Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/851bade8-bd3a-4fb1-8a1d-12461287694e?source=cve - https://plugins.trac.wordpress.org/browser/tcbd-auto-refresher/trunk/plugin-hook.php#L115 - https://wordpress.org/plugins/tcbd-auto-refresher
CVE ID: CVE-2024-12520 State: PUBLISHED Published: 2025-01-11T07:21:52.731Z Last Updated: 2025-01-13T17:15:28.340Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: reader87 Products: Dominion – Domain Checker for WPBakery Problem Types: CWE-79 Description: The Dominion – Domain Checker for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dominion_shortcodes_domain_search_6' shortcode in all versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a
ied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a684f597-da72-4697-9e37-ca45a30ca64d?source=cve - https://plugins.trac.wordpress.org/browser/dominion-domain-checker-wpbakery-addon/trunk/modules/domain_search/domain_search_6/doamin_search_shortcodes.php#L91 - https://wordpress.org/plugins/dominion-domain-checker-wpbakery-addon
CVE ID: CVE-2024-12521 State: PUBLISHED Published: 2025-01-08T03:18:09.528Z Last Updated: 2025-01-08T15:12:38.666Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: teonos Products: Slotti Ajanvaraus Problem Types: CWE-79 Description: The Slotti Ajanvaraus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'slotti-embed-ga' shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user
rs, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1d95ec4b-0cbc-49c6-821e-7050d8045159?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3218204%40slotti-ajanvaraus&new=3218204%40slotti-ajanvaraus&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12522 State: PUBLISHED Published: 2025-02-19T07:32:08.089Z Last Updated: 2025-02-19T14:39:24.058Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: yayforms Products: Yay! Forms | Embed Custom Forms, Surveys, and Quizzes Easily Problem Types: CWE-79 Description: The Yay! Forms | Embed Custom Forms, Surveys, and Quizzes Easily plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'yayforms' shortcode in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and a
ing on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/461ab75a-3ced-4296-9dc1-b8eee17a8299?source=cve - https://plugins.trac.wordpress.org/browser/yayforms/tags/1.2.1/yayforms.php#L123
CVE ID: CVE-2024-12523 State: PUBLISHED Published: 2024-12-14T04:23:45.370Z Last Updated: 2024-12-16T17:49:40.645Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wssoffice21 Products: States Map US Problem Types: CWE-79 Description: The States Map US plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'states_map' shortcode in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses
contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bdd07160-721b-4807-a227-72cd91faef39?source=cve - https://plugins.trac.wordpress.org/browser/ymc-states-map/trunk/includes/frontend/Shortcode.php - https://wordpress.org/plugins/ymc-states-map/
CVE ID: CVE-2024-12524 State: PUBLISHED Published: 2025-01-30T11:10:18.884Z Last Updated: 2025-01-30T14:59:55.421Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: clinked Products: Clinked Client Portal Problem Types: CWE-79 Description: The Clinked Client Portal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'clinked-login-button' shortcode in all versions up to, and including, 1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute when
ated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/417b9dfe-2571-4816-af55-c7cb7dfa62c6?source=cve - https://plugins.trac.wordpress.org/browser/clinked-client-portal/trunk/clinked-wordpress-plugin.php#L87 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3229331%40clinked-client-portal&new=3229331%40clinked-client-portal&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12525 State: PUBLISHED Published: 2025-02-18T04:21:16.077Z Last Updated: 2025-02-18T15:03:16.020Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: homeasap Products: Easy MLS Listings Import Problem Types: CWE-79 Description: The Easy MLS Listings Import plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'homeasap-featured-listings' shortcode in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that wi
e for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6351a40d-523d-4edb-acba-5cf048a1014f?source=cve - https://plugins.trac.wordpress.org/browser/easy-mls-listings-import/trunk/includes/class-homeasap-featured-listings-loader.php#L140
CVE ID: CVE-2024-12526 State: PUBLISHED Published: 2024-12-12T04:23:15.939Z Last Updated: 2024-12-12T15:46:32.493Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: arenaim Products: Arena.IM – Live Blogging for real-time events Problem Types: CWE-352 Description: The Arena.IM – Live Blogging for real-time events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.3.0. This is due to missing or incorrect nonce validation on the 'albfre_user_action' AJAX action. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator
authenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f9173644-f0b2-4de3-8e58-fd556d8e38cd?source=cve - https://plugins.trac.wordpress.org/browser/arena-liveblog-and-chat-tool/trunk/albfre.php#L125
CVE ID: CVE-2024-12527 State: PUBLISHED Published: 2025-01-11T07:21:54.236Z Last Updated: 2025-01-13T17:09:07.546Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: alanperfectportal Products: Perfect Portal Widgets Problem Types: CWE-79 Description: The Perfect Portal Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'perfect_portal_intake_form' shortcode in all versions up to, and including, 3.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages th
ssible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bded6765-e994-46a4-8c88-c324a4fd6ee6?source=cve - https://plugins.trac.wordpress.org/browser/perfect-portal-widgets/tags/3.0.3/perfect-portal-widgets.php#L330
CVE ID: CVE-2024-12528 State: PUBLISHED Published: 2025-01-07T03:21:55.299Z Last Updated: 2025-01-07T16:28:53.208Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: pantherius Products: WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress Problem Types: CWE-79 Description: The WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpsurveypoll_results' shortcode in all versions up to, and including, 1.7.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with
sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/51cc6247-1948-4de1-b347-c7d818400777?source=cve - https://plugins.trac.wordpress.org/browser/wp-survey-and-poll/trunk/wordpress-survey-and-poll.php#L49 - https://plugins.trac.wordpress.org/browser/wp-survey-and-poll/trunk/wordpress-survey-and-poll.php#L146
CVE ID: CVE-2024-12529 State: PUBLISHED Published: 2025-01-25T07:24:14.367Z Last Updated: 2025-01-27T15:33:18.488Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: brodosnet Products: brodos.net Onlineshop Plugin Problem Types: CWE-79 Description: The brodos.net Onlineshop Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'BrodosCategory' shortcode in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will
or authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/19a672c6-e911-46bb-a55b-c5788eedca3e?source=cve - https://plugins.trac.wordpress.org/browser/brodos-net-onlineshop/tags/2.0.1/class.onlineshop-init.php#L113
CVE ID: CVE-2024-12530 State: PUBLISHED Published: 2025-04-17T15:35:32.645Z Last Updated: 2025-04-17T18:34:59.014Z Vendors: OpenText Products: Secure Content Manager Problem Types: CWE-427 Description: Uncontrolled Search Path Element vulnerability in OpenText Secure Content Manager on Windows allows DLL Side-Loading.This issue affects Secure Content Manager: 23.4. End-users can potentially exploit the vulnerability to execute malicious code in the trusted context of the thick-client application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portal.microfocus.com/s/article/KM000040073?
CVE ID: CVE-2024-12532 State: PUBLISHED Published: 2025-01-07T11:11:11.537Z Last Updated: 2025-01-07T14:21:36.794Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: bestwpdeveloper Products: BWD Elementor Addons (2500+ presets, Meet The Team, Lottie, Lord Icon, Masking, Woocommerce, Theme Builder, Products, Blogs, CV, Contact Form 7 Styler, Header, Slider, Hero Section) Problem Types: CWE-200 Description: The BWD Elementor Addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.18 in widgets/bwdeb-content-switcher.php. This makes it possible for authenticated attackers, with Contributor-level access
in widgets/bwdeb-content-switcher.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8bdf6a52-7316-440b-9d36-d405a672dce1?source=cve - https://plugins.trac.wordpress.org/changeset/3211460/bwd-elementor-addons
CVE ID: CVE-2024-12533 State: PUBLISHED Published: 2025-05-13T14:56:41.235Z Last Updated: 2025-07-28T20:55:52.706Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Phoenix Products: SecureCore Technology 4 Problem Types: CWE-754 Description: Improper Check for Unusual or Exceptional Conditions vulnerability in Phoenix SecureCore Technology 4 allows Input Data Manipulation.This issue affects SecureCore Technology 4: from 4.0.1.0 before 4.0.1.1018, from 4.1.0.1 before 4.1.0.573, from 4.2.0.1 before 4.2.0.338, from 4.2.1.1 before 4.2.1.300, from 4.3.0.1 before 4.3.0.244, from 4.3.1.1 before 4.3.1.187, from 4.4.0.1 before 4.4.0.299, from 4.5.0.1 before 4.5.0.231, fr
.3.0.1 before 4.3.0.244, from 4.3.1.1 before 4.3.1.187, from 4.4.0.1 before 4.4.0.299, from 4.5.0.1 before 4.5.0.231, from 4.5.1.1 before 4.5.1.103, from 4.5.5.1 before 4.5.5.36, from 4.6.0.1 before 4.6.0.67. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phoenixtech.com/phoenix-security-notifications/cve-2024-12533/
CVE ID: CVE-2024-12534 State: PUBLISHED Published: 2025-03-20T10:10:52.752Z Last Updated: 2025-03-20T18:15:41.219Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: open-webui Products: open-webui/open-webui Problem Types: CWE-400 Description: In version v0.3.32 of open-webui/open-webui, the application allows users to submit large payloads in the email and password fields during the sign-in process due to the lack of character length validation on these inputs. This vulnerability can lead to a Denial of Service (DoS) condition when a user submits excessively large strings, exhausting server resources such as CPU, memory, and disk space, and rendering the servic
its excessively large strings, exhausting server resources such as CPU, memory, and disk space, and rendering the service unavailable for legitimate users. This makes the server susceptible to resource exhaustion attacks without requiring authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/c7c0a4e6-acd3-49b4-8684-2c2c27014b76
CVE ID: CVE-2024-12535 State: PUBLISHED Published: 2025-01-07T05:23:55.768Z Last Updated: 2025-01-07T16:15:35.715Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: eflyjason Products: Host PHP Info Problem Types: CWE-862 Description: The Host PHP Info plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when including the 'phpinfo' function in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attackers to read configuration settings and predefined variables on the site's server. The plugin does not need to be activated for the vulnerability to be exploited. Additional Analyst Note
e site's server. The plugin does not need to be activated for the vulnerability to be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/88d27385-9b92-419c-9e03-687d7192bbb5?source=cve - https://plugins.trac.wordpress.org/browser/host-php-info/trunk/info.php#L2
CVE ID: CVE-2024-12536 State: PUBLISHED Published: 2024-12-12T01:00:15.911Z Last Updated: 2024-12-12T16:39:24.346Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Kortex Lite Advocate Office Management System Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, has been found in SourceCodester Kortex Lite Advocate Office Management System 1.0. Affected by this issue is some unknown functionality of the file /control/client_data.php. The manipulation of the argument id leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analys
ng. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.287912 - https://vuldb.com/?ctiid.287912 - https://vuldb.com/?submit.461130 - https://www.sourcecodester.com/
CVE ID: CVE-2024-12537 State: PUBLISHED Published: 2025-03-20T10:09:10.774Z Last Updated: 2025-04-04T08:45:40.046Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: open-webui Products: open-webui/open-webui Problem Types: CWE-770 Description: In version 0.3.32 of open-webui/open-webui, the absence of authentication mechanisms allows any unauthenticated attacker to access the `api/v1/utils/code/format` endpoint. If a malicious actor sends a POST request with an excessively high volume of content, the server could become completely unresponsive. This could lead to severe performance issues, causing the server to become unresponsive or experience significant degra
This could lead to severe performance issues, causing the server to become unresponsive or experience significant degradation, ultimately resulting in service interruptions for legitimate users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/edabd06c-acc0-428c-a481-271f333755bc
CVE ID: CVE-2024-12538 State: PUBLISHED Published: 2025-01-07T03:21:59.599Z Last Updated: 2025-01-07T16:27:01.899Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: binsaifullah Products: Duplicate Post, Page and Any Custom Post Problem Types: CWE-200 Description: The Duplicate Post, Page and Any Custom Post plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.3 via the 'dpp_duplicate_as_draft' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract potentially sensitive data from draft, scheduled (future), private, and password protected posts.
and above, to extract potentially sensitive data from draft, scheduled (future), private, and password protected posts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f38543ff-1074-4273-be33-8142d59e904f?source=cve - https://plugins.trac.wordpress.org/browser/duplicate-pp/trunk/duplicate-pp.php#L22
CVE ID: CVE-2024-12539 State: PUBLISHED Published: 2024-12-17T20:50:04.968Z Last Updated: 2024-12-17T21:23:57.366Z Vendors: Elastic Products: Elasticsearch Problem Types: CWE-863 Description: An issue was discovered where improper authorization controls affected certain queries that could allow a malicious actor to circumvent Document Level Security in Elasticsearch and get access to documents that their roles would normally not allow. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/elasticsearch-8-16-2-8-17-0-security-update/372091
CVE ID: CVE-2024-12540 State: REJECTED Published: 2025-01-07T03:22:00.501Z Last Updated: 2025-01-17T16:45:24.984Z Description: No description available.
CVE ID: CVE-2024-12541 State: PUBLISHED Published: 2025-01-07T03:21:56.199Z Last Updated: 2025-01-07T16:28:30.256Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: chative Products: Chative Live chat and Chatbot Problem Types: CWE-352 Description: The Chative Live chat and Chatbot plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the add_chative_widget_action() function. This makes it possible for unauthenticated attackers to change the channel ID or organization ID via a forged request granted they can trick a site administrator into performing a
nge the channel ID or organization ID via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This could lead to redirecting the live chat widget to an attacker-controlled channel. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/61d3cb97-f12b-4480-88fc-2bdcbf4cdae3?source=cve - https://plugins.trac.wordpress.org/browser/chative-live-chat-and-chatbot/trunk/chative-plugin.php#L51 - https://wordpress.org/plugins/chative-live-chat-and-chatbot/#developers
CVE ID: CVE-2024-12542 State: PUBLISHED Published: 2025-01-09T11:11:04.098Z Last Updated: 2025-01-09T14:28:14.580Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: linkid Products: linkID Problem Types: CWE-862 Description: The linkID plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when including the 'phpinfo' function in all versions up to, and including, 0.1.2. This makes it possible for unauthenticated attackers to read configuration settings and predefined variables on the site's server. The plugin does not need to be activated for the vulnerability to be exploited. Additional Analyst Notes: - CISA ADP Vul
The plugin does not need to be activated for the vulnerability to be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b2fe5315-37b7-4009-b2e5-909e6b5ed1da?source=cve - https://plugins.trac.wordpress.org/browser/linkid/trunk/lib/linkid/linkid-sdk-php/util/index.php#L1
CVE ID: CVE-2024-12543 State: PUBLISHED Published: 2025-04-21T15:14:20.984Z Last Updated: 2025-04-21T15:36:51.036Z Vendors: OpenText Products: OpenText Content Management Problem Types: CWE-841 Description: User Enumeration and Data Integrity in Barcode functionality in OpenText Content Management versions 24.3-25.1on Windows and Linux allows a malicous authenticated attacker to potentially alter barcode attributes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.opentext.com/csm?id=ot_kb_unauthenticated&sysparm_article=KB0839119