deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-8166
Published: 2024-08-26
Description: A vulnerability has been found in Ruijie EG2000K 11.1(6)B2 and classified as critical. This vulnerability affects unknown code of the file /tool/index.php?c=download&a=save. The manipulation of the argument content leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-434
References: https://github.com/qiuhuihk/cve/blob/main/ruijie.md; https://vuldb.com/?ctiid.275764; https://vuldb.com/?id.275764
CVE: CVE-2024-8167
Published: 2024-08-26
Description: A vulnerability was found in code-projects Job Portal 1.0. It has been classified as critical. Affected is an unknown function of the file /forget.php. The manipulation of the argument email/mobile leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/t4rrega/cve/issues/1; https://vuldb.com/?ctiid.275766
CVE: CVE-2024-8168
Published: 2024-08-26
Description: A vulnerability was found in code-projects Online Bus Reservation Site 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file login.php. The manipulation of the argument Username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://code-projects.org/; https://github.com/t4rrega/cve/issues/2; https://vuldb.com/?ctiid.275767
CVE: CVE-2024-8169
Published: 2024-08-26
Description: A vulnerability was found in code-projects Online Quiz Site 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file signupuser.php. The manipulation of the argument lid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://code-projects.org/; https://github.com/t4rrega/cve/issues/5; https://vuldb.com/?ctiid.275768
CVE: CVE-2024-34087
Published: 2024-08-26
Description: An SEH-based buffer overflow in the BPQ32 HTTP Server in BPQ32 6.0.24.1 allows remote attackers with access to the Web Terminal to achieve remote code execution via an HTTP POST /TermInput request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://groups.io/g/bpq32; https://themodernham.com/bbs-hacking-discovering-rce-within-bpq32-seh-based-buffer-overflow/; https://www.cantab.net/users/john.wiseman/Documents/
CVE: CVE-2024-41285
Published: 2024-08-26
Description: A stack overflow in FAST FW300R v1.3.13 Build 141023 Rel.61347n allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via a crafted file path.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-120
References: https://gist.github.com/Giles-one/834b2becd7abebc3cabea0484301d149; https://github.com/Giles-one/FW300RouterCrack/; https://www.fastcom.com.cn/product-8.html
CVE: CVE-2024-42788
Published: 2024-08-26
Description: A Stored Cross Site Scripting (XSS) vulnerability was found in "/music/ajax.php?action=save_music" in Kashipara Music Management System v1.0. This vulnerability allows remote attackers to execute arbitrary code via "title" & "artist" parameter fields.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/Stored%20XSS%20-%20Add%20New%20Music%20List.pdf; https://www.kashipara.com/project/php/12978/music-management-system-in-php-php-project-source-code
CVE: CVE-2024-42791
Published: 2024-08-26
Description: A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Music Management System v1.0 via /music/ajax.php?action=delete_genre.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/CSRF%20-%20Delete%20Genre.pdf; https://www.kashipara.com/project/php/12978/music-management-system-in-php-php-project-source-code
CVE: CVE-2024-42816
Published: 2024-08-26
Description: A cross-site scripting (XSS) vulnerability in the Create Product function of fastapi-admin pro v0.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Name parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://fastapi-admin-pro.long2ice.io/admin/login; https://github.com/fastapi-admin/fastapi-admin/issues/172
CVE: CVE-2024-42818
Published: 2024-08-26
Description: A cross-site scripting (XSS) vulnerability in the Config-Create function of fastapi-admin pro v0.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Name parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://fastapi-admin-pro.long2ice.io/admin/login; https://github.com/fastapi-admin/fastapi-admin/issues/172
CVE: CVE-2024-43283
Published: 2024-08-26
Description: Insertion of Sensitive Information Into Sent Data vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery.This issue affects Contest Gallery: from n/a through <= 23.1.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-201
References: https://patchstack.com/database/Wordpress/Plugin/contest-gallery/vulnerability/wordpress-contest-gallery-plugin-23-1-2-unauthenticated-comment-userid-and-ip-address-disclosure-vulnerability?_s_id=cve
CVE: CVE-2024-43289
Published: 2024-08-26
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in gVectors Team wpForo Forum.This issue affects wpForo Forum: from n/a through 2.3.4.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://patchstack.com/database/vulnerability/wpforo/wordpress-wpforo-forum-plugin-2-3-4-unauthenticated-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2024-43319
Published: 2024-08-26
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in bPlugins LLC Flash & HTML5 Video.This issue affects Flash & HTML5 Video: from n/a through 2.5.31.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://patchstack.com/database/vulnerability/html5-video-player/wordpress-html5-video-player-plugin-2-5-31-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2024-43967
Published: 2024-08-26
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Stark Digital WP Testimonial Widget allows Stored XSS.This issue affects WP Testimonial Widget: from n/a through 3.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-testimonial-widget/wordpress-wp-testimonial-widget-plugin-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-44549
Published: 2024-08-26
Description: Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function formGetIptv.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-121
References: https://detailed-stetson-767.notion.site/Tenda-AX1806-Buffer-Overflow-in-formGetIptv-74cd[PII_REDACTED]729bae905996ae8902?pvs=4
CVE: CVE-2024-44550
Published: 2024-08-26
Description: Tenda AX1806 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function formGetIptv.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-121
References: https://detailed-stetson-767.notion.site/Tenda-AX1806-Buffer-Overflow-in-formGetIptv-74cd[PII_REDACTED]729bae905996ae8902?pvs=4
CVE: CVE-2024-44551
Published: 2024-08-26
Description: Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function formGetIptv.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-121
References: https://detailed-stetson-767.notion.site/Tenda-AX1806-Buffer-Overflow-in-formGetIptv-74cd[PII_REDACTED]729bae905996ae8902?pvs=4
CVE: CVE-2024-44552
Published: 2024-08-26
Description: Tenda AX1806 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function formGetIptv.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://detailed-stetson-767.notion.site/Tenda-AX1806-Buffer-Overflow-in-formGetIptv-74cd[PII_REDACTED]729bae905996ae8902?pvs=4
CVE: CVE-2024-44553
Published: 2024-08-26
Description: Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function formGetIptv.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-121
References: https://detailed-stetson-767.notion.site/Tenda-AX1806-Buffer-Overflow-in-formGetIptv-74cd[PII_REDACTED]729bae905996ae8902?pvs=4
CVE: CVE-2024-44555
Published: 2024-08-26
Description: Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function setIptvInfo.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-120
References: https://detailed-stetson-767.notion.site/Tenda-AX1806-Buffer-Overflow-in-setIptvInfo-5aee8fa8b7754d319ee35027d3628f2e?pvs=4
CVE: CVE-2024-44557
Published: 2024-08-26
Description: Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function setIptvInfo.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-121
References: https://detailed-stetson-767.notion.site/Tenda-AX1806-Buffer-Overflow-in-setIptvInfo-5aee8fa8b7754d319ee35027d3628f2e?pvs=4
CVE: CVE-2024-8170
Published: 2024-08-26
Description: A vulnerability classified as problematic has been found in SourceCodester Zipped Folder Manager App 1.0. This affects an unknown part of the file /endpoint/add-folder.php. The manipulation of the argument folder leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-434
References: https://github.com/jadu101/CVE/blob/main/SourceCodester_Zipped_Folder_Manager_App_File_Upload.md; https://vuldb.com/?ctiid.275769; https://vuldb.com/?id.275769
CVE: CVE-2024-8171
Published: 2024-08-26
Description: A vulnerability classified as critical was found in itsourcecode Tailoring Management System 1.0. This vulnerability affects unknown code of the file staffcatedit.php. The manipulation of the argument title leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/t4rrega/cve/issues/6; https://itsourcecode.com/; https://vuldb.com/?ctiid.275770
CVE: CVE-2024-8172
Published: 2024-08-26
Description: A vulnerability, which was classified as problematic, has been found in SourceCodester QR Code Attendance System 1.0. This issue affects some unknown processing of the file /endpoint/delete-student.php. The manipulation of the argument student/attendance leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/jadu101/CVE/blob/main/SourceCodester_QR_Code_Attendance_System_delete_attendance_XSS.md; https://github.com/jadu101/CVE/blob/main/SourceCodester_QR_Code_Attendance_System_delete_student_XSS.md; https://vuldb.com/?ctiid.275771
CVE: CVE-2024-8173
Published: 2024-08-26
Description: A vulnerability, which was classified as critical, was found in code-projects Blood Bank System 1.0. Affected is an unknown function of the file /login.php of the component Login Page. The manipulation of the argument user leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://code-projects.org/; https://github.com/prankfulin/cve/blob/main/sql1.md; https://vuldb.com/?ctiid.275772
CVE: CVE-2024-41444
Published: 2024-08-26
Description: SeaCMS v12.9 has a SQL injection vulnerability in the key parameter of /js/player/dmplayer/dmku/index.php?ac=so.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://gist.github.com/looppppp/fa328c81ce19c1097d10f95c763d0d50; https://github.com/seacms-net/CMS; https://www.seacms.net/p-549
CVE: CVE-2024-42790
Published: 2024-08-26
Description: A Reflected Cross Site Scripting (XSS) vulnerability was found in "/music/index.php?page=test" in Kashipara Music Management System v1.0. This vulnerability allows remote attackers to execute arbitrary code via the "page" parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/Reflected%20XSS%20-%20index.pdf; https://www.kashipara.com/project/php/12978/music-management-system-in-php-php-project-source-code
CVE: CVE-2024-42792
Published: 2024-08-26
Description: A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Music Management System v1.0 via /music/ajax.php?action=delete_playlist page.
CVSS Score: 3.5 (LOW)
CWE: CWE-352, CWE-352
References: https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/CSRF%20-%20Delete%20Playlist.pdf; https://www.kashipara.com/project/php/12978/music-management-system-in-php-php-project-source-code
CVE: CVE-2024-7401
Published: 2024-08-26
Description: Netskope was notified about a security gap in Netskope Client enrollment process where NSClient is using a static token “Orgkey” as authentication parameter. Since this is a static token, if leaked, cannot be rotated or revoked. A malicious actor can use this token to enroll NSClient from a customer’s tenant and impersonate a user.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287, CWE-287
References: https://docs.netskope.com/en/secure-enrollment/; https://quickskope.com/; https://www.netskope.com/company/security-compliance-and-assurance/security-advisories-and-disclosures/netskope-security-advisory-nskpsa-2024-001
CVE: CVE-2024-8174
Published: 2024-08-26
Description: A vulnerability has been found in code-projects Blood Bank System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /login.php of the component Login Page. The manipulation of the argument user leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://code-projects.org/; https://github.com/prankfulin/cve/blob/main/xss.md; https://vuldb.com/?ctiid.275773
CVE: CVE-2024-42913
Published: 2024-08-26
Description: RuoYi CMS v4.7.9 was discovered to contain a SQL injection vulnerability via the job_id parameter at /sasfs1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/kkll5875
CVE: CVE-2024-45265
Published: 2024-08-26
Description: A SQL injection vulnerability in the poll component in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to execute arbitrary SQL commands via the psid parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-79
References: https://github.com/TheHermione/CVE-2024-45265; https://skyss.ru
CVE: CVE-2024-43802
Published: 2024-08-26
Description: Vim is an improved version of the unix vi text editor. When flushing the typeahead buffer, Vim moves the current position in the typeahead buffer but does not check whether there is enough space left in the buffer to handle the next characters.  So this may lead to the tb_off position within the typebuf variable to point outside of the valid buffer size, which can then later lead to a heap-buffer overflow in e.g. ins_typebuf(). Therefore, when flushing the typeahead buffer, check if there is enough space left before advancing the off position. If not, fall back to flush current typebuf contents. It's not quite clear yet, what can lead to this situation. It seems to happen when error messages occur (which will cause Vim to flush the typeahead buffer) in comnination with several long mappgins and so it may eventually move the off position out of a valid buffer size. Impact is low since it is not easily reproducible and requires to have several mappings active and run into some error condition. But when this happens, this will cause a crash. The issue has been fixed as of Vim patch v9.1.0697. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-122
References: https://github.com/vim/vim/commit/322ba9108612bead5eb; https://github.com/vim/vim/security/advisories/GHSA-4ghr-c62x-cqfh; https://lists.debian.org/debian-lts-announce/2025/03/msg00023.html
CVE: CVE-2024-43806
Published: 2024-08-26
Description: Rustix is a set of safe Rust bindings to POSIX-ish APIs. When using `rustix::fs::Dir` using the `linux_raw` backend, it's possible for the iterator to "get stuck" when an IO error is encountered. Combined with a memory over-allocation issue in `rustix::fs::Dir::read_more`, this can cause quick and unbounded memory explosion (gigabytes in a few seconds if used on a hot path) and eventually lead to an OOM crash of the application. The symptoms were initially discovered in https://github.com/imsnif/bandwhich/issues/284. That post has lots of details of our investigation. Full details can be read on the GHSA-c827-hfw6-qwvm repo advisory. If a program tries to access a directory with its file descriptor after the file has been unlinked (or any other action that leaves the `Dir` iterator in the stuck state), and the implementation does not break after seeing an error, it can cause a memory explosion. As an example, Linux's various virtual file systems (e.g. `/proc`, `/sys`) can contain directories that spontaneously pop in and out of existence. Attempting to iterate over them using `rustix::fs::Dir` directly or indirectly (e.g. with the `procfs` crate) can trigger this fault condition if the implementation decides to continue on errors. An attacker knowledgeable about the implementation details of a vulnerable target can therefore try to trigger this fault condition via any one or a combination of several available APIs. If successful, the application host will quickly run out of memory, after which the application will likely be terminated by an OOM killer, leading to denial of service. This issue has been addressed in release versions 0.35.15, 0.36.16, 0.37.25, and 0.38.19. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://github.com/bytecodealliance/rustix/security/advisories/GHSA-c827-hfw6-qwvm; https://github.com/imsnif/bandwhich/issues/284
CVE: CVE-2024-28077
Published: 2024-08-26
Description: A denial-of-service issue was discovered on certain GL-iNet devices. Some websites can detect devices exposed to the external network through DDNS, and consequently obtain the IP addresses and ports of devices that are exposed. By using special usernames and special characters (such as half parentheses or square brackets), one can call the login interface and cause the session-management program to crash, resulting in customers being unable to log into their devices. This affects MT6000 4.5.6, XE3000 4.4.5, X3000 4.4.6, MT3000 4.5.0, MT2500 4.5.0, AXT1800 4.5.0, AX1800 4.5.0, A1300 4.5.0, S200 4.1.4-0300, X750 4.3.7, SFT1200 4.3.7, MT1300 4.3.10, AR750 4.3.10, AR750S 4.3.10, AR300M 4.3.10, AR300M16 4.3.10, B1300 4.3.10, MT300N-V2 4.3.10, and XE300 4.3.16.
CVSS Score: 7.5 (HIGH)
References: https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Denial%20of%20service.md; https://gl-inet.com
CVE: CVE-2024-42906
Published: 2024-08-26
Description: TestLink before v.1.9.20 is vulnerable to Cross Site Scripting (XSS) via the pop-up on upload file. When uploading a file, the XSS payload can be entered into the file name.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/Alkatraz97/CVEs/blob/main/CVE-2024-42906.md; https://testlink.org/
CVE: CVE-2024-44793
Published: 2024-08-26
Description: A cross-site scripting (XSS) vulnerability in the component /managers/multiple_freeleech.php of Gazelle commit 63b3370 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the torrents parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://gazelle.com; https://github.com/WhatCD/Gazelle; https://github.com/WhatCD/Gazelle/issues/131
CVE: CVE-2024-44794
Published: 2024-08-26
Description: A cross-site scripting (XSS) vulnerability in the component /master/auth/OnedriveRedirect.php of PicUploader commit fcf82ea allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the error_description parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://picuploader.com; https://github.com/xiebruce/PicUploader; https://github.com/xiebruce/PicUploader/issues/91
CVE: CVE-2024-44795
Published: 2024-08-26
Description: A cross-site scripting (XSS) vulnerability in the component /login/disabled.php of Gazelle commit 63b3370 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://gazelle.com; https://github.com/WhatCD/Gazelle; https://github.com/WhatCD/Gazelle/issues/129
CVE: CVE-2024-44796
Published: 2024-08-26
Description: A cross-site scripting (XSS) vulnerability in the component /auth/AzureRedirect.php of PicUploader commit fcf82ea allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the error_description parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://picuploader.com; https://github.com/xiebruce/PicUploader; https://github.com/xiebruce/PicUploader/issues/90
CVE: CVE-2024-44797
Published: 2024-08-26
Description: A cross-site scripting (XSS) vulnerability in the component /managers/enable_requests.php of Gazelle commit 63b3370 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the view parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://gazelle.com; https://github.com/WhatCD/Gazelle; https://github.com/WhatCD/Gazelle/issues/130
CVE: CVE-2024-8105
Published: 2024-08-26
Description: A vulnerability related to the use an insecure Platform Key (PK) has been discovered. An attacker with the compromised PK private key can create malicious UEFI software that is signed with a trusted key that has been compromised.
CVSS Score: 6.4 (MEDIUM)
References: https://github.com/binarly-io/Vulnerability-REsearch/blob/main/PKfail/BRLY-2024-005.md; https://kb.cert.org/vuls/id/455367; https://security.ts.fujitsu.com/ProductSecurity/content/Fujitsu-PSIRT-FJ-ISS-2024-072412-Security-Notice.pdf
CVE: CVE-2024-8188
Published: 2024-08-26
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-39628
Published: 2024-08-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in Saturday Drive Ninja Forms allows Cross Site Request Forgery.This issue affects Ninja Forms: from n/a through 3.8.6.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/ninja-forms/wordpress-ninja-forms-plugin-3-8-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-39641
Published: 2024-08-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in ThimPress LearnPress.This issue affects LearnPress: from n/a through 4.2.6.8.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/learnpress/wordpress-learnpress-plugin-4-2-6-8-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-39645
Published: 2024-08-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.7.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/tutor/wordpress-tutor-lms-plugin-2-7-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve