Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-5984 State: PUBLISHED Published: 2024-06-14T01:31:05.486Z Last Updated: 2024-08-01T21:25:03.177Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: itsourcecode Products: Online Bookstore Problem Types: CWE-89 Description: A vulnerability was found in itsourcecode Online Bookstore 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file book.php. The manipulation of the argument bookisbn leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-268460. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Progra
sed. The identifier of this vulnerability is VDB-268460. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.268460 - https://vuldb.com/?ctiid.268460 - https://vuldb.com/?submit.356177 - https://github.com/LiuYongXiang-git/cve/issues/3
CVE ID: CVE-2024-5985 State: PUBLISHED Published: 2024-06-14T02:00:04.892Z Last Updated: 2024-08-08T14:06:30.340Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Best Online News Portal Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in SourceCodester Best Online News Portal 1.0. This affects an unknown part of the file /admin/index.php. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-268461 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Con
d may be used. The identifier VDB-268461 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.268461 - https://vuldb.com/?ctiid.268461 - https://vuldb.com/?submit.356239 - https://github.com/CveSecLook/cve/issues/45
CVE ID: CVE-2024-5987 State: PUBLISHED Published: 2024-08-29T05:30:57.345Z Last Updated: 2024-08-29T14:04:01.371Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: vol4ikman Products: WP Accessibility Helper (WAH) Problem Types: CWE-862 Description: The WP Accessibility Helper (WAH) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_contrast_variations' and 'save_empty_contrast_variations' functions in all versions up to, and including, 0.6.2.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to edit or delete contrast settings. Please note these iss
henticated attackers, with Subscriber-level access and above, to edit or delete contrast settings. Please note these issues were patched in 0.6.2.8, though it broke functionality and the vendor has not responded to our follow-ups. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d3beee75-0480-4504-a177-45f8cd32cf36?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3117664%40wp-accessibility-helper&new=3117664%40wp-accessibility-helper&sfp_email=&sfph_mail=
CVE ID: CVE-2024-5988 State: PUBLISHED Published: 2024-06-25T15:53:33.899Z Last Updated: 2025-08-27T20:42:59.382Z Vendors: Rockwell Automation Products: ThinManager® ThinServer™ Problem Types: CWE-20 Description: Due to an improper input validation, an unauthenticated threat actor can send a malicious message to invoke a local or remote executable and cause a remote code execution condition on the Rockwell Automation ThinManager® ThinServer™. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1677.html
CVE ID: CVE-2024-5989 State: PUBLISHED Published: 2024-06-25T16:01:39.103Z Last Updated: 2025-08-27T20:42:59.534Z Vendors: Rockwell Automation Products: ThinManager® ThinServer™ Problem Types: CWE-20 Description: Due to an improper input validation, an unauthenticated threat actor can send a malicious message to invoke SQL injection into the program and cause a remote code execution condition on the Rockwell Automation ThinManager® ThinServer™. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1677.html
CVE ID: CVE-2024-5990 State: PUBLISHED Published: 2024-06-25T16:11:01.407Z Last Updated: 2025-08-27T20:42:59.671Z Vendors: Rockwell Automation Products: ThinManager® ThinServer™ Problem Types: CWE-20 Description: Due to an improper input validation, an unauthenticated threat actor can send a malicious message to a monitor thread within Rockwell Automation ThinServer™ and cause a denial-of-service condition on the affected device. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1677.html
CVE ID: CVE-2024-5991 State: PUBLISHED Published: 2024-08-27T18:33:27.550Z Last Updated: 2024-08-27T20:06:24.558Z Vendors: wolfSSL Products: wolfSSL Problem Types: CWE-125 Description: In function MatchDomainName(), input param str is treated as a NULL terminated string despite being user provided and unchecked. Specifically, the function X509_check_host() takes in a pointer and length to check against, with no requirements that it be NULL terminated. If a caller was attempting to do a name check on a non-NULL terminated buffer, the code would read beyond the bounds of the input array until it found a NULL terminator.This issue affects wolfSSL: through 5.7.0. Additional Analyst Notes: - CISA
input array until it found a NULL terminator.This issue affects wolfSSL: through 5.7.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://https://github.com/wolfSSL/wolfssl/pull/7604
CVE ID: CVE-2024-5992 State: PUBLISHED Published: 2024-07-09T08:33:10.073Z Last Updated: 2024-08-01T21:25:03.186Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: cliengo Products: Cliengo – Chatbot Problem Types: CWE-862 Missing Authorization Description: The Cliengo – Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_chatbot_token' and 'update_chatbot_position' functions in all versions up to, and including, 3.0.1. This makes it possible for unauthenticated attackers to change chatbot settings, which can lead to unavailability or other changes to the chatbot. Additional Analyst N
ckers to change chatbot settings, which can lead to unavailability or other changes to the chatbot. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a7f0afe8-234a-4c3f-87c8-f3f23ac94fe3?source=cve - https://plugins.trac.wordpress.org/browser/cliengo/trunk/admin/class-cliengo-form.php#L80 - https://plugins.trac.wordpress.org/browser/cliengo/trunk/admin/class-cliengo-form.php#L99
CVE ID: CVE-2024-5993 State: PUBLISHED Published: 2024-07-09T08:33:01.165Z Last Updated: 2024-08-01T21:25:03.180Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: cliengo Products: Cliengo – Chatbot Problem Types: CWE-862 Missing Authorization Description: The Cliengo – Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_session' function in all versions up to, and including, 3.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the session token of the chatbot. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Con
above, to update the session token of the chatbot. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0a13e87d-51cd-43b0-a658-900a174738fc?source=cve - https://plugins.trac.wordpress.org/browser/cliengo/trunk/admin/class-cliengo-form.php#L109
CVE ID: CVE-2024-5994 State: PUBLISHED Published: 2024-06-14T06:53:28.623Z Last Updated: 2024-08-01T21:25:03.174Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpgmaps Products: WP Go Maps (formerly WP Google Maps) Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom JS option in versions up to, and including, 9.0.38. This makes it possible for authenticated attackers that have been explicitly granted permissions by an administrator, with contributor-level permissions and ab
d attackers that have been explicitly granted permissions by an administrator, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Version 9.0.39 adds a caution to make administrators aware of the possibility for abuse if permissions are granted to lower-level users. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dd0597d2-07ba-4fb4-bf73-95770f8c3d6b?source=cve - https://plugins.trac.wordpress.org/browser/wp-google-maps/trunk/html/settings-page.html.php#L538 - https://plugins.trac.wordpress.org/brow
ac.wordpress.org/browser/wp-google-maps/trunk/html/settings-page.html.php#L538 - https://plugins.trac.wordpress.org/browser/wp-google-maps/trunk/html/atlas-novus/settings-page.html.php#L442
CVE ID: CVE-2024-5995 State: PUBLISHED Published: 2024-06-14T07:18:32.904Z Last Updated: 2024-08-01T21:25:03.252Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Soar Cloud Products: HR Portal Problem Types: CWE-613 Description: The notification emails sent by Soar Cloud HR Portal contain a link with a embedded session. The expiration of the session is not properly configured, remaining valid for more than 7 days and can be reused. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-7871-fecf1-1.html - https://www.twcert.org.tw/en/cp-139-7872-1c8b4-2.html
CVE ID: CVE-2024-5996 State: REJECTED Published: 2024-06-14T08:22:11.671Z Last Updated: 2024-08-14T01:39:58.883Z Description: No description available.
CVE ID: CVE-2024-5997 State: PUBLISHED Published: 2024-07-18T21:32:36.184Z Last Updated: 2024-08-01T21:25:03.220Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: codexpert Products: Duplica – Duplicate Posts, Pages, Custom Posts or Users Problem Types: CWE-862 Description: The Duplica – Duplicate Posts, Pages, Custom Posts or Users plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the duplicate_user and duplicate_post functions in all versions up to, and including, 0.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create duplicates of users and posts/
t possible for authenticated attackers, with Subscriber-level access and above, to create duplicates of users and posts/pages. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/605fac87-e1e8-4354-a9d3-4440e54bc161?source=cve - https://plugins.trac.wordpress.org/browser/duplica/tags/0.6/src/AJAX.php#L32 - https://plugins.trac.wordpress.org/browser/duplica/tags/0.6/src/AJAX.php#L98
CVE ID: CVE-2024-5998 State: PUBLISHED Published: 2024-09-17T11:50:13.813Z Last Updated: 2024-09-17T13:34:15.648Z Severity: MEDIUM (CVSS 5.2 CVSS:3.0/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L) Vendors: langchain-ai Products: langchain-ai/langchain Problem Types: CWE-502 Description: A vulnerability in the FAISS.deserialize_from_bytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands via the os.system function. The issue affects the latest version of the product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/fa3a2753-57c3-4e08-a176-d7a3ffda28fe - https://github.co
CISA ADP Vulnrichment: References: - https://huntr.com/bounties/fa3a2753-57c3-4e08-a176-d7a3ffda28fe - https://github.com/langchain-ai/langchain/commit/604dfe2d99246b0c09f047c604f0c63eafba31e7
CVE ID: CVE-2024-6000 State: PUBLISHED Published: 2024-06-15T03:18:57.669Z Last Updated: 2024-08-01T21:25:03.182Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: FooEvents Products: FooEvents for WooCommerce Problem Types: CWE-285 Improper Authorization Description: The FooEvents for WooCommerce plugin for WordPress is vulnerable to unauthorized arbitrary file uploads due to an improper capability setting on the 'display_ticket_themes_page' function in versions up to, and including, 1.19.20. This makes it possible for authenticated attackers with contributor-level capabilities or above, to upload arbitrary files on the affected site's server which may make rem
with contributor-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible. This was partially patched in 1.19.20, and fully patched in 1.19.21. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1080810b-ec9a-44fb-b4da-49b28646a441?source=cve - https://help.fooevents.com/docs/topics/changelogs/fooevents-for-woocommerce/
CVE ID: CVE-2024-6001 State: PUBLISHED Published: 2024-12-16T17:04:18.384Z Last Updated: 2024-12-16T17:18:06.452Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: Accessories and Display Manager Problem Types: CWE-295 Description: An improper certificate validation vulnerability was reported in LADM that could allow a network attacker with the ability to redirect an update request to a remote server and execute code with elevated privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.lenovo.co/us/en/product_security/LEN-174319
CVE ID: CVE-2024-6002 State: REJECTED Published: N/A Last Updated: 2024-12-16T17:09:32.694Z Description: No description available.
CVE ID: CVE-2024-6003 State: PUBLISHED Published: 2024-06-14T21:31:04.146Z Last Updated: 2024-08-01T21:25:03.220Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Guangdong Baolun Electronics Products: IP Network Broadcasting Service Platform Problem Types: CWE-89 Description: A vulnerability was found in Guangdong Baolun Electronics IP Network Broadcasting Service Platform 2.0. It has been classified as critical. Affected is an unknown function of the file /api/v2/maps. The manipulation of the argument orderColumn leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerabilit
h the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-268692. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.268692 - https://vuldb.com/?ctiid.268692 - https://vuldb.com/?submit.350714 - https://github.com/chennuo17/cve
CVE ID: CVE-2024-6004 State: PUBLISHED Published: 2024-08-16T14:17:44.070Z Last Updated: 2025-08-21T15:28:23.380Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Lenovo Products: Printers Problem Types: CWE-770 Description: A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to deny printer connections until the system is rebooted. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://iknow.lenovo.com.cn/detail/422688
CVE ID: CVE-2024-6005 State: PUBLISHED Published: 2024-06-15T09:31:03.062Z Last Updated: 2025-07-17T06:04:10.334Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: ZKTeco Products: ZKBio CVSecurity V5000 Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in ZKTeco ZKBio CVSecurity V5000 4.1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Department Section. The manipulation of the argument Department Name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor explains, "that ZKBio Security V5000
