Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
g/DHCPS6.BRIDGE-1.xml leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-251666 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.251666 - https://vuldb.com/?ctiid.251666 - https://github.com/c2dc/cve-reported/blob/main/CVE-2024-0769/CVE-2024-0769.md - https://supportannouncement.us.dlink
6 - https://github.com/c2dc/cve-reported/blob/main/CVE-2024-0769/CVE-2024-0769.md - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10371
CVE ID: CVE-2024-0770 State: PUBLISHED Published: 2024-01-21T23:00:05.982Z Last Updated: 2025-05-30T14:23:45.300Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: European Chemicals Agency Products: IUCLID Problem Types: CWE-276 Description: A vulnerability, which was classified as critical, was found in European Chemicals Agency IUCLID 7.10.3 on Windows. Affected is an unknown function of the file iuclid6.exe of the component Desktop Installer. The manipulation leads to incorrect default permissions. The attack needs to be approached locally. VDB-251670 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosu
y. VDB-251670 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.251670 - https://vuldb.com/?ctiid.251670 - https://imagebin.ca/v/7nx8zv3l62Kf
CVE ID: CVE-2024-0771 State: PUBLISHED Published: 2024-01-21T23:00:07.048Z Last Updated: 2025-05-08T18:10:33.242Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Nsasoft Products: Product Key Explorer Problem Types: CWE-119 Description: A vulnerability has been found in Nsasoft Product Key Explorer 4.0.9 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Registration Handler. The manipulation of the argument Name/Key leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-2516
he exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-251671. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.251671 - https://vuldb.com/?ctiid.251671 - https://youtu.be/eecN5mC0avU
CVE ID: CVE-2024-0772 State: PUBLISHED Published: 2024-01-21T23:31:04.097Z Last Updated: 2024-10-21T11:02:08.423Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Nsasoft Products: ShareAlarmPro Problem Types: CWE-119 Description: A vulnerability was found in Nsasoft ShareAlarmPro 2.1.4 and classified as problematic. Affected by this issue is some unknown functionality of the component Registration Handler. The manipulation of the argument Name/Key leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-251672. NOTE: The vendor was c
been disclosed to the public and may be used. The identifier of this vulnerability is VDB-251672. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.251672 - https://vuldb.com/?ctiid.251672 - https://youtu.be/WIeWeuXbkiY
CVE ID: CVE-2024-0773 State: PUBLISHED Published: 2024-01-21T23:31:05.166Z Last Updated: 2025-05-30T14:23:39.168Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: CodeAstro Products: Internet Banking System Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in CodeAstro Internet Banking System 1.0. Affected by this vulnerability is an unknown functionality of the file pages_client_signup.php. The manipulation of the argument Client Full Name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-251677 was assigned to this vulnerability. Additional Analy
disclosed to the public and may be used. The identifier VDB-251677 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.251677 - https://vuldb.com/?ctiid.251677 - https://drive.google.com/drive/folders/1YjJFvxis3gLWX95990Y-nJMbWCQHB02U?usp=sharing
CVE ID: CVE-2024-0774 State: PUBLISHED Published: 2024-01-22T00:00:06.489Z Last Updated: 2024-11-13T16:55:30.104Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Any-Capture Products: Any Sound Recorder Problem Types: CWE-119 Description: A vulnerability was found in Any-Capture Any Sound Recorder 2.93. It has been declared as problematic. This vulnerability affects unknown code of the component Registration Handler. The manipulation of the argument User Name/Key Code leads to memory corruption. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. VDB-251674 is the identifier assigned to this vu
cal host. The exploit has been disclosed to the public and may be used. VDB-251674 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.251674 - https://vuldb.com/?ctiid.251674 - https://youtu.be/f_4eHkISrZg
CVE ID: CVE-2024-0775 State: PUBLISHED Published: 2024-01-22T13:03:09.603Z Last Updated: 2025-11-20T18:10:55.464Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-416 Description: A use-after-free flaw was found in the __ext4_remount in fs/ext4/super.c in ext4 in the Linux kernel. This flaw allows a local user to cause an information leak problem while freeing the old quota file names before a potential failure, leading to a use-after-free. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment
tential failure, leading to a use-after-free. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2024-0775 - https://bugzilla.redhat.com/show_bug.cgi?id=2259414 - https://scm.linefinity.com/common/linux-stable/commit/4c0b4818b1f636bc96359f7817a2d8bab6370162
CVE ID: CVE-2024-0776 State: PUBLISHED Published: 2024-01-22T00:31:03.964Z Last Updated: 2025-06-17T17:51:18.779Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: LinZhaoguan Products: pb-cms Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in LinZhaoguan pb-cms 2.0. Affected by this issue is some unknown functionality of the component Comment Handler. The manipulation with the input <div onmouseenter="alert("xss)"> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-251678 is the identifier assigned to this vulnerability. Additional Analyst Notes
sed to the public and may be used. VDB-251678 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.251678 - https://vuldb.com/?ctiid.251678 - https://github.com/sweatxi/BugHub/blob/main/Pbcms%20Background%20recovery%20store%20xss.pdf
CVE ID: CVE-2024-0778 State: PUBLISHED Published: 2024-01-22T16:00:06.512Z Last Updated: 2025-05-30T14:22:50.648Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Uniview Products: ISC 2500-S Problem Types: CWE-78 Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in Uniview ISC 2500-S up to 20210930. Affected by this issue is the function setNatConfig of the file /Interface/DevManage/VM.php. The manipulation of the argument natAddress/natPort/natServerPort leads to os command injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-251696. NOTE
. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-251696. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.251696 - https://vuldb.com/?ctiid.251696 - https://github.com/dezhoutorizhao/cve/blob/main/rce.md
CVE ID: CVE-2024-0779 State: PUBLISHED Published: 2024-03-18T19:05:42.163Z Last Updated: 2024-08-28T15:36:30.412Z Vendors: Unknown Products: Enjoy Social Feed plugin for WordPress website Problem Types: CWE-862 Missing Authorization, CWE-352 Cross-Site Request Forgery (CSRF) Description: The Enjoy Social Feed plugin for WordPress website WordPress plugin through 6.2.2 does not have authorisation and CSRF in various function hooked to admin_init, allowing unauthenticated users to call them and unlink arbitrary users Instagram Account for example Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/ced134cf-82c5-401b-9476-b6
ISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/ced134cf-82c5-401b-9476-b6456e1924e2/
CVE ID: CVE-2024-0780 State: PUBLISHED Published: 2024-03-18T19:05:41.368Z Last Updated: 2025-03-14T16:20:28.257Z Vendors: Unknown Products: Enjoy Social Feed plugin for WordPress website Problem Types: CWE-862 Missing Authorization Description: The Enjoy Social Feed plugin for WordPress website WordPress plugin through 6.2.2 does not have authorisation when resetting its database, allowing any authenticated users, such as subscriber to perform such action Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/be3045b1-72e6-450a-8dd2-4702a9328447/
CVE ID: CVE-2024-0781 State: PUBLISHED Published: 2024-01-22T16:00:07.573Z Last Updated: 2025-06-17T21:19:25.822Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: CodeAstro Products: Internet Banking System Problem Types: CWE-601 Description: A vulnerability, which was classified as problematic, was found in CodeAstro Internet Banking System 1.0. This affects an unknown part of the file pages_client_signup.php. The manipulation of the argument Client Full Name with the input <meta http-equiv="refresh" content="0; url=https://vuldb.com" /> leads to open redirect. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identif
t is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-251697 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.251697 - https://vuldb.com/?ctiid.251697 - https://drive.google.com/drive/folders/1f61RXqelSDY0T92aLjmb8BhgAHt_eeUS
CVE ID: CVE-2024-0782 State: PUBLISHED Published: 2024-01-22T16:31:03.890Z Last Updated: 2024-10-21T10:53:03.506Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: CodeAstro Products: Online Railway Reservation System Problem Types: CWE-79 Description: A vulnerability has been found in CodeAstro Online Railway Reservation System 1.0 and classified as problematic. This vulnerability affects unknown code of the file pass-profile.php. The manipulation of the argument First Name/Last Name/User Name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-251698 is the identifier assigned to this vulnerability.
e exploit has been disclosed to the public and may be used. VDB-251698 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.251698 - https://vuldb.com/?ctiid.251698 - https://drive.google.com/drive/folders/1ecVTReqCS_G8svyq3MG79E2y59psMcPn?usp=sharing
CVE ID: CVE-2024-0783 State: PUBLISHED Published: 2024-01-22T17:31:03.580Z Last Updated: 2025-05-30T14:22:43.814Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Project Worlds Products: Online Admission System Problem Types: CWE-434 Description: A vulnerability was found in Project Worlds Online Admission System 1.0 and classified as critical. This issue affects some unknown processing of the file documents.php. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-251699. Additional Analyst Notes: - CVE Program Container: - CISA AD
associated identifier of this vulnerability is VDB-251699. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.251699 - https://vuldb.com/?ctiid.251699 - https://github.com/keru6k/Online-Admission-System-RCE-PoC - https://github.com/keru6k/Online-Admission-System-RCE-PoC/blob/main/poc.py
CVE ID: CVE-2024-0784 State: PUBLISHED Published: 2024-01-22T17:31:04.653Z Last Updated: 2025-05-30T14:22:37.505Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: hongmaple Products: octopus Problem Types: CWE-89 Description: A vulnerability was found in hongmaple octopus 1.0. It has been classified as critical. Affected is an unknown function of the file /system/role/list. The manipulation of the argument dataScope leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases
using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The identifier of this vulnerability is VDB-251700. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.251700 - https://vuldb.com/?ctiid.251700 - https://github.com/biantaibao/octopus_SQL/blob/main/report.md
CVE ID: CVE-2024-0786 State: PUBLISHED Published: 2024-02-28T08:33:12.550Z Last Updated: 2024-08-01T18:18:18.802Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: tatvic Products: Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the ee_syncProductCategory function using the parameters conditionData, valueData, productArray, exclude a
Injection via the ee_syncProductCategory function using the parameters conditionData, valueData, productArray, exclude and include in all versions up to, and including, 6.9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c30801d1-9335-4bba-b344-f0ff57cecf84?
Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c30801d1-9335-4bba-b344-f0ff57cecf84?source=cve - https://plugins.trac.wordpress.org/browser/enhanced-e-commerce-for-woocommerce-store/trunk/includes/data/class-tvc-ajax-file.php#L1979
CVE ID: CVE-2024-0787 State: PUBLISHED Published: 2024-11-15T10:57:05.410Z Last Updated: 2024-11-15T19:09:48.262Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: phpipam Products: phpipam/phpipam Problem Types: CWE-307 Description: phpIPAM version 1.5.1 contains a vulnerability where an attacker can bypass the IP block mechanism to brute force passwords for users by using the 'X-Forwarded-For' header. The issue lies in the 'get_user_ip()' function in 'class.Common.php' at lines 1044 and 1045, where the presence of the 'X-Forwarded-For' header is checked and used instead of 'REMOTE_ADDR'. This vulnerability allows attackers to perform brute force attacks on u
er is checked and used instead of 'REMOTE_ADDR'. This vulnerability allows attackers to perform brute force attacks on user accounts, including the admin account. The issue is fixed in version 1.7.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/840cb582-1feb-43ab-9cc4-e4b5a63c5bab - https://github.com/phpipam/phpipam/commit/55c2056068be9f1359e967fcff64db6b7f4d00b5
CVE ID: CVE-2024-0788 State: PUBLISHED Published: 2024-01-29T16:20:53.335Z Last Updated: 2025-05-20T14:47:26.144Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: SUPERAntiSpyware Products: SUPERAntiSpyware Pro X Problem Types: CWE-96 Description: SUPERAntiSpyware Pro X v10.0.1260 is vulnerable to kernel-level API parameters manipulation and Denial of Service vulnerabilities by triggering the 0x9C402140 IOCTL code of the saskutil64.sys driver. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/brubeck/ - https://www.superantispyware.com/professional-x-edition.html
CVE ID: CVE-2024-0789 State: PUBLISHED Published: 2024-06-19T07:39:33.867Z Last Updated: 2024-08-01T18:18:18.508Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: florent73 Products: WP Maintenance Problem Types: CWE-348 Use of Less Trusted Source Description: The WP Maintenance plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 6.1.9.2 due to insufficient IP address validation and use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated attackers to bypass maintenance mode. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Referenc
tackers to bypass maintenance mode. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8f6bbaa1-c50f-4dad-9e5b-04bdffd4a0ae?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3078682%40wp-maintenance%2Ftrunk&old=3069916%40wp-maintenance%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-0790 State: PUBLISHED Published: 2024-02-05T21:21:46.682Z Last Updated: 2024-08-01T18:18:18.640Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: realmag777 Products: WOLF – WordPress Posts Bulk Editor and Manager Professional Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WOLF – WordPress Posts Bulk Editor and Manager Professional plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.8.1. This is due to missing or incorrect nonce validation on the wpbe_create_new_term, wpbe_update_tax_term, and wpbe_delete_tax_term functions. This makes it possible for unauthenti
he wpbe_create_new_term, wpbe_update_tax_term, and wpbe_delete_tax_term functions. This makes it possible for unauthenticated attackers to create, modify and delete taxonomy terms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Furthermore, the functions wpbe_save_options, wpbe_bulk_delete_posts_count, wpbe_bulk_delete_posts, and wpbe_save_meta are vulnerable to Cross-Site Request Forgery allowing for plugin options update, post count deletion, post deletion and modification of post metadata via forged request. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.
equest. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6c48f94b-d193-429a-9383-628ae12bfdf3?source=cve - https://plugins.trac.wordpress.org/browser/bulk-editor/trunk/index.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3028699%40bulk-editor%2Ftrunk&old=3012874%40bulk-editor%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-0791 State: PUBLISHED Published: 2024-02-05T21:21:33.679Z Last Updated: 2025-04-24T15:53:49.200Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: realmag777 Products: WOLF – WordPress Posts Bulk Editor and Manager Professional Problem Types: CWE-862 Missing Authorization Description: The WOLF – WordPress Posts Bulk Editor and Manager Professional plugin for WordPress is vulnerable to unauthorized access, modification or loss of data due to a missing capability check on the wpbe_create_new_term, wpbe_update_tax_term, and wpbe_delete_tax_term functions in all versions up to, and including, 1.0.8.1. This makes it possible for authenticated attac
_delete_tax_term functions in all versions up to, and including, 1.0.8.1. This makes it possible for authenticated attackers, with subscriber access or higher, to create, delete or modify taxonomy terms. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/13c66a8f-b35f-4943-8880-0799b0d150f7?source=cve - https://plugins.trac.wordpress.org/browser/bulk-editor/trunk/index.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3028699%40bulk-editor%2Ftrunk&old=3012874%40bulk-editor%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-0792 State: PUBLISHED Published: 2024-02-20T18:56:18.777Z Last Updated: 2024-08-01T18:18:18.607Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: gn_themes Products: WP Shortcodes Plugin — Shortcodes Ultimate Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 7.0.1 due to insufficient input sanitization and output escaping on RSS feed content. This makes it possible for authenticated attackers wit
cient input sanitization and output escaping on RSS feed content. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0d8c043c-e347-4dc8-8a72-943a7e6c4394?source=cve - https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/includes/shortcodes/feed.php#L49 - https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/includes/shortcodes/feed.php#L78 - https://plugins.trac.wordpress