deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-24704
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in grimdonkey Magic the Gathering Card Tooltips magic-the-gathering-card-tooltips allows Stored XSS.This issue affects Magic the Gathering Card Tooltips: from n/a through <= 3.4.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/magic-the-gathering-card-tooltips/vulnerability/wordpress-magic-the-gathering-card-tooltips-plugin-3-4-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24705
Published: 2025-01-24
Description: Missing Authorization vulnerability in Arshid WooCommerce Quick View woo-quick-view allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Quick View: from n/a through <= 1.1.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/woo-quick-view/vulnerability/wordpress-woocommerce-quick-view-plugin-1-1-1-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-24706
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Stored XSS.This issue affects MultiVendorX: from n/a through <= 4.2.13.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/dc-woocommerce-multi-vendor/vulnerability/wordpress-multivendorx-plugin-4-2-13-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24709
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plethora Plugins Plethora Plugins Tabs + Accordions plethora-tabs-accordions allows Stored XSS.This issue affects Plethora Plugins Tabs + Accordions: from n/a through <= 1.1.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/plethora-tabs-accordions/vulnerability/wordpress-plethora-plugins-tabs-accordions-plugin-1-1-5-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24711
Published: 2025-01-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Popup Box popup-box allows Cross Site Request Forgery.This issue affects Popup Box: from n/a through <= 3.2.4.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/popup-box/vulnerability/wordpress-popup-box-plugin-3-2-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-24712
Published: 2025-01-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in RadiusTheme Radius Blocks radius-blocks allows Cross Site Request Forgery.This issue affects Radius Blocks: from n/a through <= 2.1.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/radius-blocks/vulnerability/wordpress-radius-blocks-wordpress-gutenberg-blocks-plugin-2-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-24713
Published: 2025-01-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Button Generator – easily Button Builder button-generation allows Cross Site Request Forgery.This issue affects Button Generator – easily Button Builder: from n/a through <= 3.1.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/button-generation/vulnerability/wordpress-button-generator-easily-button-builder-plugin-3-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-24714
Published: 2025-01-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Bubble Menu – circle floating menu bubble-menu allows Cross Site Request Forgery.This issue affects Bubble Menu – circle floating menu: from n/a through <= 4.0.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/bubble-menu/vulnerability/wordpress-bubble-menu-plugin-4-0-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-24715
Published: 2025-01-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Counter Box counter-box allows Cross Site Request Forgery.This issue affects Counter Box: from n/a through <= 2.0.5.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/counter-box/vulnerability/wordpress-counter-box-plugin-2-0-5-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-24716
Published: 2025-01-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Herd Effects mwp-herd-effect allows Cross Site Request Forgery.This issue affects Herd Effects: from n/a through <= 6.2.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/mwp-herd-effect/vulnerability/wordpress-herd-effects-plugin-6-2-1-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-24717
Published: 2025-01-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Modal Window modal-window allows Cross Site Request Forgery.This issue affects Modal Window: from n/a through <= 6.1.4.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/modal-window/vulnerability/wordpress-modal-window-plugin-6-1-4-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-24719
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevart Widget Countdown widget-countdown allows Stored XSS.This issue affects Widget Countdown: from n/a through <= 2.7.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/widget-countdown/vulnerability/wordpress-widget-countdown-plugin-2-7-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24720
Published: 2025-01-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Sticky Buttons sticky-buttons allows Cross Site Request Forgery.This issue affects Sticky Buttons: from n/a through <= 4.1.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/sticky-buttons/vulnerability/wordpress-sticky-buttons-plugin-4-1-1-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-24721
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aleksandar Urošević Easy YouTube Gallery easy-youtube-gallery allows Stored XSS.This issue affects Easy YouTube Gallery: from n/a through <= 1.0.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/easy-youtube-gallery/vulnerability/wordpress-easy-youtube-gallery-plugin-1-0-4-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24722
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro FAQ Builder AYS faq-builder-ays allows Stored XSS.This issue affects FAQ Builder AYS: from n/a through <= 1.7.3.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/faq-builder-ays/vulnerability/wordpress-faq-builder-ays-plugin-1-7-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24723
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Booking Calendar Contact Form booking-calendar-contact-form allows Stored XSS.This issue affects Booking Calendar Contact Form: from n/a through <= 1.2.55.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/booking-calendar-contact-form/vulnerability/wordpress-booking-calendar-contact-form-plugin-1-2-55-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24724
Published: 2025-01-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Side Menu Lite side-menu-lite allows Cross Site Request Forgery.This issue affects Side Menu Lite: from n/a through <= 5.3.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/side-menu-lite/vulnerability/wordpress-side-menu-lite-plugin-5-3-1-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-24725
Published: 2025-01-24
Description: Missing Authorization vulnerability in ThimPress Thim Elementor Kit thim-elementor-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Thim Elementor Kit: from n/a through <= 1.2.8.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/thim-elementor-kit/vulnerability/wordpress-thim-elementor-kit-plugin-1-2-8-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-24726
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Contact Form 7 ht-contactform allows Stored XSS.This issue affects HT Contact Form 7: from n/a through <= 1.2.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ht-contactform/vulnerability/wordpress-contact-form-7-widget-plugin-1-2-1-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24727
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Contact Form Email contact-form-to-email allows Stored XSS.This issue affects Contact Form Email: from n/a through <= 1.3.52.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/contact-form-to-email/vulnerability/wordpress-contact-form-to-email-plugin-1-3-52-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24728
Published: 2025-01-24
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yannick Lefebvre Bug Library bug-library allows Blind SQL Injection.This issue affects Bug Library: from n/a through <= 2.1.4.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/bug-library/vulnerability/wordpress-bug-library-plugin-2-1-4-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-24729
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows Stored XSS.This issue affects ElementInvader Addons for Elementor: from n/a through <= 1.3.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/elementinvader-addons-for-elementor/vulnerability/wordpress-elementinvader-addons-for-elementor-plugin-1-3-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24730
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RexTheme WP VR wpvr allows DOM-Based XSS.This issue affects WP VR: from n/a through <= 8.5.14.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wpvr/vulnerability/wordpress-wp-vr-plugin-8-5-14-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24731
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IP2Location Download IP2Location Country Blocker ip2location-country-blocker allows Stored XSS.This issue affects Download IP2Location Country Blocker: from n/a through <= 2.38.3.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ip2location-country-blocker/vulnerability/wordpress-ip2location-country-blocker-plugin-2-38-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24732
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reputeinfosystems BookingPress bookingpress-appointment-booking allows DOM-Based XSS.This issue affects BookingPress: from n/a through <= 1.1.25.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/bookingpress-appointment-booking/vulnerability/wordpress-bookingpress-plugin-1-1-25-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24733
Published: 2025-01-24
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Akhtarujjaman Shuvo Post Grid Master ajax-filter-posts allows PHP Local File Inclusion.This issue affects Post Grid Master: from n/a through <= 3.4.12.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-98, CWE-706
References: https://patchstack.com/database/Wordpress/Plugin/ajax-filter-posts/vulnerability/wordpress-post-grid-master-plugin-3-4-12-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-24736
Published: 2025-01-24
Description: Missing Authorization vulnerability in metaphorcreations Post Duplicator post-duplicator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Duplicator: from n/a through <= 2.35.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/post-duplicator/vulnerability/wordpress-post-duplicator-plugin-2-35-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-24738
Published: 2025-01-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Jerry Rietveld Call Now Button call-now-button allows Cross Site Request Forgery.This issue affects Call Now Button: from n/a through <= 1.4.13.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/call-now-button/vulnerability/wordpress-call-now-button-plugin-1-4-13-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-24739
Published: 2025-01-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Shahjahan Jewel FluentSMTP fluent-smtp allows Cross Site Request Forgery.This issue affects FluentSMTP: from n/a through <= 2.2.80.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/fluent-smtp/vulnerability/wordpress-fluentsmtp-plugin-2-2-80-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-24746
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniel Iser Popup Maker popup-maker allows Stored XSS.This issue affects Popup Maker: from n/a through <= 1.20.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/popup-maker/vulnerability/wordpress-popup-maker-plugin-1-20-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24750
Published: 2025-01-24
Description: Missing Authorization vulnerability in Syed Balkhi ExactMetrics google-analytics-dashboard-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ExactMetrics: from n/a through <= 8.1.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/google-analytics-dashboard-for-wp/vulnerability/wordpress-exactmetrics-plugin-8-1-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-24751
Published: 2025-01-24
Description: Missing Authorization vulnerability in GoDaddy CoBlocks coblocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CoBlocks: from n/a through <= 3.1.13.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/coblocks/vulnerability/wordpress-coblocks-plugin-3-1-13-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-24753
Published: 2025-01-24
Description: Missing Authorization vulnerability in StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through <= 3.3.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/kadence-blocks/vulnerability/wordpress-kadence-blocks-plugin-3-3-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-24755
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in add-ons.org PDF Invoice Builder for WooCommerce pdf-for-woocommerce allows Stored XSS.This issue affects PDF Invoice Builder for WooCommerce: from n/a through <= 4.6.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/pdf-for-woocommerce/vulnerability/wordpress-pdf-invoices-for-woocommerce-plugin-4-6-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24756
Published: 2025-01-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in mgplugin Roi Calculator roi-calculator allows Stored XSS.This issue affects Roi Calculator: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/roi-calculator/vulnerability/wordpress-roi-calculator-plugin-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52807
Published: 2025-01-24
Description: The HL7 FHIR IG publisher is a tool to take a set of inputs and create a standard FHIR IG. Prior to version 1.7.4, XSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag `( ]>` could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.publisher is being used to within a host where external clients can submit XML. A previous release provided an incomplete solution revealed by new testing. This issue has been patched as of version 1.7.4. No known workarounds are available.
CVSS Score: 8.6 (HIGH)
CWE: CWE-611
References: https://github.com/HL7/fhir-ig-publisher/commit/3560de2f486d688a3ddcf4aa54d8bdacea380c3d; https://github.com/HL7/fhir-ig-publisher/compare/1.7.3...1.7.4; https://github.com/HL7/fhir-ig-publisher/security/advisories/GHSA-8c3x-hq82-gjcm
CVE: CVE-2025-0703
Published: 2025-01-24
Description: A vulnerability, which was classified as problematic, has been found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. This issue affects some unknown processing of the file src/main/java/io/github/controller/SysFileController.java. The manipulation of the argument name leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/JoeyBling/bootplus/issues/25; https://github.com/JoeyBling/bootplus/issues/25#issue[PII_REDACTED]; https://vuldb.com/?ctiid.293231
CVE: CVE-2025-0704
Published: 2025-01-24
Description: A vulnerability, which was classified as problematic, was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. Affected is the function qrCode of the file src/main/java/io/github/controller/QrCodeController.java. The manipulation of the argument w/h leads to resource consumption. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400, CWE-404
References: https://github.com/JoeyBling/bootplus/issues/26; https://github.com/JoeyBling/bootplus/issues/26#issue[PII_REDACTED]; https://vuldb.com/?ctiid.293232
CVE: CVE-2025-0705
Published: 2025-01-24
Description: A vulnerability has been found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d and classified as problematic. Affected by this vulnerability is the function qrCode of the file src/main/java/io/github/controller/QrCodeController.java. The manipulation of the argument text leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-601
References: https://github.com/JoeyBling/bootplus/issues/27; https://github.com/JoeyBling/bootplus/issues/27#issue[PII_REDACTED]; https://vuldb.com/?ctiid.293233
CVE: CVE-2025-24363
Published: 2025-01-24
Description: The HL7 FHIR IG publisher is a tool to take a set of inputs and create a standard FHIR IG. Prior to version 1.8.9, in CI contexts, the IG Publisher CLI uses git commands to determine the URL of the originating repo. If the repo was cloned, or otherwise set to use a repo that uses a username and credential based URL, the entire URL will be included in the built Implementation Guide, exposing username and credential. This does not impact users that clone public repos without credentials, such as those using the auto-ig-build continuous integration infrastructure. This problem has been patched in release 1.8.9. Some workarounds are available. Users should ensure the IG repo they are publishing does not have username or credentials included in the `origin` URL. Running the command `git remote origin url` should return a URL that contains no username, password, or token; or users should run the IG Publisher CLI with the `-repo` parameter and specify a URL that contains no username, password, or token.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-200
References: https://github.com/HL7/fhir-ig-publisher/commit/d968694b7dd041640efab5414d7077d5028569f7; https://github.com/HL7/fhir-ig-publisher/releases/tag/1.8.9; https://github.com/HL7/fhir-ig-publisher/security/advisories/GHSA-6729-95v3-pjc2
CVE: CVE-2024-57041
Published: 2025-01-24
Description: A persistent cross-site scripting (XSS) vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code in the 'about me' section of their profile.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: http://nodebb.com; https://github.com/NodeBB/NodeBB/commit/4e69bff72fd04779064d37e46a43080e6c328adf; https://www.tonysec.com/posts/cve-2024-57041/
CVE: CVE-2024-57095
Published: 2025-01-24
Description: SQL injection vulnerability in Go-CMS v.1.1.10 allows a remote attacker to execute arbitrary code via a crafted payload.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: https://gist.github.com/wjlin0/ff3ee8afb8f8001faff89bbc03805605; https://github.com/Xi-Yuer/GO-CMS/issues/6
CVE: CVE-2024-57277
Published: 2025-01-24
Description: InnoShop V.0.3.8 and below is vulnerable to Cross Site Scripting (XSS) via SVG file upload.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-79
References: https://github.com/innocommerce/innoshop/commit/7ccc90d2b549e14460efc4f758b01adbd080e7ff; https://github.com/innocommerce/innoshop/issues/115; https://github.com/yamerooo123/ResearchNBugBountyEncyclopedia/blob/main/Researches/Innocommerce/Findings.md
CVE: CVE-2025-0706
Published: 2025-01-24
Description: A vulnerability was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/sys/admin.html. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/JoeyBling/bootplus/issues/28; https://github.com/JoeyBling/bootplus/issues/28#issue[PII_REDACTED]; https://vuldb.com/?ctiid.293234