T14:28:18.389Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: eosphoros-ai Products: eosphoros-ai/db-gpt Problem Types: CWE-22 Description: A Path Traversal vulnerability exists in the eosphoros-ai/db-gpt version 0.6.0 at the API endpoint `/v1/resource/file/delete`. This vulnerability allows an attacker to delete any file on the server by manipulating the `file_key` parameter. The `file_key` parameter is not properly sanitized, enabling an attacker to specify arbitrary file paths. If the specified file exists, the application will delete it. Additional Analyst
acker to specify arbitrary file paths. If the specified file exists, the application will delete it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/26adf08a-9262-4d5a-a2ee-ce12ed919620
CVE ID: CVE-2024-10831 State: PUBLISHED Published: 2025-03-20T10:09:08.548Z Last Updated: 2025-03-20T18:57:41.633Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: eosphoros-ai Products: eosphoros-ai/db-gpt Problem Types: CWE-36 Description: In eosphoros-ai/db-gpt version 0.6.0, the endpoint for uploading files is vulnerable to absolute path traversal. This vulnerability allows an attacker to upload arbitrary files to arbitrary locations on the target server. The issue arises because the `file_key` and `doc_file.filename` parameters are user-controllable, enabling the construction of paths outside the intended directory. This can lead to overwriting essenti
er-controllable, enabling the construction of paths outside the intended directory. This can lead to overwriting essential system files, such as SSH keys, for further exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/5c34c39f-66d4-414c-ab6a-f7888a5d882a
CVE ID: CVE-2024-10832 State: PUBLISHED Published: 2024-12-04T02:40:24.613Z Last Updated: 2024-12-04T14:09:10.457Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: jooseposti Products: Posti Shipping Problem Types: CWE-352 Description: The Posti Shipping plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.10.3. This is due to missing or incorrect nonce validation on the generate_notices_html() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Add
a a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/079c77f1-3aab-4457-ad66-a2a2d9a55b2e?source=cve - https://plugins.trac.wordpress.org/browser/posti-shipping/tags/3.10.3/core/class-shipping-method.php#L87 - https://plugins.trac.wordpress.org/browser/posti-shipping/tags/3.10.3/core/class-shipping-method.php#L104 - https://wordpress.org/plugins/posti-shipping/#developers
CVE ID: CVE-2024-10833 State: PUBLISHED Published: 2025-03-20T10:10:15.995Z Last Updated: 2025-10-15T12:50:11.814Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: eosphoros-ai Products: eosphoros-ai/db-gpt Problem Types: CWE-36 Description: eosphoros-ai/db-gpt version 0.6.0 is vulnerable to an arbitrary file write through the knowledge API. The endpoint for uploading files as 'knowledge' is susceptible to absolute path traversal, allowing attackers to write files to arbitrary locations on the target server. This vulnerability arises because the 'doc_file.filename' parameter is user-controllable, enabling the construction of absolute paths. Additional Analy
se the 'doc_file.filename' parameter is user-controllable, enabling the construction of absolute paths. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/dc58e981-e325-4c11-b4e1-1095890fd15a
CVE ID: CVE-2024-10834 State: PUBLISHED Published: 2025-03-20T10:11:01.550Z Last Updated: 2025-03-20T18:14:08.060Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: eosphoros-ai Products: eosphoros-ai/db-gpt Problem Types: CWE-73 Description: eosphoros-ai/db-gpt version 0.6.0 contains a vulnerability in the RAG-knowledge endpoint that allows for arbitrary file write. The issue arises from the ability to pass an absolute path to a call to `os.path.join`, enabling an attacker to write files to arbitrary locations on the target server. This vulnerability can be exploited by setting the `doc_file.filename` to an absolute path, which can lead to overwriting syste
lnerability can be exploited by setting the `doc_file.filename` to an absolute path, which can lead to overwriting system files or creating new SSH-key entries. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/0d598508-151a-4050-9ccd-31bb82955e7a
