Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
akes it possible for unauthenticated attackers to extract sensitive data including including usernames, email addresses, names, and more information about users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0d9817ff-ca56-4941-97bc-f26defe7ddd5?source=cve - https://plugins.trac.wordpress.org/changeset/3208874/directorist/tags/8.0.9/includes/rest-api/Version1/class-users-controller.php - https://plugins.trac.wordpress.org/changeset/3231156/directorist/tags/8.1/includes/rest-api/Version1/class-users-controller.php
CVE ID: CVE-2024-12042 State: PUBLISHED Published: 2024-12-13T08:24:50.600Z Last Updated: 2024-12-13T21:43:23.356Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: inspireui Products: MStore API – Create Native Android & iOS Apps On The Cloud Problem Types: CWE-434 Description: The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the profile picture upload functionality in all versions up to, and including, 4.16.4 due to insufficient file type validation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload HTML files with arbitrary
kes it possible for authenticated attackers, with subscriber-level access and above, to upload HTML files with arbitrary web scripts that will execute whenever a user accesses the file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/af468138-c10a-4f9b-b714-0425d52f0210?source=cve - https://plugins.trac.wordpress.org/browser/mstore-api/trunk/functions/index.php#790 - https://plugins.trac.wordpress.org/changeset/3205338/mstore-api/trunk/functions/index.php
CVE ID: CVE-2024-12043 State: PUBLISHED Published: 2025-01-23T11:13:27.032Z Last Updated: 2025-01-23T14:41:23.275Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bdthemes Products: Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Post Slider and Ecommerce Slider) Problem Types: CWE-79 Description: The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Post Slider and Ecommerce Slider) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'social_link_title' parameter of the 'blog' widget in all versions up to, and including, 3.16.5 due to insufficient input sanitization and output escaping.
e 'blog' widget in all versions up to, and including, 3.16.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/23e1fffa-9170-4bc2-ad7e-27708a08033b?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3222179%40bdthemes-prime-slider-lite&new=3222179%40bdthemes-prime-slider-lite&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12044 State: PUBLISHED Published: 2025-03-20T10:10:03.510Z Last Updated: 2025-03-20T14:36:03.940Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: open-mmlab Products: open-mmlab/mmdetection Problem Types: CWE-502 Description: A remote code execution vulnerability exists in open-mmlab/mmdetection version v3.3.0. The vulnerability is due to the use of the `pickle.loads()` function in the `all_reduce_dict()` distributed training API without proper sanitization. This allows an attacker to execute arbitrary code by broadcasting a malicious payload to the distributed training network. Additional Analyst Notes: - CISA ADP Vulnrichment: References
g a malicious payload to the distributed training network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/f7e4fc32-e167-49fb-9fc7-f092b9c27e8a
CVE ID: CVE-2024-12045 State: PUBLISHED Published: 2025-01-08T07:18:38.149Z Last Updated: 2025-01-08T14:18:59.260Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: wpdevteam Products: Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates Problem Types: CWE-79 Description: The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the maker title value of the Google Maps block in all versions up to, and including, 5.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level acce
nput sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b07f3ade-5f10-4621-99a2-18eeab993403?source=cve - https://plugins.trac.wordpress.org/changeset/3210374/essential-blocks/tags/5.1.1/src/blocks/google-map/src/marker.js
CVE ID: CVE-2024-12046 State: PUBLISHED Published: 2025-02-04T07:21:00.853Z Last Updated: 2025-02-04T15:23:00.994Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: nicheaddons Products: Medical Addon for Elementor Problem Types: CWE-639 Description: The Medical Addon for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.2 via the 'namedical_elementor_template' shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the content of draft, pending, and private posts. Additional Analyst