remotely. The exploit has been disclosed to the public and may be used. The vendor explains, "that ZKBio Security V5000 has been withdrawn from the market and [is] recommended for upgrading to the ZKBio CVSecurity latest version." This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.268693 - https://vuldb.com/?ctiid.268693 - https://vuldb.com/?submit.351241
CVE ID: CVE-2024-6006 State: PUBLISHED Published: 2024-06-15T11:31:03.182Z Last Updated: 2025-07-17T06:04:12.109Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: ZKTeco Products: ZKBio CVSecurity V5000 Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in ZKTeco ZKBio CVSecurity V5000 4.1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Summer Schedule Handler. The manipulation of the argument Schedule Name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor explains, "that ZKBio Security V5000 has be
ly. The exploit has been disclosed to the public and may be used. The vendor explains, "that ZKBio Security V5000 has been withdrawn from the market and [is] recommended for upgrading to the ZKBio CVSecurity latest version." This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.268694 - https://vuldb.com/?ctiid.268694 - https://vuldb.com/?submit.351403
CVE ID: CVE-2024-6007 State: PUBLISHED Published: 2024-06-15T13:00:06.148Z Last Updated: 2024-08-01T21:25:03.178Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Netentsec Products: NS-ASG Application Security Gateway Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /protocol/iscgwtunnel/deleteiscgwrouteconf.php. The manipulation of the argument messagecontent leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-
y. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-268695. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.268695 - https://vuldb.com/?ctiid.268695 - https://vuldb.com/?submit.351902 - https://github.com/SecureF1sh/findings/blob/main/ns_sqli.md
CVE ID: CVE-2024-6008 State: PUBLISHED Published: 2024-06-15T15:00:04.271Z Last Updated: 2024-08-01T21:25:03.189Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: Online Book Store Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in itsourcecode Online Book Store up to 1.0. Affected is an unknown function of the file /edit_book.php. The manipulation of the argument image leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-268698 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment:
e used. VDB-268698 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.268698 - https://vuldb.com/?ctiid.268698 - https://vuldb.com/?submit.357143 - https://github.com/1902zdq/cve/issues/1
CVE ID: CVE-2024-6009 State: PUBLISHED Published: 2024-06-15T15:31:03.738Z Last Updated: 2024-08-01T21:25:03.184Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: Event Calendar Problem Types: CWE-89 Description: A vulnerability has been found in itsourcecode Event Calendar 1.0 and classified as critical. Affected by this vulnerability is the function regConfirm/regDelete of the file process.php. The manipulation of the argument userId leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-268699. Additional Analyst Notes: - CISA ADP Vu
and may be used. The associated identifier of this vulnerability is VDB-268699. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.268699 - https://vuldb.com/?ctiid.268699 - https://vuldb.com/?submit.357243 - https://github.com/AutoZhou1/cve/issues/1
CVE ID: CVE-2024-6010 State: PUBLISHED Published: 2024-09-07T11:17:06.172Z Last Updated: 2024-10-28T20:59:59.935Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: StylemixThemes Products: Cost Calculator Builder PRO Problem Types: CWE-472 Description: The Cost Calculator Builder PRO plugin for WordPress is vulnerable to price manipulation in all versions up to, and including, 3.2.1. This is due to the plugin allowing the price field to be manipulated prior to processing via the 'create_cc_order' function, called from the Cost Calculator Builder plugin. This makes it possible for unauthenticated attackers to manipulate the price of orders submitted via the cal
der plugin. This makes it possible for unauthenticated attackers to manipulate the price of orders submitted via the calculator. Note: this vulnerability was partially patched with the release of Cost Calculator Builder version 3.2.17. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fc04e676-e394-488e-a239-95af5f865613?source=cve - https://plugins.trac.wordpress.org/browser/cost-calculator-builder/trunk/frontend/dist/order.js - https://docs.stylemixthemes.com/cost-calculator-builder/changelog-1/changelog-pro-version - https://plugins.trac.wordpress.org/changeset/3172590/
CVE ID: CVE-2024-6011 State: PUBLISHED Published: 2024-07-02T09:32:09.622Z Last Updated: 2024-08-01T21:25:03.189Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: stylemix Products: Cost Calculator Builder Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Cost Calculator Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘textarea.description’ parameter in all versions up to, and including, 3.2.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inj