Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
unauthenticated attackers to view form submissions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/eccea504-b8b9-46d3-b9fd-ae893528e521?source=cve - https://plugins.trac.wordpress.org/browser/all-contact-form-integration-for-elementor/trunk/includes/wp-ajax.php#L7 - https://plugins.trac.wordpress.org/browser/all-contact-form-integration-for-elementor/trunk/includes/wp-ajax.php#L147 - https://plugins.trac.wordpress.org/browser/all-contact-form-integration-for-elementor/trunk/includes/export_csv.php#L20
CVE ID: CVE-2024-6627 State: PUBLISHED Published: 2024-07-27T11:13:37.530Z Last Updated: 2024-08-01T21:41:04.236Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: thehappymonster Products: Happy Addons for Elementor Problem Types: CWE-79 Description: The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's PDF View widget in all versions up to, and including, 3.11.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute w
ticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5bfe0a05-6bf9-4acc-bf9d-05079c3b3664?source=cve - https://plugins.trac.wordpress.org/browser/happy-elementor-addons/trunk/widgets/pdf-view/widget.php#L587 - https://wordpress.org/plugins/happy-elementor-addons/#developers - https://plugins.trac.wordpress.org/changeset/3124446/
CVE ID: CVE-2024-6628 State: PUBLISHED Published: 2024-11-16T03:20:50.643Z Last Updated: 2024-11-16T15:12:43.750Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: cscode Products: EleForms – All In One Form Integration including DB for Elementor Problem Types: CWE-352 Description: The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.9.9.9. This is due to missing or incorrect nonce validation when deleting form submissions. This makes it possible for unauthenticated attackers to delete form submissions via a forged request granted they can
. This makes it possible for unauthenticated attackers to delete form submissions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c21f5461-9c1e-48ec-b15f-6a9be1e27b43?source=cve - https://wordpress.org/plugins/all-contact-form-integration-for-elementor/#developers
CVE ID: CVE-2024-6629 State: PUBLISHED Published: 2024-07-24T06:42:23.526Z Last Updated: 2024-08-01T21:41:04.255Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: plugins360 Products: All-in-One Video Gallery Problem Types: CWE-79 Description: The All-in-One Video Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Video shortcode in all versions up to, and including, 3.7.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a
tackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f6e6fda8-e998-4087-8a21-9edb2a0249c8?source=cve - https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/trunk/public/video.php#L74 - https://wordpress.org/plugins/all-in-one-video-gallery/#developers - https://plugins.trac.wordpress.org/changeset/3123171/ - https://plugins.trac.wordpress.org/changeset/3123171/all-in-one-video-gallery/trunk/public/video.php
CVE ID: CVE-2024-6630 State: REJECTED Published: N/A Last Updated: 2024-07-10T17:35:23.795Z Description: No description available.
