deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-6120
Published: 2024-06-22
Description: The Sparkle Demo Importer plugin for WordPress is vulnerable to unauthorized database reset and demo data import due to a missing capability check on the multiple functions in all versions up to and including 1.4.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete all posts, pages, and uploaded files, as well as download and install a limited set of demo plugins.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/sparkle-demo-importer/tags/1.4.7/sparkle-demo-importer.php#L446; https://plugins.trac.wordpress.org/browser/sparkle-demo-importer/tags/1.4.7/sparkle-demo-importer.php#L469; https://plugins.trac.wordpress.org/browser/sparkle-demo-importer/tags/1.4.7/sparkle-demo-importer.php#L497
CVE: CVE-2024-2484
Published: 2024-06-22
Description: The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Services and Post Type Grid widgets in all versions up to, and including, 2.10.34 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/themeisle-companion/tags/2.10.33/vendor/codeinwp/elementor-extra-widgets/widgets/elementor/posts-grid.php#L1464; https://plugins.trac.wordpress.org/browser/themeisle-companion/tags/2.10.33/vendor/codeinwp/elementor-extra-widgets/widgets/elementor/services.php#L639; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3055876%40themeisle-companion&new=3055876%40themeisle-companion&sfp_email=&sfph_mail=
CVE: CVE-2024-4313
Published: 2024-06-22
Description: The Table Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_id’ parameter in all versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/table-addons-for-elementor/trunk/includes/class-table-addons-for-elementor-widget.php#L637; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3104753%40table-addons-for-elementor&new=3104753%40table-addons-for-elementor&sfp_email=&sfph_mail=#file57; https://www.wordfence.com/threat-intel/vulnerabilities/id/ddbb4bcf-daf7-4ae3-8f42-fce5f1d2c279?source=cve
CVE: CVE-2024-5346
Published: 2024-06-22
Description: The Flatsome theme for WordPress is vulnerable to Stored Cross-Site Scripting via the UX Countdown, Video Button, UX Video, UX Slider, UX Sidebar, and UX Payment Icons shortcodes in all versions up to, and including, 3.18.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://themeforest.net/item/flatsome-multipurpose-responsive-woocommerce-theme/5484319#item-description__change-log; https://www.wordfence.com/threat-intel/vulnerabilities/id/11d4c028-94c1-4b78-92f8-0f[PII_REDACTED]?source=cve; https://themeforest.net/item/flatsome-multipurpose-responsive-woocommerce-theme/5484319#item-description__change-log
CVE: CVE-2024-5791
Published: 2024-06-22
Description: The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wp_id' parameter in all versions up to, and including, 4.4.2 due to missing authorization checks on processAction function, as well as insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever a user accesses a wp-admin dashboard.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/meeting-scheduler-by-vcita/tags/4.4.2/vcita-api-functions.php#L40; https://www.wordfence.com/threat-intel/vulnerabilities/id/c033171a-d81f-4cae-830b-8bdc4017b85e?source=cve; https://plugins.trac.wordpress.org/browser/meeting-scheduler-by-vcita/tags/4.4.2/vcita-api-functions.php#L40
CVE: CVE-2024-5965
Published: 2024-06-22
Description: The Mosaic theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter within the theme's Button shortcode in all versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://themes.trac.wordpress.org/browser/mosaic/1.7.1/shortcodes.php#L165; https://www.wordfence.com/threat-intel/vulnerabilities/id/6921da1b-e63d-479a-9786-9b1bd8201d69?source=cve; https://themes.trac.wordpress.org/browser/mosaic/1.7.1/shortcodes.php#L165
CVE: CVE-2024-5966
Published: 2024-06-22
Description: The Grey Opaque theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the theme's Download-Button shortcode in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://themes.trac.wordpress.org/browser/grey-opaque/2.0.1/functions-shortcodes.php#L34; https://www.wordfence.com/threat-intel/vulnerabilities/id/2f4888e1-98b3-48d9-a2d8-416eae447a32?source=cve; https://themes.trac.wordpress.org/browser/grey-opaque/2.0.1/functions-shortcodes.php#L34
CVE: CVE-2024-21514
Published: 2024-06-22
Description: This affects versions of the package opencart/opencart from 0.0.0. An SQL Injection issue was identified in the Divido payment extension for OpenCart, which is included by default in version 3.0.3.9. As an anonymous unauthenticated user, if the Divido payment module is installed (it does not have to be enabled), it is possible to exploit SQL injection to gain unauthorised access to the backend database. For any site which is vulnerable, any unauthenticated user could exploit this to dump the entire OpenCart database, including customer PII data.
CVSS Score: 7.4 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/opencart/opencart/blob/3.0.3.9/upload/catalog/model/extension/payment/divido.php%23L114; https://github.com/opencart/opencart/commit/46bd5f5a8056ff9aad0aa7d71729c4cf593d67e2; https://security.snyk.io/vuln/SNYK-PHP-OPENCARTOPENCART-7266565
CVE: CVE-2024-21515
Published: 2024-06-22
Description: This affects versions of the package opencart/opencart from 4.0.0.0. A reflected XSS issue was identified in the filename parameter of the admin tool/log route. An attacker could obtain a user's token by tricking the user to click on a maliciously crafted URL. The user is then prompted to login and redirected again upon authentication with the payload automatically executing. If the attacked user has admin privileges, this vulnerability could be used as the start of a chain of exploits like Zip Slip or arbitrary file write vulnerabilities in the admin functionality.**Notes:**1) This is only exploitable if the attacker knows the name or path of the admin directory. The name of the directory is "admin" by default but there is a pop-up in the dashboard warning users to rename it.2) The fix for this vulnerability is incomplete. The redirect is removed so that it is not possible for an attacker to control the redirect post admin login anymore, but it is still possible to exploit this issue in admin if the user is authenticated as an admin already.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/opencart/opencart/commit/c546199e8f100c1f3797a7a9d3cf4db1887399a2; https://security.snyk.io/vuln/SNYK-PHP-OPENCARTOPENCART-7266573; https://github.com/opencart/opencart/commit/c546199e8f100c1f3797a7a9d3cf4db1887399a2
CVE: CVE-2024-21516
Published: 2024-06-22
Description: This affects versions of the package opencart/opencart from 4.0.0.0 and before 4.1.0.0. A reflected XSS issue was identified in the directory parameter of admin common/filemanager.list route. An attacker could obtain a user's token by tricking the user to click on a maliciously crafted URL. The user is then prompted to login and redirected again upon authentication with the payload automatically executing. If the attacked user has admin privileges, this vulnerability could be used as the start of a chain of exploits like Zip Slip or arbitrary file write vulnerabilities in the admin functionality.**Notes:**1) This is only exploitable if the attacker knows the name or path of the admin directory. The name of the directory is "admin" by default but there is a pop-up in the dashboard warning users to rename it.2) The fix for this vulnerability is incomplete. The redirect is removed so that it is not possible for an attacker to control the redirect post admin login anymore, but it is still possible to exploit this issue in admin if the user is authenticated as an admin already.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-79, CWE-79, CWE-79
References: https://github.com/opencart/opencart/commit/c546199e8f100c1f3797a7a9d3cf4db1887399a2; https://security.snyk.io/vuln/SNYK-PHP-OPENCARTOPENCART-7266576; https://github.com/opencart/opencart/commit/c546199e8f100c1f3797a7a9d3cf4db1887399a2
CVE: CVE-2024-21517
Published: 2024-06-22
Description: This affects versions of the package opencart/opencart from 4.0.0.0. A reflected XSS issue was identified in the redirect parameter of customer account/login route. An attacker can inject arbitrary HTML and Javascript into the page response. As this vulnerability is present in the account functionality it could be used to target and attack customers of the OpenCart shop.**Notes:**1) The fix for this vulnerability is incomplete
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/opencart/opencart/commit/0fd1ee4b6c94366bf3e5d3831a8336f3275d1860; https://security.snyk.io/vuln/SNYK-PHP-OPENCARTOPENCART-7266577; https://github.com/opencart/opencart/commit/0fd1ee4b6c94366bf3e5d3831a8336f3275d1860
CVE: CVE-2024-21518
Published: 2024-06-22
Description: This affects versions of the package opencart/opencart from 4.0.0.0. A Zip Slip issue was identified via the marketplace installer due to improper sanitization of the target path, allowing files within a malicious archive to traverse the filesystem and be extracted to arbitrary locations. An attacker can create arbitrary files in the web root of the application and overwrite other existing files by exploiting this vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-29, CWE-22, CWE-22, CWE-290
References: https://github.com/opencart/opencart/blob/04c1724370ab02967d3b4f668c1b67771ecf1ff4/upload/admin/controller/marketplace/installer.php%23L383C1-L383C1; https://security.snyk.io/vuln/SNYK-PHP-OPENCARTOPENCART-7266578; https://github.com/opencart/opencart/blob/04c1724370ab02967d3b4f668c1b67771ecf1ff4/upload/admin/controller/marketplace/installer.php%23L383C1-L383C1
CVE: CVE-2024-21519
Published: 2024-06-22
Description: This affects versions of the package opencart/opencart from 4.0.0.0. An Arbitrary File Creation issue was identified via the database restoration functionality. By injecting PHP code into the database, an attacker with admin privileges can create a backup file with an arbitrary filename (including the extension), within /system/storage/backup.**Note:**It is less likely for the created file to be available within the web root, as part of the security recommendations for the application suggest moving the storage path outside of the web root.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-20
References: https://github.com/opencart/opencart/blob/4.0.2.3/upload/admin/controller/tool/upload.php%23L353; https://security.snyk.io/vuln/SNYK-PHP-OPENCARTOPENCART-7266579; https://github.com/opencart/opencart/blob/4.0.2.3/upload/admin/controller/tool/upload.php%23L353
CVE: CVE-2024-4874
Published: 2024-06-22
Description: The Bricks Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.8 via the postId parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to modify posts and pages created by other users including admins. As a requirement for this, an admin would have to enable access to the editor specifically for such a user or enable it for all users with a certain user account type.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://bricksbuilder.io/release/bricks-1-9-9/#access-control-fix-for-user-role-contributor; https://www.wordfence.com/threat-intel/vulnerabilities/id/6d63e898-43e5-42b5-96b6-1453352e0cae?source=cve; https://bricksbuilder.io/release/bricks-1-9-9/#access-control-fix-for-user-role-contributor
CVE: CVE-2024-3593
Published: 2024-06-22
Description: The UberMenu plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.3. This is due to missing or incorrect nonce validation on the ubermenu_delete_all_item_settings and ubermenu_reset_settings functions. This makes it possible for unauthenticated attackers to delete and reset the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 7.2 (HIGH)
CWE: CWE-352, CWE-352
References: https://codecanyon.net/item/ubermenu-wordpress-mega-menu-plugin/154703; https://www.wordfence.com/threat-intel/vulnerabilities/id/621ef583-bf99-4b81-ae9c-b4f1c86b86aa?source=cve; https://codecanyon.net/item/ubermenu-wordpress-mega-menu-plugin/154703
CVE: CVE-2024-4940
Published: 2024-06-22
Description: An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redirect users to arbitrary websites, which can be exploited for phishing attacks, Cross-site Scripting (XSS), Server-Side Request Forgery (SSRF), amongst others. This issue is due to improper validation of user-supplied input in the handling of URLs. Attackers can exploit this vulnerability by crafting a malicious URL that, when processed by the application, redirects the user to an attacker-controlled web page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://huntr.com/bounties/35aaea93-6895-4f03-9c1b-cd992665aa60; https://huntr.com/bounties/35aaea93-6895-4f03-9c1b-cd992665aa60
CVE: CVE-2024-5596
Published: 2024-06-22
Description: The ARMember Premium plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.7. This is due to incorrectly implemented nonce validation function on multiple functions. This makes it possible for unauthenticated attackers to modify, or delete user meta and plugin options which can lead to limited privilege escalation.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-352
References: https://codecanyon.net/item/armember-complete-wordpress-membership-system/17785056; https://www.wordfence.com/threat-intel/vulnerabilities/id/3e55591e-c1e9-4667-b04f-4956d2f37d51?source=cve; https://codecanyon.net/item/armember-complete-wordpress-membership-system/17785056
CVE: CVE-2024-38379
Published: 2024-06-22
Description: Apache Allura's neighborhood settings are vulnerable to a stored XSS attack.  Only neighborhood admins can access these settings, so the scope of risk is limited to configurations where neighborhood admins are not fully trusted.

This issue affects Apache Allura: from 1.4.0 through 1.17.0.

Users are recommended to upgrade to version 1.17.1, which fixes the issue.


CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://lists.apache.org/thread/2lb6vp00sj2b2snpmhff5lyortxjsnrp; http://www.openwall.com/lists/oss-security/2024/06/21/1; https://lists.apache.org/thread/2lb6vp00sj2b2snpmhff5lyortxjsnrp
CVE: CVE-2024-6251
Published: 2024-06-22
Description: A vulnerability, which was classified as problematic, was found in playSMS 1.4.3. Affected is an unknown function of the file /index.php?app=main&inc=feature_phonebook&op=phonebook_list of the component New Phonebook Handler. The manipulation of the argument name/email leads to basic cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-269418 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-80, CWE-79
References: https://vuldb.com/?ctiid.269418; https://vuldb.com/?id.269418; https://vuldb.com/?submit.355495
CVE: CVE-2024-6252
Published: 2024-06-22
Description: A vulnerability has been found in Zorlan SkyCaiji up to 2.8 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Task Handler. The manipulation of the argument onerror leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269419.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://fushuling.com/index.php/2024/06/13/test2/; https://vuldb.com/?ctiid.269419; https://vuldb.com/?id.269419
CVE: CVE-2024-6253
Published: 2024-06-22
Description: A vulnerability was found in itsourcecode Online Food Ordering System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /purchase.php. The manipulation of the argument customer leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-269420.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/Desenchanted/cve/issues/1; https://vuldb.com/?ctiid.269420; https://vuldb.com/?id.269420
CVE: CVE-2024-5443
Published: 2024-06-22
Description: CVE-2024-4320 describes a vulnerability in the parisneo/lollms software, specifically within the `ExtensionBuilder().build_extension()` function. The vulnerability arises from the `/mount_extension` endpoint, where a path traversal issue allows attackers to navigate beyond the intended directory structure. This is facilitated by the `data.category` and `data.folder` parameters accepting empty strings (`""`), which, due to inadequate input sanitization, can lead to the construction of a `package_path` that points to the root directory. Consequently, if an attacker can create a `config.yaml` file in a controllable path, this path can be appended to the `extensions` list and trigger the execution of `__init__.py` in the current directory, leading to remote code execution. The vulnerability affects versions up to 5.9.0, and has been addressed in version 9.8.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-29
References: https://github.com/parisneo/lollms/commit/2d0c4e76be93195836ecd0948027e791b8a2626f; https://huntr.com/bounties/db52848a-4dbe-4110-a[PII_REDACTED]4bf45; https://github.com/parisneo/lollms/commit/2d0c4e76be93195836ecd0948027e791b8a2626f
CVE: CVE-2024-38319
Published: 2024-06-22
Description: IBM Security SOAR 51.0.2.0 could allow an authenticated user to execute malicious code loaded from a specially crafted script.  IBM X-Force ID:  294830.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/294830; https://www.ibm.com/support/pages/node/7158261; https://exchange.xforce.ibmcloud.com/vulnerabilities/294830
CVE: CVE-2024-6266
Published: 2024-06-23
Description: A vulnerability classified as critical has been found in Pear Admin Boot up to 2.0.2. Affected is an unknown function of the file /system/dictData/loadDictItem. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-269478 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://gitee.com/pear-admin/Pear-Admin-Boot/issues/IA5K2M; https://vuldb.com/?ctiid.269478; https://vuldb.com/?id.269478
CVE: CVE-2024-6267
Published: 2024-06-23
Description: A vulnerability classified as problematic was found in SourceCodester Service Provider Management System 1.0. Affected by this vulnerability is an unknown functionality of the file system_info/index.php of the component System Info Page. The manipulation of the argument System Name/System Short Name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269479.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://docs.google.com/document/d/1upC4101Ob9UW7fGC_valsEa45Q5xuBgcKZhs1Q-WoBM/edit?usp=sharing; https://github.com/sgr-xd/CVEs/blob/main/CVE-2024-6267.md; https://vuldb.com/?ctiid.269479
CVE: CVE-2024-6268
Published: 2024-06-23
Description: A vulnerability, which was classified as critical, has been found in lahirudanushka School Management System 1.0.0/1.0.1. Affected by this issue is some unknown functionality of the file login.php of the component Login Page. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-269480.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/lahirudanushka/School-Management-System---PHP-MySQL/issues/2; https://powerful-bulb-c36.notion.site/SQL-injection-to-authorization-bypass-af95fa2c72b84b4297e3d61c17cd7cdb?pvs=4; https://vuldb.com/?ctiid.269480
CVE: CVE-2024-6269
Published: 2024-06-23
Description: A vulnerability has been found in Ruijie RG-UAC 1.0 and classified as critical. This vulnerability affects the function get_ip.addr_details of the file /view/vpn/autovpn/sxh_vpnlic.php of the component HTTP POST Request Handler. The manipulation of the argument indevice leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-269482 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-77
References: https://github.com/charliecatsec/cve1/issues/1; https://vuldb.com/?ctiid.269482; https://vuldb.com/?id.269482
CVE: CVE-2024-4841
Published: 2024-06-23
Description: A Path Traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'add_reference_to_local_mode' function due to the lack of input sanitization. This vulnerability affects versions v9.6 to the latest. By exploiting this vulnerability, an attacker can predict the folders, subfolders, and files present on the victim's computer. The vulnerability is present in the way the application handles the 'path' parameter in HTTP requests to the '/add_reference_to_local_model' endpoint.
CVSS Score: 3.3 (LOW)
CWE: CWE-29
References: https://huntr.com/bounties/740dda3e-7104-4ccf-9ac4-8870e4d6d602; https://huntr.com/bounties/740dda3e-7104-4ccf-9ac4-8870e4d6d602