Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-12297 State: PUBLISHED Published: 2025-01-15T10:00:46.524Z Last Updated: 2025-03-06T08:27:52.297Z Vendors: Moxa Products: EDS-508A Series, PT-508 Series, PT-510 Series, PT-7528 Series, PT-7728 Series, PT-7828 Series, PT-G503 Series, PT-G510 Series, PT-G7728 Series, PT-G7828 Series Problem Types: CWE-656 Description: Moxa’s Ethernet switch is vulnerable to an authentication bypass because of flaws in its authorization mechanism. Although both client-side and back-end server verification are involved in the process, attackers can exploit weaknesses in its implementation. These vulnerabilities may enable brute-force attacks to guess valid credentials or MD5 collision attacks to
lementation. These vulnerabilities may enable brute-force attacks to guess valid credentials or MD5 collision attacks to forge authentication hashes, potentially compromising the security of the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241407-cve-2024-12297-frontend-authorization-logic-disclosure-vulnerability-in-eds-508a-series - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241408-cve-2024-12297-frontend-authorization-logic-disclosure-vulnerability-identified-in-pt-switches
CVE ID: CVE-2024-12298 State: PUBLISHED Published: 2025-01-14T00:45:38.605Z Last Updated: 2025-01-14T15:29:49.972Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: OMRON Corporation Products: Programable Terminals NB-Designer Problem Types: CWE-611 Description: We found a vulnerability Improper Restriction of XML External Entity Reference (CWE-611) in NB-series NX-Designer. Attackers may be able to abuse this vulnerability to disclose confidential data on a computer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2025-002_en.pdf - https://www.fa.omron.co.jp/product/security/asset
w.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2025-002_en.pdf - https://www.fa.omron.co.jp/product/security/assets/pdf/ja/OMSR-2025-002_ja.pdf
CVE ID: CVE-2024-12299 State: PUBLISHED Published: 2025-01-30T13:42:06.561Z Last Updated: 2025-01-30T14:42:39.737Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: qriouslad Products: System Dashboard Problem Types: CWE-79 Description: The System Dashboard plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Filename parameter in all versions up to, and including, 2.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrative user into performing an action such as clicking on a
ages that execute if they can successfully trick an administrative user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/993670b7-a3ea-497d-ad46-881bd47b9346?source=cve - https://plugins.trac.wordpress.org/browser/system-dashboard/tags/2.8.15/admin/class-system-dashboard-admin.php#L2323
CVE ID: CVE-2024-12300 State: PUBLISHED Published: 2024-12-13T03:24:35.103Z Last Updated: 2024-12-13T20:26:26.182Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: webandprint Products: AR for WordPress Problem Types: CWE-862 Description: The AR for WordPress plugin for WordPress is vulnerable to unauthorized double extension file upload due to a missing capability check on the set_ar_featured_image() function in all versions up to, and including, 7.3. This makes it possible for unauthenticated attackers to upload php files leveraging a double extension attack. It's important to note the file is deleted immediately and double extension attacks only work on selec
extension attack. It's important to note the file is deleted immediately and double extension attacks only work on select servers making this unlikely to be successfully exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8b507369-49f7-4a1d-900b-c7bef40aec96?source=cve - https://plugins.trac.wordpress.org/browser/ar-for-wordpress/trunk/includes/ar-add-media.php?rev=3177638 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3206666%40ar-for-wordpress%2Ftrunk&old=3205240%40ar-for-wordpress%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12301 State: PUBLISHED Published: 2025-05-15T20:06:52.758Z Last Updated: 2025-05-20T19:33:00.155Z Vendors: Unknown Products: JSP Store Locator Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The JSP Store Locator WordPress plugin through 1.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5d93db07-415f-475b-a76d-2e12f849a4dc/
CVE ID: CVE-2024-12302 State: PUBLISHED Published: 2025-01-06T06:00:14.809Z Last Updated: 2025-01-06T13:37:41.018Z Vendors: Unknown Products: Icegram Engage Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its Campaign settings, which could allow authors and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ed860dac-8c4a-482f-8826-31f1a894b6ce/
CVE ID: CVE-2024-12303 State: PUBLISHED Published: 2025-08-13T17:27:45.555Z Last Updated: 2025-08-13T20:00:25.961Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L) Vendors: GitLab Products: GitLab Problem Types: CWE-266 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 17.7 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that under certain conditions could have allowed authenticated users with specific roles and permissions to delete issues including confidential ones by inviting users with a specific role. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/508298
e. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/508298 - https://hackerone.com/reports/2861889
CVE ID: CVE-2024-12304 State: PUBLISHED Published: 2025-01-11T03:21:03.438Z Last Updated: 2025-01-13T19:27:16.524Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: britner Products: Gutenberg Blocks with AI by Kadence WP – Page Builder Features Problem Types: CWE-79 Description: The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via button block link in all versions up to, and including, 3.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in
es it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c300c485-e5ab-48b3-99e8-0def5668ef4a?source=cve - https://plugins.trac.wordpress.org/changeset/3212269/kadence-blocks/tags/3.4.3/includes/blocks/class-kadence-blocks-singlebtn-block.php
CVE ID: CVE-2024-12305 State: PUBLISHED Published: 2024-12-09T08:49:53.971Z Last Updated: 2024-12-09T15:30:21.269Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Unifiedtransform Products: Unifiedtransform Problem Types: CWE-639 Description: An object-level access control vulnerability in Unifiedtransform version 2.0 and potentially earlier versions allows unauthorized access to student grades. A malicious student user can view grades of other students by manipulating the student_id parameter in the marks viewing endpoint. The vulnerability exists due to insufficient access control checks in MarkController.php. At the time of publication of the CVE no patch
y exists due to insufficient access control checks in MarkController.php. At the time of publication of the CVE no patch is available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/90a7299e-9233-43fd-b666-7375c4fdbb3c
CVE ID: CVE-2024-12306 State: PUBLISHED Published: 2024-12-09T08:50:23.241Z Last Updated: 2024-12-09T15:27:21.662Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Unifiedtransform Products: Unifiedtransform Problem Types: CWE-284, CWE-639 Description: Multiple access control vulnerabilities in Unifiedtransform version 2.0 and potentially earlier versions allow unauthorized access to personal information of students and teachers. The vulnerabilities include both function-level access control issues in list viewing endpoints and object-level access control issues in profile viewing endpoints. A malicious student user can access personal information of other st
access control issues in profile viewing endpoints. A malicious student user can access personal information of other students and teachers through these vulnerabilities. At the time of publication of the CVE no patch is available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/90a7299e-9233-43fd-b666-7375c4fdbb3c
CVE ID: CVE-2024-12307 State: PUBLISHED Published: 2024-12-09T08:50:45.498Z Last Updated: 2024-12-09T15:28:13.019Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Unifiedtransform Products: Unifiedtransform Problem Types: CWE-284 Description: A function-level access control vulnerability in Unifiedtransform version 2.0 and potentially earlier versions allows teachers to modify student personal data without proper authorization. The vulnerability exists due to missing access control checks in the student editing functionality. At the time of publication of the CVE no patch is available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
publication of the CVE no patch is available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/90a7299e-9233-43fd-b666-7375c4fdbb3c
CVE ID: CVE-2024-12308 State: PUBLISHED Published: 2025-02-24T06:00:02.865Z Last Updated: 2025-02-24T11:32:57.320Z Vendors: Unknown Products: Logo Slider Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Logo Slider WordPress plugin before 4.6.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/fa82ada7-357b-4f01-a0d6-ff633b188a80/
CVE ID: CVE-2024-12309 State: PUBLISHED Published: 2024-12-13T08:24:51.699Z Last Updated: 2024-12-16T16:41:21.316Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: collizo4sky Products: Rate My Post – Star Rating Plugin by FeedbackWP Problem Types: CWE-639 Description: The Rate My Post – Star Rating Plugin by FeedbackWP plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.4 via the get_post_status() due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to vote on unpublished scheduled posts. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
henticated attackers to vote on unpublished scheduled posts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c9aa467f-9ac2-4a84-b0bb-761101733af7?source=cve - https://plugins.trac.wordpress.org/changeset/3206801/rate-my-post/trunk/public/class-rate-my-post-public.php
CVE ID: CVE-2024-12310 State: PUBLISHED Published: 2025-07-23T11:53:28.743Z Last Updated: 2025-07-23T12:56:51.950Z Vendors: Imprivata Products: Enterprise Access Management Problem Types: CWE-287 Description: A vulnerability in Imprivata Enterprise Access Management (formerly Imprivata OneSign) allows bypassing the login screen of the shared kiosk workstation and allows unauthorized access to the underlying Windows system through the already logged-in autologon account due to insufficient handling of keyboard shortcuts. This issue affects Imprivata Enterprise Access Management versions 5.3 through 24.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.redguard.ch/
ent versions 5.3 through 24.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.redguard.ch/blog/2025/07/23/cve-2024-12310-imprivata-bypass-of-login-screen/
CVE ID: CVE-2024-12311 State: PUBLISHED Published: 2025-01-06T06:00:15.943Z Last Updated: 2025-01-06T13:35:28.411Z Vendors: Unknown Products: Email Subscribers by Icegram Express Problem Types: CWE-89 SQL Injection Description: The Email Subscribers by Icegram Express WordPress plugin before 5.7.44 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5e00ba37-da7f-4703-a0b9-65237696fbdd/
CVE ID: CVE-2024-12312 State: PUBLISHED Published: 2024-12-12T06:46:34.034Z Last Updated: 2024-12-12T15:45:32.579Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: johnwwweissberg Products: Print Science Designer Problem Types: CWE-502 Description: The Print Science Designer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.152 via deserialization of untrusted input through the 'designer-saved-projects' cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installe
wn POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8008b5e2-f3b4-492c-8e50-b673f725b2b1?source=cve - https://plugins.trac.wordpress.org/browser/print-science-designer/tags/1.3.152/includes/saved-projects.php#L120 - https://plugins.trac.wordpress.org/browser/print-science-designer/tags/1.3.153/includes/saved-projects.php#L120
CVE ID: CVE-2024-12313 State: PUBLISHED Published: 2025-01-07T04:22:01.100Z Last Updated: 2025-01-07T16:23:10.752Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: a3rev Products: Compare Products for WooCommerce Problem Types: CWE-502 Description: The Compare Products for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.1 via deserialization of untrusted input from the 'woo_compare_list' cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed
POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/638e8e67-38b3-4fc4-bd77-8f268030a93a?source=cve - https://plugins.trac.wordpress.org/browser/woocommerce-compare-products/trunk/classes/class-wc-compare-functions.php#L219 - https://plugins.trac.wordpress.org/browser/woocommerce-compare-products/trunk/classes/class-wc-compare-functions.php#L237 - https://plugins.trac.wordpress.org/brows
oocommerce-compare-products/trunk/classes/class-wc-compare-functions.php#L237 - https://plugins.trac.wordpress.org/browser/woocommerce-compare-products/trunk/classes/class-wc-compare-functions.php#L256 - https://plugins.trac.wordpress.org/browser/woocommerce-compare-products/trunk/classes/class-wc-compare-functions.php#L275
CVE ID: CVE-2024-12314 State: PUBLISHED Published: 2025-02-18T04:21:17.575Z Last Updated: 2025-02-18T17:07:04.172Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: megaoptim Products: Rapid Cache Problem Types: CWE-524 Description: The Rapid Cache plugin for WordPress is vulnerable to Cache Poisoning in all versions up to, and including, 1.2.3. This is due to plugin storing HTTP headers in the cached data. This makes it possible for unauthenticated attackers to poison the cache with custom HTTP headers that may be unsanitized which can lead to Cross-Site Scripting. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat
Cross-Site Scripting. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/72b777ac-1870-4588-82fe-da96a784ec81?source=cve - https://wordpress.org/plugins/rapid-cache/
