deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-44756
Published: 2024-11-18
Description: NUS-M9 ERP Management Software v3.0.0 was discovered to contain a SQL injection vulnerability via the usercode parameter at /UserWH/checkLogin.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/WarmBrew/web_vul/blob/main/CVES/CVE-2024-44756.md; https://github.com/WarmBrew/web_vul/blob/main/M9ERP/M9ERP-sqli.md
CVE: CVE-2024-44757
Published: 2024-11-18
Description: An arbitrary file download vulnerability in the component /Basics/DownloadInpFile of NUS-M9 ERP Management Software v3.0.0 allows attackers to download arbitrary files and access sensitive information via a crafted interface request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: https://github.com/WarmBrew/web_vul/blob/main/CVES/CVE-2024-44757.md; https://github.com/WarmBrew/web_vul/blob/main/M9ERP/M9ERP-filedown-Basics.md
CVE: CVE-2024-47533
Published: 2024-11-18
Description: Cobbler, a Linux installation server that allows for rapid setup of network installation environments, has an improper authentication vulnerability starting in version 3.0.0 and prior to versions 3.2.3 and 3.3.7. `utils.get_shared_secret()` always returns `-1`, which allows anyone to connect to cobbler XML-RPC as user `''` password `-1` and make any changes. This gives anyone with network access to a cobbler server full control of the server. Versions 3.2.3 and 3.3.7 fix the issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://github.com/cobbler/cobbler/commit/32c5cada013dc8daa7320a8eda9932c2814742b0; https://github.com/cobbler/cobbler/commit/e19717623c10b29e7466ed4ab23515a94beb2dda; https://github.com/cobbler/cobbler/security/advisories/GHSA-m26c-fcgh-cp6h
CVE: CVE-2024-47820
Published: 2024-11-18
Description: MarkUs, a web application for the submission and grading of student assignments, is vulnerable to path traversal in versions prior to 2.4.8. Authenticated instructors may download any file on the web server MarkUs is running on, depending on the file permissions. MarkUs v2.4.8 has addressed this issue. No known workarounds are available at the application level aside from upgrading.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-22
References: https://github.com/MarkUsProject/Markus/pull/7026; https://github.com/MarkUsProject/Markus/security/advisories/GHSA-wq6v-vx8c-8fj8
CVE: CVE-2024-47873
Published: 2024-11-18
Description: PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. The XmlScanner class has a scan method which should prevent XXE attacks. However, prior to versions 1.9.4, 2.1.3, 2.3.2, and 3.4.0, the regexes used in the `scan` method and the findCharSet method can be bypassed by using UCS-4 and encoding guessing. An attacker can bypass the sanitizer and achieve an XML external entity attack. Versions 1.9.4, 2.1.3, 2.3.2, and 3.4.0 fix the issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://github.com/PHPOffice/PhpSpreadsheet/blob/39fc51309181e82593b06e2fa8e45ef8333a0335/src/PhpSpreadsheet/Reader/Security/XmlScanner.php; https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-jw4x-v69f-hh5w; https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing
CVE: CVE-2023-49952
Published: 2024-11-18
Description: Mastodon 4.1.x before 4.1.17 and 4.2.x before 4.2.9 allows a bypass of rate limiting via a crafted HTTP request header.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79
References: https://github.com/mastodon/mastodon/security; https://github.com/mastodon/mastodon/security/advisories/GHSA-c2r5-cfqr-c553
CVE: CVE-2024-48292
Published: 2024-11-18
Description: An issue in the wssrvc.exe service of QuickHeal Antivirus Pro Version v24.0 and Quick Heal Total Security v24.0 allows authenticated attackers to escalate privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-276
References: https://github.com/Nero22k/Disclosures/blob/main/QuickHealAV/CVE-2024-48292.md; https://www.quickheal.com/download-free-antivirus/
CVE: CVE-2024-48293
Published: 2024-11-18
Description: Incorrect access control in QuickHeal Antivirus Pro 24.1.0.182 and earlier allows authenticated attackers with low-level privileges to arbitrarily modify antivirus settings.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-276
References: https://github.com/Nero22k/Disclosures/blob/main/QuickHealAV/CVE-2024-48293.md; https://www.quickheal.com/download-free-antivirus/
CVE: CVE-2024-48294
Published: 2024-11-18
Description: A NULL pointer dereference in the component libPdfCore.dll of Wondershare PDF Reader v1.0.9.2544 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/Nero22k/Disclosures/tree/main/Wondershare%20PDF%20Reader; https://pdf.wondershare.com/pdf-reader.html
CVE: CVE-2024-48917
Published: 2024-11-18
Description: PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. The `XmlScanner` class has a scan method which should prevent XXE attacks. However, in a bypass of the previously reported `CVE-2024-47873`, the regexes from the `findCharSet` method, which is used for determining the current encoding can be bypassed by using a payload in the encoding UTF-7, and adding at end of the file a comment with the value `encoding="UTF-8"` with `"`, which is matched by the first regex, so that `encoding='UTF-7'` with single quotes `'` in the XML header is not matched by the second regex. An attacker can bypass the sanitizer and achieve an XML external entity attack. Versions 1.9.4, 2.1.3, 2.3.2, and 3.4.0 fix the issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://github.com/PHPOffice/PhpSpreadsheet/blob/39fc51309181e82593b06e2fa8e45ef8333a0335/src/PhpSpreadsheet/Reader/Security/XmlScanner.php; https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-7cc9-j4mv-vcjp; https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing
CVE: CVE-2024-50919
Published: 2024-11-18
Description: Jpress until v5.1.1 has arbitrary file uploads on the windows platform, and the construction of non-standard file formats such as .jsp. can lead to arbitrary command execution
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://gist.github.com/microvorld/516552dcef65acc2d1ab0fb969cd34a3; https://github.com/JPressProjects/jpress; https://github.com/microvorld/CVE-2024/blob/main/jpress.md
CVE: CVE-2024-51499
Published: 2024-11-18
Description: MarkUs is a web application for the submission and grading of student assignments. In versions prior to 2.4.8, an arbitrary file write vulnerability accessible via the update_files method of the SubmissionsController allows authenticated users (e.g. students) to write arbitrary files to any location on the web server MarkUs is running on (depending on the permissions of the underlying filesystem). e.g. This can lead to a delayed remote code execution in case an attacker is able to write a Ruby file into the config/initializers/ subfolder of the Ruby on Rails application. MarkUs v2.4.8 has addressed this issue. No known workarounds are available at the application level aside from upgrading.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/MarkUsProject/Markus/pull/7026; https://github.com/MarkUsProject/Markus/security/advisories/GHSA-j95p-7936-f75w
CVE: CVE-2024-51743
Published: 2024-11-18
Description: MarkUs is a web application for the submission and grading of student assignments. In versions prior to 2.4.8, an arbitrary file write vulnerability in the update/upload/create file methods in Controllers allows authenticated instructors to write arbitrary files to any location on the web server MarkUs is running on (depending on the permissions of the underlying filesystem). e.g. This can lead to a delayed remote code execution in case an attacker is able to write a Ruby file into the config/initializers/ subfolder of the Ruby on Rails application. MarkUs v2.4.8 has addressed this issue. No known workarounds are available at the application level aside from upgrading.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/MarkUsProject/Markus/pull/7026; https://github.com/MarkUsProject/Markus/security/advisories/GHSA-hwgg-qvjx-572x
CVE: CVE-2024-52303
Published: 2024-11-18
Description: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions starting with 3.10.6 and prior to 3.10.11, a memory leak can occur when a request produces a MatchInfoError. This was caused by adding an entry to a cache on each request, due to the building of each MatchInfoError producing a unique cache entry. An attacker may be able to exhaust the memory resources of a server by sending a substantial number (100,000s to millions) of such requests. Those who use any middlewares with aiohttp.web should upgrade to version 3.10.11 to receive a patch.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: https://github.com/aio-libs/aiohttp/commit/bc15db61615079d1b6327ba42c682f758fa96936; https://github.com/aio-libs/aiohttp/security/advisories/GHSA-27mf-ghqm-j3j8
CVE: CVE-2024-50804
Published: 2024-11-18
Description: Insecure Permissions vulnerability in Micro-star International MSI Center Pro 2.1.37.0 allows a local attacker to execute arbitrary code via the Device_DeviceID.dat.bak file within the C:\ProgramData\MSI\One Dragon Center\Data folder
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: https://g3tsyst3m.github.io/cve/msi/Arbitrary-Write-Privilege-Escalation-CVE-2024-50804/
CVE: CVE-2024-50848
Published: 2024-11-18
Description: An XML External Entity (XXE) vulnerability in the Import object and Translation Memory import functionalities of WorldServer v11.8.2 to access sensitive information and execute arbitrary commands via supplying a crafted .tmx file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611
References: https://github.com/1mhr4b/CVE-2024-50848; https://github.com/Wh1teSnak3/CVE-2024-50848; https://www.trados.com/product/worldserver/
CVE: CVE-2024-50849
Published: 2024-11-18
Description: A Stored Cross-Site Scripting (XSS) vulnerability in the "Rules" functionality of WorldServer v11.8.2 allows a remote authenticated attacker to execute arbitrary JavaScript code.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/1mhr4b/CVE-2024-50849; https://github.com/Wh1teSnak3/CVE-2024-50849; https://www.trados.com/product/worldserver/
CVE: CVE-2024-51053
Published: 2024-11-18
Description: An arbitrary file upload vulnerability in the component /main/fileupload.php of AVSCMS v8.2.0 allows attackers to execute arbitrary code via uploading a crafted file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-79
References: https://binqqer.com/posts/CVE-2024-51053/; https://vulners.com/packetstorm/PACKETSTORM:173122
CVE: CVE-2024-52304
Published: 2024-11-18
Description: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.10.11 fixes the issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-444
