Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
to the public and may be used. The patch is named 8767ed0a77c4b02287db3723e92c2169f67c85d5. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-268791. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.268791 - https://vuldb.com/?ctiid.268791 - https://vuldb.com/?submit.356315 - https://github.com/gpac/gpac/issues/2873 - https://github.com/user-attachments/files/15801157/poc.zip - https://github.com/gpac/gpac/commit/8767ed0a77c4b02287db3723e92c2169f67c85d5
CVE ID: CVE-2024-6064 State: PUBLISHED Published: 2024-06-17T20:31:06.351Z Last Updated: 2024-08-01T21:25:03.370Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: GPAC Problem Types: CWE-416 Description: A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master. It has been declared as problematic. This vulnerability affects the function xmt_node_end of the file src/scene_manager/loader_xmt.c of the component MP4Box. The manipulation leads to use after free. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The name of the patch is f4b3e4d2f91bc1749e7a924a8ab171af03a355a8/c1b
has been disclosed to the public and may be used. The name of the patch is f4b3e4d2f91bc1749e7a924a8ab171af03a355a8/c1b9c794bad8f262c56f3cf690567980d96662f5. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-268792. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.268792 - https://vuldb.com/?ctiid.268792 - https://vuldb.com/?submit.356316 - https://github.com/gpac/gpac/issues/2874 - https://github.com/user-attachments/files/15801189/poc.zip - https://github.com/gpac/gpac/commit/c1b9c794bad8f262c56f3cf690567980d96662f5
CVE ID: CVE-2024-6065 State: PUBLISHED Published: 2024-06-17T21:00:07.211Z Last Updated: 2024-08-01T21:25:03.206Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: itsourcecode Products: Bakery Online Ordering System Problem Types: CWE-89 Description: A vulnerability was found in itsourcecode Bakery Online Ordering System 1.0. It has been rated as critical. This issue affects some unknown processing of the file index.php. The manipulation of the argument user_email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-268793 was assigned to this vulnerability. Additional Analyst Notes: - CISA
public and may be used. The identifier VDB-268793 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.268793 - https://vuldb.com/?ctiid.268793 - https://vuldb.com/?submit.358386 - https://github.com/ppp-src/CVE/issues/4
CVE ID: CVE-2024-6066 State: PUBLISHED Published: 2024-06-17T21:00:09.026Z Last Updated: 2024-08-01T21:25:03.308Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Best House Rental Management System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in SourceCodester Best House Rental Management System 1.0. Affected is an unknown function of the file payment_report.php. The manipulation of the argument month_of leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-268794 is the identifier assigned to this vulnerability. Additional Analys
disclosed to the public and may be used. VDB-268794 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.268794 - https://vuldb.com/?ctiid.268794 - https://vuldb.com/?submit.358439 - https://github.com/jadu101/CVE/blob/main/SourceCodester_House_Rental_Management_System_Sqli.md
CVE ID: CVE-2024-6067 State: PUBLISHED Published: 2024-06-17T21:31:04.320Z Last Updated: 2024-08-01T21:25:03.247Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Music Class Enrollment System Problem Types: CWE-89 Description: A vulnerability classified as critical was found in SourceCodester Music Class Enrollment System 1.0. Affected by this vulnerability is an unknown functionality of the file /mces/?p=class/view_class. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-268795. Additional An
en disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-268795. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.268795 - https://vuldb.com/?ctiid.268795 - https://vuldb.com/?submit.358566 - https://github.com/jadu101/CVE/blob/main/SourceCodester-Musical-Class-Enrollment-System-SQLi.md
CVE ID: CVE-2024-6068 State: PUBLISHED Published: 2024-11-14T16:22:03.883Z Last Updated: 2024-11-14T16:59:43.395Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Rockwell Automation Products: Arena Input Analyzer Problem Types: CWE-1284 Description: A memory corruption vulnerability exists in the affected products when parsing DFT files. Local threat actors can exploit this issue to disclose information and to execute arbitrary code. To exploit this vulnerability a legitimate user must open a malicious DFT file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD
SA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD17011.html
CVE ID: CVE-2024-6069 State: PUBLISHED Published: 2024-07-09T08:33:11.030Z Last Updated: 2024-08-01T21:25:03.242Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: genetechproducts Products: Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction Problem Types: CWE-862 Missing Authorization Description: The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation and activation/deactivation due to missing capability checks on th
nerable to unauthorized arbitrary plugin installation and activation/deactivation due to missing capability checks on the pieregister_install_addon, pieregister_activate_addon and pieregister_deactivate_addon functions in all versions up to, and including, 3.8.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install, activate and deactivate arbitrary plugins. As a result attackers might achieve code execution on the targeted server Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b946ee73-4cf9-48c8-b456-285b118c6b05?source=cve - https://plugins
ps://www.wordfence.com/threat-intel/vulnerabilities/id/b946ee73-4cf9-48c8-b456-285b118c6b05?source=cve - https://plugins.trac.wordpress.org/browser/pie-register/tags/3.8.3.4/pie-register.php#L794 - https://plugins.trac.wordpress.org/browser/pie-register/tags/3.8.3.4/pie-register.php#L727 - https://plugins.trac.wordpress.org/browser/pie-register/tags/3.8.3.4/pie-register.php#L761
CVE ID: CVE-2024-6070 State: PUBLISHED Published: 2024-07-13T06:00:13.366Z Last Updated: 2024-08-01T21:25:03.271Z Vendors: Unknown Products: If-So Dynamic Content Personalization Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/97bab6cf-011c-4df4-976c
- CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/97bab6cf-011c-4df4-976c-1f3252082f8f/
CVE ID: CVE-2024-6071 State: PUBLISHED Published: 2024-06-27T23:05:03.183Z Last Updated: 2024-08-01T21:25:03.240Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: PTC Products: Creo Elements/Direct License Problem Types: CWE-862 Description: PTC Creo Elements/Direct License Server exposes a web interface which can be used by unauthenticated remote attackers to execute arbitrary OS commands on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-177-02 - https://www.ptc.com/en/support/article/CS417607
CVE ID: CVE-2024-6072 State: PUBLISHED Published: 2024-07-15T06:00:04.074Z Last Updated: 2024-08-01T21:25:03.322Z Vendors: Unknown Products: wp-cart-for-digital-products Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/1d8a344b-37e9-41e8-9de0-c67b7ca8e21b/
CVE ID: CVE-2024-6073 State: PUBLISHED Published: 2024-07-15T06:00:04.974Z Last Updated: 2024-08-01T21:25:03.205Z Vendors: Unknown Products: wp-cart-for-digital-products Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/f04994bc-9eef-46de-995b-8598f7a749c4/
CVE ID: CVE-2024-6074 State: PUBLISHED Published: 2024-07-15T06:00:05.374Z Last Updated: 2024-08-01T21:25:03.266Z Vendors: Unknown Products: wp-cart-for-digital-products Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/e518af46-cb8e-43ff-a7c1-5300b36d9113/
CVE ID: CVE-2024-6075 State: PUBLISHED Published: 2024-07-15T06:00:05.607Z Last Updated: 2024-08-01T21:25:03.263Z Vendors: Unknown Products: wp-cart-for-digital-products Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/b0e2658a-b075-48b6-a9d9-e141194117fc/
CVE ID: CVE-2024-6076 State: PUBLISHED Published: 2024-07-15T06:00:05.868Z Last Updated: 2024-08-01T21:25:03.197Z Vendors: Unknown Products: wp-cart-for-digital-products Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/8369a2d8-1780-40c3-90ff-a826b9e9afd4/
CVE ID: CVE-2024-6077 State: PUBLISHED Published: 2024-09-12T19:59:40.368Z Last Updated: 2024-09-12T21:01:50.254Z Vendors: Rockwell Automation Products: CompactLogix 5380, CompactLogix 5380 Process, Compact GuardLogix 5380 SIL 2, Compact GuardLogix 5380 SIL 3, CompactLogix 5480, ControlLogix® 5580, ControlLogix® 5580 Process, GuardLogix 5580, 1756-EN4 Problem Types: CWE-20 Description: A denial-of-service vulnerability exists in the Rockwell Automation affected products when specially crafted packets are sent to the CIP Security Object. If exploited the device will become unavailable and require a factory reset to recover. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
