Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
m's disk space, potentially leading to a denial of service. This issue affects the file upload functionality as implemented in gradio/routes.py. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/a94d55fb-0770-4cbe-9b20-97a978a2ffff - https://github.com/gradio-app/gradio/commit/84802ee6a4806c25287344dce581f9548a99834a
CVE ID: CVE-2024-1728 State: PUBLISHED Published: 2024-04-10T17:07:56.020Z Last Updated: 2024-08-01T18:48:22.046Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: gradio-app Products: gradio-app/gradio Problem Types: CWE-22 Description: gradio-app/gradio is vulnerable to a local file inclusion vulnerability due to improper validation of user-supplied input in the UploadButton component. Attackers can exploit this vulnerability to read arbitrary files on the filesystem, such as private SSH keys, by manipulating the file path in the request to the `/queue/join` endpoint. This issue could potentially lead to remote code execution. The vulnerability is present in t
he `/queue/join` endpoint. This issue could potentially lead to remote code execution. The vulnerability is present in the handling of file upload paths, allowing attackers to redirect file uploads to unintended locations on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/9bb33b71-7995-425d-91cc-2c2a2f2a068a - https://github.com/gradio-app/gradio/commit/16fbe9cd0cffa9f2a824a0165beb43446114eec7
CVE ID: CVE-2024-1729 State: PUBLISHED Published: 2024-03-29T04:35:12.067Z Last Updated: 2024-08-01T18:48:21.924Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: gradio-app Products: gradio-app/gradio Problem Types: CWE-367 Description: A timing attack vulnerability exists in the gradio-app/gradio repository, specifically within the login function in routes.py. The vulnerability arises from the use of a direct comparison operation (`app.auth[username] == password`) to validate user credentials, which can be exploited to guess passwords based on response times. Successful exploitation of this vulnerability could allow an attacker to bypass authentication mech
d on response times. Successful exploitation of this vulnerability could allow an attacker to bypass authentication mechanisms and gain unauthorized access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/f6a10a8d-f538-4cb7-9bb2-85d9f5708124 - https://github.com/gradio-app/gradio/commit/e329f1fd38935213fe0e73962e8cbd5d3af6e87b
CVE ID: CVE-2024-1730 State: PUBLISHED Published: 2024-04-20T03:21:17.632Z Last Updated: 2024-08-09T20:12:36.786Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: bdthemes Products: Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Media Slider, Drag Drop Slider, Video Slider, Product Slider, Ecommerce Slider) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via urls in link fields, images from URLs, and ht
der) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via urls in link fields, images from URLs, and html tags used in widgets in all versions up to, and including, 3.14.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e5a2ed81-254e-460c-b3a4-0cb38e089142?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sf
bilities/id/e5a2ed81-254e-460c-b3a4-0cb38e089142?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3072100%40bdthemes-prime-slider-lite&new=3072100%40bdthemes-prime-slider-lite&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1731 State: PUBLISHED Published: 2024-03-05T01:56:00.462Z Last Updated: 2024-08-23T20:17:41.653Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: jkohlbach Products: Auto Refresh Single Page Problem Types: CWE-502 Deserialization of Untrusted Data Description: The Auto Refresh Single Page plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1 via deserialization of untrusted input from the arsp_options post meta option. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP
ibutor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5f8f8d46-d7e7-4b07-9b10-15e579973474?source=cve - https://plugins.trac.wordpress.org/browser/auto-refresh-single-page/trunk/auto-refresh-single-page.php#L42
CVE ID: CVE-2024-1732 State: PUBLISHED Published: 2024-04-02T09:32:09.089Z Last Updated: 2024-08-09T19:00:16.574Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: djamio1988 Products: Sharkdropship Dropshipping & Affiliate for for AliExpress Problem Types: CWE-862 Missing Authorization Description: The Sharkdropship for AliExpress Dropshipping and Affiliate plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wads_removeProductFromShop() function in all versions up to, and including, 2.2.4. This makes it possible for unauthenticated attackers to delete arbitrary posts. Additional Analyst Notes: - CVE Program
This makes it possible for unauthenticated attackers to delete arbitrary posts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4a2e636d-e602-4ab0-80f2-525a8a1f8388?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3059375%40wooshark-aliexpress-importer&new=3059375%40wooshark-aliexpress-importer&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1733 State: PUBLISHED Published: 2024-03-16T05:39:58.385Z Last Updated: 2024-08-21T23:11:12.441Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: charlestsmith Products: Word Replacer Pro Problem Types: CWE-862 Missing Authorization Description: The Word Replacer Pro plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the word_replacer_ultra() function in all versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to update arbitrary content on the affected WordPress site. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refere
ntent on the affected WordPress site. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1da53718-c2a2-45d0-ad43-daff3c68342d?source=cve - https://plugins.trac.wordpress.org/browser/word-replacer-ultra/trunk/inc/word-replacer-ultra-ajax.php#L16
CVE ID: CVE-2024-1734 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:06:01.105Z Description: No description available.
CVE ID: CVE-2024-1735 State: PUBLISHED Published: 2024-02-26T07:25:42.406Z Last Updated: 2025-08-26T20:01:39.603Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: LINE Corporation Products: Armeria Problem Types: na Description: A vulnerability has been identified in armeria-saml versions less than 1.27.2, allowing the use of malicious SAML messages to bypass authentication. All users who rely on armeria-saml older than version 1.27.2 must upgrade to 1.27.2 or later. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/line/armeria/security/advisories/GHSA-4m6j-23p2-8c54
CVE ID: CVE-2024-1736 State: PUBLISHED Published: 2024-06-12T23:02:21.879Z Last Updated: 2024-09-18T13:10:48.392Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-1333 Description: An issue has been discovered in GitLab CE/EE affecting all versions prior to 16.10.7, starting from 16.11 prior to 16.11.4, and starting from 17.0 prior to 17.0.2. A vulnerability in GitLab's CI/CD pipeline editor could allow for denial of service attacks through maliciously crafted configuration files. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/44
Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/442695 - https://hackerone.com/reports/2358689 - https://about.gitlab.com/releases/2024/06/12/patch-release-gitlab-17-0-2-released/#redos-in-ci-interpolation-fix-bypass
CVE ID: CVE-2024-1737 State: PUBLISHED Published: 2024-07-23T14:34:09.750Z Last Updated: 2025-02-13T17:32:25.755Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: BIND 9 Description: Resolver caches and authoritative zone databases that hold significant numbers of RRs for the same hostname (of any RTYPE) can suffer from degraded performance as content is being added or updated, and also when handling client queries for this name. This issue affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.4-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.27
8.27, 9.19.0 through 9.19.24, 9.11.4-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.27-S1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://kb.isc.org/docs/cve-2024-1737 - https://kb.isc.org/docs/rrset-limits-in-zones - http://www.openwall.com/lists/oss-security/2024/07/23/1 - http://www.openwall.com/lists/oss-security/2024/07/31/2
CVE ID: CVE-2024-1738 State: PUBLISHED Published: 2024-04-16T00:00:14.489Z Last Updated: 2024-08-01T18:48:21.825Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-863 Description: An incorrect authorization vulnerability exists in the lunary-ai/lunary repository, specifically within the evaluations.get route in the evaluations API endpoint. This vulnerability allows unauthorized users to retrieve the results of any organization's evaluation by simply knowing the evaluation ID, due to the lack of project ID verification in the SQL query. As a result, attackers can gain access to potentially private data con
lack of project ID verification in the SQL query. As a result, attackers can gain access to potentially private data contained within the evaluation results. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/f68ef361-7a5d-4272-9c2f-414baf074309 - https://github.com/lunary-ai/lunary/commit/a4e61122e61dc31460cfbe54d15fae389cc440ce
CVE ID: CVE-2024-1739 State: PUBLISHED Published: 2024-04-16T00:00:15.208Z Last Updated: 2024-08-01T18:48:21.819Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-821 Description: lunary-ai/lunary is vulnerable to an authentication issue due to improper validation of email addresses during the signup process. Specifically, the server fails to treat email addresses as case insensitive, allowing the creation of multiple accounts with the same email address by varying the case of the email characters. For example, accounts for 'abc@gmail.com' and 'Abc@gmail.com' can both be created, leading to potential imper
haracters. For example, accounts for 'abc@gmail.com' and 'Abc@gmail.com' can both be created, leading to potential impersonation and confusion among users. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/2ca70ba5-b6a4-4873-bd55-bc6cef40d300 - https://github.com/lunary-ai/lunary/commit/7351157a21e5acd0162b4528bcae9d65b1c95695
