Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-5148 State: PUBLISHED Published: 2024-09-02T11:03:18.235Z Last Updated: 2025-11-20T19:29:17.887Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-488 Description: A flaw was found in the gnome-remote-desktop package. The gnome-remote-desktop system daemon performs inadequate validation of session agents using D-Bus methods related to transitioning a client connection from the login screen to the user session. As a result, the system RDP TLS certificate and key can be exposed to unauthorized users. This flaw allows a malicious
. As a result, the system RDP TLS certificate and key can be exposed to unauthorized users. This flaw allows a malicious user on the system to take control of the RDP client connection during the login screen-to-user session transition. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2024-5148 - https://bugzilla.redhat.com/show_bug.cgi?id=2282003 - https://gitlab.gnome.org/GNOME/gnome-remote-desktop/-/issues/196
CVE ID: CVE-2024-5149 State: PUBLISHED Published: 2024-06-05T04:32:25.171Z Last Updated: 2024-08-01T21:03:11.016Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: svenl77 Products: Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) Problem Types: CWE-330 Use of Insufficiently Random Values Description: The BuddyForms plugin for WordPress is vulnerable to Email Verification Bypass in all versions up to, and including, 2.8.9 via the use of an insufficiently random activation code. This makes it possible for unauthenticated attackers to bypass the email verification. Additional Analyst Notes: - CISA
This makes it possible for unauthenticated attackers to bypass the email verification. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a5c8d361-698b-4abd-bcdd-0361d3fd10c5?source=cve - https://plugins.trac.wordpress.org/browser/buddyforms/tags/2.8.9/includes/wp-insert-user.php#L334
CVE ID: CVE-2024-5150 State: PUBLISHED Published: 2024-05-29T02:00:37.242Z Last Updated: 2024-08-01T21:03:10.892Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: glboy Products: Login with phone number Problem Types: CWE-288 Authentication Bypass Using an Alternate Path or Channel Description: The Login with phone number plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.26. This is due to the 'activation_code' default value is empty, and the not empty check is missing in the 'lwp_ajax_register' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as a
er' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user email. The vulnerability is patched in version 1.7.26, but there is an issue in the patch that causes the entire function to not work, and this issue is fixed in version 1.7.27. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cf34eb9f-f6e9-4a7a-8459-c86f9fa3dad8?source=cve - https://plugins.trac.wordpress.org/browser/login-with-phone-number/tags/1.7.25/login-with-phonenumber.php#L4183 - https://plugins.trac.wordpress.org/browse
browser/login-with-phone-number/tags/1.7.25/login-with-phonenumber.php#L4183 - https://plugins.trac.wordpress.org/browser/login-with-phone-number/tags/1.7.25/login-with-phonenumber.php#L4220 - https://plugins.trac.wordpress.org/browser/login-with-phone-number/tags/1.7.25/login-with-phonenumber.php#L4241 - https://plugins.trac.wordpress.org/changeset/3090625/login-with-phone-number - https://plugins.trac.wordpress.org/changeset/3090754/login-with-phone-number#file5
CVE ID: CVE-2024-5151 State: PUBLISHED Published: 2024-07-13T06:00:09.746Z Last Updated: 2024-08-01T21:03:10.976Z Vendors: Unknown Products: SULly Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The SULly WordPress plugin before 4.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/1ede4c66-9932-4ba6-bba1-0ba13f5a2f8f/
CVE ID: CVE-2024-5152 State: PUBLISHED Published: 2024-06-06T03:53:11.073Z Last Updated: 2024-08-01T21:03:10.962Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: quomodosoft Products: ElementsReady Addons for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The ElementsReady Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_id’ parameter in all versions up to, and including, 6.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, t
tion and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d2cffdc3-bd74-42ab-befd-8a396c5d990d?source=cve - https://plugins.trac.wordpress.org/browser/element-ready-lite/trunk/inc/Widgets/info_box/Element_Ready_Info_Box_Widget.php#L742
CVE ID: CVE-2024-5153 State: PUBLISHED Published: 2024-06-06T03:53:09.676Z Last Updated: 2024-08-01T21:03:10.849Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) Vendors: wshberlin Products: Startklar Elementor Addons Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The Startklar Elementor Addons plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.7.15 via the 'dropzone_hash' parameter. This makes it possible for unauthenticated attackers to copy the contents of arbitrary files on the server, which can contain sensitive information, and to delete arbitrary
to copy the contents of arbitrary files on the server, which can contain sensitive information, and to delete arbitrary directories, including the root WordPress directory. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/baa20290-9c01-4f8d-adeb-fbfb15b9d6a9?source=cve - https://plugins.trac.wordpress.org/browser/startklar-elmentor-forms-extwidgets/trunk/widgets/dropzone_form_field.php#L334
CVE ID: CVE-2024-5154 State: PUBLISHED Published: 2024-06-12T08:51:43.565Z Last Updated: 2025-11-20T08:19:11.952Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N) Vendors: Red Hat Products: Red Hat OpenShift Container Platform 4.12, Red Hat OpenShift Container Platform 4.13, Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 4.15, Red Hat OpenShift Container Platform 4.16, Red Hat OpenShift Container Platform 4.17, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 3.11 Problem Types: CWE-22 Description: A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on
s: CWE-22 Description: A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal (“../“). This flaw allows the container to read and write to arbitrary files on the host system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:10818 - https://access.redhat.com/errata/RHSA-2024:3676 - https://access.redhat.com/errata/RHSA-2024:3700 - https://access.redhat.com/errata/RHSA-2024:4008 - https://access.redhat.com/errata/RHSA-2024:4159 - https://access.redhat.com/errata/RHSA-2024:4486 - https://access.redhat.com/security/cve/CVE-2024-5154 - htt
2024:4159 - https://access.redhat.com/errata/RHSA-2024:4486 - https://access.redhat.com/security/cve/CVE-2024-5154 - https://bugzilla.redhat.com/show_bug.cgi?id=2280190 - https://github.com/cri-o/cri-o/security/advisories/GHSA-j9hf-98c3-wrm8
CVE ID: CVE-2024-5155 State: PUBLISHED Published: 2024-06-14T06:00:05.267Z Last Updated: 2024-08-01T21:03:10.979Z Vendors: Unknown Products: Inquiry cart Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The Inquiry cart WordPress plugin through 3.4.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/f1e90a8a-d959-4316-a5d4-e183854944bd/
CVE ID: CVE-2024-5156 State: PUBLISHED Published: 2024-06-20T14:00:46.596Z Last Updated: 2024-08-01T21:03:11.034Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: UX-themes Products: Flatsome Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Flatsome theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.18.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary w
utes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cf6c13de-e666-4c80-aa4c-6f610d899d03?source=cve - https://themeforest.net/item/flatsome-multipurpose-responsive-woocommerce-theme/5484319#item-description__change-log
CVE ID: CVE-2024-5157 State: PUBLISHED Published: 2024-05-22T15:11:02.249Z Last Updated: 2025-03-27T19:28:43.218Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Scheduling in Google Chrome prior to 125.0.6422.76 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_21.html - https://issues.chromium.org/issues/336012573 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.or
es.chromium.org/issues/336012573 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5KEVD4433KTOCYY6V4I7MMYKQ6URUS4L/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FX6IYZ6XF7B2WE66NFPNI2NHWJFI6VDF/
CVE ID: CVE-2024-5158 State: PUBLISHED Published: 2024-05-22T15:11:02.630Z Last Updated: 2025-02-13T17:53:47.978Z Vendors: Google Products: Chrome Problem Types: Type Confusion Description: Type Confusion in V8 in Google Chrome prior to 125.0.6422.76 allowed a remote attacker to potentially perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_21.html - https://issues.chromium.org/issues/338908243 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/messa
mium.org/issues/338908243 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5KEVD4433KTOCYY6V4I7MMYKQ6URUS4L/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FX6IYZ6XF7B2WE66NFPNI2NHWJFI6VDF/
CVE ID: CVE-2024-5159 State: PUBLISHED Published: 2024-05-22T15:11:03.061Z Last Updated: 2025-02-13T17:53:48.548Z Vendors: Google Products: Chrome Problem Types: Heap buffer overflow Description: Heap buffer overflow in ANGLE in Google Chrome prior to 125.0.6422.76 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_21.html - https://issues.chromium.org/issues/335613092 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraprojec
issues.chromium.org/issues/335613092 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5KEVD4433KTOCYY6V4I7MMYKQ6URUS4L/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FX6IYZ6XF7B2WE66NFPNI2NHWJFI6VDF/
CVE ID: CVE-2024-5160 State: PUBLISHED Published: 2024-05-22T15:11:03.506Z Last Updated: 2025-02-13T17:53:49.172Z Vendors: Google Products: Chrome Problem Types: Heap buffer overflow Description: Heap buffer overflow in Dawn in Google Chrome prior to 125.0.6422.76 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_21.html - https://issues.chromium.org/issues/338161969 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraprojec
issues.chromium.org/issues/338161969 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5KEVD4433KTOCYY6V4I7MMYKQ6URUS4L/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FX6IYZ6XF7B2WE66NFPNI2NHWJFI6VDF/
CVE ID: CVE-2024-5161 State: PUBLISHED Published: 2024-06-06T03:53:10.609Z Last Updated: 2024-08-01T21:03:11.081Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: nalam-1 Products: Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_id’ parameter in all versions up to, and including, 1.1.39 due to insu
lnerable to Stored Cross-Site Scripting via the ‘_id’ parameter in all versions up to, and including, 1.1.39 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cb64952e-170e-47c5-87fd-d2ec60192b65?source=cve - https://plugins.trac.wordpress.org/browser/magical-addons-for-elementor/trunk/includes/widgets/advance-skill-bars.php#L502 - https://plugi
ac.wordpress.org/browser/magical-addons-for-elementor/trunk/includes/widgets/advance-skill-bars.php#L502 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3098054%40magical-addons-for-elementor&new=3098054%40magical-addons-for-elementor&sfp_email=&sfph_mail=#file9
CVE ID: CVE-2024-5162 State: PUBLISHED Published: 2024-06-06T03:53:10.144Z Last Updated: 2024-08-01T21:03:11.051Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ibabar Products: WordPress prettyPhoto Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WordPress prettyPhoto plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts
makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c581616d-c9e7-46f2-9c2f-5e082a13fd0b?source=cve - https://plugins.trac.wordpress.org/browser/prettyphoto/trunk/addon/jltma-wpf-addon.php#L96
CVE ID: CVE-2024-5163 State: PUBLISHED Published: 2024-06-17T03:07:04.982Z Last Updated: 2024-08-21T05:48:10.193Z Vendors: TECNO Products: com.transsion.carlcare Problem Types: CWE-732 Description: Improper permission settings for mobile applications (com.transsion.carlcare) may lead to user password and account security risks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.tecno.com/SRC/blogdetail/267?lang=en_US - https://security.tecno.com/SRC/securityUpdates?type=SA
CVE ID: CVE-2024-5164 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:05:49.751Z Description: No description available.
