deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-7422
Published: 2024-08-16
Description: The Theme My Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.1.7. This is due to missing or incorrect nonce validation on the tml_admin_save_ms_settings() function. This makes it possible for unauthenticated attackers to update the theme's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Please note that this only affects multi-site instances.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/changeset/3135854/theme-my-login/trunk/admin/settings.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/0fb8e956-3a95-4e55-9816-be7eddb5835d?source=cve
CVE: CVE-2024-7301
Published: 2024-08-16
Description: The WordPress File Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.24.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-file-upload/tags/4.24.8/lib/wfu_io.php#L176; https://plugins.trac.wordpress.org/browser/wp-file-upload/tags/4.24.8/lib/wfu_security.php#L50; https://plugins.trac.wordpress.org/changeset/3136025/
CVE: CVE-2024-6460
Published: 2024-08-16
Description: The Grow by Tradedoubler  WordPress plugin through 2.0.21 is vulnerable to Local File Inclusion via the component parameter. This makes it possible for attackers to include and execute PHP files on the server, allowing the execution of any PHP code in those files.
CVSS Score: 9.8 (CRITICAL)
References: https://wpscan.com/vulnerability/ba2f53e0-30be-4f37-91bc-5fa151f1eee7/
CVE: CVE-2024-7501
Published: 2024-08-16
Description: The Download Plugins and Themes in ZIP from Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.7. This is due to missing or incorrect nonce validation on the download_theme() function. This makes it possible for unauthenticated attackers to download arbitrary themes from the website via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. In versions prior to 1.8.6 it was possible to download the entire sites files.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/changeset/3136231/download-plugins-dashboard/tags/1.8.8/includes/class-alg-download-plugins-core.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/dcbfcaeb-2635-4b11-b426-ee04345d5f36?source=cve
CVE: CVE-2024-25008
Published: 2024-08-16
Description: Ericsson RAN Compute and Site Controller 6610 contains a vulnerability in the Control System where Improper Input Validation can lead to arbitrary code execution, for example to obtain a Linux Shell with the same privileges as the attacker. The attacker would require elevated privileges for example a valid OAM user having the system administrator role to exploit the vulnerability.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: https://www.ericsson.com/en/about-us/security/psirt/security-bulletin-ericsson-ran-compute-august-2024
CVE: CVE-2024-7136
Published: 2024-08-16
Description: The JetSearch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 3.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://crocoblock.com/plugins/jetsearch/; https://www.wordfence.com/threat-intel/vulnerabilities/id/9fe9fe85-bcb5-4e12-b879-31bc73074eed?source=cve
CVE: CVE-2024-7146
Published: 2024-08-16
Description: The JetTabs for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.3 via the 'switcher_preset' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://crocoblock.com/plugins/jettabs/; https://www.wordfence.com/threat-intel/vulnerabilities/id/a401a2dd-9b31-47d9-b841-f2e7042b8333?source=cve
CVE: CVE-2024-7147
Published: 2024-08-16
Description: The JetBlocks for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple placeholder parameters in all versions up to, and including, 1.3.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://crocoblock.com/plugins/jetblocks/; https://www.wordfence.com/threat-intel/vulnerabilities/id/21f8908c-bcfc-4ca1-bc8b-80a80c4a5a4f?source=cve
CVE: CVE-2024-42462
Published: 2024-08-16
Description: Improper Authentication vulnerability in upKeeper Solutions product upKeeper Manager allows Authentication Bypass.This issue affects upKeeper Manager: through 5.1.9.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-287
References: https://support.upkeeper.se/hc/en-us/articles/[PII_REDACTED]452-CVE-2024-42462-Bypass-multifactor-authentication
CVE: CVE-2024-42463
Published: 2024-08-16
Description: Authorization Bypass Through User-Controlled Key vulnerability in upKeeper Solutions product upKeeper Manager allows Utilizing REST's Trust in the System Resource to Obtain Sensitive Data.This issue affects upKeeper Manager: through 5.1.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://support.upkeeper.se/hc/en-us/articles/[PII_REDACTED]620-CVE-2024-42463-Leak-of-organizations-messages
CVE: CVE-2024-42464
Published: 2024-08-16
Description: Authorization Bypass Through User-Controlled Key vulnerability in upKeeper Solutions product upKeeper Manager allows Utilizing REST's Trust in the System Resource to Obtain Sensitive Data.This issue affects upKeeper Manager: through 5.1.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://support.upkeeper.se/hc/en-us/articles/[PII_REDACTED]044-CVE-2024-42464-Leak-of-user-Information
CVE: CVE-2024-42465
Published: 2024-08-16
Description: Improper Restriction of Excessive Authentication Attempts vulnerability in upKeeper Solutions product upKeeper Manager allows Authentication Abuse.This issue affects upKeeper Manager: through 5.1.9.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307, CWE-307
References: https://support.upkeeper.se/hc/en-us/articles/[PII_REDACTED]564-CVE-2024-42465-Lack-of-resources-and-rate-limiting-two-factor-authentication
CVE: CVE-2024-42466
Published: 2024-08-16
Description: Improper Restriction of Excessive Authentication Attempts vulnerability in upKeeper Solutions product upKeeper Manager allows Authentication Abuse.This issue affects upKeeper Manager: through 5.1.9.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307, CWE-307
References: https://support.upkeeper.se/hc/en-us/articles/[PII_REDACTED]260-CVE-2024-42466-Lack-of-resources-and-rate-limiting-login
CVE: CVE-2024-7144
Published: 2024-08-16
Description: The JetElements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' and 'slide_id' parameters in all versions up to, and including, 2.6.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://crocoblock.com/plugins/jetelements/; https://www.wordfence.com/threat-intel/vulnerabilities/id/c5e64adf-49b3-4e85-8dc1-918f7e92965b?source=cve
CVE: CVE-2024-7145
Published: 2024-08-16
Description: The JetElements plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.6.20 via the 'progress_type' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-22
References: https://crocoblock.com/plugins/jetelements/; https://www.wordfence.com/threat-intel/vulnerabilities/id/793f27ec-a3bb-4273-a41c-cc5b04c8e8fc?source=cve
CVE: CVE-2024-2175
Published: 2024-08-16
Description: An insecure permissions vulnerability was reported in Lenovo Display Control Center (LDCC) and Lenovo Accessories and Display Manager (LADM)

 that could allow a local attacker to escalate privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://support.lenovo.com/us/en/product_security/LEN-155486
CVE: CVE-2024-42486
Published: 2024-08-16
Description: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In versions on the 1.15.x branch prior to 1.15.8 and the 1.16.x branch prior to 1.16.1, ReferenceGrant changes are not correctly propagated in Cilium's GatewayAPI controller, which could lead to Gateway resources being able to access secrets for longer than intended, or to Routes having the ability to forward traffic to backends in other namespaces for longer than intended. This issue has been patched in Cilium v1.15.8 and v1.16.1. As a workaround, any modification of a related Gateway/HTTPRoute/GRPCRoute/TCPRoute CRD (for example, adding any label to any of these resources) will trigger a reconciliation of ReferenceGrants on an affected cluster.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-200
References: https://github.com/cilium/cilium/commit/ed3dfa0aab8b80f7e841a6d49d2a990ac2dca053; https://github.com/cilium/cilium/pull/34032; https://github.com/cilium/cilium/security/advisories/GHSA-vwf8-q6fw-4wcm
CVE: CVE-2024-43381
Published: 2024-08-16
Description: reNgine is an automated reconnaissance framework for web applications. Versions 2.1.2 and prior are susceptible to Stored Cross-Site Scripting (XSS) attacks. This vulnerability occurs when scanning a domain, and if the target domain's DNS record contains an XSS payload, it leads to the execution of malicious scripts in the reNgine's dashboard view when any user views the scan results. The XSS payload is directly fetched from the DNS record of the remote target domain. Consequently, an attacker can execute the attack without requiring any additional input from the target or the reNgine user. A patch is available and expected to be part of version 2.1.3.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-79, CWE-87, CWE-79
References: https://github.com/yogeshojha/rengine/commit/064bac1c7c4d2b90745bf225c92e74d83edb7a4d; https://github.com/yogeshojha/rengine/security/advisories/GHSA-96q4-fj2m-jqf7
CVE: CVE-2024-43807
Published: 2024-08-16
Description: In JetBrains TeamCity before 2024.07.1 multiple stored XSS was possible on Clouds page
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-43808
Published: 2024-08-16
Description: In JetBrains TeamCity before 2024.07.1 self XSS was possible in the HashiCorp Vault plugin
CVSS Score: 3.7 (LOW)
CWE: CWE-79, CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-43809
Published: 2024-08-16
Description: In JetBrains TeamCity before 2024.07.1 reflected XSS was possible on the agentPushPreset page
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-43810
Published: 2024-08-16
Description: In JetBrains TeamCity before 2024.07.1 reflected XSS was possible in the AWS Core plugin
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-4763
Published: 2024-08-16
Description: An insecure driver vulnerability was reported in Lenovo Display Control Center (LDCC) and Lenovo Accessories and Display Manager (LADM)

 that could allow a local attacker to escalate privileges to kernel.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://support.lenovo.com/us/en/product_security/LEN-155486
CVE: CVE-2024-4781
Published: 2024-08-16
Description: A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to crash printer communications until the system is rebooted.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://iknow.lenovo.com.cn/detail/422688
CVE: CVE-2024-4782
Published: 2024-08-16
Description: A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to disrupt the printer's functionality until a manual system reboot occurs.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://iknow.lenovo.com.cn/detail/422688
CVE: CVE-2024-5209
Published: 2024-08-16
Description: A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to deny printing capabilities until the system is rebooted.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://iknow.lenovo.com.cn/detail/422688
CVE: CVE-2024-5210
Published: 2024-08-16
Description: A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to prevent printer services from being reachable until the system is rebooted.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://iknow.lenovo.com.cn/detail/422688
CVE: CVE-2024-6004
Published: 2024-08-16
Description: A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to deny printer connections until the system is rebooted.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://iknow.lenovo.com.cn/detail/422688
CVE: CVE-2024-6098
Published: 2024-08-16
Description: When performing an online tag generation to devices which communicate 
using the ControlLogix protocol, a machine-in-the-middle, or a device 
that is not configured correctly, could deliver a response leading to 
unrestricted or unregulated resource allocation. This could cause a 
denial-of-service condition and crash the Kepware application. By 
default, these functions are turned off, yet they remain accessible for 
users who recognize and require their advantages.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-228-11; https://www.ptc.com/en/support/article/CS423892
CVE: CVE-2024-42634
Published: 2024-08-16
Description: A Command Injection vulnerability exists in formWriteFacMac of the httpd binary in Tenda AC9 v15.03.06.42. As a result, attacker can execute OS commands with root privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/goldds96/Report/blob/main/Tenda/AC9/CI.md
CVE: CVE-2024-42994
Published: 2024-08-16
Description: VTiger CRM <= 8.1.0 does not properly sanitize user input before using it in a SQL statement, leading to a SQL Injection in the "CompanyDetails" operation of the "MailManager" module.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://www.shielder.com/advisories/vtiger-mailmanager-sqli/
CVE: CVE-2024-42995
Published: 2024-08-16
Description: VTiger CRM <= 8.1.0 does not correctly check user privileges. A low-privileged user can interact directly with the "Migration" administrative module to disable arbitrary modules.
CVSS Score: 8.3 (HIGH)
CWE: CWE-269
References: https://www.shielder.com/advisories/vtiger-migration-bac/
CVE: CVE-2023-2920
Published: 2024-08-16
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-1503. Reason: This candidate is a reservation duplicate of CVE-2024-1503. Notes: All CVE users should reference CVE-2024-1503 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-25837
Published: 2024-08-16
Description: A stored cross-site scripting (XSS) vulnerability in October CMS Bloghub Plugin v1.3.8 and lower allows attackers to execute arbitrary web scripts or HTML via a crafted payload into the Comments section.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/RatMD/bloghub-plugin/blob/master/CHANGELOG.md#version-139---stable; https://www.getastra.com/blog/vulnerability/stored-xss-vulnerability-in-bloghub-plugin/
CVE: CVE-2024-42637
Published: 2024-08-16
Description: H3C R3010 v100R002L02 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://palm-vertebra-fe9.notion.site/H3C-R3010V100R002L02-was-discovered-to-contain-a-hardcoded-d3212602f84443d4b17e3247b3e6b129; https://www.h3c.com/cn/d_202308/1907175_30005_0.htm
CVE: CVE-2024-42638
Published: 2024-08-16
Description: H3C Magic B1ST v100R012 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://palm-vertebra-fe9.notion.site/H3C-Magic-B1STV100R012-was-discovered-to-contain-a-hardcoded-2a648569ee7f4df8b570632d11032337?pvs=74; https://www.h3c.com/cn/d_201609/956059_30005_0.htm
