deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-53268
Published: 2024-11-25
Description: Joplin is an open source, privacy-focused note taking app with sync capabilities for Windows, macOS, Linux, Android and iOS. In affected versions attackers are able to abuse the fact that openExternal is used without any filtering of URI schemes to obtain remote code execution in Windows environments. This issue has been addressed in version 3.0.3 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://github.com/laurent22/joplin/security/advisories/GHSA-pc5v-xp44-5mgv
CVE: CVE-2024-50671
Published: 2024-11-25
Description: Incorrect access control in Adapt Learning Adapt Authoring Tool <= 0.11.3 allows attackers with Authenticated User roles to obtain email addresses via the "Get users" feature. The vulnerability occurs due to a flaw in permission verification logic, where the wildcard character in permitted URLs grants unintended access to endpoints restricted to users with Super Admin roles. This makes it possible for attackers to disclose the email addresses of all users.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://github.com/adaptlearning/adapt_authoring; https://github.com/dos-m0nk3y/CVE/tree/main/CVE-2024-50671
CVE: CVE-2024-50672
Published: 2024-11-25
Description: A NoSQL injection vulnerability in Adapt Learning Adapt Authoring Tool <= 0.11.3 allows unauthenticated attackers to reset user and administrator account passwords via the "Reset password" feature. The vulnerability occurs due to insufficient validation of user input, which is used as a query in Mongoose's find() function. This makes it possible for attackers to perform a full takeover of the administrator account. Attackers can then use the newly gained administrative privileges to upload a custom plugin to perform remote code execution (RCE) on the server hosting the web application.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/adaptlearning/adapt_authoring; https://github.com/dos-m0nk3y/CVE/tree/main/CVE-2024-50672
CVE: CVE-2024-53556
Published: 2024-11-25
Description: An Open Redirect vulnerability in Taiga v6.8.1 allows attackers to redirect users to arbitrary websites via appending a crafted link to /login?next= in the login page URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://drive.google.com/file/d/1CIr8oHSF4JaqOn51wIhyZyvsCtlX0Q_e/view?usp=drive_link; https://gist.githubusercontent.com/Tommywarren/b42479a048aa8ef11a63a76d14403443/raw/e24c1003accf8daf2e840b7c67d2f0ab30bdd3e6/CVE-2024-53556
CVE: CVE-2024-53096
Published: 2024-11-25
Description: In the Linux kernel, the following vulnerability has been resolved:

mm: resolve faulty mmap_region() error path behaviour

The mmap_region() function is somewhat terrifying, with spaghetti-like
control flow and numerous means by which issues can arise and incomplete
state, memory leaks and other unpleasantness can occur.

A large amount of the complexity arises from trying to handle errors late
in the process of mapping a VMA, which forms the basis of recently
observed issues with resource leaks and observable inconsistent state.

Taking advantage of previous patches in this series we move a number of
checks earlier in the code, simplifying things by moving the core of the
logic into a static internal function __mmap_region().

Doing this allows us to perform a number of checks up front before we do
any real work, and allows us to unwind the writable unmap check
unconditionally as required and to perform a CONFIG_DEBUG_VM_MAPLE_TREE
validation unconditionally also.

We move a number of things here:

1. We preallocate memory for the iterator before we call the file-backed
   memory hook, allowing us to exit early and avoid having to perform
   complicated and error-prone close/free logic. We carefully free
   iterator state on both success and error paths.

2. The enclosing mmap_region() function handles the mapping_map_writable()
   logic early. Previously the logic had the mapping_map_writable() at the
   point of mapping a newly allocated file-backed VMA, and a matching
   mapping_unmap_writable() on success and error paths.

   We now do this unconditionally if this is a file-backed, shared writable
   mapping. If a driver changes the flags to eliminate VM_MAYWRITE, however
   doing so does not invalidate the seal check we just performed, and we in
   any case always decrement the counter in the wrapper.

   We perform a debug assert to ensure a driver does not attempt to do the
   opposite.

3. We also move arch_validate_flags() up into the mmap_region()
   function. This is only relevant on arm64 and sparc64, and the check is
   only meaningful for SPARC with ADI enabled. We explicitly add a warning
   for this arch if a driver invalidates this check, though the code ought
   eventually to be fixed to eliminate the need for this.

With all of these measures in place, we no longer need to explicitly close
the VMA on error paths, as we place all checks which might fail prior to a
call to any driver mmap hook.

This eliminates an entire class of errors, makes the code easier to reason
about and more robust.
CVSS Score: 7.8 (HIGH)
References: https://git.kernel.org/stable/c/43323a4e5b3f8ccc08e2f835abfdc7ee9da8f6ed; https://git.kernel.org/stable/c/44f48eb9a[PII_REDACTED]bbd375446064fb2a43c6c; https://git.kernel.org/stable/c/52c81fd0f5a8bf8032687b94ccf00d13b44cc5c8
CVE: CVE-2024-53097
Published: 2024-11-25
Description: In the Linux kernel, the following vulnerability has been resolved:

mm: krealloc: Fix MTE false alarm in __do_krealloc

This patch addresses an issue introduced by commit 1a83a716ec233 ("mm:
krealloc: consider spare memory for __GFP_ZERO") which causes MTE
(Memory Tagging Extension) to falsely report a slab-out-of-bounds error.

The problem occurs when zeroing out spare memory in __do_krealloc. The
original code only considered software-based KASAN and did not account
for MTE. It does not reset the KASAN tag before calling memset, leading
to a mismatch between the pointer tag and the memory tag, resulting
in a false positive.

Example of the error:
==================================================================
swapper/0: BUG: KASAN: slab-out-of-bounds in __memset+0x84/0x188
swapper/0: Write at addr f4ffff8005f0fdf0 by task swapper/0/1
swapper/0: Pointer tag: [f4], memory tag: [fe]
swapper/0:
swapper/0: CPU: 4 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.
swapper/0: Hardware name: MT6991(ENG) (DT)
swapper/0: Call trace:
swapper/0:  dump_backtrace+0xfc/0x17c
swapper/0:  show_stack+0x18/0x28
swapper/0:  dump_stack_lvl+0x40/0xa0
swapper/0:  print_report+0x1b8/0x71c
swapper/0:  kasan_report+0xec/0x14c
swapper/0:  __do_kernel_fault+0x60/0x29c
swapper/0:  do_bad_area+0x30/0xdc
swapper/0:  do_tag_check_fault+0x20/0x34
swapper/0:  do_mem_abort+0x58/0x104
swapper/0:  el1_abort+0x3c/0x5c
swapper/0:  el1h_64_sync_handler+0x80/0xcc
swapper/0:  el1h_64_sync+0x68/0x6c
swapper/0:  __memset+0x84/0x188
swapper/0:  btf_populate_kfunc_set+0x280/0x3d8
swapper/0:  __register_btf_kfunc_id_set+0x43c/0x468
swapper/0:  register_btf_kfunc_id_set+0x48/0x60
swapper/0:  register_nf_nat_bpf+0x1c/0x40
swapper/0:  nf_nat_init+0xc0/0x128
swapper/0:  do_one_initcall+0x184/0x464
swapper/0:  do_initcall_level+0xdc/0x1b0
swapper/0:  do_initcalls+0x70/0xc0
swapper/0:  do_basic_setup+0x1c/0x28
swapper/0:  kernel_init_freeable+0x144/0x1b8
swapper/0:  kernel_init+0x20/0x1a8
swapper/0:  ret_from_fork+0x10/0x20
==================================================================
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/3dfb40da84f26dd35dd9bbaf626a2424565b8406; https://git.kernel.org/stable/c/486aeb5f1855c75dd810c[PII_REDACTED]1bd2a6722; https://git.kernel.org/stable/c/704573851b51808b45dae2d62059d1d8189138a2
CVE: CVE-2024-53098
Published: 2024-11-25
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/xe/ufence: Prefetch ufence addr to catch bogus address

access_ok() only checks for addr overflow so also try to read the addr
to catch invalid addr sent from userspace.

(cherry picked from commit 9408c4508483ffc60811e910a93d6425b8e63928)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://git.kernel.org/stable/c/5d623ffbae96b23f1fc43a3d5a267aabdb07583d; https://git.kernel.org/stable/c/9c1813b3253480b30604c680026c7dc721ce86d1
CVE: CVE-2024-53099
Published: 2024-11-25
Description: In the Linux kernel, the following vulnerability has been resolved:

bpf: Check validity of link->type in bpf_link_show_fdinfo()

If a newly-added link type doesn't invoke BPF_LINK_TYPE(), accessing
bpf_link_type_strs[link->type] may result in an out-of-bounds access.

To spot such missed invocations early in the future, checking the
validity of link->type in bpf_link_show_fdinfo() and emitting a warning
when such invocations are missed.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/24fec234d2ba9ca3c14e545ebe3fd6dcb47f074d; https://git.kernel.org/stable/c/4e8074bb33d18f56af30a0252cb3606d27eb1c13; https://git.kernel.org/stable/c/79f87a6ec39fb5968049a6775a528bf58b25c20a
CVE: CVE-2024-53101
Published: 2024-11-25
Description: In the Linux kernel, the following vulnerability has been resolved:

fs: Fix uninitialized value issue in from_kuid and from_kgid

ocfs2_setattr() uses attr->ia_mode, attr->ia_uid and attr->ia_gid in
a trace point even though ATTR_MODE, ATTR_UID and ATTR_GID aren't set.

Initialize all fields of newattrs to avoid uninitialized variables, by
checking if ATTR_MODE, ATTR_UID, ATTR_GID are initialized, otherwise 0.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908, CWE-908
References: https://git.kernel.org/stable/c/15f[PII_REDACTED]8a567db67fb473c23befb796af5; https://git.kernel.org/stable/c/17ecb40c5cc7755a321fb6148cba5797431ee5b8; https://git.kernel.org/stable/c/1c28bca1256aecece6e94b26b85cd07e08b0dc90
CVE: CVE-2024-53102
Published: 2024-11-25
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-53554
Published: 2024-11-25
Description: A Client-Side Template Injection (CSTI) vulnerability in the component /project/new/scrum of Taiga v 8.6.1 allows remote attackers to execute arbitrary code by injecting a malicious payload within the new project details.
CVSS Score: 8.0 (HIGH)
CWE: CWE-94
References: https://drive.google.com/file/d/1v2MLZn4Ro9TCpw-KtksUACYFIzsbuTkL/view?usp=sharing; https://gist.githubusercontent.com/Tommywarren/5ed67ab173ed60faeb791215d68e3fac/raw/352cb4259c0d41d70a206d108b5578c15824b2ff/CVE-2024-53554
CVE: CVE-2024-53597
Published: 2024-11-25
Description: masterstack_imgcap v0.0.1 was discovered to contain a SQL injection vulnerability via the endpoint /submit.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: http://masterstackimgcap.com; https://github.com/NoPurposeInLife/vulnerability_research/tree/main/CVE-2024-53597
CVE: CVE-2024-11673
Published: 2024-11-25
Description: A vulnerability, which was classified as problematic, has been found in 1000 Projects Bookstore Management System 1.0. This issue affects some unknown processing. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862, CWE-352
References: https://1000projects.org/; https://github.com/Hacker0xone/CVE/issues/16; https://vuldb.com/?ctiid.286013
CVE: CVE-2024-11674
Published: 2024-11-26
Description: A vulnerability, which was classified as critical, was found in CodeAstro Hospital Management System 1.0. Affected is an unknown function of the file /backend/doc/his_doc_update-account.php. The manipulation of the argument doc_dpic leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://codeastro.com/; https://github.com/EmilGallajov/zero-day/blob/main/codeastro_hms_rce.md; https://vuldb.com/?ctiid.286014
CVE: CVE-2024-53843
Published: 2024-11-26
Description: @dapperduckling/keycloak-connector-server is an opinionated series of libraries for Node.js applications and frontend clients to interface with keycloak. A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the authentication flow of the application. This issue arises due to improper sanitization of the URL parameters, allowing the URL bar's contents to be injected and reflected into the HTML page. An attacker could craft a malicious URL to execute arbitrary JavaScript in the browser of a victim who visits the link. Any application utilizing this authentication library is vulnerable. Users of the application are at risk if they can be lured into clicking on a crafted malicious link. The vulnerability has been patched in version 2.5.5 by ensuring proper sanitization and escaping of user input in the affected URL parameters. Users are strongly encouraged to upgrade. If upgrading is not immediately possible, users can implement the following workarounds: 1. Employ a Web Application Firewall (WAF) to block malicious requests containing suspicious URL parameters. or 2. Apply input validation and escaping directly within the application’s middleware or reverse proxy layer, specifically targeting the affected parameters.
CVSS Score: 8.1 (HIGH)
CWE: CWE-79
References: https://github.com/DapperDuckling/keycloak-connector/security/advisories/GHSA-w5rq-g9r6-vrcg
CVE: CVE-2024-11675
Published: 2024-11-26
Description: A vulnerability has been found in CodeAstro Hospital Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /backend/admin/his_admin_register_patient.php of the component Add Patient Details Page. The manipulation of the argument pat_fname/pat_ailment/pat_lname/pat_age/pat_dob/pat_number/pat_phone/pat_type/pat_addr leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://codeastro.com/; https://github.com/EmilGallajov/zero-day/blob/main/codeastro_hms_stored_xss.md; https://vuldb.com/?ctiid.286015
CVE: CVE-2024-11676
Published: 2024-11-26
Description: A vulnerability was found in CodeAstro Hospital Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /backend/admin/his_admin_add_lab_equipment.php of the component Add Laboratory Equipment Page. The manipulation of the argument eqp_code/eqp_name/eqp_vendor/eqp_desc/eqp_dept/eqp_status/eqp_qty leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://codeastro.com/; https://github.com/EmilGallajov/zero-day/blob/main/codeastro_hms_stored_xss.md; https://vuldb.com/?ctiid.286016
CVE: CVE-2024-52899
Published: 2024-11-26
Description: IBM Data Virtualization Manager for z/OS 1.1 and 1.2 could allow an authenticated user to inject malicious JDBC URL parameters and execute code on the server.
CVSS Score: 8.5 (HIGH)
CWE: CWE-94
References: https://www.ibm.com/support/pages/node/7177091
CVE: CVE-2024-10729
Published: 2024-11-26
Description: The Booking & Appointment Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_google_calendar_data' function in versions up to, and including, 6.9.0. This makes it possible for authenticated attackers, with subscriber-level permissions or above to update the site options arbitrarily.
CVSS Score: 8.8 (HIGH)
CWE: CWE-285
References: https://www.tychesoftwares.com/docs/docs/booking-appointment-plugin-for-woocommerce-new/changelog/; https://www.wordfence.com/threat-intel/vulnerabilities/id/6ed215da-10c5-469b-bab2-923808feebd4?source=cve
CVE: CVE-2024-11677
Published: 2024-11-26
Description: A vulnerability was found in CodeAstro Hospital Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /backend/admin/his_admin_add_vendor.php of the component Add Vendor Details Page. The manipulation of the argument v_name/v_adr/v_number/v_email/v_phone/v_desc leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://codeastro.com/; https://github.com/EmilGallajov/zero-day/blob/main/codeastro_hms_stored_xss.md; https://vuldb.com/?ctiid.286017
CVE: CVE-2024-11678
Published: 2024-11-26
Description: A vulnerability was found in CodeAstro Hospital Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /backend/doc/his_doc_register_patient.php. The manipulation of the argument pat_fname/pat_ailment/pat_lname/pat_age/pat_dob/pat_number/pat_phone/pat_type/pat_addr leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://codeastro.com/; https://github.com/EmilGallajov/zero-day/blob/main/codeastro_hms_stored_xss.md; https://vuldb.com/?ctiid.286018
CVE: CVE-2024-49595
Published: 2024-11-26
Description: Dell Wyse Management Suite, version WMS 4.4 and before, contain an Authentication Bypass by Capture-replay vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.
CVSS Score: 7.6 (HIGH)
CWE: CWE-294
References: https://www.dell.com/support/kbdoc/en-us/000244453/dsa-2024-440
CVE: CVE-2024-49596
Published: 2024-11-26
Description: Dell Wyse Management Suite, version WMS 4.4 and prior, contain a Missing Authorization vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service and arbitrary file deletion
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-862
References: https://www.dell.com/support/kbdoc/en-us/000244453/dsa-2024-440
CVE: CVE-2024-49597
Published: 2024-11-26
Description: Dell Wyse Management Suite, versions WMS 4.4 and prior, contain an Improper Restriction of Excessive Authentication Attempts vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass.
CVSS Score: 7.6 (HIGH)
CWE: CWE-307
References: https://www.dell.com/support/kbdoc/en-us/000244453/dsa-2024-440
CVE: CVE-2024-11342
Published: 2024-11-26
Description: The Skt NURCaptcha plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.5.0. This is due to missing or incorrect nonce validation in the skt-nurc-admin.php file. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/skt-nurcaptcha/trunk/skt-nurc-admin.php; https://plugins.trac.wordpress.org/browser/skt-nurcaptcha/trunk/skt-nurc-admin.php?rev=3195583; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3195583%40skt-nurcaptcha&new=3195583%40skt-nurcaptcha&sfp_email=&sfph_mail=
CVE: CVE-2024-11418
Published: 2024-11-26
Description: The Additional Order Filters for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shipping_method_filter' parameter in all versions up to, and including, 1.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3195214%40additional-order-filters-for-woocommerce&new=3195214%40additional-order-filters-for-woocommerce&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/d59ea96f-ad02-4189-8155-7de7de5556ba?source=cve
CVE: CVE-2024-49351
Published: 2024-11-26
Description: IBM Workload Scheduler 9.5, 10.1, and 10.2 stores user credentials in plain text which can be read by a local user.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-256
References: https://www.ibm.com/support/pages/node/7177061
CVE: CVE-2024-49353
Published: 2024-11-26
Description: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data 4.0.0 through 5.0.2 does not properly check inputs to resources that are used concurrently, which might lead to unexpected states, possibly resulting in a crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362
References: https://www.ibm.com/support/pages/node/7177065
CVE: CVE-2018-11881
Published: 2024-11-26
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. 











This CVE ID is unused and any reference to it should be ignored.
CVE: CVE-2022-33860
Published: 2024-11-26
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-43775. Reason: This record is a duplicate of CVE-2023-43775. Notes: All CVE users should reference CVE-2023-43775 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.
CVE: CVE-2024-53278
Published: 2024-11-26
Description: Cross-site scripting vulnerability exists in WP Admin UI Customize versions prior to ver 1.5.14. If a malicious admin user customizes the admin screen with some malicious contents, an arbitrary script may be executed on the web browser of the other users who are accessing the admin screen.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://gqevu6bsiz.chicappa.jp/wp-admin-ui-customize-%E3%82%A2%E3%83%83%E3%83%97%E3%83%87%E3%83%BC%E3%83%881-5-14%E3%82%92%E3%81%97%E3%81%BE%E3%81%97%E3%81%9F/; https://jvn.jp/en/jp/JVN87182660/; https://wordpress.org/plugins/wp-admin-ui-customize/#developers
CVE: CVE-2024-10471
Published: 2024-11-26
Description: The Everest Forms  WordPress plugin before 3.0.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/85d590c9-c96d-40c9-aa59-48302ba3d63c/
CVE: CVE-2024-10542
Published: 2024-11-26
Description: The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an authorization bypass via reverse DNS spoofing on the checkWithoutToken function in all versions up to, and including, 6.43.2. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/cleantalk-spam-protect/tags/6.43.2/lib/Cleantalk/ApbctWP/RemoteCalls.php#L41; https://plugins.trac.wordpress.org/changeset/3179819/cleantalk-spam-protect#file631; https://www.wordfence.com/threat-intel/vulnerabilities/id/d7eb5fad-bb62-4f0b-ad52-b16c3e442b62?source=cve