deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-20495
Published: 2024-10-23
Description: A vulnerability in the Remote Access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition on an affected device.
 This vulnerability is due to improper validation of client key data after the TLS session is established. An attacker could exploit this vulnerability by sending a crafted key value to an affected system over the secure TLS session. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.
CVSS Score: 8.6 (HIGH)
CWE: CWE-20
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-vpn-cZf8gT
CVE: CVE-2024-20526
Published: 2024-10-23
Description: A vulnerability in the SSH server of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition for the SSH server of an affected device.
 This vulnerability is due to a logic error when an SSH session is established. An attacker could exploit this vulnerability by sending crafted SSH messages to an affected device. A successful exploit could allow the attacker to exhaust available SSH resources on the affected device so that new SSH connections to the device are denied, resulting in a DoS condition. Existing SSH connections to the device would continue to function normally. The device must be rebooted manually to recover. However, user traffic would not be impacted and could be managed using a remote application such as Cisco Adaptive Security Device Manager (ASDM).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400, CWE-770
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ssh-dos-eEDWu5RM
CVE: CVE-2024-9949
Published: 2024-10-23
Description: Denial of Service in Forescout SecureConnector 11.1.02.1019 on Windows allows Unprivileged user to corrupt the configuration file and cause Denial of Service in the application.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1188
References: https://forescout.my.site.com/support/s/article/High-Severity-Vulnerability-in-Secure-Connector-HPS-Inspection-Engine-v11-3-5-and-lower
CVE: CVE-2024-10298
Published: 2024-10-23
Description: A vulnerability classified as critical has been found in PHPGurukul Medical Card Generation System 1.0. This affects an unknown part of the file /admin/edit-card-detail.php of the component Managecard Edit Card Detail Page. The manipulation of the argument editid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://phpgurukul.com/; https://vuldb.com/?ctiid.281565; https://vuldb.com/?id.281565
CVE: CVE-2024-10299
Published: 2024-10-23
Description: A vulnerability classified as critical was found in PHPGurukul Medical Card Generation System 1.0. This vulnerability affects unknown code of the file /admin/view-card-detail.php of the component Managecard View Detail Page. The manipulation of the argument viewid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://phpgurukul.com/; https://vuldb.com/?ctiid.281566; https://vuldb.com/?id.281566
CVE: CVE-2024-48963
Published: 2024-10-23
Description: The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted PHP project. The vulnerability can be triggered if Snyk test is run inside the untrusted project due to the improper handling of the current working directory name. Snyk recommends only scanning trusted projects.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/snyk/snyk-php-plugin/releases/tag/v1.10.0
CVE: CVE-2024-48964
Published: 2024-10-23
Description: The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted Gradle project. The vulnerability can be triggered if Snyk test is run inside the untrusted project due to the improper handling of the current working directory name. Snyk recommends only scanning trusted projects.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78, CWE-94
References: https://github.com/snyk/snyk-gradle-plugin/commit/2f5ee7579f00660282dd161a0b79690f4a9c865d
CVE: CVE-2024-10300
Published: 2024-10-23
Description: A vulnerability, which was classified as critical, has been found in PHPGurukul Medical Card Generation System 1.0. This issue affects some unknown processing of the file /admin/view-enquiry.php of the component View Enquiry Page. The manipulation of the argument viewid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://phpgurukul.com/; https://vuldb.com/?ctiid.281567; https://vuldb.com/?id.281567
CVE: CVE-2024-10301
Published: 2024-10-23
Description: A vulnerability, which was classified as critical, was found in PHPGurukul Medical Card Generation System 1.0. Affected is an unknown function of the file /admin/search-medicalcard.php of the component Search. The manipulation of the argument searchdata leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://phpgurukul.com/; https://vuldb.com/?ctiid.281568; https://vuldb.com/?id.281568
CVE: CVE-2024-9899
Published: 2024-10-23
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-2143. Reason: This candidate is a reservation duplicate of CVE-2023-2143. Notes: All CVE users should reference CVE-2023-2143 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-40431
Published: 2024-10-23
Description: A lack of input validation in Realtek SD card reader driver before 10.0.26100.21374 through the implementation of the IOCTL_SCSI_PASS_THROUGH control of the SD card reader driver allows an attacker to write to predictable kernel memory locations, even as a low-privileged user.
CVSS Score: 8.8 (HIGH)
References: https://zwclose.github.io/2024/10/14/rtsper1.html
CVE: CVE-2024-40432
Published: 2024-10-23
Description: A lack of input validation in Realtek SD card reader driver before 10.0.26100.21374 through the implementation of the IOCTL_SFFDISK_DEVICE_COMMAND control of the SD card reader driver allows a privileged attacker to crash the OS.
CVSS Score: 6.5 (MEDIUM)
References: https://zwclose.github.io/2024/10/14/rtsper1.html
CVE: CVE-2024-48213
Published: 2024-10-23
Description: RockOA v2.6.5 is vulnerable to Directory Traversal in webmain/system/beifen/beifenAction.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/N0zoM1z0/CVEs/blob/main/CVE-2024-48213.md
CVE: CVE-2023-50355
Published: 2024-10-23
Description: HCL Sametime is impacted by the error messages containing sensitive information.  An attacker can use this information to launch another, more focused attack.
CVSS Score: 3.6 (LOW)
CWE: CWE-209, CWE-209
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0115627
CVE: CVE-2024-9374
Published: 2024-10-24
Description: The Terms descriptions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.4.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/terms-descriptions/trunk/includes/td_admin_terms.php#L520; https://www.wordfence.com/threat-intel/vulnerabilities/id/fa977e6c-6b9d-4fa8-99f3-566d6a71424f?source=cve
CVE: CVE-2024-40595
Published: 2024-10-24
Description: An authentication-bypass issue in the RDP component of One Identity Safeguard for Privileged Sessions (SPS) On Premise before 7.5.1 (and LTS before 7.0.5.1) allows man-in-the-middle attackers to obtain access to privileged sessions on target resources by intercepting cleartext RDP protocol information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-319
References: https://support.oneidentity.com/kb/4376565/cve-2024-40595-authentication-bypass-vulnerability
CVE: CVE-2024-9864
Published: 2024-10-24
Description: The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ticket names in all versions up to, and including, 4.0.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when front-end users can submit new events with tickets.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3170503/; https://www.wordfence.com/threat-intel/vulnerabilities/id/bc2a66cb-ad13-428f-a25a-b2807450aa16?source=cve
CVE: CVE-2024-9865
Published: 2024-10-24
Description: The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ep_booking_attendee_fields’ fields in all versions up to, and including, 4.0.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the transaction log for a booking.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3170503/; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3168585%40eventprime-event-calendar-management&new=3168585%40eventprime-event-calendar-management&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/18ded977-5297-4b6f-b9f3-0567f995d08a?source=cve
CVE: CVE-2024-6049
Published: 2024-10-24
Description: The web server of Lawo AG vsm LTC Time Sync (vTimeSync) is affected by a "..." (triple dot) path traversal vulnerability. By sending a specially crafted HTTP request, an unauthenticated remote attacker could download arbitrary files from the operating system. As a limitation, the exploitation is only possible if the requested file has some file extension, e. g. .exe or .txt.
CVSS Score: 7.5 (HIGH)
CWE: CWE-32
References: https://lawo.com/lawo-downloads/; https://r.sec-consult.com/lawo; http://seclists.org/fulldisclosure/2024/Oct/7
CVE: CVE-2024-8667
Published: 2024-10-24
Description: The HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized post publication due to a missing capability check on the activateCampaign() function in all versions up to, and including, 2.10.0. This makes it possible for authenticated attackers, with contributor-level access and above, to publish arbitrary posts like ones they have submitted for review, or a site administrator has in draft.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/hurrytimer/trunk/includes/Admin.php#L568; https://plugins.trac.wordpress.org/changeset/3173213/hurrytimer/trunk/includes/Admin.php?contextall=1; https://www.wordfence.com/threat-intel/vulnerabilities/id/7a8eda88-c45a-4867-b427-d63b586e6de3?source=cve
CVE: CVE-2024-9531
Published: 2024-10-24
Description: The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mvx_sent_deactivation_request' function in all versions up to, and including, 4.2.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to send a canned email to the site's administrator asking to delete the profile of an arbitrary vendor.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-285, CWE-862
References: https://plugins.trac.wordpress.org/browser/dc-woocommerce-multi-vendor/trunk/classes/class-mvx-ajax.php#L3780; https://plugins.trac.wordpress.org/changeset/3173238/dc-woocommerce-multi-vendor/trunk/classes/class-mvx-ajax.php?contextall=1&old=3168957&old_path=%2Fdc-woocommerce-multi-vendor%2Ftrunk%2Fclasses%2Fclass-mvx-ajax.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/5af1063c-615e-4196-9fa6-960c008544c4?source=cve
CVE: CVE-2024-9943
Published: 2024-10-24
Description: The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.4. This is due to missing or incorrect nonce validation on several functions in api/class-mvx-rest-controller.php. This makes it possible for unauthenticated attackers to update vendor account details, create vendor accounts, and delete arbitrary users via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/dc-woocommerce-multi-vendor/tags/4.2.1/api/class-mvx-rest-controller.php#L5258; https://plugins.trac.wordpress.org/browser/dc-woocommerce-multi-vendor/tags/4.2.1/api/class-mvx-rest-controller.php#L6009; https://plugins.trac.wordpress.org/browser/dc-woocommerce-multi-vendor/tags/4.2.1/api/class-mvx-rest-controller.php#L6155
CVE: CVE-2024-10050
Published: 2024-10-24
Description: The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 1.6.43 via the hfe_template shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to view the contents of Draft, Private and Password-protected posts they do not own.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/header-footer-elementor/tags/1.6.43/inc/class-header-footer-elementor.php#L634; https://plugins.trac.wordpress.org/changeset/3173344/header-footer-elementor/trunk/inc/class-header-footer-elementor.php?contextall=1; https://www.wordfence.com/threat-intel/vulnerabilities/id/662f6ae2-2047-4bbf-b4a6-2d536051e389?source=cve
CVE: CVE-2024-8717
Published: 2024-10-24
Description: The PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer – DearFlip plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'pdf_source' parameter in all versions up to, and including, 2.3.32 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/3d-flipbook-dflip-lite/trunk/assets/js/dflip.min.js; https://plugins.trac.wordpress.org/changeset/3172275/; https://www.wordfence.com/threat-intel/vulnerabilities/id/6d4c2944-28e8-4866-b4da-91cf12d9d115?source=cve
CVE: CVE-2024-6826
Published: 2024-10-24
Description: An issue has been discovered in GitLab CE/EE affecting all versions from 11.2 before 17.3.6, 17.4 before 17.4.3, and 17.5 before 17.5.1. A denial of service could occur via importing a malicious crafted XML manifest file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://gitlab.com/gitlab-org/gitlab/-/issues/472928; https://hackerone.com/reports/2571364
CVE: CVE-2024-8312
Published: 2024-10-24
Description: An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 before 17.3.6, 17.4 before 17.4.3, and 17.5 before 17.5.1. An attacker could inject HTML into the Global Search field on a diff view leading to XSS.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://gitlab.com/gitlab-org/gitlab/-/issues/481819; https://hackerone.com/reports/2659386
CVE: CVE-2024-10176
Published: 2024-10-24
Description: The Compact WP Audio Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 
sc_embed_player shortcode in all versions up to, and including, 1.9.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/compact-wp-audio-player/trunk/shortcodes-functions.php#L79; https://plugins.trac.wordpress.org/changeset/3173541/; https://wordpress.org/plugins/compact-wp-audio-player/#developers
CVE: CVE-2024-10331
Published: 2024-10-24
