deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-45744
Published: 2024-09-27
Description: TopQuadrant TopBraid EDG stores external credentials insecurely. An authenticated attacker with file system access can read edg-setup.properites and obtain the secret to decrypt external passwords stored in edg-vault.properties. An authenticated attacker could gain file system access using a separate vulnerability such as CVE-2024-45745. At least version 7.1.3 is affected. Version 7.3 adds HashiCorp Vault integration that does not store external passwords locally. Version 8.3.0 warns when using plain text secrets.
CVSS Score: 3.0 (LOW)
CWE: CWE-257, CWE-312, CWE-522
References: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2024/va-24-254-02.json; https://www.topquadrant.com/doc/latest/administrator_guide/edg_installation_and_authentication/hashicorp_integration.html; https://www.topquadrant.com/doc/latest/reference/PasswordManagementAdminPage.html
CVE: CVE-2024-45745
Published: 2024-09-27
Description: TopQuadrant TopBraid EDG before version 8.0.1 allows an authenticated attacker to upload an XML DTD file and execute JavaScript to read local files or access URLs (XXE). Fixed in 8.0.1 (bug fix: TBS-6721).
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-611
References: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2024/va-24-254-02.json; https://www.topquadrant.com/wp-content/uploads/2024/06/changelog-8.0.1.txt
CVE: CVE-2024-47070
Published: 2024-09-27
Description: authentik is an open-source identity provider. A vulnerability that exists in versions prior to 2024.8.3 and 2024.6.5 allows bypassing password login by adding X-Forwarded-For header with an unparsable IP address, e.g. `a`. This results in a possibility of logging into any account with a known login or email address. The vulnerability requires the authentik instance to trust X-Forwarded-For header provided by the attacker, thus it is not reproducible from external hosts on a properly configured environment.  The issue occurs due to the password stage having a policy bound to it, which skips the password stage if the Identification stage is setup to also contain a password stage. Due to the invalid X-Forwarded-For header, which does not get validated to be an IP Address early enough, the exception happens later and the policy fails. The default blueprint doesn't correctly set `failure_result` to `True` on the policy binding meaning that due to this exception the policy returns false and the password stage is skipped. Versions 2024.8.3 and 2024.6.5 fix this issue.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-287
References: https://github.com/goauthentik/authentik/commit/78f7b04d5a62b2a9d4316282a713c2c7857dbe29; https://github.com/goauthentik/authentik/commit/dd8f809161e738b25765797eb2a5c77a7d3fc2cf; https://github.com/goauthentik/authentik/security/advisories/GHSA-7jxf-mmg9-9hg7
CVE: CVE-2024-47077
Published: 2024-09-27
Description: authentik is an open-source identity provider. Prior to versions 2024.8.3 and 2024.6.5, access tokens issued to one application can be stolen by that application and used to impersonate the user against any other proxy provider. Also, a user can steal an access token they were legitimately issued for one application and use it to access another application that they aren't allowed to access. Anyone who has more than one proxy provider application with different trust domains or different access control is affected. Versions 2024.8.3 and 2024.6.5 fix the issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://github.com/goauthentik/authentik/blob/70b5a214f2e7205572f914aaf68682501b9f5945/authentik/providers/oauth2/views/introspection.py#L42-L51; https://github.com/goauthentik/authentik/blob/70b5a214f2e7205572f914aaf68682501b9f5945/internal/outpost/proxyv2/application/auth_bearer.go#L30-L36; https://github.com/goauthentik/authentik/commit/22e586bd8cdc3d1db8a0f18314d76f82371129b2
CVE: CVE-2024-6983
Published: 2024-09-27
Description: mudler/localai version 2.17.1 is vulnerable to remote code execution. The vulnerability arises because the localai backend receives inputs not only from the configuration file but also from other inputs, allowing an attacker to upload a binary file and execute malicious code. This can lead to the attacker gaining full control over the system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://github.com/mudler/localai/commit/d02a0f6f01d5c4a926a2d67190cb55d7aca23b66; https://huntr.com/bounties/f91fb287-412e-4c89-87df-9e4b6e609647
CVE: CVE-2024-22170
Published: 2024-09-27
Description: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Western Digital My Cloud ddns-start on Linux allows Overflow Buffers.This issue affects My Cloud: before 5.29.102.
CWE: CWE-119
References: https://www.westerndigital.com/support/product-security/wdc-24005-western-digital-my-cloud-os-5-firmware-5-29-102
CVE: CVE-2024-38809
Published: 2024-09-27
Description: Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack.

Users of affected versions should upgrade to the corresponding fixed version.