s, with Contributor-level access and above, to read the content of draft, pending, and private posts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d5f4c4ec-bdb5-4f27-8ee3-060de9b62502?source=cve - https://plugins.trac.wordpress.org/browser/medical-addon-for-elementor/trunk/elementor/lib/lib.php#L12 - https://plugins.trac.wordpress.org/browser/medical-addon-for-elementor/trunk/elementor/lib/lib.php#L24 - https://plugins.trac.wordpress.org/changeset/3230459/
CVE ID: CVE-2024-12047 State: PUBLISHED Published: 2025-01-04T07:24:22.599Z Last Updated: 2025-01-06T16:30:53.272Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: smartersite Products: WP Compress – Instant Performance & Speed Optimization Problem Types: CWE-79 Description: The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘custom_server’ parameter in all versions up to, and including, 6.30.03 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can succ
s makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/09c04863-a454-4f05-9403-aff39dbccd43?source=cve - https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/6.30.00/addons/cdn/cdn-rewrite.php#L459 - https://wordpress.org/plugins/wp-compress-image-optimizer/#developers - https://plugins.trac.wordpress.org/changeset/3213738/
CVE ID: CVE-2024-12048 State: PUBLISHED Published: 2025-03-20T10:11:27.726Z Last Updated: 2025-03-20T13:04:08.483Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: transformeroptimus Products: transformeroptimus/superagi Problem Types: CWE-304 Description: An IDOR (Insecure Direct Object Reference) vulnerability exists in transformeroptimus/superagi version v0.0.14. The application fails to properly check authorization for multiple API endpoints, allowing attackers to view, edit, and delete other users' information without proper authorization. Affected endpoints include but are not limited to /get/project/{project_id}, /get/schedule_data/{agent_id}, /delete/{a
. Affected endpoints include but are not limited to /get/project/{project_id}, /get/schedule_data/{agent_id}, /delete/{agent_id}, /get/organisation/{organisation_id}, and /get/user/{user_id}. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/6def3e3a-c443-44bb-b20e-3e69b48f37dc
CVE ID: CVE-2024-12049 State: PUBLISHED Published: 2025-01-07T04:21:54.778Z Last Updated: 2025-01-07T16:26:28.780Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: bandido Products: Woo Ukrposhta Problem Types: CWE-79 Description: The Woo Ukrposhta plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'order', 'post', and 'idd' parameters in all versions up to, and including, 1.17.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link
scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0e549e4c-9f2e-40a4-9b07-7edb34bc0c9f?source=cve - https://plugins.trac.wordpress.org/browser/woo-ukrposhta/trunk/admin/partials/edit-international.php#L71 - https://plugins.trac.wordpress.org/browser/woo-ukrposhta/trunk/admin/partials/edit.php#L43 - https://plugins.trac.wordpress.org/browser/woo-ukrposhta/trunk/admin/partials/morkvaup-plugin-invoices-page.php#L29 - https://wordpress.org/plugins/woo-ukrposhta/#developers
CVE ID: CVE-2024-12053 State: PUBLISHED Published: 2024-12-03T18:50:34.119Z Last Updated: 2024-12-06T04:55:22.377Z Vendors: Google Products: Chrome Problem Types: CWE-843 Description: Type Confusion in V8 in Google Chrome prior to 131.0.6778.108 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/379009132
CVE ID: CVE-2024-12054 State: PUBLISHED Published: 2025-02-13T22:08:03.541Z Last Updated: 2025-02-14T15:58:47.771Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H) Vendors: ZF Products: RSSPlus 2M Problem Types: CWE-305 Description: ZF Roll Stability Support Plus (RSSPlus) is vulnerable to an authentication bypass vulnerability targeting deterministic RSSPlus SecurityAccess service seeds, which may allow an attacker to remotely (proximal/adjacent with RF equipment or via pivot from J2497 telematics devices) call diagnostic functions intended for workshop or repair scenarios. This can impact system availability, potentially degrading performance or erasing software, ho
shop or repair scenarios. This can impact system availability, potentially degrading performance or erasing software, however the vehicle remains in a safe vehicle state. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-021-03 - https://nmfta.org/wp-content/media/2022/11/Actionable_Mitigations_Options_v9_DIST.pdf
