Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-5050 State: PUBLISHED Published: 2024-05-17T14:00:07.630Z Last Updated: 2024-08-01T21:03:10.648Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Wangshen Products: SecGate 3600 Problem Types: CWE-434 Description: A vulnerability, which was classified as critical, was found in Wangshen SecGate 3600 up to 20240516. This affects an unknown part of the file /?g=log_import_save. The manipulation of the argument reqfile leads to unrestricted upload. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-264747. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id
-264747. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.264747 - https://vuldb.com/?ctiid.264747 - https://vuldb.com/?submit.335968 - https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/s%40%23NGfP%7B4%5Et(%7C%5Dd9/Wangshen%20SecGata%203600%20Firewall%20log_import_save%20arbitrary%20file%20upload%20vulnerability.pdf
CVE ID: CVE-2024-5051 State: PUBLISHED Published: 2024-05-17T14:31:04.711Z Last Updated: 2024-08-01T21:03:10.527Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Gas Agency Management System Problem Types: CWE-89 Description: A vulnerability has been found in SourceCodester Gas Agency Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file edituser.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264748. Additional Analyst Notes: - CISA ADP Vulnrichmen
ic and may be used. The identifier of this vulnerability is VDB-264748. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.264748 - https://vuldb.com/?ctiid.264748 - https://vuldb.com/?submit.336010 - https://github.com/HuoMingZ/aoligei/blob/main/Gas.md
CVE ID: CVE-2024-5052 State: PUBLISHED Published: 2024-05-17T09:40:02.877Z Last Updated: 2024-08-01T21:03:10.741Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Cerberus FTP Enterprise Products: Cerberus FTP Enterprise Problem Types: CWE-400 Description: Denial of Service (DoS) vulnerability for Cerberus Enterprise 8.0.10.3 web administration. The vulnerability exists when the web server, default port 10001, attempts to process a large number of incomplete HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/resource-consumption-vulnerability-cerberus-ftp-en
ner: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/resource-consumption-vulnerability-cerberus-ftp-enterprise
CVE ID: CVE-2024-5053 State: PUBLISHED Published: 2024-09-01T10:58:05.084Z Last Updated: 2024-09-03T14:20:24.504Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: techjewel Products: Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder Problem Types: CWE-285 Description: The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized Malichimp API key update due to an insufficient capability check on the verifyRequest function in all versions up to, and including, 5.1.18. This makes it possible for Form Managers with a Subscriber-level access and abov
versions up to, and including, 5.1.18. This makes it possible for Form Managers with a Subscriber-level access and above to modify the Mailchimp API key used for integration. At the same time, missing Mailchimp API key validation allows the redirect of the integration requests to the attacker-controlled server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8242e0f0-b9c5-46fe-b691-3275cd0f9a43?source=cve - https://plugins.trac.wordpress.org/browser/fluentform/trunk/app/Http/Routes/api.php#L91 - https://plugins.trac.wordpress.org/browser/fluentform/trunk/app/Http/Policies/FormPolicy.php#L17 - https://plugins.trac.wor
ps://plugins.trac.wordpress.org/browser/fluentform/trunk/app/Http/Policies/FormPolicy.php#L17 - https://plugins.trac.wordpress.org/browser/fluentform/trunk/app/Services/Integrations/MailChimp/MailChimp.php#L40
CVE ID: CVE-2024-5054 State: REJECTED Published: N/A Last Updated: 2025-07-05T22:16:33.728Z Description: No description available.
CVE ID: CVE-2024-5055 State: PUBLISHED Published: 2024-05-17T12:03:19.748Z Last Updated: 2024-08-01T21:03:10.356Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Apache Friends Products: XAMPP Problem Types: CWE-400 Description: Uncontrolled resource consumption vulnerability in XAMPP Windows, versions 7.3.2 and earlier. This vulnerability exists when XAMPP attempts to process many incomplete HTTP requests, resulting in resource consumption and system crashes. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/vulnerability-uncontrolled-resource-consumption-xampp
CVE ID: CVE-2024-5056 State: PUBLISHED Published: 2024-06-12T12:10:43.250Z Last Updated: 2024-08-01T21:03:10.683Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Schneider Electric Products: Modicon M340, Network module, Modicon M340, Modbus/TCP BMXNOE0100, Network module, Modicon M340, Ethernet TCP/IP BMXNOE0110 Problem Types: CWE-552 Description: CWE-552: Files or Directories Accessible to External Parties vulnerability exists which may prevent user to update the device firmware and prevent proper behavior of the webserver when specific files or directories are removed from the filesystem. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Co
iles or directories are removed from the filesystem. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-163-01.pdf
CVE ID: CVE-2024-5057 State: PUBLISHED Published: 2024-08-29T14:04:35.019Z Last Updated: 2024-08-29T14:27:46.777Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: Easy Digital Downloads Products: Easy Digital Downloads Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Easy Digital Downloads allows SQL Injection.This issue affects Easy Digital Downloads: from n/a through 3.2.12. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/easy-digital-downloads/wordpress-easy-digital-downloads-plugin-3-2-12-sql-injection-vu
hstack.com/database/vulnerability/easy-digital-downloads/wordpress-easy-digital-downloads-plugin-3-2-12-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2024-5058 State: PUBLISHED Published: 2024-06-21T11:37:26.896Z Last Updated: 2024-08-01T21:03:10.616Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: WPDeveloper Products: Typing Text Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPDeveloper Typing Text allows Stored XSS.This issue affects Typing Text: from n/a through 1.2.5. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/typing-text/wordpress-typing-text-plugin-1-2-5-cross-site-scripting-xss-vulnerability?_s_id=
.com/database/vulnerability/typing-text/wordpress-typing-text-plugin-1-2-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-5059 State: PUBLISHED Published: 2024-06-21T13:03:31.137Z Last Updated: 2024-08-01T21:03:10.316Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: A WP Life Products: Event Management Tickets Booking Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in A WP Life Event Management Tickets Booking.This issue affects Event Management Tickets Booking: from n/a through 1.4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/event-monster/wordpress-event-monster-plugin-1-4-0-sensitive-data-exposure-vulnerab
atchstack.com/database/vulnerability/event-monster/wordpress-event-monster-plugin-1-4-0-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2024-5060 State: PUBLISHED Published: 2024-05-24T06:42:16.556Z Last Updated: 2024-08-01T21:03:10.626Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: kapasias Products: LottieFiles – JSON Based Animation Lottie & Bodymovin for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The LottieFiles – JSON Based Animation Lottie & Bodymovin for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.10.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi
.10.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/74f59ee0-19dd-4cc9-ab24-22f26d71d248?source=cve - https://plugins.trac.wordpress.org/browser/include-lottie-animation-for-elementor/tags/1.10.9/include/jbafe-json-anim-widget.php#L1180 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3089058%40include-lotti
get.php#L1180 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3089058%40include-lottie-animation-for-elementor%2Ftags%2F1.10.9&new=3089058%40include-lottie-animation-for-elementor%2Ftags%2F1.10.10
CVE ID: CVE-2024-5061 State: PUBLISHED Published: 2024-08-30T03:24:15.330Z Last Updated: 2024-08-30T14:06:54.100Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Kriesi Products: Enfold - Responsive Multi-Purpose Theme Problem Types: CWE-79 Description: The Enfold - Responsive Multi-Purpose Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wrapper_class’ and 'class' parameters in all versions up to, and including, 6.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute
nticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/25462492-59d2-44b7-81c3-93ac04a08bcc?source=cve - https://themeforest.net/item/enfold-responsive-multipurpose-theme/4519990
CVE ID: CVE-2024-5062 State: PUBLISHED Published: 2024-06-30T15:14:25.313Z Last Updated: 2024-08-01T21:03:10.618Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: zenml-io Products: zenml-io/zenml Problem Types: CWE-79 Description: A reflected Cross-Site Scripting (XSS) vulnerability was identified in zenml-io/zenml version 0.57.1. The vulnerability exists due to improper neutralization of input during web page generation, specifically within the survey redirect parameter. This flaw allows an attacker to redirect users to a specified URL after completing a survey, without proper validation of the 'redirect' parameter. Consequently, an attacker can execute arb
er completing a survey, without proper validation of the 'redirect' parameter. Consequently, an attacker can execute arbitrary JavaScript code in the context of the user's browser session. This vulnerability could be exploited to steal cookies, potentially leading to account takeover. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/ceddd3c1-a9da-4d6c-85c4-41d4d1e1102f - https://github.com/zenml-io/zenml/commit/21edd863c0ba53c1110b6f018a07c2d6853cf6d4
CVE ID: CVE-2024-5063 State: PUBLISHED Published: 2024-05-17T18:31:04.690Z Last Updated: 2024-08-01T21:03:10.441Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Online Course Registration System Problem Types: CWE-89 Description: A vulnerability was found in PHPGurukul Online Course Registration System 3.1. It has been declared as critical. This vulnerability affects unknown code of the file /admin/index.php. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-264922 is the identifier assigned to this vulnerability. Additional Analy
n disclosed to the public and may be used. VDB-264922 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.264922 - https://vuldb.com/?ctiid.264922 - https://vuldb.com/?submit.336236 - https://github.com/BurakSevben/CVEs/blob/main/Online%20Course%20Registration%20System/Online%20Course%20Registration%20System%20-%20Authentication%20Bypass.md
CVE ID: CVE-2024-5064 State: PUBLISHED Published: 2024-05-17T18:31:06.286Z Last Updated: 2024-08-01T21:03:10.496Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Online Course Registration System Problem Types: CWE-89 Description: A vulnerability was found in PHPGurukul Online Course Registration System 3.1. It has been rated as critical. This issue affects some unknown processing of the file news-details.php. The manipulation of the argument nid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-264923. Additional Analyst Notes: -
the public and may be used. The associated identifier of this vulnerability is VDB-264923. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.264923 - https://vuldb.com/?ctiid.264923 - https://vuldb.com/?submit.336238 - https://github.com/BurakSevben/CVEs/blob/main/Online%20Course%20Registration%20System/Online%20Course%20Registration%20System%20-%20SQL%20Injection%20-%202%20(Unauthenticated).md
CVE ID: CVE-2024-5065 State: PUBLISHED Published: 2024-05-17T20:00:04.992Z Last Updated: 2024-08-01T21:03:10.474Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Online Course Registration System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in PHPGurukul Online Course Registration System 3.1. Affected is an unknown function of the file /onlinecourse/. The manipulation of the argument regno leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264924. Additional Analyst Notes: - CISA ADP Vulnrich
ublic and may be used. The identifier of this vulnerability is VDB-264924. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.264924 - https://vuldb.com/?ctiid.264924 - https://vuldb.com/?submit.336239 - https://github.com/BurakSevben/CVEs/blob/main/Online%20Course%20Registration%20System/Online%20Course%20Registration%20System%20-%20SQL%20Injection%20-%203%20(Unauthenticated).md
CVE ID: CVE-2024-5066 State: PUBLISHED Published: 2024-05-17T20:00:06.464Z Last Updated: 2024-08-08T14:37:56.667Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: PHPGurukul Products: Online Course Registration System Problem Types: CWE-89 Description: A vulnerability classified as critical was found in PHPGurukul Online Course Registration System 3.1. Affected by this vulnerability is an unknown functionality of the file /pincode-verification.php. The manipulation of the argument pincode leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-264925 was assigned to this vulnerability. Additiona
as been disclosed to the public and may be used. The identifier VDB-264925 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.264925 - https://vuldb.com/?ctiid.264925 - https://vuldb.com/?submit.336240 - https://github.com/BurakSevben/CVEs/blob/main/Online%20Course%20Registration%20System/Online%20Course%20Registration%20System%20-%20SQL%20Injection%20-%204.md
CVE ID: CVE-2024-5067 State: PUBLISHED Published: 2024-07-24T22:08:05.034Z Last Updated: 2024-08-29T15:04:59.039Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-200 Description: An issue was discovered in GitLab EE affecting all versions starting from 16.11 prior to 17.0.5, starting from 17.1 prior to 17.1.3, and starting from 17.2 prior to 17.2.1 where certain project-level analytics settings could be leaked in DOM to group members with Developer or higher roles. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/458504 - https://
ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/458504 - https://gitlab.com/gitlab-org/gitlab/-/issues/462427 - https://hackerone.com/reports/2462303 - https://hackerone.com/reports/2502047
CVE ID: CVE-2024-5069 State: PUBLISHED Published: 2024-05-17T21:00:05.326Z Last Updated: 2024-08-01T21:03:10.604Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Simple Online Mens Salon Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in SourceCodester Simple Online Mens Salon Management System 1.0. Affected by this issue is some unknown functionality of the file view_service.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-264926 is the identifier assigned to this vu
remotely. The exploit has been disclosed to the public and may be used. VDB-264926 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.264926 - https://vuldb.com/?ctiid.264926 - https://vuldb.com/?submit.336842 - https://github.com/menxin996/Cvehub/blob/main/Men's%20Salon%20Management%20System%20%20view_service.php%20has%20Sqlinjection.pdf
CVE ID: CVE-2024-5071 State: PUBLISHED Published: 2024-06-26T06:00:04.151Z Last Updated: 2024-10-28T20:13:18.059Z Vendors: Unknown Products: Bookster Problem Types: CWE-863 Incorrect Authorization Description: The Bookster WordPress plugin through 1.1.0 allows adding sensitive parameters when validating appointments allowing attackers to manipulate the data sent when booking an appointment (the request body) to change its status from pending to approved. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/07b293cf-5174-45de-8606-a782a96a35b3/
CVE ID: CVE-2024-5072 State: PUBLISHED Published: 2024-05-17T15:18:15.722Z Last Updated: 2025-03-13T16:45:40.484Z Vendors: Devolutions Products: Server Description: Improper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.11.0 and earlier allows an authenticated user with access to the PAM JIT elevation feature to manipulate the LDAP filter query via a specially crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://devolutions.net/security/advisories/DEVO-2024-0007
CVE ID: CVE-2024-5073 State: PUBLISHED Published: 2024-05-30T06:48:08.882Z Last Updated: 2024-08-01T21:03:10.538Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpdevteam Products: Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Twitter Feed component in all versions up to, and including, 5.9.21 due to insufficient input
ss-Site Scripting via the Twitter Feed component in all versions up to, and including, 5.9.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c8db80ef-5863-41dd-b33f-850984a72ee6?source=cve - https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Traits/Twitter_Feed.php#L210 - https://wordpress.org/plugin
g/browser/essential-addons-for-elementor-lite/trunk/includes/Traits/Twitter_Feed.php#L210 - https://wordpress.org/plugins/essential-addons-for-elementor-lite/#developers - https://plugins.trac.wordpress.org/changeset/3090746/
CVE ID: CVE-2024-5074 State: PUBLISHED Published: 2024-07-13T06:00:08.534Z Last Updated: 2024-08-01T21:03:10.754Z Vendors: Unknown Products: wp-eMember Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The wp-eMember WordPress plugin before 10.6.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/174a2ba8-0215-480f-93ec-83ebc4a3200e/
CVE ID: CVE-2024-5075 State: PUBLISHED Published: 2024-07-13T06:00:08.729Z Last Updated: 2024-08-01T21:03:10.348Z Vendors: Unknown Products: wp-eMember Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The wp-eMember WordPress plugin before 10.6.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/b47d93d6-5511-451a-853f-c8b0fba20969/
CVE ID: CVE-2024-5076 State: PUBLISHED Published: 2024-07-13T06:00:08.934Z Last Updated: 2024-08-01T21:03:10.703Z Vendors: Unknown Products: wp-eMember Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The wp-eMember WordPress plugin before 10.6.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/01cbc841-a30f-4df5-ab7f-0c2c7469657b/