CVE ID: CVE-2024-12315 State: PUBLISHED Published: 2025-02-12T08:25:42.626Z Last Updated: 2025-02-18T17:38:41.285Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: smackcoders Products: Export All Posts, Products, Orders, Refunds & Users Problem Types: CWE-922 Description: The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.3 via the exports directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/smack_uci_uploads/exports/ directory which can contain information like exp
stored insecurely in the /wp-content/uploads/smack_uci_uploads/exports/ directory which can contain information like exported user data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/075709e0-5f00-4d7b-80f6-96e3b4b4a895?source=cve - https://plugins.trac.wordpress.org/browser/wp-ultimate-exporter/trunk/exportExtensions/ExportExtension.php#L1678 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3230400%40wp-ultimate-exporter&new=3230400%40wp-ultimate-exporter&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12316 State: PUBLISHED Published: 2025-01-07T11:11:10.560Z Last Updated: 2025-01-07T14:22:43.323Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: artbees Products: Jupiter X Core Problem Types: CWE-862 Description: The Jupiter X Core plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_popup_action() function in all versions up to, and including, 4.8.5. This makes it possible for unauthenticated attackers to export popup templates. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5db195c1-8917-4465-a5ca-21089
ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5db195c1-8917-4465-a5ca-21089afb0bc7?source=cve - https://plugins.trac.wordpress.org/browser/jupiterx-core/trunk/includes/popups/class.php#L475 - https://plugins.trac.wordpress.org/changeset/3214798/jupiterx-core/trunk/includes/popups/class.php
CVE ID: CVE-2024-12320 State: PUBLISHED Published: 2025-01-30T13:42:01.451Z Last Updated: 2025-01-30T14:39:52.484Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: markodonnell Products: Team Rosters Problem Types: CWE-79 Description: The Team Rosters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in all versions up to, and including, 4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst No
xecute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/86b85505-8cae-4607-a645-5b127f6f37e7?source=cve - https://plugins.trac.wordpress.org/browser/team-rosters/trunk/includes/mstw-tr-settings.php#L54 - https://plugins.trac.wordpress.org/browser/team-rosters/trunk/includes/mstw-tr-settings.php#L126
CVE ID: CVE-2024-12321 State: PUBLISHED Published: 2025-01-27T06:00:05.621Z Last Updated: 2025-01-27T20:45:07.195Z Vendors: Unknown Products: WC Affiliate Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WC Affiliate WordPress plugin through 2.3.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d4c55d30-1c15-41ee-95e0-670891d67684/
CVE ID: CVE-2024-12322 State: PUBLISHED Published: 2025-01-07T04:22:22.399Z Last Updated: 2025-01-07T16:17:58.274Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: theperfectwedding Products: ThePerfectWedding.nl Widget Problem Types: CWE-352 Description: The ThePerfectWedding.nl Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8. This is due to missing or incorrect nonce validation on the 'update_option' function. This makes it possible for unauthenticated attackers to update the 'tpwKey' option with stored cross-site scripting via a forged request granted they can trick a site administrator into p
'tpwKey' option with stored cross-site scripting via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e996f71a-f0b9-4e10-873e-a0299a099dce?source=cve - https://plugins.trac.wordpress.org/browser/theperfectweddingnl-widget/trunk/admin/tpwAdminPanelTemplate.php#L4 - https://plugins.trac.wordpress.org/browser/theperfectweddingnl-widget/trunk/admin/tpwAdminPanelTemplate.php#L5 - https://plugins.trac.wordpress.org/browser/theperfectweddingnl-widget/trunk/admin/tpwAdminPanelTemplate.php#L28 - https://plugins.tra
ns.trac.wordpress.org/browser/theperfectweddingnl-widget/trunk/admin/tpwAdminPanelTemplate.php#L28 - https://plugins.trac.wordpress.org/browser/theperfectweddingnl-widget/trunk/admin/tpwAdminPanelTemplate.php#L48
CVE ID: CVE-2024-12323 State: PUBLISHED Published: 2024-12-10T14:28:14.657Z Last Updated: 2024-12-10T15:37:56.909Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: dueclic Products: turboSMTP Problem Types: CWE-79 Description: The turboSMTP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in all versions up to, and including, 4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link while logged in to turboSMTP. Ad