CVE: CVE-2024-42639
Published: 2024-08-16
Description: H3C GR1100-P v100R009 was discovered to use a hardcoded password in /etc/shadow, which allows attackers to log in as root.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-259
References: https://palm-vertebra-fe9.notion.site/H3C-GR1100-PV100R009-was-discovered-to-contain-a-hardcoded-824141daa44f4c52a914860c6e4a7684; https://www.h3c.com/cn/d_202308/1912371_30005_0.htm
CVE: CVE-2024-42758
Published: 2024-08-16
Description: A Cross-site Scripting (XSS) vulnerability exists in version v2024-01-05 of the indexmenu plugin when is used and enabled in Dokuwiki (Open Source Wiki Engine). A malicious attacker can input XSS payloads for example when creating or editing existing page, to trigger the XSS on Dokuwiki, which is then stored in .txt file (due to nature of how Dokuwiki is designed), which presents stored XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/1s1ldur/CVE-2024-42758/blob/main/README.md; https://github.com/dokuwiki/dokuwiki; https://github.com/samuelet/indexmenu
CVE: CVE-2024-7646
Published: 2024-08-16
Description: A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects (in the `networking.k8s.io` or `extensions` API group) can bypass annotation validation to inject arbitrary commands and obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://github.com/kubernetes/ingress-nginx/pull/11719; https://github.com/kubernetes/ingress-nginx/pull/11721; https://github.com/kubernetes/kubernetes/issues/126744
CVE: CVE-2022-33162
Published: 2024-08-16
Description: IBM Security Directory Integrator 7.2.0 and Security Verify Directory Integrator 10.0.0 does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources, at the privilege level of a standard unprivileged user.  IBM X-Force ID:  228570.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/228570; https://www.ibm.com/support/pages/node/7161442
CVE: CVE-2022-4405
Published: 2024-08-16
Description: Rejected reason: **REJECT** This is not considered a valid security vulnerability.
CVE: CVE-2023-5888
Published: 2024-08-16
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-7246. Reason: This candidate is a reservation duplicate of CVE-2023-7246. Notes: All CVE users should reference CVE-2023-7246 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-42849
Published: 2024-08-16
Description: An issue in Silverpeas v.6.4.2 and lower allows a remote attacker to cause a denial of service via the password change function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: http://silverpeas.com; https://github.com/njmbb8/CVE-2024-42849/tree/main
CVE: CVE-2024-42850
Published: 2024-08-16
Description: An issue in the password change function of Silverpeas v6.4.2 and lower allows for the bypassing of password complexity requirements.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-521
References: http://silverpeas.com; https://github.com/njmbb8/CVE-2024-42850
CVE: CVE-2023-3207
Published: 2024-08-16
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-31237. Reason: This candidate is a reservation duplicate of CVE-2024-31237. Notes: All CVE users should reference CVE-2024-31237 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2023-47728
Published: 2024-08-16
Description: IBM QRadar Suite Software 1.10.12.0 through 1.10.22.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the request.  This information could be used in further attacks against the system.  IBM X-Force ID:  272201.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/272201; https://www.ibm.com/support/pages/node/7161427
CVE: CVE-2023-4717
Published: 2024-08-16
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-43005
Published: 2024-08-16
Description: A reflected cross-site scripting (XSS) vulnerability in the component dl_liuyan_save.php of ZZCMS v2023 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: http://zzcms.net; https://github.com/gkdgkd123/codeAudit/blob/main/CVE-2024-43005%20ZZCMS2023%E5%8F%8D%E5%B0%84%E5%9E%8BXSS2.md
CVE: CVE-2024-43006
Published: 2024-08-16
Description: A stored cross-site scripting (XSS) vulnerability exists in ZZCMS2023 in the ask/show.php file at line 21. An attacker can exploit this vulnerability by sending a specially crafted POST request to /user/ask_edit.php?action=add, which includes malicious JavaScript code in the 'content' parameter. When a user visits the ask/show_{newsid}.html page, the injected script is executed in the context of the user's browser, leading to potential theft of cookies, session tokens, or other sensitive information.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.zzcms.net/about/download.html; https://github.com/gkdgkd123/codeAudit/blob/main/CVE-2024-43006%20ZZCMS2023%E5%82%A8%E5%AD%98%E5%9E%8BXSS.md