CVE ID: CVE-2024-1740 State: PUBLISHED Published: 2024-04-10T17:08:04.617Z Last Updated: 2024-08-01T18:48:21.987Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-863 Description: In lunary-ai/lunary version 1.0.1, a vulnerability exists where a user removed from an organization can still read, create, modify, and delete logs by re-using an old authorization token. The lunary web application communicates with the server using an 'Authorization' token in the browser, which does not properly invalidate upon the user's removal from the organization. This allows the removed user to perform unauthorized act
perly invalidate upon the user's removal from the organization. This allows the removed user to perform unauthorized actions on logs and access project and external user details without valid permissions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/c1a51f71-628e-4eb5-ac35-50bf64832cfd - https://github.com/lunary-ai/lunary/commit/c57cd50fa0477fd2a2efe60810c0099eebd66f54
CVE ID: CVE-2024-1741 State: PUBLISHED Published: 2024-04-10T17:08:04.411Z Last Updated: 2025-01-31T11:05:20.459Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-863 Description: lunary-ai/lunary version 1.0.1 is vulnerable to improper authorization, allowing removed members to read, create, modify, and delete prompt templates using an old authorization token. Despite being removed from an organization, these members can still perform operations on prompt templates by sending HTTP requests with their previously captured authorization token. This issue exposes organizations to unauthorized access and m
quests with their previously captured authorization token. This issue exposes organizations to unauthorized access and manipulation of sensitive template data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/671bd040-1cc5-4227-8182-5904e9c5ed3b - https://github.com/lunary-ai/lunary/commit/d8e2e73efd53ab4e92cf47bbf4b639a9f08853d2
CVE ID: CVE-2024-1742 State: PUBLISHED Published: 2024-03-22T10:26:06.238Z Last Updated: 2024-08-12T18:34:37.823Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: Checkmk GmbH Products: Checkmk Problem Types: CWE-214 Description: Invocation of the sqlplus command with sensitive information in the command line in the mk_oracle Checkmk agent plugin before Checkmk 2.3.0b4 (beta), 2.2.0p24, 2.1.0p41 and 2.0.0 (EOL) allows the extraction of this information from the process list. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://checkmk.com/werk/16234
CVE ID: CVE-2024-1743 State: PUBLISHED Published: 2024-04-24T05:00:02.107Z Last Updated: 2024-08-01T18:48:21.661Z Vendors: Unknown Products: WooCommerce Customers Manager Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WooCommerce Customers Manager WordPress plugin before 29.8 does not sanitise and escape various parameters before outputting them back in pages and attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/3cb1f707-6093-42a7-a778-2b296bdf1735/
CVE ID: CVE-2024-1744 State: PUBLISHED Published: 2024-09-06T12:13:31.328Z Last Updated: 2025-10-14T12:40:21.386Z Vendors: Ariva Computer Products: Accord ORS Problem Types: CWE-639, CWE-862 Description: Authorization Bypass Through User-Controlled Key, Missing Authorization vulnerability in Ariva Computer Accord ORS allows Retrieve Embedded Sensitive Data.This issue affects Accord ORS: before 7.3.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1408
CVE ID: CVE-2024-1745 State: PUBLISHED Published: 2024-03-26T05:00:02.299Z Last Updated: 2024-08-05T18:36:56.611Z Vendors: Unknown Products: Testimonial Slider Problem Types: CWE-863 Incorrect Authorization Description: The Testimonial Slider WordPress plugin before 2.3.7 does not properly ensure that a user has the necessary capabilities to edit certain sensitive Testimonial Slider WordPress plugin before 2.3.7 settings, making it possible for users with at least the Author role to edit them. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b63bbfeb-d6f7-4c33-8824-b86d64d3f598/
CVE ID: CVE-2024-1746 State: PUBLISHED Published: 2024-04-15T05:00:04.460Z Last Updated: 2024-11-06T14:34:10.713Z Vendors: Unknown Products: Testimonial Slider Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Testimonial Slider WordPress plugin before 2.3.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/5f35572a-4129-4fe0-a465-d25f4c3b4419/
CVE ID: CVE-2024-1747 State: PUBLISHED Published: 2024-08-01T06:00:02.536Z Last Updated: 2024-08-01T14:24:07.026Z Vendors: Unknown Products: WooCommerce Customers Manager Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The WooCommerce Customers Manager WordPress plugin before 30.2 does not have authorisation and CSRF in various AJAX actions, allowing any authenticated users, such as subscriber, to call them and update/delete/create customer metadata, also leading to Stored Cross-Site Scripting due to the lack of escaping of said metadata values. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnera
ing of said metadata values. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/17e45d4d-0ee1-4863-a8a4-df8587f448ec/
CVE ID: CVE-2024-1748 State: PUBLISHED Published: 2024-02-22T19:31:04.494Z Last Updated: 2025-04-22T16:16:55.447Z Severity: N/A (CVSS 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P) Vendors: van_der_Schaar LAB Products: AutoPrognosis Problem Types: CWE-502 Description: A vulnerability classified as critical was found in van_der_Schaar LAB AutoPrognosis 0.1.21. This vulnerability affects the function load_model_from_file of the component Release Note Handler. The manipulation leads to deserialization. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-254530 is the identi
oitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-254530 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.254530 - https://vuldb.com/?ctiid.254530 - https://github.com/bayuncao/vul-cve-13
CVE ID: CVE-2024-1749 State: PUBLISHED Published: 2024-02-22T19:31:06.495Z Last Updated: 2024-08-01T18:48:21.866Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: Bdtask Products: Bhojon Best Restaurant Management Software Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in Bdtask Bhojon Best Restaurant Management Software 2.9. This issue affects some unknown processing of the file /dashboard/message of the component Message Page. The manipulation of the argument Title leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of
ck may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-254531. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.254531 - https://vuldb.com/?ctiid.254531 - https://drive.google.com/file/d/1oM1h3E9G17lgkbSnhq7FQjfAtEojDNFo/view?usp=sharing
CVE ID: CVE-2024-1750 State: PUBLISHED Published: 2024-02-22T20:00:10.735Z Last Updated: 2024-08-01T18:48:21.942Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: TemmokuMVC Problem Types: CWE-502 Description: A vulnerability, which was classified as critical, was found in TemmokuMVC up to 2.3. Affected is the function get_img_url/img_replace in the library lib/images_get_down.php of the component Image Download Handler. The manipulation leads to deserialization. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and ma
n attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-254532. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.254532 - https://vuldb.com/?ctiid.254532 - https://note.zhaoj.in/share/OrBH8zLKUPOA
CVE ID: CVE-2024-1751 State: PUBLISHED Published: 2024-03-13T15:27:26.103Z Last Updated: 2024-08-09T20:17:13.929Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: themeum Products: Tutor LMS – eLearning and online course solution Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the question_id parameter in all versions up to, and including, 2.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This ma
sufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber/student access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f9cee379-79f8-4a60-b1bb-ccab1e954512?source=cve - https://plugins.trac.wordpress.org/browser/tutor/tags/2.6.1/classes/Utils.php#L4555 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&
tutor/tags/2.6.1/classes/Utils.php#L4555 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3049105%40tutor&new=3049105%40tutor&sfp_email=&sfph_mail=