CVE ID: CVE-2024-6631 State: PUBLISHED Published: 2024-08-24T02:32:20.287Z Last Updated: 2024-08-28T14:57:53.439Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N) Vendors: imagerecycle Products: ImageRecycle pdf & image compression Problem Types: CWE-862 Description: The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions in all versions up to, and including, 3.1.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform unauthorized actions, such as updating plugin settings. Additional Analyst Notes: - CISA A
access and above, to perform unauthorized actions, such as updating plugin settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f330bf36-0a39-40d6-a075-c87fdb9dc2da?source=cve - https://plugins.trac.wordpress.org/changeset/3119956/imagerecycle-pdf-image-compression/tags/3.1.15/class/class-image-otimizer.php
CVE ID: CVE-2024-6632 State: PUBLISHED Published: 2024-08-27T14:12:12.272Z Last Updated: 2024-08-29T03:55:31.502Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Fortra Products: FileCatalyst Workflow Problem Types: CWE-89 Description: A vulnerability exists in FileCatalyst Workflow whereby a field accessible to the super admin can be used to perform an SQL injection attack which can lead to a loss of confidentiality, integrity, and availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.fortra.com/security/advisories/product-security/fi-2024-010
CVE ID: CVE-2024-6633 State: PUBLISHED Published: 2024-08-27T14:11:24.527Z Last Updated: 2025-08-29T20:21:54.534Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Fortra Products: FileCatalyst Workflow Problem Types: CWE-200, CWE-798 Description: The default credentials for the setup HSQL database (HSQLDB) for FileCatalyst Workflow are published in a vendor knowledgebase article. Misuse of these credentials could lead to a compromise of confidentiality, integrity, or availability of the software. The HSQLDB is only included to facilitate installation, has been deprecated, and is not intended for production use per vendor guides. However, users who have not
nstallation, has been deprecated, and is not intended for production use per vendor guides. However, users who have not configured FileCatalyst Workflow to use an alternative database per recommendations are vulnerable to attack from any source that can reach the HSQLDB. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.fortra.com/security/advisories/product-security/fi-2024-011
CVE ID: CVE-2024-6634 State: PUBLISHED Published: 2024-07-27T01:51:06.817Z Last Updated: 2024-08-01T21:41:04.234Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wibergsweb Products: Master Currency WP Problem Types: CWE-79 Description: The Master Currency WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's currencyconverterform shortcode in all versions up to, and including, 1.1.61 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenev
ed attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fea71287-f92e-43e5-adbf-d89fce437e56?source=cve - https://wordpress.org/plugins/mastercurrency-wp/#developers
CVE ID: CVE-2024-6635 State: PUBLISHED Published: 2024-07-20T07:38:03.542Z Last Updated: 2024-08-01T21:41:04.272Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: WPWeb Products: WooCommerce - Social Login Problem Types: CWE-288 Description: The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.3. This is due to insufficient controls in the 'woo_slg_login_email' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, excluding an administrator, if they know the email of user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Progr
cluding an administrator, if they know the email of user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/37836722-eb25-4393-8cdf-91057642ba3f?source=cve - https://codecanyon.net/item/social-login-wordpress-woocommerce-plugin/8495883
CVE ID: CVE-2024-6636 State: PUBLISHED Published: 2024-07-20T07:38:04.704Z Last Updated: 2024-08-01T21:41:04.281Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: WPWeb Products: WooCommerce - Social Login Problem Types: CWE-862 Description: The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'woo_slg_login_email' function in all versions up to, and including, 2.7.3. This makes it possible for unauthenticated attackers to change the default role to Administrator while registering for an account. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Contain
Administrator while registering for an account. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/77ea4ba8-6c13-494a-92e3-12643003635b?source=cve - https://codecanyon.net/item/social-login-wordpress-woocommerce-plugin/8495883
CVE ID: CVE-2024-6637 State: PUBLISHED Published: 2024-07-20T07:37:52.405Z Last Updated: 2024-08-01T21:41:04.300Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: WPWeb Products: WooCommerce - Social Login Problem Types: CWE-305 Description: The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthenticated privilege escalation in all versions up to, and including, 2.7.3. This is due to a lack of brute force controls on a weak one-time password. This makes it possible for unauthenticated attackers to brute force the one-time password for any user, except an Administrator, if they know the email of user. Additional Analyst Notes: - CISA ADP Vul
password for any user, except an Administrator, if they know the email of user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/10d92d5e-1c23-4f6a-bfab-0756876190a5?source=cve - https://codecanyon.net/item/social-login-wordpress-woocommerce-plugin/8495883
CVE ID: CVE-2024-6638 State: PUBLISHED Published: 2024-07-22T19:55:23.548Z Last Updated: 2024-08-01T21:41:04.317Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: NI Products: LabVIEW Problem Types: CWE-190 Description: An integer overflow vulnerability due to improper input validation when reading TDMS files in LabVIEW may result in an infinite loop. Successful exploitation requires an attacker to provide a user with a specially crafted TDMS file. This vulnerability affects LabVIEW 2024 Q1 and prior versions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ni.com/en/support/security/available-critical-and
A ADP Vulnrichment: - CVE Program Container: References: - https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/integer-overflow-vulnerability-reading-tdms-files-in-labview.html
CVE ID: CVE-2024-6639 State: PUBLISHED Published: 2024-08-12T13:49:22.723Z Last Updated: 2024-08-12T15:08:23.678Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: AxtonYao Products: MDx Problem Types: CWE-79 Description: The MDx theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mdx_list_item' shortcode in all versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Add
ess and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/23ae17a6-a745-42c4-8627-ad1c41b66e0e?source=cve - https://github.com/yrccondor/mdx - https://github.com/yrccondor/mdx/commit/0906438824b8fab72715e7d5aec348aef0792721
CVE ID: CVE-2024-6640 State: PUBLISHED Published: 2024-08-11T02:33:42.590Z Last Updated: 2024-11-26T15:05:41.535Z Vendors: FreeBSD Products: FreeBSD Description: In ICMPv6 Neighbor Discovery (ND), the ID is always 0. When pf is configured to allow ND and block incoming Echo Requests, a crafted Echo Request packet after a Neighbor Solicitation (NS) can trigger an Echo Reply. The packet has to come from the same host as the NS and have a zero as identifier to match the state created by the Neighbor Discovery and allow replies to be generated. ICMPv6 packets with identifier value of zero bypass firewall rules written on the assumption that the incoming packets are going to create a state in the
lue of zero bypass firewall rules written on the assumption that the incoming packets are going to create a state in the state table. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.freebsd.org/advisories/FreeBSD-SA-24:05.pf.asc
CVE ID: CVE-2024-6641 State: PUBLISHED Published: 2024-09-18T05:31:13.844Z Last Updated: 2024-09-18T15:04:25.453Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: astrasecuritysuite Products: WP Hardening (discontinued) Problem Types: CWE-185 Description: The WP Hardening – Fix Your WordPress Security plugin for WordPress is vulnerable to Security Feature Bypass in all versions up to, and including, 1.2.6. This is due to use of an incorrect regular expression within the "Stop User Enumeration" feature. This makes it possible for unauthenticated attackers to bypass intended security restrictions and expose site usernames. Additional Analyst Notes: - CISA ADP V
ted attackers to bypass intended security restrictions and expose site usernames. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7a52a278-1729-4027-8a00-e9804fa6698b?source=cve - https://plugins.trac.wordpress.org/changeset/3151308/wp-security-hardening
CVE ID: CVE-2024-6642 State: REJECTED Published: N/A Last Updated: 2024-07-10T12:21:28.583789Z Description: No description available.
CVE ID: CVE-2024-6643 State: REJECTED Published: N/A Last Updated: 2024-07-11T09:35:09.770Z Description: No description available.
CVE ID: CVE-2024-6644 State: PUBLISHED Published: 2024-07-10T16:31:04.565Z Last Updated: 2024-08-01T21:41:04.313Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: zmops Products: ArgusDBM Problem Types: CWE-502 Description: A vulnerability was found in zmops ArgusDBM up to 0.1.0. It has been classified as critical. Affected is the function getDefaultClassLoader of the file CalculateAlarm.java of the component AviatorScript Handler. The manipulation leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-271050 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vul
c and may be used. VDB-271050 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.271050 - https://vuldb.com/?ctiid.271050 - https://vuldb.com/?submit.367347 - https://github.com/zmops/ArgusDBM/issues/64
CVE ID: CVE-2024-6645 State: PUBLISHED Published: 2024-07-10T17:00:05.966Z Last Updated: 2024-08-01T21:41:04.254Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: WuKongOpenSource Products: Wukong_nocode Problem Types: CWE-502 Description: A vulnerability was found in WuKongOpenSource Wukong_nocode up to 20230807. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file ExpressionUtil.java of the component AviatorScript Handler. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information abo
loit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The associated identifier of this vulnerability is VDB-271051. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.271051 - https://vuldb.com/?ctiid.271051 - https://vuldb.com/?submit.367349 - https://github.com/WuKongOpenSource/Wukong_nocode/issues/4
CVE ID: CVE-2024-6646 State: PUBLISHED Published: 2024-07-10T17:31:04.041Z Last Updated: 2024-08-01T21:41:04.277Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Netgear Products: WN604 Problem Types: CWE-200 Description: A vulnerability was found in Netgear WN604 up to 20240710. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /downloadFile.php of the component Web Interface. The manipulation of the argument file with the input config leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-
hed remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-271052. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.271052 - https://vuldb.com/?ctiid.271052 - https://vuldb.com/?submit.367382 - https://github.com/mikutool/vul/issues/1
CVE ID: CVE-2024-6647 State: PUBLISHED Published: 2024-07-10T18:00:05.464Z Last Updated: 2024-08-01T21:41:04.321Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: n/a Products: Croogo Problem Types: CWE-434 Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in Croogo up to 4.0.7. This affects an unknown part of the file admin/settings/settings/prefix/Theme of the component Setting Handler. The manipulation of the argument Content-Type leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-271053 was assigned to this vulnerability.