Users of older, unsupported versions could enforce a size limit on "If-Match" and "If-None-Match" headers, e.g. through a Filter.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://spring.io/security/cve-2024-38809; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-46366
Published: 2024-09-27
Description: A Client-side Template Injection (CSTI) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to execute arbitrary client-side template code by injecting a malicious payload during the lead creation process. This can lead to privilege escalation when the payload is executed, granting the attacker elevated permissions within the CRM system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1336
References: https://gist.github.com/Tommywarren/89cef7f876ee897a4ff40a8b71b6208e
CVE: CVE-2024-46367
Published: 2024-09-27
Description: A Stored Cross-Site Scripting (XSS) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to inject arbitrary JavaScript code by submitting a malicious payload within the username field. This can lead to privilege escalation when the payload is executed, granting the attacker elevated permissions within the CRM system.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79
References: https://gist.github.com/Tommywarren/4ac0c8f6e5d8584accd31b8277e55749
CVE: CVE-2024-6981
Published: 2024-09-27
Description: OMNTEC Proteus Tank Monitoring OEL8000III Series


could allow an attacker to perform administrative actions without proper authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-268-06
CVE: CVE-2024-8310
Published: 2024-09-27
Description: OPW Fuel Management Systems SiteSentinel 
could allow an attacker to bypass authentication to the server and obtain full admin privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-268-01
CVE: CVE-2024-8630
Published: 2024-09-27
Description: Alisonic Sibylla devices are vulnerable to SQL injection attacks, which could allow complete access to the database.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-89
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-268-02
CVE: CVE-2024-9171
Published: 2024-09-27
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-9268
Published: 2024-09-27
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-9273
Published: 2024-09-27
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-9284
Published: 2024-09-27
Description: A vulnerability was found in TP-LINK TL-WR841ND up to 20240920. It has been rated as critical. Affected by this issue is some unknown functionality of the file /userRpm/popupSiteSurveyRpm.htm. The manipulation of the argument ssid leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TP-LINK/WR-841ND/popupSiteSurveyRpm.md; https://vuldb.com/?ctiid.278684; https://vuldb.com/?id.278684
CVE: CVE-2024-25411
Published: 2024-09-27
Description: A cross-site scripting (XSS) vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter in setup.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://drive.google.com/file/d/1GBL-iY5ZRaxRqLVqpBe1w6dVgEfywAG7/view?usp=sharing; https://github.com/flatpressblog/flatpress/pull/261; https://github.com/paragbagul111/CVE-2024-25411
CVE: CVE-2024-25412
Published: 2024-09-27
Description: A cross-site scripting (XSS) vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://drive.google.com/file/d/1GBL-iY5ZRaxRqLVqpBe1w6dVgEfywAG7/view?usp=sharing; https://github.com/paragbagul111/CVE-2024-25412
CVE: CVE-2024-28948
Published: 2024-09-27
Description: Advantech ADAM-5630 contains a cross-site request forgery (CSRF) vulnerability. It allows an attacker to partly circumvent the same 
origin policy, which is designed to prevent different websites from 
interfering with each other.
CVSS Score: 8.0 (HIGH)
CWE: CWE-352
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-02
CVE: CVE-2024-34542
Published: 2024-09-27
Description: Advantech ADAM-5630 shares user credentials plain text between the device and the user source device during the login process.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-261, CWE-522
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-02
CVE: CVE-2024-37187
Published: 2024-09-27
Description: Advantech ADAM-5550 share user credentials with a low level of encryption, consisting of base 64 encoding.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-261, CWE-522
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-01
CVE: CVE-2024-38308
Published: 2024-09-27
Description: Advantech ADAM 5550's web application includes a "logs" page where all 
the HTTP requests received are displayed to the user. The device doesn't
 correctly neutralize malicious code when parsing HTTP requests to 
generate page output.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-01
CVE: CVE-2024-39275
Published: 2024-09-27
Description: Cookies of authenticated Advantech ADAM-5630 users remain as active valid cookies when a 
session is closed. Forging requests with a legitimate cookie, even if 
the session was terminated, allows an unauthorized attacker to act with 
the same level of privileges of the legitimate user.
