deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-12237
Published: 2025-01-03
Description: The Photo Gallery Slideshow & Masonry Tiled Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.15 via the rjg_get_youtube_info_justified_gallery_callback function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to retrieve limited information from internal services.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918
References: https://plugins.trac.wordpress.org/browser/wp-responsive-photo-gallery/tags/1.0.15/wp-responsive-photo-gallery.php#L3023; https://plugins.trac.wordpress.org/browser/wp-responsive-photo-gallery/tags/1.0.15/wp-responsive-photo-gallery.php#L3044; https://www.wordfence.com/threat-intel/vulnerabilities/id/08e44434-8908-4c63-9e5b-9a8b387255d9?source=cve
CVE: CVE-2024-55896
Published: 2025-01-03
Description: IBM PowerHA SystemMirror for i 7.4 and 7.5 contains improper restrictions when rendering content via iFrames.  This vulnerability could allow an attacker to gain improper access and perform unauthorized actions on the system.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-451
References: https://www.ibm.com/support/pages/node/7180036
CVE: CVE-2024-55897
Published: 2025-01-03
Description: IBM PowerHA SystemMirror for i 7.4 and 7.5 

does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-614
References: https://www.ibm.com/support/pages/node/7180036
CVE: CVE-2025-0199
Published: 2025-01-03
Description: A vulnerability, which was classified as critical, was found in code-projects Point of Sales and Inventory Management System 1.0. Affected is an unknown function of the file /user/minus_cart.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://gist.github.com/Masamuneee/eff0a0865d54305faa78624e63172a92; https://vuldb.com/?ctiid.290136
CVE: CVE-2025-22383
Published: 2025-01-04
Description: An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity input validation issue exists in the Commerce B2B application, affecting the Contact Us functionality. This allows visitors to send e-mail messages that could contain unfiltered HTML markup in specific scenarios.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://support.optimizely.com/hc/en-us/articles/[PII_REDACTED]2493-Configured-Commerce-Security-Advisory-COM-2024-03
CVE: CVE-2025-22384
Published: 2025-01-04
Description: An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue concerning business logic exists in the Commerce B2B application, which allows storefront visitors to purchase discontinued products in specific scenarios where requests are altered before reaching the server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-472
References: https://support.optimizely.com/hc/en-us/articles/[PII_REDACTED]3741-Configured-Commerce-Security-Advisory-COM-2024-02
CVE: CVE-2025-22385
Published: 2025-01-04
Description: An issue was discovered in Optimizely Configured Commerce before 5.2.2408. For newly created accounts, the Commerce B2B application does not require email confirmation. This medium-severity issue allows the mass creation of accounts. This could affect database storage; also, non-requested storefront accounts can be created on behalf of visitors.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://support.optimizely.com/hc/en-us/articles/[PII_REDACTED]6637-Configured-Commerce-Security-Advisory-COM-2024-05
CVE: CVE-2025-22386
Published: 2025-01-04
Description: An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity session issue exists in the Commerce B2B application, affecting the longevity of active sessions in the storefront. This allows session tokens tied to logged-out sessions to still be active and usable.
CVSS Score: 7.3 (HIGH)
CWE: CWE-613, CWE-613
References: https://support.optimizely.com/hc/en-us/articles/[PII_REDACTED]1069-Configured-Commerce-Security-Advisory-COM-2024-04
CVE: CVE-2025-22387
Published: 2025-01-04
Description: An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue exists in requests for resources where the session token is submitted as a URL parameter. This exposes information about the authenticated session, which can be leveraged for session hijacking.
CVSS Score: 7.5 (HIGH)
CWE: CWE-598
References: https://support.optimizely.com/hc/en-us/articles/[PII_REDACTED]4893-Configured-Commerce-Security-Advisory-COM-2024-06
CVE: CVE-2025-22388
Published: 2025-01-04
Description: An issue was discovered in Optimizely EPiServer.CMS.Core before 12.22.0. A high-severity Stored Cross-Site Scripting (XSS) vulnerability exists in the CMS, allowing malicious actors to inject and execute arbitrary JavaScript code, potentially compromising user data, escalating privileges, or executing unauthorized actions. The issue exists in multiple areas, including content editing, link management, and file uploads.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://support.optimizely.com/hc/en-us/articles/[PII_REDACTED]0557-Content-Management-System-CMS-Security-Advisory-CMS-2025-01
CVE: CVE-2025-22389
Published: 2025-01-04
Description: An issue was discovered in Optimizely EPiServer.CMS.Core before 12.32.0. A medium-severity vulnerability exists in the CMS, where the application does not properly validate uploaded files. This allows the upload of potentially malicious file types, including .docm .html. When accessed by application users, these files can be used to execute malicious actions or compromise users' systems.
CVSS Score: 8.0 (HIGH)
CWE: CWE-434, CWE-434
References: https://support.optimizely.com/hc/en-us/articles/[PII_REDACTED]9629-Content-Management-System-CMS-Security-Advisory-CMS-2025-03
CVE: CVE-2025-22390
Published: 2025-01-04
Description: An issue was discovered in Optimizely EPiServer.CMS.Core before 12.32.0. A medium-severity vulnerability exists in the CMS due to insufficient enforcement of password complexity requirements. The application permits users to set passwords with a minimum length of 6 characters, lacking adequate complexity to resist modern attack techniques such as password spraying or offline password cracking.
CVSS Score: 7.5 (HIGH)
CWE: CWE-521, CWE-521
References: https://support.optimizely.com/hc/en-us/articles/[PII_REDACTED]1293-Content-Management-System-CMS-Security-Advisory-CMS-2025-02
CVE: CVE-2025-0200
Published: 2025-01-04
Description: A vulnerability has been found in code-projects Point of Sales and Inventory Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /user/search_num.php. The manipulation of the argument search leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://gist.github.com/Masamuneee/f238db57d8b1947d000cadf634a8387e; https://vuldb.com/?ctiid.290137
CVE: CVE-2025-0201
Published: 2025-01-04
Description: A vulnerability was found in code-projects Point of Sales and Inventory Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /user/update_account.php. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://gist.github.com/Masamuneee/645d20dd1dc6389dd47a7fae0bb2cefa; https://vuldb.com/?ctiid.290138
CVE: CVE-2025-0202
Published: 2025-01-04
Description: A vulnerability was found in TCS BaNCS 10. It has been classified as problematic. This affects an unknown part of the file /REPORTS/REPORTS_SHOW_FILE.jsp. The manipulation of the argument FilePath leads to file inclusion. The real existence of this vulnerability is still doubted at the moment.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-73
References: https://vuldb.com/?ctiid.290139; https://vuldb.com/?id.290139; https://vuldb.com/?submit.469455
CVE: CVE-2025-0203
Published: 2025-01-04
Description: A vulnerability was found in code-projects Student Management System 1.0. It has been declared as critical. This vulnerability affects the function showSubject1 of the file /config/DbFunction.php. The manipulation of the argument sid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://gist.github.com/th4s1s/e8488d7e35d789581979f3b7e4c48b1f; https://vuldb.com/?ctiid.290140
CVE: CVE-2024-10932
Published: 2025-01-04
Description: The Backup Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.6 via deserialization of untrusted input in the 'recursive_unserialize_replace' function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files, retrieve sensitive data, or execute code. An administrator must create a staging site in order to trigger the exploit.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://plugins.trac.wordpress.org/browser//backup-backup/tags/1.4.6/includes/database/search-replace.php#L46; https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.4.6.1/includes/database/search-replace.php#L46; https://www.wordfence.com/threat-intel/vulnerabilities/id/d5a0c514-5200-47f4-9d2e-684d68946b9a?source=cve
CVE: CVE-2024-11974
Published: 2025-01-04
Description: The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘smc_settings_tab', 'unattachfixit-action', and 'woofixit-action’ parameters in all versions up to, and including, 3.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/media-library-assistant/trunk/examples/plugins/mla-unattached-fixit.php#L177; https://plugins.trac.wordpress.org/browser/media-library-assistant/trunk/examples/plugins/smart-media-categories/admin/includes/class-smc-settings-support.php#L459; https://plugins.trac.wordpress.org/browser/media-library-assistant/trunk/examples/plugins/woofixit.php#L1391
CVE: CVE-2024-12047
Published: 2025-01-04
Description: The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘custom_server’ parameter in all versions up to, and including, 6.30.03 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/6.30.00/addons/cdn/cdn-rewrite.php#L459; https://plugins.trac.wordpress.org/changeset/3213738/; https://wordpress.org/plugins/wp-compress-image-optimizer/#developers
CVE: CVE-2024-12545
Published: 2025-01-04
Description: The Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits,  referrals, sales and more plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.1. This is due to missing nonce validation on the reset_installation() function. This makes it possible for unauthenticated attackers to reset the plugin’s installation via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/scratch-win-giveaways-for-website-facebook/tags/2.7.0/includes/swin-api.php; https://plugins.trac.wordpress.org/changeset/3212730/; https://wordpress.org/plugins/scratch-win-giveaways-for-website-facebook/#developers
CVE: CVE-2024-12701
Published: 2025-01-04
Description: The WP Smart Import : Import any XML File to WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘ page’ parameter in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-smart-import/trunk/controller/file_manage_controller.php#L39; https://plugins.trac.wordpress.org/browser/wp-smart-import/trunk/controller/manage_controller.php#L82; https://plugins.trac.wordpress.org/changeset/3212009/
CVE: CVE-2025-0204
Published: 2025-01-04
Description: A vulnerability was found in code-projects Online Shoe Store 1.0. It has been rated as critical. This issue affects some unknown processing of the file /details.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://gist.github.com/th4s1s/6f0b3fcf85455238b4316d0fda7d489e; https://vuldb.com/?ctiid.290141
CVE: CVE-2024-11930
Published: 2025-01-04
Description: The Taskbuilder – WordPress Project & Task Management plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wppm_tasks shortcode in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/taskbuilder/trunk/includes/frontend/wppm_tasks_shortcode.php#L123; https://plugins.trac.wordpress.org/changeset/3210469/; https://wordpress.org/plugins/taskbuilder/#developers
CVE: CVE-2024-12583
Published: 2025-01-04
Description: The Dynamics 365 Integration plugin for WordPress is vulnerable to Remote Code Execution and Arbitrary File Read in all versions up to, and including, 1.3.23 via Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-1336
References: https://plugins.trac.wordpress.org/browser/integration-dynamics/trunk/src/Shortcode/Twig.php#L53; https://plugins.trac.wordpress.org/changeset/3210927/; https://www.wordfence.com/threat-intel/vulnerabilities/id/7f3dac5a-9ff8-4e8c-8c73-422123e121d8?source=cve
CVE: CVE-2025-0205
Published: 2025-01-04
Description: A vulnerability classified as critical has been found in code-projects Online Shoe Store 1.0. Affected is an unknown function of the file /details2.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://gist.github.com/th4s1s/832bc65fadd7d49894f68a75f834c7f3; https://vuldb.com/?ctiid.290142
CVE: CVE-2024-12221
Published: 2025-01-04
Description: The Turnkey bbPress by WeaverTheme plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘_wpnonce’ parameter in all versions up to, and including, 1.6.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3209473/; https://wordpress.org/plugins/weaver-for-bbpress/; https://www.wordfence.com/threat-intel/vulnerabilities/id/35c608c3-9c28-4e0d-b0ec-d0a279fccd3b?source=cve
CVE: CVE-2024-12195
Published: 2025-01-04
Description: The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to SQL Injection via the 'project_id' parameter of the /wp-json/pm/v2/projects/2/task-lists REST API endpoint in all versions up to, and including, 2.6.16 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, who have been granted access to a project, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/wedevs-project-manager/tags/2.6.14/src/Task_List/Controllers/Task_List_Controller.php#L688; https://plugins.trac.wordpress.org/changeset/3213295/wedevs-project-manager; https://www.wordfence.com/threat-intel/vulnerabilities/id/798d120a-edec-4af9-b574-46f9beabc491?source=cve
CVE: CVE-2024-12279
Published: 2025-01-04
Description: The WP Social AutoConnect plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/changeset/3211577/; https://wordpress.org/plugins/wp-fb-autoconnect/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/392d8286-a5fd-4d5d-9f6a-f13564013edc?source=cve
CVE: CVE-2024-12475
Published: 2025-01-04
Description: The WP Multi Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3207533/; https://wordpress.org/plugins/wp-multi-store-locator/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/089406e7-4f6a-416b-9077-e17c44069300?source=cve
CVE: CVE-2025-0206
Published: 2025-01-04
Description: A vulnerability classified as critical was found in code-projects Online Shoe Store 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/index.php. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-266, CWE-284
References: https://code-projects.org/; https://gist.github.com/th4s1s/955b71b20235dddf30689d4b85b4d271; https://vuldb.com/?ctiid.290143
CVE: CVE-2025-0207
Published: 2025-01-04
Description: A vulnerability, which was classified as critical, has been found in code-projects Online Shoe Store 1.0. Affected by this issue is some unknown functionality of the file /function/login.php. The manipulation of the argument password leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://gist.github.com/th4s1s/d10dfaebae75c8dbe54ad83d63725d81; https://vuldb.com/?ctiid.290144
CVE: CVE-2025-0208
Published: 2025-01-04
Description: A vulnerability, which was classified as critical, was found in code-projects Online Shoe Store 1.0. This affects an unknown part of the file /summary.php. The manipulation of the argument tid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://gist.github.com/th4s1s/24925a20d1f9336858dee1cbbb30c249; https://vuldb.com/?ctiid.290145
CVE: CVE-2024-10957
Published: 2025-01-04
Description: The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to PHP Object Injection in all versions from 1.23.8 to 1.24.11 via deserialization of untrusted input in the 'recursive_unserialized_replace' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. An administrator must perform a search and replace action to trigger the exploit.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://plugins.trac.wordpress.org/browser/updraftplus/trunk/includes/class-search-replace.php#L411; https://plugins.trac.wordpress.org/changeset/3212299/; https://www.wordfence.com/threat-intel/vulnerabilities/id/4729ed37-96b2-4717-8a72-89b9a21ec058?source=cve
CVE: CVE-2025-0210
Published: 2025-01-04
Description: A vulnerability has been found in Campcodes School Faculty Scheduling System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/ajax.php?action=login. The manipulation of the argument username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/shaturo1337/POCs/blob/main/Blind%20SQL%20Injection%20in%20School%20Faculty%20Scheduling%20System.md; https://vuldb.com/?ctiid.290155; https://vuldb.com/?id.290155
CVE: CVE-2024-41763
Published: 2025-01-04
Description: IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3  uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327, CWE-327
References: https://www.ibm.com/support/pages/node/7180204
CVE: CVE-2024-41765
Published: 2025-01-04
Description: IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.ibm.com/support/pages/node/7180201