deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-22606
Published: 2025-01-24
Description: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In version 4.0.0-beta.358 and possibly earlier versions, when creating or updating a "project," it is possible to inject arbitrary shell commands by altering the project name. If a name includes unescaped characters, such as single quotes (`'`), it breaks out of the intended command structure, allowing attackers to execute arbitrary commands on the host system. This vulnerability allows attackers to execute arbitrary commands on the host server, which could result in full system compromise; create, modify, or delete sensitive system files; and escalate privileges depending on the permissions of the executed process. Attackers with access to project management features could exploit this flaw to gain unauthorized control over the host environment. Version 4.0.0-beta.359 fixes this issue.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://github.com/coollabsio/coolify/security/advisories/GHSA-ccp8-v65g-m526
CVE: CVE-2025-22607
Published: 2025-01-24
Description: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to fetch the details page for any GitHub / GitLab configuration on a Coolify instance by only knowing the UUID of the model. This exposes the "client id", "client secret" and "webhook secret." Version 4.0.0-beta.361 fixes this issue.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200, CWE-862
References: https://github.com/coollabsio/coolify/security/advisories/GHSA-8w24-gfgq-jg72
CVE: CVE-2025-23991
Published: 2025-01-24
Description: Missing Authorization vulnerability in Dotstore Product Size Charts Plugin for WooCommerce woo-advanced-product-size-chart.This issue affects Product Size Charts Plugin for WooCommerce: from n/a through <= 2.4.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/woo-advanced-product-size-chart/vulnerability/wordpress-product-size-charts-plugin-for-woocommerce-plugin-2-4-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-0700
Published: 2025-01-24
Description: A vulnerability was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/sys/log/list. The manipulation of the argument logId leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/JoeyBling/bootplus/issues/22; https://github.com/JoeyBling/bootplus/issues/22#issue[PII_REDACTED]; https://vuldb.com/?ctiid.293228
CVE: CVE-2025-0701
Published: 2025-01-24
Description: A vulnerability classified as critical has been found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. This affects an unknown part of the file /admin/sys/user/list. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/JoeyBling/bootplus/issues/23; https://github.com/JoeyBling/bootplus/issues/23#issue[PII_REDACTED]; https://vuldb.com/?ctiid.293229
CVE: CVE-2025-22608
Published: 2025-01-24
Description: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to revoke any team invitations on a Coolify instance by only providing a predictable and incrementing ID, resulting in a Denial-of-Service attack (DOS). Version 4.0.0-beta.361 fixes the issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639, CWE-862
References: https://github.com/coollabsio/coolify/security/advisories/GHSA-qmxm-wvm9-wvxx
CVE: CVE-2025-22609
Published: 2025-01-24
Description: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to attach any existing private key on a coolify instance to his own server. If the server configuration of IP / domain, port (most likely 22) and user (root) matches with the victim's server configuration, then the attacker can use the `Terminal` feature and execute arbitrary commands on the victim's server. Version 4.0.0-beta.361 fixes the issue.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-862
References: https://github.com/coollabsio/coolify/security/advisories/GHSA-3w2c-jfr2-9pg9
CVE: CVE-2025-22610
Published: 2025-01-24
Description: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to fetch the global coolify instance OAuth configuration. This exposes the "client id" and "client secret" for every custom OAuth provider. The attacker can also modify the global OAuth configuration. Version 4.0.0-beta.361 fixes the issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://github.com/coollabsio/coolify/security/advisories/GHSA-496v-9q38-2x6c
CVE: CVE-2025-22611
Published: 2025-01-24
Description: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to escalate his or any other team members privileges to any role, including the owner role. He's also able to kick every other member out of the team, including admins and owners. This allows the attacker to access the `Terminal` feature and execute remote commands. Version 4.0.0-beta.361 fixes the issue.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-862
References: https://github.com/coollabsio/coolify/security/advisories/GHSA-9w72-9qww-qj6g
CVE: CVE-2025-22612
Published: 2025-01-24
Description: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.374, the missing authorization allows an authenticated user to retrieve any existing private keys on a coolify instance in plain text. If the server configuration of IP / domain, port (most likely 22) and user (root) matches with the victim's server configuration, then the attacker can execute arbitrary commands on the remote server. Version 4.0.0-beta.374 fixes the issue.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-200, CWE-862
References: https://github.com/coollabsio/coolify/security/advisories/GHSA-wg8x-cgq4-vjxj
CVE: CVE-2025-23222
Published: 2025-01-24
Description: An issue was discovered in Deepin dde-api-proxy through 1.0.19 in which unprivileged users can access D-Bus services as root. Specifically, dde-api-proxy runs as root and forwards messages from arbitrary local users to legacy D-Bus methods in the actual D-Bus services, and the actual D-Bus services don't know about the proxy situation (they believe that root is asking them to do things). Consequently several proxied methods, that shouldn't be accessible to non-root users, are accessible to non-root users. In situations where Polkit is involved, the caller would be treated as admin, resulting in a similar escalation of privileges.
CVSS Score: 8.4 (HIGH)
CWE: CWE-940
References: https://bugzilla.suse.com/show_bug.cgi?id=1229918; https://security.opensuse.org/2025/01/24/dde-api-proxy-privilege-escalation.html; https://www.openwall.com/lists/oss-security/2025/01/24/3
CVE: CVE-2025-24025
Published: 2025-01-24
Description: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.380, the tags page allows users to search for tags. If the search does not return any results, the query gets reflected on the error modal, which leads to cross-site scripting. Version 4.0.0-beta.380 fixes the issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-116
References: https://github.com/coollabsio/coolify/security/advisories/GHSA-f2gf-jvmh-vq73
CVE: CVE-2025-24355
Published: 2025-01-24
Description: Updatecli is a tool used to apply file update strategies. Prior to version 0.93.0, private maven repository credentials may be leaked in application logs in case of unsuccessful retrieval operation. During the execution of an updatecli pipeline which contains a `maven` source configured with basic auth credentials, the credentials are being leaked in the application execution logs in case of failure. Credentials are properly sanitized when the operation is successful but not when for whatever reason there is a failure in the maven repository, e.g. wrong coordinates provided, not existing artifact or version. Version 0.93.0 contains a patch for the issue.
CVSS Score: 7.1 (HIGH)
CWE: CWE-359
References: https://github.com/updatecli/updatecli/commit/344b28091ffeca5ed32e8d0f9eda542842fcd3fa; https://github.com/updatecli/updatecli/security/advisories/GHSA-v34r-vj4r-38j6
CVE: CVE-2025-24359
Published: 2025-01-24
Description: ASTEVAL is an evaluator of Python expressions and statements. Prior to version 1.0.6, if an attacker can control the input to the `asteval` library, they can bypass asteval's restrictions and execute arbitrary Python code in the context of the application using the library. The vulnerability is rooted in how `asteval` performs handling of `FormattedValue` AST nodes. In particular, the `on_formattedvalue` value uses the dangerous format method of the str class. The code allows an attacker to manipulate the value of the string used in the dangerous call `fmt.format(__fstring__=val)`. This vulnerability can be exploited to access protected attributes by intentionally triggering an `AttributeError` exception. The attacker can then catch the exception and use its `obj` attribute to gain arbitrary access to sensitive or protected object properties. Version 1.0.6 fixes this issue.
CVSS Score: 8.4 (HIGH)
CWE: CWE-134, CWE-749
References: https://github.com/lmfit/asteval/blob/cfb57f0beebe0dc0520a1fbabc35e66060c7ea71/asteval/asteval.py#L507; https://github.com/lmfit/asteval/security/advisories/GHSA-3wwr-3g9f-9gc7; https://lucumr.pocoo.org/2016/12/29/careful-with-str-format
CVE: CVE-2019-15690
Published: 2025-01-24
Description: LibVNCServer 0.9.12 release and earlier contains heap buffer overflow vulnerability within the HandleCursorShape() function in libvncclient/cursor.c. An attacker sends cursor shapes with specially crafted dimensions, which can result in remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://ics-cert.kaspersky.com/vulnerabilities/klcert-20-009-remote-code-execution-on-libvnc-version-prior-to-0-9-12/
CVE: CVE-2024-35122
Published: 2025-01-24
Description: IBM i 7.2, 7.3, 7.4, and 7.5 is vulnerable to a file level local denial of service caused by an insufficient authority requirement. A local non-privileged user can configure a referential constraint with the privileges of a user socially engineered to access the target file.
CVSS Score: 2.8 (LOW)
CWE: CWE-266
References: https://www.ibm.com/support/pages/node/7178317
CVE: CVE-2024-56404
Published: 2025-01-24
Description: In One Identity Identity Manager 9.x before 9.3, an insecure direct object reference (IDOR) vulnerability allows privilege escalation. Only On-Premise installations are affected.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-302
References: https://support.oneidentity.com/product-notification/noti-00001678; https://support.oneidentity.com/technical-documents/identity-manager/9.3/release-notes/; https://www.oneidentity.com/community/identity-manager/
CVE: CVE-2025-0702
Published: 2025-01-24
Description: A vulnerability classified as critical was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. This vulnerability affects unknown code of the file src/main/java/io/github/controller/SysFileController.java. The manipulation of the argument portraitFile leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://github.com/JoeyBling/bootplus/issues/24; https://github.com/JoeyBling/bootplus/issues/24#issue[PII_REDACTED]; https://vuldb.com/?ctiid.293230
CVE: CVE-2025-24542
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Icegram Icegram icegram allows Stored XSS.This issue affects Icegram: from n/a through <= 3.1.31.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/icegram/vulnerability/wordpress-icegram-engage-plugin-3-1-31-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24543
Published: 2025-01-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in RSTheme Ultimate Coming Soon & Maintenance ultimate-coming-soon allows Cross Site Request Forgery.This issue affects Ultimate Coming Soon & Maintenance: from n/a through <= 1.0.9.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/ultimate-coming-soon/vulnerability/wordpress-ultimate-coming-soon-maintenance-plugin-1-0-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-24546
Published: 2025-01-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in RSTheme Ultimate Coming Soon & Maintenance ultimate-coming-soon allows Cross Site Request Forgery.This issue affects Ultimate Coming Soon & Maintenance: from n/a through <= 1.0.9.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/ultimate-coming-soon/vulnerability/wordpress-ultimate-coming-soon-maintenance-plugin-1-0-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-24547
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in matthias.wagner Caching Compatible Cookie Opt-In and JavaScript caching-compatible-cookie-optin-and-javascript allows Stored XSS.This issue affects Caching Compatible Cookie Opt-In and JavaScript: from n/a through <= 0.0.10.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/caching-compatible-cookie-optin-and-javascript/vulnerability/wordpress-caching-compatible-cookie-opt-in-plugin-0-0-10-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24552
Published: 2025-01-24
Description: Generation of Error Message Containing Sensitive Information vulnerability in paytiumsupport Paytium paytium allows Retrieve Embedded Sensitive Data.This issue affects Paytium: from n/a through <= 4.4.11.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://patchstack.com/database/Wordpress/Plugin/paytium/vulnerability/wordpress-paytium-plugin-4-4-11-full-path-disclosure-fpd-vulnerability?_s_id=cve
CVE: CVE-2025-24555
Published: 2025-01-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in subscriptiondna Subscription DNA subscriptiondna allows Stored XSS.This issue affects Subscription DNA: from n/a through <= 2.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/subscriptiondna/vulnerability/wordpress-subscription-dna-plugin-2-1-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24561
Published: 2025-01-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in awcode ReviewsTap reviewstap allows Stored XSS.This issue affects ReviewsTap: from n/a through <= 1.1.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/reviewstap/vulnerability/wordpress-reviewstap-plugin-1-1-2-csrf-to-stored-cross-site-scripting-vulnerability?_s_id=cve
CVE: CVE-2025-24562
Published: 2025-01-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Optimal Access KBucket kbucket allows Stored XSS.This issue affects KBucket: from n/a through <= 4.1.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/kbucket/vulnerability/wordpress-kbucket-plugin-4-1-6-csrf-to-stored-cross-site-scripting-vulnerability?_s_id=cve
CVE: CVE-2025-24568
Published: 2025-01-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force Starter Templates astra-sites allows Cross Site Request Forgery.This issue affects Starter Templates: from n/a through <= 4.4.9.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/astra-sites/vulnerability/wordpress-starter-templates-plugin-4-4-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-24570
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Stored XSS.This issue affects Atarim: from n/a through <= 4.0.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/atarim-visual-collaboration/vulnerability/wordpress-atarim-plugin-4-0-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24571
Published: 2025-01-24
Description: Missing Authorization vulnerability in Epsiloncool WP Fast Total Search fulltext-search allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Fast Total Search: from n/a through <= 1.78.258.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/fulltext-search/vulnerability/wordpress-wp-fast-total-search-plugin-1-78-258-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-24572
Published: 2025-01-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Epsiloncool WP Fast Total Search fulltext-search allows Cross Site Request Forgery.This issue affects WP Fast Total Search: from n/a through <= 1.78.258.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/fulltext-search/vulnerability/wordpress-wp-fast-total-search-plugin-1-78-258-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-24573
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Softaculous PageLayer pagelayer allows DOM-Based XSS.This issue affects PageLayer: from n/a through <= 1.9.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/pagelayer/vulnerability/wordpress-pagelayer-plugin-1-9-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24575
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HelloAsso HelloAsso helloasso allows Stored XSS.This issue affects HelloAsso: from n/a through <= 1.1.11.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/helloasso/vulnerability/wordpress-helloasso-plugin-1-1-11-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24578
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows DOM-Based XSS.This issue affects ElementInvader Addons for Elementor: from n/a through <= 1.3.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/elementinvader-addons-for-elementor/vulnerability/wordpress-elementinvader-addons-for-elementor-plugin-1-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24579
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kyle Phillips Nested Pages wp-nested-pages allows Stored XSS.This issue affects Nested Pages: from n/a through <= 3.2.9.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-nested-pages/vulnerability/wordpress-nested-pages-plugin-3-2-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24580
Published: 2025-01-24
Description: Missing Authorization vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 12 Step Meeting List: from n/a through <= 3.16.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/12-step-meeting-list/vulnerability/wordpress-12-step-meeting-list-plugin-3-16-5-arbitrary-content-deletion-vulnerability?_s_id=cve
CVE: CVE-2025-24582
Published: 2025-01-24
Description: Insertion of Sensitive Information Into Sent Data vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list allows Retrieve Embedded Sensitive Data.This issue affects 12 Step Meeting List: from n/a through <= 3.16.5.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-201
References: https://patchstack.com/database/Wordpress/Plugin/12-step-meeting-list/vulnerability/wordpress-12-step-meeting-list-plugin-3-16-5-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-24585
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Event post event-post allows Stored XSS.This issue affects Event post: from n/a through <= 5.9.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/event-post/vulnerability/wordpress-event-post-plugin-5-9-7-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24587
Published: 2025-01-24
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nks Email Subscription Popup email-subscribe allows Blind SQL Injection.This issue affects Email Subscription Popup: from n/a through <= 1.2.23.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/email-subscribe/vulnerability/wordpress-email-subscription-popup-plugin-1-2-23-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-24588
Published: 2025-01-24
Description: Missing Authorization vulnerability in patreon Patreon WordPress patreon-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Patreon WordPress: from n/a through <= 1.9.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/patreon-connect/vulnerability/wordpress-patreon-wordpress-plugin-1-9-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-24589
Published: 2025-01-24
Description: Missing Authorization vulnerability in JS Morisset JSM Show Post Metadata jsm-show-post-meta allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JSM Show Post Metadata: from n/a through <= 4.6.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/jsm-show-post-meta/vulnerability/wordpress-jsm-show-post-metadata-plugin-4-6-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-24591
Published: 2025-01-24
Description: Missing Authorization vulnerability in Ninja Team GDPR CCPA Compliance Support ninja-gdpr-compliance allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GDPR CCPA Compliance Support: from n/a through <= 2.7.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/ninja-gdpr-compliance/vulnerability/wordpress-gdpr-ccpa-compliance-cookie-consent-banner-plugin-2-7-1-broken-access-control-vulnerability?_s_id=cve