CVSS Score: 8.0 (HIGH)
CWE: CWE-539
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-02
CVE: CVE-2024-39364
Published: 2024-09-27
Description: Advantech ADAM-5630 
has built-in commands that can be executed without authenticating the 
user. These commands allow for restarting the operating system, 
rebooting the hardware, and stopping the execution. The commands can be 
sent to a simple HTTP request and are executed by the device 
automatically, without discrimination of origin or level of privileges 
of the user sending the commands.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-306
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-02
CVE: CVE-2024-46097
Published: 2024-09-27
Description: TestLink 1.9.20 is vulnerable to Incorrect Access Control in the TestPlan editing section. When a new TestPlan is created, an ID with an incremental value is automatically generated. Using the edit function you can change the tplan_id parameter to another ID. The application does not carry out a check on the user's permissions maing it possible to recover the IDs of all the TestPlans (even the administrative ones) and modify them even with minimal privileges.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: https://github.com/Alkatraz97/CVEs/blob/main/CVE-2024-46097.md
CVE: CVE-2024-46256
Published: 2024-09-27
Description: A Command injection vulnerability in requestLetsEncryptSsl in NginxProxyManager 2.11.3 allows an attacker to RCE via Add Let's Encrypt Certificate.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/NginxProxyManager/nginx-proxy-manager/blob/v2.11.3/backend/internal/certificate.js#L830; https://github.com/NginxProxyManager/nginx-proxy-manager/commit/99cce7e2b0da2978411cedd7cac5fffbe15bc466; https://github.com/NginxProxyManager/nginx-proxy-manager/pull/4073/commits/c39d5433bcd13993def222bbb2b6988bbb810a05
CVE: CVE-2024-46257
Published: 2024-09-27
Description: A Command injection vulnerability in requestLetsEncryptSslWithDnsChallenge in NginxProxyManager 2.11.3 allows an attacker to achieve remote code execution via Add Let's Encrypt Certificate. NOTE: this is not part of any NGINX software shipped by F5.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/NginxProxyManager/nginx-proxy-manager/blob/v2.11.3/backend/internal/certificate.js#L870; https://github.com/NginxProxyManager/nginx-proxy-manager/commit/99cce7e2b0da2978411cedd7cac5fffbe15bc466; https://github.com/NginxProxyManager/nginx-proxy-manager/pull/4073/commits/c39d5433bcd13993def222bbb2b6988bbb810a05
CVE: CVE-2024-9301
Published: 2024-09-27
Description: A path traversal issue in E2Nest prior to commit 8a41948e553c89c56b14410c6ed395e9cfb9250a
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2024-004.md
CVE: CVE-2024-33368
Published: 2024-09-27
Description: An issue in Plasmoapp RPShare Fabric mod v.1.0.0 allows a remote attacker to execute arbitrary code via the build method in DonwloadPromptScreen
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://gist.github.com/apple502j/54e0f80bfe082fd934e33970394adbb8; https://github.com/plasmoapp/RPShare
CVE: CVE-2024-33369
Published: 2024-09-27
Description: Directory Traversal vulnerability in Plasmoapp RPShare Fabric mod v.1.0.0 allows a remote attacker to execute arbitrary code via the getFileNameFromConnection method in DownloadTask
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://gist.github.com/apple502j/54e0f80bfe082fd934e33970394adbb8; https://github.com/plasmoapp/RPShare
CVE: CVE-2024-9160
Published: 2024-09-27
Description: In versions of the PEADM Forge Module prior to 3.24.0 a security misconfiguration was discovered.
CWE: CWE-295
References: https://portal.perforce.com/s/detail/a91PA000001SXN3YAO
CVE: CVE-2024-6436
Published: 2024-09-27
Description: An input validation vulnerability exists in the Rockwell Automation Sequence Manager™ which could allow a malicious user to send malformed packets to the server and cause a denial-of-service condition. If exploited, the device would become unresponsive, and a manual restart will be required for recovery. Additionally, if exploited, there could be a loss of view for the downstream equipment sequences in the controller. Users would not be able to view the status or command the equipment sequences, however the equipment sequence would continue to execute uninterrupted.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1679.html
CVE: CVE-2024-46453
Published: 2024-09-27
Description: A cross-site scripting (XSS) vulnerability in the component /test/ of iq3xcite v2.31 to v3.05 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/nosmo-gla/iq3xcite-XSS-2.31-3.05/tree/main; https://github.com/nosmo-gla/iq3xcite-XSS-2.31-3.05/tree/main
CVE: CVE-2024-47186
Published: 2024-09-27
Description: Filament is a collection of full-stack components for Laravel development. Versions of Filament from v3.0.0 through v3.2.114 are affected by a cross-site scripting (XSS) vulnerability. If values passed to a `ColorColumn` or `ColumnEntry` are not valid and contain a specific set of characters, applications are vulnerable to XSS attack against a user who opens a page on which a color column or entry is rendered. Filament v3.2.115 fixes this issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/filamentphp/filament/commit/df[PII_REDACTED]d08eda5837ef50f9997fad902316; https://github.com/filamentphp/filament/releases/tag/v3.2.115; https://github.com/filamentphp/filament/security/advisories/GHSA-9h9q-qhxg-89xr
