Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
e controlled by untrusted sources, leading to potential credential leakage, internal network scanning, and unauthorized access to internal services, APIs, or data stores. The affected blocks include GithubListPullRequestsBlock, GithubReadPullRequestBlock, GithubAssignPRReviewerBlock, GithubListPRReviewersBlock, GithubUnassignPRReviewerBlock, GithubCommentBlock, GithubMakeIssueBlock, GithubReadIssueBlock, GithubListIssuesBlock, GithubAddLabelBlock, GithubRemoveLabelBlock, GithubListBranchesBlock, and ExtractWebsiteContentBlock. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/1d91e1e1-7d45-4bda-bc27-bfe9052fd975 - https://github.com/significant-gravi
nt: References: - https://huntr.com/bounties/1d91e1e1-7d45-4bda-bc27-bfe9052fd975 - https://github.com/significant-gravitas/autogpt/commit/bcaf3241dadfc1fca024e91fb8f2e3004105a172
CVE ID: CVE-2024-10458 State: PUBLISHED Published: 2024-10-29T12:19:08.505Z Last Updated: 2025-11-03T21:51:08.617Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Permission leak via embed or object elements Description: A permission leak could have occurred from a trusted site to an untrusted site via `embed` or `object` elements. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Firefox ESR < 115.17, Thunderbird < 128.4, and Thunderbird < 132. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1921733 - https://www.mozilla.org/security/advisories/mfsa2024-55/ - https
https://bugzilla.mozilla.org/show_bug.cgi?id=1921733 - https://www.mozilla.org/security/advisories/mfsa2024-55/ - https://www.mozilla.org/security/advisories/mfsa2024-56/ - https://www.mozilla.org/security/advisories/mfsa2024-57/ - https://www.mozilla.org/security/advisories/mfsa2024-58/ - https://www.mozilla.org/security/advisories/mfsa2024-59/
CVE ID: CVE-2024-10459 State: PUBLISHED Published: 2024-10-29T12:19:09.637Z Last Updated: 2025-11-03T21:51:11.574Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Use-after-free in layout with accessibility Description: An attacker could have caused a use-after-free when accessibility was enabled, leading to a potentially exploitable crash. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Firefox ESR < 115.17, Thunderbird < 128.4, and Thunderbird < 132. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1919087 - https://www.mozilla.org/security/advisories/mfsa2024-55
rences: - https://bugzilla.mozilla.org/show_bug.cgi?id=1919087 - https://www.mozilla.org/security/advisories/mfsa2024-55/ - https://www.mozilla.org/security/advisories/mfsa2024-56/ - https://www.mozilla.org/security/advisories/mfsa2024-57/ - https://www.mozilla.org/security/advisories/mfsa2024-58/ - https://www.mozilla.org/security/advisories/mfsa2024-59/
CVE ID: CVE-2024-10460 State: PUBLISHED Published: 2024-10-29T12:19:10.679Z Last Updated: 2025-11-03T21:51:14.565Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Confusing display of origin for external protocol handler prompt Description: The origin of an external protocol handler prompt could have been obscured using a data: URL within an `iframe`. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1912537 - https://www.mozilla.org/security/advisories/mfsa2024-55/ - https:/
ttps://bugzilla.mozilla.org/show_bug.cgi?id=1912537 - https://www.mozilla.org/security/advisories/mfsa2024-55/ - https://www.mozilla.org/security/advisories/mfsa2024-56/ - https://www.mozilla.org/security/advisories/mfsa2024-58/ - https://www.mozilla.org/security/advisories/mfsa2024-59/
CVE ID: CVE-2024-10461 State: PUBLISHED Published: 2024-10-29T12:19:11.706Z Last Updated: 2025-11-03T21:51:17.564Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: XSS due to Content-Disposition being ignored in multipart/x-mixed-replace response Description: In multipart/x-mixed-replace responses, `Content-Disposition: attachment` in the response header was not respected and did not force a download, which could allow XSS attacks. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cg
Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1914521 - https://www.mozilla.org/security/advisories/mfsa2024-55/ - https://www.mozilla.org/security/advisories/mfsa2024-56/ - https://www.mozilla.org/security/advisories/mfsa2024-58/ - https://www.mozilla.org/security/advisories/mfsa2024-59/
CVE ID: CVE-2024-10462 State: PUBLISHED Published: 2024-10-29T12:19:12.782Z Last Updated: 2025-11-03T21:51:20.505Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Origin of permission prompt could be spoofed by long URL Description: Truncation of a long URL could have allowed origin spoofing in a permission prompt. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1920423 - https://www.mozilla.org/security/advisories/mfsa2024-55/ - https://www.mozilla.org/security/advisories/
