deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-47828
Published: 2024-10-09
Description: ampache is a web based audio/video streaming application and file manager. A CSRF attack can be performed in order to delete objects (Playlist, smartlist etc.). Cross-Site Request Forgery (CSRF) is an attack that forces authenticated users to submit a request to a Web application against which they are currently authenticated. This vulnerability can be exploited by creating a malicious script with an arbitrary playlist ID belonging to another user. When the user submits the request, their playlist will be deleted. Any User with active sessions who are tricked into submitting a malicious request are impacted, as their playlists or other objects could be deleted without their consent.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/ampache/ampache/security/advisories/GHSA-p9cq-2qph-55f2
CVE: CVE-2024-47832
Published: 2024-10-09
Description: ssoready is a single sign on provider implemented via docker. Affected versions are vulnerable to XML signature bypass attacks. An attacker can carry out signature bypass if you have access to certain IDP-signed messages. The underlying mechanism exploits differential behavior between XML parsers. Users of https://ssoready.com, the public hosted instance of SSOReady, are unaffected. We advise folks who self-host SSOReady to upgrade to 7f92a06 or later. Do so by updating your SSOReady Docker images from sha-... to sha-7f92a06. There are no known workarounds for this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-347
References: https://github.com/ssoready/ssoready/commit/7f92a[PII_REDACTED]fcbefa8c7eafe8c144bd89915; https://github.com/ssoready/ssoready/security/advisories/GHSA-j2hr-q93x-gxvh; https://ssoready.com/docs/self-hosting/self-hosting-sso-ready
CVE: CVE-2024-47833
Published: 2024-10-09
Description: Taipy is an open-source Python library for easy, end-to-end application development for data scientists and machine learning engineers. In affected versions session cookies are served without Secure and HTTPOnly flags. This issue has been addressed in release version 4.0.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-614, CWE-1004, CWE-319, CWE-732
References: https://github.com/Avaiga/taipy/security/advisories/GHSA-r3jq-4r5c-j9hp
CVE: CVE-2024-7038
Published: 2024-10-09
Description: An information disclosure vulnerability exists in open-webui version 0.3.8. The vulnerability is related to the embedding model update feature under admin settings. When a user updates the model path, the system checks if the file exists and provides different error messages based on the existence and configuration of the file. This behavior allows an attacker to enumerate file names and traverse directories by observing the error messages, leading to potential exposure of sensitive information.
CVSS Score: 2.7 (LOW)
CWE: CWE-209, CWE-209
References: https://huntr.com/bounties/f42cf72a-8015-44a6-81a9-c6332ef05afc
CVE: CVE-2024-30118
Published: 2024-10-09
Description: HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to because of improperly handling the request data.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0114302
CVE: CVE-2024-38815
Published: 2024-10-09
Description: VMware NSX contains a content spoofing vulnerability. 

An unauthenticated malicious actor may be able to craft a URL and redirect a victim to an attacker controlled domain leading to sensitive information disclosure.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25047
CVE: CVE-2024-38817
Published: 2024-10-09
Description: VMware NSX contains a command injection vulnerability. 

A malicious actor with access to the NSX Edge CLI terminal may be able to craft malicious payloads to execute arbitrary commands on the operating system as root.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-77
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25047
CVE: CVE-2024-38818
Published: 2024-10-09
Description: VMware NSX contains a local privilege escalation vulnerability. 

An authenticated malicious actor may exploit this vulnerability to obtain permissions from a separate group role than previously assigned.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-269
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25047
CVE: CVE-2024-39515
Published: 2024-10-09
Description: An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker sending a specifically malformed BGP packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.

In some cases, rpd fails to restart requiring a manual restart via the 'restart routing' CLI command.

This issue only affects systems with BGP traceoptions enabled and 

requires a BGP session to be already established.  Systems without BGP traceoptions enabled are not affected by this issue.

This issue affects iBGP and eBGP, and both IPv4 and IPv6 are affected by this vulnerability.

This issue affects:

Junos OS: 

  *  All versions before 21.4R3-S8, 
  *  22.2 before 22.2R3-S5, 
  *  22.3 before 22.3R3-S4, 
  *  22.4 before 22.4R3-S3, 
  *  23.2 before 23.2R2-S2, 
  *  23.4 before 23.4R2; 


Junos OS Evolved: 

  *  All versions before 21.4R3-S8-EVO, 
  *  22.2-EVO before 22.2R3-S5-EVO, 
  *  22.3-EVO before 22.3R3-S4-EVO, 
  *  22.4-EVO before 22.4R3-S3-EVO, 
  *  23.2-EVO before 23.2R2-S2-EVO, 
  *  23.4-EVO before 23.4R2-EVO.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1288
References: https://supportportal.juniper.net/JSA88099; https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/traceoptions-edit-protocols-bgp.html
CVE: CVE-2024-39516
Published: 2024-10-09
Description: An Out-of-Bounds Read vulnerability in

the routing protocol daemon (rpd) of 

 Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker sending a specifically malformed BGP packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.


This issue only affects systems configured in
      either of two ways:

    
    
        *  systems with BGP traceoptions enabled

        *  systems with BGP traffic engineering
          configured

    


This issue can affect iBGP and eBGP with 

any address family

 configured. The specific attribute involved is non-transitive, and will not propagate across a network.

This issue affects:

Junos OS: 



  *  All versions before 21.4R3-S8,
  *  22.2 before 22.2R3-S5, 
  *  22.3 before 22.3R3-S4, 
  *  22.4 before 22.4R3-S3, 
  *  23.2 before 23.2R2-S2, 
  *  23.4 before 23.4R2; 




Junos OS Evolved: 



  *  All versions before 21.4R3-S8-EVO, 
  *  22.2-EVO before 22.2R3-S5-EVO, 
  *  22.3-EVO before 22.3R3-S4-EVO, 
  *  22.4-EVO before 22.4R3-S3-EVO, 
  *  23.2-EVO before 23.2R2-S2-EVO, 
  *  23.4-EVO before 23.4R2-EVO.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://supportportal.juniper.net/JSA88100; https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/traceoptions-edit-protocols-bgp.html
CVE: CVE-2024-39525
Published: 2024-10-09
Description: An Improper Handling of Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker sending a specific BGP packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.

This issue only affects systems with BGP traceoptions enabled and 

requires a BGP session to be already established.  Systems without BGP traceoptions enabled are not affected by this issue.

This issue affects iBGP and eBGP, and both IPv4 and IPv6 are affected by this vulnerability.

This issue affects:

Junos OS: 



  *  All versions before 21.2R3-S8, 
  *  from 21.4 before 21.4R3-S8, 
  *  from 22.2 before 22.2R3-S4, 
  *  from 22.3 before 22.3R3-S4,
  *  from 22.4 before 22.4R3-S3, 
  *  from 23.2 before 23.2R2-S1, 
  *  from 23.4 before 23.4R2; 




Junos OS Evolved: 



  *  All versions before 21.2R3-S8-EVO, 
  *  from 21.4-EVO before 21.4R3-S8-EVO, 
  *  from 22.2-EVO before 22.2R3-S4-EVO, 
  *  from 22.3-EVO before 22.3R3-S4-EVO,
  *  from 22.4-EVO before 22.4R3-S3-EVO, 
  *  from 23.2-EVO before 23.2R2-S1-EVO, 
  *  from 23.4-EVO before 23.4R2-EVO.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755
References: https://supportportal.juniper.net/JSA88102; https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/traceoptions-edit-protocols-bgp.html
CVE: CVE-2024-7037
Published: 2024-10-09
Description: In version v0.3.8 of open-webui/open-webui, the endpoint /api/pipelines/upload is vulnerable to arbitrary file write and delete due to unsanitized file.filename concatenation with CACHE_DIR. This vulnerability allows attackers to overwrite and delete system files, potentially leading to remote code execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: https://huntr.com/bounties/8508db68-9c99-4b1c-828c-e1bfcacfb847
CVE: CVE-2024-7041
Published: 2024-10-09
Description: An Insecure Direct Object Reference (IDOR) vulnerability exists in open-webui/open-webui version v0.3.8. The vulnerability occurs in the API endpoint `http://0.0.0.0:3000/api/v1/memories/{id}/update`, where the decentralization design is flawed, allowing attackers to edit other users' memories without proper authorization.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://huntr.com/bounties/6855227f-1237-47b8-8d37-29aad7ddec3a
CVE: CVE-2024-48933
Published: 2024-10-09
Description: A cross-site scripting (XSS) vulnerability in LemonLDAP::NG before 2.19.3 allows remote attackers to inject arbitrary web script or HTML into the login page via a username if userControl has been set to a non-default value that allows special HTML characters.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/3232; https://lists.debian.org/debian-lts-announce/2024/11/msg00037.html
CVE: CVE-2024-8264
Published: 2024-10-09
Description: Fortra's Robot Schedule Enterprise Agent prior to version 3.05 writes FTP username and password information to the agent log file when detailed logging is enabled.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://hstechdocs.helpsystems.com/releasenotes/Content/_ProductPages/Robot/RobotScheduleEnterprise.htm; https://www.fortra.com/security/advisories/product-security/fi-2024-012
CVE: CVE-2024-48941
Published: 2024-10-10
Description: The Syracom Secure Login (2FA) plugin for Jira, Confluence, and Bitbucket through 3.1.4.5 allows remote attackers to bypass 2FA by interacting with the /rest endpoint of Jira, Confluence, or Bitbucket. In the default configuration, /rest is allowlisted.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-266
References: https://syracom-bee.atlassian.net/wiki/spaces/SL/pages/[PII_REDACTED]/2024-09-16+-+Secure+Login+security+advisory+-+Insecure+default+configuration
CVE: CVE-2024-48942
Published: 2024-10-10
Description: The Syracom Secure Login (2FA) plugin for Jira, Confluence, and Bitbucket through 3.1.4.5 allows remote attackers to easily brute-force the 2FA PIN via the plugins/servlet/twofactor/public/pinvalidation endpoint. The last 30 and the next 30 tokens are valid.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-799
References: https://syracom-bee.atlassian.net/wiki/spaces/SL/pages/[PII_REDACTED]/2024-09-16+-+Secure+Login+security+advisory+-+Insecure+default+configuration
CVE: CVE-2024-48949
Published: 2024-10-10
Description: The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()" validation.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-347, CWE-347
References: https://blog.trailofbits.com/2025/11/18/we-found-cryptography-bugs-in-the-elliptic-library-using-wycheproof/; https://github.com/indutny/elliptic/commit/7ac5360118f74eb02da73bdf9f24fd0c72ff5281; https://github.com/indutny/elliptic/compare/v6.5.5...v6.5.6
CVE: CVE-2024-48957
Published: 2024-10-10
Description: execute_filter_audio in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://github.com/libarchive/libarchive/compare/v3.7.4...v3.7.5; https://github.com/libarchive/libarchive/pull/2149; https://github.com/terrynini/CVE-Reports/blob/main/CVE-2024-48957/README.md
CVE: CVE-2024-48958
Published: 2024-10-10
Description: execute_filter_delta in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://github.com/libarchive/libarchive/compare/v3.7.4...v3.7.5; https://github.com/libarchive/libarchive/pull/2148; https://github.com/terrynini/CVE-Reports/tree/main/CVE-2024-48958
CVE: CVE-2024-7048
Published: 2024-10-10
Description: In version v0.3.8 of open-webui, an improper privilege management vulnerability exists in the API endpoints GET /api/v1/documents/ and POST /rag/api/v1/doc. This vulnerability allows a lower-privileged user to access and overwrite files managed by a higher-privileged admin. By exploiting this vulnerability, an attacker can view metadata of files uploaded by an admin and overwrite these files, compromising the integrity and availability of the RAG models.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-863
References: https://huntr.com/bounties/acd0b2dd-61eb-4712-82d3-a4e35d6ee560
CVE: CVE-2024-8513
Published: 2024-10-10
Description: The QA Analytics – Web Analytics Tool with Heatmaps & Session Replay Across All Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_save_plugin_config() function in all versions up to, and including, 4.1.1.1. This makes it possible for unauthenticated attackers to update the plugin's settings.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/qa-heatmap-analytics/trunk/class-qahm-admin-page-config.php#L801; https://plugins.trac.wordpress.org/changeset/3174701/qa-heatmap-analytics/trunk/class-qahm-admin-page-config.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/15d29d58-9e28-4e18-aeb9-9c63cb308673?source=cve
CVE: CVE-2024-8729
Published: 2024-10-10
Description: The Easy Social Share Buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.4.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/easy-social-share-buttons/trunk/includes/class-easy-social-share-buttons-settings.php#L271; https://www.wordfence.com/threat-intel/vulnerabilities/id/b616bb6c-0861-4920-a589-f2c5bb819164?source=cve
CVE: CVE-2024-8987
Published: 2024-10-10
Description: The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's youzify_media shortcode in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/youzify/tags/1.3.0/includes/public/core/functions/general/youzify-profile-functions.php#L910; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3166404%40youzify%2Ftrunk&old=3125439%40youzify%2Ftrunk&sfp_email=&sfph_mail=; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3166404%40youzify&new=3166404%40youzify&sfp_email=&sfph_mail=
CVE: CVE-2024-9057
Published: 2024-10-10
Description: The Curator.io: Show all your social media posts in a beautiful feed. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘feed_id’ attribute in all versions up to, and including, 1.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3168951%40curatorio&new=3168951%40curatorio&sfp_email=&sfph_mail=; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3169646%40curatorio&new=3169646%40curatorio&sfp_email=&sfph_mail=; https://wordpress.org/plugins/curatorio/#developers
CVE: CVE-2024-9064
Published: 2024-10-10
Description: The Elementor Inline SVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/inline-svg-elementor/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/5aab3dea-5d14-4316-9a4c-97b0d30762bf?source=cve
CVE: CVE-2024-9065
Published: 2024-10-10
Description: The WP Helper Premium plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'whp_smtp_send_mail_test' function in all versions up to, and including, 4.6.1. This makes it possible for unauthenticated attackers to send emails containing any content and originating from the vulnerable WordPress instance to any recipient. CVE-2025-24737 is likely a duplicate of this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/wp-helper-lite/tags/4.6.1/functions/class.wps-frontend-setup-function.php#L55; https://plugins.trac.wordpress.org/changeset/3167825/; https://www.wordfence.com/threat-intel/vulnerabilities/id/5f3c6d98-6f30-4a98-91c9-e77c1f960527?source=cve
CVE: CVE-2024-9066
Published: 2024-10-10
Description: The Marketing and SEO Booster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.9.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/marketing-and-seo-booster/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/52144ff6-0617-496c-8159-ec5d7bc86f60?source=cve
CVE: CVE-2024-9072
Published: 2024-10-10
Description: The GDPR-Extensions-com – Consent Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3184211%40gdpr-consent-manager&new=3184211%40gdpr-consent-manager#file15; https://wordpress.org/plugins/gdpr-consent-manager/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/0ce2a9fe-3364-46b5-a6ae-b4feb3e20647?source=cve
CVE: CVE-2024-9205
Published: 2024-10-10
Description: The Maximum Products per User for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 4.2.8. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/maximum-products-per-user-for-woocommerce/tags/4.2.8/includes/class-alg-wc-mppu-users.php#L836; https://plugins.trac.wordpress.org/changeset/3164534/maximum-products-per-user-for-woocommerce/tags/4.2.9/includes/class-alg-wc-mppu-users.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/140c0d22-dc26-4100-a5c0-a2f8a6f98d97?source=cve
CVE: CVE-2024-9377
Published: 2024-10-10
Description: The Products, Order & Customers Export for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.0.15. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/export-woocommerce/tags/2.0.15/includes/class-alg-wc-export-core.php#L216; https://plugins.trac.wordpress.org/browser/export-woocommerce/tags/2.0.15/includes/class-alg-wc-export-core.php#L220; https://plugins.trac.wordpress.org/changeset/3164996/
CVE: CVE-2024-9457
Published: 2024-10-10
Description: The WP Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.0.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/cssjockey-add-ons/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/041c21fb-f2f0-45cb-b3ae-20f3ae22c947?source=cve
CVE: CVE-2024-9518
Published: 2024-10-10
Description: The UserPlus plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.0 due to insufficient restriction on the 'form_actions' and 'userplus_update_user_profile' functions. This makes it possible for unauthenticated attackers to specify their user role by supplying the 'role' parameter during a registration.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://plugins.trac.wordpress.org/browser/userplus/trunk/functions/user-functions.php?rev=1604604#L47; https://www.wordfence.com/threat-intel/vulnerabilities/id/2489e649-27f7-4ca0-8[PII_REDACTED]fa89a?source=cve