Description: A vulnerability, which was classified as critical, has been found in PHPGurukul Vehicle Record System 1.0. This issue affects some unknown processing of the file /admin/search-vehicle.php. The manipulation of the argument searchinputdata leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://phpgurukul.com/; https://vuldb.com/?ctiid.281675; https://vuldb.com/?id.281675
CVE: CVE-2024-9214
Published: 2024-10-24
Description: The Extra Product Options Builder for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'RednaoSerializedFields' parameter during the creation of a signature file in all versions up to, and including, 1.2.133 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/additional-product-fields-for-woocommerce/trunk/ajax/OrderDesignerAjax.php#L33; https://plugins.trac.wordpress.org/browser/additional-product-fields-for-woocommerce/trunk/ajax/OrderDesignerAjax.php#L61; https://plugins.trac.wordpress.org/browser/additional-product-fields-for-woocommerce/trunk/core/Managers/FileManager/FileManager.php#L106
CVE: CVE-2024-9650
Published: 2024-10-24
Description: The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tooltip’ parameter in all versions up to, and including, 9.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-recipe-maker/trunk/assets/js/public/tooltip.js#L32; https://plugins.trac.wordpress.org/changeset/3173494/; https://www.wordfence.com/threat-intel/vulnerabilities/id/085d06e1-31d3-4c01-8d8e-588c04b79ae3?source=cve
CVE: CVE-2024-49681
Published: 2024-10-24
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in activity-log.com WP Sessions Time Monitoring Full Automatic activitytime allows SQL Injection.This issue affects WP Sessions Time Monitoring Full Automatic: from n/a through <= 1.0.9.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/activitytime/vulnerability/wordpress-wp-sessions-time-monitoring-full-automatic-plugin-1-0-9-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-49682
Published: 2024-10-24
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in wp.insider Simple Membership simple-membership allows Phishing.This issue affects Simple Membership: from n/a through <= 4.5.3.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://patchstack.com/database/Wordpress/Plugin/simple-membership/vulnerability/wordpress-simple-membership-plugin-4-5-3-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2024-49683
Published: 2024-10-24
Description: Missing Authorization vulnerability in Magazine3 Schema & Structured Data for WP & AMP schema-and-structured-data-for-wp allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Schema & Structured Data for WP & AMP: from n/a through <= 1.3.5.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/schema-and-structured-data-for-wp/vulnerability/wordpress-schema-structured-data-for-wp-amp-plugin-1-3-5-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2024-49691
Published: 2024-10-24
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW Plugins Product Filter by WBW woo-product-filter allows SQL Injection.This issue affects Product Filter by WBW: from n/a through <= 2.7.0.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/woo-product-filter/vulnerability/wordpress-product-filter-by-wbw-plugin-2-7-0-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-49703
Published: 2024-10-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in magepeopleteam WpEvently mage-eventpress.This issue affects WpEvently: from n/a through <= 4.2.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/mage-eventpress/vulnerability/wordpress-wpevently-plugin-4-2-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-5608
Published: 2024-10-24
Description: Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to SQL Injection in the technician reports feature.
CVSS Score: 8.3 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.manageengine.com/products/active-directory-audit/cve-2024-5608.html
CVE: CVE-2024-8959
Published: 2024-10-24
Description: The WP Adminify – Custom WordPress Dashboard, Login and Admin Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.0.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3165558/; https://wordpress.org/plugins/adminify/#developers; https://wpadminify.com/changelogs
CVE: CVE-2024-10180
Published: 2024-10-24
Description: The Contact Form 7 – Repeatable Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's field_group shortcode in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3173935/; https://wordpress.org/plugins/cf7-repeatable-fields/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/0782bc16-7d21-4205-af01-97e3ad3db40b?source=cve
CVE: CVE-2024-10332
Published: 2024-10-24
Description: A Cross-Site Scripting vulnerability has been found in Janto v4.3r11 from Impronta. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the endpoint “/abonados/public/janto/main.php”.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://impronta.es/; https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-xss-vulnerability-janto-impronta