deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-49327
Published: 2024-10-20
Description: Unrestricted Upload of File with Dangerous Type vulnerability in bepitulaz Woostagram Connect woostagram-connect allows Upload a Web Shell to a Web Server.This issue affects Woostagram Connect: from n/a through <= 1.0.2.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/woostagram-connect/vulnerability/wordpress-woostagram-connect-plugin-1-0-2-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-49329
Published: 2024-10-20
Description: Unrestricted Upload of File with Dangerous Type vulnerability in vivek2tamrakar WP REST API FNS rest-api-fns allows Upload a Web Shell to a Web Server.This issue affects WP REST API FNS: from n/a through <= 1.0.0.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/rest-api-fns/vulnerability/wordpress-wp-rest-api-fns-plugin-1-0-0-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-49330
Published: 2024-10-20
Description: Unrestricted Upload of File with Dangerous Type vulnerability in brx8r Nice Backgrounds nicebackgrounds allows Upload a Web Shell to a Web Server.This issue affects Nice Backgrounds: from n/a through <= 1.0.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/nicebackgrounds/vulnerability/wordpress-nice-backgrounds-plugin-1-0-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-49331
Published: 2024-10-20
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Myriad Solutionz Property Lot Management System plms allows Upload a Web Shell to a Web Server.This issue affects Property Lot Management System: from n/a through <= 4.2.38.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/plms/vulnerability/wordpress-property-lot-management-system-plugin-4-2-38-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-49332
Published: 2024-10-20
Description: Deserialization of Untrusted Data vulnerability in giveawayboost Giveaway Boost giveaway-boost allows Object Injection.This issue affects Giveaway Boost: from n/a through <= 2.1.4.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/giveaway-boost/vulnerability/wordpress-giveaway-boost-plugin-2-1-4-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2024-49607
Published: 2024-10-20
Description: Unrestricted Upload of File with Dangerous Type vulnerability in redhopit WP Dropbox Dropins wp-dropbox-dropins allows Upload a Web Shell to a Web Server.This issue affects WP Dropbox Dropins: from n/a through <= 1.0.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/wp-dropbox-dropins/vulnerability/wordpress-wp-dropbox-dropins-plugin-1-0-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-49608
Published: 2024-10-20
Description: Incorrect Privilege Assignment vulnerability in gerryworks GERRYWORKS Post by Mail gerryworks-post-by-mail allows Privilege Escalation.This issue affects GERRYWORKS Post by Mail: from n/a through <= 1.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-266
References: https://patchstack.com/database/Wordpress/Plugin/gerryworks-post-by-mail/vulnerability/wordpress-gerryworks-post-by-mail-plugin-1-0-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2024-49610
Published: 2024-10-20
Description: Unrestricted Upload of File with Dangerous Type vulnerability in photokiteditor photokit photokit allows Upload a Web Shell to a Web Server.This issue affects photokit: from n/a through <= 1.0.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/photokit/vulnerability/wordpress-photokit-plugin-1-0-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-49621
Published: 2024-10-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in aatmaadhikari APA Register Newsletter Form apa-register-newsletter-form allows SQL Injection.This issue affects APA Register Newsletter Form: from n/a through <= 1.0.0.
CVSS Score: 8.2 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/apa-register-newsletter-form/vulnerability/wordpress-apa-register-newsletter-form-plugin-1-0-0-csrf-to-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-49622
Published: 2024-10-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in aatmaadhikari Apa Banner Slider apa-banner-slider allows SQL Injection.This issue affects Apa Banner Slider: from n/a through <= 1.0.0.
CVSS Score: 8.2 (HIGH)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/apa-banner-slider/vulnerability/wordpress-apa-banner-slider-plugin-1-0-0-csrf-to-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-49623
Published: 2024-10-20
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in hasan movahed Duplicate Title Validate duplicate-title-validate allows Blind SQL Injection.This issue affects Duplicate Title Validate: from n/a through <= 1.0.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/duplicate-title-validate/vulnerability/wordpress-duplicate-title-validate-plugin-1-0-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-49624
Published: 2024-10-20
Description: Deserialization of Untrusted Data vulnerability in smartdevth Advanced Advertising System advanced-advertising-system allows Object Injection.This issue affects Advanced Advertising System: from n/a through <= 1.3.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/advanced-advertising-system/vulnerability/wordpress-advanced-advertising-system-plugin-1-3-1-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2024-49625
Published: 2024-10-20
Description: Deserialization of Untrusted Data vulnerability in sphoid SiteBuilder Dynamic Components sitebuilder-dynamic-components allows Object Injection.This issue affects SiteBuilder Dynamic Components: from n/a through <= 1.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/sitebuilder-dynamic-components/vulnerability/wordpress-sitebuilder-dynamic-components-plugin-1-0-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2024-44061
Published: 2024-10-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory EU/UK VAT Manager for WooCommerce eu-vat-for-woocommerce.This issue affects EU/UK VAT Manager for WooCommerce: from n/a through <= 2.12.14.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/eu-vat-for-woocommerce/vulnerability/wordpress-eu-uk-vat-manager-for-woocommerce-plugin-2-12-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-47325
Published: 2024-10-20
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle MPG multiple-pages-generator-by-porthas allows SQL Injection.This issue affects MPG: from n/a through <= 3.4.7.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/multiple-pages-generator-by-porthas/vulnerability/wordpress-multiple-page-generator-plugin-mpg-plugin-3-4-7-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-49335
Published: 2024-10-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in sh4d0w28 GoogleDrive folder list googledrive-folder-list allows Stored XSS.This issue affects GoogleDrive folder list: from n/a through <= 2.2.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/googledrive-folder-list/vulnerability/wordpress-googledrive-folder-list-plugin-2-2-2-csrf-to-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-49605
Published: 2024-10-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in Stefan Nour AVChat Video Chat avchat-3 allows Stored XSS.This issue affects AVChat Video Chat: from n/a through <= 2.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/avchat-3/vulnerability/wordpress-community-lite-video-chat-plugin-2-2-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2024-49609
Published: 2024-10-20
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brandon White Author Discussion author-discussion allows Blind SQL Injection.This issue affects Author Discussion: from n/a through <= 0.2.2.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/author-discussion/vulnerability/wordpress-author-discussion-plugin-0-2-2-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-49612
Published: 2024-10-20
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sanjeev SW Contact Form sw-contact-form allows Blind SQL Injection.This issue affects SW Contact Form: from n/a through <= 1.0.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/sw-contact-form/vulnerability/wordpress-sw-contact-form-plugin-1-0-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-49613
Published: 2024-10-20
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in developersnote Simple Code Insert Shortcode simple-code-insert-shortcode allows SQL Injection.This issue affects Simple Code Insert Shortcode: from n/a through <= 1.0.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/simple-code-insert-shortcode/vulnerability/wordpress-simple-code-insert-shortcode-plugin-1-0-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-49614
Published: 2024-10-20
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SermonAudio SermonAudio Widgets sermonaudio-widgets allows SQL Injection.This issue affects SermonAudio Widgets: from n/a through <= 1.9.3.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/sermonaudio-widgets/vulnerability/wordpress-sermonaudio-widgets-plugin-1-9-3-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-49615
Published: 2024-10-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in Henrique Rodrigues SafetyForms safetymails-forms allows Blind SQL Injection.This issue affects SafetyForms: from n/a through <= 1.0.0.
CVSS Score: 8.2 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/safetymails-forms/vulnerability/wordpress-safetyforms-plugin-1-0-0-csrf-to-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-49616
Published: 2024-10-20
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in nyasro Rate Own Post rate-own-post allows Blind SQL Injection.This issue affects Rate Own Post: from n/a through <= 1.0.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/rate-own-post/vulnerability/wordpress-rate-own-post-plugin-1-0-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-49617
Published: 2024-10-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in anciwasim Back Link Tracker back-link-tracker allows Blind SQL Injection.This issue affects Back Link Tracker: from n/a through <= 1.0.0.
CVSS Score: 8.2 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/back-link-tracker/vulnerability/wordpress-back-link-tracker-plugin-1-0-0-csrf-to-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-49618
Published: 2024-10-20
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jordan Lyall MyTweetLinks mytweetlinks allows Blind SQL Injection.This issue affects MyTweetLinks: from n/a through <= 1.1.1.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/mytweetlinks/vulnerability/wordpress-mytweetlinks-plugin-1-1-1-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-49619
Published: 2024-10-20
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in acespritech Social Link Groups social-link-groups allows Blind SQL Injection.This issue affects Social Link Groups: from n/a through <= 1.1.0.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/social-link-groups/vulnerability/wordpress-social-link-groups-plugin-1-1-0-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-49620
Published: 2024-10-20
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mrcheck116 FERMA.ru.net ferma-ru-net-checkout allows Blind SQL Injection.This issue affects FERMA.ru.net: from n/a through <= 1.3.3.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/ferma-ru-net-checkout/vulnerability/wordpress-ferma-ru-net-plugin-1-3-3-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-49629
Published: 2024-10-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in Fahad Mahmood Endless Posts Navigation endless-posts-navigation allows Stored XSS.This issue affects Endless Posts Navigation: from n/a through <= 2.2.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/endless-posts-navigation/vulnerability/wordpress-endless-posts-navigation-plugin-2-2-7-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2024-47634
Published: 2024-10-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in Streamline CartBounty – Save and recover abandoned carts for WooCommerce woo-save-abandoned-carts allows Cross Site Request Forgery.This issue affects CartBounty – Save and recover abandoned carts for WooCommerce: from n/a through <= 8.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/woo-save-abandoned-carts/vulnerability/wordpress-cartbounty-plugin-8-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-49250
Published: 2024-10-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Table of Contents Plus table-of-contents-plus allows Cross Site Request Forgery.This issue affects Table of Contents Plus: from n/a through <= 2408.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/table-of-contents-plus/vulnerability/wordpress-table-of-contents-plus-plugin-2408-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-49272
Published: 2024-10-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in wpweb Social Auto Poster social-auto-poster allows Cross Site Request Forgery.This issue affects Social Auto Poster: from n/a through <= 5.3.15.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/social-auto-poster/vulnerability/wordpress-social-auto-poster-plugin-5-3-15-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-49274
Published: 2024-10-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Cross Site Request Forgery.This issue affects VOD Infomaniak: from n/a through <= 1.5.7.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/vod-infomaniak/vulnerability/wordpress-vod-infomaniak-plugin-1-5-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-49275
Published: 2024-10-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in Northern Beaches Websites IdeaPush ideapush allows Cross Site Request Forgery.This issue affects IdeaPush: from n/a through <= 8.69.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/ideapush/vulnerability/wordpress-ideapush-plugin-8-69-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-49290
Published: 2024-10-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in Gora Tech LLC Cooked Pro allows Cross Site Request Forgery.This issue affects Cooked Pro: from n/a before 1.8.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/cooked-pro/wordpress-cooked-pro-plugin-1-8-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-49306
Published: 2024-10-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in wp-buy WP Content Copy Protection & No Right Click wp-content-copy-protector allows Cross Site Request Forgery.This issue affects WP Content Copy Protection & No Right Click: from n/a through <= 3.5.9.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-content-copy-protector/vulnerability/wordpress-wp-content-copy-protection-no-right-click-plugin-3-5-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-49325
Published: 2024-10-20
Description: Missing Authorization vulnerability in wpdiscover Photo Gallery Builder photo-gallery-builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Photo Gallery Builder: from n/a through <= 3.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/photo-gallery-builder/vulnerability/wordpress-photo-gallery-builder-plugin-3-0-broken-access-control-to-notice-dismissal-vulnerability?_s_id=cve
CVE: CVE-2024-49627