References: https://github.com/aio-libs/aiohttp/commit/259edc369075de63e6f3a4eaade058c62af0df71; https://github.com/aio-libs/aiohttp/security/advisories/GHSA-8495-4g3g-x7pr; https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html
CVE: CVE-2024-52506
Published: 2024-11-18
Description: Graylog is a free and open log management platform. The reporting functionality in Graylog allows the creation and scheduling of reports which contain dashboard widgets displaying individual log messages or metrics aggregated from fields of multiple log messages. This functionality, as included in Graylog 6.1.0 & 6.1.1, is vulnerable to information leakage triggered by multiple concurrent report rendering requests from authorized users. When multiple report renderings are requested at the same start time, the headless browser instance used to render the PDF will be reused. Depending on the timing, either a check for the browser instance "freshness" hits, resulting in an error instead of the report being returned, or one of the concurrent report rendering requests "wins" and this report is returned for all report rendering requests that do not return an error. This might lead to one user getting the report of a different user, potentially leaking indexed log messages or aggregated data that this user normally has no access to. This problem is fixed in Graylog 6.1.2. There is no known workaround besides disabling the reporting functionality.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-vggm-3478-vm5m; https://www.vicarius.io/vsociety/posts/cve-2024-52506-detect-graylog-vulnerability; https://www.vicarius.io/vsociety/posts/cve-2024-52506-mitigate-graylog-vulnerability
CVE: CVE-2024-52583
Published: 2024-11-18
Description: The WesHacks GitHub repository provides the official Hackathon competition website source code for the Muweilah Wesgreen Hackathon. The page `schedule.html` before 17 November 2024 or commit 93dfb83 contains links to `Leostop`, a site that hosts a malicious injected JavaScript file that occurs when bootstrap is run as well as jquery. `Leostop` may be a tracking malware and creates 2 JavaScript files, but little else is known about it. The WesHacks website remove all references to `Leostop` as of 17 November 2024.
CVSS Score: 8.2 (HIGH)
CWE: CWE-494
References: https://github.com/DefinetlyNotAI/WesHacks/commit/93dfb83cb23a8d44e81dc12424ad8a5ea05e8f96; https://github.com/DefinetlyNotAI/WesHacks/commit/ea5a4112d94bfe47beb74b8a1ba9b631d10f64f0; https://github.com/DefinetlyNotAI/WesHacks/security/advisories/GHSA-462m-5c66-4pmh
CVE: CVE-2024-52584
Published: 2024-11-18
Description: Autolab is a course management service that enables auto-graded programming assignments. There is a vulnerability in version 3.0.1 where CAs can view or edit the grade for any submission ID, even if they are not a CA for the class that has the submission. The endpoints only check that the CAs have the authorization level of a CA in the class in the endpoint, which is not necessarily the class the submission is attached to. Version 3.0.2 contains a patch. No known workarounds are available.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-863
References: https://github.com/autolab/Autolab/commit/96006d532a392eeca2d350d1811f8e8ab9625bda; https://github.com/autolab/Autolab/security/advisories/GHSA-rjg4-cf66-x6gr
CVE: CVE-2024-52585
Published: 2024-11-18
Description: Autolab is a course management service that enables auto-graded programming assignments. There is an HTML injection vulnerability in version 3.0.1 that can affect instructors and CAs on the grade submissions page. The issue is patched in version 3.0.2. One may apply the patch manually by editing line 589 on `gradesheet.js.erb` to take in feedback as text rather than html.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/autolab/Autolab/commit/2429983b6caa245fea1b37f0dc236ccbcad9554c; https://github.com/autolab/Autolab/security/advisories/GHSA-8qhp-jhhw-45r2
CVE: CVE-2024-10486
Published: 2024-11-18
Description: The Google for WooCommerce plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 2.8.6. This is due to publicly accessible print_php_information.php file. This makes it possible for unauthenticated attackers to retrieve information about Webserver and PHP configuration, which can be used to aid other attacks.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/google-listings-and-ads/tags/2.8.6/vendor/googleads/google-ads-php/scripts/print_php_information.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/64bc7d47-6b63-4fd9-85d4-82126f86308a?source=cve
CVE: CVE-2024-21287
Published: 2024-11-18
Description: Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Process Extension).   The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM Framework.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Agile PLM Framework accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS Score: 7.5 (HIGH)
CWE: CWE-863, CWE-863
References: https://www.oracle.com/security-alerts/alert-cve-2024-21287.html; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21287
CVE: CVE-2024-51051
Published: 2024-11-18
Description: AVSCMS v8.2.0 was discovered to contain weak default credentials for the Administrator account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276
References: https://binqqer.com/posts/CVE-2024-51051/; https://github.com/avscms/avscms/blob/main/include/config.local.php
CVE: CVE-2024-52341
Published: 2024-11-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Offshorent Solutions Pvt Ltd OS Our Team os-our-team allows Stored XSS.This issue affects OS Our Team: from n/a through <= 1.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/os-our-team/vulnerability/wordpress-os-our-team-plugin-1-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52342
Published: 2024-11-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Offshorent Solutions Pvt Ltd OS BXSlider os-bxslider allows Stored XSS.This issue affects OS BXSlider: from n/a through <= 2.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/os-bxslider/vulnerability/wordpress-os-bxslider-plugin-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52343
Published: 2024-11-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Offshorent Solutions Pvt Ltd OS Pricing Tables os-pricing-tables allows Stored XSS.This issue affects OS Pricing Tables: from n/a through <= 1.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/os-pricing-tables/vulnerability/wordpress-os-pricing-tables-plugin-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52344
Published: 2024-11-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codeies Pvt Ltd Provide Forex Signals provide-forex-signals allows Stored XSS.This issue affects Provide Forex Signals: from n/a through <= 1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/provide-forex-signals/vulnerability/wordpress-provide-forex-signals-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52345
Published: 2024-11-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RobertoAlicata ra_qrcode ra-qrcode allows Stored XSS.This issue affects ra_qrcode: from n/a through <= 2.1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ra-qrcode/vulnerability/wordpress-ra-qrcode-plugin-2-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52346
Published: 2024-11-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JavierMendezPWG SimpleGMaps simplegmaps allows Stored XSS.This issue affects SimpleGMaps: from n/a through <= 1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/simplegmaps/vulnerability/wordpress-simplegmaps-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52347
Published: 2024-11-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpwebsitecreator Website remote Install vor Gravity, WPForms, Formidable, Ninja, Caldera wp-website-creator allows Stored XSS.This issue affects Website remote Install vor Gravity, WPForms, Formidable, Ninja, Caldera: from n/a through <= 4.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-website-creator/vulnerability/wordpress-website-remote-install-vor-gravity-wpforms-formidable-ninja-caldera-plugin-4-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52348
Published: 2024-11-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AA Extensions AA Audio Player aa-audio-player allows DOM-Based XSS.This issue affects AA Audio Player: from n/a through <= 1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/aa-audio-player/vulnerability/wordpress-aa-audio-player-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52349
Published: 2024-11-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Md. Shiddikur Rahman Awesome Tool Tip awesome-tool-tip allows DOM-Based XSS.This issue affects Awesome Tool Tip: from n/a through <= 1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/awesome-tool-tip/vulnerability/wordpress-awesome-tool-tip-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52389
Published: 2024-11-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpjobportal WP Job Portal wp-job-portal allows Stored XSS.This issue affects WP Job Portal: from n/a through <= 2.2.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-job-portal/vulnerability/wordpress-wp-job-portal-plugin-2-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52390
Published: 2024-11-18
Description: Path Traversal: '.../...//' vulnerability in Greg Ross CYAN Backup cyan-backup allows Path Traversal.This issue affects CYAN Backup: from n/a through <= 2.5.3.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-35
References: https://patchstack.com/database/Wordpress/Plugin/cyan-backup/vulnerability/wordpress-cyan-backup-plugin-2-5-3-arbitrary-file-download-vulnerability?_s_id=cve
CVE: CVE-2024-52394
Published: 2024-11-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in verkkovaraani Print PDF Generator and Publisher nopeamedia allows Stored XSS.This issue affects Print PDF Generator and Publisher: from n/a through <= 1.1.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/nopeamedia/vulnerability/wordpress-print-pdf-generator-and-publisher-plugin-1-1-6-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52417
Published: 2024-11-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldThemes ReConstruction reconstruction allows Reflected XSS.This issue affects ReConstruction: from n/a through <= 1.4.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/reconstruction/vulnerability/wordpress-reconstruction-theme-1-4-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52418
Published: 2024-11-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CactusThemes Gameplan gameplan allows Reflected XSS.This issue affects Gameplan: from n/a through <= 1.5.10.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/gameplan/vulnerability/wordpress-gameplan-theme-1-5-10-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve