deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-22153
Published: 2025-01-23
Description: RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Via a type confusion bug in versions of the CPython interpreter starting in 3.11 and prior to 3.13.2 when using `try/except*`, RestrictedPython starting in version 6.0 and prior to version 8.0 could be bypassed. The issue is patched in version 8.0 of RestrictedPython by removing support for `try/except*` clauses. No known workarounds are available.
CVSS Score: 7.9 (HIGH)
CWE: CWE-843
References: https://github.com/zopefoundation/RestrictedPython/commit/48a92c5bb617a647cffd0dadd4d5cfe626bcdb2f; https://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-gmj9-h825-chq2
CVE: CVE-2025-23227
Published: 2025-01-23
Description: IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.11 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7181334
CVE: CVE-2025-24033
Published: 2025-01-23
Description: @fastify/multipart is a Fastify plugin for parsing the multipart content-type. Prior to versions 8.3.1 and 9.0.3, the `saveRequestFiles` function does not delete the uploaded temporary files when user cancels the request. The issue is fixed in versions 8.3.1 and 9.0.3. As a workaround, do not use `saveRequestFiles`.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/fastify/fastify-multipart/issues/546; https://github.com/fastify/fastify-multipart/pull/567; https://github.com/fastify/fastify-multipart/security/advisories/GHSA-27c6-mcxv-x3fh
CVE: CVE-2025-24034
Published: 2025-01-23
Description: Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Starting in version 0.7.0 and prior to versions 0.7.15 and 0.8.3, Himmelblau is vulnerable to leaking credentials in debug logs. When debug logging is enabled, user access tokens are inadvertently logged, potentially exposing sensitive authentication data. Similarly, Kerberos Ticket-Granting Tickets (TGTs) are logged when debug logging is enabled. Both issues pose a risk of exposing sensitive credentials, particularly in environments where debug logging is enabled. Himmelblau versions 0.7.15 and 0.8.3 contain a patch that fixes both issues. Some workarounds are available for users who are unable to upgrade. For the **logon compliance script issue**, disable the `logon_script` option in `/etc/himmelblau/himmelblau.conf`, and avoid using the `-d` flag when starting the `himmelblaud` daemon. For the Kerberos CCache issue, one may disable debug logging globally by setting the `debug` option in `/etc/himmelblau/himmelblau.conf` to `false` and avoiding the `-d` parameter when starting `himmelblaud`.
CVSS Score: 3.2 (LOW)
CWE: CWE-532
References: https://github.com/himmelblau-idm/himmelblau/commit/1216804f15ce5dc74bb5da48b5508c41d2ece8fa; https://github.com/himmelblau-idm/himmelblau/releases/tag/0.7.15; https://github.com/himmelblau-idm/himmelblau/releases/tag/0.8.3
CVE: CVE-2025-24353
Published: 2025-01-23
Description: Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.2.0, when sharing an item, a typical user can specify an arbitrary role. It allows the user to use a higher-privileged role to see fields that otherwise the user should not be able to see. Instances that are impacted are those that use the share feature and have specific roles hierarchy and fields that are not visible for certain roles. Version 11.2.0 contains a patch the issue.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-269
References: https://github.com/directus/directus/commit/e288a43a79613dada905da683f4919c6965ac804; https://github.com/directus/directus/pull/23716; https://github.com/directus/directus/releases/tag/v11.2.0
CVE: CVE-2025-23011
Published: 2025-01-23
Description: Fedora Repository 3.8.1 allows path traversal when extracting uploaded archives ("Zip Slip"). A remote, authenticated attacker can upload a specially crafted archive that will extract an arbitrary JSP file to a location that can be executed by an unauthenticated GET request. Fedora Repository 3.8.1 was released on 2015-06-11 and is no longer maintained. Migrate to a currently supported version (6.5.1 as of 2025-01-23).
CVSS Score: 8.8 (HIGH)
CWE: CWE-23
References: https://github.com/fcrepo-exts/migration-utils; https://github.com/fcrepo/fcrepo/releases; https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-021-01.json
CVE: CVE-2025-23012
Published: 2025-01-23
Description: Fedora Repository 3.8.x includes a service account (fedoraIntCallUser) with default credentials and privileges to read read local files by manipulating datastreams. Fedora Repository 3.8.1 was released on 2015-06-11 and is no longer maintained. Migrate to a currently supported version (6.5.1 as of 2025-01-23).
CVSS Score: 7.5 (HIGH)
CWE: CWE-1392
References: https://github.com/fcrepo-exts/migration-utils; https://github.com/fcrepo/fcrepo/releases; https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-021-01.json
CVE: CVE-2023-46400
Published: 2025-01-23
Description: KWHotel 0.47 is vulnerable to CSV Formula Injection in the add guest function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1236, CWE-1236
References: https://gist.github.com/6en6ar/5d39374d6ced8acbe489e0b1b932d056; https://gist.github.com/6en6ar/5d39374d6ced8acbe489e0b1b932d056
CVE: CVE-2023-46401
Published: 2025-01-23
Description: KWHotel 0.47 is vulnerable to CSV Formula Injection in the invoice adding function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1236, CWE-1236
References: https://gist.github.com/6en6ar/5d39374d6ced8acbe489e0b1b932d056; https://gist.github.com/6en6ar/5d39374d6ced8acbe489e0b1b932d056
CVE: CVE-2024-50664
Published: 2025-01-23
Description: gpac 2.4 contains a heap-buffer-overflow at isomedia/sample_descs.c:1799 in gf_isom_new_mpha_description in gpac/MP4Box.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-120
References: https://github.com/gpac/gpac/issues/2988; https://github.com/gpac/gpac/issues/2988
CVE: CVE-2024-50665
Published: 2025-01-23
Description: gpac 2.4 contains a SEGV at src/isomedia/drm_sample.c:1562:96 in isom_cenc_get_sai_by_saiz_saio in MP4Box.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://github.com/gpac/gpac/issues/2987; https://github.com/gpac/gpac/issues/2987
CVE: CVE-2024-53588
Published: 2025-01-23
Description: A DLL hijacking vulnerability in iTop VPN v16.0 allows attackers to execute arbitrary code via placing a crafted DLL file into the path \ProgramData\iTop VPN\Downloader\vpn6.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://github.com/JonathanLauener/iTop-privesc
CVE: CVE-2024-53923
Published: 2025-01-23
Description: An issue was discovered in Centreon Web 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x before 23.10.19, 23.04.x before 23.04.24. A user with high privileges is able to achieve SQL injection in the form to upload media.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89
References: https://github.com/centreon/centreon/releases; https://thewatch.centreon.com/latest-security-bulletins-64/cve-2024-53923-centreon-web-critical-severity-4265
CVE: CVE-2024-55192
Published: 2025-01-23
Description: OpenImageIO v3.1.0.0dev was discovered to contain a heap overflow via the component OpenImageIO_v3_1_0::farmhash::inlined::Fetch64(char const*).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-122
References: https://github.com/AcademySoftwareFoundation/OpenImageIO/issues/4550
CVE: CVE-2024-55193
Published: 2025-01-23
Description: OpenImageIO v3.1.0.0dev was discovered to contain a segmentation violation via the component /OpenImageIO/string_view.h.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476
References: https://github.com/AcademySoftwareFoundation/OpenImageIO/issues/4551
CVE: CVE-2024-55194
Published: 2025-01-23
Description: OpenImageIO v3.1.0.0dev was discovered to contain a heap overflow via the component /OpenImageIO/fmath.h.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-120
References: https://github.com/AcademySoftwareFoundation/OpenImageIO/issues/4552; https://github.com/AcademySoftwareFoundation/OpenImageIO/issues/4552
CVE: CVE-2024-55195
Published: 2025-01-23
Description: An allocation-size-too-big bug in the component /imagebuf.cpp of OpenImageIO v3.1.0.0dev may cause a Denial of Service (DoS) when the program to requests to allocate too much space.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/AcademySoftwareFoundation/OpenImageIO/issues/4553; https://github.com/AcademySoftwareFoundation/OpenImageIO/issues/4553
CVE: CVE-2024-57326
Published: 2025-01-23
Description: A Reflected Cross-Site Scripting (XSS) vulnerability exists in the search.php file of the Online Pizza Delivery System 1.0. The vulnerability allows an attacker to execute arbitrary JavaScript code in the browser via unsanitized input passed through the search parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/fatihtuzunn/CVEs/tree/main/CVE-2024-57326
CVE: CVE-2024-57328
Published: 2025-01-23
Description: A SQL Injection vulnerability exists in the login form of Online Food Ordering System v1.0. The vulnerability arises because the input fields username and password are not properly sanitized, allowing attackers to inject malicious SQL queries to bypass authentication and gain unauthorized access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/fatihtuzunn/CVEs/tree/main/CVE-2024-57328
CVE: CVE-2024-57329
Published: 2025-01-23
Description: HortusFox v3.9 contains a stored XSS vulnerability in the "Add Plant" function. The name input field does not sanitize or escape user inputs, allowing attackers to inject and execute arbitrary JavaScript payloads.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/fatihtuzunn/CVEs/tree/main/CVE-2024-57329
CVE: CVE-2024-57386
Published: 2025-01-23
Description: Cross Site Scripting vulnerability in Wallos v.2.41.0 allows a remote attacker to execute arbitrary code via the profile picture function.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/PawaritSanguanpang/CVEs/tree/main/Wallos/CVE-2024-57386
CVE: CVE-2024-57556
Published: 2025-01-23
Description: Cross Site Scripting vulnerability in nbubna store v.2.14.2 and before allows a remote attacker to execute arbitrary code via the store.deep.js component
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/nbubna/store/issues/127
CVE: CVE-2025-0693
Published: 2025-01-23
Description: Variable response times in the AWS Sign-in IAM user login flow allowed for the use of brute force enumeration techniques to identify valid IAM usernames in an arbitrary AWS account.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-204, CWE-208
References: https://aws.amazon.com/security/security-bulletins/AWS-2025-002/
CVE: CVE-2021-42718
Published: 2025-01-23
Description: Information Disclosure in API in Replicated Replicated Classic versions prior to 2.53.1 on all platforms allows authenticated users with Admin Console access to retrieve sensitive data, including application secrets, via accessing container definitions with environment variables through the Admin Console API on port 8800.

This CVE was originally reserved in 2021 and later publicly disclosed by Replicated on their website on 21 October 2021. However, it mistakenly remained in the Reserved But Public (RBP) status with the CVE Numbering Authority (CNA). Please note that this product reached its end of life on 31 December 2024. Publishing this CVE with the CNA was required to comply with CNA rules, despite the fact that the issue was disclosed and fixed four years ago, and the affected product is no longer supported as of 2024.

Summary of VulnerabilityThis advisory discloses a low severity security vulnerability in the versions of Replicated Classic listed above (“Affected Replicated Classic Versions”)

DescriptionReplicated Classic versions prior to 2.53.1 have an authenticated API from the Replicated Admin Console that may expose sensitive data including application secrets, depending on how the application manifests are written. A user with valid credentials and access to the Admin Console port (8800) on the Replicated Classic server can retrieve container definitions including environment variables which may contain passwords and other secrets depending on how the application is configured.

This data is shared over authenticated sessions to the Admin Console only, and was never displayed or used in the application processing. To remediate this issue, we removed the sensitive data from the API, sending only the data to the Admin Console that was needed.

TimelineThis issue was discovered during a security review on 16 September 2021.
Patched versions were released on 23 September 2021.
This advisory was published on 21 October 2021.


The CVE Numbering Authority (CNA) notified Replicated on 23 January 2025 that the CVE was still in Reserved But Public (RBP) status. Upon discovering the oversight in updating the status to published with the CNA, Replicated submitted the updated report on the same day, 23 January 2025.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-922
References: https://www.replicated.com/cve-2021-42718
CVE: CVE-2024-53379
Published: 2025-01-23
Description: Heap buffer overflow in the server site handshake implementation in Real Time Logic LLC's SharkSSL version (from 05/05/24) commit 64808a5e12c83b38f85c943dee0112e428dc2a43 allows a remote attacker to trigger a Denial-of-Service via a malformed Client-Hello message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://www.telekom.com/resource/blob/1086326/e6e800ec1e4e675ca0d8fdafab86ea8c/dl-250122-cve-2024-53379-data.pdf; https://www.telekom.com/resource/blob/1086326/e6e800ec1e4e675ca0d8fdafab86ea8c/dl-250122-cve-2024-53379-data.pdf
CVE: CVE-2024-55573
Published: 2025-01-23
Description: An issue was discovered in Centreon centreon-web 24.10.x before 24.10.3, 24.04.x before 24.04.9, 23.10.x before 23.10.19, 23.04.x before 23.04.24. A user with high privileges is able to inject SQL into the form used to create virtual metrics.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89
References: https://github.com/centreon/centreon/releases; https://thewatch.centreon.com/latest-security-bulletins-64/cve-2024-55573-centreon-web-critical-severity-4264
CVE: CVE-2021-30745
Published: 2025-01-24
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Rejected Reason: This candidate is unused by its CNA.
CVE: CVE-2024-11931
Published: 2025-01-24
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.6.4, from 17.7 prior to 17.7.3, and from 17.8 prior to 17.8.1. Under certain conditions, it may have been possible for users with developer role to exfiltrate protected CI variables via CI lint.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-1220
References: https://gitlab.com/gitlab-org/gitlab/-/issues/480901; https://about.gitlab.com/releases/2025/01/22/patch-release-gitlab-17-8-1-released/https://about.gitlab.com/releases/2025/01/22/patch-release-gitlab-17-8-1-released/
CVE: CVE-2025-0314
Published: 2025-01-24
Description: An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.6.4, 17.7 before 17.7.3, and 17.8 before 17.8.1. Improper rendering of certain file types lead to cross-site scripting.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://gitlab.com/gitlab-org/gitlab/-/issues/512118; https://hackerone.com/reports/2922313
CVE: CVE-2024-13659
Published: 2025-01-24
Description: The Listamester plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'listamester' shortcode in all versions up to, and including, 2.3.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2025-24678 is a duplicate of this.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/listamester/trunk/includes/class-listamester.php#L105; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3225538%40listamester&new=3225538%40listamester&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/68b4358d-d4b4-415b-a19f-e58b155ceac9?source=cve
CVE: CVE-2024-13680
Published: 2025-01-24
Description: The Form Builder CP plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'CP_EASY_FORM_WILL_APPEAR_HERE' shortcode in all versions up to, and including, 1.2.41 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/cp-easy-form-builder/tags/1.2.41/cp_easy_form_builder.php#L297; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3214984%40cp-easy-form-builder&new=3214984%40cp-easy-form-builder&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/a018fcb1-b7a6-456f-ab0b-59ccc1fd5b67?source=cve
CVE: CVE-2024-13683
Published: 2025-01-24
Description: The Automate Hub Free by Sperse.IO plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.0. This is due to missing or incorrect nonce validation on the 'automate_hub' page. This makes it possible for unauthenticated attackers to update an activation status via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/automate-hub-free-by-sperse-io/trunk/apps/s/sperse/sperse.php#L141; https://wordpress.org/plugins/automate-hub-free-by-sperse-io/; https://www.wordfence.com/threat-intel/vulnerabilities/id/f6d90ca3-dc24-4634-9f98-83a909e3e093?source=cve
CVE: CVE-2024-13545
Published: 2025-01-24
Description: The Bootstrap Ultimate theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.9 via the path parameter. This makes it possible for unauthenticated attackers to include PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included. If php://filter is enabled on the server, this issue may directly lead to Remote Code Execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://themes.trac.wordpress.org/browser/bootstrap-ultimate/1.4.9/docs/index.php#L8; https://www.wordfence.com/threat-intel/vulnerabilities/id/ae07af10-e5fc-4f28-a343-f56c0e2bc324?source=cve
CVE: CVE-2024-12494
Published: 2025-01-24
Description: The BMLT Meeting Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bmlt_meeting_map' shortcode in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/bmlt-meeting-map/tags/2.6.0/meeting_map.php#L33; https://plugins.trac.wordpress.org/browser/bmlt-meeting-map/tags/2.6.0/meeting_map.php#L462; https://www.wordfence.com/threat-intel/vulnerabilities/id/73c01967-262c-48ab-a464-401b1cadd4be?source=cve
CVE: CVE-2024-13583
Published: 2025-01-24
Description: The Simple Gallery with Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'c2tw_sgwf' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/simple-gallery-with-filter/trunk/simple-gallery-with-filter.php#L377; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3227234%40simple-gallery-with-filter&new=3227234%40simple-gallery-with-filter&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/1c088264-64a2-4a36-ae3b-fdf60f3837e2?source=cve
CVE: CVE-2024-13335
Published: 2025-01-24
Description: The Spexo Addons for Elementor – Free Elementor Addons, Widgets and Templates plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the tmpcoder_theme_install_func() function in all versions up to, and including, 1.0.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install a theme.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset/3227353/sastra-essential-addons-for-elementor/trunk/inc/wizard/wizard-ajax-api.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/4edc7ef9-33db-4433-8ef2-cd06089ee8d5?source=cve
CVE: CVE-2024-13354
Published: 2025-01-24
Description: The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML tags in several widgets in all versions up to, and including, 1.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3226779%40responsive-addons-for-elementor&new=3226779%40responsive-addons-for-elementor&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/c46d71fb-ccf1-4cbe-8088-edb7fba225e9?source=cve
CVE: CVE-2024-13408
Published: 2025-01-24
Description: The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.10 via the 'theme' attribute of the `pgcu` shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php files can be uploaded and included.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://plugins.trac.wordpress.org/changeset/3227281/post-grid-carousel-ultimate/tags/1.7/includes/classes/shortcode.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/ff346465-62c2-4a2b-8a4a-c88558d7cabd?source=cve