deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-3084
Published: 2024-03-30
Description: A vulnerability was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. It has been rated as problematic. This issue affects some unknown processing of the component Hire an Ambulance Page. The manipulation of the argument Patient Name/Relative Name/Relative Phone Number/City/State/Message leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258677 was assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/eahp_sxss.md; https://vuldb.com/?ctiid.258677; https://vuldb.com/?id.258677
CVE: CVE-2024-3085
Published: 2024-03-30
Description: A vulnerability classified as critical has been found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. Affected is an unknown function of the file /admin/login.php of the component Admin Login Page. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-258678 is the identifier assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/eahp_sqli.md; https://vuldb.com/?ctiid.258678; https://vuldb.com/?id.258678
CVE: CVE-2024-3086
Published: 2024-03-30
Description: A vulnerability classified as problematic was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. Affected by this vulnerability is an unknown functionality of the file ambulance-tracking.php of the component Ambulance Tracking Page. The manipulation of the argument searchdata leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258679.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/eahp_rxss.md; https://vuldb.com/?ctiid.258679; https://vuldb.com/?id.258679
CVE: CVE-2024-2491
Published: 2024-03-30
Description: The PowerPack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the *_html_tag* attribute of multiple widgets in all versions up to, and including, 2.7.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3053463/powerpack-lite-for-elementor; https://www.wordfence.com/threat-intel/vulnerabilities/id/22c4b981-6135-4c44-aa68-f0d51704a68c?source=cve; https://plugins.trac.wordpress.org/changeset/3053463/powerpack-lite-for-elementor
CVE: CVE-2024-3087
Published: 2024-03-30
Description: A vulnerability, which was classified as critical, has been found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. Affected by this issue is some unknown functionality of the file ambulance-tracking.php of the component Ambulance Tracking Page. The manipulation of the argument searchdata leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258680.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/eahp_rce.md; https://vuldb.com/?ctiid.258680; https://vuldb.com/?id.258680
CVE: CVE-2024-3088
Published: 2024-03-30
Description: A vulnerability, which was classified as critical, was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. This affects an unknown part of the file /admin/forgot-password.php of the component Forgot Password Page. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258681 was assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/eahp_forgotpasssqli.md; https://vuldb.com/?ctiid.258681; https://vuldb.com/?id.258681
CVE: CVE-2024-3018
Published: 2024-03-30
Description: The Essential Addons for Elementor plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.9.13 via deserialization of untrusted input from the 'error_resetpassword' attribute of the "Login | Register Form" widget (disabled by default). This makes it possible for authenticated attackers, with author-level access and above, to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://plugins.trac.wordpress.org/changeset/3060417/essential-addons-for-elementor-lite; https://www.wordfence.com/threat-intel/vulnerabilities/id/342049e5-834e-4867-8174-01ca7bb0caa2?source=cve; https://plugins.trac.wordpress.org/changeset/3060417/essential-addons-for-elementor-lite
CVE: CVE-2024-3089
Published: 2024-03-30
Description: A vulnerability has been found in PHPGurukul Emergency Ambulance Hiring Portal 1.0 and classified as problematic. This vulnerability affects unknown code of the file /admin/manage-ambulance.php of the component Manage Ambulance Page. The manipulation of the argument del leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-258682 is the identifier assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/eahp_csrf.md; https://vuldb.com/?ctiid.258682; https://vuldb.com/?id.258682
CVE: CVE-2024-3090
Published: 2024-03-30
Description: A vulnerability was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0 and classified as problematic. This issue affects some unknown processing of the file /admin/add-ambulance.php of the component Add Ambulance Page. The manipulation of the argument Ambulance Reg No/Driver Name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258683.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/eahp_authsxss.md; https://vuldb.com/?ctiid.258683; https://vuldb.com/?id.258683
CVE: CVE-2024-3091
Published: 2024-03-30
Description: A vulnerability was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. It has been classified as problematic. Affected is an unknown function of the file /admin/search.php of the component Search Request Page. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258684.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/eahp_authrxss.md; https://vuldb.com/?ctiid.258684; https://vuldb.com/?id.258684
CVE: CVE-2024-1522
Published: 2024-03-30
Description: A Cross-Site Request Forgery (CSRF) vulnerability in the parisneo/lollms-webui project allows remote attackers to execute arbitrary code on a victim's system. The vulnerability stems from the `/execute_code` API endpoint, which does not properly validate requests, enabling an attacker to craft a malicious webpage that, when visited by a victim, submits a form to the victim's local lollms-webui instance to execute arbitrary OS commands. This issue allows attackers to take full control of the victim's system without requiring direct network access to the vulnerable application.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/parisneo/lollms-webui/commit/0b51063119cfb5e391925d232a4af1de9dc32e2b; https://huntr.com/bounties/687cef92-3432-4d6c-af92-868eccabbb71; https://github.com/parisneo/lollms-webui/commit/0b51063119cfb5e391925d232a4af1de9dc32e2b
CVE: CVE-2023-41724
Published: 2024-03-31
Description: A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute arbitrary commands on the underlying operating system of the appliance within the same physical or logical network. 
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-94
References: https://forums.ivanti.com/s/article/CVE-2023-41724-Remote-Code-Execution-for-Ivanti-Standalone-Sentry; https://forums.ivanti.com/s/article/CVE-2023-41724-Remote-Code-Execution-for-Ivanti-Standalone-Sentry
CVE: CVE-2023-46808
Published: 2024-03-31
Description: An file upload vulnerability in Ivanti ITSM before 2023.4, allows an authenticated remote user to perform file writes to the server. Successful exploitation may lead to execution of commands in the context of non-root user. 
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://forums.ivanti.com/s/article/SA-CVE-2023-46808-Authenticated-Remote-File-Write-for-Ivanti-Neurons-for-ITSM; https://forums.ivanti.com/s/article/SA-CVE-2023-46808-Authenticated-Remote-File-Write-for-Ivanti-Neurons-for-ITSM
CVE: CVE-2024-3117
Published: 2024-03-31
Description: A vulnerability classified as critical was found in YouDianCMS up to 9.5.12. This vulnerability affects unknown code of the file App\Lib\Action\Admin\ChannelAction.class.php. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-258778 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-434
References: https://github.com/Luci4n555/CVE-Report/blob/main/YouDianCMS9.5.12.md; https://vuldb.com/?ctiid.258778; https://vuldb.com/?id.258778
CVE: CVE-2024-3118
Published: 2024-03-31
Description: A vulnerability, which was classified as critical, has been found in Dreamer CMS up to 4.1.3. This issue affects some unknown processing of the component Attachment Handler. The manipulation leads to permission issues. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258779. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-275
References: https://github.com/sweatxi/BugHub/blob/main/dreamer_Excessive_authority.pdf; https://vuldb.com/?ctiid.258779; https://vuldb.com/?id.258779
CVE: CVE-2015-10131
Published: 2024-03-31
Description: A vulnerability was found in chrisy TFO Graphviz Plugin up to 1.9 on WordPress and classified as problematic. Affected by this issue is the function admin_page_load/admin_page of the file tfo-graphviz-admin.php. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.10 is able to address this issue. The name of the patch is 594c953a345f79e[PII_REDACTED]3b0caafc14b92c2. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-258620.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/wp-plugins/tfo-graphviz/commit/594c953a345f79e[PII_REDACTED]3b0caafc14b92c2; https://github.com/wp-plugins/tfo-graphviz/releases/tag/1.10; https://vuldb.com/?ctiid.258620
CVE: CVE-2017-20191
Published: 2024-03-31
Description: A vulnerability was found in Zimbra zm-admin-ajax up to 8.8.1. It has been classified as problematic. This affects the function XFormItem.prototype.setError of the file WebRoot/js/ajax/dwt/xforms/XFormItem.js of the component Form Textbox Field Error Handler. The manipulation of the argument message leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 8.8.2 is able to address this issue. The identifier of the patch is bb240ce0c71c01caabaa43eed30c78ba8d7d3591. It is recommended to upgrade the affected component. The identifier VDB-258621 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/Zimbra/zm-admin-ajax/commit/bb240ce0c71c01caabaa43eed30c78ba8d7d3591; https://github.com/Zimbra/zm-admin-ajax/releases/tag/8.8.2; https://vuldb.com/?ctiid.258621
CVE: CVE-2020-36828
Published: 2024-03-31
Description: A vulnerability was found in DiscuzX up to 3.4-20200818. It has been classified as problematic. Affected is the function show_next_step of the file upload/install/include/install_function.php. The manipulation of the argument uchidden leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 3.4-20210119 is able to address this issue. The name of the patch is 4a9673624f46f[PII_REDACTED]ded[PII_REDACTED]c567. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-258612.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/codersclub/DiscuzX/commit/4a9673624f46f[PII_REDACTED]ded[PII_REDACTED]c567; https://vuldb.com/?ctiid.258612; https://vuldb.com/?id.258612
CVE: CVE-2023-50311
Published: 2024-03-31
Description: IBM CICS Transaction Gateway for Multiplatforms 9.2 and 9.3 could disclose sensitive path information to an attacker that could reveal through debugging or error messages.
CVSS Score: 3.1 (LOW)
CWE: CWE-522
References: https://https://www.ibm.com/support/pages/node/7145418; https://exchange.xforce.ibmcloud.com/vulnerabilities/273612; https://https://www.ibm.com/support/pages/node/7145418
CVE: CVE-2023-50959
Published: 2024-03-31
Description: IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2,19.0.1, 19.0.2, 19.0.3,20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1,2 2.0.2, 23.0.1, and 23.0.2 may allow end users to query more documents than expected from a connected Enterprise Content Management system when configured to use a system account.  IBM X-Force ID:  275938.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-497
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/275938; https://www.ibm.com/support/pages/node/7145492; https://exchange.xforce.ibmcloud.com/vulnerabilities/275938
CVE: CVE-2024-22353
Published: 2024-03-31
Description: IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.4 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.  IBM X-Force ID:  280400.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-770
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/280400; https://www.ibm.com/support/pages/node/7145365; https://exchange.xforce.ibmcloud.com/vulnerabilities/280400
CVE: CVE-2024-25027
Published: 2024-03-31
Description: IBM Security Verify Access 10.0.6 could disclose sensitive snapshot information due to missing encryption.  IBM X-Force ID:  281607.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-311
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/281607; https://www.ibm.com/support/pages/node/7145400; http://seclists.org/fulldisclosure/2024/Nov/0
CVE: CVE-2024-31094
Published: 2024-03-31
Description: Deserialization of Untrusted Data vulnerability in Filter Custom Fields & Taxonomies Light.This issue affects Filter Custom Fields & Taxonomies Light: from n/a through 1.05.
CVSS Score: 8.5 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/vulnerability/filter-custom-fields-taxonomies-light/wordpress-filter-custom-fields-taxonomies-light-plugin-1-05-php-object-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/filter-custom-fields-taxonomies-light/wordpress-filter-custom-fields-taxonomies-light-plugin-1-05-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2024-31114
Published: 2024-03-31
Description: Unrestricted Upload of File with Dangerous Type vulnerability in biplob018 Shortcode Addons.This issue affects Shortcode Addons: from n/a through 3.2.5.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/shortcode-addons/wordpress-shortcode-addons-3-2-5-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/shortcode-addons/wordpress-shortcode-addons-3-2-5-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-31115
Published: 2024-03-31
Description: Unrestricted Upload of File with Dangerous Type vulnerability in QuanticaLabs Chauffeur Taxi Booking System for WordPress.This issue affects Chauffeur Taxi Booking System for WordPress: from n/a through 7.2.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/chauffeur-booking-system/wordpress-chauffeur-taxi-booking-system-for-wordpress-plugin-6-9-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/chauffeur-booking-system/wordpress-chauffeur-taxi-booking-system-for-wordpress-plugin-6-9-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-30489
Published: 2024-03-31
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in loopus WP Cost Estimation & Payment Forms Builder.This issue affects WP Cost Estimation & Payment Forms Builder: from n/a through 10.1.75.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/wp-estimation-form/wordpress-wp-cost-estimation-payment-forms-builder-plugin-10-1-75-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-estimation-form/wordpress-wp-cost-estimation-payment-forms-builder-plugin-10-1-75-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-30523
Published: 2024-03-31
Description: Insertion of Sensitive Information into Log File vulnerability in Paid Memberships Pro Paid Memberships Pro – Mailchimp Add On pmpro-mailchimp.This issue affects Paid Memberships Pro – Mailchimp Add On: from n/a through 2.3.4.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-532
References: https://patchstack.com/database/vulnerability/pmpro-mailchimp/wordpress-paid-memberships-pro-mailchimp-add-on-plugin-2-3-4-sensitive-data-exposure-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/pmpro-mailchimp/wordpress-paid-memberships-pro-mailchimp-add-on-plugin-2-3-4-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2024-30526
Published: 2024-03-31
Description: Cross-Site Request Forgery (CSRF) vulnerability in Easy Social Feed.This issue affects Easy Social Feed: from n/a through 6.5.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/easy-facebook-likebox/wordpress-easy-social-feed-social-photos-gallery-post-feed-like-box-plugin-6-5-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/easy-facebook-likebox/wordpress-easy-social-feed-social-photos-gallery-post-feed-like-box-plugin-6-5-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-30533
Published: 2024-03-31
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Techeshta Layouts for Elementor.This issue affects Layouts for Elementor: from n/a before 1.8.
CVSS Score: 7.5 (HIGH)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/layouts-for-elementor/wordpress-layouts-for-elementor-plugin-1-8-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/layouts-for-elementor/wordpress-layouts-for-elementor-plugin-1-8-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-30535
Published: 2024-03-31
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WhiteStudio Easy Form Builder.This issue affects Easy Form Builder: from n/a through 3.7.4.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/easy-form-builder/wordpress-easy-form-builder-plugin-3-7-4-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/easy-form-builder/wordpress-easy-form-builder-plugin-3-7-4-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-30536
Published: 2024-03-31
Description: Cross-Site Request Forgery (CSRF) vulnerability in WPFactory Slugs Manager.This issue affects Slugs Manager: from n/a through 2.6.7.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/remove-old-slugspermalinks/wordpress-slugs-manager-plugin-2-6-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/remove-old-slugspermalinks/wordpress-slugs-manager-plugin-2-6-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-30541
Published: 2024-03-31
Description: Cross-Site Request Forgery (CSRF) vulnerability in LWS LWS Optimize.This issue affects LWS Optimize: from n/a through 1.9.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/lws-optimize/wordpress-lws-optimize-plugin-1-9-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/lws-optimize/wordpress-lws-optimize-plugin-1-9-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-30543
Published: 2024-03-31
Description: Authorization Bypass Through User-Controlled Key vulnerability in UPQODE Whizz.This issue affects Whizzy: from n/a through 1.1.18.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://patchstack.com/database/vulnerability/whizzy/wordpress-whizzy-plugin-1-1-18-insecure-direct-object-references-idor-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/whizzy/wordpress-whizzy-plugin-1-1-18-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE: CVE-2024-31095
Published: 2024-03-31
Description: Authorization Bypass Through User-Controlled Key vulnerability in Ricard Torres Thumbs Rating.This issue affects Thumbs Rating: from n/a through 5.1.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://patchstack.com/database/vulnerability/thumbs-rating/wordpress-thumbs-rating-plugin-5-1-0-insecure-direct-object-references-idor-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/thumbs-rating/wordpress-thumbs-rating-plugin-5-1-0-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE: CVE-2024-31096
Published: 2024-03-31
Description: Cross-Site Request Forgery (CSRF) vulnerability in kopatheme Nictitate.This issue affects Nictitate: from n/a through 1.1.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/nictitate/wordpress-nictitate-theme-1-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/nictitate/wordpress-nictitate-theme-1-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-31100
Published: 2024-03-31
Description: Cross-Site Request Forgery (CSRF) vulnerability in Festi-Team Popup Cart Lite for WooCommerce.This issue affects Popup Cart Lite for WooCommerce: from n/a through 1.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/woocommerce-woocart-popup-lite/wordpress-popup-cart-lite-for-woocommerce-plugin-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-woocart-popup-lite/wordpress-popup-cart-lite-for-woocommerce-plugin-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve