deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-34571
Published: 2024-05-08
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill Himalayas allows Stored XSS.This issue affects Himalayas: from n/a through 1.3.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/himalayas/wordpress-himalayas-theme-1-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/himalayas/wordpress-himalayas-theme-1-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-34572
Published: 2024-05-08
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemePrix Fancy Elementor Flipbox fancy-elementor-flipbox allows Stored XSS.This issue affects Fancy Elementor Flipbox: from n/a through 2.4.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/fancy-elementor-flipbox/wordpress-fancy-elementor-flipbox-plugin-2-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/fancy-elementor-flipbox/wordpress-fancy-elementor-flipbox-plugin-2-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-4135
Published: 2024-05-08
Description: The WP Latest Posts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.7. This is due to the plugin allowing users to execute an action that does not properly validate a user-supplied value prior to using that value in a call to do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-94
References: https://plugins.trac.wordpress.org/changeset/3081119/wp-latest-posts; https://www.wordfence.com/threat-intel/vulnerabilities/id/57d90ba7-b655-4655-981c-548ff96c3bb7?source=cve; https://plugins.trac.wordpress.org/changeset/3081119/wp-latest-posts
CVE: CVE-2024-4281
Published: 2024-05-08
Description: The Link Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'link-library' shortcode in all versions up to, and including, 7.6.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3081532/link-library; https://www.wordfence.com/threat-intel/vulnerabilities/id/30c9c4b9-6905-4d8a-bc55-5cd6f6201d25?source=cve; https://plugins.trac.wordpress.org/changeset/3081532/link-library
CVE: CVE-2024-34562
Published: 2024-05-08
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Moveaddons Move Addons for Elementor allows Stored XSS.This issue affects Move Addons for Elementor: from n/a through 1.3.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/move-addons/wordpress-move-addons-for-elementor-plugin-1-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/move-addons/wordpress-move-addons-for-elementor-plugin-1-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-34563
Published: 2024-05-08
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoldAddons Gold Addons for Elementor allows Stored XSS.This issue affects Gold Addons for Elementor: from n/a through 1.2.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/gold-addons-for-elementor/wordpress-gold-addons-for-elementor-plugin-1-2-9-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/gold-addons-for-elementor/wordpress-gold-addons-for-elementor-plugin-1-2-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-34564
Published: 2024-05-08
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LogicHunt Inc. Counter Up allows Stored XSS.This issue affects Counter Up: from n/a through 2.2.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-counter-up/wordpress-counter-up-plugin-2-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-counter-up/wordpress-counter-up-plugin-2-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-34565
Published: 2024-05-08
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Debug Info allows Stored XSS.This issue affects Debug Info: from n/a through 1.3.10.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/debug-info/wordpress-debug-info-plugin-1-3-10-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/debug-info/wordpress-debug-info-plugin-1-3-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-34566
Published: 2024-05-08
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Johan van der Wijk Content Blocks (Custom Post Widget) allows Stored XSS.This issue affects Content Blocks (Custom Post Widget): from n/a through 3.3.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/custom-post-widget/wordpress-content-blocks-custom-post-widget-plugin-3-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/custom-post-widget/wordpress-content-blocks-custom-post-widget-plugin-3-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-34568
Published: 2024-05-08
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeqx LetterPress allows Stored XSS.This issue affects LetterPress: from n/a through 1.2.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/letterpress/wordpress-letterpress-newsletter-plugin-1-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/letterpress/wordpress-letterpress-newsletter-plugin-1-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-34569
Published: 2024-05-08
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Katie Zotpress zotpress.This issue affects Zotpress: from n/a through <= 7.3.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/zotpress/vulnerability/wordpress-zotpress-plugin-7-3-9-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/zotpress/wordpress-zotpress-plugin-7-3-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-34570
Published: 2024-05-08
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xpro Xpro Elementor Addons allows Stored XSS.This issue affects Xpro Elementor Addons: from n/a through 1.4.3.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/xpro-elementor-addons/wordpress-xpro-elementor-addons-plugin-1-4-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/xpro-elementor-addons/wordpress-xpro-elementor-addons-plugin-1-4-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-3507
Published: 2024-05-08
Description: Improper privilege management vulnerability in Lunar software that affects versions 6.0.2 through 6.6.0. This vulnerability allows an attacker to perform a secondary process injection into the Lunar application and abuse those rights to access sensitive user information.
