deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-48874
Published: 2024-12-06
Description: Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could give attackers the ability to force Ruijie's proxy servers to perform any request the attackers choose. Using this, attackers could access internal services used by Ruijie and their internal cloud infrastructure via AWS cloud metadata services.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-01
CVE: CVE-2024-52324
Published: 2024-12-06
Description: Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses an inherently dangerous function which could allow an attacker to send a malicious MQTT message resulting in devices executing arbitrary OS commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-242
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-01
CVE: CVE-2024-0130
Published: 2024-12-06
Description: NVIDIA UFM Enterprise, UFM Appliance, and UFM CyberAI contain a vulnerability where an attacker can cause an improper authentication issue by sending a malformed request through the Ethernet management interface. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, denial of service, and information disclosure.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5584
CVE: CVE-2024-0139
Published: 2024-12-06
Description: NVIDIA Base Command Manager and Bright Cluster Manager for Linux contain an insecure temporary file vulnerability. A successful exploit of this vulnerability might lead to denial of service.
CVSS Score: 4.4 (MEDIUM)
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5600
CVE: CVE-2024-12326
Published: 2024-12-06
Description: Jirafeau normally prevents browser preview for SVG files due to the possibility that manipulated SVG files could be exploited for cross site scripting. This was done by storing the MIME type of a file and preventing the browser preview for MIME type image/svg+xml. This issue was first reported in CVE-2022-30110. However, it was still possible to do a browser preview of a SVG file by sending a manipulated MIME type during the upload, where the case of any letter in image/svg+xml had been changed (like image/svg+XML). The check for image/svg+xml has been changed to be case insensitive.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gitlab.com/jirafeau/Jirafeau/-/commit/6cfca8753d54e2025c6020b2af32529e25f58c66; https://www.cve.org/CVERecord?id=CVE-2022-30110
CVE: CVE-2024-7874
Published: 2024-12-06
Description: Tungsten Automation (Kofax) TotalAgility in versions all through 7.9.0.25.0.954 is vulnerable to a Reflected XSS attacks through mfpConnectionId parameter manipulation in a form sent to endpoints "/TotalAgility/Kofax/BrowserDevice/ScanFront.aspx" 
and "/TotalAgility/Kofax/BrowserDevice/ScanFrontDebug.aspx"
This allows for injection of a malicious JavaScript code, leading to a possible information leak. 
Exploitation is possible only while using POST requests and also requires retrieving/generating a proper VIEWSTATE parameter, which limits the risk of a successful attack.
CWE: CWE-79
References: https://cert.pl/en/posts/2024/12/CVE-2024-7874; https://cert.pl/posts/2024/12/CVE-2024-7874; https://www.tungstenautomation.com/products/totalagility
CVE: CVE-2024-7875
Published: 2024-12-06
Description: Tungsten Automation (Kofax) TotalAgility in versions all through 7.9.0.25.0.954 is vulnerable to a Reflected XSS attacks through mfpScreenResolutionWidth parameter manipulation in a form sent to an endpoint /TotalAgility/Kofax/BrowserDevice/ScanFront.aspx
This allows for injection of a malicious JavaScript code, leading to a possible information leak. 
Exploitation is possible only while using POST requests and also requires retrieving/generating a proper VIEWSTATE parameter, which limits the risk of a successful attack.
CWE: CWE-79
References: https://cert.pl/en/posts/2024/12/CVE-2024-7874; https://cert.pl/posts/2024/12/CVE-2024-7874; https://www.tungstenautomation.com/products/totalagility
CVE: CVE-2024-38921
Published: 2024-12-06
Description: Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerability is triggered via remotely sending a request for change the value of dynamic-parameter`/amcl z_rand ` .
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416, CWE-416
References: https://github.com/GoesM/ROS-CVE-CNVDs; https://github.com/ros-navigation/navigation2/issues/4379; https://github.com/ros-navigation/navigation2/pull/4397
CVE: CVE-2024-38922
Published: 2024-12-06
Description: Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble version was discovered to contain a heap overflow in the nav2_amcl process. This vulnerability is triggered via sending a crafted message to the component /initialpose.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-120
References: https://github.com/GoesM/ROS-CVE-CNVDs; https://github.com/open-navigation/navigation2/issues/4307; https://github.com/ros-navigation/navigation2/issues/4294
CVE: CVE-2024-38923
Published: 2024-12-06
Description: Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerability is triggered via remotely sending a request to change the value of dynamic-parameter`/amcl odom_frame_id` .
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416, CWE-416
References: https://github.com/GoesM/ROS-CVE-CNVDs; https://github.com/ros-navigation/navigation2/issues/4379; https://github.com/ros-navigation/navigation2/pull/4397
CVE: CVE-2024-38924
Published: 2024-12-06
Description: Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerability is triggered via remotely sending a request to change the value of dynamic-parameter`/amcl laser_model_type` .
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416, CWE-416
References: https://github.com/GoesM/ROS-CVE-CNVDs; https://github.com/ros-navigation/navigation2/issues/4379; https://github.com/ros-navigation/navigation2/pull/4397
CVE: CVE-2024-38925
Published: 2024-12-06
Description: Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerability is triggered via remotely sending a request for change the value of dynamic-parameter`/amcl z_max` .
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416, CWE-416
References: https://github.com/GoesM/ROS-CVE-CNVDs; https://github.com/ros-navigation/navigation2/issues/4379; https://github.com/ros-navigation/navigation2/pull/4397
CVE: CVE-2024-38926
Published: 2024-12-06
Description: Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerability is triggered via remotely sending a request for change the value of dynamic-parameter `/amcl z_short`.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416, CWE-416
References: https://github.com/GoesM/ROS-CVE-CNVDs; https://github.com/ros-navigation/navigation2/issues/4379; https://github.com/ros-navigation/navigation2/pull/4397
CVE: CVE-2024-38927
Published: 2024-12-06
Description: Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerability is triggered via remotely sending a request to change the value of dynamic-parameter `/amcl do_beamskip`.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416, CWE-416
References: https://github.com/GoesM/ROS-CVE-CNVDs; https://github.com/ros-navigation/navigation2/issues/4379; https://github.com/ros-navigation/navigation2/pull/4397
CVE: CVE-2024-41644
Published: 2024-12-06
Description: Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via the dyn_param_handler_ component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-281, CWE-281
References: https://github.com/GoesM/ROS-CVE-CNVDs; https://github.com/ros-navigation/navigation2/issues/4496; https://github.com/ros-navigation/navigation2/pull/4521
CVE: CVE-2024-41645
Published: 2024-12-06
Description: Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a crafted script to the nav2__amcl.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-281, CWE-281
References: https://github.com/GoesM/ROS-CVE-CNVDs; https://github.com/ros-navigation/navigation2/issues/4497; https://github.com/ros-navigation/navigation2/pull/4521
CVE: CVE-2024-41646
Published: 2024-12-06
Description: Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a crafted script to the nav2_dwb_controller.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-281, CWE-281
References: https://github.com/GoesM/ROS-CVE-CNVDs; https://github.com/ros-navigation/navigation2/issues/4437; https://github.com/ros-navigation/navigation2/pull/4463
CVE: CVE-2024-41647
Published: 2024-12-06
Description: Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a crafted script to the nav2_mppi_controller.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-732
References: https://github.com/GoesM/ROS-CVE-CNVDs; https://github.com/ros-navigation/navigation2/issues/4436; https://github.com/ros-navigation/navigation2/pull/4463
CVE: CVE-2024-41648
Published: 2024-12-06
Description: Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a crafted script to the nav2_regulated_pure_pursuit_controller.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-281, CWE-281
References: https://github.com/GoesM/ROS-CVE-CNVDs; https://github.com/ros-navigation/navigation2/issues/4438; https://github.com/ros-navigation/navigation2/pull/4463
CVE: CVE-2024-41649
Published: 2024-12-06
Description: Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a crafted script to the executor_thread_.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-281, CWE-281
References: https://github.com/GoesM/ROS-CVE-CNVDs; https://github.com/open-navigation/navigation2/issues/4323; https://github.com/ros-navigation/navigation2/pull/4385
CVE: CVE-2024-41650
Published: 2024-12-06
Description: Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a crafted script to the nav2_costmap_2d.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-281, CWE-281
References: https://github.com/GoesM/ROS-CVE-CNVDs; https://github.com/ros-navigation/navigation2/issues/4489; https://github.com/ros-navigation/navigation2/pull/4495
CVE: CVE-2024-44852
Published: 2024-12-06
Description: Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a segmentation violation via the component theta_star::ThetaStar::isUnsafeToPlan().