Published: 2024-10-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in Noor Alam WordPress Image SEO allows Cross Site Request Forgery.This issue affects WordPress Image SEO: from n/a through 1.1.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-image-seo/wordpress-wordpress-image-seo-plugin-1-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-49628
Published: 2024-10-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in whiletrue Most And Least Read Posts Widget most-and-least-read-posts-widget allows Cross Site Request Forgery.This issue affects Most And Least Read Posts Widget: from n/a through <= 2.5.18.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/most-and-least-read-posts-widget/vulnerability/wordpress-most-and-least-read-posts-widget-plugin-2-5-18-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-44000
Published: 2024-10-20
Description: Insufficiently Protected Credentials vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Authentication Bypass.This issue affects LiteSpeed Cache: from n/a through < 6.5.0.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://patchstack.com/database/Wordpress/Plugin/litespeed-cache/vulnerability/wordpress-litespeed-cache-plugin-6-5-0-1-unauthenticated-account-takeover-vulnerability?_s_id=cve
CVE: CVE-2024-10196
Published: 2024-10-21
Description: A vulnerability was found in code-projects Pharmacy Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /add_new_invoice.php. The manipulation of the argument text leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://code-projects.org/; https://gist.github.com/higordiego/be616d2853a9f1820d8558fc00e97e24; https://vuldb.com/?ctiid.281021
CVE: CVE-2024-10197
Published: 2024-10-21
Description: A vulnerability was found in code-projects Pharmacy Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file /manage_supplier.php of the component Manage Supplier Page. The manipulation of the argument address leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://code-projects.org/; https://gist.github.com/higordiego/bc051be4a8c6b6641578cad533742aab; https://vuldb.com/?ctiid.281022
CVE: CVE-2024-49215
Published: 2024-10-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-49294. Reason: This candidate is a reservation duplicate of CVE-2023-49294. Notes: All CVE users should reference CVE-2023-49294 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-10198
Published: 2024-10-21
Description: A vulnerability was found in code-projects Pharmacy Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /manage_customer.php of the component Manage Customer Page. The manipulation of the argument suppliers_name/address leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory mentions contradicting files to be affected. Other parameters might be affected as well.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://code-projects.org/; https://gist.github.com/higordiego/[PII_REDACTED]1d3799de0cb8912cc328ec; https://vuldb.com/?ctiid.281023
CVE: CVE-2024-10199
Published: 2024-10-21
Description: A vulnerability was found in code-projects Pharmacy Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /manage_medicine.php of the component Manage Medicines Page. The manipulation of the argument name/address/doctor_address/suppliers_name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory mentions contradicting files to be affected.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-79
References: https://code-projects.org/; https://gist.github.com/higordiego/0dae6dd4a36acd12bcc408caf1c787d9; https://vuldb.com/?ctiid.281024
CVE: CVE-2024-43689
Published: 2024-10-21
Description: Stack-based buffer overflow vulnerability exists in ELECOM wireless access points. By processing a specially crafted HTTP request, arbitrary code may be executed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://jvn.jp/en/jp/JVN24885537/; https://www.elecom.co.jp/news/security/20240827-01/
CVE: CVE-2024-10200
Published: 2024-10-21
Description: Administrative Management System from Wellchoose has a Path Traversal vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to download arbitrary files on the server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-23, CWE-22
References: https://www.twcert.org.tw/en/cp-139-8158-dadbc-2.html; https://www.twcert.org.tw/tw/cp-132-8159-0f7a2-1.html
CVE: CVE-2024-10201
Published: 2024-10-21
Description: Administrative Management System from Wellchoose does not properly validate uploaded file types, allowing remote attackers with regular privileges to upload and execute webshells.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://www.twcert.org.tw/en/cp-139-8161-b8a6d-2.html; https://www.twcert.org.tw/tw/cp-132-8160-756b6-1.html
CVE: CVE-2024-10202
Published: 2024-10-21
Description: Administrative Management System from Wellchoose has an OS Command Injection vulnerability, allowing remote attackers with regular privileges to inject and execute arbitrary OS commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.twcert.org.tw/en/cp-139-8163-b701e-2.html; https://www.twcert.org.tw/tw/cp-132-8162-dc491-1.html
CVE: CVE-2024-8625
Published: 2024-10-21
Description: The TS Poll  WordPress plugin before 2.4.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://wpscan.com/vulnerability/ab4d7065-4ea2-4233-9593-0f540f91f45e/