deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-13409
Published: 2025-01-24
Description: The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.10 via the 'theme' parameter of the post_type_ajax_handler() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://ja.wordpress.org/plugins/post-grid-carousel-ultimate/; https://plugins.trac.wordpress.org/browser/post-grid-carousel-ultimate/tags/1.6.10/includes/classes/ajax.php; https://plugins.trac.wordpress.org/changeset/3227281/post-grid-carousel-ultimate/tags/1.7/includes/classes/ajax.php
CVE: CVE-2024-13542
Published: 2025-01-24
Description: The WP Google Street View (with 360° virtual tour) & Google maps + Local SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpgsv' shortcode in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3227140%40wp-google-street-view&new=3227140%40wp-google-street-view&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/4b1944a9-4bc4-4ac2-83c3-55d6d61f405c?source=cve
CVE: CVE-2024-13572
Published: 2025-01-24
Description: The Precious Metals Charts and Widgets for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'nfusion-widget' shortcode in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3227123%40precious-metals-chart-and-widgets&new=3227123%40precious-metals-chart-and-widgets&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/3f2c8c5f-2017-4b22-a864-dc142b3b1afb?source=cve
CVE: CVE-2024-13594
Published: 2025-01-24
Description: The Simple Downloads List plugin for WordPress is vulnerable to SQL Injection via the 'category' attribute of the 'neofix_sdl' shortcode in all versions up to, and including, 1.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/simple-downloads-list/trunk/lists/list_1/download_list_1.php#L20; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3226486%40simple-downloads-list&new=3226486%40simple-downloads-list&sfp_email=&sfph_mail=#file14; https://www.wordfence.com/threat-intel/vulnerabilities/id/49f5bb21-d18f-453b-bef4-e3b234d162c8?source=cve
CVE: CVE-2025-22714
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MDJM Mobile DJ Manager mobile-dj-manager allows Reflected XSS.This issue affects Mobile DJ Manager: from n/a through <= 1.7.5.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/mobile-dj-manager/vulnerability/wordpress-mdjm-event-management-plugin-1-7-5-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23422
Published: 2025-01-24
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in moaluko Store Locator store-locator allows PHP Local File Inclusion.This issue affects Store Locator: from n/a through <= 3.98.10.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/store-locator/vulnerability/wordpress-store-locator-plugin-3-98-10-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-23427
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Anderson / Team Updraft Redux Converter redux-converter allows Reflected XSS.This issue affects Redux Converter: from n/a through <= 1.1.3.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/redux-converter/vulnerability/wordpress-redux-converter-plugin-1-1-3-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23522
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matthew Haines-Young HM Portfolio hm-portfolio allows Reflected XSS.This issue affects HM Portfolio: from n/a through <= 1.1.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/hm-portfolio/vulnerability/wordpress-hm-portfolio-plugin-1-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23621
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in algothemes Causes – Donation Plugin causes allows Reflected XSS.This issue affects Causes – Donation Plugin: from n/a through <= 1.0.01.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/causes/vulnerability/wordpress-causes-donation-plugin-1-0-01-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23622
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sabuj Kundu CBX Accounting & Bookkeeping cbxwpsimpleaccounting allows Reflected XSS.This issue affects CBX Accounting & Bookkeeping: from n/a through <= 1.3.14.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/cbxwpsimpleaccounting/vulnerability/wordpress-cbx-accounting-bookkeeping-plugin-1-3-14-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23711
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Quincy Kwende Quote me quote-me allows Reflected XSS.This issue affects Quote me: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/quote-me/vulnerability/wordpress-quote-me-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23734
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Casey Bisson Gigaom Sphinx go-sphinx allows Reflected XSS.This issue affects Gigaom Sphinx: from n/a through <= 0.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/go-sphinx/vulnerability/wordpress-gigaom-sphinx-plugin-0-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23737
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thobian Network-Favorites network-favorites allows Reflected XSS.This issue affects Network-Favorites: from n/a through <= 1.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/network-favorites/vulnerability/wordpress-network-favorites-plugin-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23837
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in martinjuhasz One Backend Language one-backend-language allows Reflected XSS.This issue affects One Backend Language: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/one-backend-language/vulnerability/wordpress-one-backend-language-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23838
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rally Vincent Bauernregeln bauernregeln allows Reflected XSS.This issue affects Bauernregeln: from n/a through <= 1.0.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/bauernregeln/vulnerability/wordpress-bauernregeln-plugin-1-0-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23839
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Asif Shakeel Sticky Button sticky-chat-button allows Stored XSS.This issue affects Sticky Button: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/sticky-chat-button/vulnerability/wordpress-sticky-button-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23885
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in anildhiman MJ Contact us mj-contact-us allows Reflected XSS.This issue affects MJ Contact us: from n/a through <= 5.2.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/mj-contact-us/vulnerability/wordpress-mj-contact-us-plugin-5-2-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23888
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GrandSlambert Custom Page Extensions custom-page-extensions allows Reflected XSS.This issue affects Custom Page Extensions: from n/a through <= 0.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/custom-page-extensions/vulnerability/wordpress-custom-page-extensions-plugin-0-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23889
Published: 2025-01-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tormorten FooGallery Captions foogallery-captions allows Reflected XSS.This issue affects FooGallery Captions: from n/a through <= 1.0.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/foogallery-captions/vulnerability/wordpress-foogallery-captions-plugin-1-0-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-47090
Published: 2025-01-24
Description: GPAC MP4box 2.1-DEV-rev574-g9d5bb184b contains a buffer overflow in gf_vvc_read_pps_bs_internal function of media_tools/av_parsers.c, check needed for num_exp_tile_columns
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://github.com/gpac/gpac/commit/[PII_REDACTED]1f6766bf9e7378bb7cc66cebd6e49d; https://github.com/gpac/gpac/issues/2341
CVE: CVE-2024-10324
Published: 2025-01-24
Description: The RomethemeKit For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.5.2 via the register_controls function in widgets/offcanvas-rometheme.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1230
References: https://plugins.trac.wordpress.org/changeset/3220079/rometheme-for-elementor; https://www.wordfence.com/threat-intel/vulnerabilities/id/cd726b20-75c9-408e-86fc-061db591a9db?source=cve
CVE: CVE-2024-11913
Published: 2025-01-24
Description: The Activity Plus Reloaded for BuddyPress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.1.1 via the 'ajax_preview_link' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-918
References: https://plugins.trac.wordpress.org/browser/bp-activity-plus-reloaded/tags/1.1.2/src/handlers/class-bpapr-preview-handler.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/69485409-8e91-4651-b9b8-69beb2364fa8?source=cve
CVE: CVE-2024-41739
Published: 2025-01-24
Description: IBM Cognos Dashboards 4.0.7 and 5.0.0 on Cloud Pak for Data could allow a remote attacker to perform unauthorized actions due to dependency confusion.
CVSS Score: 8.8 (HIGH)
CWE: CWE-427
References: https://www.ibm.com/support/pages/node/7177766
CVE: CVE-2024-57184
Published: 2025-01-24
Description: An issue was discovered in GPAC v0.8.0, as demonstrated by MP4Box. It contains a heap-based buffer overflow in gf_m2ts_process_pmt in media_tools/mpegts.c:2163 that can cause a denial of service (DOS) via a crafted MP4 file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/gpac/gpac/commit/8c5e847185d74462d674ee7d28fb46c29dae6dd2; https://github.com/gpac/gpac/issues/1421
CVE: CVE-2024-9490
Published: 2025-01-24
Description: DLL hijacking vulnerabilities, caused by an uncontrolled search path in Silicon Labs (8-bit) IDE installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
CVSS Score: 8.6 (HIGH)
CWE: CWE-427
References: https://community.silabs.com/068Vm00000JUQwd
CVE: CVE-2024-9491
Published: 2025-01-24
Description: DLL hijacking vulnerabilities, caused by an uncontrolled search path in Configuration Wizard 2 installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
CVSS Score: 8.6 (HIGH)
CWE: CWE-427
References: https://community.silabs.com/068Vm00000JUQwd
CVE: CVE-2024-9492
Published: 2025-01-24
Description: DLL hijacking vulnerabilities, caused by an uncontrolled search path in Flash Programming Utility installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
CVSS Score: 8.6 (HIGH)
CWE: CWE-427
References: https://community.silabs.com/068Vm00000JUQwd
CVE: CVE-2024-9493
Published: 2025-01-24
Description: DLL hijacking vulnerabilities, caused by an uncontrolled search path in the 

ToolStick

 installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
CVSS Score: 8.6 (HIGH)
CWE: CWE-427
References: https://community.silabs.com/068Vm00000JUQwd
CVE: CVE-2024-9494
Published: 2025-01-24
Description: DLL hijacking vulnerabilities, caused by an uncontrolled search path in the 



CP210 VCP Win 2k



 installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
CVSS Score: 8.6 (HIGH)
CWE: CWE-427
References: https://community.silabs.com/068Vm00000JUQwd
CVE: CVE-2024-9495
Published: 2025-01-24
Description: DLL hijacking vulnerabilities, caused by an uncontrolled search path in the CP210x VCP Windows 



 installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
CVSS Score: 8.6 (HIGH)
CWE: CWE-427
References: https://community.silabs.com/068Vm00000JUQwd
CVE: CVE-2024-9496
Published: 2025-01-24
Description: DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress Dev Kit

 



 installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
CVSS Score: 8.6 (HIGH)
CWE: CWE-427
References: https://community.silabs.com/068Vm00000JUQwd
CVE: CVE-2024-9497
Published: 2025-01-24
Description: DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress 4 SDK

 



 installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
CVSS Score: 8.6 (HIGH)
CWE: CWE-427
References: https://community.silabs.com/068Vm00000JUQwd
CVE: CVE-2024-9498
Published: 2025-01-24
Description: DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress SDK

 



 installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
CVSS Score: 8.6 (HIGH)
CWE: CWE-427
References: https://community.silabs.com/068Vm00000JUQwd
CVE: CVE-2024-9499
Published: 2025-01-24
Description: DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress Win 98SE Dev Kit installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
CVSS Score: 8.6 (HIGH)
CWE: CWE-427
References: https://community.silabs.com/068Vm00000JUQwd
CVE: CVE-2025-0697
Published: 2025-01-24
Description: A vulnerability, which was classified as problematic, was found in Telstra Smart Modem Gen 2 up to 20250115. This affects an unknown part of the component HTTP Header Handler. The manipulation of the argument Content-Disposition leads to injection. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-74, CWE-707
References: https://github.com/bloodbile/Telstra-RHI; https://vuldb.com/?ctiid.293223; https://vuldb.com/?id.293223
CVE: CVE-2025-22605
Published: 2025-01-24
Description: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Starting in version 4.0.0-beta.18 and prior to 4.0.0-beta.253, a vulnerability in the execution of commands on remote servers allows an authenticated user to execute arbitrary code on the local Coolify container, gaining access to data and private keys or tokens of other users/teams. The ability to inject malicious commands into the Coolify container gives authenticated attackers the ability to fully retrieve and control the data and availability of the software. Centrally hosted Coolify instances (open registration and/or multiple teams with potentially untrustworthy users) are especially at risk, as sensitive data of all users and connected servers can be leaked by any user. Additionally, attackers are able to modify the running software, potentially deploying malicious images to remote nodes or generally changing its behavior. Version 4.0.0-beta.253 patches this issue.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://github.com/coollabsio/coolify/blob/40a239ddda3fc919f57a052d7b52b8e1a6696b81/bootstrap/helpers/remoteProcess.php#L70; https://github.com/coollabsio/coolify/commit/353245bb7de9680f238bae30443af1696bc977b0; https://github.com/coollabsio/coolify/pull/1524
CVE: CVE-2024-13698
Published: 2025-01-24
Description: The Jobify - Job Board WordPress Theme for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the 'download_image_via_ai' and 'generate_image_via_ai' functions in all versions up to, and including, 4.2.7. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application to upload files in an image format, and to generate AI images using the site's OpenAI key.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://themeforest.net/item/jobify-wordpress-job-board-theme/5247604; https://www.wordfence.com/threat-intel/vulnerabilities/id/393811e4-71dd-4359-80fa-5a3d146439bb?source=cve
CVE: CVE-2024-25034
Published: 2025-01-24
Description: IBM Planning Analytics 2.0 and 2.1 could be vulnerable to malicious file upload by not validating the type of file in the File Manager T1 process. Attackers can make use of this weakness and upload malicious executable files into the system that can be sent to victims for performing further attacks.
CVSS Score: 8.0 (HIGH)
CWE: CWE-434
References: https://www.ibm.com/support/pages/node/7168387
CVE: CVE-2024-40693
Published: 2025-01-24
Description: IBM Planning Analytics 2.0 and 2.1 could be vulnerable to malicious file upload by not validating the content of the file uploaded to the web interface. Attackers can make use of this weakness and upload malicious executable files into the system, and it can be sent to victim for performing further attacks.
CVSS Score: 8.0 (HIGH)
CWE: CWE-434
References: https://www.ibm.com/support/pages/node/7168387
CVE: CVE-2024-40706
Published: 2025-01-24
Description: IBM InfoSphere Information Server 11.7 could allow a remote user to obtain sensitive version information that could aid in further attacks against the system.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-497
References: https://www.ibm.com/support/pages/node/7169826
CVE: CVE-2024-41757
Published: 2025-01-24
Description: IBM Concert Software 1.0.0 and 1.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319, CWE-311
References: https://www.ibm.com/support/pages/node/7173596
CVE: CVE-2024-45077
Published: 2025-01-24
Description: IBM Maximo Asset Management 7.6.1.3 MXAPIASSET API is vulnerable to unrestricted file upload which allows authenticated low privileged user to upload restricted file types with a simple method of adding a dot to the end of the file name if Maximo is installed on Windows operating system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-98
References: https://www.ibm.com/support/pages/node/7174819
CVE: CVE-2025-0698
Published: 2025-01-24
Description: A vulnerability was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. It has been classified as critical. Affected is an unknown function of the file /admin/sys/menu/list. The manipulation of the argument sort/order leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/JoeyBling/bootplus/issues/19; https://github.com/JoeyBling/bootplus/issues/19#issue[PII_REDACTED]; https://vuldb.com/?ctiid.293226
CVE: CVE-2025-0699
Published: 2025-01-24
Description: A vulnerability was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/sys/role/list. The manipulation of the argument sort leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/JoeyBling/bootplus/issues/21; https://github.com/JoeyBling/bootplus/issues/21#issue[PII_REDACTED]; https://vuldb.com/?ctiid.293227