Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-0299 State: PUBLISHED Published: 2024-01-08T05:31:03.711Z Last Updated: 2025-06-03T14:38:26.253Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Totolink Products: N200RE Problem Types: CWE-78 Description: A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. It has been declared as critical. Affected by this vulnerability is the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument command leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249865 was assigned to this vulnerability. NOTE: The vendor was contacted
he public and may be used. The identifier VDB-249865 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.249865 - https://vuldb.com/?ctiid.249865 - https://github.com/jylsec/vuldb/blob/main/TOTOLINK/N200RE/setTracerouteCfg/README.md
CVE ID: CVE-2024-0300 State: PUBLISHED Published: 2024-01-08T06:00:04.028Z Last Updated: 2024-09-04T19:16:07.984Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Byzoro Products: Smart S150 Management Platform Problem Types: CWE-434 Description: A vulnerability was found in Byzoro Smart S150 Management Platform up to 20240101. It has been rated as critical. Affected by this issue is some unknown functionality of the file /useratte/userattestation.php of the component HTTP POST Request Handler. The manipulation of the argument web_img leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249866 is the
d. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249866 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.249866 - https://vuldb.com/?ctiid.249866 - https://vuldb.com/?submit.260962 - https://github.com/tolkent/cve/blob/main/upload.md
CVE ID: CVE-2024-0301 State: PUBLISHED Published: 2024-01-08T06:31:03.527Z Last Updated: 2025-06-17T20:39:15.173Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: fhs-opensource Products: iparking Problem Types: CWE-89 Description: A vulnerability classified as critical was found in fhs-opensource iparking 1.5.22.RELEASE. This vulnerability affects the function getData of the file src/main/java/com/xhb/pay/action/PayTempOrderAction.java. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249868. Additional Analyst Notes: - CVE Program Container: -
d may be used. The identifier of this vulnerability is VDB-249868. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.249868 - https://vuldb.com/?ctiid.249868 - https://github.com/laoquanshi/heishou/blob/main/iparking-SQL.pdf
CVE ID: CVE-2024-0302 State: PUBLISHED Published: 2024-01-08T07:00:05.741Z Last Updated: 2024-11-14T18:14:37.943Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: fhs-opensource Products: iparking Problem Types: CWE-502 Description: A vulnerability, which was classified as critical, has been found in fhs-opensource iparking 1.5.22.RELEASE. This issue affects some unknown processing of the file /vueLogin. The manipulation leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249869 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
B-249869 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.249869 - https://vuldb.com/?ctiid.249869 - https://github.com/laoquanshi/heishou/blob/main/Iparking%20rce.pdf
CVE ID: CVE-2024-0303 State: PUBLISHED Published: 2024-01-08T07:31:03.703Z Last Updated: 2025-06-17T20:39:15.307Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: Youke365 Problem Types: CWE-918 Description: A vulnerability, which was classified as critical, was found in Youke365 up to 1.5.3. Affected is an unknown function of the file /app/api/controller/caiji.php of the component Parameter Handler. The manipulation of the argument url leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249870 is the identifier assigned to this vulnerability. Additional Analyst Notes:
d to the public and may be used. VDB-249870 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.249870 - https://vuldb.com/?ctiid.249870 - https://note.zhaoj.in/share/fssH60eQkvSl
CVE ID: CVE-2024-0304 State: PUBLISHED Published: 2024-01-08T08:00:05.121Z Last Updated: 2025-06-03T14:38:16.923Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: Youke365 Problem Types: CWE-918 Description: A vulnerability has been found in Youke365 up to 1.5.3 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /app/api/controller/collect.php. The manipulation of the argument url leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249871. Additional Analyst Notes: - CVE Program Co
d may be used. The associated identifier of this vulnerability is VDB-249871. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.249871 - https://vuldb.com/?ctiid.249871 - https://note.zhaoj.in/share/3jF3Xpl3ttlZ
CVE ID: CVE-2024-0305 State: PUBLISHED Published: 2024-01-08T08:31:03.398Z Last Updated: 2024-09-04T19:13:58.124Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Guangzhou Yingke Electronic Technology Products: Ncast Problem Types: CWE-200 Description: A vulnerability was found in Guangzhou Yingke Electronic Technology Ncast up to 2017 and classified as problematic. Affected by this issue is some unknown functionality of the file /manage/IPSetup.php of the component Guest Login. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerabil
ay be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249872. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.249872 - https://vuldb.com/?ctiid.249872 - https://github.com/2267787739/cve/blob/main/logic.md
CVE ID: CVE-2024-0306 State: PUBLISHED Published: 2024-01-08T09:00:07.071Z Last Updated: 2025-06-17T20:39:15.425Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Kashipara Products: Dynamic Lab Management System Problem Types: CWE-89 Description: A vulnerability was found in Kashipara Dynamic Lab Management System up to 1.0. It has been classified as critical. This affects an unknown part of the file /admin/admin_login_process.php. The manipulation of the argument admin_password leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249873 was assigned to this vulnerability. Additio
has been disclosed to the public and may be used. The identifier VDB-249873 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.249873 - https://vuldb.com/?ctiid.249873 - https://github.com/E1CHO/cve_hub/blob/main/Dynamic%20Lab%20Management%20System%20-%20vuln%201.pdf
CVE ID: CVE-2024-0307 State: PUBLISHED Published: 2024-01-08T09:31:03.531Z Last Updated: 2025-06-17T20:39:15.549Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Kashipara Products: Dynamic Lab Management System Problem Types: CWE-89 Description: A vulnerability was found in Kashipara Dynamic Lab Management System up to 1.0. It has been declared as critical. This vulnerability affects unknown code of the file login_process.php. The manipulation of the argument password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-249874 is the identifier assigned to this vulnerability. Additional Analyst Notes: -
to the public and may be used. VDB-249874 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.249874 - https://vuldb.com/?ctiid.249874 - https://github.com/VistaAX/vulnerablility/blob/main/Dynamic%20Lab%20Management%20System%20-%20vuln%202.pdf
CVE ID: CVE-2024-0308 State: PUBLISHED Published: 2024-01-08T10:00:05.086Z Last Updated: 2025-06-03T14:38:10.657Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: Inis Problem Types: CWE-918 Description: A vulnerability was found in Inis up to 2.0.1. It has been rated as critical. This issue affects some unknown processing of the file app/api/controller/default/Proxy.php. The manipulation of the argument p_url leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249875. Additional Analyst Notes: - CVE Program Container: - CISA A
e associated identifier of this vulnerability is VDB-249875. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.249875 - https://vuldb.com/?ctiid.249875 - https://note.zhaoj.in/share/2E2JG2PClHGF
CVE ID: CVE-2024-0310 State: PUBLISHED Published: 2024-01-10T10:43:46.006Z Last Updated: 2024-09-03T18:29:33.745Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Trellix Products: Trellix Endpoint Security (ENS) Web Control Problem Types: CWE-79 Description: A content-security-policy vulnerability in ENS Control browser extension prior to 10.7.0 Update 15 allows a remote attacker to alter the response header parameter setting to switch the content security policy into report-only mode, allowing an attacker to bypass the content-security-policy configuration. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kcm
icy configuration. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kcm.trellix.com/corporate/index?page=content&id=SB10417
CVE ID: CVE-2024-0311 State: PUBLISHED Published: 2024-03-14T09:06:25.147Z Last Updated: 2024-08-01T18:04:48.596Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Skyhigh Products: Skyhigh Client Proxy Problem Types: CWE-622 Description: A malicious insider can bypass the existing policy of Skyhigh Client Proxy without a valid release code. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://kcm.trellix.com/corporate/index?page=content&id=SB10418
CVE ID: CVE-2024-0312 State: PUBLISHED Published: 2024-03-14T09:08:27.231Z Last Updated: 2024-08-01T18:04:48.595Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Skyhigh Products: Skyhigh Client Proxy Problem Types: CWE-622 Description: A malicious insider can uninstall Skyhigh Client Proxy without a valid uninstall password. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://kcm.trellix.com/corporate/index?page=content&id=SB10418
CVE ID: CVE-2024-0313 State: PUBLISHED Published: 2024-03-14T09:11:29.770Z Last Updated: 2024-08-02T19:28:22.007Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Skyhigh Products: Skyhigh Client Proxy Problem Types: CWE-670 Description: A malicious insider exploiting this vulnerability can circumvent existing security controls put in place by the organization. On the contrary, if the victim is legitimately using the temporary bypass to reach out to the Internet for retrieving application and system updates, a remote device could target it and undo the bypass, thereby denying the victim access to the update service, causing it to fail. Additional Analyst Note
nd undo the bypass, thereby denying the victim access to the update service, causing it to fail. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kcm.trellix.com/corporate/index?page=content&id=SB10418
CVE ID: CVE-2024-0314 State: PUBLISHED Published: 2024-01-15T16:01:02.234Z Last Updated: 2025-06-03T14:00:17.084Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: FireEye Products: FireEye Central Management Problem Types: CWE-79 Description: XSS vulnerability in FireEye Central Management affecting version 9.1.1.956704, which could allow an attacker to modify special HTML elements in the application and cause a reflected XSS, leading to a session hijacking. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-fireeye-products
CVE ID: CVE-2024-0315 State: PUBLISHED Published: 2024-01-15T16:02:52.863Z Last Updated: 2025-06-03T13:59:59.410Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: FireEye Products: FireEye Central Management Problem Types: CWE-98 Description: Remote file inclusion vulnerability in FireEye Central Management affecting version 9.1.1.956704. This vulnerability allows an attacker to upload a malicious PDF file to the system during the report creation process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-fireeye-products
CVE ID: CVE-2024-0316 State: PUBLISHED Published: 2024-01-15T16:04:50.148Z Last Updated: 2024-10-01T20:10:06.870Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: FireEye Products: FireEye Endpoint Security Problem Types: CWE-460 Description: Improper cleanup vulnerability in exceptions thrown in FireEye Endpoint Security, affecting version 5.2.0.958244. This vulnerability could allow an attacker to send multiple request packets to the containment_notify/preview parameter, which could lead to a service outage. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-v
Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-fireeye-products
CVE ID: CVE-2024-0317 State: PUBLISHED Published: 2024-01-15T16:23:34.711Z Last Updated: 2025-06-03T13:59:52.149Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: FireEye Products: FireEye EX Problem Types: CWE-79 Description: Cross-Site Scripting in FireEye EX, affecting version 9.0.3.936727. Exploitation of this vulnerability allows an attacker to send a specially crafted JavaScript payload via the 'type' and 's_f_name' parameters to an authenticated user to retrieve their session details. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-fire
- CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-fireeye-products
CVE ID: CVE-2024-0318 State: PUBLISHED Published: 2024-01-15T16:26:50.033Z Last Updated: 2024-10-23T15:28:55.604Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: FireEye Products: FireEye HXTool Problem Types: CWE-79 Description: Cross-Site Scripting in FireEye HXTool affecting version 4.6. This vulnerability allows an attacker to store a specially crafted JavaScript payload in the 'Profile Name' and 'Hostname/IP' parameters that will be triggered when items are loaded. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-fireeye-products
CVE ID: CVE-2024-0319 State: PUBLISHED Published: 2024-01-15T16:27:50.796Z Last Updated: 2024-08-30T19:04:52.774Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: FireEye Products: FireEye HXTool Problem Types: CWE-601 Description: Open Redirect vulnerability in FireEye HXTool affecting version 4.6, the exploitation of which could allow an attacker to redirect a legitimate user to a malicious page by changing the 'redirect_uri' parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-fireeye-products
CVE ID: CVE-2024-0320 State: PUBLISHED Published: 2024-01-15T16:29:31.439Z Last Updated: 2025-06-03T13:59:47.443Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: FireEye Products: FireEye Malware Analysis (AX) Problem Types: CWE-79 Description: Cross-Site Scripting in FireEye Malware Analysis (AX) affecting version 9.0.3.936530. This vulnerability allows an attacker to send a specially crafted JavaScript payload in the application URL to retrieve the session details of a legitimate user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-fireeye
CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-fireeye-products
CVE ID: CVE-2024-0321 State: PUBLISHED Published: 2024-01-08T12:10:46.709Z Last Updated: 2025-05-16T15:37:07.837Z Severity: MEDIUM (CVSS 4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: gpac Products: gpac/gpac Problem Types: CWE-121 Description: Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.3-DEV. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/4c027b94-8e9c-4c31-a169-893b25047769 - https://github.com/gpac/gpac/commit/d0ced41651b279bb054eb6390751e2d4eb84819a
CVE ID: CVE-2024-0322 State: PUBLISHED Published: 2024-01-08T12:38:35.128Z Last Updated: 2025-06-03T14:37:57.761Z Severity: MEDIUM (CVSS 4.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) Vendors: gpac Products: gpac/gpac Problem Types: CWE-125 Description: Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3-DEV. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/87611fc9-ed7c-43e9-8e52-d83cd270bbec - https://github.com/gpac/gpac/commit/092904b80edbc4dce315684a59cc3184c45c1b70
CVE ID: CVE-2024-0323 State: PUBLISHED Published: 2024-02-05T16:05:47.612Z Last Updated: 2024-09-06T07:21:29.270Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: B&R Industrial Automation Products: Automation Runtime Problem Types: CWE-1240 Description: The FTP server used on the B&R Automation Runtime supports unsecure encryption mechanisms, such as SSLv3, TLSv1.0 and TLS1.1. An network-based attacker can exploit the flaws to conduct man-in-the-middle attacks or to decrypt communications between the affected product clients. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.br-automation.com/fileadmin/SA
nalyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.br-automation.com/fileadmin/SA23P004_FTP_uses_unsecure_encryption_mechanisms-f57c147c.pdf
CVE ID: CVE-2024-0324 State: PUBLISHED Published: 2024-02-05T21:21:37.446Z Last Updated: 2025-05-15T19:46:36.638Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) Vendors: reflectionmedia Products: User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor Problem Types: CWE-284 Improper Access Control Description: The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wppb_two_factor_authentication_settings_update' function in all versions up to, and including, 3.10.8. This makes it pos
wppb_two_factor_authentication_settings_update' function in all versions up to, and including, 3.10.8. This makes it possible for unauthenticated attackers to enable or disable the 2FA functionality present in the Premium version of the plugin for arbitrary user roles. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/23caef95-36b6-40aa-8dd7-51a376790a40?source=cve - https://github.com/WordpressPluginDirectory/profile-builder/blob/main/profile-builder/admin/admin-functions.php#L517 - https://plugins.trac.wordpress.org/changeset/3022354/
CVE ID: CVE-2024-0325 State: PUBLISHED Published: 2024-02-01T22:03:57.425Z Last Updated: 2024-08-01T18:04:49.113Z Severity: LOW (CVSS 3.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Helix Products: Sync Problem Types: CWE-94 Description: In Helix Sync versions prior to 2024.1, a local command injection was identified. Reported by Bryan Riggins. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://perforce.com
CVE ID: CVE-2024-0326 State: PUBLISHED Published: 2024-03-13T15:26:38.238Z Last Updated: 2024-08-01T18:04:49.122Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: leap13 Products: Premium Addons for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Link Wrapper functionality in all versions up to, and including, 4.10.17 due to insufficient input sanitization and output escaping on user supplied links. This makes it possible for authenticated attackers with contributo
itization and output escaping on user supplied links. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/22ba0eaf-f514-420a-9680-8126f6dcdde9?source=cve - https://plugins.trac.wordpress.org/browser/premium-addons-for-elementor/trunk/modules/premium-wrapper-link/module.php#L173 - https://plugins.trac.wordpress.org/browser/premium-addons-for-elementor/trunk/includes/class-premium-template-tags.php#L1638
://plugins.trac.wordpress.org/browser/premium-addons-for-elementor/trunk/includes/class-premium-template-tags.php#L1638 - https://plugins.trac.wordpress.org/browser/premium-addons-for-elementor/trunk/widgets/premium-button.php#L1709 - https://plugins.trac.wordpress.org/changeset/3022824/premium-addons-for-elementor/trunk/modules/premium-wrapper-link/module.php