deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-10439
Published: 2024-10-28
Description: The eHRD CTMS from Sunnet has an Insecure Direct Object Reference (IDOR) vulnerability, allowing unauthenticated remote attackers to modify a specific parameter to access arbitrary files uploaded by any user.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://www.twcert.org.tw/en/cp-139-8167-a2c0d-2.html; https://www.twcert.org.tw/tw/cp-132-8166-085c4-1.html
CVE: CVE-2024-10440
Published: 2024-10-28
Description: The eHDR CTMS from Sunnet has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL command to read, modify, and delete database contents.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.twcert.org.tw/en/cp-139-8169-0632f-2.html; https://www.twcert.org.tw/tw/cp-132-8168-02720-1.html
CVE: CVE-2024-48936
Published: 2024-10-28
Description: SchedMD Slurm before 24.05.4 has Incorrect Authorization. A mistake in authentication handling in stepmgr could permit an attacker to execute processes under other users' jobs. This is limited to jobs explicitly running with --stepmgr, or on systems that have globally enabled stepmgr via SlurmctldParameters=enable_stepmgr in their configuration.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-863
References: https://lists.schedmd.com/mailman3/hyperkitty/list/slurm-announce%40lists.schedmd.com/message/44MFMN7R35YZFWTNO43R2754W5B5XUAI/; https://lists.schedmd.com/pipermail/slurm-announce/2024/date.html; https://www.schedmd.com/security-policy/
CVE: CVE-2024-50307
Published: 2024-10-28
Description: Use of potentially dangerous function issue exists in Chatwork Desktop Application (Windows) versions prior to 2.9.2. If a user clicks a specially crafted link in the application, an arbitrary file may be downloaded from an external website and executed. As a result, arbitrary code may be executed on the device that runs Chatwork Desktop Application (Windows).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-676
References: https://jvn.jp/en/jp/JVN78335885/
CVE: CVE-2024-9162
Published: 2024-10-28
Description: The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to arbitrary PHP Code Injection due to missing file type validation during the export in all versions up to, and including, 7.86. This makes it possible for authenticated attackers, with Administrator-level access and above, to create an export file with the .php extension on the affected site's server, adding an arbitrary PHP code to it, which may make remote code execution possible.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://github.com/d0n601/CVE-2024-9162; https://plugins.trac.wordpress.org/browser/all-in-one-wp-migration/trunk/lib/controller/class-ai1wm-backups-controller.php#L60; https://plugins.trac.wordpress.org/browser/all-in-one-wp-migration/trunk/lib/controller/class-ai1wm-export-controller.php#L36
CVE: CVE-2024-38821
Published: 2024-10-28
Description: Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances.

For this to impact an application, all of the following must be true:

  *  It must be a WebFlux application
  *  It must be using Spring's static resources support
  *  It must have a non-permitAll authorization rule applied to the static resources support
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-770
References: https://spring.io/security/cve-2024-38821; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-10446
Published: 2024-10-28
Description: A vulnerability classified as critical has been found in Project Worlds Online Time Table Generator 1.0. Affected is an unknown function of the file /timetable/admin/admindashboard.php?info=add_course. The manipulation of the argument c leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/jadu101/CVE/blob/main/project_worlds_online_time_table_generator_add_department_sqli.md; https://vuldb.com/?ctiid.282006; https://vuldb.com/?id.282006
CVE: CVE-2024-48074
Published: 2024-10-28
Description: An authorized RCE vulnerability exists in the DrayTek Vigor2960 router version 1.4.4, where an attacker can place a malicious command into the table parameter of the doPPPoE function in the cgi-bin/mainfunction.cgi route, and finally the command is executed by the system function.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://gist.github.com/Giles-one/6425e97dcd1ec97a722a1e20da25fad7; https://github.com/Giles-one/Vigor2960Crack
CVE: CVE-2024-50408
Published: 2024-10-28
Description: Deserialization of Untrusted Data vulnerability in Bob Namaste! LMS namaste-lms allows Object Injection.This issue affects Namaste! LMS: from n/a through <= 2.6.3.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/namaste-lms/vulnerability/wordpress-namaste-lms-plugin-2-6-3-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2024-50416
Published: 2024-10-28
Description: Deserialization of Untrusted Data vulnerability in WPClever WPC Shop as a Customer for WooCommerce wpc-shop-as-customer allows Object Injection.This issue affects WPC Shop as a Customer for WooCommerce: from n/a through <= 1.2.6.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/wpc-shop-as-customer/vulnerability/wordpress-wpc-shop-as-a-customer-for-woocommerce-plugin-1-2-6-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2024-50442
Published: 2024-10-28
Description: Improper Restriction of XML External Entity Reference vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows XML Injection.This issue affects Royal Elementor Addons: from n/a through <= 1.3.980.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611
References: https://patchstack.com/database/Wordpress/Plugin/royal-elementor-addons/vulnerability/wordpress-royal-elementor-addons-and-templates-plugin-1-3-980-xml-external-entity-xxe-vulnerability?_s_id=cve
CVE: CVE-2024-50450
Published: 2024-10-28
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter allows Code Injection.This issue affects MDTF: from n/a through <= 1.3.3.4.
CVSS Score: 7.3 (HIGH)
CWE: CWE-94
References: https://patchstack.com/database/Wordpress/Plugin/wp-meta-data-filter-and-taxonomy-filter/vulnerability/wordpress-mdtf-meta-data-and-taxonomies-filter-plugin-1-3-3-4-bypass-vulnerability-vulnerability?_s_id=cve
CVE: CVE-2024-50477
Published: 2024-10-28
Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in Stacks Stacks Mobile App Builder stacks-mobile-app-builder allows Authentication Bypass.This issue affects Stacks Mobile App Builder: from n/a through <= 5.2.3.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288, CWE-306
References: https://patchstack.com/database/Wordpress/Plugin/stacks-mobile-app-builder/vulnerability/wordpress-stacks-mobile-app-builder-plugin-5-2-3-account-takeover-vulnerability?_s_id=cve
CVE: CVE-2024-50486
Published: 2024-10-28
Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in Acnoo Acnoo Flutter API acnoo-flutter-api allows Authentication Bypass.This issue affects Acnoo Flutter API: from n/a through <= 1.0.5.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288, CWE-306
References: https://patchstack.com/database/Wordpress/Plugin/acnoo-flutter-api/vulnerability/wordpress-acnoo-flutter-api-plugin-1-0-5-account-takeover-vulnerability?_s_id=cve
CVE: CVE-2024-50487
Published: 2024-10-28
Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in Acnoo MaanStore API maanstore-api allows Authentication Bypass.This issue affects MaanStore API: from n/a through <= 1.0.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288, CWE-306
References: https://patchstack.com/database/Wordpress/Plugin/maanstore-api/vulnerability/wordpress-maanstore-api-plugin-1-0-1-account-takeover-vulnerability?_s_id=cve
CVE: CVE-2024-50489
Published: 2024-10-28
Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in realtyworkstation Realty Workstation realty-workstation allows Authentication Bypass.This issue affects Realty Workstation: from n/a through <= 1.0.45.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288, CWE-306
References: https://patchstack.com/database/Wordpress/Plugin/realty-workstation/vulnerability/wordpress-realty-workstation-plugin-1-0-45-account-takeover-vulnerability?_s_id=cve
CVE: CVE-2024-50492
Published: 2024-10-28
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Scott Paterson ScottCart scottcart allows Code Injection.This issue affects ScottCart: from n/a through <= 1.1.
CVSS Score: 8.3 (HIGH)
CWE: CWE-94
References: https://patchstack.com/database/Wordpress/Plugin/scottcart/vulnerability/wordpress-scottcart-plugin-1-1-remote-code-execution-rce-vulnerability?_s_id=cve
CVE: CVE-2024-50498
Published: 2024-10-28
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Ajit Bohra WP Query Console wp-query-console allows Code Injection.This issue affects WP Query Console: from n/a through <= 1.0.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-94
References: https://patchstack.com/database/Wordpress/Plugin/wp-query-console/vulnerability/wordpress-wp-query-console-plugin-1-0-remote-code-execution-rce-vulnerability?_s_id=cve; https://github.com/JoshuaProvoste/0-click-RCE-Exploit-for-CVE-2024-50498
CVE: CVE-2024-10447
Published: 2024-10-28
Description: A vulnerability classified as critical was found in Project Worlds Online Time Table Generator 1.0. Affected by this vulnerability is an unknown functionality of the file /timetable/staff/staffdashboard.php?info=updateprofile. The manipulation of the argument n leads to sql injection. The attack can be launched remotely.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/jadu101/CVE/blob/main/project_worlds_online_time_table_generator_update_profile_sqli.md; https://vuldb.com/?ctiid.282007; https://vuldb.com/?id.282007
CVE: CVE-2024-50463
Published: 2024-10-28
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a through <= 3.2.9.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://patchstack.com/database/Wordpress/Plugin/sunshine-photo-cart/vulnerability/wordpress-sunshine-photo-cart-plugin-3-2-9-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2024-50465
Published: 2024-10-28
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP SEO – Calin Vingan Premium SEO Pack allows SQL Injection.This issue affects Premium SEO Pack: from n/a through 1.6.001.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/premium-seo-pack/wordpress-premium-seo-pack-plugin-1-6-001-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-50470
Published: 2024-10-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themes4WP Themes4WP YouTube External Subtitles themes4wp-youtube-external-subtitles allows DOM-Based XSS.This issue affects Themes4WP YouTube External Subtitles: from n/a through <= 1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/themes4wp-youtube-external-subtitles/vulnerability/wordpress-themes4wp-youtube-external-subtitles-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-50471
Published: 2024-10-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in checklistcom Trip Plan tripplan allows DOM-Based XSS.This issue affects Trip Plan: from n/a through <= 1.0.10.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/tripplan/vulnerability/wordpress-trip-plan-plugin-1-0-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-50472
Published: 2024-10-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in martindrapeau Amilia Store amilia-store allows Stored XSS.This issue affects Amilia Store: from n/a through <= 2.9.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/amilia-store/vulnerability/wordpress-amilia-store-plugin-2-9-8-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-50478
Published: 2024-10-28
Description: Authentication Bypass by Primary Weakness vulnerability in Swoop 1-Click Login: Passwordless Authentication allows Authentication Bypass.This issue affects 1-Click Login: Passwordless Authentication: 1.4.5.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-305, CWE-287
References: https://patchstack.com/database/vulnerability/swoop-password-free-authentication/wordpress-1-click-login-passwordless-authentication-plugin-1-4-5-broken-authentication-vulnerability?_s_id=cve
CVE: CVE-2024-50479
Published: 2024-10-28
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in chenyenming Woocommerce Quote Calculator woo-quote-calculator-order allows Blind SQL Injection.This issue affects Woocommerce Quote Calculator: from n/a through <= 1.1.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/woo-quote-calculator-order/vulnerability/wordpress-woocommerce-quote-calculator-plugin-1-1-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-50483
Published: 2024-10-28
Description: Authorization Bypass Through User-Controlled Key vulnerability in Tareq Hasan Meetup meetup allows Privilege Escalation.This issue affects Meetup: from n/a through <= 0.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-639, CWE-639
References: https://patchstack.com/database/Wordpress/Plugin/meetup/vulnerability/wordpress-meetup-plugin-0-1-broken-authentication-vulnerability?_s_id=cve
CVE: CVE-2024-50488
Published: 2024-10-28
Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in yespbs Token Login token-login allows Authentication Bypass.This issue affects Token Login: from n/a through <= 1.0.3.
CVSS Score: 8.8 (HIGH)
CWE: CWE-288, CWE-306
References: https://patchstack.com/database/Wordpress/Plugin/token-login/vulnerability/wordpress-token-login-plugin-1-0-3-broken-authentication-vulnerability?_s_id=cve
CVE: CVE-2024-50491
Published: 2024-10-28
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MicahBlu RSVP ME rsvp-me allows SQL Injection.This issue affects RSVP ME: from n/a through <= 1.9.9.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/rsvp-me/vulnerability/wordpress-rsvp-me-plugin-1-9-9-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-50497
Published: 2024-10-28
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wdesco Advanced Online Ordering and Delivery Platform advanced-online-ordering-and-delivery-platform allows PHP Local File Inclusion.This issue affects Advanced Online Ordering and Delivery Platform: from n/a through <= 2.0.0.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98, CWE-829
References: https://patchstack.com/database/Wordpress/Plugin/advanced-online-ordering-and-delivery-platform/vulnerability/wordpress-advanced-online-ordering-and-delivery-platform-plugin-2-0-0-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-50501
Published: 2024-10-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Climax Themes Kata Plus kata-plus allows DOM-Based XSS.This issue affects Kata Plus: from n/a through <= 1.4.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/kata-plus/vulnerability/wordpress-kata-plus-plugin-1-4-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-50502
Published: 2024-10-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows DOM-Based XSS.This issue affects Cozy Blocks: from n/a through <= 2.0.18.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/cozy-addons/vulnerability/wordpress-cozy-blocks-plugin-2-0-18-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-50573
Published: 2024-10-28
Description: In JetBrains Hub before 2024.3.47707 improper access control allowed users to generate permanent tokens for unauthorized services
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-50574
Published: 2024-10-28
Description: In JetBrains YouTrack before 2024.3.47707 potential ReDoS exploit was possible via email header parsing in Helpdesk functionality
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1333
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-50575
Published: 2024-10-28
Description: In JetBrains YouTrack before 2024.3.47707 reflected XSS was possible in Widget API
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-50576
Published: 2024-10-28
Description: In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via vendor URL in App manifest
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-50577
Published: 2024-10-28
Description: In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via Angular template injection in Hub settings
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-50578
Published: 2024-10-28
Description: In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via sprint value on agile boards page
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-50579
Published: 2024-10-28
Description: In JetBrains YouTrack before 2024.3.47707 reflected XSS due to insecure link sanitization was possible
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-50580
Published: 2024-10-28
Description: In JetBrains YouTrack before 2024.3.47707 multiple XSS were possible due to insecure markdown parsing and custom rendering rule
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-50581
Published: 2024-10-28
Description: In JetBrains YouTrack before 2024.3.47707 improper HTML sanitization could lead to XSS attack via comment tag
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-50582
Published: 2024-10-28
Description: In JetBrains YouTrack before 2024.3.47707 stored XSS was possible due to improper HTML sanitization in markdown elements
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-8013
Published: 2024-10-28
Description: A bug in query analysis of certain complex self-referential $lookup subpipelines may result in literal values in expressions for encrypted fields to be sent to the server as plaintext instead of ciphertext. Should this occur, no documents would be returned or written. This issue affects mongocryptd binary (v5.0 versions prior to 5.0.29, v6.0 versions prior to 6.0.17, v7.0 versions prior to 7.0.12 and v7.3 versions prior to 7.3.4) and mongo_crypt_v1.so shared libraries (v6.0 versions prior to 6.0.17, v7.0 versions prior to 7.0.12 and v7.3 versions prior to 7.3.4) released alongside MongoDB Enterprise Server versions.
CVSS Score: 2.2 (LOW)
CWE: CWE-319, CWE-319
References: https://jira.mongodb.org/browse/SERVER-96254
CVE: CVE-2024-10448
Published: 2024-10-28
Description: A vulnerability, which was classified as problematic, has been found in code-projects Blood Bank Management System 1.0. Affected by this issue is some unknown functionality of the file /file/delete.php. The manipulation of the argument bid leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other endpoints might be affected as well.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://code-projects.org/; https://github.com/bevennyamande/bloodbank_delete_csrf_attack; https://vuldb.com/?ctiid.282008
CVE: CVE-2024-10455
Published: 2024-10-28
Description: Reachable Assertion in BPv7 parser in µD3TN v0.14.0 allows attacker to disrupt service via malformed Extension Block
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://gitlab.com/d3tn/ud3tn/-/issues/227
CVE: CVE-2024-34537
Published: 2024-10-28
Description: TYPO3 before 13.3.1 allows denial of service (interface error) in the Bookmark Toolbar (ext:backend), exploitable by an administrator-level backend user account via manipulated data saved in the bookmark toolbar of the backend user interface. The fixed versions are 10.4.46 ELTS, 11.5.40 LTS, 12.4.21 LTS, and 13.3.1.
CVSS Score: 4.9 (MEDIUM)
References: https://github.com/TYPO3/typo3/security/advisories/GHSA-ffcv-v6pw-qhrp; https://typo3.org/security/advisory/typo3-core-sa-2024-011; https://www.mgm-sp.com/cve/denial-of-service-in-typo3-bookmark-toolbar
CVE: CVE-2024-48191
Published: 2024-10-28
Description: dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/doAdminAction.php?act=delAdmin&id=17
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/xiaoyin0226/cms/tree/main/5/readme.md
CVE: CVE-2024-50443
Published: 2024-10-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPXPO PostX ultimate-post.This issue affects PostX: from n/a through <= 4.1.12.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ultimate-post/vulnerability/wordpress-postx-plugin-4-1-12-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-10214
Published: 2024-10-28
Description: Mattermost versions 9.11.X <= 9.11.1, 9.5.x <= 9.5.9 icorrectly issues two sessions when using desktop SSO - one in the browser and one in desktop with incorrect settings.
CVSS Score: 3.5 (LOW)
CWE: CWE-303
References: https://mattermost.com/security-updates
CVE: CVE-2024-10449
Published: 2024-10-28
Description: A vulnerability, which was classified as critical, was found in Codezips Hospital Appointment System 1.0. This affects an unknown part of the file /loginAction.php. The manipulation of the argument Username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/ppp-src/CVE/issues/25; https://vuldb.com/?ctiid.282009; https://vuldb.com/?id.282009
CVE: CVE-2024-10450
Published: 2024-10-28
Description: A vulnerability has been found in SourceCodester Kortex Lite Advocate Office Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /kortex_lite/control/edit_profile.php of the component POST Parameter Handler. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/will121351/wenqin.webray.com.cn/blob/main/CVE-project/Advocate-office-management-system.md; https://vuldb.com/?ctiid.282010; https://vuldb.com/?id.282010