Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
mbnails in the video-wc-gallery-thumb directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/50259040-a984-42a8-8d58-cc94e349ca45?source=cve - https://plugins.trac.wordpress.org/browser/video-wc-gallery/trunk/admin/admin-ui-setup.php#L545 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3182174%40video-wc-gallery&new=3182174%40video-wc-gallery&sfp_email=&sfph_mail=
CVE ID: CVE-2024-10536 State: PUBLISHED Published: 2025-01-07T05:24:09.055Z Last Updated: 2025-01-07T16:13:30.798Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: wpqode Products: FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor Problem Types: CWE-862 Description: The FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the handle_block_shortcode_export() function in all versions up to, and including, 6.0.0. This makes it possible for authenticated attackers,
tcode_export() function in all versions up to, and including, 6.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e573648e-215f-4858-a4d3-a3e85119dbcf?source=cve - https://plugins.trac.wordpress.org/browser/post-block/trunk/custom-fields/options/admin-backup.php#L171
CVE ID: CVE-2024-10537 State: PUBLISHED Published: 2024-11-23T03:25:50.903Z Last Updated: 2024-11-23T13:28:20.903Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: wpusermanager Products: WP User Manager – User Profile Builder & Membership Problem Types: CWE-862 Description: The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the validate_user_meta_key() function in all versions up to, and including, 2.9.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate user meta keys. Additional Analyst Notes: -
uthenticated attackers, with Subscriber-level access and above, to enumerate user meta keys. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9e9a5b7e-db74-4c66-a659-85b2509fded4?source=cve - https://plugins.trac.wordpress.org/changeset/3194404/wp-user-manager/trunk/includes/actions.php
CVE ID: CVE-2024-10538 State: PUBLISHED Published: 2024-11-12T03:24:59.169Z Last Updated: 2024-11-12T11:21:01.982Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: thehappymonster Products: Happy Addons for Elementor Problem Types: CWE-79 Description: The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the before_label parameter in the Image Comparison widget in all versions up to, and including, 3.12.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute
enticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fd192a52-ae12-4706-b3ea-aa69f7393bb8?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3182100%40happy-elementor-addons&new=3182100%40happy-elementor-addons&sfp_email=&sfph_mail=
CVE ID: CVE-2024-10539 State: PUBLISHED Published: 2025-01-23T13:33:04.521Z Last Updated: 2025-01-23T14:18:58.545Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: Uyumsoft Informatin Systems Products: Uyumsoft ERP Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Uyumsoft Informatin Systems Uyumsoft ERP allows XSS Using Invalid Characters, Reflected XSS.This issue affects Uyumsoft ERP: before Erp4.2109.166p45. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0017
CVE ID: CVE-2024-10540 State: PUBLISHED Published: 2024-11-02T02:03:07.525Z Last Updated: 2024-11-02T16:44:50.978Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: reputeinfosystems Products: Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress Problem Types: CWE-89 Description: The Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress plugin for WordPress is vulnerable to SQL Injection via the 'service' parameter of the bookingpress_form shortcode in all versions up to, and including, 1.1.16 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This mak
ufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/21690b9c-ffec-4195-8c0f-2b1801552bc6?source=cve - https://plugins.trac.wordpress.org/browser/bookingpress-appointment-booking/trunk/core/classes/class.bookingpress.php#L358 - https://plugins.trac.wordpress.org/browser/bookingpress-appointmen
king/trunk/core/classes/class.bookingpress.php#L358 - https://plugins.trac.wordpress.org/browser/bookingpress-appointment-booking/trunk/core/classes/frontend/class.bookingpress_appointment_bookings.php#L3683 - https://plugins.trac.wordpress.org/browser/bookingpress-appointment-booking/trunk/core/classes/frontend/class.bookingpress_appointment_bookings.php#L4620 - https://plugins.trac.wordpress.org/changeset/3179229/bookingpress-appointment-booking/trunk/core/classes/frontend/class.bookingpress_appointment_bookings.php
CVE ID: CVE-2024-10541 State: REJECTED Published: N/A Last Updated: 2025-01-07T21:07:43.205Z Description: No description available.
CVE ID: CVE-2024-10542 State: PUBLISHED Published: 2024-11-26T05:33:01.407Z Last Updated: 2024-11-26T15:45:22.565Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: cleantalk Products: Spam protection, Anti-Spam, FireWall by CleanTalk Problem Types: CWE-862 Description: The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an authorization bypass via reverse DNS spoofing on the checkWithoutToken function in all versions up to, and including, 6.43.2. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to ach
makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d7eb5fad-bb62-4f0b-ad52-b16c3e442b62?source=cve - https://plugins.trac.wordpress.org/browser/cleantalk-spam-protect/tags/6.43.2/lib/Cleantalk/ApbctWP/RemoteCalls.php#L41 - https://plugins.trac.wordpress.org/changeset/3179819/cleantalk-spam-protect#file631
CVE ID: CVE-2024-10543 State: PUBLISHED Published: 2024-11-06T06:43:31.411Z Last Updated: 2024-11-06T11:29:00.878Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: tumultinc Products: Tumult Hype Animations Problem Types: CWE-862 Description: The Tumult Hype Animations plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hypeanimations_getcontent function in all versions up to, and including, 1.9.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve animation information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordf
e, to retrieve animation information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7273526e-bb51-418f-9ac8-8832f2de1cd6?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3182537%40tumult-hype-animations&new=3182537%40tumult-hype-animations&sfp_email=&sfph_mail=
CVE ID: CVE-2024-10544 State: PUBLISHED Published: 2024-10-31T02:03:06.954Z Last Updated: 2024-10-31T13:41:34.017Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: prasidhda Products: Woo Manage Fraud Orders Problem Types: CWE-532 Description: The Woo Manage Fraud Orders plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.1.7 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information about users contained in the exposed log files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel
posed log files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a62df5f6-64b0-4489-9dde-0d472040ee12?source=cve - https://plugins.trac.wordpress.org/browser/woo-manage-fraud-orders/trunk/includes/class-wmfo-debug-log.php#L25
CVE ID: CVE-2024-10545 State: PUBLISHED Published: 2025-02-25T06:00:05.291Z Last Updated: 2025-02-25T14:04:36.426Z Vendors: Unknown Products: Photo Gallery, Sliders, Proofing and Themes Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.9 does not sanitise and escape some of its Image settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e969e5f8-17cb-489b-988d-cae31719da36/
CVE ID: CVE-2024-10546 State: PUBLISHED Published: 2024-10-30T19:31:06.659Z Last Updated: 2024-10-31T13:41:42.172Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: open-scratch Products: Teaching 在线教学平台 Problem Types: CWE-89 Description: A vulnerability classified as critical was found in open-scratch Teaching 在线教学平台 up to 2.7. This vulnerability affects unknown code of the file /api/sys/ng-alain/getDictItemsByTable/ of the component URL Handler. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional
public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282520 - https://vuldb.com/?ctiid.282520 - https://vuldb.com/?submit.429033 - https://wiki.shikangsi.com/post/share/dfde9afc-8d64-4022-a6ca-3c1a323c5e66
CVE ID: CVE-2024-10547 State: PUBLISHED Published: 2024-11-09T07:35:04.633Z Last Updated: 2024-11-12T18:36:26.271Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: e-plugins Products: WP Membership Problem Types: CWE-434 Description: The WP Membership plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the user_profile_image_upload() function in all versions up to, and including, 1.6.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:
r which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/664e6e2a-faa1-4609-b250-d7e94c5d5a04?source=cve - https://codecanyon.net/item/wp-membership/10066554
CVE ID: CVE-2024-10548 State: PUBLISHED Published: 2024-12-19T01:45:13.998Z Last Updated: 2024-12-20T17:41:39.731Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: wedevs Products: WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts Problem Types: CWE-200 Description: The WP Project Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.15 via the Project Task List ('/wp-json/pm/v2/projects/1/task-lists') REST API endpoint. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data includ
makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including the hashed passwords of project owners (e.g. adminstrators). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a21b7c40-2090-4262-9105-346db2325612?source=cve - https://plugins.trac.wordpress.org/changeset/3206717/wedevs-project-manager/tags/2.6.16/src/Task_List/Controllers/Task_List_Controller.php
CVE ID: CVE-2024-10549 State: PUBLISHED Published: 2025-03-20T10:11:32.621Z Last Updated: 2025-10-15T12:49:27.711Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: h2oai Products: h2oai/h2o-3 Problem Types: CWE-1333 Description: A vulnerability in the `/3/Parse` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint uses a user-specified string to construct a regular expression, which is then applied to another user-specified string. By sending multiple simultaneous requests, an attacker can exhaust all available threads, leading to a complete denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
all available threads, leading to a complete denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/ce7bd2d6-fd38-440d-a91a-dd8f3fc06bc2
CVE ID: CVE-2024-10550 State: PUBLISHED Published: 2025-03-20T10:10:11.240Z Last Updated: 2025-03-20T18:30:21.595Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: h2oai Products: h2oai/h2o-3 Problem Types: CWE-1333 Description: A vulnerability in the `/3/ParseSetup` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint applies a user-specified regular expression to a user-controllable string. This can be exploited by an attacker to cause inefficient regular expression complexity, leading to the exhaustion of server resources and making the server unresponsive. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
austion of server resources and making the server unresponsive. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/ef3f4d89-3b8b-4618-b134-cb93c1664ec6
CVE ID: CVE-2024-10551 State: PUBLISHED Published: 2024-12-06T06:00:08.221Z Last Updated: 2024-12-06T15:59:27.835Z Vendors: Unknown Products: Sticky Social Icons Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Sticky Social Icons WordPress plugin through 1.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/cd1aea4a-e5a6-4f87-805d-459b293bbf28/
CVE ID: CVE-2024-10552 State: PUBLISHED Published: 2025-01-25T06:40:38.087Z Last Updated: 2025-01-27T14:54:41.678Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: flexmls Products: Flexmls® IDX Plugin Problem Types: CWE-79 Description: The Flexmls® IDX Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘api_key’ and 'api_secret' parameters in all versions up to, and including, 3.14.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected
-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 3.14.25. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0624108b-cd60-4278-802d-d4853f73ec6a?source=cve - https://plugins.trac.wordpress.org/browser/flexmls-idx/trunk/views/admin-intro-api.php#L22 - https://plugins.trac.wordpress.org/browser/flexmls-idx/trunk/views/admin-intro-api.php#L30 - https://plugins.trac.wordpress.org/changeset/3226484/
CVE ID: CVE-2024-10553 State: PUBLISHED Published: 2025-03-20T10:09:04.913Z Last Updated: 2025-03-20T18:58:32.945Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: h2oai Products: h2oai/h2o-3 Problem Types: CWE-502 Description: A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitrary code via deserialization of untrusted data. The vulnerability exists in the endpoints POST /99/ImportSQLTable and POST /3/SaveToHiveTable, where user-controlled JDBC URLs are passed to DriverManager.getConnection, leading to deserialization if a MySQL or PostgreSQL driver is available in the classpath. This issue
ager.getConnection, leading to deserialization if a MySQL or PostgreSQL driver is available in the classpath. This issue is fixed in version 3.47.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/e6f550dd-eda2-428c-a740-ed8f893a084b - https://github.com/h2oai/h2o-3/commit/ac1d642b4d86f10a02d75974055baf2a4b2025ac
CVE ID: CVE-2024-10554 State: PUBLISHED Published: 2025-03-25T06:00:04.997Z Last Updated: 2025-03-25T13:55:14.618Z Vendors: Unknown Products: WordPress WP-Advanced-Search Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WordPress WP-Advanced-Search WordPress plugin before 3.3.9.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7c15b082-caa5-4cf2-9986-2eb519dcb7c5/
CVE ID: CVE-2024-10555 State: PUBLISHED Published: 2024-12-20T06:00:02.298Z Last Updated: 2024-12-20T16:18:14.404Z Vendors: Unknown Products: WordPress Button Plugin MaxButtons Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WordPress Button Plugin MaxButtons WordPress plugin before 9.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/fcc97635-e939-4cb4-9851-6f6ac4f6ad47/
CVE ID: CVE-2024-10556 State: PUBLISHED Published: 2024-10-31T00:31:04.314Z Last Updated: 2024-10-31T13:48:41.306Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Codezips Products: Pet Shop Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in Codezips Pet Shop Management System 1.0. Affected is an unknown function of the file birdsadd.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282558 - https://vuldb.co
e used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282558 - https://vuldb.com/?ctiid.282558 - https://vuldb.com/?submit.432727 - https://github.com/ppp-src/CVE/issues/28
CVE ID: CVE-2024-10557 State: PUBLISHED Published: 2024-10-31T01:00:07.347Z Last Updated: 2024-10-31T13:45:35.417Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: code-projects Products: Blood Bank Management System Problem Types: CWE-352 Description: A vulnerability has been found in code-projects Blood Bank Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /file/updateprofile.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vul
en disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282559 - https://vuldb.com/?ctiid.282559 - https://vuldb.com/?submit.433057 - https://github.com/bevennyamande/bloodbank_profile_update_csrf - https://code-projects.org/
CVE ID: CVE-2024-10558 State: PUBLISHED Published: 2025-03-24T06:00:05.729Z Last Updated: 2025-03-24T18:06:48.990Z Vendors: Unknown Products: Form Maker by 10Web Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Form Maker by 10Web WordPress plugin before 1.15.30 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7028db78-2870-48d5-b06b-480ac8be3655/
CVE ID: CVE-2024-10559 State: PUBLISHED Published: 2024-10-31T02:00:14.095Z Last Updated: 2025-04-03T10:54:25.610Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Airport Booking Management System Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in SourceCodester Airport Booking Management System 1.0 and classified as critical. Affected by this issue is the function Details. The manipulation of the argument passport/name leads to buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst
xploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282560 - https://vuldb.com/?ctiid.282560 - https://vuldb.com/?submit.433262 - https://github.com/CveSecLook/cve/issues/64 - https://www.sourcecodester.com/
CVE ID: CVE-2024-10560 State: PUBLISHED Published: 2025-03-25T06:00:06.762Z Last Updated: 2025-03-25T13:53:00.270Z Vendors: Unknown Products: Form Maker by 10Web Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Form Maker by 10Web WordPress plugin before 1.15.30 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/80298c89-544d-4894-a837-253f5f26cf42/