Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-262225 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.262225 - https://vuldb.com/?ctiid.262225 - https://vuldb.com/?submit.323586 - https://github.com/Sospiro014/zday1/blob/main/doctor_appointment_management_system_xss.md
CVE ID: CVE-2024-4294 State: PUBLISHED Published: 2024-04-27T22:31:05.029Z Last Updated: 2024-08-01T20:33:53.078Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: PHPGurukul Products: Doctor Appointment Management System Problem Types: CWE-99 Description: A vulnerability, which was classified as critical, has been found in PHPGurukul Doctor Appointment Management System 1.0. Affected by this issue is some unknown functionality of the file /doctor/view-appointment-detail.php. The manipulation of the argument editid leads to improper control of resource identifiers. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-262226 is the
s. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-262226 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.262226 - https://vuldb.com/?ctiid.262226 - https://vuldb.com/?submit.323597 - https://github.com/Sospiro014/zday1/blob/main/doctor_appointment_management_system_idor.md
CVE ID: CVE-2024-4295 State: PUBLISHED Published: 2024-06-05T05:33:05.595Z Last Updated: 2024-08-01T20:33:53.096Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: icegram Products: Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in all versions up to, and including, 5.7.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparatio
to, and including, 5.7.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/641123af-1ec6-4549-a58c-0a08b4678f45?source=cve - https://plugins.trac.wordpress.org/changeset/3090845/email-subscribers/trunk/lite/includes/db/class-es-db-lists-contacts.php
CVE ID: CVE-2024-4296 State: PUBLISHED Published: 2024-04-29T02:08:23.300Z Last Updated: 2025-07-14T02:15:08.879Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: HGiga Products: iSherlock 4.5, iSherlock 5.5 Problem Types: CWE-22 Description: The account management interface of HGiga iSherlock (including MailSherlock, SpamSherlock, AuditSherlock) fails to filter special characters in certain function parameters, allowing remote attackers with administrative privileges to exploit this vulnerability to download arbitrary system files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-77
al Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7765-49906-1.html
CVE ID: CVE-2024-4297 State: PUBLISHED Published: 2024-04-29T02:28:24.526Z Last Updated: 2025-07-14T02:17:55.601Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: HGiga Products: iSherlock 4.5, iSherlock 5.5 Problem Types: CWE-22 Description: The system configuration interface of HGiga iSherlock (including MailSherlock, SpamSherlock, AuditSherlock) fails to filter special characters in certain function parameters, allowing remote attackers with administrative privileges to exploit this vulnerability to download arbitrary system files. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-
onal Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-7767-ce3b4-1.html
CVE ID: CVE-2024-4298 State: PUBLISHED Published: 2024-04-29T02:39:04.580Z Last Updated: 2025-07-14T02:19:23.281Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: HGiga Products: iSherlock 4.5, iSherlock 5.5 Problem Types: CWE-78 Description: The email search interface of HGiga iSherlock (including MailSherlock, SpamSherock, AuditSherlock) fails to filter special characters in certain function parameters, allowing remote attackers with administrative privileges to exploit this vulnerability for Command Injection attacks, enabling execution of arbitrary system commands. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - htt
arbitrary system commands. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-7769-0773a-1.html - https://www.chtsecurity.com/news/4559fabd-43d1-4324-a0b3-f459a05c2290 - https://www.chtsecurity.com/news/f67fd9b5-cb7a-42e4-bcb7-cc1c73d1f851
CVE ID: CVE-2024-4299 State: PUBLISHED Published: 2024-04-29T03:15:18.038Z Last Updated: 2025-07-14T02:21:35.775Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: HGiga Products: iSherlock 4.5, iSherlock 5.5 Problem Types: CWE-78 Description: The system configuration interface of HGiga iSherlock (including MailSherlock, SpamSherock, AuditSherlock) fails to filter special characters in certain function parameters, allowing remote attackers with administrative privileges to exploit this vulnerability for Command Injection attacks, enabling execution of arbitrary system commands. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Reference
tion of arbitrary system commands. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-7771-36c50-1.html - https://www.chtsecurity.com/news/4559fabd-43d1-4324-a0b3-f459a05c2290 - https://www.chtsecurity.com/news/f67fd9b5-cb7a-42e4-bcb7-cc1c73d1f851
CVE ID: CVE-2024-4300 State: PUBLISHED Published: 2024-04-29T03:31:40.592Z Last Updated: 2024-08-01T20:33:53.219Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: E-WEBInformationCo. Products: FS-EZViewer(Web) Problem Types: CWE-200 Description: E-WEBInformationCo. FS-EZViewer(Web) exposes sensitive information in the service. A remote attacker can obtain the database configuration file path through the webpage source code without login. Accessing this path allows attacker to obtain the database credential with the highest privilege and database host IP address. With this information, attackers can connect to the database and perform actions such as adding,
tabase host IP address. With this information, attackers can connect to the database and perform actions such as adding, modifying, or deleting database contents. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-7774-fbd01-1.html
CVE ID: CVE-2024-4301 State: PUBLISHED Published: 2024-04-29T04:01:24.051Z Last Updated: 2024-08-01T20:33:53.191Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: N-Partner Products: N-Reporter firmware, N-Cloud firmware Problem Types: CWE-78 Description: N-Reporter and N-Cloud, products of the N-Partner, have an OS Command Injection vulnerability. Remote attackers with normal user privilege can execute arbitrary system commands by manipulating user inputs on a specific page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-7776-035ff-1.html
CVE ID: CVE-2024-4302 State: PUBLISHED Published: 2024-04-29T05:46:52.134Z Last Updated: 2024-08-01T20:33:53.106Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Super 8 Products: livechat SDK Problem Types: CWE-79 Description: Super 8 Live Chat online customer service platform fails to properly filter user input, allowing unauthenticated remote attackers to insert JavaScript code into the chat box. When the message recipient views the message, they become susceptible to Cross-site Scripting (XSS) attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-7779-35562-1.html
CVE ID: CVE-2024-4303 State: PUBLISHED Published: 2024-04-29T05:56:42.761Z Last Updated: 2024-08-01T20:33:53.173Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ArmorX Products: ArmorX APP Problem Types: CWE-287 Description: ArmorX Android APP's multi-factor authentication (MFA) for the login function is not properly implemented. Remote attackers who obtain user credentials can bypass MFA, allowing them to successfully log into the APP. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-7781-ef309-1.html
CVE ID: CVE-2024-4304 State: PUBLISHED Published: 2024-04-29T11:52:57.795Z Last Updated: 2024-08-01T20:33:53.199Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: GT3 Soluciones Products: SWAL Problem Types: CWE-79 Description: A Cross-Site Scripting XSS vulnerability has been detected on GT3 Soluciones SWAL. This vulnerability consists in a reflected XSS in the Titular parameter inside Gestion 'Documental > Seguimiento de Expedientes > Alta de Expedientes'. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/vulnerability-swal-platform-gt3-soluciones
CVE ID: CVE-2024-4305 State: PUBLISHED Published: 2024-06-17T06:00:01.480Z Last Updated: 2024-08-01T20:33:53.172Z Vendors: Unknown Products: Post Grid Gutenberg Blocks and WordPress Blog Plugin Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Post Grid Gutenberg Blocks and WordPress Blog Plugin WordPress plugin before 4.1.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/635
onal Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/635be98d-4c17-4e75-871f-9794d85a2eb1/
CVE ID: CVE-2024-4306 State: PUBLISHED Published: 2024-04-29T11:56:36.434Z Last Updated: 2024-08-01T20:33:53.247Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Ofofonobs Products: HubBank Problem Types: CWE-434 Description: Critical unrestricted file upload vulnerability in HubBank affecting version 1.0.2. This vulnerability allows a registered user to upload malicious PHP files via upload document fields, resulting in webshell execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-hubbank
CVE ID: CVE-2024-4307 State: PUBLISHED Published: 2024-04-29T12:25:38.606Z Last Updated: 2024-08-01T20:33:53.193Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Ofofonobs Products: HubBank Problem Types: CWE-89 Description: SQL injection vulnerability in HubBank affecting version 1.0.2. This vulnerability could allow an attacker to send a specially crafted SQL query to the database through different endpoints (/accounts/activities.php?id=1, /accounts/view-deposit.php?id=1, /accounts/view_cards. php?id=1, /accounts/wire-transfer.php?id=1 and /accounts/wiretransfer-pending.php?id=1, id parameter) and retrieve the information stored in the database. Additional A
/accounts/wiretransfer-pending.php?id=1, id parameter) and retrieve the information stored in the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-hubbank
CVE ID: CVE-2024-4308 State: PUBLISHED Published: 2024-04-29T12:23:41.188Z Last Updated: 2025-08-27T21:25:55.216Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Ofofonobs Products: HubBank Problem Types: CWE-89 Description: SQL injection vulnerability in HubBank affecting version 1.0.2. This vulnerability could allow an attacker to send a specially crafted SQL query to the database through different endpoints (/admin/view_users.php?id=1,/admin/viewloan-trans.php?id=1,/admin/view-deposit.php?id=1,/admin/view-domtrans.php?id=1, /admin/delete_cards.php?id=1,/admin/view_cards.php?id=1 and /admin/view_users.php?id=1, id parameter) and retrieve the information stor
ards.php?id=1,/admin/view_cards.php?id=1 and /admin/view_users.php?id=1, id parameter) and retrieve the information stored in the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-hubbank
CVE ID: CVE-2024-4309 State: PUBLISHED Published: 2024-04-29T12:28:01.751Z Last Updated: 2024-08-01T20:33:53.109Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Ofofonobs Products: HubBank Problem Types: CWE-89 Description: SQL injection vulnerability in HubBank affecting version 1.0.2. This vulnerability could allow an attacker to send a specially crafted SQL query to the database through different endpoints (/user/transaction.php?id=1, /user/credit-debit_transaction.php?id=1,/user/view_transaction. php?id=1 and /user/viewloantrans.php?id=1, id parameter) and retrieve the information stored in the database. Additional Analyst Notes: - CISA ADP Vulnrichment:
, id parameter) and retrieve the information stored in the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-hubbank
CVE ID: CVE-2024-4310 State: PUBLISHED Published: 2024-04-29T12:35:48.526Z Last Updated: 2024-08-01T20:33:53.174Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Ofofonobs Products: HubBank Problem Types: CWE-79 Description: Cross-site Scripting (XSS) vulnerability in HubBank affecting version 1.0.2. This vulnerability allows an attacker to send a specially crafted JavaScript payload to registration and profile forms and trigger the payload when any authenticated user loads the page, resulting in a session takeover. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/mul
: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-hubbank
CVE ID: CVE-2024-4311 State: PUBLISHED Published: 2024-11-14T17:35:53.703Z Last Updated: 2024-11-18T15:40:16.154Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:H) Vendors: zenml-io Products: zenml-io/zenml Problem Types: CWE-770 Description: zenml-io/zenml version 0.56.4 is vulnerable to an account takeover due to the lack of rate-limiting in the password change function. An attacker can brute-force the current password in the 'Update Password' function, allowing them to take over the user's account. This vulnerability is due to the absence of rate-limiting on the '/api/v1/current-user' endpoint, which does not restrict the number of attempts an attacker can make to g
imiting on the '/api/v1/current-user' endpoint, which does not restrict the number of attempts an attacker can make to guess the current password. Successful exploitation results in the attacker being able to change the password and take control of the account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/d5517e1a-6b94-4e38-aad6-3aa65f98bec2 - https://github.com/zenml-io/zenml/commit/87a6c2c8f45b49ea83fbb5fe8fff7ab5365a60c9
CVE ID: CVE-2024-4312 State: PUBLISHED Published: 2024-05-09T20:03:27.632Z Last Updated: 2024-08-01T20:33:53.250Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: daext Products: Soccer Engine – Soccer Plugin for WordPress Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Soccer Engine – Soccer Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12. This is due to missing or incorrect nonce validation when saving match and team settings. This makes it possible for unauthenticated attackers to change plugin settings as well as teams, players, etc. via a forged req
kes it possible for unauthenticated attackers to change plugin settings as well as teams, players, etc. via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/57e84624-98ab-495b-b985-908302527b3a?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3081944%40soccer-engine-lite%2Ftrunk&old=3066918%40soccer-engine-lite%2Ftrunk
CVE ID: CVE-2024-4313 State: PUBLISHED Published: 2024-06-22T02:01:07.423Z Last Updated: 2024-08-01T20:33:53.111Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: fusionplugin Products: Table Addons for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Table Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_id’ parameter in all versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitr
escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ddbb4bcf-daf7-4ae3-8f42-fce5f1d2c279?source=cve - https://plugins.trac.wordpress.org/browser/table-addons-for-elementor/trunk/includes/class-table-addons-for-elementor-widget.php#L637 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3104753%40table-addons-for-elementor&new=3104753%40table-addons-for-elementor&s
eset?sfp_email=&sfph_mail=&reponame=&old=3104753%40table-addons-for-elementor&new=3104753%40table-addons-for-elementor&sfp_email=&sfph_mail=#file57
CVE ID: CVE-2024-4314 State: PUBLISHED Published: 2024-05-09T20:03:30.049Z Last Updated: 2024-08-01T20:33:53.201Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: prasunsen Products: Hostel Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Hostel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.5.3. This is due to missing or incorrect nonce validation when managing rooms. This makes it possible for unauthenticated attackers to create and delete rooms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional
ed request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6a8c5d9b-4535-4edb-a92e-a9b83a0d22c3?source=cve - https://plugins.trac.wordpress.org/changeset/3079755/hostel/trunk?contextall=1&old=3070681&old_path=%2Fhostel%2Ftrunk
CVE ID: CVE-2024-4315 State: PUBLISHED Published: 2024-06-12T00:40:15.768Z Last Updated: 2025-10-15T12:50:24.257Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) Vendors: parisneo Products: parisneo/lollms Problem Types: CWE-22 Description: parisneo/lollms version 9.5 is vulnerable to Local File Inclusion (LFI) attacks due to insufficient path sanitization. The `sanitize_path_from_endpoint` function fails to properly sanitize Windows-style paths (backward slash `\`), allowing attackers to perform directory traversal attacks on Windows systems. This vulnerability can be exploited through various routes, including `personalities` and `/del_preset`, to read or delete
s vulnerability can be exploited through various routes, including `personalities` and `/del_preset`, to read or delete any file on the Windows filesystem, compromising the system's availability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/8a1b0197-2c36-4276-b92b-630a2a9bb09c - https://github.com/parisneo/lollms/commit/95ad36eeffc6a6be3e3f35ed35a384d768f0ecf6
CVE ID: CVE-2024-4316 State: PUBLISHED Published: 2024-05-09T20:03:22.848Z Last Updated: 2024-08-01T20:40:46.043Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpdevteam Products: EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in
ts in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 3.9.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2af03168-9344-4db0-9b69-2ad1fdb6d472?source=cve - https://plugins.trac.wordpress.org/browser/embedpress/trunk/EmbedPress/Elementor/Widg
db0-9b69-2ad1fdb6d472?source=cve - https://plugins.trac.wordpress.org/browser/embedpress/trunk/EmbedPress/Elementor/Widgets/Embedpress_Elementor.php#L3076
CVE ID: CVE-2024-4317 State: PUBLISHED Published: 2024-05-09T13:00:01.285Z Last Updated: 2025-03-28T15:03:02.067Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: PostgreSQL Problem Types: CWE-862 Description: Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands of other users. The most common values may reveal column values the eavesdropper could not otherwise read or results of functions they cannot execute. Installing an unaffected version only fixes fresh PostgreSQL installations, namely those th