Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-3214 State: PUBLISHED Published: 2024-04-09T18:59:07.972Z Last Updated: 2024-08-01T20:05:08.380Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: Relevanssi, msaari Products: Relevanssi – A Better Search (Pro), Relevanssi – A Better Search Problem Types: CWE-1236 Improper Neutralization of Formula Elements in a CSV File Description: The Relevanssi – A Better Search plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 4.22.1. This makes it possible for unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on
trusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9960bae9-6f19-49eb-8f24-fdde4933671e?source=cve - https://plugins.trac.wordpress.org/changeset/3064304/relevanssi/tags/4.22.2/lib/log.php
CVE ID: CVE-2024-3215 State: PUBLISHED Published: 2024-05-02T16:52:29.758Z Last Updated: 2024-08-01T20:05:07.794Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: strangerstudios Products: Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on the pmpro_update_level_group_order() function. This makes it possible
s due to missing or incorrect nonce validation on the pmpro_update_level_group_order() function. This makes it possible for unauthenticated attackers to update order levels via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a9ef7742-e6f8-4350-90e9-242d9d1b12a0?source=cve - https://plugins.trac.wordpress.org/changeset/3069136/paid-memberships-pro/trunk/includes/services.php
CVE ID: CVE-2024-3216 State: PUBLISHED Published: 2024-04-06T03:24:44.171Z Last Updated: 2024-08-08T19:49:21.881Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: webtoffee Products: WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels Problem Types: CWE-862 Missing Authorization Description: The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wt_pklist_reset_settings() function in all versions up to, and including, 4.4.2. This makes it possible for unauthenticated attackers to reset all of the plu
n all versions up to, and including, 4.4.2. This makes it possible for unauthenticated attackers to reset all of the plugin's settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/aeac9c4a-0754-4fb1-bf11-0cd8483451b6?source=cve - https://plugins.trac.wordpress.org/browser/print-invoices-packing-slip-labels-for-woocommerce/trunk/admin/class-wf-woocommerce-packing-list-admin.php#L4262
CVE ID: CVE-2024-3217 State: PUBLISHED Published: 2024-04-05T07:34:35.138Z Last Updated: 2024-08-01T20:05:08.233Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: listingthemes Products: WP Directory Kit Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'attribute_value' and 'attribute_id' parameters in all versions up to, and including, 1.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers
rameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/09b315e6-d973-467d-8b8d-4b7b4a7ca3f8?source=cve - https://plugins.trac.wordpress.org/browser/wpdirectorykit/trunk/application/controllers/Wdk_frontendajax.php#L72 - https://plugins.trac.wordpress.org/changeset/3064842/wpdirectorykit/trunk/application/control
Wdk_frontendajax.php#L72 - https://plugins.trac.wordpress.org/changeset/3064842/wpdirectorykit/trunk/application/controllers/Wdk_frontendajax.php
CVE ID: CVE-2024-3218 State: PUBLISHED Published: 2024-04-02T23:31:04.891Z Last Updated: 2024-08-01T20:05:08.386Z Severity: N/A (CVSS 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P) Vendors: Shibang Communications Products: IP Network Intercom Broadcasting System Problem Types: CWE-24 Description: A vulnerability classified as critical has been found in Shibang Communications IP Network Intercom Broadcasting System 1.0. This affects an unknown part of the file /php/busyscreenshotpush.php. The manipulation of the argument jsondata[callee]/jsondata[imagename] leads to path traversal: '../filedir'. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The
edir'. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259065 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.259065 - https://vuldb.com/?ctiid.259065 - https://vuldb.com/?submit.308510 - https://github.com/garboa/cve_3/blob/main/file_put_content.md
