Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-7665 State: PUBLISHED Published: 2024-08-11T07:00:06.567Z Last Updated: 2024-08-12T16:29:56.439Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Car Driving School Management System Problem Types: CWE-89 Description: A vulnerability classified as critical was found in SourceCodester Car Driving School Management System 1.0. Affected by this vulnerability is an unknown functionality of the file manage_package.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274123 - https://vuldb.com/?ctiid.274123 - https://vuldb.com/?submit.388769 - https://github.com/BFS-Lab/BFSDV/blob/main/Sourcecodester%20Online%20Catering%20Reservation%20System%20SQL%20Injection-3.md
CVE ID: CVE-2024-7666 State: PUBLISHED Published: 2024-08-11T07:31:04.049Z Last Updated: 2024-08-12T13:39:01.041Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Car Driving School Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in SourceCodester Car Driving School Management System 1.0. Affected by this issue is some unknown functionality of the file view_package.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
e exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274124 - https://vuldb.com/?ctiid.274124 - https://vuldb.com/?submit.388770 - https://github.com/BFS-Lab/BFSDV/blob/main/Sourcecodester%20Online%20Catering%20Reservation%20System%20SQL%20Injection-4.md
CVE ID: CVE-2024-7667 State: PUBLISHED Published: 2024-08-11T08:00:06.267Z Last Updated: 2024-08-12T12:41:04.271Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Car Driving School Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in SourceCodester Car Driving School Management System 1.0. This affects the function delete_users of the file User.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vul
en disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274125 - https://vuldb.com/?ctiid.274125 - https://vuldb.com/?submit.388771 - https://github.com/BFS-Lab/BFSDV/blob/main/Sourcecodester%20Online%20Catering%20Reservation%20System%20SQL%20Injection-5.md
CVE ID: CVE-2024-7668 State: PUBLISHED Published: 2024-08-11T08:31:03.884Z Last Updated: 2024-08-12T14:09:59.171Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Car Driving School Management System Problem Types: CWE-89 Description: A vulnerability has been found in SourceCodester Car Driving School Management System 1.0 and classified as critical. This vulnerability affects the function delete_package of the file Master.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:
as been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274126 - https://vuldb.com/?ctiid.274126 - https://vuldb.com/?submit.388772 - https://github.com/BFS-Lab/BFSDV/blob/main/Sourcecodester%20Online%20Catering%20Reservation%20System%20SQL%20Injection-6.md
CVE ID: CVE-2024-7669 State: PUBLISHED Published: 2024-08-11T09:00:07.029Z Last Updated: 2024-08-12T14:35:37.293Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Car Driving School Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Car Driving School Management System 1.0 and classified as critical. This issue affects the function delete_enrollment of the file Master.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.co
sclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274127 - https://vuldb.com/?ctiid.274127 - https://vuldb.com/?submit.388773 - https://github.com/BFS-Lab/BFSDV/blob/main/Sourcecodester%20Online%20Catering%20Reservation%20System%20SQL%20Injection-7.md
CVE ID: CVE-2024-7670 State: PUBLISHED Published: 2024-09-30T20:25:32.777Z Last Updated: 2025-08-26T18:09:47.786Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: Navisworks Freedom, Navisworks Simulate, Navisworks Manage Problem Types: CWE-125 Description: A maliciously crafted DWFX file, when parsed in w3dtk.dll through Autodesk Navisworks, can force an Out-of-Bounds Read. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/ad
. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0015
CVE ID: CVE-2024-7671 State: PUBLISHED Published: 2024-09-30T20:28:34.579Z Last Updated: 2025-08-26T18:15:39.138Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: Navisworks Freedom, Navisworks Simulate, Navisworks Manage Problem Types: CWE-787 Description: A maliciously crafted DWFX file, when parsed in dwfcore.dll through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/sec
the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0015
CVE ID: CVE-2024-7672 State: PUBLISHED Published: 2024-09-30T20:29:03.464Z Last Updated: 2025-08-26T18:16:16.268Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: Navisworks Freedom, Navisworks Simulate, Navisworks Manage Problem Types: CWE-787 Description: A maliciously crafted DWF file, when parsed in dwfcore.dll through Autodesk Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/t
text of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0015
CVE ID: CVE-2024-7673 State: PUBLISHED Published: 2024-09-30T20:29:24.756Z Last Updated: 2025-08-26T18:16:57.314Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: Navisworks Freedom, Navisworks Simulate, Navisworks Manage Problem Types: CWE-122 Description: A maliciously crafted DWFX file, when parsed in w3dtk.dll through Autodesk Navisworks, can force a Heap-based Buffer Overflow. A malicious actor can leverage this vulnerability to cause a crash or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0015
CVE ID: CVE-2024-7674 State: PUBLISHED Published: 2024-09-30T20:30:07.187Z Last Updated: 2025-08-26T18:17:27.701Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: Navisworks Freedom, Navisworks Simulate, Navisworks Manage Problem Types: CWE-122 Description: A maliciously crafted DWFX file, when parsed in dwfcore.dll through Autodesk Navisworks, can force a Heap-based Buffer Overflow. A malicious actor can leverage this vulnerability to cause a crash or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-00
Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0015
CVE ID: CVE-2024-7675 State: PUBLISHED Published: 2024-09-30T20:30:31.826Z Last Updated: 2025-08-26T18:23:05.760Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: Navisworks Freedom, Navisworks Simulate, Navisworks Manage Problem Types: CWE-416 Description: A maliciously crafted DWF file, when parsed in w3dtk.dll through Autodesk Navisworks, can force a Use-After-Free. A malicious actor can leverage this vulnerability to cause a crash or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0015
CVE ID: CVE-2024-7676 State: PUBLISHED Published: 2024-08-11T09:31:04.214Z Last Updated: 2024-08-13T17:24:59.446Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Sourcecodester Products: Car Driving School Management System Problem Types: CWE-89 Description: A vulnerability was found in Sourcecodester Car Driving School Management System 1.0. It has been classified as critical. Affected is the function save_package of the file /classes/Master.php?f=save_package. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: R
tely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274128 - https://vuldb.com/?ctiid.274128 - https://vuldb.com/?submit.388831 - https://github.com/BFS-Lab/BFSDV/blob/main/Sourcecodester%20Online%20Catering%20Reservation%20System%20SQL%20Injection-8.md
CVE ID: CVE-2024-7677 State: PUBLISHED Published: 2024-08-11T10:31:03.789Z Last Updated: 2024-08-12T16:26:55.556Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Car Driving School Management System Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Car Driving School Management System 1.0. It has been declared as problematic. Affected by this vulnerability is the function update_settings_info of the file /classes/SystemSettings.php?f=update_settings. The manipulation of the argument contact/address leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. A
oss site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274129 - https://vuldb.com/?ctiid.274129 - https://vuldb.com/?submit.388832 - https://github.com/BFS-Lab/BFSDV/blob/main/Sourcecodester%20Online%20Catering%20Reservation%20System%20XSS-1.md
CVE ID: CVE-2024-7678 State: PUBLISHED Published: 2024-08-11T12:31:04.140Z Last Updated: 2024-08-12T13:37:54.995Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Car Driving School Management System Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Car Driving School Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /classes/Master.php?f=save_package. The manipulation of the argument name/description/training_duration leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional
cripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274130 - https://vuldb.com/?ctiid.274130 - https://vuldb.com/?submit.388833 - https://github.com/BFS-Lab/BFSDV/blob/main/Sourcecodester%20Online%20Catering%20Reservation%20System%20XSS-2.md
CVE ID: CVE-2024-7679 State: PUBLISHED Published: 2024-09-25T13:53:01.102Z Last Updated: 2024-09-25T14:22:18.409Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Progress Software Products: Telerik UI for WinForms Problem Types: CWE-77 Description: In Progress Telerik UI for WinForms versions prior to 2024 Q3 (2024.3.924), a command injection attack is possible through improper neutralization of hyperlink elements. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.telerik.com/devtools/winforms/knowledge-base/command-injection-cve-2024-7679
CVE ID: CVE-2024-7680 State: PUBLISHED Published: 2024-08-11T22:00:07.007Z Last Updated: 2024-08-12T12:34:32.203Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: Tailoring Management System Problem Types: CWE-89 Description: A vulnerability was found in itsourcecode Tailoring Management System 1.0. It has been classified as critical. This affects an unknown part of the file /incedit.php?id=4. The manipulation of the argument id/inccat/desc/date/amount leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://v
been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274137 - https://vuldb.com/?ctiid.274137 - https://vuldb.com/?submit.389047 - https://github.com/chenzg22/cve/issues/1
CVE ID: CVE-2024-7681 State: PUBLISHED Published: 2024-08-11T23:31:03.861Z Last Updated: 2024-08-12T14:01:52.011Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: code-projects Products: College Management System Problem Types: CWE-89 Description: A vulnerability was found in code-projects College Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file login.php of the component Login Page. The manipulation of the argument email/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274138 - https://vuldb.com/?ctiid.274138 - https://vuldb.com/?submit.389158 - https://github.com/space-security/cve/issues/6
CVE ID: CVE-2024-7682 State: PUBLISHED Published: 2024-08-12T00:31:04.446Z Last Updated: 2024-08-12T14:33:09.810Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: code-projects Products: Job Portal Problem Types: CWE-89 Description: A vulnerability was found in code-projects Job Portal 1.0. It has been rated as critical. This issue affects some unknown processing of the file rw_i_nat.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274139 - https://vuldb.com/?ctiid.274139 - https:
st Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274139 - https://vuldb.com/?ctiid.274139 - https://vuldb.com/?submit.389161 - https://github.com/space-security/cve/issues/7
CVE ID: CVE-2024-7683 State: PUBLISHED Published: 2024-08-12T01:00:10.271Z Last Updated: 2024-08-13T20:10:26.916Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Kortex Lite Advocate Office Management System Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in SourceCodester Kortex Lite Advocate Office Management System 1.0. Affected is an unknown function of the file addcase_stage.php. The manipulation of the argument cname leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Ref
ly. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274140 - https://vuldb.com/?ctiid.274140 - https://vuldb.com/?submit.389162 - https://github.com/samwbs/kortexcve/blob/main/xss_addcase_stage/xss_addcase_stage.md
CVE ID: CVE-2024-7684 State: PUBLISHED Published: 2024-08-12T01:00:11.993Z Last Updated: 2024-08-12T16:25:51.258Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Kortex Lite Advocate Office Management System Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in SourceCodester Kortex Lite Advocate Office Management System 1.0. Affected by this vulnerability is an unknown functionality of the file add_act.php. The manipulation of the argument aname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichme
remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274141 - https://vuldb.com/?ctiid.274141 - https://vuldb.com/?submit.389163 - https://github.com/samwbs/kortexcve/blob/main/xss_add_act/XSS_add_act.md
CVE ID: CVE-2024-7685 State: PUBLISHED Published: 2024-08-12T01:31:03.841Z Last Updated: 2024-08-12T13:36:26.944Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Kortex Lite Advocate Office Management System Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in SourceCodester Kortex Lite Advocate Office Management System 1.0. Affected by this issue is some unknown functionality of the file adds.php. The manipulation of the argument name/dob/email/mobile/address leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Anal
ting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274142 - https://vuldb.com/?ctiid.274142 - https://vuldb.com/?submit.389164 - https://github.com/samwbs/kortexcve/blob/main/xss_adds/XSS_adds.md
CVE ID: CVE-2024-7686 State: PUBLISHED Published: 2024-08-12T01:31:05.475Z Last Updated: 2024-08-12T12:31:25.752Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Kortex Lite Advocate Office Management System Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in SourceCodester Kortex Lite Advocate Office Management System 1.0. This affects an unknown part of the file register_case.php. The manipulation of the argument title/description/opposite_lawyer leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst N
ible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274143 - https://vuldb.com/?ctiid.274143 - https://vuldb.com/?submit.389165 - https://github.com/samwbs/kortexcve/blob/main/xss_register_case/XSS_register_case.md
CVE ID: CVE-2024-7687 State: PUBLISHED Published: 2024-09-09T06:00:02.313Z Last Updated: 2024-09-09T13:29:57.451Z Vendors: Unknown Products: AZIndex Problem Types: CWE-352 Cross-Site Request Forgery (CSRF), CWE-79 Cross-Site Scripting (XSS) Description: The AZIndex WordPress plugin through 0.8.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b861f18a-40ae-4989-a8e4-37df1771ae23/
CVE ID: CVE-2024-7688 State: PUBLISHED Published: 2024-09-09T06:00:02.549Z Last Updated: 2024-09-09T13:19:13.228Z Vendors: Unknown Products: AZIndex Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The AZIndex WordPress plugin through 0.8.1 does not have CSRF checks in some places, which could allow attackers to make logged in admin delete arbitrary indexes via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/6c1d4354-b88b-46ca-b25a-efb9518f4955/
CVE ID: CVE-2024-7689 State: PUBLISHED Published: 2024-09-09T06:00:02.765Z Last Updated: 2024-09-09T13:18:59.260Z Vendors: Unknown Products: Snapshot Backup Problem Types: CWE-352 Cross-Site Request Forgery (CSRF), CWE-79 Cross-Site Scripting (XSS) Description: The Snapshot Backup WordPress plugin through 2.1.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/4463785c-55db-4f86-80a2-ada4d2241e5e/
CVE ID: CVE-2024-7690 State: PUBLISHED Published: 2024-09-02T06:00:03.795Z Last Updated: 2024-09-03T14:04:16.707Z Vendors: Unknown Products: DN Popup Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The DN Popup WordPress plugin through 1.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1f941d51-1eaf-424a-95b8-ccaa3fdd339b/
CVE ID: CVE-2024-7691 State: PUBLISHED Published: 2024-09-02T06:00:04.184Z Last Updated: 2024-09-03T15:20:05.150Z Vendors: Unknown Products: Flaming Forms Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Flaming Forms WordPress plugin through 1.0.1 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks against administrators. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d30a3b95-5d1f-4755-8b61-19946afc51ef/
CVE ID: CVE-2024-7692 State: PUBLISHED Published: 2024-09-02T06:00:04.419Z Last Updated: 2024-09-03T15:26:02.332Z Vendors: Unknown Products: Flaming Forms Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Flaming Forms WordPress plugin through 1.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5e9f98ef-5a44-4a0c-b9cd-ce750bec74f9/