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-763, CWE-763
References: https://github.com/GoesM/ROS-CVE-CNVDs; https://github.com/open-navigation/navigation2/issues/4464; https://github.com/ros-navigation/navigation2/pull/4463
CVE: CVE-2024-44853
Published: 2024-12-06
Description: Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a NULL pointer dereference via the component computeControl().
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://github.com/GoesM/ROS-CVE-CNVDs; https://github.com/ros-navigation/navigation2/issues/4547; https://github.com/ros-navigation/navigation2/pull/4548
CVE: CVE-2024-44854
Published: 2024-12-06
Description: Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a NULL pointer dereference via the component smoothPlan().
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://github.com/GoesM/ROS-CVE-CNVDs; https://github.com/ros-navigation/navigation2/issues/4538; https://github.com/ros-navigation/navigation2/pull/4544
CVE: CVE-2024-44855
Published: 2024-12-06
Description: Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a NULL pointer dereference via the component nav2_navfn_planner().
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://github.com/GoesM/ROS-CVE-CNVDs; https://github.com/open-navigation/navigation2/issues/4466; https://github.com/ros-navigation/navigation2/pull/4463
CVE: CVE-2024-44856
Published: 2024-12-06
Description: Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a NULL pointer dereference via the component nav2_smac_planner().
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://github.com/GoesM/ROS-CVE-CNVDs; https://github.com/ros-navigation/navigation2/issues/4468; https://github.com/ros-navigation/navigation2/pull/4463
CVE: CVE-2024-54138
Published: 2024-12-06
Description: NuGet Gallery is a package repository that powers nuget.org. The NuGetGallery has a security vulnerability related to its handling of autolinks in Markdown content. While the platform properly filters out JavaScript from standard links, it does not adequately sanitize autolinks. This oversight allows attackers to exploit autolinks as a vector for Cross-Site Scripting (XSS) attacks. This vulnerability is fixed in 2024.12.06.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/NuGet/NuGetGallery/pull/10296; https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-x448-p234-x5p8
CVE: CVE-2024-10046
Published: 2024-12-07
Description: The افزونه پیامک ووکامرس Persian WooCommerce SMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 7.0.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/persian-woocommerce-sms/tags/7.0.3/src/SMS/Archive.php#L93; https://plugins.trac.wordpress.org/changeset/3201912/; https://www.wordfence.com/threat-intel/vulnerabilities/id/175a69da-c47a-40f3-98c7-7cfcdf98f9f6?source=cve
CVE: CVE-2024-11329
Published: 2024-12-07
Description: The Comfino Payment Gateway plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 4.1.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/comfino-payment-gateway/tags/4.1.0/views/admin/configuration.php#L39; https://plugins.trac.wordpress.org/changeset/3205417/comfino-payment-gateway/trunk/views/admin/configuration.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/006945a3-5f54-4bb8-9522-c832d59624a0?source=cve
CVE: CVE-2024-11353
Published: 2024-12-07
Description: The SMS for Lead Capture Forms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_message() function in all versions up to, and including, 1.1.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary messages.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/clicksend-lead-capture-form/trunk/clicksend-SMS-form-settings.php#L54; https://plugins.trac.wordpress.org/browser/clicksend-lead-capture-form/trunk/clicksend-SMS-form-settings.php#L63; https://www.wordfence.com/threat-intel/vulnerabilities/id/a0c68bb6-77a2-4232-923a-37f2c0327743?source=cve
CVE: CVE-2024-11436
Published: 2024-12-07
Description: The Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.4.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3202800/; https://www.wordfence.com/threat-intel/vulnerabilities/id/125a1d8d-8cd9-439c-b765-198ad369f987?source=cve
CVE: CVE-2024-11451
Published: 2024-12-07
Description: The Zooom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zooom' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/zooom/trunk/zooom.php; https://wordpress.org/plugins/zooom/; https://www.wordfence.com/threat-intel/vulnerabilities/id/6bd15878-a290-4613-83d9-011d60bb0233?source=cve
CVE: CVE-2024-11904
Published: 2024-12-07
Description: The 코드엠샵 소셜톡 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'msntt_add_plus_talk' shortcode in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3202813/; https://www.wordfence.com/threat-intel/vulnerabilities/id/8e501b31-a7f4-4d0d-bf83-af7b6c023a6b?source=cve
CVE: CVE-2024-11943
Published: 2024-12-07
Description: The 워드프레스 결제 심플페이 – 우커머스 결제 플러그인 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg() function without appropriate escaping on the URL in all versions up to, and including, 5.2.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/pgall-for-woocommerce/trunk/includes/admin/class-pafw-admin-notice.php#L81; https://plugins.trac.wordpress.org/changeset/3202085/; https://wordpress.org/plugins/pgall-for-woocommerce/#developers
CVE: CVE-2024-12026
Published: 2024-12-07
Description: The Message Filter for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveFilter() function in all versions up to, and including, 1.6.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create new filters. CVE-2024-54254 may be a duplicate of this CVE.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset/3203387/cf7-message-filter/trunk?contextall=1&old=3160303&old_path=%2Fcf7-message-filter%2Ftrunk; https://wordpress.org/plugins/cf7-message-filter/; https://www.wordfence.com/threat-intel/vulnerabilities/id/7e7044aa-a1e7-4b1d-9f50-5e250426c6b0?source=cve
CVE: CVE-2024-12115
Published: 2024-12-07
Description: The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.5.4. This is due to missing or incorrect nonce validation on the duplicate_poll() function. This makes it possible for unauthenticated attackers to duplicate polls via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/changeset/3202972/poll-maker/tags/5.5.5/includes/lists/class-poll-maker-polls-list-table.php?old=3202972&old_path=poll-maker%2Ftags%2F5.5.4%2Fincludes%2Flists%2Fclass-poll-maker-polls-list-table.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/e76447ec-2815-4758-ae2c-67a938a739d9?source=cve
CVE: CVE-2024-12165
Published: 2024-12-07
Description: The Mollie for Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 5.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/cf7-mollie/trunk/includes/php/admin_menu.php#L164; https://www.wordfence.com/threat-intel/vulnerabilities/id/a5a21b3a-a60f-4083-a474-ec9fedd9b8cb?source=cve
CVE: CVE-2024-12166
Published: 2024-12-07
Description: The Shortcodes Blocks Creator Ultimate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 2.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE-2024-54264 may be a duplicate of this.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/ultimate-shortcodes-creator/trunk/admin/class-shortcode-list-table.php#L83; https://www.wordfence.com/threat-intel/vulnerabilities/id/6ece9b6d-6802-44b9-9ead-1563286f4ff3?source=cve
CVE: CVE-2024-12167
Published: 2024-12-07
Description: The Shortcodes Blocks Creator Ultimate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '_wpnonce' parameter in all versions up to, and including, 2.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/ultimate-shortcodes-creator/trunk/admin/class-admin.php#L111; https://www.wordfence.com/threat-intel/vulnerabilities/id/db6ccadb-5e90-4234-88cc-28241846acea?source=cve
CVE: CVE-2024-12257
Published: 2024-12-07
Description: The CardGate Payments for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3203585/; https://www.wordfence.com/threat-intel/vulnerabilities/id/9f8de5a9-2279-4b84-b1f6-fdb293aa6017?source=cve