deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-2618
Published: 2024-05-24
Description: The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the size attribute in all versions up to, and including, 1.6.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-87, CWE-79
References: https://plugins.trac.wordpress.org/browser/header-footer-elementor/tags/1.6.26/inc/widgets-manager/widgets/class-page-title.php#L494; https://plugins.trac.wordpress.org/browser/header-footer-elementor/tags/1.6.26/inc/widgets-manager/widgets/class-site-title.php#L478; https://www.wordfence.com/threat-intel/vulnerabilities/id/a780ce1b-0758-42ef-88e7-ff8d921eca6e?source=cve
CVE: CVE-2024-2784
Published: 2024-05-24
Description: The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Hover Card widget in all versions up to, and including, 5.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3090866/; https://www.wordfence.com/threat-intel/vulnerabilities/id/cc6fdb7c-b750-4f03-9785-a9dc7573580d?source=cve; https://plugins.trac.wordpress.org/changeset/3090866/
CVE: CVE-2024-3557
Published: 2024-05-24
Description: The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpgmza shortcode in all versions up to, and including, 9.0.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-google-maps/trunk/includes/class.shortcodes.php?rev=3045434; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3083067%40wp-google-maps%2Ftrunk&old=3062437%40wp-google-maps%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/ef792894-b841-495c-aae0-08476a435471?source=cve
CVE: CVE-2023-1001
Published: 2024-05-24
Description: A vulnerability, which was classified as problematic, has been found in xuliangzhan vxe-table up to 3.7.9. This issue affects the function export of the file packages/textarea/src/textarea.js of the component vxe-textarea. The manipulation of the argument inputValue leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 3.7.10 is able to address this issue. The patch is named d70b0e089740b65a22c89c106ebc4627ac48a22d. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-266123.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://gitee.com/xuliangzhan_admin/vxe-table/commit/d70b0e089740b65a22c89c106ebc4627ac48a22d; https://gitee.com/xuliangzhan_admin/vxe-table/issues/I8O21R; https://gitee.com/xuliangzhan_admin/vxe-table/tree/3.7.10
CVE: CVE-2024-0867
Published: 2024-05-24
Description: The Email Log plugin for WordPress is vulnerable to Unauthenticated Hook Injection in all versions up to, and including, 2.4.8 via the check_nonce function. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress under certain circumstances. The action the attacker wishes to execute needs to have a nonce check, and the nonce needs to be known to the attacker. Furthermore, the absence of a capability check is a requirement.
CVSS Score: 8.1 (HIGH)
CWE: CWE-94
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3027872%40email-log&new=3027872%40email-log&sfp_email=&sfph_mail=; https://wordpress.org/plugins/email-log/; https://www.wordfence.com/threat-intel/vulnerabilities/id/fd15268f-7e06-4e0d-baaf-f27348af61ce?source=cve
CVE: CVE-2024-1134
Published: 2024-05-24
Description: The SEOPress – On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the SEO title and description parameters as well as others in all versions up to, and including, 7.5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3056025%40wp-seopress%2Ftrunk&old=3047913%40wp-seopress%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/bc3910e4-649f-45ab-876a-a4b04afac8d2?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3056025%40wp-seopress%2Ftrunk&old=3047913%40wp-seopress%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2024-36361
Published: 2024-05-24
Description: Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the compileClient, compileFileClient, or compileClientWithDependenciesTracked function. NOTE: these functions are for compiling Pug templates into JavaScript, and there would typically be no reason to allow untrusted callers.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: https://github.com/pugjs/pug/pull/3428; https://pugjs.org/api/reference.html; https://github.com/pugjs/pug/pull/3428
CVE: CVE-2024-3718
Published: 2024-05-24
Description: The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's widgets all versions up to, and including, 5.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-35709 is likely a duplicate of this issue.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/the-plus-addons-for-elementor-page-builder/tags/5.4.2/modules/widgets/tp_age_gate.php#L2304; https://plugins.trac.wordpress.org/browser/the-plus-addons-for-elementor-page-builder/tags/5.4.2/modules/widgets/tp_flip_box.php#L2349; https://plugins.trac.wordpress.org/browser/the-plus-addons-for-elementor-page-builder/tags/5.4.2/modules/widgets/tp_header_extras.php#L2757
CVE: CVE-2024-5142
Published: 2024-05-24
Description: Stored Cross-Site Scripting vulnerability in Social Module in M-Files Hubshare before version 5.0.6.0 allows authenticated attacker to run scripts in other users browser
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://empower.m-files.com/security-advisories/CVE-2024-5142; https://product.m-files.com/security-advisories/cve-2024-5142/; https://www.m-files.com/about/trust-center/security-advisories/cve-2024-5142/
CVE: CVE-2023-1111
Published: 2024-05-24
Description: A vulnerability was found in FastCMS up to 0.1.5 and classified as problematic. Affected by this issue is some unknown functionality of the component New Article Tab. The manipulation of the argument Title leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-266126 is the identifier assigned to this vulnerability.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://gitee.com/dianbuapp_admin/fastcms/issues/I8ERNV; https://vuldb.com/?ctiid.266126; https://vuldb.com/?id.266126
CVE: CVE-2023-7259
Published: 2024-05-24
Description: ** DISPUTED ** A vulnerability was found in zzdevelop lenosp up to 20230831. It has been classified as problematic. This affects an unknown part of the component Adduser Page. The manipulation of the argument username with the input <script>alert(1)</script> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The associated identifier of this vulnerability is VDB-266127. NOTE: The vendor rejected the issue because he claims that XSS which require administrative privileges are not of any use for attackers.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://gitee.com/zzdevelop/lenosp/issues/I7XC2Y; https://vuldb.com/?ctiid.266127; https://vuldb.com/?id.266127
CVE: CVE-2024-0893
Published: 2024-05-24
Description: The Schema App Structured Data plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the MarkupUpdate function in all versions up to, and including, 2.2.0. This makes it possible for authenticated attackers, with subscriber access or higher, to update or delete post metadata.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/schema-app-structured-data-for-schemaorg/trunk/lib/SchemaEditor.php#L327; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3108928%40schema-app-structured-data-for-schemaorg&new=3108928%40schema-app-structured-data-for-schemaorg&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/1089ab17-b780-4840-8dcd-c[PII_REDACTED]4?source=cve
CVE: CVE-2024-1332
Published: 2024-05-24
Description: The Custom Fonts – Host Your Fonts Locally plugin for WordPress is vulnerable to Stored Cross-Site Scripting via svg file upload in all versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author level or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-434, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3074871%40custom-fonts%2Ftrunk&old=3062686%40custom-fonts%2Ftrunk&sfp_email=&sfph_mail=#file4; https://www.wordfence.com/threat-intel/vulnerabilities/id/98536242-64c7-4e02-aa00-a3efbf5c90d8?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3074871%40custom-fonts%2Ftrunk&old=3062686%40custom-fonts%2Ftrunk&sfp_email=&sfph_mail=#file4
CVE: CVE-2024-1376
Published: 2024-05-24
Description: The Event post plugin for WordPress is vulnerable to unauthorized bulk metadata update due to a missing capability check on the save_bulkdatas function in all versions up to, and including, 5.9.4. This makes it possible for authenticated attackers, with subscriber access or higher, to update post_meta_data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284, CWE-862
References: https://plugins.trac.wordpress.org/changeset/3086840/event-post/trunk/eventpost.php?old=3060317&old_path=event-post%2Ftrunk%2Feventpost.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/926c09d5-3824-4745-99f6-50d9c945d252?source=cve; https://plugins.trac.wordpress.org/changeset/3086840/event-post/trunk/eventpost.php?old=3060317&old_path=event-post%2Ftrunk%2Feventpost.php
CVE: CVE-2024-4484
Published: 2024-05-24
Description: The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘xai_username’ parameter in versions up to, and including, 5.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/the-plus-addons-for-elementor-page-builder/tags/5.5.2/modules/widgets/tp_meeting_scheduler.php#L549; https://plugins.trac.wordpress.org/changeset/3083932; https://www.wordfence.com/threat-intel/vulnerabilities/id/f36c785f-9b8c-43c4-b12f-6fb4c0c67eff?source=cve
CVE: CVE-2024-4485
Published: 2024-05-24
Description: The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘button_custom_attributes’ parameter in versions up to, and including, 5.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/the-plus-addons-for-elementor-page-builder/tags/5.5.2/modules/widgets/tp_button.php#L1538; https://plugins.trac.wordpress.org/changeset/3083932; https://www.wordfence.com/threat-intel/vulnerabilities/id/4890cd48-a448-4af1-ae1e[PII_REDACTED]e5?source=cve
CVE: CVE-2024-5060
Published: 2024-05-24
Description: The LottieFiles – JSON Based Animation Lottie & Bodymovin for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.10.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/include-lottie-animation-for-elementor/tags/1.10.9/include/jbafe-json-anim-widget.php#L1180; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3089058%40include-lottie-animation-for-elementor%2Ftags%2F1.10.9&new=3089058%40include-lottie-animation-for-elementor%2Ftags%2F1.10.10; https://www.wordfence.com/threat-intel/vulnerabilities/id/74f59ee0-19dd-4cc9-ab24-22f26d71d248?source=cve
CVE: CVE-2024-4366
Published: 2024-05-24
Description: The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘block_id’ parameter in versions up to, and including, 2.13.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3080971/; https://www.wordfence.com/threat-intel/vulnerabilities/id/72a74483-e159-4c51-a9e0-4a128cbf72dd?source=cve; https://plugins.trac.wordpress.org/changeset/3080971/
CVE: CVE-2024-4037
Published: 2024-05-24
Description: The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.7.02.003. This is due to the plugin allowing unauthenticated users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94, CWE-94
References: https://plugins.trac.wordpress.org/browser/wp-photo-album-plus/trunk/wppa-ajax.php#L1138; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3078746%40wp-photo-album-plus&new=3078746%40wp-photo-album-plus&sfp_email=&sfph_mail=#file3; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3079831%40wp-photo-album-plus&new=3079831%40wp-photo-album-plus&sfp_email=&sfph_mail=
CVE: CVE-2024-5310
Published: 2024-05-24
Description: A vulnerability classified as problematic has been found in JFinalCMS up to 20221020. This affects an unknown part of the file /admin/content. The manipulation of the argument Title leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-266121 was assigned to this vulnerability.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://gitee.com/heyewei/JFinalcms/issues/I8VHM2; https://vuldb.com/?ctiid.266121; https://vuldb.com/?id.266121
CVE: CVE-2024-5314
Published: 2024-05-24
Description: Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters sortorder y sortfield in /dolibarr/admin/dict.php.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-dolibarrs-erp-cms; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-dolibarrs-erp-cms
CVE: CVE-2024-5315
Published: 2024-05-24
Description: Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters 

viewstatut in /dolibarr/commande/list.php.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-dolibarrs-erp-cms; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-dolibarrs-erp-cms
CVE: CVE-2024-4455
Published: 2024-05-24
Description: The YITH WooCommerce Ajax Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘item’ parameter in versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/yith-woocommerce-ajax-search/trunk/includes/admin/class-yith-wcas-admin-statistic-list-table.php#L213; https://plugins.trac.wordpress.org/changeset/3091321; https://www.wordfence.com/threat-intel/vulnerabilities/id/cf0f5fd4-cd06-4d11-9f22-1f417b546afb?source=cve
CVE: CVE-2024-5312
Published: 2024-05-24
Description: PHP Server Monitor, version 3.2.0, is vulnerable to an XSS via the /phpservermon-3.2.0/vendor/phpmailer/phpmailer/test_script/index.php page in all visible parameters. An attacker could create a specially crafted URL, send it to a victim and retrieve their session details.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-php-server-monitor; https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-php-server-monitor
CVE: CVE-2023-47710
Published: 2024-05-24
Description: IBM Security Guardium 11.4, 11.5, and 12.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  271525.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/271525; https://www.ibm.com/support/pages/node/7154435; https://exchange.xforce.ibmcloud.com/vulnerabilities/271525
CVE: CVE-2023-49572
Published: 2024-05-24
Description: A vulnerability has been discovered in VX Search Enterprise affecting version 10.2.14, and in Disk Pulse Enterprise 10.4.18 version, that could allow an attacker to execute persistent XSS through /setup_odbc in odbc_data_source, odbc_user and odbc_password parameters. This vulnerability could allow an attacker to store malicious JavaScript payloads on the system to be triggered when the page loads.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-flexense-vx-search-enterprise; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-flexense-vx-search-enterprise
CVE: CVE-2023-49573
Published: 2024-05-24
Description: A vulnerability has been discovered in VX Search Enterprise affecting version 10.2.14 that could allow an attacker to execute persistent XSS through /add_command_action in action_value. This vulnerability could allow an attacker to store malicious JavaScript payloads on the system to be triggered when the page loads.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-flexense-vx-search-enterprise; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-flexense-vx-search-enterprise
CVE: CVE-2023-49574
Published: 2024-05-24
Description: A vulnerability has been discovered in VX Search Enterprise affecting version 10.2.14 that could allow an attacker to execute persistent XSS through /add_job in job_name. This vulnerability could allow an attacker to store malicious JavaScript payloads on the system to be triggered when the page loads.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-flexense-vx-search-enterprise; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-flexense-vx-search-enterprise
CVE: CVE-2023-49575
Published: 2024-05-24
Description: A vulnerability has been discovered in VX Search Enterprise affecting version 10.2.14, in Sync Breeze Enterprise Server 10.4.18 version, and in Disk Pulse Enterprise 10.4.18 version, that could allow an attacker to execute persistent XSS through /setup_smtp in smtp_server, smtp_user, smtp_password and smtp_email_address parameters. This vulnerability could allow an attacker to store malicious JavaScript payloads on the system to be triggered when the page loads.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-flexense-vx-search-enterprise; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-flexense-vx-search-enterprise
CVE: CVE-2024-5318
Published: 2024-05-24
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.11 prior to 16.10.6, starting from 16.11 prior to 16.11.3, and starting from 17.0 prior to 17.0.1. A Guest user can view dependency lists of private projects through job artifacts.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://gitlab.com/gitlab-org/gitlab/-/issues/427526; https://hackerone.com/reports/2189464; https://gitlab.com/gitlab-org/gitlab/-/issues/427526
CVE: CVE-2024-35591
Published: 2024-05-24
Description: An arbitrary file upload vulnerability in O2OA v8.3.8 allows attackers to execute arbitrary code via uploading a crafted PDF file.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/o2oa/o2oa/issues/156; https://github.com/o2oa/o2oa/issues/156
CVE: CVE-2024-35592
Published: 2024-05-24
Description: An arbitrary file upload vulnerability in the Upload function of Box-IM v2.0 allows attackers to execute arbitrary code via uploading a crafted PDF file.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79
References: https://github.com/Joying-C/Cross-site-scripting-vulnerability/blob/main/BOX-IM_Cross_site%20_scripting%20_vulnerability/BOX-IM_Cross_site%20_scripting%20_vulnerability.pdf; https://github.com/Joying-C/Cross-site-scripting-vulnerability/blob/main/BOX-IM_Cross_site%20_scripting%20_vulnerability/BOX-IM_Cross_site%20_scripting%20_vulnerability.pdf