deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-26625
Published: 2024-01-02
Description: A SQL injection vulnerability was discovered in Gila CMS 1.15.4 and earlier which allows a remote attacker to execute arbitrary web scripts via the 'user_id' parameter after the login portal.
CVSS Score: 3.8 (LOW)
CWE: CWE-89, CWE-89
References: http://gilacms.com; https://github.com/GilaCMS/gila; https://github.com/GilaCMS/gila/security/policy
CVE: CVE-2023-4164
Published: 2024-01-02
Description: There is a possible information disclosure due to a missing permission check. This could lead to local information disclosure of health data with no additional execution privileges needed.

CVSS Score: 8.4 (HIGH)
CWE: CWE-200, CWE-862
References: https://source.android.com/docs/security/bulletin/pixel-watch/2023/2023-12-01; https://source.android.com/docs/security/bulletin/pixel-watch/2023/2023-12-01
CVE: CVE-2023-50019
Published: 2024-01-02
Description: An issue was discovered in open5gs v2.6.6. InitialUEMessage, Registration request sent at a specific time can crash AMF due to incorrect error handling of Nudm_UECM_Registration response.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-755, CWE-400
References: https://github.com/open5gs/open5gs/commit/[PII_REDACTED]422cee46c32c7523f81ec2cecad9e2; https://github.com/open5gs/open5gs/issues/2733; https://github.com/open5gs/open5gs/commit/[PII_REDACTED]422cee46c32c7523f81ec2cecad9e2
CVE: CVE-2023-50020
Published: 2024-01-02
Description: An issue was discovered in open5gs v2.6.6. SIGPIPE can be used to crash AMF.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://github.com/open5gs/open5gs/commit/1aba814938e3a1b2eec7014bf6ce132d34622e08; https://github.com/open5gs/open5gs/issues/2734; https://github.com/open5gs/open5gs/commit/1aba814938e3a1b2eec7014bf6ce132d34622e08
CVE: CVE-2023-6339
Published: 2024-01-02
Description: Google Nest WiFi Pro root code-execution & user-data compromise
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-311, CWE-311
References: https://support.google.com/product-documentation/answer/14273332?hl=en&ref_topic=12974021&sjid=[PII_REDACTED]772963473-NA; https://vuldb.com/?id.249563; https://support.google.com/product-documentation/answer/14273332?hl=en&ref_topic=12974021&sjid=[PII_REDACTED]772963473-NA
CVE: CVE-2024-0196
Published: 2024-01-02
Description: A vulnerability has been found in Magic-Api up to 2.0.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /resource/file/api/save?auto=1. The manipulation leads to code injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249511.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-94
References: https://github.com/laoquanshi/puppy/blob/main/Magic-Api%20Code%20Execution%20Vulnerability.md; https://vuldb.com/?ctiid.249511; https://vuldb.com/?id.249511
CVE: CVE-2024-21628
Published: 2024-01-02
Description: PrestaShop is an open-source e-commerce platform. Prior to version 8.1.3, the isCleanHtml method is not used on this this form, which makes it possible to store a cross-site scripting payload in the database. The impact is low because the HTML is not interpreted in BO, thanks to twig's escape mechanism. In FO, the cross-site scripting attack is effective, but only impacts the customer sending it, or the customer session from which it was sent. This issue affects those who have a module fetching these messages from the DB and displaying it without escaping HTML. Version 8.1.3 contains a patch for this issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/PrestaShop/PrestaShop/commit/c3d78b7e49f5fe49a9d07725c3174d005deaa597; https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-vr7m-r9vm-m4wf; https://github.com/PrestaShop/PrestaShop/commit/c3d78b7e49f5fe49a9d07725c3174d005deaa597
CVE: CVE-2024-21629
Published: 2024-01-02
Description: Rust EVM is an Ethereum Virtual Machine interpreter. In `rust-evm`, a feature called `record_external_operation` was introduced, allowing library users to record custom gas changes. This feature can have some bogus interactions with the call stack. In particular, during finalization of a `CREATE` or `CREATE2`, in the case that the substack execution happens successfully, `rust-evm` will first commit the substate, and then call `record_external_operation(Write(out_code.len()))`. If `record_external_operation` later fails, this error is returned to the parent call stack, instead of `Succeeded`. Yet, the substate commitment already happened. This causes smart contracts able to commit state changes, when the parent caller contract receives zero address (which usually indicates that the execution has failed). This issue only impacts library users with custom `record_external_operation` that returns errors. The issue is patched in release 0.41.1. No known workarounds are available.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-703
References: https://github.com/rust-ethereum/evm/blob/release-v041/src/executor/stack/executor.rs#L1012C25-L1012C69; https://github.com/rust-ethereum/evm/commit/d8991ec727ad0fb64fe9957a3cd307387a6701e4; https://github.com/rust-ethereum/evm/pull/264
CVE: CVE-2024-21632
Published: 2024-01-02
Description: omniauth-microsoft_graph provides an Omniauth strategy for the Microsoft Graph API. Prior to versions 2.0.0, the implementation did not validate the legitimacy of the `email` attribute of the user nor did it give/document an option to do so, making it susceptible to nOAuth misconfiguration in cases when the `email` is used as a trusted user identifier. This could lead to account takeover. Version 2.0.0 contains a fix for this issue.

CVSS Score: 8.6 (HIGH)
CWE: CWE-287
References: https://github.com/synth/omniauth-microsoft_graph/commit/f[PII_REDACTED]2b797c872b45bd0e0b47382414c1; https://github.com/synth/omniauth-microsoft_graph/security/advisories/GHSA-5g66-628f-7cvj; https://www.descope.com/blog/post/noauth
CVE: CVE-2023-48418
Published: 2024-01-02
Description: In checkDebuggingDisallowed of DeviceVersionFragment.java, there is a
    possible way to access adb before SUW completion due to an insecure default
    value. This could lead to local escalation of privilege with no additional
    execution privileges needed. User interaction is not needed for
    exploitation
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-269
References: http://packetstormsecurity.com/files/176446/Android-DeviceVersionFragment.java-Privilege-Escalation.html; https://source.android.com/docs/security/bulletin/pixel-watch/2023/2023-12-01; http://packetstormsecurity.com/files/176446/Android-DeviceVersionFragment.java-Privilege-Escalation.html
CVE: CVE-2023-49549
Published: 2024-01-02
Description: An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_getretvalpos function in the msj.c file.
CVSS Score: 7.5 (HIGH)
References: https://github.com/cesanta/mjs/issues/251; https://github.com/cesanta/mjs/issues/251
CVE: CVE-2023-49550
Published: 2024-01-02
Description: An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs+0x4ec508 component.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/cesanta/mjs/issues/252; https://github.com/cesanta/mjs/issues/252
CVE: CVE-2023-49551
Published: 2024-01-02
Description: An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_op_json_parse function in the msj.c file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/cesanta/mjs/issues/257; https://github.com/cesanta/mjs/issues/257
CVE: CVE-2023-49552
Published: 2024-01-02
Description: An Out of Bounds Write in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_op_json_stringify function in the msj.c file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-787
References: https://github.com/cesanta/mjs/issues/256; https://github.com/cesanta/mjs/issues/256
CVE: CVE-2023-49553
Published: 2024-01-02
Description: An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_destroy function in the msj.c file.
CVSS Score: 7.5 (HIGH)
References: https://github.com/cesanta/mjs/issues/253; https://github.com/cesanta/mjs/issues/253
CVE: CVE-2023-49554
Published: 2024-01-03
Description: Use After Free vulnerability in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the do_directive function in the modules/preprocs/nasm/nasm-pp.c component.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://github.com/yasm/yasm/issues/249; https://github.com/yasm/yasm/issues/249
CVE: CVE-2023-49555
Published: 2024-01-03
Description: An issue in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the expand_smacro function in the modules/preprocs/nasm/nasm-pp.c component.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://github.com/yasm/yasm/issues/248; https://github.com/yasm/yasm/issues/248
CVE: CVE-2023-49556
Published: 2024-01-03
Description: Buffer Overflow vulnerability in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the expr_delete_term function in the libyasm/expr.c component.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/yasm/yasm/issues/250; https://github.com/yasm/yasm/issues/250
CVE: CVE-2023-49557
Published: 2024-01-03
Description: An issue in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the yasm_section_bcs_first function in the libyasm/section.c component.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://github.com/yasm/yasm/issues/253; https://github.com/yasm/yasm/issues/253
CVE: CVE-2023-49558
Published: 2024-01-03
Description: An issue in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the expand_mmac_params function in the modules/preprocs/nasm/nasm-pp.c component.
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/yasm/yasm/issues/252; https://github.com/yasm/yasm/issues/252
CVE: CVE-2023-41776
Published: 2024-01-03
Description: There is a local privilege escalation vulnerability of ZTE's ZXCLOUD iRAI.Attackers with regular user privileges can create a fake process, and to escalate local privileges.



CVSS Score: 6.7 (MEDIUM)
CWE: CWE-732, CWE-269
References: https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1034404; https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1034404
CVE: CVE-2023-41779
Published: 2024-01-03
Description: There is an illegal memory access vulnerability of ZTE's ZXCLOUD iRAI product.When the vulnerability is exploited by an attacker with the common user permission, the physical machine will be crashed.



CVSS Score: 4.4 (MEDIUM)
CWE: CWE-119, CWE-863
References: https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1034404; https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1034404
CVE: CVE-2023-41780
Published: 2024-01-03
Description: There is an unsafe DLL loading vulnerability in ZTE ZXCLOUD iRAI. Due to the  program  failed to adequately validate the user's input, an attacker could exploit this vulnerability  to escalate local privileges.



CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22, CWE-427
References: https://https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1034404; https://https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1034404
CVE: CVE-2023-41783
Published: 2024-01-03
Description: There is a command injection vulnerability of ZTE's ZXCLOUD iRAI. Due to the  program  failed to adequately validate the user's input, an attacker could exploit this vulnerability  to escalate local privileges.



CVSS Score: 4.3 (MEDIUM)
CWE: CWE-94, CWE-94
References: https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1034404; https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1034404
CVE: CVE-2023-50345
Published: 2024-01-03
Description: HCL DRYiCE MyXalytics is impacted by an Open Redirect vulnerability which could allow an attacker to redirect users to malicious sites, potentially leading to phishing attacks or other security threats.

CVSS Score: 3.7 (LOW)
CWE: CWE-601, CWE-601
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109608; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109608
CVE: CVE-2023-50346
Published: 2024-01-03
Description: HCL DRYiCE MyXalytics is impacted by an information disclosure vulnerability. Certain endpoints within the application disclose detailed file information.

CVSS Score: 3.1 (LOW)
CWE: CWE-200
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109608; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109608
CVE: CVE-2023-50348
Published: 2024-01-03
Description: HCL DRYiCE MyXalytics is impacted by an improper error handling vulnerability. The application returns detailed error messages that can provide an attacker with insight into the application, system, etc.

CVSS Score: 3.1 (LOW)
CWE: CWE-209
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109608; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109608
CVE: CVE-2023-50350
Published: 2024-01-03
Description: HCL DRYiCE MyXalytics is impacted by the use of a broken cryptographic algorithm for encryption, potentially giving an attacker ability to decrypt sensitive information. 

CVSS Score: 8.2 (HIGH)
CWE: CWE-327, CWE-327
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109608; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109608
CVE: CVE-2023-50351
Published: 2024-01-03
Description: HCL DRYiCE MyXalytics is impacted by the use of an insecure key rotation mechanism which can allow an attacker to compromise the confidentiality or integrity of data.

CVSS Score: 8.2 (HIGH)
CWE: CWE-327
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109608; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109608
CVE: CVE-2023-45722
Published: 2024-01-03
Description: HCL DRYiCE MyXalytics is impacted by path traversal arbitrary file read vulnerability because it uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory.  The product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Potential exploits can completely disrupt or take over the application.

CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-22
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109608; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109608
CVE: CVE-2023-45723
Published: 2024-01-03
Description: HCL DRYiCE MyXalytics is impacted by path traversal vulnerability which allows file upload capability.  Certain endpoints permit users to manipulate the path (including the file name) where these files are stored on the server.

CVSS Score: 7.6 (HIGH)
CWE: CWE-22, CWE-22
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109608; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109608
CVE: CVE-2023-45724
Published: 2024-01-03
Description: HCL DRYiCE MyXalytics product is impacted by unauthenticated file upload vulnerability. The web application permits the upload of a certain file without requiring user authentication.

CVSS Score: 8.2 (HIGH)
CWE: CWE-434, CWE-434
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109608; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109608
CVE: CVE-2023-50341
Published: 2024-01-03
Description: HCL DRYiCE MyXalytics is impacted by Improper Access Control (Obsolete web pages) vulnerability. Discovery of outdated and accessible web pages, reflects a "Missing Access Control" vulnerability, which could lead to inadvertent exposure of sensitive information and/or exposing a vulnerable endpoint.

CVSS Score: 7.6 (HIGH)
CWE: CWE-284
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109608; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109608
CVE: CVE-2023-50342
Published: 2024-01-03
Description: HCL DRYiCE MyXalytics is impacted by an Insecure Direct Object Reference (IDOR) vulnerability.  A user can obtain certain details about another user as a result of improper access control.

CVSS Score: 7.1 (HIGH)
CWE: CWE-639, CWE-639
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109608; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109608
CVE: CVE-2023-50343
Published: 2024-01-03
Description: HCL DRYiCE MyXalytics is impacted by an Improper Access Control (Controller APIs) vulnerability. Certain API endpoints are accessible to Customer Admin Users that can allow access to sensitive information about other users.

CVSS Score: 8.3 (HIGH)
CWE: CWE-284
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109608; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109608
CVE: CVE-2023-50344
Published: 2024-01-03
Description: HCL DRYiCE MyXalytics is impacted by improper access control (Unauthenticated File Download) vulnerability. An unauthenticated user can download certain files.

CVSS Score: 5.4 (MEDIUM)
CWE: CWE-284
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109608; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109608
CVE: CVE-2023-46308
Published: 2024-01-03
Description: In Plotly plotly.js before 2.25.2, plot API calls have a risk of __proto__ being polluted in expandObjectPaths or nestedProperty.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321, CWE-1321
References: https://github.com/plotly/plotly.R/issues/2463; https://github.com/plotly/plotly.js/releases/tag/v2.25.2; https://plotly.com/javascript/
CVE: CVE-2023-6629
Published: 2024-01-03
Description: The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘msg’ parameter in all versions up to, and including, 2.8.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE-2023-6621 appears to be a duplicate of this issue. CVE-2024-29128 appears to be a duplicate of this issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/Wizard/NewWizard.php#L396; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3012318%40post-smtp%2Ftrunk&old=3006604%40post-smtp%2Ftrunk&sfp_email=&sfph_mail=#file4; https://www.wordfence.com/threat-intel/vulnerabilities/id/7681f984-d488-4da7-afe1-988e5ad012f2?source=cve
CVE: CVE-2023-7027
Published: 2024-01-03
Description: The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘device’ header in all versions up to, and including, 2.8.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/Mobile/includes/rest-api/v1/rest-api.php#L79; https://plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/Mobile/mobile.php#L219; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3016126%40post-smtp%2Ftrunk&old=3012318%40post-smtp%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2023-42358
Published: 2024-01-03
Description: An issue was discovered in O-RAN Software Community ric-plt-e2mgr in the G-Release environment, allows remote attackers to cause a denial of service (DoS) via a crafted request to the E2Manager API component.
CVSS Score: 7.7 (HIGH)
CWE: CWE-862, CWE-400
References: https://jira.o-ran-sc.org/browse/RIC-1009; https://jira.o-ran-sc.org/browse/RIC-1009
CVE: CVE-2023-6524
Published: 2024-01-03
Description: The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the map title parameter in all versions up to and including 2.88.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor access or higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://advisory.abay.sh/cve-2023-6524; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3015598%40mappress-google-maps-for-wordpress%2Ftrunk&old=3001436%40mappress-google-maps-for-wordpress%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/28a8f025-c2ab-4a5f-a99e-a2d19b14a190?source=cve
CVE: CVE-2023-6600
Published: 2024-01-03
Description: The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to unauthorized modification of data and Stored Cross-Site Scripting due to a missing capability check on the update_settings() function hooked via admin_init in all versions up to, and including, 5.7.9. This makes it possible for unauthenticated attackers to update the plugin's settings which can be used to inject Cross-Site Scripting payloads and delete entire directories. PLease note there were several attempted patched, and we consider 5.7.10 to be the most sufficiently patched.
CVSS Score: 8.6 (HIGH)
CWE: CWE-862, CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3008876%40host-webfonts-local&new=3008876%40host-webfonts-local&sfp_email=&sfph_mail=; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3009010%40host-webfonts-local&new=3009010%40host-webfonts-local&sfp_email=&sfph_mail=; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3009453%40host-webfonts-local&new=3009453%40host-webfonts-local&sfp_email=&sfph_mail=
CVE: CVE-2023-6980
Published: 2024-01-03
Description: The WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.5. This is due to missing or incorrect nonce validation on the 'delete' action of the wp-sms-subscribers page. This makes it possible for unauthenticated attackers to delete subscribers via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/wp-sms/wp-sms/commit/0f36e2f521ade8ddfb3e04786defe074370afb50; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3015006%40wp-sms&new=3015006%40wp-sms&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/94ad6b51-ff8d-48d5-9a70-1781d13990a5?source=cve