deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-35085
Published: 2024-05-23
Description: J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in ProcessDefinitionMapper.xml.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-89
References: https://github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/main/cxcxcxcxcxc/about-2024/35085.txt; https://www.j2eefast.com/; https://github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/main/cxcxcxcxcxc/about-2024/35085.txt
CVE: CVE-2024-35086
Published: 2024-05-23
Description: J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in BpmTaskFromMapper.xml .
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/main/cxcxcxcxcxc/about-2024/35086.txt; https://www.j2eefast.com/; https://github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/main/cxcxcxcxcxc/about-2024/35086.txt
CVE: CVE-2024-35090
Published: 2024-05-23
Description: J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysUreportFileMapper.xml.
CVSS Score: 8.2 (HIGH)
CWE: CWE-89
References: https://github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/main/cxcxcxcxcxc/about-2024/35090.txt; https://www.j2eefast.com/; https://github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/main/cxcxcxcxcxc/about-2024/35090.txt
CVE: CVE-2024-35091
Published: 2024-05-23
Description: J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysTenantMapper.xml.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/main/cxcxcxcxcxc/about-2024/35091.txt; https://www.j2eefast.com/; https://github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/main/cxcxcxcxcxc/about-2024/35091.txt
CVE: CVE-2024-4365
Published: 2024-05-23
Description: The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘add_iframe_url_as_param_direct’ parameter in versions up to, and including, 2024.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/advanced-iframe/trunk/includes/advanced-iframe-main-after-iframe.php#L30; https://plugins.trac.wordpress.org/changeset/3090438/; https://www.wordfence.com/threat-intel/vulnerabilities/id/21990e54-c3a2-4bca-b164-132ad456e651?source=cve
CVE: CVE-2024-5143
Published: 2024-05-23
Description: A user with device administrative privileges can change existing SMTP server settings on the device, without having to re-enter SMTP server credentials.  By redirecting send-to-email traffic to the new server, the original SMTP server credentials may potentially be exposed.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-306
References: https://support.hp.com/us-en/document/ish_10[PII_REDACTED]3841-16/HPSBPI03941; https://support.hp.com/us-en/document/ish_10[PII_REDACTED]3841-16/HPSBPI03941
CVE: CVE-2024-31843
Published: 2024-05-23
Description: An issue was discovered in Italtel Embrace 1.6.4. The Web application does not properly check the parameters sent as input before they are processed on the server side. This allows authenticated users to execute commands on the Operating System.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-78
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2024-35079
Published: 2024-05-23
Description: An arbitrary file upload vulnerability in the uploadAudio method of inxedu v2024.4 allows attackers to execute arbitrary code via uploading a crafted .jsp file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/main/cxcxcxcxcxc/about-2024/35079.txt; https://www.inxedu.com/; https://github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/main/cxcxcxcxcxc/about-2024/35079.txt
CVE: CVE-2024-35080
Published: 2024-05-23
Description: An arbitrary file upload vulnerability in the gok4 method of inxedu v2024.4 allows attackers to execute arbitrary code via uploading a crafted .jsp file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/main/cxcxcxcxcxc/about-2024/35080.txt; https://www.inxedu.com/; https://github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/main/cxcxcxcxcxc/about-2024/35080.txt
CVE: CVE-2024-35375
Published: 2024-05-23
Description: There is an arbitrary file upload vulnerability on the media add .php page in the backend of the website in version 5.7.114 of DedeCMS
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://shtaoism.com/; https://gist.github.com/Tsq741/a16015209fa8728d505c4f82b4f518cd; http://shtaoism.com/
CVE: CVE-2024-35570
Published: 2024-05-23
Description: An arbitrary file upload vulnerability in the component \controller\ImageUploadController.class of inxedu v2.0.6 allows attackers to execute arbitrary code via uploading a crafted jsp file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/KakeruJ/CVE/; https://github.com/KakeruJ/CVE/
CVE: CVE-2024-5201
Published: 2024-05-23
Description: Privilege Escalation in OpenText Dimensions RM allows an authenticated user to escalate there privilege to the privilege of another user via HTTP Request
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://portal.microfocus.com/s/article/KM000029985; https://portal.microfocus.com/s/article/KM000029985
CVE: CVE-2024-5202
Published: 2024-05-23
Description: Arbitrary File Read in OpenText Dimensions RM allows authenticated users to read files stored on the server via webservices
CVSS Score: 7.7 (HIGH)
CWE: CWE-200
References: https://portal.microfocus.com/s/article/KM000029988; https://portal.microfocus.com/s/article/KM000029988
CVE: CVE-2024-5227
Published: 2024-05-23
Description: TP-Link Omada ER605 PPTP VPN username Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. Authentication is not required to exploit this vulnerability. However, devices are only vulnerable if configured to use a PPTP VPN with LDAP authentication.

The specific flaw exists within the handling of the username parameter provided to the /usr/bin/pppd endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-22446.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-24-499/; https://www.zerodayinitiative.com/advisories/ZDI-24-499/
CVE: CVE-2024-5228
Published: 2024-05-23
Description: TP-Link Omada ER605  Comexe DDNS Response Handling Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. Authentication is not required to exploit this vulnerability. However, devices are vulnerable only if configured to use the Comexe DDNS service.

The specific flaw exists within the handling of DNS responses. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-22383.
CVSS Score: 7.5 (HIGH)
CWE: CWE-122
References: https://www.zerodayinitiative.com/advisories/ZDI-24-500/; https://www.zerodayinitiative.com/advisories/ZDI-24-500/
CVE: CVE-2024-5242
Published: 2024-05-23
Description: TP-Link Omada ER605 Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. Authentication is not required to exploit this vulnerability. However, devices are vulnerable only if configured to use the Comexe DDNS service.

The specific flaw exists within the handling of DDNS error codes. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-22522.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://www.zerodayinitiative.com/advisories/ZDI-24-501/; https://www.zerodayinitiative.com/advisories/ZDI-24-501/
CVE: CVE-2024-5243
Published: 2024-05-23
Description: TP-Link Omada ER605 Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. Authentication is not required to exploit this vulnerability. However, devices are vulnerable only if configured to use the Comexe DDNS service.

The specific flaw exists within the handling of DNS names. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-22523.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://www.zerodayinitiative.com/advisories/ZDI-24-502/; https://www.zerodayinitiative.com/advisories/ZDI-24-502/
CVE: CVE-2024-5244
Published: 2024-05-23
Description: TP-Link Omada ER605 Reliance on Security Through Obscurity Vulnerability. This vulnerability allows network-adjacent attackers to access or spoof DDNS messages on affected installations of TP-Link Omada ER605 routers. Authentication is not required to exploit this vulnerability. However, devices are vulnerable only if configured to use the Comexe DDNS service.

The specific flaw exists within the cmxddnsd executable. The issue results from reliance on obscurity to secure network data. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-22439.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-656
References: https://www.zerodayinitiative.com/advisories/ZDI-24-503/; https://www.zerodayinitiative.com/advisories/ZDI-24-503/
CVE: CVE-2024-5245
Published: 2024-05-23
Description: NETGEAR ProSAFE Network Management System Default Credentials Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NETGEAR ProSAFE Network Management System. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the product installer. The issue results from the use of default MySQL credentials. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22755.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1392
References: https://kb.netgear.com/000066164/Security-Advisory-for-Multiple-Vulnerabilities-on-the-NMS300-PSV-2024-0003-PSV-2024-0004; https://www.zerodayinitiative.com/advisories/ZDI-24-496/; https://kb.netgear.com/000066164/Security-Advisory-for-Multiple-Vulnerabilities-on-the-NMS300-PSV-2024-0003-PSV-2024-0004
CVE: CVE-2024-5246
Published: 2024-05-23
Description: NETGEAR ProSAFE Network Management System Tomcat Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Authentication is required to exploit this vulnerability.

The specific flaw exists within the product installer. The issue results from the use of a vulnerable version of Apache Tomcat. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-22868.
CVSS Score: 8.8 (HIGH)
References: https://kb.netgear.com/000066164/Security-Advisory-for-Multiple-Vulnerabilities-on-the-NMS300-PSV-2024-0003-PSV-2024-0004; https://www.zerodayinitiative.com/advisories/ZDI-24-497/; https://kb.netgear.com/000066164/Security-Advisory-for-Multiple-Vulnerabilities-on-the-NMS300-PSV-2024-0003-PSV-2024-0004
CVE: CVE-2024-5247
Published: 2024-05-23
Description: NETGEAR ProSAFE Network Management System UpLoadServlet Unrestricted File Upload Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Authentication is required to exploit this vulnerability.

The specific flaw exists within the UpLoadServlet class. The issue results from the lack of proper validation of user-supplied data, which can allow the upload of arbitrary files. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-22923.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://kb.netgear.com/000066165/Security-Advisory-for-Missing-Function-Level-Access-Control-on-the-NMS300-PSV-2024-0005; https://www.zerodayinitiative.com/advisories/ZDI-24-498/; https://kb.netgear.com/000066165/Security-Advisory-for-Missing-Function-Level-Access-Control-on-the-NMS300-PSV-2024-0005
CVE: CVE-2024-5291
Published: 2024-05-23
Description: D-Link DIR-2150 GetDeviceSettings Target Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2150 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the SOAP API interface, which listens on TCP port 80 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21235.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-24-442/; https://www.zerodayinitiative.com/advisories/ZDI-24-442/
CVE: CVE-2024-5292
Published: 2024-05-23
Description: D-Link Network Assistant Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of D-Link Network Assistant. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the DNACore service. The service loads a file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-21426.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://www.zerodayinitiative.com/advisories/ZDI-24-443/; https://www.zerodayinitiative.com/advisories/ZDI-24-443/
CVE: CVE-2024-5293
Published: 2024-05-23
Description: D-Link DIR-2640 HTTP Referer Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2640-US routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within prog.cgi, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21853.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://www.zerodayinitiative.com/advisories/ZDI-24-444/; https://www.zerodayinitiative.com/advisories/ZDI-24-444/
CVE: CVE-2024-5294
Published: 2024-05-23
Description: D-Link DIR-3040 prog.cgi websSecurityHandler Memory Leak Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of D-Link DIR-3040 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the prog.cgi program, which handles HNAP requests made to the lighttpd webserver listening on ports 80 and 443. The issue results from the lack of proper memory management when processing HTTP cookie values. An attacker can leverage this vulnerability to create a denial-of-service condition on the system.
. Was ZDI-CAN-21668.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: https://www.zerodayinitiative.com/advisories/ZDI-24-445/; https://www.zerodayinitiative.com/advisories/ZDI-24-445/
CVE: CVE-2024-5295
Published: 2024-05-23
Description: D-Link G416 flupl self Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 wireless routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the HTTP service listening on TCP port 80. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21294.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-24-446/; https://www.zerodayinitiative.com/advisories/ZDI-24-446/
CVE: CVE-2024-5296
Published: 2024-05-23
Description: D-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of D-Link D-View. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the TokenUtils class. The issue results from a hard-coded cryptographic key. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-21991.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-321
References: https://www.zerodayinitiative.com/advisories/ZDI-24-447/; https://www.zerodayinitiative.com/advisories/ZDI-24-447/
CVE: CVE-2024-5297
Published: 2024-05-23
Description: D-Link D-View executeWmicCmd Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of D-Link D-View. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the executeWmicCmd method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21821.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-24-448/; https://www.zerodayinitiative.com/advisories/ZDI-24-448/
CVE: CVE-2024-5298
Published: 2024-05-23
Description: D-Link D-View queryDeviceCustomMonitorResult Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of D-Link D-View. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the queryDeviceCustomMonitorResult method. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21842.
CVSS Score: 8.8 (HIGH)
CWE: CWE-749
References: https://www.zerodayinitiative.com/advisories/ZDI-24-449/; https://www.zerodayinitiative.com/advisories/ZDI-24-449/
CVE: CVE-2024-5299
Published: 2024-05-23
Description: D-Link D-View execMonitorScript Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of D-Link D-View. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the execMonitorScript method. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21828.
CVSS Score: 8.8 (HIGH)
CWE: CWE-749
References: https://www.zerodayinitiative.com/advisories/ZDI-24-450/; https://www.zerodayinitiative.com/advisories/ZDI-24-450/
CVE: CVE-2024-5279
Published: 2024-05-23
Description: A vulnerability was found in Qiwen Netdisk up to 1.4.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component File Rename Handler. The manipulation with the input <img src="" onerror="alert(document.cookie)"> leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-266083.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://gitee.com/qiwen-cloud/qiwen-file/issues/I8W3H2; https://vuldb.com/?ctiid.266083; https://vuldb.com/?id.266083
CVE: CVE-2024-4409
Published: 2024-05-24
Description: The WP-ViperGB plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.1. This is due to missing or incorrect nonce validation when saving plugin settings. This makes it possible for unauthenticated attackers to change the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3091230%40wp-vipergb%2Ftrunk&old=2812759%40wp-vipergb%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/e86581bd-94c3-4b05-9590-ca3b62073703?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3091230%40wp-vipergb%2Ftrunk&old=2812759%40wp-vipergb%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2024-5205
Published: 2024-05-24
Description: The Videojs HTML5 Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's videojs_video shortcode in all versions up to, and including, 1.1.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/videojs-html5-player/trunk/videojs-html5-player.php#L258; https://plugins.trac.wordpress.org/changeset/3091226/#file1; https://wordpress.org/plugins/videojs-html5-player/#developers
CVE: CVE-2024-4544
Published: 2024-05-24
Description: The Pie Register - Social Sites Login (Add on) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.7. This is due to insufficient verification on the user being supplied during a social login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://plugins.trac.wordpress.org/browser/pie-register/tags/3.8.3.3/pie-register.php#L2959; https://www.wordfence.com/threat-intel/vulnerabilities/id/b98179c3-8b32-4d75-9f3f-2367215a740b?source=cve; https://plugins.trac.wordpress.org/browser/pie-register/tags/3.8.3.3/pie-register.php#L2959