deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-41513
Published: 2024-10-04
Description: A reflected cross-site scripting (XSS) vulnerability in "Artikel.aspx" in CADClick v1.11.0 and before allows remote attackers to inject arbitrary web script or HTML via the "searchindex" parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://cadclick.de/; http://kimweb.de/; https://piuswalter.de/blog/multiple-critical-vulnerabilities-in-cadclick/
CVE: CVE-2024-41514
Published: 2024-10-04
Description: A reflected cross-site scripting (XSS) vulnerability in "PrevPgGroup.aspx" in CADClick v1.11.0 and before allows remote attackers to inject arbitrary web script or HTML via the "wer" parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://cadclick.de/; http://kimweb.de/; https://piuswalter.de/blog/multiple-critical-vulnerabilities-in-cadclick/
CVE: CVE-2024-41515
Published: 2024-10-04
Description: A reflected cross-site scripting (XSS) vulnerability in "ccHandlerResource.ashx" in CADClick <= 1.11.0 allows remote attackers to inject arbitrary web script or HTML via the "res_url" parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://cadclick.de/; http://kimweb.de/; https://piuswalter.de/blog/multiple-critical-vulnerabilities-in-cadclick/
CVE: CVE-2024-41516
Published: 2024-10-04
Description: A Reflected cross-site scripting (XSS) vulnerability in "ccHandler.aspx" CADClick <= 1.11.0 allows remote attackers to inject arbitrary web script or HTML via the "bomid" parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://cadclick.de/; http://kimweb.de/; https://piuswalter.de/blog/multiple-critical-vulnerabilities-in-cadclick/
CVE: CVE-2024-44439
Published: 2024-10-04
Description: An issue in Shanghai Zhouma Network Technology CO., Ltd IMS Intelligent Manufacturing Collaborative Internet of Things System v.1.9.1 allows a remote attacker to escalate privileges via the open port.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-269
References: https://smiling-lemonade-122.notion.site/f7da442e0f8a40fc846eea495dcdd329; https://www.notion.so/f7da442e0f8a40fc846eea495dcdd329?pvs=4
CVE: CVE-2024-47211
Published: 2024-10-04
Description: In OpenStack Ironic before 21.4.4, 22.x and 23.x before 23.0.3, 23.x and 24.x before 24.1.3, and 25.x and 26.x before 26.1.0, there is a lack of checksum validation of supplied image_source URLs when configured to convert images to a raw format for streaming.
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/openstack/ironic/compare/24.1.2...26.1.0; https://github.com/openstack/ironic/security; https://github.com/openstack/ironic/tags
CVE: CVE-2024-8148
Published: 2024-10-04
Description: There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.2 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2024-update-2-released/
CVE: CVE-2024-8149
Published: 2024-10-04
Description: There is a reflected Cross‑Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS versions 11.1 and 11.2 that may allow a remote, authenticated attacker with low‑privileged access to create a crafted link which, when clicked, could potentially execute arbitrary JavaScript code in the victim’s browser. Exploitation is limited to the same browser execution context and does not result in a change of security scope beyond the affected user session.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2024-update-2-released/
CVE: CVE-2023-26770
Published: 2024-10-04
Description: TaskCafe 0.3.2 lacks validation in the Cookie value. Any unauthenticated attacker who knows a registered UserID can change the password of that user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://bishopfox.com/blog/taskcafe-version-0-3-2-advisory; https://github.com/JordanKnott/taskcafe
CVE: CVE-2023-26771
Published: 2024-10-04
Description: Taskcafe 0.3.2 is vulnerable to Cross Site Scripting (XSS). There is a lack of validation in the filetype when uploading a SVG profile picture with a XSS payload on it. An authenticated attacker can exploit this vulnerability by uploading a malicious picture which will trigger the payload when the victim opens the file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://bishopfox.com/blog/taskcafe-version-0-3-2-advisory; https://github.com/JordanKnott/taskcafe
CVE: CVE-2024-46077
Published: 2024-10-04
Description: itsourcecode Online Tours and Travels Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via a crafted payload to the val-username, val-email, val-suggestions, val-digits and state_name parameters in travellers.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/n00bS3cLe4rner/CVE-s/blob/main/CVE-2024-46077.md; https://packetstormsecurity.com
CVE: CVE-2024-46078
Published: 2024-10-04
Description: itsourcecode Sports Management System Project 1.0 is vulnerable to SQL Injection in the function delete_category of the file sports_scheduling/player.php via the argument id.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/n00bS3cLe4rner/CVE-s/blob/main/CVE-2024-46078.md
CVE: CVE-2024-43683
Published: 2024-10-04
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Microchip TimeProvider 4100 allows XSS Through HTTP Headers.This issue affects TimeProvider 4100: from 1.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-grandmaster-improper-verification-of-host-header
CVE: CVE-2024-43684
Published: 2024-10-04
Description: Cross-Site Request Forgery (CSRF) vulnerability in Microchip TimeProvider 4100 allows Cross Site Request Forgery, Cross-Site Scripting (XSS).This issue affects TimeProvider 4100: from 1.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79, CWE-352, CWE-352
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-grandmaster-cross-site-request-forgery
CVE: CVE-2024-43685
Published: 2024-10-04
Description: Improper Authentication vulnerability in Microchip TimeProvider 4100 (login modules) allows Session Hijacking.This issue affects TimeProvider 4100: from 1.0 before 2.4.7.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-613
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-grandmaster-session-token-fixation
CVE: CVE-2024-43686
Published: 2024-10-04
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimeProvider 4100 (data plot modules) allows Reflected XSS.This issue affects TimeProvider 4100: from 1.0 before 2.4.7.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-grandmaster-reflected-xss-vulnerability
CVE: CVE-2024-43687
Published: 2024-10-04
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimeProvider 4100 (banner config modules) allows Cross-Site Scripting (XSS).This issue affects TimeProvider 4100: from 1.0 before 2.4.7.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-grandmaster-stored-xss-vulnerability-in-banner
CVE: CVE-2024-47764
Published: 2024-10-04
Description: cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.
CWE: CWE-74
References: https://github.com/jshttp/cookie/commit/e[PII_REDACTED]fea83bd8f34af72475eed1dadf5c; https://github.com/jshttp/cookie/pull/167; https://github.com/jshttp/cookie/security/advisories/GHSA-pxg6-pf52-xh8x
CVE: CVE-2024-7801
Published: 2024-10-04
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Microchip TimeProvider 4100 (Data plot modules) allows SQL Injection.This issue affects TimeProvider 4100: from 1.0 before 2.4.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-grandmaster-unathenticated-sql-injection
CVE: CVE-2024-9054
Published: 2024-10-04
Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Microchip TimeProvider 4100 (Configuration modules) allows Command Injection.This issue affects TimeProvider 4100: from 1.0 before 2.4.7.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-grandmaster-rce-through-configuration-file
CVE: CVE-2024-37868
Published: 2024-10-04
Description: File Upload vulnerability in Itsourcecode Online Discussion Forum Project v.1.0 allows a remote attacker to execute arbitrary code via the "sendreply.php" file, and the uploaded file was received using the "$- FILES" variable.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://gist.github.com/TERRENCE-REX/bfca92171143e28899bb8511f311f9ed; https://github.com/TERRENCE-REX/CVE/issues/1
CVE: CVE-2024-37869
Published: 2024-10-04
Description: File Upload vulnerability in Itsourcecode Online Discussion Forum Project v.1.0 allows a remote attacker to execute arbitrary code via the "poster.php" file, and the uploaded file was received using the "$- FILES" variable
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://gist.github.com/TERRENCE-REX/7e5dfdd3583bf9fd81196f557a8b8879; https://github.com/TERRENCE-REX/CVE/issues/2
CVE: CVE-2024-47910
Published: 2024-10-04
Description: An issue was discovered in SonarSource SonarQube before 9.9.5 LTA and 10.x before 10.5. A SonarQube user with the Administrator role can modify an existing configuration of a GitHub integration to exfiltrate a pre-signed JWT.
CVSS Score: 7.2 (HIGH)
CWE: CWE-284
References: https://community.sonarsource.com/t/sonarqube-github-integration-information-leakage/126609; https://sonarsource.atlassian.net/browse/SONAR-21795; https://sonarsource.atlassian.net/browse/SONAR-21813
CVE: CVE-2024-47911
Published: 2024-10-04
Description: In SonarSource SonarQube 10.4 through 10.5 before 10.6, a vulnerability was discovered in the authorizations/group-memberships API endpoint that allows SonarQube users with the administrator role to inject blind SQL commands.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-89
References: https://sonarsource.atlassian.net/browse/SONAR-22340
CVE: CVE-2024-47913
Published: 2024-10-04
Description: An issue was discovered in the AbuseFilter extension for MediaWiki before 1.39.9, 1.40.x and 1.41.x before 1.41.3, and 1.42.x before 1.42.2. An API caller can match a filter condition against AbuseFilter logs even if the caller is not authorized to view the log details for the filter.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-532
References: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/AbuseFilter/+/1076855; https://phabricator.wikimedia.org/T372998
CVE: CVE-2024-47848
Published: 2024-10-05
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - PageTriage allows Authentication Bypass.This issue affects Mediawiki - PageTriage: from 1.39.X before 1.39.9, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.
CWE: CWE-200
References: https://gerrit.wikimedia.org/r/q/I0288a715f7040a14ab7f70b2888fe1ef77a44588; https://phabricator.wikimedia.org/T366991; https://phabricator.wikimedia.org/T368628
CVE: CVE-2024-47840
Published: 2024-10-05
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Apex skin allows Stored XSS.This issue affects Mediawiki - Apex skin: from 1.39.X before 1.39.9, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gerrit.wikimedia.org/r/q/Id[PII_REDACTED]c3f8e6dcb5dc89f9493a5f5cf7bd7; https://phabricator.wikimedia.org/T368628; https://phabricator.wikimedia.org/T370081
CVE: CVE-2024-47845
Published: 2024-10-05
Description: Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Code Injection.This issue affects Mediawiki - CSS Extension: from 1.39.X before 1.39.9, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.
CVSS Score: 8.2 (HIGH)
CWE: CWE-116, CWE-116
References: https://gerrit.wikimedia.org/r/q/I6f38f4a8fc1dcd690ab27b8f18ce6ca903bacc53; https://phabricator.wikimedia.org/T368594; https://phabricator.wikimedia.org/T368628
CVE: CVE-2024-47846
Published: 2024-10-05
Description: Cross-Site Request Forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross Site Request Forgery.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1062723; https://phabricator.wikimedia.org/T368628; https://phabricator.wikimedia.org/T372209
CVE: CVE-2024-47847
Published: 2024-10-05
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063804; https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063806; https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063827
CVE: CVE-2024-47849
Published: 2024-10-05
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows SQL Injection.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1055963; https://phabricator.wikimedia.org/T368628; https://phabricator.wikimedia.org/T370632
CVE: CVE-2024-47841
Published: 2024-10-05
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Path Traversal.This issue affects Mediawiki - CSS Extension: from 1.42.X before 1.42.2, from 1.41.X before 1.41.3, from 1.39.X before 1.39.9.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://gerrit.wikimedia.org/r/q/I46613d8d50fc978bdac58e2b312ee03324c1edc8; https://phabricator.wikimedia.org/T368628; https://phabricator.wikimedia.org/T369486
CVE: CVE-2024-9385
Published: 2024-10-05
Description: The Themify Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 7.6.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/themify-builder/tags/7.6.2/classes/class-themify-builder-model.php#L1121; https://plugins.trac.wordpress.org/changeset/3162399/themify-builder/trunk/classes/class-themify-builder-model.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/a83e68e0-1b5b-4fd5-be00-37b8f11144c4?source=cve
CVE: CVE-2024-9455
Published: 2024-10-05
Description: The WP Cleanup and Basic Functions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/wp-cleanup-and-basic-functions/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/28bdaf44-6f2c-440a-a96f-bdcd71fb7bea?source=cve
CVE: CVE-2024-9528
Published: 2024-10-05
Description: The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form label fields in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with access to edit forms (administrator by default), to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/fluentform/tags/5.1.17/app/Services/FormBuilder/Components/BaseComponent.php#L191; https://plugins.trac.wordpress.org/browser/fluentform/tags/5.1.17/boot/globals.php#L342; https://plugins.trac.wordpress.org/changeset/3125227/
CVE: CVE-2024-8743
Published: 2024-10-05
Description: The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to Limited JavaScript File Upload in all versions up to, and including, 6.5.7. This is due to a lack of proper checks on allowed file types. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an administrator, to upload .css and .js files, which could lead to Stored Cross-Site Scripting.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/changeset/3161219/; https://www.wordfence.com/threat-intel/vulnerabilities/id/314520d5-bd9d-46c1-b903-5e5cb3bb3417?source=cve
CVE: CVE-2024-8486
Published: 2024-10-05
Description: The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in the Modern Heading and Icon Picker widgets all versions up to, and including, 2.16.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/auxin-elements/trunk/includes/elementor/widgets/heading-modern.php#L1168; https://plugins.trac.wordpress.org/browser/auxin-elements/trunk/includes/elementor/widgets/heading-modern.php#L1205; https://plugins.trac.wordpress.org/browser/auxin-elements/trunk/includes/elementor/widgets/icon.php#L397
CVE: CVE-2024-9532
Published: 2024-10-05
Description: A vulnerability has been found in D-Link DIR-605L 2.13B01 BETA and classified as critical. This vulnerability affects the function formAdvanceSetup of the file /goform/formAdvanceSetup. The manipulation of the argument webpage leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-605L/formAdvanceSetup.md; https://vuldb.com/?ctiid.279238; https://vuldb.com/?id.279238
CVE: CVE-2024-9417
Published: 2024-10-05
Description: The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to limited file uploads due to a misconfigured file type validation in the 'handleUpload' function in all versions up to, and including, 1.1.9. This makes it possible for unauthenticated attackers to upload files that are excluded from both the 'allowedExtensions' and 'unallowed_extensions' arrays on the affected site's server, including files that may contain cross-site scripting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/browser/hash-form/trunk/admin/classes/HashFormUploader.php#L107; https://plugins.trac.wordpress.org/browser/hash-form/trunk/admin/classes/HashFormUploader.php#L135; https://plugins.trac.wordpress.org/changeset/3161828/
CVE: CVE-2024-44011
Published: 2024-10-05
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ExpressTech Systems WP Ticket Ultra Help Desk & Support Plugin wp-ticket-ultra allows PHP Local File Inclusion.This issue affects WP Ticket Ultra Help Desk & Support Plugin: from n/a through <= 1.0.5.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/wp-ticket-ultra/vulnerability/wordpress-wp-ticket-ultra-plugin-1-0-5-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-44012
Published: 2024-10-05
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpdev33 WP Newsletter Subscription wp-newsletter-subscription allows PHP Local File Inclusion.This issue affects WP Newsletter Subscription: from n/a through <= 1.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/wp-newsletter-subscription/vulnerability/wordpress-wp-newsletter-subscription-plugin-1-1-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-44013
Published: 2024-10-05
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Innate Images LLC VR Calendar vr-calendar-sync allows PHP Local File Inclusion.This issue affects VR Calendar: from n/a through <= 2.4.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/vr-calendar-sync/vulnerability/wordpress-vr-calendar-plugin-2-4-0-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-44014
Published: 2024-10-05
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Vmax Studio Vmax Project Manager vmax-project-manager allows PHP Local File Inclusion.This issue affects Vmax Project Manager: from n/a through <= 1.0.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/vmax-project-manager/vulnerability/wordpress-vmax-project-manager-plugin-1-0-local-file-inclusion-to-rce-vulnerability?_s_id=cve
CVE: CVE-2024-44015
Published: 2024-10-05
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in istmoplugins Users Control users-control allows PHP Local File Inclusion.This issue affects Users Control: from n/a through <= 1.0.16.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/users-control/vulnerability/wordpress-users-control-plugin-1-0-16-local-file-inclusion-vulnerability?_s_id=cve