CVE ID: CVE-2024-10835 State: PUBLISHED Published: 2025-03-20T10:09:31.809Z Last Updated: 2025-03-20T18:37:53.483Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: eosphoros-ai Products: eosphoros-ai/db-gpt Problem Types: CWE-89 Description: In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /api/v1/editor/sql/run` allows execution of arbitrary SQL queries without any access control. This vulnerability can be exploited by attackers to perform Arbitrary File Write using DuckDB SQL, enabling them to write arbitrary files to the victim's file system. This can potentially lead to Remote Code Execution (RCE). Additional Analyst Notes: - CISA ADP Vulnrichme
s file system. This can potentially lead to Remote Code Execution (RCE). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/e32fda74-ca83-431c-8de8-08274ba686c9
CVE ID: CVE-2024-10836 State: PUBLISHED Published: 2024-12-06T03:25:37.857Z Last Updated: 2024-12-06T14:18:27.659Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: themesdaddy Products: Flixita Problem Types: CWE-79 Description: The Flixita theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.0.82 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CIS
they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/131b5d57-2af1-4cc5-8b4e-019a050c3bb8?source=cve - https://themes.trac.wordpress.org/browser/flixita/1.0.76/core/customizer/customizer-notice/flixita-customizer-notify.php#L147 - https://themes.trac.wordpress.org/browser/flixita/1.0.76/core/customizer/customizer-notice/flixita-customizer-notify.php#L188 - https://wordpress.org/themes/flixita/ - https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=250697%40flixita%2F1.0.83&old=250119%40flixita%2F1.0.82
CVE ID: CVE-2024-10837 State: PUBLISHED Published: 2024-11-09T12:30:20.937Z Last Updated: 2024-11-09T15:28:14.891Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: phppoet Products: SysBasics Customize My Account for WooCommerce Problem Types: CWE-79 Description: The SysBasics Customize My Account for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in all versions up to, and including, 2.7.29 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into perf
nticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0ced1c79-97fe-4841-9a02-ffb9f336212a?source=cve - https://plugins.trac.wordpress.org/browser/customize-my-account-for-woocommerce/tags/2.7.19/phppoet-checkout-fields/include/admin/pcfme_admin_settings.php#L840 - https://wordpress.org/plugins/customize-my-account-for-woocommerce/#developers - https://plugins.trac.wordpress.org/changeset/3183607/
CVE ID: CVE-2024-10838 State: PUBLISHED Published: 2025-03-12T13:03:47.747Z Last Updated: 2025-03-12T13:34:12.621Z Vendors: Eclipse Foundation Products: Eclipse Cyclone DDS Problem Types: CWE-191 Description: An integer underflow during deserialization may allow any unauthenticated user to read out of bounds heap memory. This may result into secret data or pointers revealing the layout of the address space to be included into a deserialized data structure, which may potentially lead to thread crashes or cause denial of service conditions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/eclipse-cyclonedds/cyclonedds/security/advisories/GHSA-6jj6-w25p-jc42 -
P Vulnrichment: References: - https://github.com/eclipse-cyclonedds/cyclonedds/security/advisories/GHSA-6jj6-w25p-jc42 - https://github.com/eclipse-cyclonedds/cyclonedds/releases/tag/0.10.5 - https://gitlab.eclipse.org/security/cve-assignement/-/issues/46
CVE ID: CVE-2024-10839 State: PUBLISHED Published: 2024-11-08T10:58:19.228Z Last Updated: 2024-11-08T14:18:57.843Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: ManageEngine Products: SharePoint Manager Plus Problem Types: CWE-611 Description: Zohocorp ManageEngine SharePoint Manager Plus versions 4503 and prior are vulnerable to authenticated XML External Entity (XXE) in the Management option. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/sharepoint-management-reporting/advisory/CVE-2024-10839.html
CVE ID: CVE-2024-10840 State: PUBLISHED Published: 2024-11-05T13:00:06.352Z Last Updated: 2024-11-05T14:37:25.148Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: romadebrian Products: WEB-Sekolah Problem Types: CWE-79, CWE-74, CWE-707 Description: A vulnerability classified as problematic has been found in romadebrian WEB-Sekolah 1.0. Affected is an unknown function of the file /Admin/akun_edit.php of the component Backend. The manipulation of the argument kode leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.co
sclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283086 - https://vuldb.com/?ctiid.283086 - https://github.com/2537463005/a/blob/main/WEB-Sekolah%E5%90%8E%E5%8F%B0%E5%AD%98%E5%82%A8%E5%9E%8Bxss.md
CVE ID: CVE-2024-10841 State: PUBLISHED Published: 2024-11-05T14:00:07.860Z Last Updated: 2024-11-05T14:27:03.960Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: romadebrian Products: WEB-Sekolah Problem Types: CWE-89, CWE-74, CWE-707 Description: A vulnerability classified as critical was found in romadebrian WEB-Sekolah 1.0. Affected by this vulnerability is an unknown functionality of the file /Proses_Kirim.php of the component Mail Handler. The manipulation of the argument Name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA
en disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283087 - https://vuldb.com/?ctiid.283087 - https://github.com/2537463005/a/blob/main/WEB-Sekolah%E5%90%8E%E5%8F%B0%E5%AD%98%E5%82%A8%E5%9E%8Bxss.md
CVE ID: CVE-2024-10842 State: PUBLISHED Published: 2024-11-05T14:00:09.337Z Last Updated: 2024-11-05T16:23:05.167Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: romadebrian Products: WEB-Sekolah Problem Types: CWE-79, CWE-74, CWE-707 Description: A vulnerability, which was classified as problematic, has been found in romadebrian WEB-Sekolah 1.0. Affected by this issue is some unknown functionality of the file /Admin/Proses_Edit_Akun.php of the component Backend. The manipulation of the argument Username_Baru/Password leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA
may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283088 - https://vuldb.com/?ctiid.283088 - https://vuldb.com/?submit.429558 - https://github.com/2537463005/a/blob/main/WEB-Sekolah%E5%90%8E%E5%8F%B0%E5%AD%98%E5%82%A8%E5%9E%8Bxss.md
CVE ID: CVE-2024-10844 State: PUBLISHED Published: 2024-11-05T15:00:07.641Z Last Updated: 2024-11-05T19:35:53.210Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: 1000 Projects Products: Bookstore Management System Problem Types: CWE-89, CWE-74, CWE-707 Description: A vulnerability, which was classified as critical, was found in 1000 Projects Bookstore Management System 1.0. This affects an unknown part of the file search.php. The manipulation of the argument s leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.
d to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283089 - https://vuldb.com/?ctiid.283089 - https://vuldb.com/?submit.436969 - https://github.com/sbm-98/CVE/issues/1
CVE ID: CVE-2024-10845 State: PUBLISHED Published: 2024-11-05T15:00:09.525Z Last Updated: 2024-11-05T19:34:36.254Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: 1000 Projects Products: Bookstore Management System Problem Types: CWE-89, CWE-74, CWE-707 Description: A vulnerability has been found in 1000 Projects Bookstore Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file book_detail.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/
losed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283090 - https://vuldb.com/?ctiid.283090 - https://vuldb.com/?submit.436999 - https://github.com/hbuzs/CVE/issues/3
CVE ID: CVE-2024-10846 State: PUBLISHED Published: 2025-01-23T15:22:56.170Z Last Updated: 2025-04-25T23:02:53.505Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H) Vendors: compose-spec Products: compose-go Problem Types: CWE-20 Description: The compose-go library component in versions v2.10-v2.4.0 allows an authorized user who sends malicious YAML payloads to cause the compose-go to consume excessive amount of Memory and CPU cycles while parsing YAML, such as used by Docker Compose from versions v2.27.0 to v2.29.7 included Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/compose-spec/compose-go/security/advi
- CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/compose-spec/compose-go/security/advisories/GHSA-36gq-35j3-p9r9
