deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-9355
Published: 2024-10-01
Description: A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.  It is also possible to force a derived key to be all zeros instead of an unpredictable value.  This may have follow-on implications for the Go TLS stack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-457
References: https://access.redhat.com/errata/RHSA-2024:10133; https://access.redhat.com/errata/RHSA-2024:7502; https://access.redhat.com/errata/RHSA-2024:7550
CVE: CVE-2024-45999
Published: 2024-10-01
Description: A SQL Injection vulnerability was discovered in Cloudlog 2.6.15, specifically within the get_station_info()function located in the file /application/models/Oqrs_model.php. The vulnerability is exploitable via the station_id parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://chiggerlor.substack.com/p/cve-2024-45999
CVE: CVE-2024-9411
Published: 2024-10-01
Description: A vulnerability classified as problematic has been found in OFCMS 1.1.2. This affects the function add of the file /admin/system/dict/add.json?sqlid=system.dict.save. The manipulation of the argument dict_value leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://gitee.com/oufu/ofcms/issues/IATECW; https://vuldb.com/?ctiid.278973; https://vuldb.com/?id.278973
CVE: CVE-2024-46080
Published: 2024-10-01
Description: Scriptcase v9.10.023 and before is vulnerable to Remote Code Execution (RCE) via the nm_zip function.
CVSS Score: 8.0 (HIGH)
CWE: CWE-94
References: https://blog.hawktesters.com/zero-day-alert-scriptcase-vulnerabilities-rce/
CVE: CVE-2024-46082
Published: 2024-10-01
Description: Scriptcase v.9.10.023 and before is vulnerable to Cross Site Scripting (XSS) in nm_cor.php via the form and field parameters.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://blog.hawktesters.com/zero-day-alert-scriptcase-vulnerabilities-rce/; https://blog.hawktesters.com/zero-day-alert-scriptcase-vulnerabilities-xss/
CVE: CVE-2024-46084
Published: 2024-10-01
Description: Scriptcase 9.10.023 and before is vulnerable to Remote Code Execution (RCE) via the nm_unzip function.
CVSS Score: 8.0 (HIGH)
CWE: CWE-77
References: http://scriptcase.com; https://blog.hawktesters.com/zero-day-alert-scriptcase-vulnerabilities-rce/
CVE: CVE-2024-47523
Published: 2024-10-01
Description: LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Alert Transports" feature allows authenticated users to inject arbitrary JavaScript through the "Details" section (which contains multiple fields depending on which transport is selected at that moment). This vulnerability can lead to the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and allowing unauthorized actions. This vulnerability is fixed in 24.9.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79
References: https://github.com/librenms/librenms/blob/[PII_REDACTED]c793ed0a3306d0464b[PII_REDACTED]7b/includes/html/print-alert-transports.php#L40; https://github.com/librenms/librenms/commit/ee1afba003d33667981e098c83295f599d88439c; https://github.com/librenms/librenms/security/advisories/GHSA-7f84-28qh-9486
CVE: CVE-2024-47524
Published: 2024-10-01
Description: LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. User with Admin role can create a Device Groups, the application did not properly sanitize the user input in the Device Groups name, when user see the detail of the Device Group, if java script code is inside the name of the Device Groups, its will be trigger. This vulnerability is fixed in 24.9.0.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/librenms/librenms/commit/d3b51560a8e2343e520d16e9adc72c6951aa91ee; https://github.com/librenms/librenms/security/advisories/GHSA-fc38-2254-48g7
CVE: CVE-2024-47525
Published: 2024-10-01
Description: LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Alert Rules" feature allows authenticated users to inject arbitrary JavaScript through the "Title" field. This vulnerability can lead to the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and allowing unauthorized actions. This vulnerability is fixed in 24.9.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79
References: https://github.com/librenms/librenms/blob/9455173edce6971777cf6666d540eeeaf6201920/includes/html/print-alert-rules.php#L405; https://github.com/librenms/librenms/commit/7620d220e48563938d869da7689b8ac3f7721490; https://github.com/librenms/librenms/security/advisories/GHSA-j2j9-7pr6-xqwv
CVE: CVE-2024-47526
Published: 2024-10-01
Description: LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Self Cross-Site Scripting (Self-XSS) vulnerability in the "Alert Templates" feature allows users to inject arbitrary JavaScript into the alert template's name. This script executes immediately upon submission but does not persist after a page refresh.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/librenms/librenms/blob/0e741e365aa974a74aee6b43d1b4b759158a5c7e/includes/html/forms/alert-templates.inc.php#L40; https://github.com/librenms/librenms/blob/0e741e365aa974a74aee6b43d1b4b759158a5c7e/includes/html/modal/alert_template.inc.php#L205; https://github.com/librenms/librenms/commit/f259edc19b9f0ccca484c60b1ba70a0bfff97ef5
CVE: CVE-2024-47527
Published: 2024-10-01
Description: LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Device Dependencies" feature allows authenticated users to inject arbitrary JavaScript through the device name ("hostname" parameter). This vulnerability can lead to the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and allowing unauthorized actions. This vulnerability is fixed in 24.9.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79
References: https://github.com/librenms/librenms/commit/36b38a50cc10d4ed16caab92bdc18ed6abac9685; https://github.com/librenms/librenms/security/advisories/GHSA-rwwc-2v8q-gc9v
CVE: CVE-2024-47528
Published: 2024-10-01
Description: LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Stored Cross-Site Scripting (XSS) can be achieved by uploading a new Background for a Custom Map. Users with "admin" role can set background for a custom map, this allow the upload of SVG file that can contain XSS payload which will trigger on load. This led to Stored Cross-Site Scripting (XSS). The vulnerability is fixed in 24.9.0.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-116, CWE-434
References: https://github.com/librenms/librenms/commit/d959bf1b366319eda16e3cd6dfda8a22beb203be; https://github.com/librenms/librenms/security/advisories/GHSA-x8gm-j36p-fppf
CVE: CVE-2024-47609
Published: 2024-10-01
Description: Tonic is a native gRPC client & server implementation with async/await support. When using tonic::transport::Server there is a remote DoS attack that can cause the server to exit cleanly on accepting a TCP/TLS stream. This can be triggered by causing the accept call to error out with errors that were not covered correctly causing the accept loop to exit. Upgrading to tonic 0.12.3 and above contains the fix.
CWE: CWE-755
References: https://github.com/hyperium/tonic/commit/a4472a86f3290e60c7c01348b7e6a8164d6e7e48; https://github.com/hyperium/tonic/issues/1897; https://github.com/hyperium/tonic/security/advisories/GHSA-4jwc-w2hc-78qv
CVE: CVE-2024-9407
Published: 2024-10-01
Description: A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-20
References: https://access.redhat.com/errata/RHSA-2024:10147; https://access.redhat.com/errata/RHSA-2024:8846; https://access.redhat.com/errata/RHSA-2024:9051
CVE: CVE-2024-21530
Published: 2024-10-02
Description: Versions of the package cocoon before 0.4.0 are vulnerable to Reusing a Nonce, Key Pair in Encryption when the encrypt, wrap, and dump functions are sequentially called. An attacker can generate the same ciphertext by creating a new encrypted message with the same cocoon object.**Note:**The issue does NOT affect objects created with Cocoon::new which utilizes ThreadRng.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-323
References: https://github.com/advisories/GHSA-6878-6wc2-pf5h; https://github.com/fadeevab/cocoon/commit/1b6392173ce35db4736a94b62b2d2973f9a71441; https://github.com/fadeevab/cocoon/issues/22
CVE: CVE-2024-33662
Published: 2024-10-02
Description: Portainer before 2.20.2 improperly uses an encryption algorithm in the AesEncrypt function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: https://github.com/portainer/portainer/compare/2.20.1...2.20.2; https://github.com/portainer/portainer/issues/11737; https://www.portainer.io
CVE: CVE-2024-45186
Published: 2024-10-02
Description: FileSender before 2.49 allows server-side template injection (SSTI) for retrieving credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://filesender.org/vulnerability-in-filesender-versions-below-2-49-and-3-x-beta/
CVE: CVE-2024-7855
Published: 2024-10-02
Description: The WP Hotel Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_review() function in all versions up to, and including, 2.1.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/browser/wp-hotel-booking/trunk/includes/class-wphb-comments.php#L150; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3157905%40wp-hotel-booking&new=3157905%40wp-hotel-booking&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/784593ec-b635-4f59-9afb-ab506f786d21?source=cve
CVE: CVE-2024-7315
Published: 2024-10-02
Description: The Migration, Backup, Staging  WordPress plugin before 0.9.106 does not use sufficient randomness in the filename that is created when generating a backup, which could be bruteforced by attackers to leak sensitive information about said backups.
CVSS Score: 7.5 (HIGH)
CWE: CWE-338
References: https://wpscan.com/vulnerability/456b728b-a451-4afb-895f-850ddc4fb589/
CVE: CVE-2024-9174
Published: 2024-10-02
Description: Stored HTML Injection in Social Module in M-Files Hubshare before version 5.0.8.6 allows authenticated user to spoof UI
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://empower.m-files.com/security-advisories/CVE-2024-9174; https://product.m-files.com/security-advisories/cve-2024-9174/
CVE: CVE-2024-9333
Published: 2024-10-02
Description: Permissions bypass in M-Files Connector for Copilot before version 24.9.3 allows authenticated user to access limited amount of documents via incorrect access control list calculation
CWE: CWE-281
References: https://empower.m-files.com/security-advisories/CVE-2024-9333; https://product.m-files.com/security-advisories/cve-2024-9333/
CVE: CVE-2024-8254
Published: 2024-10-02
Description: The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.7.34. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-94
References: https://plugins.trac.wordpress.org/browser/email-subscribers/tags/5.7.29/lite/includes/class-es-common.php#L244; https://plugins.trac.wordpress.org/changeset/3157336/; https://www.wordfence.com/threat-intel/vulnerabilities/id/7d4ae4a7-aec1-4cc1-bea0-61dde44027fc?source=cve
CVE: CVE-2024-8800
Published: 2024-10-02
Description: The RabbitLoader – Website Speed Optimization for improving Core Web Vital metrics with Cache, Image Optimization, and more plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.21.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/rabbit-loader/tags/2.21.0/inc/tab_init.php#L86; https://plugins.trac.wordpress.org/changeset/3160267/; https://www.wordfence.com/threat-intel/vulnerabilities/id/ba435b26-a6f1-41cf-acb8-fffd8a18fea7?source=cve
CVE: CVE-2024-8967
Published: 2024-10-02
Description: The PWA — easy way to Progressive Web App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/iworks-pwa/trunk/includes/iworks/class-iworks-svg.php#L16; https://plugins.trac.wordpress.org/changeset/3161056/; https://wordpress.org/plugins/iworks-pwa/#developers
CVE: CVE-2024-9172
Published: 2024-10-02
Description: The Demo Importer Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/demo-importer-plus/trunk/inc/importers/wxr-importer/class-demo-importer-plus-wxr-importer.php#L331; https://plugins.trac.wordpress.org/changeset/3160715/; https://wordpress.org/plugins/demo-importer-plus/#description
CVE: CVE-2024-9210
Published: 2024-10-02
Description: The MC4WP: Mailchimp Top Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.6.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/mailchimp-top-bar/tags/1.6.0/views/settings-page.php#L40; https://plugins.trac.wordpress.org/browser/mailchimp-top-bar/tags/1.6.1/views/settings-page.php#L40; https://www.wordfence.com/threat-intel/vulnerabilities/id/b45ba98f-4cd1-406a-8661-e19d5b4c3ba8?source=cve
CVE: CVE-2024-9222
Published: 2024-10-02
Description: The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.12.8. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/paid-member-subscriptions/tags/2.12.8/includes/admin/class-admin-payments-list-table.php#L155; https://plugins.trac.wordpress.org/changeset/3160323/#file10; https://www.wordfence.com/threat-intel/vulnerabilities/id/6d43235b-9c5e-4d7f-99f0-28dcab4b2a91?source=cve
CVE: CVE-2024-9225
Published: 2024-10-02
Description: The SEOPress – On-site SEO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 8.1.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-seopress/tags/8.1.1/inc/admin/wizard/admin-wizard.php#L286; https://plugins.trac.wordpress.org/changeset/3159928/wp-seopress/trunk/inc/admin/wizard/admin-wizard.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/4e648f65-3eeb-405d-b243-26354f3843c8?source=cve
CVE: CVE-2024-9218
Published: 2024-10-02
Description: The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.3.14. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/magazine-blocks/tags/1.3.14/includes/Blocks.php#L334; https://plugins.trac.wordpress.org/changeset/3161000/#file13; https://www.wordfence.com/threat-intel/vulnerabilities/id/e4c27225-f9db-4ae5-bb1f-ce8648c216eb?source=cve
CVE: CVE-2024-9344
Published: 2024-10-02
Description: The BerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/searchpro/trunk/simplehtmldom/example/scraping/example_scraping_general.php?rev=3138385; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3160806%40searchpro&new=3160806%40searchpro&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/01d5e5b5-033c-4690-9857-3339e2831340?source=cve
CVE: CVE-2024-9378
Published: 2024-10-02
Description: The YML for Yandex Market plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 4.7.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/yml-for-yandex-market/tags/4.7.2/classes/system/pages/settings-page/class-y4ym-settings-page-feeds-wp-list-table.php#L311; https://plugins.trac.wordpress.org/changeset/3160483/yml-for-yandex-market/trunk/classes/system/pages/settings-page/class-y4ym-settings-page-feeds-wp-list-table.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/a463c5be-13d9-45d8-b43e-54ab188c151a?source=cve
CVE: CVE-2024-35293
Published: 2024-10-02
Description: An unauthenticated remote attacker may use a missing authentication for critical function vulnerability to reboot or erase the affected devices resulting in data loss and/or a DoS.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-306
References: https://www.schneider-elektronik.de/wp-content/uploads/2024/07/SAR-202405-1.pdf
CVE: CVE-2024-44017
Published: 2024-10-02
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in MinHyeong Lim MH Board mh-board allows PHP Local File Inclusion.This issue affects MH Board: from n/a through <= 1.3.2.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/mh-board/vulnerability/wordpress-mh-board-plugin-1-3-2-1-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-44030
Published: 2024-10-02
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mestres do WP Checkout Mestres WP checkout-mestres-wp allows Absolute Path Traversal.This issue affects Checkout Mestres WP: from n/a through <= 8.6.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/checkout-mestres-wp/vulnerability/wordpress-checkout-mestres-wp-plugin-8-6-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-8282
Published: 2024-10-02
Description: The Ibtana – WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ attribute within the 'wp:ive/ive-productscarousel' Gutenberg block in all versions up to, and including, 1.2.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/ibtana-visual-editor/trunk/dist/blocks.build.js; https://plugins.trac.wordpress.org/changeset/3160421/; https://wordpress.org/plugins/ibtana-visual-editor/#developers
CVE: CVE-2024-8505
Published: 2024-10-02
Description: The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘button_label’ parameter in all versions up to, and including, 7.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-87, CWE-79
References: https://plugins.trac.wordpress.org/browser/ajax-load-more/trunk/core/classes/class-alm-shortcode.php; https://plugins.trac.wordpress.org/changeset/3160896/; https://wordpress.org/plugins/ajax-load-more/#developers
CVE: CVE-2024-35294
Published: 2024-10-02
Description: An unauthenticated remote attacker may use the devices traffic capture without authentication to grab plaintext administrative credentials.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-306
References: https://www.schneider-elektronik.de/wp-content/uploads/2024/07/SAR-202405-2.pdf