Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
disclosed to the public and may be used. The identifier VDB-273145 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.273145 - https://vuldb.com/?ctiid.273145 - https://vuldb.com/?submit.381094 - https://github.com/DeepMountains/Mirage/blob/main/CVE8-4.md
CVE ID: CVE-2024-7277 State: PUBLISHED Published: 2024-07-30T23:31:04.329Z Last Updated: 2024-08-01T21:52:31.638Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: itsourcecode Products: Alton Management System Problem Types: CWE-434 Description: A vulnerability was found in itsourcecode Alton Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/menu.php of the component Add a Menu. The manipulation of the argument image leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-273146 is the identifier assigned to this vulnerability. Addit
oit has been disclosed to the public and may be used. VDB-273146 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.273146 - https://vuldb.com/?ctiid.273146 - https://vuldb.com/?submit.381095 - https://github.com/DeepMountains/Mirage/blob/main/CVE8-5.md
CVE ID: CVE-2024-7278 State: PUBLISHED Published: 2024-07-31T00:00:08.789Z Last Updated: 2024-08-01T21:52:31.204Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: itsourcecode Products: Alton Management System Problem Types: CWE-89 Description: A vulnerability was found in itsourcecode Alton Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/team_save.php. The manipulation of the argument team leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273147. Additional Analyst Notes: - CISA ADP V
c and may be used. The associated identifier of this vulnerability is VDB-273147. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.273147 - https://vuldb.com/?ctiid.273147 - https://vuldb.com/?submit.381096 - https://github.com/DeepMountains/Mirage/blob/main/CVE8-6.md
CVE ID: CVE-2024-7279 State: PUBLISHED Published: 2024-07-31T00:31:03.880Z Last Updated: 2024-07-31T14:02:11.606Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Lot Reservation Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Lot Reservation Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/ajax.php?action=login. The manipulation of the argument username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273148. Additional Ana
oit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273148. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273148 - https://vuldb.com/?ctiid.273148 - https://vuldb.com/?submit.381195 - https://gist.github.com/topsky979/8eb5a3711f4802b2b05ae3702addb61e
CVE ID: CVE-2024-7280 State: PUBLISHED Published: 2024-07-31T01:00:14.310Z Last Updated: 2024-07-31T18:20:19.627Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Lot Reservation Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Lot Reservation Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/view_reserved.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273149 was assigned to this vulnerability. Additional Ana
en disclosed to the public and may be used. The identifier VDB-273149 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273149 - https://vuldb.com/?ctiid.273149 - https://vuldb.com/?submit.381196 - https://gist.github.com/topsky979/c4e972f03739833ad2d111493f44138b
CVE ID: CVE-2024-7281 State: PUBLISHED Published: 2024-07-31T01:31:03.655Z Last Updated: 2024-07-31T15:15:40.258Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Lot Reservation Management System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in SourceCodester Lot Reservation Management System 1.0. Affected is an unknown function of the file /admin/index.php?page=manage_lot. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-273150 is the identifier assigned to this vulnerability. Additional An
been disclosed to the public and may be used. VDB-273150 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273150 - https://vuldb.com/?ctiid.273150 - https://vuldb.com/?submit.381197 - https://gist.github.com/topsky979/13cfd55966ffe12c8904de995400fc33
CVE ID: CVE-2024-7282 State: PUBLISHED Published: 2024-07-31T02:00:06.585Z Last Updated: 2024-07-31T14:17:37.680Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Lot Reservation Management System Problem Types: CWE-89 Description: A vulnerability classified as critical was found in SourceCodester Lot Reservation Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/manage_model.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273151. Additio
has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273151. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273151 - https://vuldb.com/?ctiid.273151 - https://vuldb.com/?submit.381198 - https://gist.github.com/topsky979/16181c02e770952091a36784da530eab
CVE ID: CVE-2024-7283 State: PUBLISHED Published: 2024-07-31T02:31:03.785Z Last Updated: 2024-07-31T15:36:24.025Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Lot Reservation Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in SourceCodester Lot Reservation Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/manage_user.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273152. Addition
e exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273152. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273152 - https://vuldb.com/?ctiid.273152 - https://vuldb.com/?submit.381199 - https://gist.github.com/topsky979/0cda40ceee628634e4bc984cc5651b51
CVE ID: CVE-2024-7284 State: PUBLISHED Published: 2024-07-31T03:00:08.531Z Last Updated: 2024-07-31T15:35:38.933Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Lot Reservation Management System Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in SourceCodester Lot Reservation Management System 1.0. This affects an unknown part of the file /admin/ajax.php?action=save_settings. The manipulation of the argument about leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273153 was assigned to this vulner
ely. The exploit has been disclosed to the public and may be used. The identifier VDB-273153 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273153 - https://vuldb.com/?ctiid.273153 - https://vuldb.com/?submit.381223 - https://gist.github.com/topsky979/16da371a38fd91d64765fd16ed3d049e
CVE ID: CVE-2024-7285 State: PUBLISHED Published: 2024-07-31T03:31:04.494Z Last Updated: 2024-07-31T14:16:13.130Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Establishment Billing Management System Problem Types: CWE-79 Description: A vulnerability has been found in SourceCodester Establishment Billing Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /admin/ajax.php?action=save_settings. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-273154 is the identifier assigned to thi
ted remotely. The exploit has been disclosed to the public and may be used. VDB-273154 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273154 - https://vuldb.com/?ctiid.273154 - https://vuldb.com/?submit.381467 - https://gist.github.com/topsky979/e2fa238262fcafdd8e301c32ee9f8e3a
CVE ID: CVE-2024-7286 State: PUBLISHED Published: 2024-07-31T04:00:08.887Z Last Updated: 2024-07-31T14:01:06.515Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Establishment Billing Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Establishment Billing Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/ajax.php?action=login of the component Login. The manipulation of the argument username leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this v
be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273155. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273155 - https://vuldb.com/?ctiid.273155 - https://vuldb.com/?submit.381468 - https://gist.github.com/topsky979/da1899833a862fb19fcc146b6725a67b
CVE ID: CVE-2024-7287 State: PUBLISHED Published: 2024-07-31T04:31:04.244Z Last Updated: 2024-07-31T15:34:31.108Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Establishment Billing Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Establishment Billing Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /manage_user.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273156. Additional Analyst
has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273156. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273156 - https://vuldb.com/?ctiid.273156 - https://vuldb.com/?submit.381469 - https://gist.github.com/topsky979/d4684a6cf3ca446bb7c71c51ff6152ba
CVE ID: CVE-2024-7288 State: PUBLISHED Published: 2024-07-31T05:00:07.331Z Last Updated: 2024-07-31T15:20:00.317Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Establishment Billing Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Establishment Billing Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=delete_block. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273157 was assigned to
unched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273157 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273157 - https://vuldb.com/?ctiid.273157 - https://vuldb.com/?submit.381470 - https://gist.github.com/topsky979/f495fd0ec7cdda5c7c6059a0b2224b64
CVE ID: CVE-2024-7289 State: PUBLISHED Published: 2024-07-31T05:31:04.491Z Last Updated: 2024-07-31T15:33:53.112Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Establishment Billing Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Establishment Billing Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /manage_payment.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-273158 is the identifier assigned to this vulnerability.
e exploit has been disclosed to the public and may be used. VDB-273158 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273158 - https://vuldb.com/?ctiid.273158 - https://vuldb.com/?submit.381471 - https://gist.github.com/topsky979/7f65e9704b8650e6bee74190f96d21e3
CVE ID: CVE-2024-7290 State: PUBLISHED Published: 2024-07-31T06:00:07.320Z Last Updated: 2024-07-31T15:33:18.370Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Establishment Billing Management System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in SourceCodester Establishment Billing Management System 1.0. This affects an unknown part of the file /manage_tenant.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273159. Additional Ana
n disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273159. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273159 - https://vuldb.com/?ctiid.273159 - https://vuldb.com/?submit.381487 - https://gist.github.com/topsky979/e40f691866138ea1abf3ca452c4ae3ac
CVE ID: CVE-2024-7291 State: PUBLISHED Published: 2024-08-03T06:41:39.862Z Last Updated: 2024-08-07T15:57:47.794Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: jetmonsters Products: JetFormBuilder — Dynamic Blocks Form Builder Problem Types: CWE-269 Description: The JetFormBuilder plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.3.4.1. This is due to improper restriction on user meta fields. This makes it possible for authenticated attackers, with administrator-level and above permissions, to register as super-admins on the sites configured as multi-sites. Additional Analyst Notes: - CISA ADP Vulnrichment: Re
o register as super-admins on the sites configured as multi-sites. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0d8ea1c2-7c6e-43b3-97ca-a06438d51d11?source=cve - https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.3.4.1/includes/actions/types/register-user.php#L220 - https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.3.4.1/includes/actions/methods/update-user/user-meta-property.php#L23
CVE ID: CVE-2024-7292 State: PUBLISHED Published: 2024-10-09T14:47:10.831Z Last Updated: 2024-10-16T15:01:22.209Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Progress Software Corporation Products: Telerik Report Server Problem Types: CWE-307 Description: In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), a credential stuffing attack is possible through improper restriction of excessive login attempts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.telerik.com/report-server/knowledge-base/improper-restriction-of-excessive-login-attempts-cve-2024-7292
CVE ID: CVE-2024-7293 State: PUBLISHED Published: 2024-10-09T14:43:28.711Z Last Updated: 2024-10-09T16:18:01.674Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Progress Software Corporation Products: Telerik Report Server Problem Types: CWE-521 Description: In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), a password brute forcing attack is possible through weak password requirements. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.telerik.com/report-server/knowledge-base/weak-password-requirement-cve-2024-7293
CVE ID: CVE-2024-7294 State: PUBLISHED Published: 2024-10-09T14:45:30.445Z Last Updated: 2024-10-09T16:17:21.325Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Progress Software Corporation Products: Telerik Report Server Problem Types: CWE-400 Description: In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), an HTTP DoS attack is possible on anonymous endpoints without rate limiting. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.telerik.com/report-server/knowledge-base/uncontrolled-resource-consumption-cve-2024-7294
CVE ID: CVE-2024-7295 State: PUBLISHED Published: 2024-11-13T15:22:28.781Z Last Updated: 2024-11-13T19:13:33.110Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Progress Software Corporation Products: Telerik Report Server Problem Types: CWE-798 Description: In Progress® Telerik® Report Server versions prior to 2024 Q4 (10.3.24.1112), the encryption of local asset data used an older algorithm which may allow a sophisticated actor to decrypt this information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.telerik.com/report-server/knowledge-base/encryption-weakness-cve-2024-7295
CVE ID: CVE-2024-7296 State: PUBLISHED Published: 2025-03-13T06:00:54.415Z Last Updated: 2025-03-14T13:43:35.011Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-863 Description: An issue was discovered in GitLab EE affecting all versions from 16.5 prior to 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2 which allowed a user with a custom permission to approve pending membership requests beyond the maximum number of allowed users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/475056 - https://hackerone.com/reports/2602274
CVE ID: CVE-2024-7297 State: PUBLISHED Published: 2024-07-30T16:13:48.008Z Last Updated: 2024-08-01T21:52:31.427Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Problem Types: CWE-913 Description: Langflow versions prior to 1.0.13 suffer from a Privilege Escalation vulnerability, allowing a remote and low privileged attacker to gain super admin privileges by performing a mass assignment request on the '/api/v1/users' endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2024-26
CVE ID: CVE-2024-7298 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:04:57.920Z Description: No description available.
CVE ID: CVE-2024-7299 State: PUBLISHED Published: 2024-07-31T06:31:04.296Z Last Updated: 2024-07-31T15:32:33.267Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Bolt Products: CMS Problem Types: CWE-79 Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Bolt CMS 3.7.1. It has been rated as problematic. This issue affects some unknown processing of the file /preview/page of the component Entry Preview Handler. The manipulation of the argument body leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273167. NOTE: This vulnerabil
osed to the public and may be used. The associated identifier of this vulnerability is VDB-273167. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the affected release tree is end-of-life. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273167 - https://vuldb.com/?ctiid.273167 - https://vuldb.com/?submit.379971
CVE ID: CVE-2024-7300 State: PUBLISHED Published: 2024-07-31T07:00:06.610Z Last Updated: 2024-08-19T13:34:37.679Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Bolt Products: CMS Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in Bolt CMS 3.7.1. Affected is an unknown function of the file /bolt/editcontent/showcases of the component Showcase Creation Handler. The manipulation of the argument title/textarea leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
e public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the affected release tree is end-of-life. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273168 - https://vuldb.com/?ctiid.273168 - https://vuldb.com/?submit.380678
CVE ID: CVE-2024-7301 State: PUBLISHED Published: 2024-08-16T04:29:26.598Z Last Updated: 2024-08-16T16:09:55.887Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: nickboss Products: WordPress File Upload Problem Types: CWE-79 Description: The WordPress File Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.24.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References
s that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e2b16b9c-48c7-4370-839b-696797ff2101?source=cve - https://plugins.trac.wordpress.org/browser/wp-file-upload/tags/4.24.8/lib/wfu_io.php#L176 - https://wordpress.org/plugins/wp-file-upload/#developers - https://plugins.trac.wordpress.org/browser/wp-file-upload/tags/4.24.8/lib/wfu_security.php#L50 - https://plugins.trac.wordpress.org/changeset/3136025/
CVE ID: CVE-2024-7302 State: PUBLISHED Published: 2024-08-01T06:47:04.088Z Last Updated: 2024-08-05T16:56:30.984Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: pr-gateway Products: Blog2Social: Social Media Auto Post & Scheduler Problem Types: CWE-79 Description: The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 3gp2 file uploads in all versions up to, and including, 7.5.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever