deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-1271
Published: 2024-11-19
Description: Rejected reason: This CVE was previously published at https://bugzilla.redhat.com/show_bug.cgi?id=2262978 but later rejected for the following reason: The flaw requires an attacker to have superuser credentials which is a condition that already permits all impacts, hence not constituing a security vulnerability.
CVE: CVE-2024-37070
Published: 2024-11-19
Description: IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 could allow an authenticated user to obtain sensitive information that could aid in further attacks against the system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-497
References: https://www.ibm.com/support/pages/node/7176346
CVE: CVE-2024-45419
Published: 2024-11-19
Description: Improper input validation in some Zoom Apps may allow an unauthenticated user to conduct a disclosure of information via network access.
CVSS Score: 8.1 (HIGH)
CWE: CWE-252
References: https://www.zoom.com/en/trust/security-bulletin/zsb-24041
CVE: CVE-2024-45420
Published: 2024-11-19
Description: Uncontrolled resource consumption in some Zoom Apps before version 6.2.0 may allow an authenticated user to conduct a denial of service via network access.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400
References: https://www.zoom.com/en/trust/security-bulletin/zsb-24042
CVE: CVE-2024-45422
Published: 2024-11-19
Description: Improper input validation in some Zoom Apps before version 6.2.0 may allow an unauthenticated user to conduct a denial of service via network access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://www.zoom.com/en/trust/security-bulletin/zsb-24044
CVE: CVE-2024-52359
Published: 2024-11-19
Description: IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 could allow an authenticated user to perform unauthorized actions that should be reserved to administrator used due to improper access controls.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-286
References: https://www.ibm.com/support/pages/node/7176346
CVE: CVE-2024-52360
Published: 2024-11-19
Description: IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.ibm.com/support/pages/node/7176346
CVE: CVE-2018-9365
Published: 2024-11-19
Description: In smp_data_received of smp_l2c.cc, there is a possible out of bounds read followed by code execution due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://source.android.com/security/bulletin/2018-07-01
CVE: CVE-2018-9410
Published: 2024-11-19
Description: In analyzeAxes of FontUtils.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://source.android.com/security/bulletin/2018-07-01
CVE: CVE-2024-52762
Published: 2024-11-19
Description: A cross-site scripting (XSS) vulnerability in the component /master/header.php of Ganglia-web v3.73 to v3.76 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the "tz" parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/ganglia/ganglia-web/issues/382
CVE: CVE-2024-52763
Published: 2024-11-19
Description: A cross-site scripting (XSS) vulnerability in the component /graph_all_periods.php of Ganglia-web v3.73 to v3.75 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the "g" parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/ganglia/ganglia-web/issues/382
CVE: CVE-2018-9411
Published: 2024-11-19
Description: In decrypt of ClearKeyCasPlugin.cpp there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote arbitrary code execution with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://source.android.com/security/bulletin/2018-07-01
CVE: CVE-2018-9412
Published: 2024-11-19
Description: In removeUnsynchronization of ID3.cpp there is a possible resource exhaustion due to improper input validation. This could lead to denial of service with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://source.android.com/security/bulletin/2018-07-01
CVE: CVE-2018-9417
Published: 2024-11-19
Description: In f_hidg_read and hidg_disable of f_hid.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://source.android.com/security/bulletin/2018-07-01
CVE: CVE-2018-9419
Published: 2024-11-19
Description: In l2cble_process_sig_cmd of l2c_ble.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-787
References: https://source.android.com/security/bulletin/2018-07-01
CVE: CVE-2018-9420
Published: 2024-11-19
Description: In BnCameraService::onTransact of CameraService.cpp, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908, CWE-908
References: https://source.android.com/security/bulletin/2018-07-01
CVE: CVE-2018-9421
Published: 2024-11-19
Description: In writeInplace of Parcel.cpp, there is a possible information leak across processes, using Binder, due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908, CWE-908
References: https://source.android.com/security/bulletin/2018-07-01
CVE: CVE-2018-9424
Published: 2024-11-19
Description: In CryptoPlugin::decrypt of CryptoPlugin.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://source.android.com/security/bulletin/2018-07-01
CVE: CVE-2018-9428
Published: 2024-11-19
Description: In startDevice of AAudioServiceStreamBase.cpp there is a possible out of bounds write due to a use after free. This could lead to local arbitrary code execution with no additional execution privileges needed. User interaction is needed for exploitation.  https://source.android.com/security/bulletin/2018-07-01
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-787, CWE-787
References: https://source.android.com/security/bulletin/2018-07-01
CVE: CVE-2018-9432
Published: 2024-11-19
Description: In createPhonebookDialogView and createMapDialogView of BluetoothPermissionActivity.java, there is a possible permissions bypass. This could lead to local escalation of privilege due to hiding and bypassing the user's ability to disable access to contacts, with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://source.android.com/security/bulletin/2018-07-01
CVE: CVE-2018-9433
Published: 2024-11-19
Description: In ArrayConcatVisitor of builtins-array.cc, there is a possible type confusion due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-116
References: https://source.android.com/security/bulletin/2018-07-01
CVE: CVE-2023-27609
Published: 2024-11-19
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in NetTantra WP Roles at Registration allows Stored XSS.This issue affects WP Roles at Registration: from n/a through 0.23.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-roles-at-registration/wordpress-wp-roles-at-registration-plugin-0-23-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-11400
Published: 2024-11-19
Description: The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the really_curr_tax parameter in all versions up to, and including, 1.3.6.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3186438/; https://www.wordfence.com/threat-intel/vulnerabilities/id/f3158e77-39b3-4151-8f10-5824000a585a?source=cve
CVE: CVE-2024-30424
Published: 2024-11-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM Beaver Builder Addons by WPZOOM wpzoom-addons-for-beaver-builder allows Stored XSS.This issue affects Beaver Builder Addons by WPZOOM: from n/a through <= 1.3.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wpzoom-addons-for-beaver-builder/vulnerability/wordpress-beaver-builder-addons-by-wpzoom-plugin-1-3-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-51669
Published: 2024-11-19
Description: Cross-Site Request Forgery (CSRF) vulnerability in Kalmang Dynamic Widgets dynamic-widgets.This issue affects Dynamic Widgets: from n/a through <= 1.6.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/dynamic-widgets/vulnerability/wordpress-dynamic-widgets-plugin-1-6-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-52392
Published: 2024-11-19
Description: Cross-Site Request Forgery (CSRF) vulnerability in w3speedster W3SPEEDSTER w3speedster-wp.This issue affects W3SPEEDSTER: from n/a through <= 7.25.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/w3speedster-wp/vulnerability/wordpress-w3speedster-plugin-7-25-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-52595
Published: 2024-11-19
Description: lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.0, the HTML Parser in lxml does not properly handle context-switching for special HTML tags such as `<svg>`, `<math>` and `<noscript>`. This behavior deviates from how web browsers parse and interpret such tags. Specifically, content in CSS comments is ignored by lxml_html_clean but may be interpreted differently by web browsers, enabling malicious scripts to bypass the cleaning process. This vulnerability could lead to Cross-Site Scripting (XSS) attacks, compromising the security of users relying on lxml_html_clean in default configuration for sanitizing untrusted HTML content. Users employing the HTML cleaner in a security-sensitive context should upgrade to lxml 0.4.0, which addresses this issue. As a temporary mitigation, users can configure lxml_html_clean with the following settings to prevent the exploitation of this vulnerability. Via `remove_tags`, one may specify tags to remove - their content is moved to their parents' tags. Via `kill_tags`, one may specify tags to be removed completely. Via `allow_tags`, one may restrict the set of permissible tags, excluding context-switching tags like `<svg>`, `<math>` and `<noscript>`.
CVSS Score: 7.7 (HIGH)
CWE: CWE-79, CWE-83, CWE-184, CWE-79
References: https://github.com/fedora-python/lxml_html_clean/commit/c5d816f86eb3707d72a8ecf5f3823e0daa1b3808; https://github.com/fedora-python/lxml_html_clean/pull/19; https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-5jfw-gq64-q45f
CVE: CVE-2018-9440
Published: 2024-11-19
Description: In parse of M3UParser.cpp there is a possible resource exhaustion due to improper input validation. This could lead to denial of service with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 6.5 (MEDIUM)
References: https://source.android.com/security/bulletin/2018-09-01
CVE: CVE-2018-9456
Published: 2024-11-19
Description: In sdpu_extract_attr_seq of sdp_utils.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: https://source.android.com/security/bulletin/2018-09-01
CVE: CVE-2018-9466
Published: 2024-11-19
Description: In the xmlSnprintfElementContent function of valid.c, there is a possible out of bounds write. This could lead to remote escalation of privilege in an unprivileged app with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://source.android.com/security/bulletin/2018-09-01; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2018-9467
Published: 2024-11-20
Description: In the getHost() function of UriTest.java, there is the possibility of incorrect web origin determination. This could lead to incorrect security decisions with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276
References: https://source.android.com/security/bulletin/2018-09-01
CVE: CVE-2024-44306
Published: 2024-11-20
Description: A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.6. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://support.apple.com/en-us/120911
CVE: CVE-2024-44307
Published: 2024-11-20
Description: A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.6. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://support.apple.com/en-us/120911
CVE: CVE-2024-44308
Published: 2024-11-20
Description: The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.
CVSS Score: 8.8 (HIGH)
References: https://support.apple.com/en-us/121752; https://support.apple.com/en-us/121753; https://support.apple.com/en-us/121754
CVE: CVE-2024-44309
Published: 2024-11-20
Description: A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://support.apple.com/en-us/121752; https://support.apple.com/en-us/121753; https://support.apple.com/en-us/121754
CVE: CVE-2024-11278
Published: 2024-11-20
Description: The GD bbPress Attachments plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 4.7.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/gd-bbpress-attachments/trunk/code/front.php#L280; https://plugins.trac.wordpress.org/changeset/3189863/gd-bbpress-attachments/trunk/code/front.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/6f598cfc-4d41-4d22-95f0-47efdb7d07a2?source=cve
CVE: CVE-2024-10515
Published: 2024-11-20
Description: In the process of testing the SEO Plugin by Squirrly SEO WordPress plugin before 12.3.21, a vulnerability was found that allows you to implement Stored XSS on behalf of the editor by embedding malicious script, which entails account takeover backdoor
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://wpscan.com/vulnerability/367aad17-fbb5-48eb-8829-5d3513098d02/
CVE: CVE-2024-52614
Published: 2024-11-20
Description: Use of hard-coded cryptographic key issue exists in "Kura Sushi Official App Produced by EPARK" for Android versions prior to 3.8.5. If this vulnerability is exploited, a local attacker may obtain the login ID and password for the affected product.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-321
References: https://jvn.jp/en/jp/JVN16114985/; https://play.google.com/store/apps/details?id=jp.co.kura_corpo
CVE: CVE-2024-9653
Published: 2024-11-20
Description: The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'action' parameter in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3186456%40menu-ordering-reservations&new=3186456%40menu-ordering-reservations&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/11ccafd9-dad5-4b7d-b913-7821dd52d12b?source=cve
CVE: CVE-2024-10365
Published: 2024-11-20
Description: The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.3 via the render function in modules/widgets/tp_carousel_anything.php, modules/widgets/tp_page_scroll.php, and other widgets. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset/3186482/the-plus-addons-for-elementor-page-builder; https://www.wordfence.com/threat-intel/vulnerabilities/id/f7ce1d19-25fa-434d-943b-d10c5cb2ec51?source=cve
CVE: CVE-2024-10855
Published: 2024-11-20
Description: The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to insufficient validation on the filename parameter of the sirv_upload_file_by_chunks() function and lack of  in all versions up to, and including, 7.3.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users.
CVSS Score: 8.1 (HIGH)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/browser/sirv/tags/7.2.8/sirv.php#L4691; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3186406%40sirv&new=3186406%40sirv&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/d6ec09e5-4994-4d23-bf8e-26b64d5303fa?source=cve
CVE: CVE-2024-10899
Published: 2024-11-20
Description: The The WooCommerce Product Table Lite plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.8.6. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The same 'id' parameter is vulnerable to Reflected Cross-Site Scripting as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-94
References: https://plugins.trac.wordpress.org/browser/wc-product-table-lite/tags/3.8.6/main.php#L1778; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3190789%40wc-product-table-lite&new=3190789%40wc-product-table-lite&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/c9b010ff-8a4a-4553-bb2b-d58a254d7ee4?source=cve
CVE: CVE-2024-10900
Published: 2024-11-20
Description: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pm_remove_file_attachment() function in all versions up to, and including, 5.9.3.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary user meta which can do things like deny an administrator's access to their site. .
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/admin/class-profile-magic-admin.php#L1902; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3190069%40profilegrid-user-profiles-groups-and-communities&new=3190069%40profilegrid-user-profiles-groups-and-communities&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/a0e5fcfa-ebc9-45f6-9cbc-c9e3540baa6f?source=cve
CVE: CVE-2024-11277
Published: 2024-11-20
Description: The 404 Solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URLs in all versions up to, and including, 2.35.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3191597%40404-solution&new=3191597%40404-solution&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/259f9ea3-ac24-4bea-8d0d-c635a68d9c98?source=cve
CVE: CVE-2024-8726
Published: 2024-11-20
Description: The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.2.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3189361%40mailchimp-forms-by-mailmunch&new=3189361%40mailchimp-forms-by-mailmunch&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/a1a1c5e7-75a4-4ca5-9707-4076b92e0c33?source=cve