deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-31906
Published: 2025-01-26
Description: IBM Automation Decision Services 23.0.2 allows web pages to be stored locally which can be read by another user on the system.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-525
References: https://www.ibm.com/support/pages/node/7150662
CVE: CVE-2023-38009
Published: 2025-01-26
Description: IBM Cognos Mobile Client 1.1 iOS may be vulnerable to information disclosure through man in the middle techniques due to the lack of certificate pinning.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-295
References: https://www.ibm.com/support/pages/node/7172691; https://www.ibm.com/support/pages/node/7172692
CVE: CVE-2023-50945
Published: 2025-01-26
Description: IBM Common Licensing 9.0 stores user credentials in plain clear text which can be read by a local user.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-256, CWE-522
References: https://www.ibm.com/support/pages/node/7161947
CVE: CVE-2023-50946
Published: 2025-01-26
Description: IBM Common Licensing 9.0  could allow an authenticated user to modify a configuration file that they should not have access to due to a broken authorization mechanism.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://www.ibm.com/support/pages/node/7161947
CVE: CVE-2017-20196
Published: 2025-01-26
Description: A vulnerability was found in Itechscripts School Management Software 2.75. It has been classified as critical. This affects an unknown part of the file /notice-edit.php. The manipulation of the argument aid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://vuldb.com/?ctiid.95307; https://vuldb.com/?id.95307; https://www.exploit-db.com/exploits/41034
CVE: CVE-2025-0720
Published: 2025-01-26
Description: A vulnerability was found in Microword eScan Antivirus 7.0.32 on Linux. It has been rated as problematic. Affected by this issue is the function removeExtraSlashes of the file /opt/MicroWorld/sbin/rtscanner of the component Folder Watch List Handler. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.3 (LOW)
CWE: CWE-119, CWE-121
References: https://vuldb.com/?ctiid.293480; https://vuldb.com/?id.293480; https://vuldb.com/?submit.482371
CVE: CVE-2025-0721
Published: 2025-01-27
Description: A vulnerability classified as problematic has been found in needyamin image_gallery 1.0. This affects the function image_gallery of the file /view.php. The manipulation of the argument Username leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://vuldb.com/?ctiid.293481; https://vuldb.com/?id.293481; https://vuldb.com/?submit.482812
CVE: CVE-2025-0722
Published: 2025-01-27
Description: A vulnerability classified as critical was found in needyamin image_gallery 1.0. This vulnerability affects unknown code of the file /admin/gallery.php of the component Cover Image Handler. The manipulation of the argument image leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://vuldb.com/?ctiid.293482; https://vuldb.com/?id.293482; https://vuldb.com/?submit.482822
CVE: CVE-2023-46187
Published: 2025-01-27
Description: IBM InfoSphere Master Data Management 11.6, 12.0, and 14.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7173892
CVE: CVE-2024-28766
Published: 2025-01-27
Description: IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 could disclose sensitive information about directory contents that could aid in further attacks against the system.
CVSS Score: 2.4 (LOW)
CWE: CWE-548
References: https://www.ibm.com/support/pages/node/7161444
CVE: CVE-2024-28770
Published: 2025-01-27
Description: IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-614
References: https://www.ibm.com/support/pages/node/7161444
CVE: CVE-2024-28771
Published: 2025-01-27
Description: IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-614
References: https://www.ibm.com/support/pages/node/7161444
CVE: CVE-2024-12280
Published: 2025-01-27
Description: The WP Customer Area WordPress plugin through 8.2.4 does not have CSRF check in place when deleting its logs, which could allow attackers to make a logged in to delete them via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/2b32c0b8-28bb-4220-800b-4c369bca91c5/; https://wpscan.com/vulnerability/2b32c0b8-28bb-4220-800b-4c369bca91c5/
CVE: CVE-2024-12321
Published: 2025-01-27
Description: The WC Affiliate  WordPress plugin through 2.3.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://wpscan.com/vulnerability/d4c55d30-1c15-41ee-95e0-670891d67684/; https://wpscan.com/vulnerability/d4c55d30-1c15-41ee-95e0-670891d67684/
CVE: CVE-2024-12436
Published: 2025-01-27
Description: The WP Customer Area WordPress plugin through 8.2.4 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/3345a403-f62c-40c1-b7ae-bc947591e02a/; https://wpscan.com/vulnerability/3345a403-f62c-40c1-b7ae-bc947591e02a/
CVE: CVE-2024-12773
Published: 2025-01-27
Description: The Altra Side Menu WordPress plugin through 2.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://wpscan.com/vulnerability/fab64105-599f-49a4-b01d-c873ff34b590/
CVE: CVE-2024-12774
Published: 2025-01-27
Description: The Altra Side Menu WordPress plugin through 2.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete arbitrary menu via a CSRF attack
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://wpscan.com/vulnerability/8decbef5-f106-488b-925c-42b3b280460a/
CVE: CVE-2024-13052
Published: 2025-01-27
Description: The Dental Optimizer Patient Generator App WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://wpscan.com/vulnerability/671d5eef-c496-4047-9d01-8ab8a94cdc72/; https://wpscan.com/vulnerability/671d5eef-c496-4047-9d01-8ab8a94cdc72/
CVE: CVE-2024-13055
Published: 2025-01-27
Description: The Dyn Business Panel WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://wpscan.com/vulnerability/91178272-ed7e-412c-a187-e360a1313004/; https://wpscan.com/vulnerability/91178272-ed7e-412c-a187-e360a1313004/
CVE: CVE-2024-13056
Published: 2025-01-27
Description: The Dyn Business Panel WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://wpscan.com/vulnerability/a6acb608-a23e-461d-af48-a6669a45594a/; https://wpscan.com/vulnerability/a6acb608-a23e-461d-af48-a6669a45594a/
CVE: CVE-2024-13057
Published: 2025-01-27
Description: The Dyn Business Panel WordPress plugin through 1.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://wpscan.com/vulnerability/6f869a3d-1ac1-4d31-8fe5-9b9795b15b5b/; https://wpscan.com/vulnerability/6f869a3d-1ac1-4d31-8fe5-9b9795b15b5b/
CVE: CVE-2024-13094
Published: 2025-01-27
Description: The WP Triggers Lite WordPress plugin through 2.5.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://wpscan.com/vulnerability/7a75809e-824e-458e-bd01-50dadcea7713/; https://wpscan.com/vulnerability/7a75809e-824e-458e-bd01-50dadcea7713/
CVE: CVE-2024-13095
Published: 2025-01-27
Description: The WP Triggers Lite WordPress plugin through 2.5.3 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-89
References: https://wpscan.com/vulnerability/74e95fb5-025b-4d4d-a279-844b6ee3e57d/; https://wpscan.com/vulnerability/74e95fb5-025b-4d4d-a279-844b6ee3e57d/
CVE: CVE-2024-13116
Published: 2025-01-27
Description: The Crelly Slider WordPress plugin before 1.4.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 3.8 (LOW)
CWE: CWE-79
References: https://wpscan.com/vulnerability/1755c8ad-7620-4b12-bba0-013e80c2691b/
CVE: CVE-2024-13117
Published: 2025-01-27
Description: The Social Share Buttons for WordPress plugin through 2.7 allows an unauthenticated user to upload arbitrary images and change the path where they are uploaded
CVSS Score: 6.5 (MEDIUM)
References: https://wpscan.com/vulnerability/3234cdac-f328-4f1e-a1de-31fbd86aefb9/
CVE: CVE-2024-43445
Published: 2025-01-27
Description: A vulnerability exists in OTRS and ((OTRS Community Edition)) that fail to set the HTTP response header X-Content-Type-Options to nosniff. An attacker could exploit this vulnerability by uploading or inserting content that would be treated as a different MIME type than intended. 

This issue affects: 

  *  OTRS 7.0.X

  *  OTRS 8.0.X
  *  OTRS 2023.X
  *  OTRS 2024.X

  *  ((OTRS)) Community Edition: 6.0.x

Products based on the ((OTRS)) Community Edition also very likely to be affected
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20
References: https://otrs.com/release-notes/otrs-security-advisory-2025-01/
CVE: CVE-2024-43446
Published: 2025-01-27
Description: An improper privilege management vulnerability in OTRS Generic Interface module allows change of the Ticket status even if the user only has ro permissions. 

This issue affects: 

  *  OTRS 7.0.X

  *  OTRS 8.0.X
  *  OTRS 2023.X
  *  OTRS 2024.X

  *  ((OTRS)) Community Edition: 6.0.x

Products based on the ((OTRS)) Community Edition also very likely to be affected
CVSS Score: 3.5 (LOW)
CWE: CWE-269
References: https://otrs.com/release-notes/otrs-security-advisory-2025-02/
CVE: CVE-2025-24389
Published: 2025-01-27
Description: Certain errors of the upstream libraries will insert sensitive information in the OTRS or ((OTRS)) Community Edition log mechanism and mails send to the system administrator.

This issue affects: 

  *  OTRS 7.0.X

  *  OTRS 8.0.X
  *  OTRS 2023.X
  *  OTRS 2024.X

  *  ((OTRS)) Community Edition: 6.0.x

Products based on the ((OTRS)) Community Edition also very likely to be affected
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-532
References: https://otrs.com/release-notes/otrs-security-advisory-2025-03/
CVE: CVE-2025-24390
Published: 2025-01-27
Description: A vulnerability in OTRS Application Server and reverse proxy settings allows session hijacking due to missing attributes for sensitive cookie settings in HTTPS sessions.

This issue affects: 

  *  OTRS 7.0.X

  *  OTRS 8.0.X
  *  OTRS 2023.X
  *  OTRS 2024.X
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-614
References: https://otrs.com/release-notes/otrs-security-advisory-2025-04/
CVE: CVE-2024-52012
Published: 2025-01-27
Description: Relative Path Traversal vulnerability in Apache Solr.

Solr instances running on Windows are vulnerable to arbitrary filepath write-access, due to a lack of input-sanitation in the "configset upload" API.  Commonly known as a "zipslip", maliciously constructed ZIP files can use relative filepaths to write data to unanticipated parts of the filesystem.  
This issue affects Apache Solr: from 6.6 through 9.7.0.

Users are recommended to upgrade to version 9.8.0, which fixes the issue.  Users unable to upgrade may also safely prevent the issue by using Solr's "Rule-Based Authentication Plugin" to restrict access to the configset upload API, so that it can only be accessed by a trusted set of administrators/users.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-23
References: https://lists.apache.org/thread/yp39pgbv4vf1746pf5yblz84lv30vfxd; http://www.openwall.com/lists/oss-security/2025/01/26/2
CVE: CVE-2025-24814
Published: 2025-01-27
Description: Core creation allows users to replace "trusted" configset files with arbitrary configuration

Solr instances that (1) use the "FileSystemConfigSetService" component (the default in "standalone" or "user-managed" mode), and (2) are running without authentication and authorization are vulnerable to a sort of privilege escalation wherein individual "trusted" configset files can be ignored in favor of potentially-untrusted replacements available elsewhere on the filesystem.  These replacement config files are treated as "trusted" and can use "<lib>" tags to add to Solr's classpath, which an attacker might use to load malicious code as a searchComponent or other plugin.

This issue affects all Apache Solr versions up through Solr 9.7.  Users can protect against the vulnerability by enabling authentication and authorization on their Solr clusters or switching to SolrCloud (and away from "FileSystemConfigSetService").  Users are also recommended to upgrade to Solr 9.8.0, which mitigates this issue by disabling use of "<lib>" tags by default.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-250
References: https://lists.apache.org/thread/gl291pn8x9f9n52ys5l0pc0b6qtf0qw1; http://www.openwall.com/lists/oss-security/2025/01/26/1; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-12345
Published: 2025-01-27
Description: A vulnerability classified as problematic was found in INW Krbyyyzo 25.2002. Affected by this vulnerability is an unknown functionality of the file /gbo.aspx of the component Daily Huddle Site. The manipulation of the argument s leads to resource consumption. It is possible to launch the attack on the local host. Other endpoints might be affected as well.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-400, CWE-404
References: https://vuldb.com/?ctiid.293509; https://vuldb.com/?id.293509
CVE: CVE-2025-0695
Published: 2025-01-27
Description: An Allocation of Resources Without Limits or Throttling vulnerability in Cesanta Frozen versions less than 1.7 allows an attacker to induce a crash of the component embedding the library by supplying a maliciously crafted JSON as input.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-0695
CVE: CVE-2025-0696
Published: 2025-01-27
Description: A NULL Pointer Dereference vulnerability in Cesanta Frozen versions less than 1.7 allows an attacker to induce a crash of the component embedding the library by supplying a maliciously crafted JSON as input.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-476
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-0696
CVE: CVE-2024-55931
Published: 2025-01-27
Description: Xerox Workplace Suite stores tokens in session storage, which may expose them to potential access if a user's session is compromised. 

The patch for this vulnerability will be included in a future release of Workplace Suite, and customers will be notified through an update to the security bulletin.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-922
References: https://securitydocs.business.xerox.com/wp-content/uploads/2025/01/Xerox-Security-Bulletin-XRX25-002-for-Xerox%C2%AE-WorkplaceSuite%C2%AE.pdf
CVE: CVE-2022-4975
Published: 2025-01-27
Description: A flaw was found in the Red Hat Advanced Cluster Security (RHACS) portal. When rendering a table view in the portal, for example, on any of the /main/configmanagement/* endpoints, the front-end generates a DOM table-element (id="pdf-table"). This information is then populated with unsanitized data using innerHTML. An attacker with some control over the data rendered can trigger a cross-site scripting (XSS) vulnerability.
CVSS Score: 8.9 (HIGH)
CWE: CWE-79
References: https://access.redhat.com/security/cve/CVE-2022-4975; https://bugzilla.redhat.com/show_bug.cgi?id=2071527
CVE: CVE-2024-11348
Published: 2025-01-27
Description: Eura7 CMSmanager in version 4.6 and below is vulnerable to Reflected XSS attacks through manipulation of return GET request parameter sent to a specific endpoint.
The vulnerability has been fixed by a patche patch 17012022 addressing all affected versions in use.
CWE: CWE-79
References: https://cert.pl/en/posts/2025/01/CVE-2024-11348
CVE: CVE-2025-22513
Published: 2025-01-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kyle Phillips Simple Locator simple-locator allows Reflected XSS.This issue affects Simple Locator: from n/a through <= 2.0.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/simple-locator/vulnerability/wordpress-simple-locator-plugin-2-0-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23457
Published: 2025-01-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shipdeoplugin Shipdeo shipdeo-woo allows Reflected XSS.This issue affects Shipdeo: from n/a through <= 1.2.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/shipdeo-woo/vulnerability/wordpress-shipdeo-plugin-1-2-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23792
Published: 2025-01-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Busters Passwordless WP – Login with your glance or fingerprint passwordless-wp allows Reflected XSS.This issue affects Passwordless WP – Login with your glance or fingerprint: from n/a through <= 1.1.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/passwordless-wp/vulnerability/wordpress-passwordless-wp-login-with-your-glance-or-fingerprint-plugin-1-1-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24533
Published: 2025-01-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in MetaSlider Responsive Slider by MetaSlider ml-slider allows Cross Site Request Forgery.This issue affects Responsive Slider by MetaSlider: from n/a through <= 3.92.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/ml-slider/vulnerability/wordpress-metaslider-plugin-3-92-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-24584
Published: 2025-01-27
Description: Missing Authorization vulnerability in bdthemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Store Kit Elementor Addons: from n/a through <= 2.3.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/ultimate-store-kit/vulnerability/wordpress-ultimate-store-kit-elementor-addons-plugin-2-3-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-24601
Published: 2025-01-27
Description: Deserialization of Untrusted Data vulnerability in ThimPress FundPress fundpress allows Object Injection.This issue affects FundPress: from n/a through <= 2.0.6.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/fundpress/vulnerability/wordpress-fundpress-plugin-2-0-6-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-24612
Published: 2025-01-27
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ihor Kit Shipping for Nova Poshta nova-poshta-ttn allows SQL Injection.This issue affects Shipping for Nova Poshta: from n/a through <= 1.19.6.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/nova-poshta-ttn/vulnerability/wordpress-shipping-for-nova-poshta-plugin-1-19-6-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-24664
Published: 2025-01-27
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in enituretechnology LTL Freight Quotes – Worldwide Express Edition ltl-freight-quotes-worldwide-express-edition allows SQL Injection.This issue affects LTL Freight Quotes – Worldwide Express Edition: from n/a through <= 5.0.20.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/ltl-freight-quotes-worldwide-express-edition/vulnerability/wordpress-ltl-freight-quotes-plugin-5-0-20-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-24685
Published: 2025-01-27
Description: Path Traversal: '.../...//' vulnerability in Ihor Kit Morkva UA Shipping morkva-ua-shipping allows PHP Local File Inclusion.This issue affects Morkva UA Shipping: from n/a through <= 1.0.18.
CVSS Score: 8.1 (HIGH)
CWE: CWE-35
References: https://patchstack.com/database/Wordpress/Plugin/morkva-ua-shipping/vulnerability/wordpress-morkva-ua-shipping-plugin-1-0-18-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-24754
Published: 2025-01-27
Description: Missing Authorization vulnerability in favethemes Houzez houzez.This issue affects Houzez: from n/a through <= 3.4.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Theme/houzez/vulnerability/wordpress-houzez-theme-3-4-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-57590
Published: 2025-01-27
Description: TRENDnet TEW-632BRP v1.010B31 devices have an OS command injection vulnerability in the CGl interface "ntp_sync.cgi",which allows remote attackers to execute arbitrary commands via parameter "ntp_server" passed to the "ntp_sync.cgi" binary through a POST request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/IdaJea/IOT_vuln_1/blob/master/tew632/ntp_sync.md