CVSS Score: 7.7 (HIGH)
CWE: CWE-269
References: https://www.incibe.es/en/incibe-cert/notices/aviso/privilege-escalation-vulnerability-lunar; https://www.incibe.es/en/incibe-cert/notices/aviso/privilege-escalation-vulnerability-lunar
CVE: CVE-2022-40218
Published: 2024-05-08
Description: Missing Authorization vulnerability in ThemeHunk Advance WordPress Search Plugin.This issue affects Advance WordPress Search Plugin: from n/a through 1.1.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/th-advance-product-search/wordpress-th-advance-product-search-plugin-1-1-4-unauthenticated-plugin-settings-change-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/th-advance-product-search/wordpress-th-advance-product-search-plugin-1-1-4-unauthenticated-plugin-settings-change-vulnerability?_s_id=cve
CVE: CVE-2024-34414
Published: 2024-05-08
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nobita allows Stored XSS.This issue affects raindrops: from n/a through 1.600.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/raindrops/wordpress-raindrops-theme-1-600-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/raindrops/wordpress-raindrops-theme-1-600-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-34546
Published: 2024-05-08
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Habibur Rahman Sticky Social Link sticky-social-link allows DOM-Based XSS.This issue affects Sticky Social Link: from n/a through <= 2.0.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/sticky-social-link/vulnerability/wordpress-sticky-social-link-plugin-1-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/sticky-social-link/wordpress-sticky-social-link-plugin-1-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-34547
Published: 2024-05-08
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor alam Magical Addons For Elementor allows Stored XSS.This issue affects Magical Addons For Elementor: from n/a through 1.1.34.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/magical-addons-for-elementor/wordpress-magical-addons-for-elementor-header-footer-builder-free-elementor-widgets-elementor-templates-library-plugin-1-1-34-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/magical-addons-for-elementor/wordpress-magical-addons-for-elementor-header-footer-builder-free-elementor-widgets-elementor-templates-library-plugin-1-1-34-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-34548
Published: 2024-05-08
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesgrove WidgetKit allows Stored XSS.This issue affects WidgetKit: from n/a through 2.4.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/widgetkit-for-elementor/wordpress-all-in-one-addons-for-elementor-widgetkit-plugin-2-4-8-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/widgetkit-for-elementor/wordpress-all-in-one-addons-for-elementor-widgetkit-plugin-2-4-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-34553
Published: 2024-05-08
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Select-Themes Stockholm Core allows Reflected XSS.This issue affects Stockholm Core: from n/a through 2.4.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/stockholm-core/wordpress-stockholm-core-plugin-2-4-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/stockholm-core/wordpress-stockholm-core-plugin-2-4-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-34558
Published: 2024-05-08
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WOLF allows Stored XSS.This issue affects WOLF: from n/a through 1.0.8.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/bulk-editor/wordpress-wolf-wordpress-posts-bulk-editor-and-manager-professional-plugin-1-0-8-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/bulk-editor/wordpress-wolf-wordpress-posts-bulk-editor-and-manager-professional-plugin-1-0-8-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-34560
Published: 2024-05-08
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GOMO gee Search Plus allows Stored XSS.This issue affects gee Search Plus: from n/a through 1.4.4.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/gsearch-plus/wordpress-gee-search-plus-plugin-1-4-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/gsearch-plus/wordpress-gee-search-plus-plugin-1-4-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-34561
Published: 2024-05-08
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative interactive media 3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook WordPress Plugin allows Stored XSS.This issue affects 3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook WordPress Plugin: from n/a through 3.71.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/real3d-flipbook-lite/wordpress-real3d-flipbook-pdf-viewer-lite-plugin-3-71-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/real3d-flipbook-lite/wordpress-real3d-flipbook-pdf-viewer-lite-plugin-3-71-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-4644
Published: 2024-05-08
Description: A vulnerability has been found in SourceCodester Prison Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /Employee/changepassword.php. The manipulation of the argument txtold_password/txtnew_password/txtconfirm_password leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263488.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/yylmm/CVE/blob/main/Prison%20Management%20System/xss3.md; https://vuldb.com/?ctiid.263488; https://vuldb.com/?id.263488
CVE: CVE-2024-1438
Published: 2024-05-08
Description: Missing Authorization vulnerability in PressFore Rolo Slider.This issue affects Rolo Slider: from n/a through 1.0.9.
CVSS Score: 7.7 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/rolo-slider/wordpress-rolo-slider-plugin-1-0-9-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/rolo-slider/wordpress-rolo-slider-plugin-1-0-9-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-34255
Published: 2024-05-08
Description: jizhicms v2.5.1 contains a Cross-Site Scripting(XSS) vulnerability in the message function.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Cherry-toto/jizhicms/issues/93; https://github.com/Cherry-toto/jizhicms/issues/93
CVE: CVE-2024-4645
Published: 2024-05-08
Description: A vulnerability was found in SourceCodester Prison Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file /Admin/changepassword.php. The manipulation of the argument txtold_password/txtnew_password/txtconfirm_password leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263489 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/yylmm/CVE/blob/main/Prison%20Management%20System/xss4.md; https://vuldb.com/?ctiid.263489; https://vuldb.com/?id.263489
CVE: CVE-2024-4646
Published: 2024-05-08
Description: A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file /view/student_payment_details.php. The manipulation of the argument index leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-263490 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20xss/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2015.pdf; https://vuldb.com/?ctiid.263490; https://vuldb.com/?id.263490
CVE: CVE-2024-4647
Published: 2024-05-08
Description: A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /view/student_first_payment.php. The manipulation of the argument index leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263491.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20xss/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2016.pdf; https://vuldb.com/?ctiid.263491; https://vuldb.com/?id.263491
CVE: CVE-2024-4648
Published: 2024-05-08
Description: A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /view/student_exam_mark_update_form.php. The manipulation of the argument std_index leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263492.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20xss/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2017.pdf; https://vuldb.com/?ctiid.263492; https://vuldb.com/?id.263492
CVE: CVE-2024-24833
Published: 2024-05-08
Description: Missing Authorization vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-addons.This issue affects Happy Addons for Elementor: from n/a through <= 3.10.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/happy-elementor-addons/vulnerability/wordpress-happy-addons-for-elementor-plugin-3-10-1-broken-access-control-on-post-clone-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/happy-elementor-addons/wordpress-happy-addons-for-elementor-plugin-3-10-1-broken-access-control-on-post-clone-vulnerability?_s_id=cve
CVE: CVE-2024-30459
Published: 2024-05-08
Description: Missing Authorization vulnerability in AIpost AI WP Writer.This issue affects AI WP Writer: from n/a through 3.6.5.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/ai-wp-writer/wordpress-ai-wp-writer-plugin-3-6-5-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ai-wp-writer/wordpress-ai-wp-writer-plugin-3-6-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-31270
Published: 2024-05-08
Description: Missing Authorization vulnerability in Repute InfoSystems ARForms Form Builder.This issue affects ARForms Form Builder: from n/a through 1.6.1.
CVSS Score: 7.6 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/arforms-form-builder/wordpress-arforms-form-builder-plugin-1-6-1-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/arforms-form-builder/wordpress-arforms-form-builder-plugin-1-6-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-32886
Published: 2024-05-08
Description: Vitess is a database clustering system for horizontal scaling of MySQL. When executing the following simple query, the `vtgate` will go into an endless loop that also keeps consuming memory and eventually will run out of memory. This vulnerability is fixed in 19.0.4, 18.0.5, and 17.0.7.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-835
References: https://github.com/vitessio/vitess/blob/8f6cfaaa643a08dc111395a75a2d250ee746cfa8/go/mysql/collations/charset/convert.go#L73-L79; https://github.com/vitessio/vitess/blob/8f6cfaaa643a08dc111395a75a2d250ee746cfa8/go/mysql/collations/charset/unicode/utf16.go#L69-L71; https://github.com/vitessio/vitess/commit/2fd5ba1dbf6e9b32fdfdaf869d130066b1b5c0df
CVE: CVE-2024-33573
Published: 2024-05-08
Description: Missing Authorization vulnerability in EPROLO EPROLO Dropshipping.This issue affects EPROLO Dropshipping: from n/a through 1.7.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/eprolo-dropshipping/wordpress-eprolo-dropshipping-plugin-1-7-1-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/eprolo-dropshipping/wordpress-eprolo-dropshipping-plugin-1-7-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-33574
Published: 2024-05-08
Description: Missing Authorization vulnerability in appsbd Vitepos.This issue affects Vitepos: from n/a through 3.0.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/vitepos-lite/wordpress-vitepos-plugin-3-0-1-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/vitepos-lite/wordpress-vitepos-plugin-3-0-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-4233
Published: 2024-05-08
Description: Missing Authorization vulnerability in Tyche Softwares Print Invoice & Delivery Notes for WooCommerce, Tyche Softwares Arconix Shortcodes, Tyche Softwares Arconix FAQ.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through 4.8.1; Arconix Shortcodes: from n/a through 2.1.10; Arconix FAQ: from n/a through 1.9.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/arconix-faq/wordpress-arconix-faq-plugin-1-9-3-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/arconix-shortcodes/wordpress-arconix-shortcodes-plugin-2-1-10-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-delivery-notes/wordpress-print-invoice-delivery-notes-for-woocommerce-plugin-4-8-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-4649
Published: 2024-05-08
Description: A vulnerability classified as problematic has been found in Campcodes Complete Web-Based School Management System 1.0. This affects an unknown part of the file /view/student_exam_mark_insert_form1.php. The manipulation of the argument page leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263493 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20xss/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2018.pdf; https://vuldb.com/?ctiid.263493; https://vuldb.com/?id.263493