CVE ID: CVE-2024-3219 State: PUBLISHED Published: 2024-07-29T21:54:05.830Z Last Updated: 2025-05-02T23:02:58.327Z Vendors: Python Software Foundation Products: CPython Description: The “socket” module provides a pure-Python fallback to the socket.socketpair() function for platforms that don’t support AF_UNIX, such as Windows. This pure-Python implementation uses AF_INET or AF_INET6 to create a local connected pair of sockets. The connection between the two sockets was not verified before passing the two sockets back to the user, which leaves the server socket vulnerable to a connection race from a malicious local peer. Platforms that support AF_UNIX such as Linux and macOS are not affected b
a connection race from a malicious local peer. Platforms that support AF_UNIX such as Linux and macOS are not affected by this vulnerability. Versions prior to CPython 3.5 are not affected due to the vulnerable API not being included. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/python/cpython/pull/122134 - https://github.com/python/cpython/issues/122133 - https://mail.python.org/archives/list/security-announce@python.org/thread/WYKDQWIERRE2ICIYMSVRZJO33GSCWU2B/ - http://www.openwall.com/lists/oss-security/2024/07/29/3 - https://github.com/python/cpython/commit/06fa244666ec6335a3b9bf2367e31b42b9a89b20 - https://github.com/python
/07/29/3 - https://github.com/python/cpython/commit/06fa244666ec6335a3b9bf2367e31b42b9a89b20 - https://github.com/python/cpython/commit/0b65c8bf5367625673eafb92f85046a1b31259f2 - https://github.com/python/cpython/commit/220e31adeaaa8436c9ff234cba1398bc49e2bb6c - https://github.com/python/cpython/commit/5f90abaa786f994db3907fc31e2ee00ea2cf0929 - https://github.com/python/cpython/commit/b252317956b7fc035bb3774ef6a177e227f9fc54 - https://github.com/python/cpython/commit/2621a8a40ba4b2c68ca564671b7daa5da80a4508 - https://github.com/python/cpython/commit/5df322e91a40909e6904bbdbc0c3a6b6a9eead39 - https://github.com/python/cpython/commit/c21a36112a0028d7ac3cf8f480e0dc88dba5922c - https://github.co
c0c3a6b6a9eead39 - https://github.com/python/cpython/commit/c21a36112a0028d7ac3cf8f480e0dc88dba5922c - https://github.com/python/cpython/commit/f071f01b7b7e19d7d6b3a4b0ec62f820ecb14660 - https://github.com/python/cpython/commit/31302f5fc24eecd693f0c8aaba7c2840b09b594d - https://github.com/python/cpython/commit/3f5d9d12c74787fbf3f5891835c85cc15526c86d - https://github.com/python/cpython/commit/c5655aa6ad120d2ed7f255bebd6e8b71a9c07dde - https://github.com/python/cpython/commit/e319f774f9e766a2b92949444a2d46081df3363a - https://github.com/python/cpython/commit/78df1043dbdce5c989600616f9f87b4ee72944e5
CVE ID: CVE-2024-3220 State: PUBLISHED Published: 2025-02-14T16:18:00.918Z Last Updated: 2025-03-14T10:03:04.669Z Vendors: Python Software Foundation Products: CPython Problem Types: CWE-426 Description: There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file locations are writable meaning other users can create invalid files to cause MemoryError to be raised on Python runtime startup or have file extensions be interpreted as the incorrect file type. This defect is caused by the default locations of Linux and macOS platforms (such as “/etc/mime.types”) also being used on Windows, where they are user-writable locations (“C:\etc\mime
S platforms (such as “/etc/mime.types”) also being used on Windows, where they are user-writable locations (“C:\etc\mime.types”). To work-around this issue a user can call mimetypes.init() with an empty list (“[]”) on Windows platforms to avoid using the default list of known file locations. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://mail.python.org/archives/list/security-announce@python.org/thread/CDXW34ND2LSAOYAR5N6UNONP4ZBX4D6R/
CVE ID: CVE-2024-3221 State: PUBLISHED Published: 2024-04-03T00:00:05.386Z Last Updated: 2025-02-27T20:13:35.820Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: PHP Task Management System Problem Types: CWE-89 Description: A vulnerability classified as critical was found in SourceCodester PHP Task Management System 1.0. This vulnerability affects unknown code of the file attendance-info.php. The manipulation of the argument user_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-259066 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vul
c and may be used. VDB-259066 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.259066 - https://vuldb.com/?ctiid.259066 - https://vuldb.com/?submit.308626 - https://github.com/SLthendieck/cve-report/blob/main/1.pdf
CVE ID: CVE-2024-3222 State: PUBLISHED Published: 2024-04-03T00:00:06.822Z Last Updated: 2024-08-01T20:05:08.220Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: PHP Task Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in SourceCodester PHP Task Management System 1.0. This issue affects some unknown processing of the file admin-password-change.php. The manipulation of the argument admin_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259067. Additional
been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259067. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.259067 - https://vuldb.com/?ctiid.259067 - https://vuldb.com/?submit.308627 - https://github.com/SLthendieck/cve-report/blob/main/2.pdf
CVE ID: CVE-2024-3223 State: PUBLISHED Published: 2024-04-03T01:00:04.993Z Last Updated: 2024-08-01T20:05:08.309Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: PHP Task Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in SourceCodester PHP Task Management System 1.0. Affected is an unknown function of the file admin-manage-user.php. The manipulation of the argument admin_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259068. Additional Analyst Notes: - CISA A
ed to the public and may be used. The identifier of this vulnerability is VDB-259068. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.259068 - https://vuldb.com/?ctiid.259068 - https://vuldb.com/?submit.308628 - https://github.com/SLthendieck/cve-report/blob/main/3.pdf
CVE ID: CVE-2024-3224 State: PUBLISHED Published: 2024-04-03T01:31:04.205Z Last Updated: 2024-08-22T19:51:42.414Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: PHP Task Management System Problem Types: CWE-89 Description: A vulnerability has been found in SourceCodester PHP Task Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file task-details.php. The manipulation of the argument task_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259069 was assigned to this vulnerability. Additional Anal
n disclosed to the public and may be used. The identifier VDB-259069 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.259069 - https://vuldb.com/?ctiid.259069 - https://vuldb.com/?submit.308631 - https://github.com/E1CHO/cve_hub/blob/main/php%20task%20management%20system/php%20task%20management%20system%20-%20vuln%203.pdf
CVE ID: CVE-2024-3225 State: PUBLISHED Published: 2024-04-03T02:00:04.669Z Last Updated: 2024-08-01T20:05:08.382Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: PHP Task Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester PHP Task Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file edit-task.php. The manipulation of the argument task_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-259070 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CI
the public and may be used. VDB-259070 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.259070 - https://vuldb.com/?ctiid.259070 - https://vuldb.com/?submit.308642 - https://github.com/E1CHO/cve_hub/blob/main/php%20task%20management%20system/php%20task%20management%20system%20-%20vuln%204.pdf
CVE ID: CVE-2024-3226 State: PUBLISHED Published: 2024-04-03T02:00:06.081Z Last Updated: 2024-08-01T20:05:08.311Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Campcodes Products: Online Patient Record Management System Problem Types: CWE-89 Description: A vulnerability was found in Campcodes Online Patient Record Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/login.php. The manipulation of the argument password leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259071. Additional A
een disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259071. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.259071 - https://vuldb.com/?ctiid.259071 - https://vuldb.com/?submit.308644 - https://github.com/E1CHO/cve_hub/blob/main/Online%20Patient%20Record%20Management%20System%20-%20vuln%201.pdf
CVE ID: CVE-2024-3227 State: PUBLISHED Published: 2024-04-03T02:31:04.531Z Last Updated: 2024-08-01T20:05:08.169Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: Panwei Products: eoffice OA Problem Types: CWE-24 Description: A vulnerability was found in Panwei eoffice OA up to 9.5. It has been declared as critical. This vulnerability affects unknown code of the file /general/system/interface/theme_set/save_image.php of the component Backend. The manipulation of the argument image_type leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259072. Additi
The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259072. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.259072 - https://vuldb.com/?ctiid.259072 - https://vuldb.com/?submit.308750 - https://github.com/garboa/cve_3/blob/main/upload.md
CVE ID: CVE-2024-3228 State: PUBLISHED Published: 2024-07-09T08:33:07.717Z Last Updated: 2024-08-01T20:05:08.174Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: wpkube Products: Social Sharing Plugin – Kiwi Problem Types: CWE-200 Information Exposure Description: The Social Sharing Plugin – Kiwi plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.1.7 via the 'kiwi-nw-pinterest' class. This makes it possible for unauthenticated attackers to view limited content from password protected posts. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat
ditional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/896a038f-fe54-4120-842e-093ef236a898?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3109786%40kiwi-social-share&new=3109786%40kiwi-social-share&sfp_email=&sfph_mail=
CVE ID: CVE-2024-3229 State: PUBLISHED Published: 2024-06-19T04:31:58.762Z Last Updated: 2024-08-01T20:05:08.200Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: wordpresschef Products: Salon Booking System Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The Salon booking system plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SLN_Action_Ajax_ImportAssistants function along with missing authorization checks in all versions up to, and including, 10.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may
. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3bbbf5be-5c0a-4514-88ac-003083c0bba3?source=cve - https://plugins.trac.wordpress.org/changeset/3103584/salon-booking-system/trunk/src/SLN/Action/Ajax/ImportAssistants.php
CVE ID: CVE-2024-3230 State: PUBLISHED Published: 2024-06-04T05:32:15.260Z Last Updated: 2024-08-01T20:05:08.375Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: dfactory Products: Download Attachments Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Download Attachments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'download-attachments' shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-leve
d output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/62475d8f-a0f6-45ab-abd0-ad24e1887c91?source=cve - https://wordpress.org/plugins/download-attachments/
CVE ID: CVE-2024-3231 State: PUBLISHED Published: 2024-05-17T06:00:02.342Z Last Updated: 2024-11-01T19:39:52.466Z Vendors: Unknown Products: Popup4Phone Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/81dbb5c0-ccdd-4af1-b2f2-71cb1b37fe93/
CVE ID: CVE-2024-3232 State: PUBLISHED Published: 2024-07-16T17:02:19.000Z Last Updated: 2024-08-01T20:05:08.350Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: Tenable Products: Tenable Identity Exposure Problem Types: CWE-1236 Description: A formula injection vulnerability exists in Tenable Identity Exposure where an authenticated remote attacker with administrative privileges could manipulate application form fields in order to trick another administrator into executing CSV payloads. - CVE-2024-3232 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.tenable.com/security/tns-2024-04
CVE ID: CVE-2024-3233 State: PUBLISHED Published: 2024-05-02T16:52:40.154Z Last Updated: 2024-08-01T20:05:08.436Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: vinod-dalvi Products: Ivory Search – WordPress Search Plugin Problem Types: CWE-862 Missing Authorization Description: The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_create_index() function in all versions up to, and including, 5.5.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to trigger index creation. Additional Analyst Notes: - CISA ADP
cated attackers, with subscriber-level access and above, to trigger index creation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cc9935d8-7790-457b-88bf-bee5e13b0f5a?source=cve - https://plugins.trac.wordpress.org/changeset/3067568/add-search-to-menu/trunk/includes/class-is-index-manager.php
CVE ID: CVE-2024-3234 State: PUBLISHED Published: 2024-06-06T18:20:45.616Z Last Updated: 2024-08-01T20:05:08.277Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: gaizhenbiao Products: gaizhenbiao/chuanhuchatgpt Problem Types: CWE-22 Description: The gaizhenbiao/chuanhuchatgpt application is vulnerable to a path traversal attack due to its use of an outdated gradio component. The application is designed to restrict user access to resources within the `web_assets` folder. However, the outdated version of gradio it employs is susceptible to path traversal, as identified in CVE-2023-51449. This vulnerability allows unauthorized users to bypass the intended res