Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-9870 State: PUBLISHED Published: 2025-02-12T15:31:02.886Z Last Updated: 2025-02-12T15:59:49.272Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-441 Description: An external service interaction vulnerability in GitLab EE affecting all versions from 15.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to send requests from the GitLab server to unintended services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/498911 - https://hackerone.com/reports/2734142
CVE ID: CVE-2024-9872 State: PUBLISHED Published: 2024-12-06T08:24:55.229Z Last Updated: 2024-12-06T17:34:51.079Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: vcita Products: Online Booking & Scheduling Calendar for WordPress by vcita Problem Types: CWE-79 Description: The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_save_user_data_callback() function in all versions up to, and including, 4.5.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject malicious web scripts and up
it possible for authenticated attackers, with Subscriber-level access and above, to inject malicious web scripts and update settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/963c2d10-692b-4447-8d0b-7ccc2e533f01?source=cve - https://plugins.trac.wordpress.org/changeset/3200129/meeting-scheduler-by-vcita/trunk/vcita-ajax-function.php
CVE ID: CVE-2024-9873 State: PUBLISHED Published: 2024-10-16T05:31:56.035Z Last Updated: 2024-10-16T16:20:12.249Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: peepso Products: Community by PeepSo – Social Network, Membership, Registration, User Profiles, Premium – Mobile App Problem Types: CWE-79 Description: The Community by PeepSo – Social Network, Membership, Registration, User Profiles, Premium – Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via URLs in posts, comments, and profiles when Markdown support is enabled in all versions up to, and including, 6.4.6.1 due to insufficient input sanitization and output escaping. T
t is enabled in all versions up to, and including, 6.4.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/33585791-be40-438c-bebc-8852e7cf8ae5?source=cve - https://plugins.trac.wordpress.org/changeset/3168989/peepso-core/tags/6.4.6.2/peepso.php?old=3157925&old_path=peepso-core%2Ftags%2F6.4.6.1%2Fpeepso.php
CVE ID: CVE-2024-9874 State: PUBLISHED Published: 2024-11-09T06:41:29.565Z Last Updated: 2024-11-12T20:15:57.078Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: ays-pro Products: Poll Maker – Versus Polls, Anonymous Polls, Image Polls Problem Types: CWE-89 Description: The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 5.4.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level a
nt preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5a7e8284-d70f-4448-8f0d-99c23b8eda79?source=cve - https://packetstormsecurity.com/files/179500/WordPress-Poll-Maker-5.3.2-SQL-Injection.html - https://plugins.trac.wordpress.org/browser/poll-maker/tags/5.4.6/includes/lists/class-poll-maker-results-list-table.php#L58 - https://plugins.trac.wordpress.org/brow
ll-maker/tags/5.4.6/includes/lists/class-poll-maker-results-list-table.php#L58 - https://plugins.trac.wordpress.org/browser/poll-maker/tags/5.4.7/includes/lists/class-poll-maker-each-results-poll-list-table.php#L48
CVE ID: CVE-2024-9875 State: PUBLISHED Published: 2024-11-20T22:23:15.230Z Last Updated: 2024-11-22T15:25:43.803Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Okta Products: Okta Privileged Access Server Agent (SFTD) Problem Types: CWE-20 Description: Okta Privileged Access server agent (SFTD) versions 1.82.0 to 1.84.0 are affected by a privilege escalation vulnerability when the sudo command bundles feature is enabled. To remediate this vulnerability, upgrade the Okta Privileged Access server agent (SFTD) to version 1.87.1 or greater. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.okta.com/asa/en-us/content/topics/releasenote
itional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.okta.com/asa/en-us/content/topics/releasenotes/advanced-server-access-release-notes.htm
CVE ID: CVE-2024-9876 State: PUBLISHED Published: 2025-04-30T18:31:28.797Z Last Updated: 2025-04-30T18:58:18.908Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: ABB Products: ANC, ANC-L, ANC-mini Problem Types: CWE-471 Description: : Modification of Assumed-Immutable Data (MAID) vulnerability in ABB ANC, ABB ANC-L, ABB ANC-mini.This issue affects ANC: through 1.1.4; ANC-L: through 1.1.4; ANC-mini: through 1.1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=2CRT000006&LanguageCode=en&DocumentPartId=PDF&Action=Launch
CVE ID: CVE-2024-9877 State: PUBLISHED Published: 2025-04-30T18:37:45.828Z Last Updated: 2025-04-30T18:43:32.990Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: ABB Products: ANC, ANC-L, ANC-mini Problem Types: CWE-598 Description: : Use of GET Request Method With Sensitive Query Strings vulnerability in ABB ANC, ABB ANC-L, ABB ANC-mini.This issue affects ANC: through 1.1.4; ANC-L: through 1.1.4; ANC-mini: through 1.1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=2CRT000006&LanguageCode=en&DocumentPartId=PDF&Action=Launch
CVE ID: CVE-2024-9878 State: PUBLISHED Published: 2024-11-05T09:30:58.925Z Last Updated: 2024-11-05T13:29:57.917Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: 10web Products: Photo Gallery by 10Web – Mobile-Friendly Image Gallery Problem Types: CWE-79 Description: The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.8.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that wil
thenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bfa1192b-34f5-4b71-8fff-14f2d4ac4aca?source=cve - https://packetstormsecurity.com/files/179357/WordPress-Photo-Gallery-1.8.26-Cross-Site-Scripting.html - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3180567%40photo-gallery%2Ftrunk&old=3171538%40photo-gallery%2Ftrunk
ss.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3180567%40photo-gallery%2Ftrunk&old=3171538%40photo-gallery%2Ftrunk&sfp_email=&sfph_mail=#file12
CVE ID: CVE-2024-9879 State: PUBLISHED Published: 2025-05-15T20:07:24.310Z Last Updated: 2025-05-16T20:25:53.107Z Vendors: Unknown Products: Melapress File Monitor Problem Types: CWE-89 SQL Injection Description: The Melapress File Monitor WordPress plugin before 2.1.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/cda54097-4aec-472e-a73f-31ecb76ebb23/
CVE ID: CVE-2024-9880 State: REJECTED Published: 2025-03-20T10:09:04.353Z Last Updated: 2025-03-26T17:02:39.383Z Description: No description available.
CVE ID: CVE-2024-9881 State: PUBLISHED Published: 2024-12-12T06:00:19.491Z Last Updated: 2024-12-12T17:21:08.999Z Vendors: Unknown Products: LearnPress Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The LearnPress WordPress plugin before 4.2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ec76f73a-7ad4-432d-8216-7cdb5603cef9/
CVE ID: CVE-2024-9882 State: PUBLISHED Published: 2025-05-15T20:07:24.507Z Last Updated: 2025-05-17T02:52:59.079Z Vendors: Unknown Products: Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References
capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7f7667fd-6ac6-4c90-aaf0-c7862bd8e9bd/
CVE ID: CVE-2024-9883 State: PUBLISHED Published: 2024-11-05T06:00:08.587Z Last Updated: 2024-11-05T15:42:43.505Z Vendors: Unknown Products: Pods Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Pods WordPress plugin before 3.2.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ea4b277e-ef47-4e38-bd82-c5a54a95372f/
CVE ID: CVE-2024-9884 State: PUBLISHED Published: 2024-10-30T02:04:33.458Z Last Updated: 2024-10-30T13:03:33.479Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: twinpictures Products: T(-) Countdown Problem Types: CWE-79 Description: The T(-) Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tminus' shortcode in all versions up to, and including, 2.4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a
ontributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/23a0dcdf-e98f-4e24-9900-49ca522b8038?source=cve - https://plugins.trac.wordpress.org/browser/t-countdown/trunk/t-countdown.php#L810 - https://wordpress.org/plugins/t-countdown/
CVE ID: CVE-2024-9885 State: PUBLISHED Published: 2024-10-30T02:32:18.210Z Last Updated: 2024-10-30T13:02:52.307Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: fstaude Products: Widget or Sidebar Shortcode Problem Types: CWE-79 Description: The Widget or Sidebar Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sidebar' shortcode in all versions up to, and including, 0.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute when
ated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/20584675-0d4a-4215-8132-e9ea95bee09b?source=cve - https://plugins.trac.wordpress.org/browser/widget-or-sidebar-per-shortcode/trunk/class-widget-or-sidebar-per-shortcode.php#L89 - https://wordpress.org/plugins/widget-or-sidebar-per-shortcode/
CVE ID: CVE-2024-9886 State: PUBLISHED Published: 2024-10-30T02:04:37.585Z Last Updated: 2024-10-30T13:03:13.281Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: suifengtec Products: WP Baidu Map Problem Types: CWE-79 Description: The WP Baidu Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'baidu_map' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an i
ributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ccd917ae-3fa2-47b5-ace7-1462647e2352?source=cve - https://plugins.trac.wordpress.org/browser/wp-baidu-map/trunk/wp-baidu-map.php - https://wordpress.org/plugins/wp-baidu-map/
CVE ID: CVE-2024-9887 State: PUBLISHED Published: 2024-11-16T09:36:34.031Z Last Updated: 2024-11-19T15:27:53.860Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: cyberlord92 Products: Login using WordPress Users ( WP as SAML IDP ) Problem Types: CWE-89 Description: The Login using WordPress Users ( WP as SAML IDP ) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.15.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to
e existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/220b0e71-8e80-4a29-982e-259a475835fe?source=cve - https://github.com/GumGumZz/wordpress/blob/main/miniorange-wp-as-saml-idp.md - https://plugins.trac.wordpress.org/browser/miniorange-wp-as-saml-idp/trunk/controllers/sso-idp-settings.php#L46 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3184
rollers/sso-idp-settings.php#L46 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3184249%40miniorange-wp-as-saml-idp%2Ftrunk&old=3158222%40miniorange-wp-as-saml-idp%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-9888 State: PUBLISHED Published: 2024-10-16T05:31:56.677Z Last Updated: 2024-10-16T16:10:45.410Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: elementinvader Products: ElementInvader Addons for Elementor Problem Types: CWE-79 Description: The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's contact form widget redirect URL in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scr
This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ba9d12c5-fe3a-4958-8d35-c63bb05b6d5a?source=cve - https://plugins.trac.wordpress.org/changeset/3168782/elementinvader-addons-for-elementor/trunk/modules/forms/ajax-handler.php
CVE ID: CVE-2024-9889 State: PUBLISHED Published: 2024-10-19T06:42:02.835Z Last Updated: 2024-10-21T15:19:50.268Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: elementinvader Products: ElementInvader Addons for Elementor Problem Types: CWE-200 Description: The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.9 via the Page Loader widget. This makes it possible for authenticated attackers, with contributor-level access and above, to view private/draft/password protected posts, pages, and Elementor templates that they should not have access to. Additional Analys
te/draft/password protected posts, pages, and Elementor templates that they should not have access to. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9bd04f78-0b9c-4985-b450-007bb5cc9e26?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3171339%40elementinvader-addons-for-elementor&new=3171339%40elementinvader-addons-for-elementor&sfp_email=&sfph_mail=
CVE ID: CVE-2024-9890 State: PUBLISHED Published: 2024-10-26T01:58:35.496Z Last Updated: 2024-10-28T19:34:19.279Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: deryck Products: User Toolkit Problem Types: CWE-288 Description: The User Toolkit plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.2.3. This is due to an improper capability check in the 'switchUser' function. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to log in as any existing user on the site, such as an administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.word
on the site, such as an administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/805f18e2-9a5a-48cf-81f4-825da4bfd8ef?source=cve - https://plugins.trac.wordpress.org/browser/user-toolkit/tags/1.2.3/src/UserSwitch.php#L51 - https://plugins.trac.wordpress.org/changeset/3175190/user-toolkit#file5
CVE ID: CVE-2024-9891 State: PUBLISHED Published: 2024-10-16T02:05:05.861Z Last Updated: 2024-10-16T13:31:23.195Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: zluck Products: Multiline files upload for contact form 7 Problem Types: CWE-862 Description: The Multiline files upload for contact form 7 plugin for WordPress is vulnerable to unauthorized plugin deactivation due to a missing capability check on the mfcf7_zl_custom_handle_deactivation_plugin_form_submission() function in all versions up to, and including, 2.8.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivate the plugin and send a custom re
sible for authenticated attackers, with Subscriber-level access and above, to deactivate the plugin and send a custom reason from the site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5cf62f45-a142-497e-9838-ce0b1b1bb3d3?source=cve - https://plugins.trac.wordpress.org/tags/2.8.1/multiline-files-for-contact-form-7/multiline-admin.php#L410 - https://plugins.trac.wordpress.org/changeset/3169228/
CVE ID: CVE-2024-9892 State: PUBLISHED Published: 2024-10-18T04:32:56.793Z Last Updated: 2024-10-18T16:35:43.504Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: apintop Products: Add Widget After Content Problem Types: CWE-79 Description: The Add Widget After Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This o
and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e02472a8-5b88-43ad-86f3-e890b49899ad?source=cve - https://plugins.trac.wordpress.org/browser/add-widget-after-content/trunk/add-widget-after-content-admin.php#L320
CVE ID: CVE-2024-9893 State: PUBLISHED Published: 2024-10-16T13:56:39.004Z Last Updated: 2025-02-19T17:27:34.589Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: nextendweb Products: Nextend Social Login Pro Problem Types: CWE-288 Description: The Nextend Social Login Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.1.14. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email and the user does not have an alre
existing user on the site, such as an administrator, if they have access to the email and the user does not have an already-existing account for the service returning the token. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0e4588d1-f21e-48ba-a8cb-d18c421f000a?source=cve - https://nextendweb.com/social-login/ - https://wordpress.org/plugins/nextend-facebook-connect/#developers
CVE ID: CVE-2024-9894 State: PUBLISHED Published: 2024-10-12T12:31:04.789Z Last Updated: 2024-10-15T14:41:35.303Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Blood Bank System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in code-projects Blood Bank System 1.0. Affected is an unknown function of the file reset.php. The manipulation of the argument useremail leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280164 - https://vuldb.com/?ct
d. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280164 - https://vuldb.com/?ctiid.280164 - https://vuldb.com/?submit.422189 - https://github.com/siyuancn-hub/cve/blob/main/sql7-.md - https://code-projects.org/