CVE ID: CVE-2024-12055 State: PUBLISHED Published: 2025-03-20T10:08:47.923Z Last Updated: 2025-03-20T19:03:30.843Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ollama Products: ollama/ollama Problem Types: CWE-125 Description: A vulnerability in Ollama versions <=0.3.14 allows a malicious user to create a customized gguf model file that can be uploaded to the public Ollama server. When the server processes this malicious model, it crashes, leading to a Denial of Service (DoS) attack. The root cause of the issue is an out-of-bounds read in the gguf.go file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/7b111d55-8
the gguf.go file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/7b111d55-8215-4727-8807-c5ed4cf1bfbe
CVE ID: CVE-2024-12056 State: PUBLISHED Published: 2024-12-04T14:30:35.838Z Last Updated: 2024-12-04T15:00:50.503Z Vendors: arcinfo Products: PcVue Problem Types: CWE-358 Description: The Client secret is not checked when using the OAuth Password grant type. By exploiting this vulnerability, an attacker could connect to a web server using a client application not explicitly authorized as part of the OAuth deployment. Exploitation requires valid credentials and does not permit the attacker to bypass user privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.pcvue.com/security/security/#SB2024-4
CVE ID: CVE-2024-12057 State: PUBLISHED Published: 2024-12-09T19:08:15.527Z Last Updated: 2025-03-21T15:55:47.995Z Vendors: arcinfo Products: PcVue Problem Types: CWE-532 Description: User credentials (login & password) are inserted into log files when a user tries to authenticate using a version of a Web client that is not compatible with that of the PcVue Web back end. By exploiting this vulnerability, an attacker could retrieve the credentials of a user by accessing the Log File. Successful exploitation of this vulnerability could lead to unauthorized access to the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.pcvue.com/security/#SB2024-6
CVE ID: CVE-2024-12058 State: PUBLISHED Published: 2025-02-11T15:21:18.279Z Last Updated: 2025-02-11T15:35:20.850Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Ivanti Products: Connect Secure, Policy Secure Problem Types: CWE-73 Description: External control of a file name in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin privileges to read arbitrary files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/February-Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-and-Ivanti-Secure-Access-C
i.com/s/article/February-Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-and-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs
CVE ID: CVE-2024-12059 State: PUBLISHED Published: 2024-12-12T05:24:24.715Z Last Updated: 2024-12-12T15:45:55.699Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: elementinvader Products: ElementInvader Addons for Elementor Problem Types: CWE-639 Description: The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.1 via the eli_option_value shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract arbitrary options from the wp_options table. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
xtract arbitrary options from the wp_options table. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cf7ec469-70b7-4ec2-83df-c788c76730b4?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3203139%40elementinvader-addons-for-elementor&new=3203139%40elementinvader-addons-for-elementor&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12060 State: PUBLISHED Published: 2024-12-06T08:24:49.945Z Last Updated: 2024-12-06T14:18:26.966Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: francescosganga Products: WP Media Optimizer (.webp) Problem Types: CWE-79 Description: The WP Media Optimizer (.webp) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘wpmowebp-css-resources’ and 'wpmowebp-js-resources' parameters in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a
ble for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/183d1be9-4c05-4107-b039-3711034ef774?source=cve - https://plugins.trac.wordpress.org/browser/wp-media-optimizer-webp/trunk/wp-media-optimizer-webp.php#L229 - https://wordpress.org/plugins/wp-media-optimizer-webp/#developers
CVE ID: CVE-2024-12061 State: PUBLISHED Published: 2024-12-18T03:22:07.346Z Last Updated: 2024-12-18T16:33:59.336Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: nicheaddons Products: Events Addon for Elementor Problem Types: CWE-639 Description: The Events Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.3 via the naevents_elementor_template shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they shoul
