Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-10609 State: PUBLISHED Published: 2024-11-01T01:00:10.104Z Last Updated: 2024-11-01T15:17:48.131Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: Tailoring Management System Project Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in itsourcecode Tailoring Management System Project 1.0. This affects an unknown part of the file typeadd.php. The manipulation of the argument sex leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.
d to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282621 - https://vuldb.com/?ctiid.282621 - https://vuldb.com/?submit.434841 - https://github.com/Lanxiy7th/lx_CVE_report-/issues/17 - https://itsourcecode.com/
CVE ID: CVE-2024-10610 State: PUBLISHED Published: 2024-11-01T01:31:06.563Z Last Updated: 2024-11-01T15:15:50.668Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: ESAFENET Products: CDG Problem Types: CWE-89 Description: A vulnerability has been found in ESAFENET CDG 5 and classified as critical. This vulnerability affects the function delProtocol of the file /com/esafenet/servlet/system/ProtocolService.java. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - C
used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282622 - https://vuldb.com/?ctiid.282622 - https://vuldb.com/?submit.431326 - https://flowus.cn/share/0099e10a-5242-4651-a85a-5e8f98abc533?code=G8A6P3
CVE ID: CVE-2024-10611 State: PUBLISHED Published: 2024-11-01T01:31:16.229Z Last Updated: 2024-11-01T15:14:03.865Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: ESAFENET Products: CDG Problem Types: CWE-89 Description: A vulnerability was found in ESAFENET CDG 5 and classified as critical. This issue affects the function delProtocol of the file /com/esafenet/servlet/system/PrintScreenListService.java. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA AD
The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282623 - https://vuldb.com/?ctiid.282623 - https://vuldb.com/?submit.431327 - https://flowus.cn/share/9967b626-9a33-42f9-b8d2-d001b2a0b24a?code=G8A6P3
CVE ID: CVE-2024-10612 State: PUBLISHED Published: 2024-11-01T02:00:10.894Z Last Updated: 2024-11-01T13:54:59.965Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: ESAFENET Products: CDG Problem Types: CWE-89 Description: A vulnerability was found in ESAFENET CDG 5. It has been classified as critical. Affected is the function removeHookInvalidCourse of the file /com/esafenet/servlet/system/HookInvalidCourseService.java. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional
public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282624 - https://vuldb.com/?ctiid.282624 - https://vuldb.com/?submit.431328 - https://flowus.cn/share/ba7e7981-c66b-4d04-8fed-6d26b6765fe7?code=G8A6P3
CVE ID: CVE-2024-10613 State: PUBLISHED Published: 2024-11-01T02:31:06.805Z Last Updated: 2024-11-01T13:51:55.604Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: ESAFENET Products: CDG Problem Types: CWE-89 Description: A vulnerability was found in ESAFENET CDG 5. It has been declared as critical. Affected by this vulnerability is the function delSystemEncryptPolicy of the file /com/esafenet/servlet/system/SystemEncryptPolicyService.java. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
osed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282625 - https://vuldb.com/?ctiid.282625 - https://vuldb.com/?submit.431329 - https://flowus.cn/share/b73c3e0f-21ff-4026-84ec-be60bcbd5bfc?code=G8A6P3
CVE ID: CVE-2024-10614 State: PUBLISHED Published: 2024-11-16T05:39:34.403Z Last Updated: 2024-11-16T15:08:46.889Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: ivole Products: Customer Reviews for WooCommerce Problem Types: CWE-862 Description: The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the cancel_import() function in all versions up to, and including, 5.61.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to cancel and import or check on the status. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://w
to cancel and import or check on the status. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e27224aa-56c4-49ab-b9b3-b431b38e126e?source=cve - https://plugins.trac.wordpress.org/changeset/3188169/customer-reviews-woocommerce/trunk/includes/import-export/class-cr-reviews-importer.php
CVE ID: CVE-2024-10615 State: PUBLISHED Published: 2024-11-01T02:31:08.336Z Last Updated: 2024-11-01T14:26:38.383Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Tongda Products: OA 2017 Problem Types: CWE-89 Description: A vulnerability was found in Tongda OA 2017 up to 11.10. It has been rated as critical. Affected by this issue is some unknown functionality of the file /general/approve_center/query/list/input_form/delete_data_attach.php. The manipulation of the argument RUN_ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb
disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282626 - https://vuldb.com/?ctiid.282626 - https://vuldb.com/?submit.433500 - https://github.com/LvZCh/td/issues/6
CVE ID: CVE-2024-10616 State: PUBLISHED Published: 2024-11-01T03:00:05.130Z Last Updated: 2024-11-01T14:25:08.412Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Tongda Products: OA Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in Tongda OA up to 11.9. This affects an unknown part of the file /pda/workflow/webSignSubmit.php. The manipulation of the argument saleId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282627 - https://vuldb.com/?ctiid.282627 - https://vuld
es: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282627 - https://vuldb.com/?ctiid.282627 - https://vuldb.com/?submit.433509 - https://github.com/LvZCh/td/issues/7
CVE ID: CVE-2024-10617 State: PUBLISHED Published: 2024-11-01T03:31:04.076Z Last Updated: 2024-11-01T14:23:45.357Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Tongda Products: OA Problem Types: CWE-89 Description: A vulnerability classified as critical was found in Tongda OA up to 11.10. This vulnerability affects unknown code of the file /pda/workflow/check_seal.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282628 - https://vuldb.com/?ctiid.282628 - https://vuldb.com/?sub
ADP Vulnrichment: References: - https://vuldb.com/?id.282628 - https://vuldb.com/?ctiid.282628 - https://vuldb.com/?submit.433510 - https://github.com/LvZCh/td/issues/8
CVE ID: CVE-2024-10618 State: PUBLISHED Published: 2024-11-01T03:31:05.587Z Last Updated: 2024-11-01T14:22:12.488Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Tongda Products: OA 2017 Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in Tongda OA 2017 up to 11.10. This issue affects some unknown processing of the file /pda/reportshop/record_detail.php. The manipulation of the argument repid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282629 - https://vuldb.com/
used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282629 - https://vuldb.com/?ctiid.282629 - https://vuldb.com/?submit.433513 - https://github.com/LvZCh/td/issues/9
CVE ID: CVE-2024-10619 State: PUBLISHED Published: 2024-11-01T04:00:06.490Z Last Updated: 2024-11-01T14:20:23.483Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Tongda Products: OA 2017 Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in Tongda OA 2017 up to 11.10. Affected is an unknown function of the file /pda/reportshop/next_detail.php. The manipulation of the argument repid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282630 - https://vuldb.com/?ctiid.282
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282630 - https://vuldb.com/?ctiid.282630 - https://vuldb.com/?submit.433514 - https://github.com/LvZCh/td/issues/10
CVE ID: CVE-2024-10620 State: PUBLISHED Published: 2024-11-01T04:31:03.775Z Last Updated: 2024-11-01T14:22:44.724Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: knightliao Products: Disconf Problem Types: CWE-287 Description: A vulnerability was found in knightliao Disconf 2.6.36. It has been classified as critical. This affects an unknown part of the file /api/config/list of the component Configuration Center. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.2
to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282633 - https://vuldb.com/?ctiid.282633 - https://vuldb.com/?submit.429927 - https://github.com/knightliao/disconf/issues/431 - https://github.com/knightliao/disconf/issues/431#issue-2607011340
CVE ID: CVE-2024-10621 State: PUBLISHED Published: 2024-11-08T05:31:13.132Z Last Updated: 2024-11-08T14:06:09.095Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: fullworks Products: Simple Shortcode for Google Maps Problem Types: CWE-80 Description: The Simple Shortcode for Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's pw_map shortcode in all versions up to, and including, 1.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will ex
authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/33146b95-d2c7-433d-a104-5762b251f8ec?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3181804%40simple-google-maps-short-code%2Ftrunk&old=3065630%40simple-google-maps-short-code%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-10623 State: PUBLISHED Published: 2024-11-21T04:24:26.556Z Last Updated: 2024-11-21T11:30:09.317Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: EngineThemes Products: ForumEngine Problem Types: CWE-79 Description: The ForumEngine theme for WordPress is vulnerable to Reflected Cross-Site Scripting via a URL in all versions up to, and including, 1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP V
n successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a8bfdf39-2387-4a6f-ab85-6756a1e67305?source=cve - https://www.enginethemes.com/
CVE ID: CVE-2024-10624 State: PUBLISHED Published: 2025-03-20T10:10:43.329Z Last Updated: 2025-10-15T12:50:09.419Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: gradio-app Products: gradio-app/gradio Problem Types: CWE-1333 Description: A Regular Expression Denial of Service (ReDoS) vulnerability exists in the gradio-app/gradio repository, affecting the gr.Datetime component. The affected version is git commit 98cbcae. The vulnerability arises from the use of a regular expression `^(?:\s*now\s*(?:-\s*(\d+)\s*([dmhs]))?)?\s*$` to process user input. In Python's default regex engine, this regular expression can take polynomial time to match certain crafted inp
r input. In Python's default regex engine, this regular expression can take polynomial time to match certain crafted inputs. An attacker can exploit this by sending a crafted HTTP request, causing the gradio process to consume 100% CPU and potentially leading to a Denial of Service (DoS) condition on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/e8d0b248-8feb-4c23-9ef9-be4d1e868374
CVE ID: CVE-2024-10625 State: PUBLISHED Published: 2024-11-09T03:18:14.929Z Last Updated: 2024-11-12T17:09:38.189Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: vanquish Products: WooCommerce Support Ticket System Problem Types: CWE-22 Description: The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_tmp_uploaded_file() function in all versions up to, and including, 17.7. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-c
bitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ddf1cecd-c630-498d-9aa0-3d0adeb73033?source=cve - https://codecanyon.net/item/woocommerce-support-ticket-system/17930050
CVE ID: CVE-2024-10626 State: PUBLISHED Published: 2024-11-09T03:18:15.453Z Last Updated: 2024-11-12T15:49:46.747Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: vanquish Products: WooCommerce Support Ticket System Problem Types: CWE-22 Description: The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_uploaded_file() function in all versions up to, and including, 17.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the righ
access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/eeb2c829-579f-41e2-ad5f-8e4fc125d980?source=cve - https://codecanyon.net/item/woocommerce-support-ticket-system/17930050
CVE ID: CVE-2024-10627 State: PUBLISHED Published: 2024-11-09T03:30:47.479Z Last Updated: 2024-11-12T17:08:10.263Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: vanquish Products: WooCommerce Support Ticket System Problem Types: CWE-434 Description: The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_manage_file_chunk_upload() function in all versions up to, and including, 17.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - C
bitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1ac218f6-0bfa-480c-9159-d75a027022ba?source=cve - https://codecanyon.net/item/woocommerce-support-ticket-system/17930050
CVE ID: CVE-2024-10628 State: PUBLISHED Published: 2025-01-26T05:24:14.930Z Last Updated: 2025-04-03T18:38:50.562Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: AYS Pro Plugins Products: Quiz Maker Business, Quiz Maker Developer, Quiz Maker Agency Problem Types: CWE-89 Description: The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including, 8.8.0 (Business), up to, and including, 21.8.0 (Developer), and up to, and including, 31.8.0 (Agency) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query
due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. NOTE: The three variations of this software (Business, Developer, and Agency) share the same plugin slug, so you may get an alert even if you are running the latest version of any of the pieces of software. In these cases it is safe to dismiss the notice once you've confirmed your site is on a patched version of the applicable software. Additional Analyst Notes: - CISA ADP Vulnrichment: Ref
med your site is on a patched version of the applicable software. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9bd873e5-fd65-48c3-a71d-aaf6d8372606?source=cve - https://ays-pro.com/wordpress/quiz-maker - https://ays-pro.com/changelog-for-quiz-maker-pro - https://abrahack.com/posts/quiz-maker-sqli/
CVE ID: CVE-2024-10629 State: PUBLISHED Published: 2024-11-13T02:02:36.558Z Last Updated: 2024-11-13T16:52:38.881Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: axelkeller Products: GPX Viewer Problem Types: CWE-862 Description: The GPX Viewer plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check and file type validation in the gpxv_file_upload() function in all versions up to, and including, 2.2.8. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes:
arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cfc6ff21-52f5-453f-bf97-881c39be1aeb?source=cve - https://plugins.trac.wordpress.org/browser/gpx-viewer/tags/2.2.9/gpx-viewer-admin.php#L144
CVE ID: CVE-2024-10630 State: PUBLISHED Published: 2025-01-14T16:49:45.799Z Last Updated: 2025-01-24T04:55:59.704Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Application Control Engine Problem Types: CWE-366 Description: A race condition in Ivanti Application Control Engine before version 10.14.4.0 allows a local authenticated attacker to bypass the application blocking functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Application-Control-Engine-CVE-2024-10630
CVE ID: CVE-2024-10631 State: PUBLISHED Published: 2025-05-15T20:06:44.791Z Last Updated: 2025-05-20T15:17:04.021Z Vendors: Unknown Products: Countdown Timer for WordPress Block Editor Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Countdown Timer for WordPress Block Editor WordPress plugin through 1.0.5 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b153fb5e-7df2-491b-b61b-6f90314c7b04/
CVE ID: CVE-2024-10632 State: PUBLISHED Published: 2025-05-15T20:06:45.033Z Last Updated: 2025-05-20T19:40:13.000Z Vendors: Unknown Products: Nokaut Offers Box Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Nokaut Offers Box WordPress plugin through 1.4.0 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/17afba70-f213-47f6-aea2-59288ca92549/
CVE ID: CVE-2024-10633 State: PUBLISHED Published: 2025-01-26T05:24:15.723Z Last Updated: 2025-01-27T15:02:49.886Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: AYS Pro Plugins Products: Quiz Maker Developer, Quiz Maker Agency, Quiz Maker Business Problem Types: CWE-95 Description: The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.8.0 (Business), up to, and including, 21.8.0 (Developer), and up to, and including, 31.8.0 (Agency). This is due to the software allowing users to execute an action that does not properly validate a value before running do_shor
s due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/eb81f83f-a0e7-46d9-b106-fe31f8ad3eb9?source=cve - https://ays-pro.com/wordpress/quiz-maker - https://ays-pro.com/changelog-for-quiz-maker-pro