CVE ID: CVE-2024-5165 State: PUBLISHED Published: 2024-05-23T09:56:31.696Z Last Updated: 2024-08-01T21:03:11.075Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Eclipse Foundation Products: Eclipse Ditto Problem Types: CWE-79 Description: In Eclipse Ditto versions 3.0.0 to 3.5.5, the user input of several input fields of the Eclipse Ditto Explorer User Interface https://eclipse.dev/ditto/user-interface.html was not properly neutralized and thus vulnerable to both Reflected and Stored XSS (Cross Site Scripting). Several inputs were not persisted at the backend of Eclipse Ditto, but only in local browser storage to save settings of "environments" of the UI an
isted at the backend of Eclipse Ditto, but only in local browser storage to save settings of "environments" of the UI and e.g. the last performed "search queries", resulting in a "Reflected XSS" vulnerability. However, several other inputs were persisted at the backend of Eclipse Ditto, leading to a "Stored XSS" vulnerability. Those mean that authenticated and authorized users at Eclipse Ditto can persist Things in Ditto which can - when being displayed by other users also being authorized to see those Things in the Eclipse Ditto UI - cause scripts to be executed in the browser of other users. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://g
wser of other users. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.eclipse.org/security/cve-assignement/-/issues/23 - https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/211 - https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/210 - https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/209 - https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/207 - https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/204 - https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/202 - https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/201
CVE ID: CVE-2024-5166 State: PUBLISHED Published: 2024-05-22T16:11:55.740Z Last Updated: 2024-08-01T21:03:10.986Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Google Cloud Products: Looker Problem Types: CWE-639 Description: An Insecure Direct Object Reference in Google Cloud's Looker allowed metadata exposure across authenticated Looker users sharing the same LookML model. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cloud.google.com/looker/docs/best-practices/query-id-update-instructions
CVE ID: CVE-2024-5167 State: PUBLISHED Published: 2024-07-13T06:00:09.955Z Last Updated: 2024-08-01T21:03:11.042Z Vendors: Unknown Products: CM Email Registration Blacklist and Whitelist Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The CM Email Registration Blacklist and Whitelist WordPress plugin before 1.4.9 does not have CSRF check when adding or deleting an item from the blacklist or whitelist, which could allow attackers to make a logged in admin add or delete settings from the blacklist or whitelist menu via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/67bb5ab8-4493-4f5b
tes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/67bb5ab8-4493-4f5b-a989-41576675b61a/
CVE ID: CVE-2024-5168 State: PUBLISHED Published: 2024-05-23T13:04:19.049Z Last Updated: 2024-08-01T21:03:10.998Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Prodys Products: Quantum Audio codec Problem Types: CWE-284 Description: Improper access control vulnerability in Prodys' Quantum Audio codec affecting versions 2.3.4t and below. This vulnerability could allow an unauthenticated user to bypass authentication entirely and execute arbitrary API requests against the web application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/improper-access-control-vulne
- CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/improper-access-control-vulnerability-prodys-quantum-audio-codec
CVE ID: CVE-2024-5169 State: PUBLISHED Published: 2024-06-26T06:00:04.539Z Last Updated: 2024-08-01T21:03:11.041Z Vendors: Unknown Products: Video Widget Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Video Widget WordPress plugin through 1.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/f0de62e3-5e85-43f3-8e3e-e816dafb1406/
CVE ID: CVE-2024-5170 State: PUBLISHED Published: 2024-09-17T06:00:02.039Z Last Updated: 2024-09-17T14:52:48.958Z Vendors: Unknown Products: Logo Manager For Enamad Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Logo Manager For Enamad WordPress plugin through 0.7.1 does not sanitise and escape in its widgets settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/37b5ed06-0633-49e0-b47d-8aa2f4510179/