Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-7105 State: PUBLISHED Published: 2024-07-25T20:31:04.725Z Last Updated: 2024-08-01T21:52:30.704Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: ForIP Tecnologia Products: Administração PABX Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in ForIP Tecnologia Administração PABX 1.x. Affected is an unknown function of the file /detalheIdUra of the component Lista Ura Page. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-272430 is the identifier assigned to this vulnerability. NOTE: The vendor was conta
d to the public and may be used. VDB-272430 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272430 - https://vuldb.com/?ctiid.272430 - https://vuldb.com/?submit.376659 - https://docs.google.com/document/d/1Q3kLR-HXSmj1LFpnCAt964YHACWwdckz4O8n4ocgB1I/edit?usp=sharing
CVE ID: CVE-2024-7106 State: PUBLISHED Published: 2024-07-25T21:00:06.267Z Last Updated: 2024-08-01T21:52:30.941Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: Spina Products: CMS Problem Types: CWE-352 Description: A vulnerability classified as problematic was found in Spina CMS 2.18.0. Affected by this vulnerability is an unknown functionality of the file /admin/media_folders. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272431. NOTE: The vendor was contacted early about this disclosure but did not respond in any way
s vulnerability is VDB-272431. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272431 - https://vuldb.com/?ctiid.272431 - https://vuldb.com/?submit.376769 - https://github.com/topsky979/Security-Collections/blob/main/cve3/README.md
CVE ID: CVE-2024-7107 State: PUBLISHED Published: 2024-09-26T12:02:41.541Z Last Updated: 2024-09-26T12:59:32.585Z Vendors: National Keep Cyber Security Services Products: CyberMath Problem Types: CWE-552 Description: Files or Directories Accessible to External Parties vulnerability in National Keep Cyber Security Services CyberMath allows Collect Data from Common Resource Locations.This issue affects CyberMath: before CYBM.240816253. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1549
CVE ID: CVE-2024-7108 State: PUBLISHED Published: 2024-09-26T12:07:13.201Z Last Updated: 2024-09-26T12:58:59.616Z Vendors: National Keep Cyber Security Services Products: CyberMath Problem Types: CWE-863 Description: Incorrect Authorization vulnerability in National Keep Cyber Security Services CyberMath allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects CyberMath: before CYBM.240816253. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1549
CVE ID: CVE-2024-7110 State: PUBLISHED Published: 2024-08-22T15:30:47.474Z Last Updated: 2024-09-17T15:35:37.142Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-77 Description: An issue was discovered in GitLab EE affecting all versions starting 17.0 to 17.1.6, 17.2 prior to 17.2.4, and 17.3 prior to 17.3.1 allows an attacker to execute arbitrary command in a victim's pipeline through prompt injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/472603
CVE ID: CVE-2024-7112 State: PUBLISHED Published: 2024-09-07T11:17:04.173Z Last Updated: 2024-09-09T15:02:03.052Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: dotonpaper Products: Pinpoint Booking System – #1 WordPress Booking Plugin Problem Types: CWE-89 Description: The Pinpoint Booking System – #1 WordPress Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the ‘schedule’ parameter in all versions up to, and including, 2.9.9.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and ab
ation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5a7358cd-fec8-4a16-ae6b-14194bb63396?source=cve - https://plugins.trac.wordpress.org/browser/booking-system/trunk/includes/calendars/class-backend-calendar-schedule.php#L529 - https://plugins.trac.wordpress.org/browser/booking-system/trunk/includes/calendars/class-backend-calendar-schedule.php#L441 - https://plugins.tr
dpress.org/browser/booking-system/trunk/includes/calendars/class-backend-calendar-schedule.php#L441 - https://plugins.trac.wordpress.org/changeset/3147739/
CVE ID: CVE-2024-7113 State: PUBLISHED Published: 2024-08-13T16:26:32.285Z Last Updated: 2024-08-15T18:49:01.175Z Vendors: AVEVA Products: SuiteLink Server, Historian, InTouch, Application Server, Communication Drivers Pack, Batch Management Problem Types: CWE-770 Description: If exploited, this vulnerability could cause a SuiteLink server to consume excessive system resources and slow down processing of Data I/O for the duration of the attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-226-01
CVE ID: CVE-2024-7114 State: PUBLISHED Published: 2024-07-26T01:00:05.925Z Last Updated: 2024-08-01T21:52:30.832Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Tianchoy Products: Blog Problem Types: CWE-89 Description: A vulnerability was found in Tianchoy Blog up to 1.8.8. It has been classified as critical. This affects an unknown part of the file /so.php. The manipulation of the argument search leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272445 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any wa
assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272445 - https://vuldb.com/?ctiid.272445 - https://vuldb.com/?submit.376851 - https://github.com/topsky979/Security-Collections/tree/main/cve5
CVE ID: CVE-2024-7115 State: PUBLISHED Published: 2024-07-26T02:00:06.077Z Last Updated: 2024-08-01T21:52:30.287Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: MD-MAFUJUL-HASAN Products: Online-Payroll-Management-System Problem Types: CWE-89 Description: A vulnerability was found in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to 20230911. It has been declared as critical. This vulnerability affects unknown code of the file /designation_viewmore.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this prod
exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. VDB-272446 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272446 - https://vuldb.com/?ctiid.272446 - https://vuldb.com/?submit.376885 - https://github.com/topsky979/Security-Collections/tree/main/cve6
CVE ID: CVE-2024-7116 State: PUBLISHED Published: 2024-07-26T02:31:04.178Z Last Updated: 2024-08-01T21:52:30.926Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: MD-MAFUJUL-HASAN Products: Online-Payroll-Management-System Problem Types: CWE-89 Description: A vulnerability was found in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to 20230911. It has been rated as critical. This issue affects some unknown processing of the file /branch_viewmore.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about
it has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The associated identifier of this vulnerability is VDB-272447. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272447 - https://vuldb.com/?ctiid.272447 - https://vuldb.com/?submit.376887 - https://github.com/topsky979/Security-Collections/tree/main/cve7
CVE ID: CVE-2024-7117 State: PUBLISHED Published: 2024-07-26T03:31:03.991Z Last Updated: 2024-08-01T21:52:30.554Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: MD-MAFUJUL-HASAN Products: Online-Payroll-Management-System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to 20230911. Affected is an unknown function of the file /shift_viewmore.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Th
been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The identifier of this vulnerability is VDB-272448. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272448 - https://vuldb.com/?ctiid.272448 - https://vuldb.com/?submit.376889 - https://github.com/topsky979/Security-Collections/tree/main/cve8
CVE ID: CVE-2024-7118 State: PUBLISHED Published: 2024-07-26T04:00:05.572Z Last Updated: 2024-08-01T21:52:30.581Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: MD-MAFUJUL-HASAN Products: Online-Payroll-Management-System Problem Types: CWE-89 Description: A vulnerability classified as critical was found in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to 20230911. Affected by this vulnerability is an unknown functionality of the file /department_viewmore.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to p
. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The identifier VDB-272449 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272449 - https://vuldb.com/?ctiid.272449 - https://vuldb.com/?submit.376890 - https://github.com/topsky979/Security-Collections/tree/main/cve9
CVE ID: CVE-2024-7119 State: PUBLISHED Published: 2024-07-26T04:31:04.164Z Last Updated: 2024-08-01T21:52:30.701Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: MD-MAFUJUL-HASAN Products: Online-Payroll-Management-System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to 20230911. Affected by this issue is some unknown functionality of the file /employee_viewmore.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is us
remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. VDB-272450 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272450 - https://vuldb.com/?ctiid.272450 - https://vuldb.com/?submit.376891 - https://github.com/topsky979/Security-Collections/tree/main/cve10
CVE ID: CVE-2024-7120 State: PUBLISHED Published: 2024-07-26T05:00:07.432Z Last Updated: 2024-08-01T21:52:30.336Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Raisecom Products: MSG1200, MSG2100E, MSG2200, MSG2300 Problem Types: CWE-78 Description: A vulnerability, which was classified as critical, was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90. This affects an unknown part of the file list_base_config.php of the component Web Interface. The manipulation of the argument template leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulner
attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272451. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272451 - https://vuldb.com/?ctiid.272451 - https://vuldb.com/?submit.380167 - https://netsecfish.notion.site/Command-Injection-Vulnerability-in-RAISECOM-Gateway-Devices-673bc7d2f8db499f9de7182d4706c707?pvs=4
CVE ID: CVE-2024-7121 State: REJECTED Published: N/A Last Updated: 2024-08-08T17:12:44.453Z Description: No description available.
CVE ID: CVE-2024-7122 State: PUBLISHED Published: 2024-08-30T09:29:48.121Z Last Updated: 2024-08-30T13:26:42.104Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: webtechstreet Products: Elementor Addon Elements Problem Types: CWE-79 Description: The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.13.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user acc
with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/668621b0-67ef-44fc-a126-e8c4e372666e?source=cve - https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/trunk/assets/js/eae.js#L568 - https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/trunk/modules/text-separator/widgets/text-separator.php#L570 - https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/trunk/modules/animated-gradient/mod
https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/trunk/modules/animated-gradient/module.php#L160 - https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/trunk/modules/image-compare/widgets/image-compare.php#L537 - https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/trunk/modules/dual-button/widgets/dual-button.php#L1045 - https://wordpress.org/plugins/addon-elements-for-elementor-page-builder/#developers - https://plugins.trac.wordpress.org/changeset/3143440/ - https://plugins.trac.wordpress.org/changeset/3143444/
CVE ID: CVE-2024-7123 State: REJECTED Published: N/A Last Updated: 2024-08-08T17:13:04.285Z Description: No description available.
CVE ID: CVE-2024-7124 State: PUBLISHED Published: 2024-11-14T15:07:50.313Z Last Updated: 2024-11-14T16:06:24.925Z Vendors: Poznan Supercomputing and Networking Center Products: DInGO dLIbra Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation vulnerability in DInGO dLibra software in the parameter 'filter' in the endpoint 'indexsearch' allows a Reflected Cross-Site Scripting (XSS). An attacker might trick somebody into using a crafted URL, which will cause a script to be run in user's browser. This issue affects DInGO dLibra software in versions from 6.0 before 6.3.20. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/e
e in versions from 6.0 before 6.3.20. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2024/11/CVE-2024-7124/ - https://cert.pl/posts/2024/11/CVE-2024-7124/ - https://dingo.psnc.pl/dlibra/
CVE ID: CVE-2024-7125 State: PUBLISHED Published: 2024-08-27T04:15:15.774Z Last Updated: 2024-08-28T14:17:22.156Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Hitachi Products: Hitachi Ops Center Common Services Problem Types: CWE-288 Description: Authentication Bypass vulnerability in Hitachi Ops Center Common Services.This issue affects Hitachi Ops Center Common Services: from 10.9.3-00 before 11.0.2-01. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-143/index.html
CVE ID: CVE-2024-7127 State: PUBLISHED Published: 2024-07-30T11:21:37.657Z Last Updated: 2024-08-01T21:52:30.852Z Vendors: Stackposts Products: Social Marketing Tool Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation vulnerability in Stackposts Social Marketing Tool allows Cross-site Scripting (XSS) attack. By submitting the payload in the username during registration, it can be executed later in the application panel. This could lead to the unauthorised acquisition of information (e.g. cookies from a logged-in user). After multiple attempts to contact the vendor we did not receive any answer. Our team has confirmed the existence of this vulnerabil
le attempts to contact the vendor we did not receive any answer. Our team has confirmed the existence of this vulnerability. We suppose this issue affects Social Marketing Tool in all versions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert.pl/en/posts/2024/07/CVE-2024-7127/ - https://cert.pl/posts/2024/07/CVE-2024-7127/ - https://stackposts.com/product/stackposts-social-marketing-tool-1 - https://codecanyon.net/comments/30802802
CVE ID: CVE-2024-7128 State: PUBLISHED Published: 2024-07-26T13:34:19.647Z Last Updated: 2025-11-20T20:56:31.160Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Red Hat Products: Red Hat OpenShift Container Platform 4.16, Red Hat OpenShift Container Platform 4.17, Red Hat OpenShift Container Platform 4.18, Red Hat OpenShift Container Platform 3.11 Problem Types: CWE-200 Description: A flaw was found in the OpenShift console. Several endpoints in the application use the authHandler() and authHandlerWithUser() middleware functions. When the default authentication provider ("openShiftAuth") is set, these functions do not perform any authentication checks, rely
default authentication provider ("openShiftAuth") is set, these functions do not perform any authentication checks, relying instead on the targeted service to handle authentication and authorization. This issue leads to various degrees of data exposure due to a lack of proper credential verification. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2025:13336 - https://access.redhat.com/errata/RHSA-2025:4427 - https://access.redhat.com/errata/RHSA-2025:4723 - https://access.redhat.com/security/cve/CVE-2024-7128 - https://bugzilla.redhat.com/show_bug.cgi?id=2300037
CVE ID: CVE-2024-7129 State: PUBLISHED Published: 2024-09-13T06:00:03.731Z Last Updated: 2025-09-15T19:26:20.635Z Vendors: Unknown Products: Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin Problem Types: CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine Description: The Appointment Booking Calendar WordPress plugin before 1.6.7.43 does not escape template syntax provided via user input, leading to Twig Template Injection which further exploited can result to remote code Execution by high privilege such as admins Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/00ad9b1a-97a5-425f-841e-ea48
onal Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/00ad9b1a-97a5-425f-841e-ea48f72ecda4/
CVE ID: CVE-2024-7130 State: PUBLISHED Published: 2024-11-21T13:44:04.298Z Last Updated: 2024-11-25T14:50:41.333Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: Kion Computer Products: KION Exchange Programs Software Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kion Computer KION Exchange Programs Software allows Reflected XSS.This issue affects KION Exchange Programs Software: before 1.21.9092.29966. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1867
CVE ID: CVE-2024-7131 State: REJECTED Published: N/A Last Updated: 2025-02-20T22:15:45.969Z Description: No description available.
CVE ID: CVE-2024-7132 State: PUBLISHED Published: 2024-08-29T06:00:03.395Z Last Updated: 2024-08-29T13:57:12.080Z Vendors: Unknown Products: Page Builder Gutenberg Blocks Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Page Builder Gutenberg Blocks WordPress plugin before 3.1.13 does not escape the content of post embed via one of its block, which could allow users with the capability to publish posts (editor and admin by default) to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/16deb743-6fe9-
setup) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/16deb743-6fe9-43a2-9586-d92cfe1daa17/
CVE ID: CVE-2024-7133 State: PUBLISHED Published: 2024-09-13T06:00:03.935Z Last Updated: 2024-09-13T15:24:30.807Z Vendors: Unknown Products: Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any Theme Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin before 2.7.3 does not validate and escape some of its settings before outputting them back in the page, which could allow users with a high role to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com