Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-3868 State: PUBLISHED Published: 2025-04-25T06:45:28.347Z Last Updated: 2025-04-25T16:01:59.432Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: codeandreload Products: Custom Admin-Bar Favorites Problem Types: CWE-79 Description: The Custom Admin-Bar Favorites plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'menuObject' parameter in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicki
bitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/417fb507-a414-4bc2-ab01-d6f2fc554350?source=cve - https://plugins.trac.wordpress.org/browser/abundatrade-plugin/tags/1.8.02/abundatrade_pugin.php - https://wordpress.org/plugins/admin-bookmarks/
CVE ID: CVE-2025-3869 State: PUBLISHED Published: 2025-05-24T02:23:03.204Z Last Updated: 2025-05-24T10:10:08.770Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: 4stats Products: 4stats Problem Types: CWE-79 Description: The 4stats plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.9. This is due to missing or incorrect nonce validation on the stats/stats.php page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst
est granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/453b246f-7e39-4adb-9506-77d96146ab50?source=cve - https://plugins.trac.wordpress.org/browser/4stats/tags/2.0.9/4stats.php - https://wordpress.org/plugins/4stats/
CVE ID: CVE-2025-3870 State: PUBLISHED Published: 2025-04-25T08:22:13.223Z Last Updated: 2025-04-25T14:28:26.319Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: olarmarius Products: 1 Decembrie 1918 Problem Types: CWE-79 Description: The 1 Decembrie 1918 plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.dec.2012. This is due to missing or incorrect nonce validation on the 1-decembrie-1918/1-decembrie-1918.php page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an ac
and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/73f7646f-f01f-4f57-836c-e0bd04764ba9?source=cve - https://plugins.trac.wordpress.org/browser/1-decembrie-1918/tags/1.dec.1918/1-decembrie-1918.php - https://wordpress.org/plugins/1-decembrie-1918/
CVE ID: CVE-2025-3871 State: PUBLISHED Published: 2025-07-16T14:00:27.665Z Last Updated: 2025-07-18T14:52:28.197Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Fortra Products: GoAnywhere MFT Problem Types: CWE-862 Description: Broken access control in Fortra's GoAnywhere MFT prior to 7.8.1 allows an attacker to create a denial of service situation when configured to use GoAnywhere One-Time Password (GOTP) email two-factor authentication (2FA) and the user has not set an email address. In this scenario, the attacker may enter the email address of a known user when prompted and the user will be disabled if that user has configured GOTP. Additional Analyst N
dress of a known user when prompted and the user will be disabled if that user has configured GOTP. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.fortra.com/security/advisories/product-security/FI-2025-009
CVE ID: CVE-2025-3872 State: PUBLISHED Published: 2025-04-24T09:19:33.900Z Last Updated: 2025-04-24T15:22:37.345Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Centreon Products: Centreon Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon centreon-web (User configuration form modules) allows SQL Injection. A user with high privileges is able to become administrator by intercepting the contact form request and altering its payload. This issue affects Centreon: from 22.10.0 before 22.10.28, from 23.04.0 before 23.04.25, from 23.10.0 before 23.10.20, from 24.04.0 befo
ts Centreon: from 22.10.0 before 22.10.28, from 23.04.0 before 23.04.25, from 23.10.0 before 23.10.20, from 24.04.0 before 24.04.10, from 24.10.0 before 24.10.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://thewatch.centreon.com/latest-security-bulletins-64/cve-2024-55571-centreon-web-high-severity-4496 - https://github.com/centreon/centreon/releases
CVE ID: CVE-2025-3873 State: PUBLISHED Published: 2025-07-25T15:46:02.258Z Last Updated: 2025-07-25T18:32:06.955Z Vendors: silabs.com Products: WiseConnect Problem Types: CWE-787 Description: The following APIs for the Silcon Labs SiWx91x prior to vesion 3.4.0 failed to check the size of the output buffer of the caller which could lead to data corruption on the host (Cortex-M4) application. sl_si91x_aes sl_si91x_gcm sl_si91x_ccm sl_si91x_sha Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.silabs.com/wiseconnect/latest/sisdk-wifi-release-notes/ - https://community.silabs.com/068Vm00000SSlOu
CVE ID: CVE-2025-3874 State: PUBLISHED Published: 2025-05-01T11:11:41.924Z Last Updated: 2025-05-01T13:46:41.298Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: mra13 Products: WordPress Simple Shopping Cart Problem Types: CWE-639 Description: The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.3 due to lack of randomization of a user controlled key. This makes it possible for unauthenticated attackers to access customer shopping carts and edit product links, add or delete products, and discover coupon codes. Additional Analyst Notes: - CISA ADP Vulnrichment: Ref
product links, add or delete products, and discover coupon codes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4fed59bf-885b-4a06-aff2-8e5ab5f83ba7?source=cve - https://plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5.1.2/includes/class-wpsc-cart.php#L68 - https://plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5.1.2/includes/class-wpsc-cart.php#L32 - https://plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5.1.2/wp_shopping_cart.php#L525 - https://plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5
.1.2/wp_shopping_cart.php#L525 - https://plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5.1.2/wp_shopping_cart.php#L158 - https://plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5.1.2/wp_shopping_cart.php#L265 - https://www.tipsandtricks-hq.com/ecommerce/wp-shopping-cart - https://developer.wordpress.org/reference/functions/wp_generate_password/ - https://plugins.trac.wordpress.org/changeset/3284572/
CVE ID: CVE-2025-3875 State: PUBLISHED Published: 2025-05-14T16:56:42.950Z Last Updated: 2025-11-03T19:58:36.011Z Vendors: Mozilla Products: Thunderbird Problem Types: Sender Spoofing via Malformed From Header in Thunderbird Description: Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used. For example, if the From header contains an (invalid) value "Spoofed Name ", Thunderbird treats spoofed@example.com as the actual address. This vulnerability affects Thunderbird < 128.10.1 and Thunderbird < 138.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.
0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1950629 - https://www.mozilla.org/security/advisories/mfsa2025-34/ - https://www.mozilla.org/security/advisories/mfsa2025-35/
CVE ID: CVE-2025-3876 State: PUBLISHED Published: 2025-05-10T11:22:45.907Z Last Updated: 2025-05-12T13:20:01.378Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: cozyvision1 Products: SMS Alert Order Notifications – WooCommerce Problem Types: CWE-862 Description: The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to insufficient user OTP validation in the handleWpLoginCreateUserAction() function in all versions up to, and including, 3.8.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to impersonate any account by supplying its username or email and elevat
ackers, with Subscriber-level access and above, to impersonate any account by supplying its username or email and elevate their privileges to that of an administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1cf65f79-d386-4dd4-a360-b2f764dfaf19?source=cve - https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.8.0/handler/forms/class-wplogin.php#L447 - https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.8.0/handler/forms/class-wplogin.php#L145 - https://wordpress.org/plugins/sms-alert/#developers - https://plugins.trac.wordpress.org/changeset/3290478/
CVE ID: CVE-2025-3877 State: REJECTED Published: 2025-05-14T16:56:43.402Z Last Updated: 2025-06-11T12:10:53.177Z Description: No description available.
CVE ID: CVE-2025-3878 State: PUBLISHED Published: 2025-05-10T11:22:46.479Z Last Updated: 2025-05-12T13:19:49.762Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: cozyvision1 Products: SMS Alert Order Notifications – WooCommerce Problem Types: CWE-79 Description: The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sa_verify shortcode in all versions up to, and including, 3.8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scr
This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a85461b7-6d16-435c-a149-ad25419a1585?source=cve - https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.8.0/helper/shortcode.php#L103 - https://wordpress.org/plugins/sms-alert/#developers - https://plugins.trac.wordpress.org/changeset/3290478/
CVE ID: CVE-2025-3879 State: PUBLISHED Published: 2025-05-02T16:15:10.650Z Last Updated: 2025-05-02T16:50:15.195Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: HashiCorp Products: Vault, Vault Enterprise Problem Types: CWE-863 Description: Vault Community, Vault Enterprise (“Vault”) Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the bound_locations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2025-07-vault-s-azure-
ional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2025-07-vault-s-azure-authentication-method-bound-location-restriction-could-be-bypassed-on-login/74716
CVE ID: CVE-2025-3880 State: PUBLISHED Published: 2025-06-17T11:23:36.813Z Last Updated: 2025-07-11T20:13:36.919Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: assafp Products: Poll, Survey & Quiz Maker Plugin by Opinion Stage Problem Types: CWE-863 Description: The Poll, Survey & Quiz Maker Plugin by Opinion Stage plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on several functions in all versions up to, and including, 19.9.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to change the email address for the account connection, and disconnect the
rs, with Contributor-level access and above, to change the email address for the account connection, and disconnect the plugin. Previously created content will still be displayed and functional if the account is disconnected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ba86268a-7bd6-40ed-9af6-29409245675d?source=cve - https://plugins.trac.wordpress.org/browser/social-polls-by-opinionstage/trunk/plugin.php - https://plugins.trac.wordpress.org/browser/social-polls-by-opinionstage/trunk/src/Modules/Admin.php - https://plugins.trac.wordpress.org/changeset/3310848/
CVE ID: CVE-2025-3881 State: PUBLISHED Published: 2025-05-22T00:48:31.860Z Last Updated: 2025-05-22T18:38:54.469Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: eCharge Hardy Barth Products: cPH2 Problem Types: CWE-78 Description: eCharge Hardy Barth cPH2 check_req.php ntp Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of eCharge Hardy Barth cPH2 charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the ntp parameter provided to the check_req.php endpoint. The issue results
specific flaw exists within the handling of the ntp parameter provided to the check_req.php endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the www-data user. Was ZDI-CAN-23113. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-247/
CVE ID: CVE-2025-3882 State: PUBLISHED Published: 2025-05-22T00:48:37.499Z Last Updated: 2025-05-22T18:37:53.253Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: eCharge Hardy Barth Products: cPH2 Problem Types: CWE-78 Description: eCharge Hardy Barth cPH2 nwcheckexec.php dest Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of eCharge Hardy Barth cPH2 charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the dest parameter provided to the nwcheckexec.php endpoint. The issue re
he specific flaw exists within the handling of the dest parameter provided to the nwcheckexec.php endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the www-data user. Was ZDI-CAN-23114. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-248/
CVE ID: CVE-2025-3883 State: PUBLISHED Published: 2025-05-22T00:48:41.901Z Last Updated: 2025-05-22T15:56:59.993Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: eCharge Hardy Barth Products: cPH2 Problem Types: CWE-78 Description: eCharge Hardy Barth cPH2 index.php Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of eCharge Hardy Barth cPH2 charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of GET parameters provided to the index.php endpoint. The issue results from the lack o
flaw exists within the handling of GET parameters provided to the index.php endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the www-data user. Was ZDI-CAN-23115. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-249/
CVE ID: CVE-2025-3884 State: PUBLISHED Published: 2025-05-22T00:49:29.032Z Last Updated: 2025-05-22T15:53:37.932Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Cloudera Products: Hue Problem Types: CWE-22 Description: Cloudera Hue Ace Editor Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Cloudera Hue. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Ace Editor web application. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An at
The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-24332. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-250/
CVE ID: CVE-2025-3885 State: PUBLISHED Published: 2025-05-22T00:49:42.558Z Last Updated: 2025-05-22T18:33:03.160Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Harman Becker Products: MGU21 Problem Types: CWE-20 Description: Harman Becker MGU21 Bluetooth Improper Input Validation Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of Harman Becker MGU21 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Bluetooth stack of the BCM89359 chipset. The issue results from the lack of proper validation of Blue
exists within the Bluetooth stack of the BCM89359 chipset. The issue results from the lack of proper validation of Bluetooth frames. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-23942. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-251/
CVE ID: CVE-2025-3886 State: PUBLISHED Published: 2025-04-27T10:41:17.670Z Last Updated: 2025-04-28T16:31:10.186Z Vendors: Cato Networks Products: SDP Client Problem Types: CWE-362 Description: An issue in CatoNetworks CatoClient before v.5.8.0 allows attackers to escalate privileges and achieve a race condition (TOCTOU) via the PrivilegedHelperTool component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.catonetworks.com/hc/en-us/articles/26903049677597-Security-Vulnerability-CVE-2025-3886-that-Impacts-macOS-Client-Versions-Lower-than-5-8
CVE ID: CVE-2025-3887 State: PUBLISHED Published: 2025-05-22T00:47:04.097Z Last Updated: 2025-06-17T23:03:10.566Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GStreamer Products: GStreamer Problem Types: CWE-121 Description: GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of H265 slice headers. The issue results from the lack of pr
implementation. The specific flaw exists within the parsing of H265 slice headers. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26596. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-267/
CVE ID: CVE-2025-3888 State: PUBLISHED Published: 2025-05-17T11:17:16.724Z Last Updated: 2025-05-19T14:56:52.470Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: artbees Products: Jupiter X Core Problem Types: CWE-79 Description: The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File inclusion in all versions up to, and including, 4.8.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the page with the included SVG file. Additiona
arbitrary web scripts in pages that will execute whenever a user accesses the page with the included SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f36f1ea5-62f7-48f0-a8d3-a56e0c9915d7?source=cve - https://plugins.trac.wordpress.org/browser/jupiterx-core/trunk/includes/extensions/raven/includes/modules/inline-svg/widgets/inline-svg.php#L304 - https://plugins.trac.wordpress.org/changeset/3292376/
CVE ID: CVE-2025-3889 State: PUBLISHED Published: 2025-05-01T11:11:41.530Z Last Updated: 2025-05-01T13:49:29.539Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: mra13 Products: WordPress Simple Shopping Cart Problem Types: CWE-639 Description: The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.3 via the 'process_payment_data' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the quantity of a product to a negative number, which subtracts the product cost from the total order cost. The attack will o
uantity of a product to a negative number, which subtracts the product cost from the total order cost. The attack will only work with Manual Checkout mode, as PayPal and Stripe will not process payments for a negative quantity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/41212533-535e-4a9e-a9b8-1240021a3752?source=cve - https://plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5.1.2/wp_shopping_cart.php#L324 - https://www.tipsandtricks-hq.com/ecommerce/wp-shopping-cart - https://www.tipsandtricks-hq.com/ecommerce/simple-shopping-cart-enabling-manual-offline-checkout - https://plugins.tr
- https://www.tipsandtricks-hq.com/ecommerce/simple-shopping-cart-enabling-manual-offline-checkout - https://plugins.trac.wordpress.org/changeset/3284572/