Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
nctions they cannot execute. Installing an unaffected version only fixes fresh PostgreSQL installations, namely those that are created with the initdb utility after installing that version. Current PostgreSQL installations will remain vulnerable until they follow the instructions in the release notes. Within major versions 14-16, minor versions before PostgreSQL 16.3, 15.7, and 14.12 are affected. Versions before PostgreSQL 14 are unaffected. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.postgresql.org/support/security/CVE-2024-4317/
CVE ID: CVE-2024-4318 State: PUBLISHED Published: 2024-05-16T05:33:27.607Z Last Updated: 2024-08-01T20:40:46.476Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: themeum Products: Tutor LMS – eLearning and online course solution Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Tutor LMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘question_id’ parameter in versions up to, and including, 2.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attacke
parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Instructor-level permissions and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9bbb3c65-f02c-4d6d-bd4e-b3232af5e21b?source=cve - https://plugins.trac.wordpress.org/browser/tutor/tags/2.7.0/classes/Utils.php#L4456 - https://plugins.trac.wordpress.org/browser/tutor/tags/2.7.0/classes/Utils.php#L4575 - https://plugins.trac.wordpres
56 - https://plugins.trac.wordpress.org/browser/tutor/tags/2.7.0/classes/Utils.php#L4575 - https://plugins.trac.wordpress.org/changeset/3086489/
CVE ID: CVE-2024-4319 State: PUBLISHED Published: 2024-06-11T05:33:40.185Z Last Updated: 2024-08-01T20:40:46.028Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: vsourz1td Products: Advanced Contact form 7 DB Problem Types: CWE-862 Missing Authorization Description: The Advanced Contact form 7 DB plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'vsz_cf7_export_to_excel' function in versions up to, and including, 2.0.2. This makes it possible for unauthenticated attackers to download the entry data for submitted forms. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Referenc
the entry data for submitted forms. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2c66b185-fd4b-452d-890b-0f1850d8a7be?source=cve - https://plugins.trac.wordpress.org/browser/advanced-cf7-db/trunk/admin/class-advanced-cf7-db-admin.php#L1459
CVE ID: CVE-2024-4320 State: PUBLISHED Published: 2024-06-06T18:22:40.768Z Last Updated: 2024-08-01T20:40:47.180Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: parisneo Products: parisneo/lollms-webui Problem Types: CWE-29 Description: A remote code execution (RCE) vulnerability exists in the '/install_extension' endpoint of the parisneo/lollms-webui application, specifically within the `@router.post("/install_extension")` route handler. The vulnerability arises due to improper handling of the `name` parameter in the `ExtensionBuilder().build_extension()` method, which allows for local file inclusion (LFI) leading to arbitrary code execution. An attacker
.build_extension()` method, which allows for local file inclusion (LFI) leading to arbitrary code execution. An attacker can exploit this vulnerability by crafting a malicious `name` parameter that causes the server to load and execute a `__init__.py` file from an arbitrary location, such as the upload directory for discussions. This vulnerability affects the latest version of parisneo/lollms-webui and can lead to remote code execution without requiring user interaction, especially when the application is exposed to an external endpoint or operated in headless mode. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/d6564f04-0
nal Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/d6564f04-0f59-4686-beb2-11659342279b
CVE ID: CVE-2024-4321 State: PUBLISHED Published: 2024-05-16T09:03:46.604Z Last Updated: 2024-08-01T20:40:46.483Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: gaizhenbiao Products: gaizhenbiao/chuanhuchatgpt Problem Types: CWE-20 Description: A Local File Inclusion (LFI) vulnerability exists in the gaizhenbiao/chuanhuchatgpt application, specifically within the functionality for uploading chat history. The vulnerability arises due to improper input validation when handling file paths during the chat history upload process. An attacker can exploit this vulnerability by intercepting requests and manipulating the 'name' parameter to specify arbitrary file path
exploit this vulnerability by intercepting requests and manipulating the 'name' parameter to specify arbitrary file paths. This allows the attacker to read sensitive files on the server, leading to information leakage, including API keys and private information. The issue affects version 20240310 of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/19a16f8e-3d92-498f-abc9-8686005f067e
CVE ID: CVE-2024-4322 State: PUBLISHED Published: 2024-05-16T09:03:45.504Z Last Updated: 2024-08-01T20:40:46.520Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: parisneo Products: parisneo/lollms-webui Problem Types: CWE-29 Description: A path traversal vulnerability exists in the parisneo/lollms-webui application, specifically within the `/list_personalities` endpoint. By manipulating the `category` parameter, an attacker can traverse the directory structure and list any directory on the system. This issue affects the latest version of the application. The vulnerability is due to improper handling of user-supplied input in the `list_personalities` function,
application. The vulnerability is due to improper handling of user-supplied input in the `list_personalities` function, where the `category` parameter can be controlled to specify arbitrary directories for listing. Successful exploitation of this vulnerability could allow an attacker to list all folders in the drive on the system, potentially leading to information disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/5116d858-ce00-418c-a5a5-851c5608c209
CVE ID: CVE-2024-4323 State: PUBLISHED Published: 2024-05-20T12:06:21.696Z Last Updated: 2024-08-19T07:47:45.924Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Fluent Bit Products: Fluent Bit Problem Types: CWE-122 Description: A memory corruption vulnerability in Fluent Bit versions 2.0.7 thru 3.0.3. This issue lies in the embedded http server’s parsing of trace requests and may result in denial of service conditions, information disclosure, or remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://tenable.com/security/research/tra-2024-17 - https://github.com/fluent/fluent-bit/commit/931
ainer: References: - https://tenable.com/security/research/tra-2024-17 - https://github.com/fluent/fluent-bit/commit/9311b43a258352797af40749ab31a63c32acfd04
CVE ID: CVE-2024-4324 State: PUBLISHED Published: 2024-05-02T16:52:45.465Z Last Updated: 2024-08-01T20:40:46.488Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wptipsntricks Products: WP Video Lightbox Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WP Video Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to, and including, 1.9.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web script
s makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/da2d8494-aea3-4a1e-9eca-946c0bd390cd?source=cve - https://plugins.trac.wordpress.org/browser/wp-video-lightbox/trunk/misc_functions.php#L60
CVE ID: CVE-2024-4325 State: PUBLISHED Published: 2024-06-06T17:55:29.815Z Last Updated: 2024-08-01T20:40:46.442Z Severity: HIGH (CVSS 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: gradio-app Products: gradio-app/gradio Problem Types: CWE-918 Description: A Server-Side Request Forgery (SSRF) vulnerability exists in the gradio-app/gradio version 4.21.0, specifically within the `/queue/join` endpoint and the `save_url_to_cache` function. The vulnerability arises when the `path` value, obtained from the user and expected to be a URL, is used to make an HTTP request without sufficient validation checks. This flaw allows an attacker to send crafted requests that could lead to unautho
t without sufficient validation checks. This flaw allows an attacker to send crafted requests that could lead to unauthorized access to the local network or the AWS metadata endpoint, thereby compromising the security of internal servers. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/b34f084b-7d14-4f00-bc10-048a3a5aaf88
CVE ID: CVE-2024-4326 State: PUBLISHED Published: 2024-05-16T09:03:47.208Z Last Updated: 2024-08-01T20:40:46.028Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: parisneo Products: parisneo/lollms-webui Problem Types: CWE-15 Description: A vulnerability in parisneo/lollms-webui versions up to 9.3 allows remote attackers to execute arbitrary code. The vulnerability stems from insufficient protection of the `/apply_settings` and `/execute_code` endpoints. Attackers can bypass protections by setting the host to localhost, enabling code execution, and disabling code validation through the `/apply_settings` endpoint. Subsequently, arbitrary commands can be exec
tion, and disabling code validation through the `/apply_settings` endpoint. Subsequently, arbitrary commands can be executed remotely via the `/execute_code` endpoint, exploiting the delay in settings enforcement. This issue was addressed in version 9.5. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/2ab9f03d-0538-4317-be21-0748a079cbdd - https://github.com/parisneo/lollms-webui/commit/abb4c6d495a95a3ef5b114ffc57f85cd650b905e
CVE ID: CVE-2024-4327 State: PUBLISHED Published: 2024-04-30T01:00:06.720Z Last Updated: 2024-08-15T15:40:59.672Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Apryse Products: WebViewer Problem Types: CWE-79 Description: A vulnerability was found in Apryse WebViewer up to 10.8.0. It has been classified as problematic. This affects an unknown part of the component PDF Document Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 10.9 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of t
10.9 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-262419. NOTE: The vendor was contacted early about this disclosure and explains that the documentation recommends a strict Content Security Policy and the issue was fixed in release 10.9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.262419 - https://vuldb.com/?ctiid.262419 - https://vuldb.com/?submit.321231 - https://1drv.ms/b/s!AqJ7dHWS4CD_l0acw2hDjgo-C2zC?e=DOGPmq - https://docs.apryse.com/documentation/web/faq/content-security-policy/#recommended-policy
CVE ID: CVE-2024-4328 State: PUBLISHED Published: 2024-06-10T07:27:09.072Z Last Updated: 2024-08-01T20:40:47.115Z Severity: MEDIUM (CVSS 4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: parisneo Products: parisneo/lollms-webui Problem Types: CWE-352 Description: A Cross-Site Request Forgery (CSRF) vulnerability exists in the clear_personality_files_list function of the parisneo/lollms-webui v9.6. The vulnerability arises from the use of a GET request to clear personality files list, which lacks proper CSRF protection. This flaw allows attackers to trick users into performing actions without their consent, such as deleting important files on the system. The issue is present in the app
erforming actions without their consent, such as deleting important files on the system. The issue is present in the application's handling of requests, making it susceptible to CSRF attacks that could lead to unauthorized actions being performed on behalf of the user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/0f4faadf-ebca-4ef8-9d8a-66dbd849c0f8
CVE ID: CVE-2024-4329 State: PUBLISHED Published: 2024-05-11T06:43:40.751Z Last Updated: 2024-08-01T20:40:46.044Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: thimpress Products: Thim Elementor Kit Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Thim Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in p
s it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3275c47d-caf5-49e6-8aa2-20a6d8106f26?source=cve - https://plugins.trac.wordpress.org/browser/thim-elementor-kit/tags/1.1.9.1/inc/elementor/widgets/global/search-form.php#L819
CVE ID: CVE-2024-4330 State: PUBLISHED Published: 2024-05-30T14:43:40.842Z Last Updated: 2024-08-01T20:40:46.503Z Severity: MEDIUM (CVSS 4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: parisneo Products: parisneo/lollms-webui Problem Types: CWE-23 Description: A path traversal vulnerability was identified in the parisneo/lollms-webui repository, specifically within version 9.6. The vulnerability arises due to improper handling of user-supplied input in the 'list_personalities' endpoint. By crafting a malicious HTTP request, an attacker can traverse the directory structure and view the contents of any folder, albeit limited to subfolder names only. This issue was demonstrated via a s
ructure and view the contents of any folder, albeit limited to subfolder names only. This issue was demonstrated via a specific HTTP request that manipulated the 'category' parameter to access arbitrary directories. The vulnerability is present in the code located at the 'endpoints/lollms_advanced.py' file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/154a78d5-3960-4fc6-8666-f982b5e70ed7
CVE ID: CVE-2024-4331 State: PUBLISHED Published: 2024-05-01T12:50:38.291Z Last Updated: 2025-02-13T17:53:33.009Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Picture In Picture in Google Chrome prior to 124.0.6367.118 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_30.html - https://issues.chromium.org/issues/335003891 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproje
/issues.chromium.org/issues/335003891 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOC3HLIZCGMIJLJ6LME5UWUUIFLXEGRN/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L7I4FMQSOVTCIIH4XT2MJGEQRUACLPB6/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/
CVE ID: CVE-2024-4332 State: PUBLISHED Published: 2024-06-03T17:38:54.516Z Last Updated: 2025-08-29T20:20:21.394Z Vendors: Fortra Products: Tripwire Enterprise Problem Types: CWE-303, CWE-306 Description: An authentication bypass vulnerability has been identified in the REST and SOAP API components of Tripwire Enterprise (TE) 9.1.0 when TE is configured to use LDAP/Active Directory SAML authentication and its optional "Auto-synchronize LDAP Users, Roles, and Groups" feature is enabled. This vulnerability allows unauthenticated attackers to bypass authentication if a valid username is known. Exploitation of this vulnerability could allow remote attackers to gain privileged access to the APIs
sername is known. Exploitation of this vulnerability could allow remote attackers to gain privileged access to the APIs and lead to unauthorized information disclosure or modification. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.fortra.com/security/advisory/fi-2024-006
CVE ID: CVE-2024-4333 State: PUBLISHED Published: 2024-05-14T12:50:02.482Z Last Updated: 2024-08-01T20:40:46.486Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: shaonsina Products: Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via several parameters in
ts & Elementor Templates) plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via several parameters in versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f616df94-7839-49db-baa5-88f8f1de208f?source=cve - https://plugins.trac.wordpress.org/browser/sina-extension-for-elementor/trunk/assets
49db-baa5-88f8f1de208f?source=cve - https://plugins.trac.wordpress.org/browser/sina-extension-for-elementor/trunk/assets/js/typed.min.js - https://plugins.trac.wordpress.org/browser/sina-extension-for-elementor/trunk/assets/js/jquery.countdown.min.js - https://plugins.trac.wordpress.org/changeset/3085825/
CVE ID: CVE-2024-4334 State: PUBLISHED Published: 2024-05-02T16:51:49.677Z Last Updated: 2024-08-01T20:40:47.072Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: divisupreme Products: Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the ‘typing_cursor’ parameter in versions up to, and including, 2.5.3 due to insufficient input sanitization and output escaping. This makes it possible for
ions up to, and including, 2.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/17508063-3cd7-4b61-b7be-23a71b75f6a2?source=cve - https://plugins.trac.wordpress.org/browser/supreme-modules-for-divi/trunk/includes/modules/TypingEffect/TypingEffect.php#L744 - https://plugins.trac.wordpress.org/browser/supreme-modules-for-divi/trunk/include
s/TypingEffect/TypingEffect.php#L744 - https://plugins.trac.wordpress.org/browser/supreme-modules-for-divi/trunk/includes/modules/TypingEffect/frontend.min.js - https://plugins.trac.wordpress.org/changeset/3079965/#file203 - https://plugins.trac.wordpress.org/changeset/3079965/#file204
CVE ID: CVE-2024-4335 State: PUBLISHED Published: 2024-05-09T20:03:33.881Z Last Updated: 2024-08-01T20:40:46.487Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: rankmath Products: Rank Math SEO with AI Best SEO Tools Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Rank Math SEO with AI Best SEO Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘textAlign’ parameter in versions up to, and including, 1.0.217 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions an
itization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/96eba67c-58e7-4eea-84d4-9b3bb275b42d?source=cve - https://plugins.trac.wordpress.org/browser/seo-by-rank-math/tags/1.0.217/includes/modules/schema/blocks/class-block.php#L64 - https://plugins.trac.wordpress.org/changeset/3080259/#file26
CVE ID: CVE-2024-4336 State: PUBLISHED Published: 2024-04-30T09:34:16.165Z Last Updated: 2024-08-15T14:58:57.161Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L) Vendors: Adive Products: Adive Framework Problem Types: CWE-79 Description: Adive Framework 2.0.8, does not sufficiently encode user-controlled inputs, resulting in a persistent Cross-Site Scripting (XSS) vulnerability via the /adive/admin/tables/add, in multiple parameters. An attacker could retrieve the session details of an authenticated user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-
ner: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-adive-framework