cgi?id=1920423 - https://www.mozilla.org/security/advisories/mfsa2024-55/ - https://www.mozilla.org/security/advisories/mfsa2024-56/ - https://www.mozilla.org/security/advisories/mfsa2024-58/ - https://www.mozilla.org/security/advisories/mfsa2024-59/
CVE ID: CVE-2024-10463 State: PUBLISHED Published: 2024-10-29T12:19:13.795Z Last Updated: 2025-11-03T21:51:23.428Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Cross origin video frame leak Description: Video frames could have been leaked between origins in some situations. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Firefox ESR < 115.17, Thunderbird < 128.4, and Thunderbird < 132. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1920800 - https://www.mozilla.org/security/advisories/mfsa2024-55/ - https://www.mozilla.org/security/advisories/mfsa2024-56/ - ht
https://www.mozilla.org/security/advisories/mfsa2024-55/ - https://www.mozilla.org/security/advisories/mfsa2024-56/ - https://www.mozilla.org/security/advisories/mfsa2024-57/ - https://www.mozilla.org/security/advisories/mfsa2024-58/ - https://www.mozilla.org/security/advisories/mfsa2024-59/
CVE ID: CVE-2024-10464 State: PUBLISHED Published: 2024-10-29T12:19:14.864Z Last Updated: 2025-11-03T21:51:26.386Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: History interface could have been used to cause a Denial of Service condition in the browser Description: Repeated writes to history interface attributes could have been used to cause a Denial of Service condition in the browser. This was addressed by introducing rate-limiting to this API. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozi
d < 132. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1913000 - https://www.mozilla.org/security/advisories/mfsa2024-55/ - https://www.mozilla.org/security/advisories/mfsa2024-56/ - https://www.mozilla.org/security/advisories/mfsa2024-58/ - https://www.mozilla.org/security/advisories/mfsa2024-59/
CVE ID: CVE-2024-10465 State: PUBLISHED Published: 2024-10-29T12:19:15.936Z Last Updated: 2025-11-03T21:51:29.580Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Clipboard "paste" button persisted across tabs Description: A clipboard "paste" button could persist across tabs which allowed a spoofing attack. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1918853 - https://www.mozilla.org/security/advisories/mfsa2024-55/ - https://www.mozilla.org/security/advisories/mfsa2024
918853 - https://www.mozilla.org/security/advisories/mfsa2024-55/ - https://www.mozilla.org/security/advisories/mfsa2024-56/ - https://www.mozilla.org/security/advisories/mfsa2024-58/ - https://www.mozilla.org/security/advisories/mfsa2024-59/
CVE ID: CVE-2024-10466 State: PUBLISHED Published: 2024-10-29T12:19:17.005Z Last Updated: 2025-11-03T21:51:32.544Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: DOM push subscription message could hang Thunderbird Description: By sending a specially crafted push message, a remote server could have hung the parent process, causing the browser to become unresponsive. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1924154 - https://www.mozilla.org/security/advisories/mfsa20
References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1924154 - https://www.mozilla.org/security/advisories/mfsa2024-55/ - https://www.mozilla.org/security/advisories/mfsa2024-56/ - https://www.mozilla.org/security/advisories/mfsa2024-58/ - https://www.mozilla.org/security/advisories/mfsa2024-59/
CVE ID: CVE-2024-10467 State: PUBLISHED Published: 2024-10-29T12:19:18.057Z Last Updated: 2025-11-03T21:51:35.485Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Memory safety bugs fixed in Firefox 132, Thunderbird 132, Firefox ESR 128.4, and Thunderbird 128.4 Description: Memory safety bugs present in Firefox 131, Firefox ESR 128.3, and Thunderbird 128.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132. Additional Analyst Notes: - CISA ADP Vulnrichme
< 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1829029%2C1888538%2C1900394%2C1904059%2C1917742%2C1919809%2C1923706 - https://www.mozilla.org/security/advisories/mfsa2024-55/ - https://www.mozilla.org/security/advisories/mfsa2024-56/ - https://www.mozilla.org/security/advisories/mfsa2024-58/ - https://www.mozilla.org/security/advisories/mfsa2024-59/
CVE ID: CVE-2024-10468 State: PUBLISHED Published: 2024-10-29T12:19:19.111Z Last Updated: 2024-10-29T14:22:29.067Z Vendors: Mozilla Products: Firefox, Thunderbird Problem Types: Race conditions in IndexedDB Description: Potential race conditions in IndexedDB could have caused memory corruption, leading to a potentially exploitable crash. This vulnerability affects Firefox < 132 and Thunderbird < 132. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1914982 - https://www.mozilla.org/security/advisories/mfsa2024-55/ - https://www.mozilla.org/security/advisories/mfsa2024-59/
CVE ID: CVE-2024-10469 State: PUBLISHED Published: 2024-10-28T15:38:29.062Z Last Updated: 2025-08-25T22:10:00.825Z Vendors: CERT/CC Products: VINCE Problem Types: CWE-276 Description: VINCE versions before 3.0.9 is vulnerable to exposure of User information to authenticated users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/CERTCC/VINCE/
CVE ID: CVE-2024-10470 State: PUBLISHED Published: 2024-11-09T05:40:22.357Z Last Updated: 2024-11-12T18:41:47.848Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: VibeThemes Products: WPLMS Learning Management System for WordPress, WordPress LMS Problem Types: CWE-22 Description: The WPLMS Learning Management System for WordPress, WordPress LMS theme for WordPress is vulnerable to arbitrary file read and deletion due to insufficient file path validation and permissions checks in the readfile and unlink functions in all versions up to, and including, 4.962. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which c
including, 4.962. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The theme is vulnerable even when it is not activated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1932c9b4-2fea-40f8-9748-09ded8143c11?source=cve - https://themeforest.net/item/wplms-learning-management-system/6780226
CVE ID: CVE-2024-10471 State: PUBLISHED Published: 2024-11-26T06:00:06.615Z Last Updated: 2024-11-26T14:15:02.219Z Vendors: Unknown Products: Everest Forms Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Everest Forms WordPress plugin before 3.0.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/85d590c9-c96d-40c9-aa59-48302ba3d63c/
CVE ID: CVE-2024-10472 State: PUBLISHED Published: 2025-03-25T06:00:04.490Z Last Updated: 2025-03-25T13:58:46.286Z Vendors: Unknown Products: Stylish Price List Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Stylish Price List WordPress plugin before 7.1.12 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d79e5c05-26d0-4223-891f-42ac9fb6ef6e/
CVE ID: CVE-2024-10473 State: PUBLISHED Published: 2024-11-28T06:00:05.185Z Last Updated: 2024-11-29T15:50:32.875Z Vendors: Unknown Products: Logo Slider Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Logo Slider WordPress plugin before 4.5.0 does not sanitise and escape some of its Logo Settings when outputing them in pages where the Logo Slider shortcode is embed, which could allow users with a role as low as Author to perform Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7512cbdf-cf27-4a1f-bac8-9fcb14bf463e/
CVE ID: CVE-2024-10474 State: PUBLISHED Published: 2024-10-29T12:19:20.120Z Last Updated: 2025-03-13T19:11:52.222Z Vendors: Mozilla Products: Focus for iOS Problem Types: Don't allow web content to open firefox-focus URLs Description: Focus was incorrectly allowing internal links to utilize the app scheme used for deeplinking, which could result in links potentially circumventing some URL safety checks This vulnerability affects Focus for iOS < 132. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1863832 - https://www.mozilla.org/security/advisories/mfsa2024-60/
CVE ID: CVE-2024-10475 State: PUBLISHED Published: 2025-05-15T20:06:43.490Z Last Updated: 2025-05-20T19:40:42.456Z Vendors: Unknown Products: Responsive Contact Form Builder & Lead Generation Plugin Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin before 1.9.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/faca59fb-6
ite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/faca59fb-6b59-45b0-8b97-c4125d9d3cb3/
CVE ID: CVE-2024-10476 State: PUBLISHED Published: 2024-12-17T15:16:44.982Z Last Updated: 2024-12-17T15:35:43.490Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Becton Dickinson & Co Products: BD BACTEC™ Blood Culture System, BD COR™ System, BD EpiCenter™ Microbiology Data Management System, BD MAX™ System, BD Phoenix™ M50 Automated Microbiology System, BD Synapsys™ Informatics Solution Problem Types: CWE-1392 Description: Default credentials are used in the above listed BD Diagnostic Solutions products. If exploited, threat actors may be able to access, modify or delete data, including sensitive information such as protected health information (PHI) and perso
e to access, modify or delete data, including sensitive information such as protected health information (PHI) and personally identifiable information (PII). Exploitation of this vulnerability may allow an attacker to shut down or otherwise impact the availability of the system. Note: BD Synapsys™ Informatics Solution is only in scope of this vulnerability when installed on a NUC server. BD Synapsys™ Informatics Solution installed on a customer-provided virtual machine or on the BD Kiestra™ SCU hardware is not in scope. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-cybersecurity-vulnerability-bulletin-diagnostic-s
erences: - https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-cybersecurity-vulnerability-bulletin-diagnostic-solutions-products
CVE ID: CVE-2024-10477 State: PUBLISHED Published: 2024-10-29T00:31:08.354Z Last Updated: 2024-10-29T15:33:31.461Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: LinZhaoguan Products: pb-cms Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in LinZhaoguan pb-cms up to 2.0.1. This vulnerability affects unknown code of the file /admin#permissions of the component Permission Management Page. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282088 - https://vuldb
y be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282088 - https://vuldb.com/?ctiid.282088 - https://gitee.com/LinZhaoguan/pb-cms/issues/IAYIB9
CVE ID: CVE-2024-10478 State: PUBLISHED Published: 2024-10-29T00:31:15.499Z Last Updated: 2024-10-29T15:33:09.289Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: LinZhaoguan Products: pb-cms Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in LinZhaoguan pb-cms up to 2.0.1. This issue affects some unknown processing of the file /admin#article/edit?id=2 of the component Edit Article Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.28
to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282089 - https://vuldb.com/?ctiid.282089 - https://gitee.com/LinZhaoguan/pb-cms/issues/IAYIAO
CVE ID: CVE-2024-10479 State: PUBLISHED Published: 2024-10-29T01:00:14.763Z Last Updated: 2024-10-29T14:54:33.402Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: LinZhaoguan Products: pb-cms Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in LinZhaoguan pb-cms up to 2.0.1. Affected is an unknown function of the file /admin#themes of the component Theme Management Module. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282090 - https://v
d may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282090 - https://vuldb.com/?ctiid.282090 - https://gitee.com/LinZhaoguan/pb-cms/issues/IAYHUP
CVE ID: CVE-2024-10480 State: PUBLISHED Published: 2024-12-06T06:00:07.090Z Last Updated: 2024-12-06T16:03:29.448Z Vendors: Unknown Products: 3DPrint Lite Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The 3DPrint Lite WordPress plugin before 2.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/725ac766-c849-49d6-a968-58fcc2e134c8/
CVE ID: CVE-2024-10481 State: PUBLISHED Published: 2025-03-20T10:09:02.407Z Last Updated: 2025-10-15T12:50:08.883Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: comfyanonymous Products: comfyanonymous/comfyui Problem Types: CWE-352 Description: A CSRF vulnerability exists in comfyanonymous/comfyui versions up to v0.2.2. This vulnerability allows attackers to host malicious websites that, when visited by authenticated ComfyUI users, can perform arbitrary API requests on behalf of the user. This can be exploited to perform actions such as uploading arbitrary files via the `/upload/image` endpoint. The lack of CSRF protections on API endpoints like `/upload/i
ploading arbitrary files via the `/upload/image` endpoint. The lack of CSRF protections on API endpoints like `/upload/image`, `/prompt`, and `/history` leaves users vulnerable to unauthorized actions, which could be combined with other vulnerabilities such as stored-XSS to further compromise user sessions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/f4d5bfb5-6ff1-4356-b81f-f8c01d2e6ded
CVE ID: CVE-2024-10482 State: PUBLISHED Published: 2024-11-21T06:00:02.180Z Last Updated: 2024-11-21T23:14:49.029Z Vendors: Unknown Products: Media File Rename, Find Unused File, Add Alt text, Caption, Desc For Image SEO Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Media File Rename, Find Unused File, Add Alt text, Caption, Desc For Image SEO WordPress plugin before 1.5.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/46cbd4bb-b6f3-49e8-8d79-8c378c617e7c/
CVE ID: CVE-2024-10483 State: PUBLISHED Published: 2025-02-26T06:00:05.748Z Last Updated: 2025-02-26T16:09:06.667Z Vendors: Unknown Products: Simple:Press Forum Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Simple:Press Forum WordPress plugin before 6.10.11 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c7e3c473-09b2-473b-87d7-0a01d8f52086/