navailable and require a factory reset to recover. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1963.html
CVE ID: CVE-2024-6078 State: PUBLISHED Published: 2024-08-14T19:45:08.139Z Last Updated: 2024-08-19T18:43:37.917Z Vendors: Rockwell Automation Products: DataMosaix™ Problem Types: CWE-287 Description: CVE-2024-6078 IMPACT An improper authentication vulnerability exists in the affected product, which could allow a malicious user to generate cookies for any user ID without the use of a username or password. If exploited, a malicious user could take over the account of a legitimate user. The malicious user would be able to view and modify data stored in the cloud. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advi
nalyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD%201687.html
CVE ID: CVE-2024-6079 State: PUBLISHED Published: 2024-08-13T17:46:24.950Z Last Updated: 2024-08-21T16:44:29.747Z Vendors: Rockwell Automation Products: Emulate3D™ Problem Types: CWE-610 Description: A vulnerability exists in the Rockwell Automation Emulate3D™, which could be leveraged to execute a DLL Hijacking attack. The application loads shared libraries, which are readable and writable by any user. If exploited, a malicious user could leverage a malicious dll and perform a remote code execution attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD%201683.html
CVE ID: CVE-2024-6080 State: PUBLISHED Published: 2024-06-17T23:00:05.125Z Last Updated: 2024-11-04T19:13:12.474Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Intelbras Products: InControl Problem Types: CWE-428, CWE-426 Description: A vulnerability classified as critical was found in Intelbras InControl 2.21.56. This vulnerability affects unknown code of the component incontrolWebcam Service. The manipulation leads to unquoted search path. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 2.21.58 is able to address this issue. It is recommended to upgrade the affected compon
ay be used. Upgrading to version 2.21.58 is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early about this disclosure and plans to provide a solution within the next few weeks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.268822 - https://vuldb.com/?ctiid.268822 - https://vuldb.com/?submit.353502 - https://backend.intelbras.com/sites/default/files/2024-10/Aviso%20de%20Seguran%C3%A7a%20-%20Incontrol%202.21.56%20e%202.21.57.pdf - https://download.cronos.intelbras.com.br/download/INCONTROL/INCONTROL-WEB/prod/INCONTROL-WEB-2.21.58-233dfd1ac1e2ca3eabb71c854005c78b.exe
CVE ID: CVE-2024-6081 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:05:44.787Z Description: No description available.
CVE ID: CVE-2024-6082 State: PUBLISHED Published: 2024-06-17T23:00:06.893Z Last Updated: 2024-08-01T21:25:03.225Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: n/a Products: PHPVibe Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in PHPVibe 11.0.46. This issue affects some unknown processing of the file functionalities.global.php of the component Global Options Page. The manipulation of the argument site-logo-text leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-268823. NOTE: The vendor
isclosed to the public and may be used. The associated identifier of this vulnerability is VDB-268823. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.268823 - https://vuldb.com/?ctiid.268823 - https://vuldb.com/?submit.353548 - https://github.com/WeikFu/PHPVibe-vulnerability-description/issues/1
CVE ID: CVE-2024-6083 State: PUBLISHED Published: 2024-06-17T23:31:03.508Z Last Updated: 2024-09-03T17:42:07.637Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: PHPVibe Problem Types: CWE-434 Description: A vulnerability, which was classified as critical, was found in PHPVibe 11.0.46. Affected is an unknown function of the file /app/uploading/upload-mp3.php of the component Media Upload Page. The manipulation of the argument file leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-268824. NOTE: The vendor was contacted early about this
ic and may be used. The identifier of this vulnerability is VDB-268824. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.268824 - https://vuldb.com/?ctiid.268824 - https://vuldb.com/?submit.353552 - https://github.com/WeikFu/PHPVibe-vulnerability-description/issues/2
CVE ID: CVE-2024-6084 State: PUBLISHED Published: 2024-06-18T00:31:04.309Z Last Updated: 2024-08-01T21:25:03.269Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: itsourcecode Products: Pool of Bethesda Online Reservation System Problem Types: CWE-434 Description: A vulnerability has been found in itsourcecode Pool of Bethesda Online Reservation System up to 1.0 and classified as critical. Affected by this vulnerability is the function uploadImage of the file /admin/mod_room/controller.php?action=add. The manipulation of the argument image leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifie
upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-268825 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.268825 - https://vuldb.com/?ctiid.268825 - https://vuldb.com/?submit.358628 - https://github.com/Laster-dev/CVE/issues/2
CVE ID: CVE-2024-6085 State: PUBLISHED Published: 2024-06-27T18:45:15.903Z Last Updated: 2024-08-01T21:25:03.365Z Severity: HIGH (CVSS 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: parisneo Products: parisneo/lollms Problem Types: CWE-22 Description: A path traversal vulnerability exists in the XTTS server included in the lollms package, version v9.6. This vulnerability arises from the ability to perform an unauthenticated root folder settings change. Although the read file endpoint is protected against path traversals, this protection can be bypassed by changing the root folder to '/'. This allows attackers to read arbitrary files on the system. Additionally, the output folders
ng the root folder to '/'. This allows attackers to read arbitrary files on the system. Additionally, the output folders can be changed to write arbitrary audio files to any location on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/d2fb73d7-4b4f-451a-8763-484c189a27fe
CVE ID: CVE-2024-6086 State: PUBLISHED Published: 2024-06-27T18:46:15.133Z Last Updated: 2025-10-15T12:49:45.527Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-863 Description: In version 1.2.7 of lunary-ai/lunary, any authenticated user, regardless of their role, can change the name of an organization due to improper access control. The function checkAccess() is not implemented, allowing users with the lowest privileges, such as the 'Prompt Editor' role, to modify organization attributes without proper authorization. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Referenc
butes without proper authorization. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/9e83f63f-c5c1-422f-8010-95c353f0c643 - https://github.com/lunary-ai/lunary/commit/3451fcd7b9d95e9091d62c515752f39f2faa6e54
CVE ID: CVE-2024-6087 State: PUBLISHED Published: 2024-09-13T16:12:15.921Z Last Updated: 2025-10-15T12:49:46.200Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-639 Description: An improper access control vulnerability exists in lunary-ai/lunary at the latest commit (a761d83) on the main branch. The vulnerability allows an attacker to use the auth tokens issued by the 'invite user' functionality to obtain valid JWT tokens. These tokens can be used to compromise target users upon registration for their own arbitrary organizations. The attacker can invite a target email, obtain a one-time use token, retr
tration for their own arbitrary organizations. The attacker can invite a target email, obtain a one-time use token, retract the invite, and later use the token to reset the password of the target user, leading to full account takeover. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/bd9f2301-11c7-4cbd-8d77-3e9225bd67e8 - https://github.com/lunary-ai/lunary/commit/844e8855c7a713dc7371766dba4125de4007b1cf
CVE ID: CVE-2024-6088 State: PUBLISHED Published: 2024-07-02T11:01:35.401Z Last Updated: 2024-08-01T21:33:03.291Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: thimpress Products: LearnPress – WordPress LMS Plugin Problem Types: CWE-862 Missing Authorization Description: The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized user registration due to a missing capability check on the 'register' function in all versions up to, and including, 4.2.6.8.1. This makes it possible for unauthenticated attackers to bypass disabled user registration to create a new account with the default role. Additional Analyst Notes: - CISA ADP V
bypass disabled user registration to create a new account with the default role. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/04e0ddff-16af-4c85-b5b0-cf767684ee08?source=cve - https://plugins.trac.wordpress.org/browser/learnpress/tags/4.2.6.8.1/inc/jwt/includes/class-jwt-public.php#L127 - https://plugins.trac.wordpress.org/browser/learnpress/tags/4.2.6.8.1/inc/class-lp-forms-handler.php#L235 - https://plugins.trac.wordpress.org/changeset/3109339/