CVE: CVE-2024-9291
Published: 2024-09-27
Description: A vulnerability classified as problematic has been found in kalvinGit kvf-admin up to f12a94dc1ebb7d1c51ee978a85e4c7ed75c620ff. Affected is an unknown function of the file /ueditor/upload?configPath=ueditor/config.json&action=uploadfile of the component XML File Handler. The manipulation of the argument upfile leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The GitHub repository of the project did not receive an update for more than two years.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/daxiangya/kvf-admin/issues/1; https://github.com/user-attachments/files/17058501/kvf-admin_xss.md; https://vuldb.com/?ctiid.278784
CVE: CVE-2024-9293
Published: 2024-09-27
Description: A vulnerability classified as critical was found in skyselang yylAdmin up to 3.0. Affected by this vulnerability is the function list of the file /app/admin/controller/file/File.php of the component Backend. The manipulation of the argument is_disable leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://gitee.com/A0kooo/cve_article/blob/master/yyladmin/yyladmin%20file%20list%20have%20SQL%20injection.md; https://vuldb.com/?ctiid.278785; https://vuldb.com/?id.278785
CVE: CVE-2024-23586
Published: 2024-09-27
Description: HCL Nomad is susceptible to an insufficient session expiration vulnerability.   Under certain circumstances, an unauthenticated attacker could obtain old session information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-613, CWE-613
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0115264
CVE: CVE-2024-38796
Published: 2024-09-27
Description: EDK2 contains a vulnerability in the PeCoffLoaderRelocateImage(). An Attacker may cause memory corruption due to an overflow via an adjacent network. A successful exploit of this vulnerability may lead to a loss of Confidentiality, Integrity, and/or Availability.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-122
References: https://github.com/tianocore/edk2/security/advisories/GHSA-xpcr-7hjq-m6qm; https://lists.debian.org/debian-lts-announce/2025/06/msg00007.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-9294
Published: 2024-09-27
Description: A vulnerability, which was classified as critical, has been found in dingfanzu CMS up to 29d67d9044f6f93378e6eb6ff92272217ff7225c. Affected by this issue is some unknown functionality of the file saveNewPwd.php. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/dingfanzu-CMS/dingfanzu-CMS%20saveNewPwd.php%20username%20SQL-inject.md; https://vuldb.com/?ctiid.278786; https://vuldb.com/?id.278786
CVE: CVE-2024-8353
Published: 2024-09-28
Description: The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1 via deserialization of untrusted input via several parameters like 'give_title' and 'card_address'. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files and achieve remote code execution. This is essentially the same vulnerability as CVE-2024-5932, however, it was discovered the the presence of stripslashes_deep on user_info allows the is_serialized check to be bypassed. This issue was mostly patched in 3.16.1, but further hardening was added in 3.16.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://plugins.trac.wordpress.org/browser/give/tags/3.16.0/includes/process-donation.php#L154; https://plugins.trac.wordpress.org/changeset/3149290/give/tags/3.16.1/includes/admin/admin-actions.php; https://plugins.trac.wordpress.org/changeset/3149290/give/tags/3.16.1/includes/process-donation.php
CVE: CVE-2024-8547
Published: 2024-09-28
Description: The Simple Popup Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [popup] shortcode in all versions up to, and including, 4.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/simple-popup-plugin/tags/4.5/simple_popup_plugin.php#L87; https://plugins.trac.wordpress.org/changeset/3160218/#file7; https://www.wordfence.com/threat-intel/vulnerabilities/id/217da4de-38df-41ff-b138-f12d4f8999cd?source=cve
CVE: CVE-2024-8788
Published: 2024-09-28
Description: The EU/UK VAT Manager for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.12.11. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/eu-vat-for-woocommerce/tags/2.12.12/includes/admin/class-alg-wc-eu-vat-admin.php#L461; https://plugins.trac.wordpress.org/changeset/3158296/eu-vat-for-woocommerce/tags/2.12.14/includes/admin/class-alg-wc-eu-vat-admin.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/443c57bf-2f3d-4b8f-9dae-b11142a74341?source=cve
CVE: CVE-2024-9023
Published: 2024-09-28
Description: The WP-WebAuthn plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wwa_login_form shortcode in all versions up to, and including, 1.3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-webauthn/trunk/blocks/blocks.build.js#L1; https://plugins.trac.wordpress.org/browser/wp-webauthn/trunk/wwa-shortcodes.php#L51; https://plugins.trac.wordpress.org/changeset/3163161/