CVE ID: CVE-2024-10847 State: PUBLISHED Published: 2025-01-30T13:42:08.547Z Last Updated: 2025-01-30T14:30:33.859Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: sellerthemes Products: Storely Problem Types: CWE-79 Description: The Storely theme for WordPress is vulnerable to Stored Cross-Site Scripting via a malicious display name in all versions up to, and including, 16.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA
rary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b3a3fe11-76cc-4304-91b7-b9bc61f0ff70?source=cve - https://wordpress.org/themes/storely/
CVE ID: CVE-2024-10848 State: PUBLISHED Published: 2024-12-05T09:23:06.193Z Last Updated: 2024-12-05T11:13:24.699Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: desertthemes Products: NewsMunch Problem Types: CWE-79 Description: The NewsMunch theme for WordPress is vulnerable to Stored Cross-Site Scripting via a malicious display name in all versions up to, and including, 1.0.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: -
arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1a2b0ff4-9471-4fd0-ac1a-ed5b7b4af4ff?source=cve - https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=250663%40newsmunch&new=250663%40newsmunch&sfp_email=&sfph_mail=
CVE ID: CVE-2024-10849 State: PUBLISHED Published: 2024-12-06T08:24:51.078Z Last Updated: 2024-12-06T14:18:26.736Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: desertthemes Products: NewsMash Problem Types: CWE-79 Description: The NewsMash theme for WordPress is vulnerable to Stored Cross-Site Scripting via a malicious display name in all versions up to, and including, 1.0.71 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - C
rbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3bb30dac-e0f3-43dd-a20d-9af6c7af3cb4?source=cve - https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=250662%40newsmash&new=250662%40newsmash&sfp_email=&sfph_mail=
CVE ID: CVE-2024-10850 State: PUBLISHED Published: 2024-11-13T02:02:33.161Z Last Updated: 2024-11-13T14:42:12.936Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: razorpay Products: Razorpay Payment Button Elementor Plugin Problem Types: CWE-79 Description: The Razorpay Payment Button Elementor Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performi
ated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9331aa66-2eee-4745-b286-fa6db3bd9f37?source=cve - https://plugins.trac.wordpress.org/browser/razorpay-payment-button-elementor/tags/1.2.5/includes/rzp-payment-buttons.php#L78
CVE ID: CVE-2024-10851 State: PUBLISHED Published: 2024-11-13T02:02:30.812Z Last Updated: 2024-11-13T14:43:32.063Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: razorpay Products: Razorpay Payment Button Plugin Problem Types: CWE-79 Description: The Razorpay Payment Button Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.4.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as
ject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5c0e8e63-2603-4ee4-88f5-e132f9bc7fae?source=cve - https://plugins.trac.wordpress.org/browser/razorpay-payment-button/tags/2.4.6/includes/rzp-payment-buttons.php#L78 - https://plugins.trac.wordpress.org/browser/razorpay-payment-button/tags/2.4.6/includes/rzp-subscription-buttons.php#L78
CVE ID: CVE-2024-10852 State: PUBLISHED Published: 2024-11-13T02:02:28.880Z Last Updated: 2024-11-13T16:55:35.389Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: northmule Products: Buy one click WooCommerce Problem Types: CWE-862 Description: The Buy one click WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the buy_one_click_export_options AJAX action in all versions up to, and including, 2.2.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export plugin settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wo
ss and above, to export plugin settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/230eb20c-2d0e-4056-b341-4c2db584b70a?source=cve - https://wordpress.org/plugins/buy-one-click-woocommerce/
CVE ID: CVE-2024-10853 State: PUBLISHED Published: 2024-11-13T02:02:34.824Z Last Updated: 2024-11-13T15:44:01.679Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: northmule Products: Buy one click WooCommerce Problem Types: CWE-862 Description: The Buy one click WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the removeorder AJAX action in all versions up to, and including, 2.2.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete Buy one click WooCommerce orders. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://