Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
kers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/88e74cb2-7b6f-43ac-bb30-4763c5afe493?source=cve - https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/geo-mashup.php#L1755 - https://wordpress.org/plugins/geo-mashup/#developers - https://plugins.trac.wordpress.org/changeset/3159868/#file0 - https://plugins.trac.wordpress.org/changeset/3159868/
CVE ID: CVE-2024-8991 State: PUBLISHED Published: 2024-09-27T06:53:58.679Z Last Updated: 2024-09-27T16:22:03.594Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: photoweblog Products: OSM – OpenStreetMap Problem Types: CWE-79 Description: The OSM – OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's osm_map and osm_map_v3 shortcodes in all versions up to, and including, 6.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute wh
icated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/839ecd06-9c74-4ddc-b455-26ec3e627889?source=cve - https://wordpress.org/plugins/osm/#developers - https://plugins.trac.wordpress.org/browser/osm/trunk/osm-metabox.php#L155 - https://plugins.trac.wordpress.org/browser/osm/trunk/osm.php#L1120 - https://plugins.trac.wordpress.org/browser/osm/trunk/osm-metabox_v4.php#L139 - https://wp-osm-plugin.hyumika.com/changelog/ - https://plugins.trac.wordpress.org/changeset/31
osm-metabox_v4.php#L139 - https://wp-osm-plugin.hyumika.com/changelog/ - https://plugins.trac.wordpress.org/changeset/3157069/
CVE ID: CVE-2024-8992 State: PUBLISHED Published: 2024-12-26T11:28:54.956Z Last Updated: 2024-12-26T16:38:20.375Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Honor Products: Magic OS Description: Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.honor.com/global/security/cve-2024-8992/
CVE ID: CVE-2024-8993 State: PUBLISHED Published: 2024-12-26T11:18:11.112Z Last Updated: 2024-12-26T16:38:58.332Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Honor Products: Magic OS Description: Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.honor.com/global/security/cve-2024-8993/
CVE ID: CVE-2024-8994 State: PUBLISHED Published: 2024-12-26T11:13:17.488Z Last Updated: 2024-12-26T16:39:32.162Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Honor Products: Magic OS Description: Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.honor.com/global/security/cve-2024-8994/
CVE ID: CVE-2024-8996 State: PUBLISHED Published: 2024-09-25T16:45:15.417Z Last Updated: 2024-09-26T16:23:09.485Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Grafana Products: Agent Flow Problem Types: CWE-428 Description: Unquoted Search Path or Element vulnerability in Grafana Agent (Flow mode) on Windows allows Privilege Escalation from Local User to SYSTEM This issue affects Agent Flow: before 0.43.2 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://grafana.com/security/security-advisories/cve-2024-8996/ - https://grafana.com/blog/2024/09/25/grafana-alloy-and-grafana-agent-flow-security-release-high-severity-fix-for-cve-2024-8975
://grafana.com/blog/2024/09/25/grafana-alloy-and-grafana-agent-flow-security-release-high-severity-fix-for-cve-2024-8975-and-cve-2024-8996/ - https://github.com/grafana/agent/releases/tag/v0.43.3
CVE ID: CVE-2024-8997 State: PUBLISHED Published: 2025-03-18T13:46:23.242Z Last Updated: 2025-06-27T09:16:16.237Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Vestel Products: EVC04 Configuration Interface Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Vestel EVC04 Configuration Interface allows SQL Injection.This issue affects EVC04 Configuration Interface: before V3.187, V4.53. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0070
CVE ID: CVE-2024-8998 State: PUBLISHED Published: 2025-03-20T10:11:04.121Z Last Updated: 2025-04-04T08:45:38.448Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-1333 Description: A Regular Expression Denial of Service (ReDoS) vulnerability exists in lunary-ai/lunary version git f07a845. The server uses the regex /{.*?}/ to match user-controlled strings. In the default JavaScript regex engine, this regex can take polynomial time to match certain crafted user inputs. As a result, an attacker can cause the server to hang for an arbitrary amount of time by submitting a specially crafted payload. This issue i
ker can cause the server to hang for an arbitrary amount of time by submitting a specially crafted payload. This issue is fixed in version 1.4.26. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/4dbd8648-1dca-4f95-b74f-978ef030e97e - https://github.com/lunary-ai/lunary/commit/f2bfa036caf2c48686474f4560a9c5abcf5f43b7
CVE ID: CVE-2024-8999 State: PUBLISHED Published: 2025-03-20T10:08:51.051Z Last Updated: 2025-10-15T12:49:59.295Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-862 Description: lunary-ai/lunary version v1.4.25 contains an improper access control vulnerability in the POST /api/v1/data-warehouse/bigquery endpoint. This vulnerability allows any user to export the entire database data by creating a stream to Google BigQuery without proper authentication or authorization. The issue is fixed in version 1.4.26. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/d42b
ixed in version 1.4.26. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/d42b7a44-0dcb-4ef0-b15c-d0e558da65c6 - https://github.com/lunary-ai/lunary/commit/aa0fd22952d1d84a717ae563eb1ab564d94a9e2b
CVE ID: CVE-2024-9000 State: PUBLISHED Published: 2025-03-20T10:09:25.798Z Last Updated: 2025-10-15T12:49:59.801Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-862 Description: In lunary-ai/lunary before version 1.4.26, the checklists.post() endpoint allows users to create or modify checklists without validating whether the user has proper permissions. This missing access control permits unauthorized users to create checklists, bypassing intended permission checks. Additionally, the endpoint does not validate the uniqueness of the slug field when creating a new checklist, allowing an attacker to spoof e
dpoint does not validate the uniqueness of the slug field when creating a new checklist, allowing an attacker to spoof existing checklists by reusing the slug of an already-existing checklist. This can lead to significant data integrity issues, as legitimate checklists can be replaced with malicious or altered data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/f5fca549-0a4a-4f64-8ccf-d4e108856da4 - https://github.com/lunary-ai/lunary/commit/a02861ef9bb6ce860a35f7b8f178d58859cd85f0
CVE ID: CVE-2024-9001 State: PUBLISHED Published: 2024-09-19T20:00:09.012Z Last Updated: 2024-09-19T20:11:23.091Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: TOTOLINK Products: T10 Problem Types: CWE-78 Description: A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It has been declared as critical. This vulnerability affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument command leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - C
used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.278152 - https://vuldb.com/?ctiid.278152 - https://vuldb.com/?submit.406140 - https://github.com/C9Y57/TOTOLINK_setTracerouteCfg/blob/main/setTracerouteCfg.md - https://www.totolink.net/
CVE ID: CVE-2024-9002 State: PUBLISHED Published: 2024-10-11T13:43:25.391Z Last Updated: 2024-10-11T14:03:06.738Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: Easergy Studio Problem Types: CWE-269 Description: CWE-269: Improper Privilege Management vulnerability exists that could cause unauthorized access, loss of confidentiality, integrity, and availability of the workstation when non-admin authenticated user tries to perform privilege escalation by tampering with the binaries Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-282-03&p_enDocType=Sec
ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-282-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-282-03.pdf
CVE ID: CVE-2024-9003 State: PUBLISHED Published: 2024-09-19T21:00:07.682Z Last Updated: 2024-09-20T13:50:49.213Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Jinan Chicheng Company Products: JFlow Problem Types: CWE-284 Description: A vulnerability was found in Jinan Chicheng Company JFlow 2.0.0. It has been rated as problematic. This issue affects the function AttachmentUploadController of the file /WF/Ath/EntityMutliFile_Load.do of the component Attachment Handler. The manipulation of the argument oid leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was con
. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.278153 - https://vuldb.com/?ctiid.278153 - https://vuldb.com/?submit.406225 - https://github.com/sweatxi/BugHub/blob/main/Jinan%20Gallop%20JFlow%20CMS%20port%20is%20not%20authorized%20to%20cause%20the%20leakage%20of%20database%20attachment%20information.pdf
CVE ID: CVE-2024-9004 State: PUBLISHED Published: 2024-09-19T21:00:10.914Z Last Updated: 2024-09-20T14:40:00.225Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: D-Link Products: DAR-7000 Problem Types: CWE-78 Description: A vulnerability classified as critical has been found in D-Link DAR-7000 up to 20240912. Affected is an unknown function of the file /view/DBManage/Backup_Server_commit.php. The manipulation of the argument host leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst
used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.278154 - https://vuldb.com/?ctiid.278154 - https://vuldb.com/?submit.407023 - https://github.com/mhtcshe/cve/blob/main/cve.md - https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10354 - https://www.dlink.com/
CVE ID: CVE-2024-9005 State: PUBLISHED Published: 2024-10-08T10:22:06.939Z Last Updated: 2025-03-25T14:31:09.556Z Vendors: Schneider Electric Products: EcoStruxure Power Monitoring Expert (PME) Problem Types: CWE-502 Description: CWE-502: Deserialization of Untrusted Data vulnerability exists that could allow code to be remotely executed on the server when unsafely deserialized data is posted to the web server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-282-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-282-05.pdf
CVE ID: CVE-2024-9006 State: PUBLISHED Published: 2024-09-19T22:31:05.103Z Last Updated: 2024-09-20T13:40:09.596Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: jeanmarc77 Products: 123solar Problem Types: CWE-94 Description: A vulnerability was found in jeanmarc77 123solar 1.8.4.5. It has been rated as critical. Affected by this issue is some unknown functionality of the file config/config_invt1.php. The manipulation of the argument PASSOx leads to code injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The patch is identified as f4a8c748ec436e5a79f91ccb6a6f73752b336aa5. It is recommended to apply a patch to fix this i
d. The patch is identified as f4a8c748ec436e5a79f91ccb6a6f73752b336aa5. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.278162 - https://vuldb.com/?ctiid.278162 - https://vuldb.com/?submit.408298 - https://github.com/jeanmarc77/123solar/issues/74 - https://github.com/jeanmarc77/123solar/issues/74#issuecomment-2357653441 - https://github.com/jeanmarc77/123solar/commit/f4a8c748ec436e5a79f91ccb6a6f73752b336aa5
CVE ID: CVE-2024-9007 State: PUBLISHED Published: 2024-09-19T22:31:07.360Z Last Updated: 2024-09-20T13:39:09.819Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: jeanmarc77 Products: 123solar Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in jeanmarc77 123solar 1.8.4.5. This affects an unknown part of the file /detailed.php. The manipulation of the argument date1 leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The patch is named 94bf9ab7ad0ccb7fbdc02f172f37f0e2ea08d48f. It is recommended to apply a patch to fix this issue. Additional Analyst Not
d 94bf9ab7ad0ccb7fbdc02f172f37f0e2ea08d48f. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.278163 - https://vuldb.com/?ctiid.278163 - https://vuldb.com/?submit.408299 - https://github.com/jeanmarc77/123solar/issues/73 - https://github.com/jeanmarc77/123solar/issues/73#issuecomment-2357648077 - https://github.com/jeanmarc77/123solar/commit/94bf9ab7ad0ccb7fbdc02f172f37f0e2ea08d48f
CVE ID: CVE-2024-9008 State: PUBLISHED Published: 2024-09-19T23:00:07.887Z Last Updated: 2024-09-20T13:27:53.449Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Best Online News Portal Problem Types: CWE-89 Description: A vulnerability classified as critical was found in SourceCodester Best Online News Portal 1.0. This vulnerability affects unknown code of the file /news-details.php of the component Comment Section. The manipulation of the argument name leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.
disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.278164 - https://vuldb.com/?ctiid.278164 - https://vuldb.com/?submit.409956 - https://github.com/gurudattch/CVEs/blob/main/Sourcecodester-News-Portal-Comment-Blind-SQLi.md - https://www.sourcecodester.com/
CVE ID: CVE-2024-9009 State: PUBLISHED Published: 2024-09-19T23:31:04.784Z Last Updated: 2024-09-20T13:26:16.612Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Online Quiz Site Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in code-projects Online Quiz Site 1.0. This issue affects some unknown processing of the file showtest.php. The manipulation of the argument subid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.278165 - https://vuldb.co
e used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.278165 - https://vuldb.com/?ctiid.278165 - https://vuldb.com/?submit.410183 - https://github.com/ZTurNA/cve/issues/1 - https://code-projects.org/
CVE ID: CVE-2024-9010 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:05:31.858Z Description: No description available.
CVE ID: CVE-2024-9011 State: PUBLISHED Published: 2024-09-20T00:00:06.610Z Last Updated: 2024-09-20T17:30:13.367Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Crud Operation System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in code-projects Crud Operation System 1.0. Affected is an unknown function of the file updata.php. The manipulation of the argument sid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.278166 - https://vuldb.com/
used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.278166 - https://vuldb.com/?ctiid.278166 - https://vuldb.com/?submit.410396 - https://github.com/ppp-src/a/issues/14 - https://code-projects.org/
CVE ID: CVE-2024-9012 State: REJECTED Published: N/A Last Updated: 2025-07-05T22:16:34.903Z Description: No description available.
CVE ID: CVE-2024-9014 State: PUBLISHED Published: 2024-09-23T17:04:00.264Z Last Updated: 2024-09-23T19:21:22.348Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: pgadmin.org Products: pgAdmin 4 Description: pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pgadmin-org/pgadmin4/issues/7945
CVE ID: CVE-2024-9015 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:05:34.309Z Description: No description available.
CVE ID: CVE-2024-9016 State: REJECTED Published: 2025-03-20T10:09:34.885Z Last Updated: 2025-04-15T15:51:15.829Z Description: No description available.
CVE ID: CVE-2024-9017 State: PUBLISHED Published: 2025-07-03T06:44:25.405Z Last Updated: 2025-07-03T13:17:36.571Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: PeepSo Products: PeepSo Core: Groups Problem Types: CWE-79 Description: The PeepSo Core: Groups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Group Description field in all versions up to, and including, 6.4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional A
bove, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/32ac79f4-ada7-4c14-8675-53f8375912d8?source=cve - https://www.peepso.com/changelog/
CVE ID: CVE-2024-9018 State: PUBLISHED Published: 2024-10-01T08:30:16.968Z Last Updated: 2024-10-01T13:38:02.422Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: hahncgdev Products: WP Easy Gallery – WordPress Gallery Plugin Problem Types: CWE-89 Description: The WP Easy Gallery – WordPress Gallery Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the ‘key’ parameter in all versions up to, and including, 4.8.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append addit
SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a1c4c632-66f2-4987-b7da-048dbe4a3044?source=cve - https://wordpress.org/plugins/wp-easy-gallery/#developers - https://plugins.trac.wordpress.org/browser/wp-easy-gallery/trunk/wp-easy-gallery.php#L866
CVE ID: CVE-2024-9019 State: PUBLISHED Published: 2025-02-28T08:23:15.912Z Last Updated: 2025-02-28T13:38:35.554Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: secupress Products: SecuPress Free — WordPress Security Problem Types: CWE-79 Description: The SecuPress Free — WordPress Security plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's secupress_check_ban_ips_form shortcode in all versions up to, and including, 2.2.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web
s. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/56e842c8-61ac-4281-8c4a-9cb1f8ecc062?source=cve - https://plugins.trac.wordpress.org/browser/secupress/trunk/free/common.php#L238
CVE ID: CVE-2024-9020 State: PUBLISHED Published: 2025-01-18T06:00:05.173Z Last Updated: 2025-01-22T14:18:23.161Z Vendors: Unknown Products: List category posts Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The List category posts WordPress plugin before 0.90.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/6caa4e5d-8112-4d00-8e97-b41df611a071/
CVE ID: CVE-2024-9021 State: PUBLISHED Published: 2024-10-08T06:00:05.067Z Last Updated: 2024-10-09T15:20:50.596Z Vendors: Unknown Products: Relevanssi Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: In the process of testing the Relevanssi WordPress plugin before 4.23.1, a vulnerability was found that allows you to implement Stored XSS on behalf of the Contributor+ by embedding malicious script, which entails account takeover backdoor Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5f25646d-b80b-40b1-bcaf-3b860ddc4059/