deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-40809
Published: 2024-07-29
Description: A logic issue was addressed with improved checks. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8, visionOS 1.3, watchOS 10.6. A shortcut may be able to bypass Internet permission requirements.
CVSS Score: 7.8 (HIGH)
References: https://support.apple.com/en-us/120908; https://support.apple.com/en-us/120909; https://support.apple.com/en-us/120910
CVE: CVE-2024-40811
Published: 2024-07-29
Description: The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.6. An app may be able to modify protected parts of the file system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-281
References: https://support.apple.com/en-us/120911; http://seclists.org/fulldisclosure/2024/Jul/18; https://support.apple.com/en-us/HT214119
CVE: CVE-2024-40812
Published: 2024-07-29
Description: A logic issue was addressed with improved checks. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8, visionOS 1.3, watchOS 10.6. A shortcut may be able to bypass Internet permission requirements.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://support.apple.com/en-us/120908; https://support.apple.com/en-us/120909; https://support.apple.com/en-us/120910
CVE: CVE-2024-40813
Published: 2024-07-29
Description: A lock screen issue was addressed with improved state management. This issue is fixed in iOS 17.6 and iPadOS 17.6, watchOS 10.6. An attacker with physical access may be able to use Siri to access sensitive user data.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-922
References: https://support.apple.com/en-us/120909; https://support.apple.com/en-us/120916; http://seclists.org/fulldisclosure/2024/Jul/16
CVE: CVE-2024-40814
Published: 2024-07-29
Description: A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sonoma 14.6, macOS Ventura 13.7. An app may be able to bypass Privacy preferences.
CVSS Score: 7.1 (HIGH)
CWE: CWE-285
References: https://support.apple.com/en-us/120911; https://support.apple.com/en-us/121234; http://seclists.org/fulldisclosure/2024/Jul/18
CVE: CVE-2024-40815
Published: 2024-07-29
Description: A race condition was addressed with additional validation. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, macOS Ventura 13.6.8, tvOS 17.6, watchOS 10.6. A malicious attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362, CWE-352
References: https://support.apple.com/en-us/120909; https://support.apple.com/en-us/120911; https://support.apple.com/en-us/120912
CVE: CVE-2024-40816
Published: 2024-07-29
Description: An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. A local attacker may be able to cause unexpected system shutdown.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://support.apple.com/en-us/120910; https://support.apple.com/en-us/120911; https://support.apple.com/en-us/120912
CVE: CVE-2024-40817
Published: 2024-07-29
Description: The issue was addressed with improved UI handling. This issue is fixed in Safari 17.6, macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. Visiting a website that frames malicious content may lead to UI spoofing.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1021, CWE-1021
References: https://support.apple.com/en-us/120910; https://support.apple.com/en-us/120911; https://support.apple.com/en-us/120912
CVE: CVE-2024-40818
Published: 2024-07-29
Description: This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, macOS Ventura 13.6.8, watchOS 10.6. An attacker with physical access may be able to use Siri to access sensitive user data.
CVSS Score: 4.6 (MEDIUM)
References: https://support.apple.com/en-us/120908; https://support.apple.com/en-us/120909; https://support.apple.com/en-us/120911
CVE: CVE-2024-40821
Published: 2024-07-29
Description: An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. Third party app extensions may not receive the correct sandbox restrictions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-281
References: https://support.apple.com/en-us/120910; https://support.apple.com/en-us/120911; https://support.apple.com/en-us/120912
CVE: CVE-2024-40822
Published: 2024-07-29
Description: This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, watchOS 10.6. An attacker with physical access to a device may be able to access contacts from the lock screen.
CVSS Score: 2.4 (LOW)
CWE: CWE-284
References: https://support.apple.com/en-us/120908; https://support.apple.com/en-us/120909; https://support.apple.com/en-us/120911
CVE: CVE-2024-40823
Published: 2024-07-29
Description: The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. An app may be able to access user-sensitive data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/120910; https://support.apple.com/en-us/120911; https://support.apple.com/en-us/120912
CVE: CVE-2024-40824
Published: 2024-07-29
Description: This issue was addressed through improved state management. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, watchOS 10.6. An app may be able to bypass Privacy preferences.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-281
References: https://support.apple.com/en-us/120909; https://support.apple.com/en-us/120911; https://support.apple.com/en-us/120914
CVE: CVE-2024-40827
Published: 2024-07-29
Description: The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. An app may be able to overwrite arbitrary files.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/120910; https://support.apple.com/en-us/120911; https://support.apple.com/en-us/120912
CVE: CVE-2024-40828
Published: 2024-07-29
Description: The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. A malicious app may be able to gain root privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-281
References: https://support.apple.com/en-us/120910; https://support.apple.com/en-us/120911; https://support.apple.com/en-us/120912
CVE: CVE-2024-40829
Published: 2024-07-29
Description: The issue was addressed with improved checks. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Ventura 13.6.8, watchOS 10.6. An attacker may be able to view restricted content from the lock screen.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-416
References: https://support.apple.com/en-us/120908; https://support.apple.com/en-us/120909; https://support.apple.com/en-us/120912
CVE: CVE-2024-40832
Published: 2024-07-29
Description: The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.6. An app may be able to view a contact's phone number in system logs.
CVSS Score: 3.3 (LOW)
CWE: CWE-922
References: https://support.apple.com/en-us/120911; http://seclists.org/fulldisclosure/2024/Jul/18; https://support.apple.com/en-us/HT214119
CVE: CVE-2024-40833
Published: 2024-07-29
Description: A logic issue was addressed with improved checks. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. A shortcut may be able to use sensitive data with certain actions without prompting the user.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/120908; https://support.apple.com/en-us/120910; https://support.apple.com/en-us/120911
CVE: CVE-2024-40834
Published: 2024-07-29
Description: This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. A shortcut may be able to bypass sensitive Shortcuts app settings.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-862
References: https://support.apple.com/en-us/120910; https://support.apple.com/en-us/120911; https://support.apple.com/en-us/120912
CVE: CVE-2024-40835
Published: 2024-07-29
Description: A logic issue was addressed with improved checks. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8, watchOS 10.6. A shortcut may be able to use sensitive data with certain actions without prompting the user.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/120908; https://support.apple.com/en-us/120909; https://support.apple.com/en-us/120910
CVE: CVE-2024-40836
Published: 2024-07-29
Description: A logic issue was addressed with improved checks. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, watchOS 10.6. A shortcut may be able to use sensitive data with certain actions without prompting the user.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/120908; https://support.apple.com/en-us/120909; https://support.apple.com/en-us/120911
CVE: CVE-2024-7212
Published: 2024-07-30
Description: A vulnerability, which was classified as critical, has been found in TOTOLINK A7000R 9.1.0u.6268_B20220504. This issue affects the function loginauth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument password leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272783. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/A7000R/loginauth_password.md; https://vuldb.com/?ctiid.272783; https://vuldb.com/?id.272783
CVE: CVE-2024-7213
Published: 2024-07-30
Description: A vulnerability, which was classified as critical, was found in TOTOLINK A7000R 9.1.0u.6268_B20220504. Affected is the function setWizardCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ssid leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272784. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/A7000R/setWizardCfg.md; https://vuldb.com/?ctiid.272784; https://vuldb.com/?id.272784
CVE: CVE-2024-7214
Published: 2024-07-30
Description: A vulnerability has been found in TOTOLINK LR350 9.3.5u.6369_B20220309 and classified as critical. Affected by this vulnerability is the function setWanCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument hostName leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272785 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/LR350/setWanCfg.md; https://vuldb.com/?ctiid.272785; https://vuldb.com/?id.272785
CVE: CVE-2024-7215
Published: 2024-07-30
Description: A vulnerability was found in TOTOLINK LR1200 9.3.1cu.2832 and classified as critical. Affected by this issue is the function NTPSyncWithHost of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument host_time leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-272786 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/LR1200/NTPSyncWithHost.md; https://vuldb.com/?ctiid.272786; https://vuldb.com/?id.272786
CVE: CVE-2024-7216
Published: 2024-07-30
Description: A vulnerability was found in TOTOLINK LR1200 9.3.1cu.2832. It has been classified as problematic. This affects an unknown part of the file /etc/shadow.sample. The manipulation leads to use of hard-coded password. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272787. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.6 (LOW)
CWE: CWE-259
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/LR1200/shadow.md; https://vuldb.com/?ctiid.272787; https://vuldb.com/?id.272787
CVE: CVE-2024-7217
Published: 2024-07-30
Description: A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884. It has been declared as critical. This vulnerability affects the function loginauth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument password leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272788. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/CA300-PoE/loginauth_password.md; https://vuldb.com/?ctiid.272788; https://vuldb.com/?id.272788
CVE: CVE-2024-7218
Published: 2024-07-30
Description: A flaw has been found in SourceCodester/Campcodes School Log Management System 1.0. Affected is an unknown function of the file /admin/ajax.php?action=save_student. Executing manipulation of the argument Name can lead to cross site scripting. The attack may be performed from remote. The exploit has been published and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://gist.github.com/topsky979/86480890cc621c240c86e95a3de9ecc4; https://vuldb.com/?ctiid.272789; https://vuldb.com/?id.272789
CVE: CVE-2024-1286
Published: 2024-07-30
Description: The pmpro-membership-maps WordPress plugin before 0.7 does not prevent users with at least the contributor role from leaking sensitive information about users with a membership on the site.
CVSS Score: 4.9 (MEDIUM)
References: https://wpscan.com/vulnerability/49dc9ca3-d0ef-4a75-8b51-307e3e44e91b/; https://wpscan.com/vulnerability/49dc9ca3-d0ef-4a75-8b51-307e3e44e91b/
CVE: CVE-2024-1287
Published: 2024-07-30
Description: The pmpro-member-directory WordPress plugin before 1.2.6 does not prevent users with at least the contributor role from leaking other users' sensitive information, including password hashes via an SQLi vector.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-202
References: https://wpscan.com/vulnerability/169e5756-4e12-4add-82e9-47471c30f08c/; https://wpscan.com/vulnerability/169e5756-4e12-4add-82e9-47471c30f08c/
CVE: CVE-2024-3113
Published: 2024-07-30
Description: The FormFlow: WhatsApp Social and Advanced Form Builder with Easy Lead Collection WordPress plugin before 2.12.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/ad85c5c7-f4d1-4374-b3b7-8ee022d27d34/; https://wpscan.com/vulnerability/ad85c5c7-f4d1-4374-b3b7-8ee022d27d34/
CVE: CVE-2024-3669
Published: 2024-07-30
Description: The Web Directory Free WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/3c37c9a9-1424-427a-adc7-c2336a47e9cf/; https://wpscan.com/vulnerability/3c37c9a9-1424-427a-adc7-c2336a47e9cf/
CVE: CVE-2024-3986
Published: 2024-07-30
Description: The SportsPress  WordPress plugin before 2.7.22 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/76c78f8e-e3da-47d9-9bf4-70e9dd125b82/; https://wpscan.com/vulnerability/76c78f8e-e3da-47d9-9bf4-70e9dd125b82/
CVE: CVE-2024-4096
Published: 2024-07-30
Description: The Responsive Tabs WordPress plugin through 4.0.8 does not sanitise and escape some of its Tab settings, which could allow high privilege users such as Contributors and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/4dba5e9e-24be-458a-9150-7c7a958e66cb/; https://wpscan.com/vulnerability/4dba5e9e-24be-458a-9150-7c7a958e66cb/
CVE: CVE-2024-5765
Published: 2024-07-30
Description: The WpStickyBar  WordPress plugin through 2.1.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wpscan.com/vulnerability/0b73f84c-611e-4681-b362-35e721478ba4/; https://wpscan.com/vulnerability/0b73f84c-611e-4681-b362-35e721478ba4/
CVE: CVE-2024-5807
Published: 2024-07-30
Description: The Business Card WordPress plugin through 1.0.0 does not prevent high privilege users like administrators from uploading malicious PHP files, which could allow them to run arbitrary code on servers hosting their site, even in MultiSite configurations.
CVSS Score: 7.2 (HIGH)
References: https://wpscan.com/vulnerability/badb16b5-8c06-4170-b605-ea7af8982c1f/; https://wpscan.com/vulnerability/badb16b5-8c06-4170-b605-ea7af8982c1f/
CVE: CVE-2024-5808
Published: 2024-07-30
Description: The WP Ajax Contact Form WordPress plugin through 2.2.2 does not have CSRF check in place when deleting emails from the email list, which could allow attackers to make a logged in admin perform such action via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/1783bbce-3cc3-4a7e-a491-b713cee8278b/; https://wpscan.com/vulnerability/1783bbce-3cc3-4a7e-a491-b713cee8278b/
CVE: CVE-2024-5809
Published: 2024-07-30
Description: The WP Ajax Contact Form WordPress plugin through 2.2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against admin users
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/0af9fbcf-5f0e-4f7f-ae60-b46e704cf0a5/; https://wpscan.com/vulnerability/0af9fbcf-5f0e-4f7f-ae60-b46e704cf0a5/
CVE: CVE-2024-5975
Published: 2024-07-30
Description: The CZ Loan Management WordPress plugin through 1.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89
References: https://wpscan.com/vulnerability/68f81943-b007-49c8-be9c-d0405b2ba4cf/; https://wpscan.com/vulnerability/68f81943-b007-49c8-be9c-d0405b2ba4cf/
CVE: CVE-2024-6021
Published: 2024-07-30
Description: The Donation Block For PayPal WordPress plugin through 2.1.0 does not sanitise and escape form submissions, leading to a stored cross-site scripting vulnerability
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/9d83cffd-7dcd-4301-8d4d-3043b14e05b5/; https://wpscan.com/vulnerability/9d83cffd-7dcd-4301-8d4d-3043b14e05b5/
CVE: CVE-2024-6223
Published: 2024-07-30
Description: The Send email only on Reply to My Comment WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/cf7d1cea-0bf4-4b9e-bab4-71d5719a7c30/; https://wpscan.com/vulnerability/cf7d1cea-0bf4-4b9e-bab4-71d5719a7c30/
CVE: CVE-2024-6224
Published: 2024-07-30
Description: The Send email only on Reply to My Comment WordPress plugin through 1.0.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/54457f1b-6572-4de0-9100-3433c715c5ce/; https://wpscan.com/vulnerability/54457f1b-6572-4de0-9100-3433c715c5ce/
CVE: CVE-2024-6226
Published: 2024-07-30
Description: The WpStickyBar  WordPress plugin through 2.1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/e42ce8dc-51d4-471d-b3bb-ad2a6b735d02/; https://wpscan.com/vulnerability/e42ce8dc-51d4-471d-b3bb-ad2a6b735d02/
CVE: CVE-2024-6230
Published: 2024-07-30
Description: The پلاگین پرداخت دلخواه WordPress plugin through 2.9.8 does not have CSRF check in place when resetting its form fields, which could allow attackers to make a logged in admin perform such action via a CSRF attack
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/311e3c15-0f58-4f3b-91f8-0c62c0eea55e/; https://wpscan.com/vulnerability/311e3c15-0f58-4f3b-91f8-0c62c0eea55e/
CVE: CVE-2024-6536
Published: 2024-07-30
Description: The Zephyr Project Manager WordPress plugin before 3.3.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors and admins to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/ee40c1c6-4186-4b97-866c-fb0e76cedeb8/; https://wpscan.com/vulnerability/ee40c1c6-4186-4b97-866c-fb0e76cedeb8/
CVE: CVE-2024-7219
Published: 2024-07-30
Description: A vulnerability has been found in SourceCodester/Campcodes School Log Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/ajax.php?action=login. The manipulation of the argument Username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://gist.github.com/topsky979/03c7fe20c80455b4884ae9e6c3f3d978; https://vuldb.com/?ctiid.272790; https://vuldb.com/?id.272790
CVE: CVE-2024-7220
Published: 2024-07-30
Description: A vulnerability was found in SourceCodester/Campcodes School Log Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/print_barcode.php. The manipulation of the argument tbl results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://gist.github.com/topsky979/5cd0b6a43815a0615b8493cde5c4dacf; https://vuldb.com/?ctiid.272791; https://vuldb.com/?id.272791