Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-2821 State: PUBLISHED Published: 2024-03-22T16:00:06.943Z Last Updated: 2025-08-27T20:58:09.984Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: n/a Products: DedeCMS Problem Types: CWE-352 Description: A vulnerability, which was classified as problematic, has been found in DedeCMS 5.7. Affected by this issue is some unknown functionality of the file /src/dede/friendlink_edit.php. The manipulation of the argument id leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257708. NOTE: The vendor was contacted early about this disclosure but d
ed. The identifier of this vulnerability is VDB-257708. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.257708 - https://vuldb.com/?ctiid.257708 - https://github.com/E1CHO/demo/blob/main/27.pdf
CVE ID: CVE-2024-2822 State: PUBLISHED Published: 2024-03-22T17:00:08.031Z Last Updated: 2025-08-27T20:58:33.386Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: n/a Products: DedeCMS Problem Types: CWE-352 Description: A vulnerability, which was classified as problematic, was found in DedeCMS 5.7. This affects an unknown part of the file /src/dede/vote_edit.php. The manipulation of the argument aid leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257709 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respon
257709 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.257709 - https://vuldb.com/?ctiid.257709 - https://github.com/E1CHO/demo/blob/main/29.pdf
CVE ID: CVE-2024-2823 State: PUBLISHED Published: 2024-03-22T17:00:09.635Z Last Updated: 2025-04-10T20:10:35.986Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: n/a Products: DedeCMS Problem Types: CWE-352 Description: A vulnerability has been found in DedeCMS 5.7 and classified as problematic. This vulnerability affects unknown code of the file /src/dede/mda_main.php. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-257710 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional
his vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.257710 - https://vuldb.com/?ctiid.257710 - https://github.com/lcg-22266/cms/blob/main/1.md
CVE ID: CVE-2024-2824 State: PUBLISHED Published: 2024-03-22T18:00:08.695Z Last Updated: 2024-08-01T20:47:22.904Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Matthias-Wandel Products: jhead Problem Types: CWE-122 Description: A vulnerability was found in Matthias-Wandel jhead 3.08 and classified as critical. This issue affects the function PrintFormatNumber of the file exif.c. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257711. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References
this vulnerability is VDB-257711. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.257711 - https://vuldb.com/?ctiid.257711 - https://github.com/Matthias-Wandel/jhead/issues/84 - https://github.com/Matthias-Wandel/jhead/files/14613084/poc.zip
CVE ID: CVE-2024-2825 State: PUBLISHED Published: 2024-03-22T18:31:08.472Z Last Updated: 2024-08-01T19:25:41.810Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: lakernote Products: EasyAdmin Problem Types: CWE-24 Description: A vulnerability classified as critical has been found in lakernote EasyAdmin up to 20240315. This affects an unknown part of the file /ureport/designer/saveReportFile. The manipulation of the argument file leads to path traversal: '../filedir'. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257715. Additional Analyst Notes: - CISA ADP Vulnr
d may be used. The associated identifier of this vulnerability is VDB-257715. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.257715 - https://vuldb.com/?ctiid.257715 - https://gitee.com/lakernote/easy-admin/issues/I98ZTA
CVE ID: CVE-2024-2826 State: PUBLISHED Published: 2024-03-22T19:00:09.857Z Last Updated: 2024-08-01T19:25:41.890Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: lakernote Products: EasyAdmin Problem Types: CWE-611 Description: A vulnerability classified as problematic was found in lakernote EasyAdmin up to 20240315. This vulnerability affects unknown code of the file /ureport/designer/saveReportFile. The manipulation leads to xml external entity reference. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257716. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Containe
dentifier of this vulnerability is VDB-257716. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.257716 - https://vuldb.com/?ctiid.257716 - https://gitee.com/lakernote/easy-admin/issues/I98ZTA
CVE ID: CVE-2024-2827 State: PUBLISHED Published: 2024-03-22T19:00:15.250Z Last Updated: 2024-08-01T19:25:41.875Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: lakernote Products: EasyAdmin Problem Types: CWE-918 Description: A vulnerability, which was classified as critical, has been found in lakernote EasyAdmin up to 20240315. This issue affects some unknown processing of the file /ureport/designer/saveReportFile. The manipulation leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257717 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichmen
be used. The identifier VDB-257717 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.257717 - https://vuldb.com/?ctiid.257717 - https://gitee.com/lakernote/easy-admin/issues/I98ZTA
CVE ID: CVE-2024-2828 State: PUBLISHED Published: 2024-03-22T19:31:11.240Z Last Updated: 2024-08-12T15:03:49.285Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: lakernote Products: EasyAdmin Problem Types: CWE-918 Description: A vulnerability, which was classified as critical, was found in lakernote EasyAdmin up to 20240315. Affected is the function thumbnail of the file src/main/java/com/laker/admin/module/sys/controller/IndexController.java. The manipulation of the argument url leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The patch is identified as 23165d8cb569048c531150f194fe
y. The exploit has been disclosed to the public and may be used. The patch is identified as 23165d8cb569048c531150f194fea39f8800b8d5. It is recommended to apply a patch to fix this issue. VDB-257718 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.257718 - https://vuldb.com/?ctiid.257718 - https://gitee.com/lakernote/easy-admin/issues/I98YSR - https://gitee.com/lakernote/easy-admin/commit/23165d8cb569048c531150f194fea39f8800b8d5
CVE ID: CVE-2024-2829 State: PUBLISHED Published: 2024-04-25T11:02:06.060Z Last Updated: 2025-11-20T04:12:19.477Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-1333 Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.5 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. A crafted wildcard filter in FileFinder may lead to a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/451456 - https://hackerone.com/repor
CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/451456 - https://hackerone.com/reports/2416728
CVE ID: CVE-2024-2830 State: PUBLISHED Published: 2024-04-04T02:32:39.462Z Last Updated: 2024-08-01T19:25:42.064Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: stevejburge Products: WordPress Tag and Category Manager – AI Autotagger Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WordPress Tag and Category Manager – AI Autotagger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'st_tag_cloud' shortcode in all versions up to, and including, 3.13.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it p
ncluding, 3.13.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0f537479-d5ec-46bb-a04e-2c33a2abc759?source=cve - https://plugins.trac.wordpress.org/browser/simple-tags/trunk/inc/class.client.php#L346 - https://plugins.trac.wordpress.org/browser/simple-tags/trunk/inc/class.client.php#L348 - https://plugins.trac.wor
L346 - https://plugins.trac.wordpress.org/browser/simple-tags/trunk/inc/class.client.php#L348 - https://plugins.trac.wordpress.org/changeset/3060746/simple-tags/trunk/inc/class.client.tagcloud.php
CVE ID: CVE-2024-2831 State: PUBLISHED Published: 2024-05-02T16:51:43.560Z Last Updated: 2024-08-01T19:25:42.162Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: kieranoshea Products: Calendar Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Calendar plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcodes in all versions up to, and including, 1.3.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor access or higher, to appen
the existing SQL query. This makes it possible for authenticated attackers, with contributor access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0886fa16-4292-4223-af01-9aa1f36490f7?source=cve - https://wordpress.org/plugins/calendar/
CVE ID: CVE-2024-2832 State: PUBLISHED Published: 2024-03-23T06:00:05.613Z Last Updated: 2024-08-01T19:25:41.995Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Campcodes Products: Online Shopping System Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in Campcodes Online Shopping System 1.0. This vulnerability affects unknown code of the file /offersmail.php. The manipulation of the argument email leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257752. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program
d. The identifier of this vulnerability is VDB-257752. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.257752 - https://vuldb.com/?ctiid.257752 - https://github.com/comeony/vuln_report/blob/main/Online%20Shopping%20System%20-%20vuln%201.pdf
CVE ID: CVE-2024-2833 State: PUBLISHED Published: 2024-04-18T09:33:17.890Z Last Updated: 2024-08-01T19:25:41.902Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: blueglassch Products: Jobs for WordPress Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The Jobs for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘job-search’ parameter in all versions up to, and including, 2.7.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can succ
s makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f6710f53-34fe-4549-9e1a-7826be74c912?source=cve - https://plugins.trac.wordpress.org/changeset/3064421/job-postings/trunk/include/shortcodes/class-job-search.php
CVE ID: CVE-2024-2834 State: PUBLISHED Published: 2024-04-08T12:22:49.221Z Last Updated: 2024-08-29T19:12:40.109Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: OpenText Products: ArcSight Management Center, ArcSight Platform Problem Types: CWE-79 Description: A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenText ArcSight Management Center and ArcSight Platform. The vulnerability could be remotely exploited. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://portal.microfocus.com/s/article/KM000028275
CVE ID: CVE-2024-2835 State: PUBLISHED Published: 2024-05-20T13:10:08.716Z Last Updated: 2024-08-01T19:25:41.903Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: OpenText Products: ArcSight Enterprise Security Manager, ArcSight Platform Problem Types: CWE-79 Description: A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenText ArcSight Enterprise Security Manager and ArcSight Platform. The vulnerability could be remotely exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://portal.microfocus.com/s/article/KM000029773
CVE ID: CVE-2024-2836 State: PUBLISHED Published: 2024-04-15T05:00:05.687Z Last Updated: 2024-08-01T19:25:42.038Z Vendors: Unknown Products: Social Share, Social Login and Social Comments Plugin Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.64 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/36f95b19-af74-4c56-9848-8ff270af4723/
CVE ID: CVE-2024-2837 State: PUBLISHED Published: 2024-04-26T05:00:03.453Z Last Updated: 2024-08-01T19:25:42.125Z Vendors: Unknown Products: WP Chat App Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Chat App WordPress plugin before 3.6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admins to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/91058c48-f262-4fcc-9390-472d59d61115/
CVE ID: CVE-2024-2838 State: PUBLISHED Published: 2024-04-27T03:33:35.892Z Last Updated: 2024-08-01T19:25:42.118Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpclever Products: WPC Composite Products for WooCommerce Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WPC Composite Products for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wooco_components[0][name]' parameter in all versions up to, and including, 7.2.7 due to insufficient input sanitization and output escaping and missing authorization on the ajax_save_components function. This
insufficient input sanitization and output escaping and missing authorization on the ajax_save_components function. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d3bea017-9fc3-4e14-97c4-5bb525650cde?source=cve - https://plugins.trac.wordpress.org/changeset/3069973/wpc-composite-products/trunk/includes/class-wooco.php
CVE ID: CVE-2024-2839 State: PUBLISHED Published: 2024-04-02T06:47:43.668Z Last Updated: 2024-08-01T19:25:42.137Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: extendthemes Products: Colibri Page Builder Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'colibri_post_title' shortcode in all versions up to, and including, 1.0.263 due to insufficient input sanitization and output escaping on user supplied attributes such as 'heading_type'. This makes it possible for authenticated att
ion and output escaping on user supplied attributes such as 'heading_type'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c9466e5f-d8eb-4de4-a1d2-e5ef15bf1e4e?source=cve - https://plugins.trac.wordpress.org/changeset/3061940/colibri-page-builder/trunk/extend-builder/shortcodes/blog/post-item.php
CVE ID: CVE-2024-2840 State: PUBLISHED Published: 2024-05-02T16:51:48.753Z Last Updated: 2024-08-01T19:25:42.140Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: webbistro Products: Enhanced Media Library Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Enhanced Media Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via media upload functionality in all versions up to, and including, 2.8.9 due to the plugin allowing 'dfxp' files to be uploaded. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scrip
d. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/15b30ecb-e3ce-4092-841b-3a1b2553596a?source=cve - https://plugins.trac.wordpress.org/changeset?old_path=/enhanced-media-library/tags/2.8.9&new_path=/enhanced-media-library/tags/2.8.10&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2841 State: PUBLISHED Published: 2024-03-29T04:31:34.185Z Last Updated: 2024-08-01T19:25:42.147Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themeisle Products: Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 2.6.5 due to insufficient input sanitization and output escaping on user supplied att
all versions up to, and including, 2.6.5 due to insufficient input sanitization and output escaping on user supplied attributes such as 'id'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/99e24496-0e3b-4bff-ba14-dc535be10633?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3059761%40otter-blocks&new=3059761%40otter-blocks&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2842 State: PUBLISHED Published: 2024-03-29T05:35:33.303Z Last Updated: 2024-08-01T19:25:42.143Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: loncar Products: Easy Appointments Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Easy Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ea_full_calendar' shortcode in all versions up to, and including, 3.11.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access
escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9e1514c8-3752-4d0a-87a3-3f245a7cb914?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3059359%40easy-appointments&new=3059359%40easy-appointments&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2843 State: PUBLISHED Published: 2024-08-01T06:00:03.997Z Last Updated: 2024-08-07T20:03:11.414Z Vendors: Unknown Products: WooCommerce Customers Manager Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some places, which could allow attackers to make logged in admin users delete users via CSRF attacks Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/fec4e077-4c4e-4618-bfe8-61fdba59b696/
CVE ID: CVE-2024-2844 State: PUBLISHED Published: 2024-03-29T05:35:33.762Z Last Updated: 2024-08-01T19:25:42.151Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: loncar Products: Easy Appointments Problem Types: CWE-862 Missing Authorization Description: The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to insufficient user validation on the ajax_cancel_appointment() function in all versions up to, and including, 3.11.18. This makes it possible for unauthenticated attackers to cancel other users orders. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfen