Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-13902 State: PUBLISHED Published: 2025-03-06T10:00:15.926Z Last Updated: 2025-03-06T16:23:11.574Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: huang-yk Products: student-manage Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, was found in huang-yk student-manage 1.0. This affects an unknown part of the component Edit a Student Information Page. The manipulation of the argument Class leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.29878
the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298785 - https://vuldb.com/?ctiid.298785 - https://gitee.com/huang-yk/student-manage/issues/I9UXC4
CVE ID: CVE-2024-13903 State: PUBLISHED Published: 2025-03-21T07:00:14.647Z Last Updated: 2025-03-21T12:31:02.832Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:N/A:P) Vendors: quickjs-ng Products: QuickJS Problem Types: CWE-121, CWE-119 Description: A vulnerability was found in quickjs-ng QuickJS up to 0.8.0. It has been declared as problematic. Affected by this vulnerability is the function JS_GetRuntime of the file quickjs.c of the component qjs. The manipulation leads to stack-based buffer overflow. The attack can be launched remotely. Upgrading to version 0.9.0 is able to address this issue. The patch is named 99c02eb45170775a9a679c32b45dd4000ea67aff. It is recommended to upgrade the affec
address this issue. The patch is named 99c02eb45170775a9a679c32b45dd4000ea67aff. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300571 - https://vuldb.com/?ctiid.300571 - https://vuldb.com/?submit.517394 - https://github.com/quickjs-ng/quickjs/issues/775 - https://github.com/quickjs-ng/quickjs/commit/99c02eb45170775a9a679c32b45dd4000ea67aff - https://github.com/quickjs-ng/quickjs/releases/tag/v0.9.0
CVE ID: CVE-2024-13904 State: PUBLISHED Published: 2025-03-07T08:21:25.888Z Last Updated: 2025-03-07T17:01:26.988Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: platformlycom Products: Platform.ly for WooCommerce Problem Types: CWE-918 Description: The Platform.ly for WooCommerce plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.1.6 via the 'hooks' function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Additional Analyst Notes: - CISA AD
application and can be used to query and modify information from internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/944e4c96-6ded-4483-9eaf-d976646f45ea?source=cve - https://plugins.trac.wordpress.org/browser/platformly-for-woocommerce/trunk/platformly-for-woocommerce.php#L167 - https://plugins.trac.wordpress.org/changeset/3249460
CVE ID: CVE-2024-13905 State: PUBLISHED Published: 2025-02-27T04:21:45.364Z Last Updated: 2025-02-27T14:46:14.196Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: sainwp Products: OneStore Sites Problem Types: CWE-918 Description: The OneStore Sites plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 0.1.1 via the class-export.php file. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
ery and modify information from internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f2c70d5f-beb3-480e-8ea8-c3ab01ce5a20?source=cve - https://plugins.trac.wordpress.org/browser/onestore-sites/trunk/classess/class-export.php#L3
CVE ID: CVE-2024-13906 State: PUBLISHED Published: 2025-03-07T07:22:24.217Z Last Updated: 2025-03-07T15:27:26.114Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: bestwebsoft Products: Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress Problem Types: CWE-502 Description: The Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.7.3 via deserialization of untrusted input in the 'import_gallery_from_csv' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to inje
om_csv' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/76c5559d-f9dd-
t Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/76c5559d-f9dd-43cf-8c8e-07188b4edf7f?source=cve - https://plugins.trac.wordpress.org/browser/gallery-plugin/tags/4.7.3/gallery-plugin.php#L292 - https://plugins.trac.wordpress.org/changeset/3249573/
CVE ID: CVE-2024-13907 State: PUBLISHED Published: 2025-02-27T06:48:38.602Z Last Updated: 2025-02-27T14:52:30.741Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: boldgrid Products: Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid Problem Types: CWE-918 Description: The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.16.8 via the 'download' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from
ated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/21da92d2-c38d-4a12-b850-bd0b580aaa54?source=cve - https://plugins.trac.wordpress.org/browser/boldgrid-backup/trunk/includes/class-boldgrid-backup-archive-fetcher.php#L141 - https://plugins.trac.wordpress.org/changeset/3246655/
CVE ID: CVE-2024-13908 State: PUBLISHED Published: 2025-03-08T07:04:54.779Z Last Updated: 2025-03-11T16:08:26.057Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: bestwebsoft Products: SMTP by BestWebSoft Problem Types: CWE-434 Description: The SMTP by BestWebSoft plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_options' function in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA
rary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9f3b0637-b1ee-4e0b-95cd-11ac377805a7?source=cve - https://plugins.trac.wordpress.org/browser/bws-smtp/tags/1.1.8/includes/class-bwssmtp-settings.php - https://plugins.trac.wordpress.org/changeset/3250935/
CVE ID: CVE-2024-13909 State: PUBLISHED Published: 2025-04-10T07:02:40.769Z Last Updated: 2025-04-10T14:00:30.438Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: accredible Products: Accredible Certificates & Open Badges Problem Types: CWE-89 Description: The Accredible Certificates & Open Badges plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 1.4.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append addit
QL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f96d3773-29a1-44bd-904a-905aff2b345e?source=cve - https://plugins.trac.wordpress.org/browser/accredible-certificates/tags/1.4.9/users_list.php#L48 - https://wordpress.org/plugins/accredible-certificates/#developers
CVE ID: CVE-2024-13910 State: PUBLISHED Published: 2025-03-01T08:23:21.649Z Last Updated: 2025-03-03T20:56:16.347Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: sminozzi Products: Database Backup and check Tables Automated With Scheduler 2024 Problem Types: CWE-22 Description: The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'database_backup_ajax_delete' function in all versions up to, and including, 2.35. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the
es it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The vulnerability was partially patched in version 2.36. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c92776c4-643c-40f2-ac28-5df5d6bf7fcd?source=cve - https://plugins.trac.wordpress.org/browser/database-backup/trunk/database-backup.php#L267 - https://plugins.trac.wordpress.org/changeset/3247917/ - https://plugins.trac.wordpress.org/changeset/3248708/
CVE ID: CVE-2024-13911 State: PUBLISHED Published: 2025-03-01T07:24:05.517Z Last Updated: 2025-03-03T20:56:40.678Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: sminozzi Products: Database Backup and check Tables Automated With Scheduler 2024 Problem Types: CWE-200 Description: The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.35 via the /dashboard/backup.php file. This makes it possible for authenticated attackers, with Administrator-level access and above, to extract sensitive data including full database credentials. Additional Ana
with Administrator-level access and above, to extract sensitive data including full database credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c548b70a-8566-4aaf-a3a2-fce6c19e6a0c?source=cve - https://plugins.trac.wordpress.org/browser/database-backup/trunk/dashboard/backup.php#L62 - https://plugins.trac.wordpress.org/browser/database-backup/trunk/dashboard/backup.php#L63 - https://plugins.trac.wordpress.org/browser/database-backup/trunk/dashboard/backup.php#L64 - https://plugins.trac.wordpress.org/browser/database-backup/trunk/dashboard/backup.php#L65 - https://plugins.trac.wordpress.org/browser/database-b
press.org/browser/database-backup/trunk/dashboard/backup.php#L65 - https://plugins.trac.wordpress.org/browser/database-backup/trunk/dashboard/backup.php#L66 - https://plugins.trac.wordpress.org/changeset/3247917/
CVE ID: CVE-2024-13913 State: PUBLISHED Published: 2025-03-14T05:24:04.459Z Last Updated: 2025-03-14T15:07:34.227Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: instawp Products: InstaWP Connect – 1-click WP Staging & Migration Problem Types: CWE-352 Description: The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1.0.83. This is due to missing or incorrect nonce validation in the '/migrate/templates/main.php' file. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP
le for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ea6c7b63-00da-4476-a024-97fe99af643d?source=cve - https://plugins.trac.wordpress.org/browser/instawp-connect/trunk/admin/class-instawp-admin.php#L159 - https://plugins.trac.wordpress.org/browser/instawp-connect/trunk/migrate/templates/main.php#L27 - https://plug
hp#L159 - https://plugins.trac.wordpress.org/browser/instawp-connect/trunk/migrate/templates/main.php#L27 - https://plugins.trac.wordpress.org/changeset/3254817/
CVE ID: CVE-2024-13914 State: PUBLISHED Published: 2025-05-15T05:22:57.630Z Last Updated: 2025-07-01T17:36:13.646Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: WP Experts Products: File Manager Advanced Shortcode Problem Types: CWE-22 Description: The File Manager Advanced Shortcode plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.4 (file-manager-advanced-shortcode) and 2.5.6 (advanced-file-manager-pro-premium), via the 'file_manager_advanced' shortcode. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary JavaScript files on the se
icated attackers, with Administrator-level access and above, to include and execute arbitrary JavaScript files on the server. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Sites currently using 2.5.4 (file-manager-advanced-shortcode) should be updated to 2.6.0 (advanced-file-manager-pro-premium). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1500c72a-0621-4f97-9cab-0c9c8abeaf8f?source=cve - https://advancedfilemanager.com/
CVE ID: CVE-2024-13915 State: PUBLISHED Published: 2025-05-30T15:09:58.520Z Last Updated: 2025-06-10T08:49:37.732Z Vendors: Ulefone, Krüger&Matz Products: com.pri.factorytest Problem Types: CWE-926 Description: Android based smartphones from vendors such as Ulefone and Krüger&Matz contain "com.pri.factorytest" application preloaded onto devices during manufacturing process. The application "com.pri.factorytest" (version name: 1.0, version code: 1) exposes a ”com.pri.factorytest.emmc.FactoryResetService“ service allowing any application to perform a factory reset of the device. Application update did not increment the APK version. Instead, it was bundled in OS builds released later than Decem
ce. Application update did not increment the APK version. Instead, it was bundled in OS builds released later than December 2024 (Ulefone) and April 2025 (Krüger&Matz). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/05/CVE-2024-13915
CVE ID: CVE-2024-13916 State: PUBLISHED Published: 2025-05-30T15:16:03.066Z Last Updated: 2025-10-03T09:01:35.255Z Vendors: Kruger&Matz Products: com.pri.applock Problem Types: CWE-926 Description: An application "com.pri.applock", which is pre-loaded on Kruger&Matz smartphones, allows a user to encrypt any application using user-provided PIN code or by using biometric data. Exposed ”com.android.providers.settings.fingerprint.PriFpShareProvider“ content provider's public method query() allows any other malicious application, without any granted Android system permissions, to exfiltrate the PIN code. Only version (version name: 13, version code: 33) was tested and confirmed to have this vulne
o exfiltrate the PIN code. Only version (version name: 13, version code: 33) was tested and confirmed to have this vulnerability. Application update was released in April 2025. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/05/CVE-2024-13915
CVE ID: CVE-2024-13917 State: PUBLISHED Published: 2025-05-30T15:17:47.318Z Last Updated: 2025-06-10T09:12:56.279Z Vendors: Kruger&Matz Products: com.pri.applock Problem Types: CWE-926 Description: An application "com.pri.applock", which is pre-loaded on Kruger&Matz smartphones, allows a user to encrypt any application using user-provided PIN code or by using biometric data. Exposed ”com.pri.applock.LockUI“ activity allows any other malicious application, with no granted Android system permissions, to inject an arbitrary intent with system-level privileges to a protected application. One must know the protecting PIN number (it might be revealed by exploiting CVE-2024-13916) or ask the user t
plication. One must know the protecting PIN number (it might be revealed by exploiting CVE-2024-13916) or ask the user to provide it. Only version (version name: 13, version code: 33) was tested and confirmed to have this vulnerability. Application update was released in April 2025. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/05/CVE-2024-13915
CVE ID: CVE-2024-13918 State: PUBLISHED Published: 2025-03-10T10:02:29.530Z Last Updated: 2025-03-10T17:02:40.794Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: Laravel Holdings Inc. Products: Laravel Framework Problem Types: CWE-79 Description: The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters in the debug-mode error page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20241209-01_Laravel_Reflected_XSS_via_Request_Parameter_in_Debug-Mode_Error_P
search/advisories/tree/public/2024/SBA-ADV-20241209-01_Laravel_Reflected_XSS_via_Request_Parameter_in_Debug-Mode_Error_Page - https://github.com/laravel/framework/pull/53869 - https://github.com/laravel/framework/releases/tag/v11.36.0
CVE ID: CVE-2024-13919 State: PUBLISHED Published: 2025-03-10T10:03:01.374Z Last Updated: 2025-03-10T17:02:42.335Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: Laravel Holdings Inc. Products: Laravel Framework Problem Types: CWE-79 Description: The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of route parameters in the debug-mode error page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20241209-02_Laravel_Reflected_XSS_via_Route_Parameter_in_Debug-Mode_Error_Page
arch/advisories/tree/public/2024/SBA-ADV-20241209-02_Laravel_Reflected_XSS_via_Route_Parameter_in_Debug-Mode_Error_Page - https://github.com/laravel/framework/pull/53869 - https://github.com/laravel/framework/releases/tag/v11.36.0
CVE ID: CVE-2024-13920 State: PUBLISHED Published: 2025-03-20T11:11:28.160Z Last Updated: 2025-03-20T13:07:36.171Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: webtoffee Products: Order Export & Order Import for WooCommerce Problem Types: CWE-22 Description: The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.6.0 via the download_file() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary log files on the server, which can contain sensitive information. Additional Analyst Notes:
ad the contents of arbitrary log files on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dba84eb3-f48a-4175-a652-7c11b12c9afc?source=cve - https://plugins.trac.wordpress.org/browser/order-import-export-for-woocommerce/trunk/admin/modules/history/history.php#L751 - https://wordpress.org/plugins/users-customers-import-export-for-wp-woocommerce/#developers - https://plugins.trac.wordpress.org/changeset/3258567/
CVE ID: CVE-2024-13921 State: PUBLISHED Published: 2025-03-20T11:11:27.795Z Last Updated: 2025-03-20T13:09:01.039Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: webtoffee Products: Order Export & Order Import for WooCommerce Problem Types: CWE-502 Description: The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.0 via deserialization of untrusted input from the 'form_data' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which
strator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c5fcfa21-b3f7-4241-a931-9708ced4f811?source=cve - https://plugins.trac.wordpress.org/browser/or
intel/vulnerabilities/id/c5fcfa21-b3f7-4241-a931-9708ced4f811?source=cve - https://plugins.trac.wordpress.org/browser/order-import-export-for-woocommerce/trunk/admin/modules/import/classes/class-import-ajax.php - https://plugins.trac.wordpress.org/browser/order-import-export-for-woocommerce/trunk/admin/modules/export/classes/class-export-ajax.php - https://wordpress.org/plugins/users-customers-import-export-for-wp-woocommerce/#developers - https://plugins.trac.wordpress.org/changeset/3258567/
CVE ID: CVE-2024-13922 State: PUBLISHED Published: 2025-03-20T11:11:26.177Z Last Updated: 2025-03-20T13:32:50.187Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) Vendors: webtoffee Products: Order Export & Order Import for WooCommerce Problem Types: CWE-73 Description: The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the admin_log_page() function in all versions up to, and including, 2.6.0. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary log files on the server. Additional Analyst Notes: - CISA ADP V