Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-2937 State: PUBLISHED Published: 2024-08-05T11:31:07.833Z Last Updated: 2024-09-30T15:56:26.093Z Vendors: Arm Ltd Products: Bifrost GPU Kernel Driver, Valhall GPU Kernel Driver, Arm 5th Gen GPU Architecture Kernel Driver Problem Types: CWE-416 Description: Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r41p0 through r49p0; Valhall GPU Kernel Driver: from r41p0 through r49p0; Arm 5th Gen GPU Architec
U Kernel Driver: from r41p0 through r49p0; Valhall GPU Kernel Driver: from r41p0 through r49p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE ID: CVE-2024-2938 State: PUBLISHED Published: 2024-03-27T01:00:06.067Z Last Updated: 2024-08-22T19:33:22.033Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Campcodes Products: Online Examination System Problem Types: CWE-89 Description: A vulnerability was found in Campcodes Online Examination System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /adminpanel/admin/facebox_modal/updateCourse.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258029 was assigned to this vulnerability. Additional Analy
disclosed to the public and may be used. The identifier VDB-258029 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.258029 - https://vuldb.com/?ctiid.258029 - https://vuldb.com/?submit.304746 - https://github.com/Beatriz-ai-boop/cve/blob/main/report/1.pdf
CVE ID: CVE-2024-2939 State: PUBLISHED Published: 2024-03-27T01:00:08.113Z Last Updated: 2024-08-01T19:32:42.325Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Campcodes Products: Online Examination System Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in Campcodes Online Examination System 1.0. Affected is an unknown function of the file /adminpanel/admin/facebox_modal/updateExaminee.php. The manipulation of the argument id leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-258030 is the identifier assigned to this vulnerability. Additional An
been disclosed to the public and may be used. VDB-258030 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.258030 - https://vuldb.com/?ctiid.258030 - https://vuldb.com/?submit.304747 - https://github.com/Beatriz-ai-boop/cve/blob/main/report/2.pdf
CVE ID: CVE-2024-2940 State: PUBLISHED Published: 2024-03-27T01:31:04.287Z Last Updated: 2024-08-01T19:32:42.535Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Campcodes Products: Online Examination System Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in Campcodes Online Examination System 1.0. Affected by this vulnerability is an unknown functionality of the file /adminpanel/admin/facebox_modal/updateCourse.php. The manipulation of the argument id leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258031.
xploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258031. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.258031 - https://vuldb.com/?ctiid.258031 - https://vuldb.com/?submit.304748 - https://github.com/Beatriz-ai-boop/cve/blob/main/report/3.pdf
CVE ID: CVE-2024-2941 State: PUBLISHED Published: 2024-03-27T02:00:05.644Z Last Updated: 2024-08-01T19:32:42.341Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Campcodes Products: Online Examination System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in Campcodes Online Examination System 1.0. Affected by this issue is some unknown functionality of the file /adminpanel/admin/query/loginExe.php. The manipulation of the argument pass leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258032. Additional Analyst
has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258032. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.258032 - https://vuldb.com/?ctiid.258032 - https://vuldb.com/?submit.304757 - https://github.com/E1CHO/cve_hub/blob/main/Online%20Examination%20System/Online%20Examination%20System%20-%20vuln%201.pdf
CVE ID: CVE-2024-2942 State: PUBLISHED Published: 2024-03-27T02:00:07.466Z Last Updated: 2024-08-12T15:05:11.062Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Campcodes Products: Online Examination System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in Campcodes Online Examination System 1.0. This affects an unknown part of the file /adminpanel/admin/query/deleteQuestionExe.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258033 was assigned to this vulnerability. Additional Analyst
sclosed to the public and may be used. The identifier VDB-258033 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.258033 - https://vuldb.com/?ctiid.258033 - https://vuldb.com/?submit.304758 - https://github.com/E1CHO/cve_hub/blob/main/Online%20Examination%20System/Online%20Examination%20System%20-%20vuln%202.pdf
CVE ID: CVE-2024-2943 State: PUBLISHED Published: 2024-03-27T02:31:04.781Z Last Updated: 2024-08-22T19:32:40.698Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Campcodes Products: Online Examination System Problem Types: CWE-89 Description: A vulnerability has been found in Campcodes Online Examination System 1.0 and classified as critical. This vulnerability affects unknown code of the file /adminpanel/admin/query/deleteExamExe.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-258034 is the identifier assigned to this vulnerability. Additional Analyst Notes:
d to the public and may be used. VDB-258034 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.258034 - https://vuldb.com/?ctiid.258034 - https://vuldb.com/?submit.304759 - https://github.com/E1CHO/cve_hub/blob/main/Online%20Examination%20System/Online%20Examination%20System%20-%20vuln%203.pdf
CVE ID: CVE-2024-2944 State: PUBLISHED Published: 2024-03-27T02:31:06.230Z Last Updated: 2025-04-10T20:07:32.345Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Campcodes Products: Online Examination System Problem Types: CWE-89 Description: A vulnerability was found in Campcodes Online Examination System 1.0 and classified as critical. This issue affects some unknown processing of the file /adminpanel/admin/query/deleteCourseExe.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258035. Additional Analyst Notes
d to the public and may be used. The associated identifier of this vulnerability is VDB-258035. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.258035 - https://vuldb.com/?ctiid.258035 - https://vuldb.com/?submit.304760 - https://github.com/E1CHO/cve_hub/blob/main/Online%20Examination%20System/Online%20Examination%20System%20-%20vuln%204.pdf
CVE ID: CVE-2024-2945 State: PUBLISHED Published: 2024-03-27T03:00:05.068Z Last Updated: 2024-08-01T19:32:42.230Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Campcodes Products: Online Examination System Problem Types: CWE-89 Description: A vulnerability was found in Campcodes Online Examination System 1.0. It has been classified as critical. Affected is an unknown function of the file /adminpanel/admin/facebox_modal/updateExaminee.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258036. Additional Analyst Not
been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258036. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.258036 - https://vuldb.com/?ctiid.258036 - https://vuldb.com/?submit.304762 - https://github.com/E1CHO/cve_hub/blob/main/Online%20Examination%20System/Online%20Examination%20System%20-%20vuln%205.pdf
CVE ID: CVE-2024-2946 State: PUBLISHED Published: 2024-04-09T18:59:25.791Z Last Updated: 2024-08-01T19:32:42.356Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: devitemsllc Products: ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's QR Code Widget in all versions up to, and inclu
WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's QR Code Widget in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d8e64525-6080-40f3-a296-389b800a5e8a?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=306425
3-a296-389b800a5e8a?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3064259%40woolentor-addons&new=3064259%40woolentor-addons&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2947 State: PUBLISHED Published: 2024-03-28T18:31:59.249Z Last Updated: 2025-11-20T19:07:19.457Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7 Problem Types: CWE-77 Description: A flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue affects Cockpit versions 270 and newer. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.red
and newer. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:3667 - https://access.redhat.com/errata/RHSA-2024:3843 - https://access.redhat.com/security/cve/CVE-2024-2947 - https://bugzilla.redhat.com/show_bug.cgi?id=2271614
CVE ID: CVE-2024-2948 State: PUBLISHED Published: 2024-03-30T07:36:30.300Z Last Updated: 2024-08-01T19:32:42.547Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: kylephillips Products: Favorites Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Favorites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'user_favorites' shortcode in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping on user supplied attributes such as 'no_favorites'. This makes it possible for authenticated attackers, with contributor-level
r supplied attributes such as 'no_favorites'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/38a87046-9a46-40c2-b10d-d1a7d5ef8742?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3061244%40favorites&new=3061244%40favorites&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2949 State: PUBLISHED Published: 2024-04-06T06:47:18.701Z Last Updated: 2024-08-01T19:32:42.463Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: shapedplugin Products: Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site S
l & Post Grid, Product Carousel & Product Grid for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the carousel widget in all versions up to, and including, 2.6.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9349208c-3e86-4ec6-9e10-5ecaa4923922?source=cve - https://plugins.trac.w
w.wordfence.com/threat-intel/vulnerabilities/id/9349208c-3e86-4ec6-9e10-5ecaa4923922?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3065296%40wp-carousel-free&new=3065296%40wp-carousel-free&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2950 State: PUBLISHED Published: 2024-04-06T03:24:44.633Z Last Updated: 2024-08-01T19:32:42.518Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: boldgrid Products: BoldGrid Easy SEO – Simple and Effective SEO Problem Types: CWE-200 Information Exposure Description: The BoldGrid Easy SEO – Simple and Effective SEO plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.6.14 via meta information (og:description) This makes it possible for unauthenticated attackers to view the first 130 characters of a password protected post which can contain sensitive information. Additional Analyst Notes: - CISA ADP
30 characters of a password protected post which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d502e617-a59f-4385-b050-3702a1b1ed7e?source=cve - https://plugins.trac.wordpress.org/browser/boldgrid-easy-seo/tags/1.6.15/includes/class-boldgrid-seo-admin.php?rev=3064911
CVE ID: CVE-2024-2951 State: PUBLISHED Published: 2024-03-26T18:03:41.675Z Last Updated: 2024-08-05T13:29:37.024Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Metagauss Products: RegistrationMagic Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Metagauss RegistrationMagic.This issue affects RegistrationMagic: from n/a through 5.3.0.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/custom-registration-form-builder-with-submission-manager/wordpress-registrationmagic-plugin-5-3-0-0-cross-site-request-forgery-csrf-vulnerability?_s_id
r-with-submission-manager/wordpress-registrationmagic-plugin-5-3-0-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-2952 State: PUBLISHED Published: 2024-04-10T17:07:52.935Z Last Updated: 2024-08-01T19:32:42.587Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: berriai Products: berriai/litellm Problem Types: CWE-76 Description: BerriAI/litellm is vulnerable to Server-Side Template Injection (SSTI) via the `/completions` endpoint. The vulnerability arises from the `hf_chat_template` method processing the `chat_template` parameter from the `tokenizer_config.json` file through the Jinja template engine without proper sanitization. Attackers can exploit this by crafting malicious `tokenizer_config.json` files that execute arbitrary code on the server. Addit
rs can exploit this by crafting malicious `tokenizer_config.json` files that execute arbitrary code on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/a9e0a164-6de0-43a4-a640-0cbfb54220a4 - https://github.com/berriai/litellm/commit/8a1cdc901708b07b7ff4eca20f9cb0f1f0e8d0b3
CVE ID: CVE-2024-2953 State: PUBLISHED Published: 2024-05-22T07:37:24.757Z Last Updated: 2024-08-01T19:32:42.458Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: theluckywp Products: LuckyWP Table of Contents Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The LuckyWP Table of Contents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Contributor permissions and above to inject arbitrary web scr
g. This makes it possible for authenticated attackers with Contributor permissions and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b12c0524-d991-4f96-8646-f4203880558c?source=cve - https://plugins.trac.wordpress.org/browser/luckywp-table-of-contents/tags/2.1.4/plugin/PostSettings.php#L207 - https://plugins.trac.wordpress.org/browser/luckywp-table-of-contents/tags/2.1.4/plugin/PostSettings.php#L209 - https://plugins.trac.wordpress.org/browser/luckywp-table-of-contents/tags/2.1.4/plugi
1.4/plugin/PostSettings.php#L209 - https://plugins.trac.wordpress.org/browser/luckywp-table-of-contents/tags/2.1.4/plugin/PostSettings.php#L210
CVE ID: CVE-2024-2954 State: PUBLISHED Published: 2024-03-27T06:40:51.010Z Last Updated: 2024-08-07T18:13:40.299Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: jonathankissam Products: Action Network Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Action Network plugin for WordPress is vulnerable to SQL Injection via the 'bulk-action' parameter in version 1.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append
ting SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fdf18ae2-f0d4-44d4-9dd1-6ac36d859d68?source=cve - https://blog.sth.sh/wordpress-action-network-1-4-3-authenticated-sql-injection-0-day-01fcd6e89e96
CVE ID: CVE-2024-2955 State: PUBLISHED Published: 2024-03-26T20:02:08.419Z Last Updated: 2025-11-03T21:54:35.524Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Wireshark Foundation Products: Wireshark Problem Types: CWE-762 Description: T.38 dissector crash in Wireshark 4.2.0 to 4.0.3 and 4.0.0 to 4.0.13 allows denial of service via packet injection or crafted capture file Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wireshark.org/security/wnpa-sec-2024-06.html - https://gitlab.com/wireshark/wireshark/-/issues/19695
CVE ID: CVE-2024-2956 State: PUBLISHED Published: 2024-03-27T07:34:51.994Z Last Updated: 2024-08-02T18:29:02.484Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: specialk Products: Simple Ajax Chat – Add a Fast, Secure Chat Box Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 20231101 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-leve
ient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9e9e0214-b88e-4125-8c10-850ca736e920?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3037001%40simple-ajax-chat&new=3037001%40simple-ajax-chat&sfp_email=&sfp
g/changeset?sfp_email=&sfph_mail=&reponame=&old=3037001%40simple-ajax-chat&new=3037001%40simple-ajax-chat&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2957 State: REJECTED Published: 2024-04-09T18:59:34.320Z Last Updated: 2024-04-24T15:13:32.611Z Description: No description available.
CVE ID: CVE-2024-2958 State: PUBLISHED Published: 2024-05-02T16:52:11.744Z Last Updated: 2024-08-01T19:32:42.481Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: svs-websoft Products: SVS Pricing Tables Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The SVS Pricing Tables plugin for WordPress is vulnerable to Stored Cross-Site Scripting via pricing table settings in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web