ith Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f59d9d8a-467a-4920-963a-da45f1f4462f?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3208546%40events-addon-for-elementor&new=3208546%40events-addon-for-elementor&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12062 State: PUBLISHED Published: 2024-12-03T09:32:01.188Z Last Updated: 2024-12-03T11:23:41.338Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: nicheaddons Products: Charity Addon for Elementor Problem Types: CWE-639 Description: The Charity Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.3.2 via the 'nacharity_elementor_template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they
rs, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7ac68314-c704-4273-addc-4bc623659769?source=cve - https://plugins.trac.wordpress.org/browser/charity-addon-for-elementor/trunk/elementor/lib/lib.php#L12
CVE ID: CVE-2024-12063 State: PUBLISHED Published: 2025-03-20T10:11:34.263Z Last Updated: 2025-03-20T13:55:34.718Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: imartinez Products: imartinez/privategpt Problem Types: CWE-400 Description: A Denial of Service (DoS) vulnerability exists in the file upload feature of imartinez/privategpt version v0.6.2. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. An attacker can exploit this by sending a payload with an excessively large filename, causing the server to become overwhelmed and unavailable to legitimate users. Additional Analyst Notes: - CISA ADP Vuln
causing the server to become overwhelmed and unavailable to legitimate users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/7db0091f-cb53-4cde-aad7-7ce491dfd8d9
CVE ID: CVE-2024-12064 State: REJECTED Published: N/A Last Updated: 2024-12-05T21:26:36.063Z Description: No description available.
CVE ID: CVE-2024-12065 State: PUBLISHED Published: 2025-03-20T10:09:49.632Z Last Updated: 2025-10-15T12:49:29.847Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: haotian-liu Products: haotian-liu/llava Problem Types: CWE-22 Description: A local file inclusion vulnerability exists in haotian-liu/llava at commit c121f04. This vulnerability allows an attacker to access any file on the system by sending multiple crafted requests to the server. The issue is due to improper input validation in the gradio web UI component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/0594503c-038f-401c-9127-08be32bfd682
CVE ID: CVE-2024-12066 State: PUBLISHED Published: 2024-12-21T07:02:59.004Z Last Updated: 2024-12-28T00:51:02.451Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: smsaexpress Products: SMSA Shipping(official) Problem Types: CWE-73 Description: The SMSA Shipping(official) plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the smsa_delete_label() function in all versions up to, and including, 2.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (su
delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/29d72347-ba49-45c6-a964-2c75064ac866?source=cve - https://plugins.trac.wordpress.org/browser/smsa-shipping-official/trunk/smsa-express-shipping.php#L235
CVE ID: CVE-2024-12067 State: PUBLISHED Published: 2025-01-09T11:10:57.510Z Last Updated: 2025-01-09T14:49:37.771Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: wptravel Products: WP Travel – Ultimate Travel Booking System, Tour Management Engine Problem Types: CWE-89 Description: The WP Travel – Ultimate Travel Booking System, Tour Management Engine plugin for WordPress is vulnerable to SQL Injection via the 'booking_itinerary' parameter of the 'wptravel_get_booking_data' function in all versions up to, and including, 10.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes
ficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4e0f38db-84bb-4ba9-9068-40937e78010d?source=cve - https://plugins.trac.wordpress.org/browser/wp-travel/trunk/inc/helpers/helpers-stat.php#L14 - https://plugins.trac.wordpress.org/browser/wp-travel/trunk/inc/helpers/helpers-stat.php#L64 - https
lpers-stat.php#L14 - https://plugins.trac.wordpress.org/browser/wp-travel/trunk/inc/helpers/helpers-stat.php#L64 - https://plugins.trac.wordpress.org/browser/wp-travel/trunk/app/inc/admin/class-wptravel-admin-assets.php#L17 - https://plugins.trac.wordpress.org/browser/wp-travel/trunk/app/inc/admin/class-wptravel-admin-assets.php#L31