exploit has been disclosed to the public and may be used. The identifier VDB-271053 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.271053 - https://vuldb.com/?ctiid.271053 - https://vuldb.com/?submit.372009 - https://github.com/DeepMountains/Mirage/blob/main/CVE-1.md
CVE ID: CVE-2024-6648 State: PUBLISHED Published: 2025-05-08T12:16:53.436Z Last Updated: 2025-05-08T13:11:48.054Z Vendors: Apollo Theme Products: AP Page Builder Problem Types: CWE-22 Description: Absolute Path Traversal vulnerability in AP Page Builder versions prior to 4.0.0 could allow an unauthenticated remote user to modify the 'product_item_path' within the 'config' JSON file, allowing them to read any file on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/path-traversal-ap-page-builder
CVE ID: CVE-2024-6649 State: PUBLISHED Published: 2024-07-10T18:31:03.571Z Last Updated: 2024-08-01T21:41:04.396Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: SourceCodester Products: Employee and Visitor Gate Pass Logging System Problem Types: CWE-352 Description: A vulnerability has been found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0 and classified as problematic. Affected by this vulnerability is the function save_users of the file Users.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-271057 was assigned to this vulnerabi
. The exploit has been disclosed to the public and may be used. The identifier VDB-271057 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.271057 - https://vuldb.com/?ctiid.271057 - https://vuldb.com/?submit.370663 - https://github.com/Xu-Mingming/cve/blob/main/csrf1.md
CVE ID: CVE-2024-6650 State: PUBLISHED Published: 2024-07-10T22:31:04.218Z Last Updated: 2024-08-01T21:41:04.261Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: SourceCodester Products: Employee and Visitor Gate Pass Logging System Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0 and classified as problematic. Affected by this issue is the function save_designation of the file /classes/Master.php. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-271058 is the identifier assigned to this vulnerabilit
The exploit has been disclosed to the public and may be used. VDB-271058 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.271058 - https://vuldb.com/?ctiid.271058 - https://vuldb.com/?submit.370664 - https://github.com/Xu-Mingming/cve/blob/main/xss1.md
CVE ID: CVE-2024-6651 State: PUBLISHED Published: 2024-08-06T06:00:02.684Z Last Updated: 2024-08-06T14:52:56.919Z Vendors: Unknown Products: WordPress File Upload Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WordPress File Upload WordPress plugin before 4.24.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/65e2c77d-09bd-4a44-81d9-d7a5db0e0f84/
CVE ID: CVE-2024-6652 State: PUBLISHED Published: 2024-07-10T23:00:06.798Z Last Updated: 2024-08-01T21:41:04.260Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: Gym Management System Problem Types: CWE-89 Description: A vulnerability was found in itsourcecode Gym Management System 1.0. It has been classified as critical. This affects an unknown part of the file manage_member.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-271059. Additional Analyst Notes: - CISA ADP Vulnrichme