Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-11213 State: PUBLISHED Published: 2024-11-14T16:00:12.617Z Last Updated: 2024-11-14T17:05:41.050Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: SourceCodester Products: Best Employee Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in SourceCodester Best Employee Management System 1.0. This affects an unknown part of the file /admin/edit_role.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vu
een disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.284529 - https://vuldb.com/?ctiid.284529 - https://vuldb.com/?submit.443298 - https://github.com/sh3rl0ckpggp/0day/blob/main/authenticated_sqli_Employee_management_system.md - https://www.sourcecodester.com/
CVE ID: CVE-2024-11214 State: PUBLISHED Published: 2024-11-14T16:00:15.245Z Last Updated: 2024-11-14T17:04:42.105Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: SourceCodester Products: Best Employee Management System Problem Types: CWE-434, CWE-284 Description: A vulnerability has been found in SourceCodester Best Employee Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/profile.php. The manipulation of the argument website_image leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The initial researcher disclosure contains confusing vulnera
e exploit has been disclosed to the public and may be used. The initial researcher disclosure contains confusing vulnerability classes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.284530 - https://vuldb.com/?ctiid.284530 - https://vuldb.com/?submit.443304 - https://github.com/sh3rl0ckpggp/0day/blob/main/Employee_management%20_system_RCE.md - https://www.sourcecodester.com/
CVE ID: CVE-2024-11215 State: PUBLISHED Published: 2024-11-14T13:37:04.665Z Last Updated: 2024-11-14T14:27:02.624Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: EasyPHP Products: EasyPHP web server Problem Types: CWE-22 Description: Absolute path traversal (incorrect restriction of a path to a restricted directory) vulnerability in the EasyPHP web server, affecting version 14.1. This vulnerability could allow remote users to bypass SecurityManager restrictions and retrieve any file stored on the server by setting only consecutive strings ‘/...%5c’. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices
‘/...%5c’. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/path-traversal-vulnerability-easyphp
CVE ID: CVE-2024-11216 State: PUBLISHED Published: 2025-03-05T13:02:20.755Z Last Updated: 2025-08-19T14:15:58.924Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: PozitifIK Products: Pik Online Problem Types: CWE-639, CWE-359 Description: Authorization Bypass Through User-Controlled Key, Exposure of Private Personal Information to an Unauthorized Actor vulnerability in PozitifIK Pik Online allows Account Footprinting, Session Hijacking.This issue affects Pik Online: before 3.1.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0052
CVE ID: CVE-2024-11217 State: PUBLISHED Published: 2024-11-15T20:48:46.460Z Last Updated: 2025-11-21T06:27:50.196Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: Red Hat OpenShift Container Platform 4 Problem Types: CWE-1295 Description: A vulnerability was found in the OAuth-server. OAuth-server logs the OAuth2 client secret when the logLevel is Debug higher for OIDC/GitHub/GitLab/Google IDPs login options. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2024-11217 - https://bugzilla.redhat.com/show_bug.cgi?id=2326230
CVE ID: CVE-2024-11218 State: PUBLISHED Published: 2025-01-22T04:55:30.649Z Last Updated: 2025-11-20T07:12:04.847Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Ha
ions, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat OpenShift Container Platform 4.12, Red Hat OpenShift Container Platform 4.13, Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 4.15, Red Hat OpenShift Container Platform 4.16, Red Hat OpenShift Container Platform 4.17, Red Hat OpenShift Container Platform 4.18, Red Hat Enterprise Linux 10, Red Hat OpenShift Container Platform 4 Problem Types: CWE-269 Description: A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile.
is issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the host. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:0830 - https://access.redhat.com/errata/RHSA-2025:0878 - https://access.redhat.com/errata/RHSA-2025:0922 - https://access.redhat.com/errata/RHSA-2025:0923 - https://access.redhat.com/errata/RHSA-2025:1186 - https://access.redhat.com/errata/RHSA-2025:1187 - https://access.redhat.com/errata/RHSA-2025:1188 - https://access.redhat.com/errata/RHSA-2025
com/errata/RHSA-2025:1187 - https://access.redhat.com/errata/RHSA-2025:1188 - https://access.redhat.com/errata/RHSA-2025:1189 - https://access.redhat.com/errata/RHSA-2025:1207 - https://access.redhat.com/errata/RHSA-2025:1275 - https://access.redhat.com/errata/RHSA-2025:1295 - https://access.redhat.com/errata/RHSA-2025:1296 - https://access.redhat.com/errata/RHSA-2025:1372 - https://access.redhat.com/errata/RHSA-2025:1453 - https://access.redhat.com/errata/RHSA-2025:1707 - https://access.redhat.com/errata/RHSA-2025:1713 - https://access.redhat.com/errata/RHSA-2025:1908 - https://access.redhat.com/errata/RHSA-2025:1910 - https://access.redhat.com/errata/RHSA-2025:1914 - https://access.redhat.
