Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1acfa5d1-c1ba-4ba5-9511-0f4adbe5b9ca?source=cve - https://plugins.trac.wordpress.org/browser/bp-profile-search/trunk/bps-admin.php#L160 - https://plugins.trac.wordpress.org/changeset/3136686/ - https://plugins.trac.wordpress.org/changeset/3137271/bp-profile-search/tags/5.8/bps-admin.php
CVE ID: CVE-2024-7851 State: PUBLISHED Published: 2024-08-16T00:00:05.504Z Last Updated: 2024-09-03T18:00:41.196Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Yoga Class Registration System Problem Types: CWE-285 Description: A vulnerability has been found in SourceCodester Yoga Class Registration System 1.0 and classified as critical. This vulnerability affects unknown code of the file /classes/Users.php?f=save of the component Add User Handler. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274756 - https://vuldb.com/?ctiid.274756 - https://vuldb.com/?submit.391640 - https://github.com/Wsstiger/cve/blob/main/Yoga_add.md
CVE ID: CVE-2024-7852 State: PUBLISHED Published: 2024-08-16T00:31:04.422Z Last Updated: 2024-08-16T13:56:15.785Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Yoga Class Registration System Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Yoga Class Registration System 1.0 and classified as problematic. This issue affects some unknown processing of the file /admin/inquiries/view_inquiry.php. The manipulation of the argument message leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
ploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274757 - https://vuldb.com/?ctiid.274757 - https://vuldb.com/?submit.391663 - https://github.com/Wsstiger/cve/blob/main/Yoga_xss.md
CVE ID: CVE-2024-7853 State: PUBLISHED Published: 2024-08-16T00:31:05.932Z Last Updated: 2024-09-03T17:59:05.282Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Yoga Class Registration System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Yoga Class Registration System up to 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/?page=categories/view_category. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References
exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274758 - https://vuldb.com/?ctiid.274758 - https://vuldb.com/?submit.391666 - https://github.com/Wsstiger/cve/blob/main/Yoga_sql.md
CVE ID: CVE-2024-7854 State: PUBLISHED Published: 2024-08-21T05:30:18.474Z Last Updated: 2024-08-22T13:36:45.542Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: sjhoo Products: Woo Inquiry Problem Types: CWE-89 Description: The Woo Inquiry plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 0.1 due to insufficient escaping on the user supplied parameter 'dbid' and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analy
ries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/312a6601-c914-4661-82ff-6f8bac849442?source=cve - https://plugins.trac.wordpress.org/browser/woo-inquiry/trunk/includes/functions.php?rev=2088873#L307
CVE ID: CVE-2024-7855 State: PUBLISHED Published: 2024-10-02T04:31:17.744Z Last Updated: 2024-10-02T13:43:57.551Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: thimpress Products: WP Hotel Booking Problem Types: CWE-434 Description: The WP Hotel Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_review() function in all versions up to, and including, 2.1.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnri
on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/784593ec-b635-4f59-9afb-ab506f786d21?source=cve - https://plugins.trac.wordpress.org/browser/wp-hotel-booking/trunk/includes/class-wphb-comments.php#L150 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3157905%40wp-hotel-booking&new=3157905%40wp-hotel-booking&sfp_email=&sfph_mail=
CVE ID: CVE-2024-7856 State: PUBLISHED Published: 2024-08-29T03:52:57.401Z Last Updated: 2024-08-29T14:07:23.168Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: sonaar Products: MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar Problem Types: CWE-862 Description: The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on the removeTempFiles() function and insufficient path validation on the 'file' parameter in all versions up to, and including, 5.7.0.1. This makes it possible for authenticated attackers, with subscribe
ameter in all versions up to, and including, 5.7.0.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files which can make remote code execution possible when wp-config.php is deleted. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/43adc9dd-1780-440f-90c2-ff05a22eb084?source=cve - https://plugins.trac.wordpress.org/browser/mp3-music-player-by-sonaar/tags/5.7.0.1/includes/class-sonaar-music.php#L755 - https://plugins.trac.wordpress.org/changeset/3142445/mp3-music-player-by-sonaar/trunk/includes/class-sonaar-music.php - https://plugins.trac.wordpress.org/b
hangeset/3142445/mp3-music-player-by-sonaar/trunk/includes/class-sonaar-music.php - https://plugins.trac.wordpress.org/browser/mp3-music-player-by-sonaar/tags/5.7.0.1/includes/class-sonaar-music.php#L739
CVE ID: CVE-2024-7857 State: PUBLISHED Published: 2024-08-29T02:31:30.608Z Last Updated: 2024-08-29T13:43:12.796Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: maxfoundry Products: Media Library Folders Problem Types: CWE-89 Description: The Media Library Folders plugin for WordPress is vulnerable to second order SQL Injection via the 'sort_type' parameter of the 'mlf_change_sort_type' AJAX action in all versions up to, and including, 8.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to
the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d2266254-9281-4859-8630-f7bb5c0ead19?source=cve - https://plugins.trac.wordpress.org/changeset/3139954/media-library-plus/trunk/media-library-plus.php - https://plugins.trac.wordpress.org/browser/media-library-plus/tags/8.2.2/media-library-plus.php#L1766 - https://plugins.trac.wordpress.org/browser/media-library-plus/tags/8.2.
y-plus/tags/8.2.2/media-library-plus.php#L1766 - https://plugins.trac.wordpress.org/browser/media-library-plus/tags/8.2.2/media-library-plus.php#L3339
CVE ID: CVE-2024-7858 State: PUBLISHED Published: 2024-08-30T09:29:49.791Z Last Updated: 2024-08-30T14:48:04.872Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: maxfoundry Products: Media Library Folders Problem Types: CWE-862 Description: The Media Library Folders plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several AJAX functions in the media-library-plus.php file in all versions up to, and including, 8.2.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform several actions related to managing media files and folder along with controlling settings. Additio
nd above, to perform several actions related to managing media files and folder along with controlling settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fcc0fc00-b7d6-429c-9ab3-f08971c48777?source=cve - https://plugins.trac.wordpress.org/browser/media-library-plus/trunk/media-library-plus.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3143036%40media-library-plus&new=3143036%40media-library-plus&sfp_email=&sfph_mail=
CVE ID: CVE-2024-7859 State: PUBLISHED Published: 2024-09-12T06:00:05.954Z Last Updated: 2024-09-12T13:41:09.887Z Vendors: Unknown Products: Visual Sound Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Visual Sound WordPress plugin through 1.03 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/88cacd47-d900-478c-b833-c6c55fd4b082/
CVE ID: CVE-2024-7860 State: PUBLISHED Published: 2024-09-12T06:00:06.139Z Last Updated: 2024-09-12T13:35:25.166Z Vendors: Unknown Products: Simple Headline Rotator Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The Simple Headline Rotator WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/584156d7-928e-48c9-8b81-539ccb06f3f5/
CVE ID: CVE-2024-7861 State: PUBLISHED Published: 2024-09-12T06:00:06.323Z Last Updated: 2024-09-12T13:31:44.773Z Vendors: Unknown Products: Misiek Paypal Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The Misiek Paypal WordPress plugin through 1.1.20090324 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/df9aa795-ba16-4806-b01a-311f80aa52c0/
CVE ID: CVE-2024-7862 State: PUBLISHED Published: 2024-09-12T06:00:06.592Z Last Updated: 2024-09-12T13:23:00.960Z Vendors: Unknown Products: blogintroduction-wordpress-plugin Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The blogintroduction-wordpress-plugin WordPress plugin through 0.3.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/9b54cd05-3bb8-4bb9-a0e4-fb00d97d5cae/
CVE ID: CVE-2024-7863 State: PUBLISHED Published: 2024-09-13T06:00:04.133Z Last Updated: 2024-09-13T14:27:56.345Z Vendors: Unknown Products: Favicon Generator (CLOSED) Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Favicon Generator (CLOSED) WordPress plugin before 2.1 does not validate files to be uploaded and does not have CSRF checks, which could allow attackers to make logged in admin upload arbitrary files such as PHP on the server Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5e814b02-3870-4742-905d-ec03b0d31add/
CVE ID: CVE-2024-7864 State: PUBLISHED Published: 2024-09-13T06:00:04.341Z Last Updated: 2024-09-13T15:41:24.874Z Vendors: Unknown Products: Favicon Generator (CLOSED) Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Favicon Generator (CLOSED) WordPress plugin before 2.1 does not have CSRF and path validation in the output_sub_admin_page_0() function, allowing attackers to make logged in admins delete arbitrary files on the server Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/6ce62e78-04a4-46b2-b97f-c4ef8f3258c3/
CVE ID: CVE-2024-7865 State: REJECTED Published: N/A Last Updated: 2024-11-15T15:12:48.523Z Description: No description available.
CVE ID: CVE-2024-7866 State: PUBLISHED Published: 2024-08-15T19:50:06.413Z Last Updated: 2024-08-16T17:13:35.817Z Vendors: Xpdf Products: Xpdf Problem Types: CWE-674 Description: In Xpdf 4.05 (and earlier), a PDF object loop in a pattern resource leads to infinite recursion and a stack overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.xpdfreader.com/security-bug/object-loops.html
CVE ID: CVE-2024-7867 State: PUBLISHED Published: 2024-08-15T20:06:47.966Z Last Updated: 2024-08-16T17:12:21.754Z Vendors: Xpdf Products: Xpdf Problem Types: CWE-369, CWE-190 Description: In Xpdf 4.05 (and earlier), very large coordinates in a page box can cause an integer overflow and divide-by-zero. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.xpdfreader.com/security-bug/CVE-2024-7867.html
CVE ID: CVE-2024-7868 State: PUBLISHED Published: 2024-08-15T20:22:52.873Z Last Updated: 2025-10-06T22:31:57.623Z Vendors: Xpdf Products: Xpdf Problem Types: CWE-457 Description: In Xpdf 4.05 (and earlier), invalid header info in a DCT (JPEG) stream can lead to an uninitialized variable in the DCT decoder. The proof-of-concept PDF file causes a segfault attempting to read from an invalid address. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.xpdfreader.com/security-bug/CVE-2024-7868.html
CVE ID: CVE-2024-7869 State: PUBLISHED Published: 2024-10-01T07:30:09.730Z Last Updated: 2024-10-01T15:55:20.937Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: 123.chat Products: 123.chat - Video Chat Problem Types: CWE-79 Description: The 123.chat - Video Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wo
enever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1d4469e4-5d99-4a56-bde8-9a0aaca7794f?source=cve - https://wordpress.org/plugins/123-chat-videochat/#developers
CVE ID: CVE-2024-7870 State: PUBLISHED Published: 2024-09-04T08:30:37.877Z Last Updated: 2024-09-04T14:10:13.933Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: pixelyoursite Products: PixelYourSite Pro – Your smart PIXEL (TAG) Manager, PixelYourSite – Your smart PIXEL (TAG) & API Manager Problem Types: CWE-287 Description: The PixelYourSite – Your smart PIXEL (TAG) & API Manager and the PixelYourSite PRO plugins for WordPress are vulnerable to Sensitive Information Exposure in all versions up to, and including, 9.7.1 and 10.4.2, respectively, through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensit
ely, through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files, and to delete log files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7fd7a515-6389-4152-8dac-d5497dd94f6d?source=cve - https://github.com/WordpressPluginDirectory/pixelyoursite/blob/main/pixelyoursite/includes/logger/class-pys-logger.php#L126 - https://plugins.trac.wordpress.org/browser/pixelyoursite/trunk/includes/class-pys.php#L114 - https://plugins.trac.wordpress.org/changeset/3143047/
CVE ID: CVE-2024-7871 State: PUBLISHED Published: 2024-09-02T04:00:24.762Z Last Updated: 2024-09-03T14:23:19.390Z Vendors: Huachu Digital Technology Ltd. Products: Easytest Online Test Platform Problem Types: CWE-89 Description: SQL Injection in online dictionary function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the word parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://zuso.ai/advisory/za-2024-04
CVE ID: CVE-2024-7872 State: PUBLISHED Published: 2025-03-06T11:14:35.964Z Last Updated: 2025-03-06T16:18:21.879Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: ExtremePACS Products: Extreme XDS Problem Types: CWE-201 Description: Insertion of Sensitive Information Into Sent Data vulnerability in ExtremePACS Extreme XDS allows Retrieve Embedded Sensitive Data.This issue affects Extreme XDS: before 3933. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0057
CVE ID: CVE-2024-7873 State: PUBLISHED Published: 2024-09-17T12:33:44.675Z Last Updated: 2024-09-17T17:51:16.872Z Vendors: Veribilim Software Products: Veribase Order Problem Types: CWE-79, CWE-116, CWE - 83 Improper Neutralization of Script in Attributes in a Web Page Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Encoding or Escaping of Output, CWE - 83 Improper Neutralization of Script in Attributes in a Web Page vulnerability in Veribilim Software Veribase Order allows Stored XSS, Cross-Site Scripting (XSS), Exploit Script-Based APIs, XSS Through HTTP Headers.This issue affects Veribase Order: before v4.010.3. Additional
XSS), Exploit Script-Based APIs, XSS Through HTTP Headers.This issue affects Veribase Order: before v4.010.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1485
CVE ID: CVE-2024-7874 State: PUBLISHED Published: 2024-12-06T20:54:40.934Z Last Updated: 2024-12-10T14:43:49.896Z Vendors: Tungsten Automation Products: TotalAgility Problem Types: CWE-79 Description: Tungsten Automation (Kofax) TotalAgility in versions all through 7.9.0.25.0.954 is vulnerable to a Reflected XSS attacks through mfpConnectionId parameter manipulation in a form sent to endpoints "/TotalAgility/Kofax/BrowserDevice/ScanFront.aspx" and "/TotalAgility/Kofax/BrowserDevice/ScanFrontDebug.aspx" This allows for injection of a malicious JavaScript code, leading to a possible information leak. Exploitation is possible only while using POST requests and also requires retrieving/generatin
ossible information leak. Exploitation is possible only while using POST requests and also requires retrieving/generating a proper VIEWSTATE parameter, which limits the risk of a successful attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tungstenautomation.com/products/totalagility - https://cert.pl/en/posts/2024/12/CVE-2024-7874 - https://cert.pl/posts/2024/12/CVE-2024-7874
CVE ID: CVE-2024-7875 State: PUBLISHED Published: 2024-12-06T20:55:11.944Z Last Updated: 2024-12-10T14:44:28.209Z Vendors: Tungsten Automation Products: TotalAgility Problem Types: CWE-79 Description: Tungsten Automation (Kofax) TotalAgility in versions all through 7.9.0.25.0.954 is vulnerable to a Reflected XSS attacks through mfpScreenResolutionWidth parameter manipulation in a form sent to an endpoint /TotalAgility/Kofax/BrowserDevice/ScanFront.aspx This allows for injection of a malicious JavaScript code, leading to a possible information leak. Exploitation is possible only while using POST requests and also requires retrieving/generating a proper VIEWSTATE parameter, which limits the ri
only while using POST requests and also requires retrieving/generating a proper VIEWSTATE parameter, which limits the risk of a successful attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tungstenautomation.com/products/totalagility - https://cert.pl/en/posts/2024/12/CVE-2024-7874 - https://cert.pl/posts/2024/12/CVE-2024-7874
CVE ID: CVE-2024-7876 State: PUBLISHED Published: 2024-11-05T06:00:07.461Z Last Updated: 2024-11-05T15:52:12.176Z Vendors: Unknown Products: Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Appointment Type settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/fffe862f-5b
disallowed Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/fffe862f-5bf0-4a05-9d32-caff0bfdb860/
CVE ID: CVE-2024-7877 State: PUBLISHED Published: 2024-11-05T06:00:07.856Z Last Updated: 2024-11-05T15:50:50.548Z Vendors: Unknown Products: Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Notification settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/fbec3738-2135-4
llowed Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/fbec3738-2135-458d-be25-1ffb00e6deb6/
CVE ID: CVE-2024-7878 State: PUBLISHED Published: 2024-09-25T06:00:05.377Z Last Updated: 2024-09-25T13:36:15.056Z Vendors: Unknown Products: WP ULike Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP ULike WordPress plugin before 4.7.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/9166cf91-69e5-4786-a6a9-816db7d47b07/