deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-36528
Published: 2025-06-09
Description: Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in Service Account Auditing reports.
CVSS Score: 8.3 (HIGH)
CWE: CWE-89
References: https://www.manageengine.com/products/active-directory-audit/cve-2025-36528.html
CVE: CVE-2025-3835
Published: 2025-06-09
Description: Zohocorp ManageEngine Exchange Reporter Plus versions 5721 and prior are vulnerable to Remote code execution in the Content Search module.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-434
References: https://www.manageengine.com/products/exchange-reports/advisory/CVE-2025-3835.html
CVE: CVE-2025-41437
Published: 2025-06-09
Description: Zohocorp ManageEngine OpManager, NetFlow Analyzer, Network Configuration Manager, Firewall Analyzer and OpUtils versions 128565 and below are vulnerable to Reflected XSS on the login page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://www.manageengine.com/itom/advisory/cve-2025-41437.html
CVE: CVE-2025-5873
Published: 2025-06-09
Description: A vulnerability was detected in eCharge Hardy Barth Salia PLCC up to 2.3.81. Affected by this issue is some unknown functionality of the file /firmware.php of the component Web UI. Performing a manipulation of the argument media results in unrestricted upload. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://github.com/YZS17/CVE/blob/main/Salia_PLCC/Salia_PLCC_Slave_v2.2.0_File_Upload.md; https://vuldb.com/?ctiid.311632; https://vuldb.com/?id.311632
CVE: CVE-2025-5874
Published: 2025-06-09
Description: A vulnerability was found in Redash up to 10.1.0/25.1.0. It has been rated as problematic. This issue affects the function run_query of the file /query_runner/python.py of the component getattr Handler. The manipulation leads to sandbox issue. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor explains, that "[t]he Python data source is disabled by default and is clearly marked in our documentation as discouraged due to its security implications. Users who choose to enable it are doing so at their own risk, with full awareness that it bypasses standard safeguards."
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264, CWE-265
References: https://gist.github.com/superboy-zjc/1f89d375e2408ed843dc2cf0bb1bb894; https://gist.github.com/superboy-zjc/1f89d375e2408ed843dc2cf0bb1bb894#proof-of-concept; https://vuldb.com/?ctiid.311633
CVE: CVE-2025-41444
Published: 2025-06-09
Description: Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the alerts module.
CVSS Score: 8.3 (HIGH)
CWE: CWE-89
References: https://www.manageengine.com/products/active-directory-audit/cve-2025-41444.html
CVE: CVE-2025-5875
Published: 2025-06-09
Description: A vulnerability classified as critical has been found in TP-LINK Technologies TL-IPC544EP-W4 1.0.9 Build 240428 Rel 69493n. Affected is the function sub_69064 of the file /bin/main. The manipulation of the argument text leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://locrian-lightning-dc7.notion.site/TL-IPC544EP-W4-1f98e5e2b1a280ae9862d49391d95651; https://vuldb.com/?ctiid.311634; https://vuldb.com/?id.311634
CVE: CVE-2025-5876
Published: 2025-06-09
Description: A vulnerability classified as problematic was found in Lucky LM-520-SC, LM-520-FSC and LM-520-FSC-SAM up to 20250321. Affected by this vulnerability is an unknown functionality. The manipulation leads to missing authentication. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287, CWE-306
References: https://github.com/zeke2997/cve_request_LuckyTechnologyLtd; https://vuldb.com/?ctiid.311635; https://vuldb.com/?id.311635
CVE: CVE-2025-40668
Published: 2025-06-09
Description: Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an attacker, with low privilege level, to change the password of other users through a POST request using the parameters idUser, PasswordActual, PasswordNew and PasswordNewRepeat in /PC/WebService.aspx/validateChangePassword%C3%B1a. To exploit the vulnerability the PasswordActual parameter must be empty.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tcman-gim-1
CVE: CVE-2025-40669
Published: 2025-06-09
Description: Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an unprivileged attacker to modify the permissions held by each of the application's users, including the user himself by sending a POST request to /PC/Options.aspx?Command=2&amp;Page=-1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tcman-gim-1
CVE: CVE-2025-40670
Published: 2025-06-09
Description: Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an unprivileged attacker to create a user and assign it many privileges by sending a POST request to /PC/frmGestionUser.aspx/updateUser.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tcman-gim-1
CVE: CVE-2025-48053
Published: 2025-06-09
Description: Discourse is an open-source discussion platform. Prior to version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch, sending a malicious URL in a PM to a bot user can cause a reduced the availability of a Discourse instance. This issue is patched in version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch. No known workarounds are available.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-770
References: https://github.com/discourse/discourse/security/advisories/GHSA-3q5q-qmrm-rvwx
CVE: CVE-2025-48062
Published: 2025-06-09
Description: Discourse is an open-source discussion platform. Prior to version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch, certain invites via email may result in HTML injection in the email body if the topic title includes HTML. This includes inviting someone (without an account) to a PM and inviting someone (without an account) to a topic with a custom message. This issue is patched in version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch. This can be worked around if the relevant templates are overridden without `{topic_title}`.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-116, CWE-79
References: https://github.com/discourse/discourse/security/advisories/GHSA-x8mp-chx3-6x2p
CVE: CVE-2025-48877
Published: 2025-06-09
Description: Discourse is an open-source discussion platform. Prior to version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch, Codepen is present in the default `allowed_iframes` site setting, and it can potentially auto-run arbitrary JS in the iframe scope, which is unintended. This issue is patched in version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch. As a workaround, the Codepen prefix can be removed from a site's `allowed_iframes`.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1038
References: https://github.com/discourse/discourse/security/advisories/GHSA-cm93-6m2m-cjcv
CVE: CVE-2025-49006
Published: 2025-06-09
Description: Wasp (Web Application Specification) is a Rails-like framework for React, Node.js, and Prisma. Prior to version 0.16.6, Wasp authentication has a vulnerability in the OAuth authentication implementation (affecting only Keycloak with a specific config). Wasp currently lowercases OAuth user IDs before storing / fetching them. This behavior violates OAuth and OpenID Connect specifications and can result in user impersonation, account collisions, and privilege escalation. In practice, out of the OAuth providers that Wasp auth supports, only Keycloak is affected. Keycloak uses a lowercase UUID by default, but users can configure it to be case sensitive, making it affected. Google, GitHub, and Discord use numerical IDs, making them not affected. Users should update their Wasp version to `0.16.6` which has a fix for the problematic behavior. Users using Keycloak can work around the issue by not using a case sensitive user ID in their realm configuration.
CWE: CWE-276
References: https://github.com/wasp-lang/wasp/commit/433b9b7f491c172db656fb94cc85e5bd7d614b74; https://github.com/wasp-lang/wasp/security/advisories/GHSA-qvjc-6xv7-6v5f; https://wasp-lang.notion.site/PUB-Case-insensitive-OAuth-ID-vulnerability-20018a74854c8064a2bfebe4eaf5fceb
CVE: CVE-2025-49013
Published: 2025-06-09
Description: WilderForge is a Wildermyth coremodding API. A critical vulnerability has been identified in multiple projects across the WilderForge organization. The issue arises from unsafe usage of `${{ github.event.review.body }}` and other user controlled variables directly inside shell script contexts in GitHub Actions workflows. This introduces a code injection vulnerability: a malicious actor submitting a crafted pull request review containing shell metacharacters or commands could execute arbitrary shell code on the GitHub Actions runner. This can lead to arbitrary command execution with the permissions of the workflow, potentially compromising CI infrastructure, secrets, and build outputs. Developers who maintain or contribute to the repos WilderForge/WilderForge, WilderForge/ExampleMod, WilderForge/WilderWorkspace, WilderForge/WildermythGameProvider, WilderForge/AutoSplitter, WilderForge/SpASM, WilderForge/thrixlvault, WilderForge/MassHash, and/or WilderForge/DLC_Disabler; as well as users who fork any of the above repositories and reuse affected GitHub Actions workflows, are affected. End users of any the above software and users who only install pre-built releases or artifacts are not affected. This vulnerability does not impact runtime behavior of the software or compiled outputs unless those outputs were produced during exploitation of this vulnerability. A current workaround is to disable GitHub Actions in affected repositories, or remove the affected workflows.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-94, CWE-95, CWE-116
References: https://codeql.github.com/codeql-query-help/javascript/js-actions-command-injection; https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#preventing-script-injection; https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injection
CVE: CVE-2025-49130
Published: 2025-06-09
Description: Laravel Translation Manager is a package to manage Laravel translation files. Prior to version 0.6.8, the application is vulnerable to Cross-Site Scripting (XSS) attacks due to incorrect input validation and sanitization of user-input data. An attacker can inject arbitrary HTML code, including JavaScript scripts, into the page processed by the user's browser, allowing them to steal sensitive data, hijack user sessions, or conduct other malicious activities. Only authenticated users with access to the translation manager are impacted. The issue is fixed in version 0.6.8.
CWE: CWE-79
References: https://github.com/barryvdh/laravel-translation-manager/commit/527446ed419f90f2319675fc5211cb8f851d7a1f; https://github.com/barryvdh/laravel-translation-manager/pull/475; https://github.com/barryvdh/laravel-translation-manager/releases/tag/v0.6.8
CVE: CVE-2025-49131
Published: 2025-06-09
Description: FastGPT is an open-source project that provides a platform for building, deploying, and operating AI-driven workflows and conversational agents. The Sandbox container (fastgpt-sandbox) is a specialized, isolated environment used by FastGPT to safely execute user-submitted or dynamically generated code in isolation. The sandbox before version 4.9.11 has insufficient isolation and inadequate restrictions on code execution by allowing overly permissive syscalls, which allows attackers to escape the intended sandbox boundaries. Attackers could exploit this to read and overwrite arbitrary files and bypass Python module import restrictions. This is patched in version 4.9.11 by restricting the allowed system calls to a safer subset and additional descriptive error messaging.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-732
References: https://github.com/labring/FastGPT/commit/bb810a43a1c70683fab7f5fe993771e930a94426; https://github.com/labring/FastGPT/pkgs/container/fastgpt-sandbox; https://github.com/labring/FastGPT/pull/4958
CVE: CVE-2025-5877
Published: 2025-06-09
Description: A vulnerability, which was classified as problematic, has been found in Fengoffice Feng Office 3.2.2.1. Affected by this issue is some unknown functionality of the file /application/models/ApplicationDataObject.class.php of the component Document Upload Handler. The manipulation leads to xml external entity reference. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-610, CWE-611
References: https://gist.github.com/mcdruid/e78694d754f[PII_REDACTED]8be082fcbaa; https://gist.github.com/mcdruid/e78694d754f[PII_REDACTED]8be082fcbaa#steps-to-reproduce; https://vuldb.com/?ctiid.311636
CVE: CVE-2025-5879
Published: 2025-06-09
Description: A vulnerability, which was classified as problematic, was found in WuKongOpenSource WukongCRM 9.0. This affects an unknown part of the file AdminSysConfigController.java of the component File Upload. The manipulation of the argument File leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/Aiyakami/CVE-1/issues/7; https://vuldb.com/?ctiid.311637; https://vuldb.com/?id.311637
CVE: CVE-2025-5880
Published: 2025-06-09
Description: A vulnerability has been found in Whistle 2.9.98 and classified as problematic. This vulnerability affects unknown code of the file /cgi-bin/sessions/get-temp-file. The manipulation of the argument filename leads to path traversal. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://vuldb.com/?ctiid.311638; https://vuldb.com/?id.311638; https://vuldb.com/?submit.582867
CVE: CVE-2025-5881
Published: 2025-06-09
Description: A vulnerability was found in code-projects Chat System up to 1.0 and classified as critical. This issue affects some unknown processing of the file /user/confirm_password.php. The manipulation of the argument cid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/LamentXU123/cve/blob/main/sql4.md; https://vuldb.com/?ctiid.311639
CVE: CVE-2025-5884
Published: 2025-06-09
Description: A vulnerability, which was classified as problematic, was found in Konica Minolta bizhub up to 20250202. This affects an unknown part of the component Display MFP Information List. The manipulation of the argument Model Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://drive.google.com/file/d/1A0JEnmnUGNjGsizRu99uz2ynqQ3v9ZKB/view; https://vuldb.com/?ctiid.311655; https://vuldb.com/?id.311655
CVE: CVE-2025-5885
Published: 2025-06-09
Description: A vulnerability has been found in Konica Minolta bizhub up to 20250202 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862, CWE-352
References: https://drive.google.com/file/d/1pECiiSWdB_ERzzGrc--WY63IzZxR6i6L/view; https://vuldb.com/?ctiid.311656; https://vuldb.com/?id.311656
CVE: CVE-2023-25999
Published: 2025-06-09
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme BodyCenter - Gym, Fitness WooCommerce WordPress Theme allows PHP Local File Inclusion. This issue affects BodyCenter - Gym, Fitness WooCommerce WordPress Theme: from n/a through 2.4.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/wordpress/theme/bodycenter/vulnerability/wordpress-bodycenter-gym-fitness-woocommerce-wordpress-theme-2-4-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2023-26005
Published: 2025-06-09
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme Fitrush allows PHP Local File Inclusion. This issue affects Fitrush: from n/a through 1.3.4.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/wordpress/theme/bw-fitrush/vulnerability/wordpress-fitrush-1-3-4-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-23974
Published: 2025-06-09
Description: Incorrect Privilege Assignment vulnerability in ifkooo One-Login one-login allows Privilege Escalation.This issue affects One-Login: from n/a through <= 1.4.
CVSS Score: 8.1 (HIGH)
CWE: CWE-266
References: https://patchstack.com/database/Wordpress/Plugin/one-login/vulnerability/wordpress-one-login-1-4-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2025-24767
Published: 2025-06-09
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in facturaone TicketBAI Facturas para WooCommerce wp-ticketbai allows Blind SQL Injection.This issue affects TicketBAI Facturas para WooCommerce: from n/a through <= 3.19.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/wp-ticketbai/vulnerability/wordpress-ticketbai-facturas-para-woocommerce-3-19-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-24768
Published: 2025-06-09
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme Nitan snsnitan allows PHP Local File Inclusion.This issue affects Nitan: from n/a through <= 2.9.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/snsnitan/vulnerability/wordpress-nitan-2-9-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-24770
Published: 2025-06-09
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme CraftXtore bw-craftxtore allows PHP Local File Inclusion.This issue affects CraftXtore: from n/a through <= 1.7.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/bw-craftxtore/vulnerability/wordpress-craftxtore-1-7-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-26592
Published: 2025-06-09
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Lab lab allows PHP Local File Inclusion.This issue affects Lab: from n/a through <= 1.0.0.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/lab/vulnerability/wordpress-lab-theme-1-0-0-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-27362
Published: 2025-06-09
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme Petito bw-petito allows PHP Local File Inclusion.This issue affects Petito: from n/a through < 1.6.6.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/bw-petito/vulnerability/wordpress-petito-1-6-2-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-28888
Published: 2025-06-09
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme GiftXtore bw-giftxtore allows PHP Local File Inclusion.This issue affects GiftXtore: from n/a through < 1.7.7.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/bw-giftxtore/vulnerability/wordpress-giftxtore-1-7-4-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-28944
Published: 2025-06-09
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme Avaz snsavaz allows PHP Local File Inclusion.This issue affects Avaz: from n/a through <= 2.8.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/snsavaz/vulnerability/wordpress-avaz-2-8-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-28945
Published: 2025-06-09
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme Valen - Sport, Fashion WooCommerce WordPress Theme valen allows PHP Local File Inclusion.This issue affects Valen - Sport, Fashion WooCommerce WordPress Theme: from n/a through <= 2.4.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/valen/vulnerability/wordpress-valen-sport-fashion-woocommerce-wordpress-theme-2-4-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-28992
Published: 2025-06-09
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme SNS Anton snsanton allows PHP Local File Inclusion.This issue affects SNS Anton: from n/a through <= 4.1.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/snsanton/vulnerability/wordpress-sns-anton-4-1-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-31019
Published: 2025-06-09
Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Password Policy Manager password-policy-manager allows Authentication Abuse.This issue affects Password Policy Manager: from n/a through <= 2.0.4.
CVSS Score: 8.8 (HIGH)
CWE: CWE-288
References: https://patchstack.com/database/Wordpress/Plugin/password-policy-manager/vulnerability/wordpress-password-policy-manager-plugin-2-0-4-account-takeover-vulnerability?_s_id=cve
CVE: CVE-2025-31022
Published: 2025-06-09
Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in PayU India PayU India payu-india allows Authentication Abuse.This issue affects PayU India: from n/a through < 3.8.8.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://patchstack.com/database/Wordpress/Plugin/payu-india/vulnerability/wordpress-payu-india-plugin-3-8-5-account-takeover-vulnerability?_s_id=cve