tps://access.redhat.com/errata/RHSA-2025:1910 - https://access.redhat.com/errata/RHSA-2025:1914 - https://access.redhat.com/errata/RHSA-2025:2441 - https://access.redhat.com/errata/RHSA-2025:2443 - https://access.redhat.com/errata/RHSA-2025:2454 - https://access.redhat.com/errata/RHSA-2025:2456 - https://access.redhat.com/errata/RHSA-2025:2701 - https://access.redhat.com/errata/RHSA-2025:2703 - https://access.redhat.com/errata/RHSA-2025:2710 - https://access.redhat.com/errata/RHSA-2025:2712 - https://access.redhat.com/errata/RHSA-2025:3577 - https://access.redhat.com/errata/RHSA-2025:3798 - https://access.redhat.com/security/cve/CVE-2024-11218 - https://bugzilla.redhat.com/show_bug.cgi?id=23
/RHSA-2025:3798 - https://access.redhat.com/security/cve/CVE-2024-11218 - https://bugzilla.redhat.com/show_bug.cgi?id=2326231 - https://github.com/containers/buildah/pull/5918
CVE ID: CVE-2024-11219 State: PUBLISHED Published: 2024-11-27T05:31:54.882Z Last Updated: 2024-11-27T12:03:31.895Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: themeisle Products: Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE Problem Types: CWE-22 Description: The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 3.0.6 via the get_image function. This makes it possible for unauthenticated attackers to view arbitrary images on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vu
to view arbitrary images on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c5e9ab63-d61e-40f1-a5cb-432f33dfd2a6?source=cve - https://plugins.trac.wordpress.org/browser/otter-blocks/tags/3.0.6/inc/plugins/class-dynamic-content.php#L222
CVE ID: CVE-2024-11220 State: PUBLISHED Published: 2024-12-06T17:45:51.853Z Last Updated: 2024-12-06T20:43:08.930Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Open Automation Software Products: Open Automation Software Problem Types: CWE-279 Description: A local low-level user on the server machine with credentials to the running OAS services can create and execute a report with an rdlx file on the server system itself. Any code within the rdlx file of the report executes with SYSTEM privileges, resulting in privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-03
al Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-03 - https://openautomationsoftware.com/downloads/
CVE ID: CVE-2024-11221 State: PUBLISHED Published: 2025-05-15T20:06:48.314Z Last Updated: 2025-05-20T19:36:19.217Z Vendors: Unknown Products: Full Screen (Page) Background Image Slideshow Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Full Screen (Page) Background Image Slideshow WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/810c2c94-5d35-419c-a993-07a0c7064
Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/810c2c94-5d35-419c-a993-07a0c7064ce6/
CVE ID: CVE-2024-11223 State: PUBLISHED Published: 2024-12-26T06:00:08.723Z Last Updated: 2024-12-30T17:15:08.839Z Vendors: Unknown Products: WPForms Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WPForms WordPress plugin before 1.9.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/82989909-9745-4c9a-abc7-c1adf8c2b047/
CVE ID: CVE-2024-11224 State: PUBLISHED Published: 2024-11-19T12:45:28.507Z Last Updated: 2024-11-19T14:01:50.491Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: thehowarde Products: Parallax Image Problem Types: CWE-79 Description: The Parallax Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘position’ parameter in all versions up to, and including, 1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst No
inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/56e5f7c9-ad22-43b3-9bfe-0eea1f8040d3?source=cve - https://plugins.trac.wordpress.org/browser/parallax-image/tags/1.9/assets/shortcode.php#L156 - https://wordpress.org/plugins/parallax-image/#developers - https://plugins.trac.wordpress.org/changeset/3189649/
CVE ID: CVE-2024-11225 State: PUBLISHED Published: 2024-11-22T05:33:42.053Z Last Updated: 2024-11-22T11:34:08.660Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: codename065 Products: Premium Packages – Sell Digital Products Securely Problem Types: CWE-79 Description: The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 5.9.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into perfor
icated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a2e847fd-0932-4d65-a201-b86e39a33588?source=cve - https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/5.9.3/includes/libs/functions.php#L584 - https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/5.9.3/includes/libs/functions.php#L420 - https://plugins.trac.wordpress.org/browser/wpdm-premium-packages/tags/5.9.3/includes/libs/functions.php#L422 - https://wordpress.org/plugins/w
ordpress.org/browser/wpdm-premium-packages/tags/5.9.3/includes/libs/functions.php#L422 - https://wordpress.org/plugins/wpdm-premium-packages/#developers
CVE ID: CVE-2024-11226 State: PUBLISHED Published: 2025-01-21T11:09:46.724Z Last Updated: 2025-01-21T14:51:16.760Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: alexmoss Products: FireCask Like & Share Button Problem Types: CWE-79 Description: The FireCask Like & Share Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page
l access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5b9d61cd-1955-40d0-99b4-c75f480733f8?source=cve - https://plugins.trac.wordpress.org/browser/facebook-like-send-button/tags/1.2/class-frontend.php#L121 - https://wordpress.org/plugins/facebook-like-send-button/#developers - https://plugins.trac.wordpress.org/changeset/3225838/
CVE ID: CVE-2024-11227 State: PUBLISHED Published: 2024-11-23T09:39:08.618Z Last Updated: 2024-11-23T13:18:19.872Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: strangerstudios Products: Memberlite Shortcodes Problem Types: CWE-79 Description: The Memberlite Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's memberlite_accordion shortcode in all versions up to, and including, 1.3.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will exec
uthenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1c98e8f4-49b4-4d1e-8e11-e38b676d4af0?source=cve - https://plugins.trac.wordpress.org/browser/memberlite-shortcodes/tags/1.3.9/shortcodes/accordion.php#L14 - https://wordpress.org/plugins/memberlite-shortcodes/#developers - https://plugins.trac.wordpress.org/changeset/3195143/
CVE ID: CVE-2024-11228 State: PUBLISHED Published: 2024-11-23T11:39:44.207Z Last Updated: 2024-11-23T13:18:19.284Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: codemstory Products: 워드프레스 결제 심플페이 – 우커머스 결제 플러그인 Problem Types: CWE-79 Description: The 워드프레스 결제 심플페이 – 우커머스 결제 플러그인 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's pafw_instant_payment shortcode in all versions up to, and including, 5.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that
ble for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2fe166a9-8e80-4bb9-8074-5404289f5685?source=cve - https://plugins.trac.wordpress.org/browser/pgall-for-woocommerce/trunk/templates/checkout/pafw/instant-payment.php#L11 - https://wordpress.org/plugins/pgall-for-woocommerce/#developers - https://plugins.trac.wordpress.org/changeset/3191856/
CVE ID: CVE-2024-11229 State: PUBLISHED Published: 2024-11-23T11:39:43.429Z Last Updated: 2024-11-23T13:18:22.612Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: codemstory Products: 코드엠샵 소셜톡 Problem Types: CWE-79 Description: The 코드엠샵 소셜톡 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's add_plus_friends and add_plus_talk shortcodes in all versions up to, and including, 1.1.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a
tackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/226baf3e-1b28-4196-9438-0b17fef4c5af?source=cve - https://plugins.trac.wordpress.org/browser/mshop-naver-talktalk/trunk/includes/class-msntt-plus-friends.php#L22 - https://plugins.trac.wordpress.org/browser/mshop-naver-talktalk/trunk/includes/class-msntt-plus-friends.php#L168 - https://plugins.trac.wordpress.org/browser/mshop-naver-talktalk/trunk/includes/class-msntt-plus-friends.php#L23 - https://plugins.trac.wordpress.o
ress.org/browser/mshop-naver-talktalk/trunk/includes/class-msntt-plus-friends.php#L23 - https://plugins.trac.wordpress.org/browser/mshop-naver-talktalk/trunk/includes/class-msntt-plus-friends.php#L215 - https://wordpress.org/plugins/mshop-naver-talktalk/#developers - https://plugins.trac.wordpress.org/changeset/3191812/
CVE ID: CVE-2024-11230 State: PUBLISHED Published: 2024-12-23T04:23:13.165Z Last Updated: 2024-12-28T00:48:26.561Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: brainstormforce Products: Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) Problem Types: CWE-79 Description: The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘size’ parameter in all versions up to, and including, 1.6.46 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages
possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0d82c866-5b35-414e-bd72-30530930d5d8?source=cve - https://plugins.trac.wordpress.org/browser/header-footer-elementor/tags/1.6.46/inc/widgets-manager/widgets/class-page-title.php#L516 - https://plugins.trac.wordpress.org/changeset/3194764/
CVE ID: CVE-2024-11231 State: PUBLISHED Published: 2024-11-23T11:23:17.382Z Last Updated: 2024-11-23T13:18:19.462Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: codemstory Products: 우커머스 네이버페이 Problem Types: CWE-79 Description: The 우커머스 네이버페이 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mnp_purchase shortcode in all versions up to, and including, 3.3.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an inj
butor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dab587c3-54f3-4619-8de0-8740d6451f96?source=cve - https://plugins.trac.wordpress.org/browser/mshop-npay/trunk/templates/shortcodes/naverpay-button.php#L6 - https://wordpress.org/plugins/mshop-npay/#developers - https://plugins.trac.wordpress.org/changeset/3191814/
CVE ID: CVE-2024-11233 State: PUBLISHED Published: 2024-11-24T01:08:28.663Z Last Updated: 2025-11-03T21:51:48.654Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: PHP Group Products: PHP Problem Types: CWE-122 Description: In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, due to an error in convert.quoted-printable-decode filter certain data can lead to buffer overread by one byte, which can in certain circumstances lead to crashes or disclose content of other memory areas. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/php/php-src/security/advisories/GHSA-r977-prxv-hc
ulnrichment: - CVE Program Container: References: - https://github.com/php/php-src/security/advisories/GHSA-r977-prxv-hc43
CVE ID: CVE-2024-11234 State: PUBLISHED Published: 2024-11-24T00:57:39.349Z Last Updated: 2025-11-03T21:51:51.580Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: PHP Group Products: PHP Problem Types: CWE-20 Description: In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user. Additional Analyst Notes:
ver, thus potentially gaining access to resources not normally available to the external user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm7-mmq2