deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-10958
Published: 2024-11-10
Description: The The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution via getshortcodedrenderedfenodelay AJAX action in all versions up to, and including, 8.8.08.007 . This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVSS Score: 7.3 (HIGH)
CWE: CWE-94
References: https://plugins.trac.wordpress.org/browser/wp-photo-album-plus/tags/8.8.08.004/wppa-ajax.php#L1238; https://plugins.trac.wordpress.org/changeset/3184852/; https://wordpress.org/plugins/wp-photo-album-plus/#developers
CVE: CVE-2024-11055
Published: 2024-11-10
Description: A vulnerability, which was classified as critical, has been found in 1000 Projects Beauty Parlour Management System 1.0. This issue affects some unknown processing of the file /admin/admin-profile.php. The manipulation of the argument adminname leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://1000projects.org/; https://github.com/Hacker0xone/CVE/issues/3; https://vuldb.com/?ctiid.283799
CVE: CVE-2024-11056
Published: 2024-11-10
Description: A vulnerability, which was classified as critical, was found in Tenda AC10 16.03.10.13. Affected is the function FUN_0046AC38 of the file /goform/WifiExtraSet. The manipulation of the argument wpapsk_crypto leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://tasty-foxtrot-3a8.notion.site/Tenda-AC10v4-stack-overflow-1380448e619580409bb1e1ac85f45570; https://vuldb.com/?ctiid.283800; https://vuldb.com/?id.283800
CVE: CVE-2024-11057
Published: 2024-11-10
Description: A vulnerability has been found in Codezips Hospital Appointment System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /removeBranchResult.php. The manipulation of the argument ID/Name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Hacker0xone/CVE/issues/4; https://vuldb.com/?ctiid.283801; https://vuldb.com/?id.283801
CVE: CVE-2024-46613
Published: 2024-11-10
Description: WeeChat before 4.4.2 has an integer overflow and resultant buffer overflow at core/core-string.c when there are more than two billion items in a list. This affects string_free_split_shared , string_free_split, string_free_split_command, and string_free_split_tags.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190, CWE-190
References: https://github.com/weechat/weechat/issues/2178; https://weechat.org/doc/weechat/security/WSA-2024-1/
CVE: CVE-2024-46951
Published: 2024-11-10
Description: An issue was discovered in psi/zcolor.c in Artifex Ghostscript before 10.04.0. An unchecked Implementation pointer in Pattern color space could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-824, CWE-824
References: https://bugs.ghostscript.com/show_bug.cgi?id=707991; https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=f49812186baa7d[PII_REDACTED]08a6fbe8719b4f8; https://github.com/ArtifexSoftware/ghostpdl/blob/master/doc/News.html
CVE: CVE-2024-46952
Published: 2024-11-10
Description: An issue was discovered in pdf/pdf_xref.c in Artifex Ghostscript before 10.04.0. There is a buffer overflow during handling of a PDF XRef stream (related to W array values).
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://bugs.ghostscript.com/show_bug.cgi?id=708001; https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=b1f0827c30f59a2dcbc8a39e42cace7a1de35f7f; https://github.com/ArtifexSoftware/ghostpdl/blob/master/doc/News.html
CVE: CVE-2024-46953
Published: 2024-11-10
Description: An issue was discovered in base/gsdevice.c in Artifex Ghostscript before 10.04.0. An integer overflow when parsing the filename format string (for the output filename) results in path truncation, and possible path traversal and code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-190
References: https://bugs.ghostscript.com/show_bug.cgi?id=707793; https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=1f21a45df0fa3abec4cff12951022b192dda3c00; https://github.com/ArtifexSoftware/ghostpdl/blob/master/doc/News.html
CVE: CVE-2024-46954
Published: 2024-11-10
Description: An issue was discovered in decode_utf8 in base/gp_utf8.c in Artifex Ghostscript before 10.04.0. Overlong UTF-8 encoding leads to possible ../ directory traversal.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22, CWE-22
References: https://bugs.ghostscript.com/show_bug.cgi?id=707788; https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=55f587dd039282316f512e1bea64218fd991f934; https://github.com/ArtifexSoftware/ghostpdl/blob/master/doc/News.html
CVE: CVE-2024-46955
Published: 2024-11-10
Description: An issue was discovered in psi/zcolor.c in Artifex Ghostscript before 10.04.0. There is an out-of-bounds read when reading color in Indexed color space.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://bugs.ghostscript.com/show_bug.cgi?id=707990; https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=85bd9d2f4b792fe67aef22f1a[PII_REDACTED]b8ba6; https://github.com/ArtifexSoftware/ghostpdl/blob/master/doc/News.html
CVE: CVE-2024-46956
Published: 2024-11-10
Description: An issue was discovered in psi/zfile.c in Artifex Ghostscript before 10.04.0. Out-of-bounds data access in filenameforall can lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://bugs.ghostscript.com/show_bug.cgi?id=707895; https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=f4151f12db32cd3ed26c24327de714bf2c3ed6ca; https://github.com/ArtifexSoftware/ghostpdl/blob/master/doc/News.html
CVE: CVE-2020-10367
Published: 2024-11-10
Description: Certain Cypress (and Broadcom) Wireless Combo chips, when a January 2021 firmware update is not present, allow memory access via a "Spectra" attack.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-203
References: https://bugzilla.redhat.com/show_bug.cgi?id=2052676; https://github.com/RPi-Distro/bluez-firmware/commit/8445a53ce2c51a77472b908a0c8f6f8e1fa5c37a; https://www.informatik.tu-darmstadt.de/fb20/aktuelles_fb20/fb20_neuigkeiten/neuigkeiten_fb20_details_203136.de.jsp
CVE: CVE-2020-10368
Published: 2024-11-10
Description: Certain Cypress (and Broadcom) Wireless Combo chips, when a January 2021 firmware update is not present, allow memory read access via a "Spectra" attack.
CVSS Score: 3.5 (LOW)
CWE: CWE-922
References: https://bugzilla.redhat.com/show_bug.cgi?id=2052676; https://github.com/RPi-Distro/bluez-firmware/commit/8445a53ce2c51a77472b908a0c8f6f8e1fa5c37a; https://www.informatik.tu-darmstadt.de/fb20/aktuelles_fb20/fb20_neuigkeiten/neuigkeiten_fb20_details_203136.de.jsp
CVE: CVE-2020-10369
Published: 2024-11-10
Description: Certain Cypress (and Broadcom) Wireless Combo chips, when a January 2021 firmware update is not present, allow inferences about memory content via a "Spectra" attack.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-203
References: https://bugzilla.redhat.com/show_bug.cgi?id=2052676; https://github.com/RPi-Distro/bluez-firmware/commit/8445a53ce2c51a77472b908a0c8f6f8e1fa5c37a; https://www.informatik.tu-darmstadt.de/fb20/aktuelles_fb20/fb20_neuigkeiten/neuigkeiten_fb20_details_203136.de.jsp
CVE: CVE-2021-35473
Published: 2024-11-10
Description: An issue was discovered in LemonLDAP::NG before 2.0.12. There is a missing expiration check in the OAuth2.0 handler, i.e., it does not verify access token validity. An attacker can use a expired access token from an OIDC client to access the OAuth2 handler The earliest affected version is 2.0.4.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-613
References: https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2549; https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/tags
CVE: CVE-2021-41737
Published: 2024-11-10
Description: In Faust 2.23.1, an input file with the lines "// r visualisation tCst" and "//process = +: L: abM-^Q;" and "process = route[PII_REDACTED]333333333,2,1,2,3,1) : *;" leads to stack consumption.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: https://github.com/grame-cncm/faust/issues/653; https://github.com/grame-cncm/faust/tree/e682dbeeb7cc0ec9a1fcb6872f53433e454aa233
CVE: CVE-2024-11058
Published: 2024-11-10
Description: A vulnerability was found in CodeAstro Real Estate Management System up to 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /aboutedit.php of the component About Us Page. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://codeastro.com/; https://github.com/EmilGallajov/zero-day/blob/main/codeastro_real_estate_ms_sqli.md; https://vuldb.com/?ctiid.283804
CVE: CVE-2020-10370
Published: 2024-11-11
Description: Certain Cypress (and Broadcom) Wireless Combo chips such as CYW43455, when a 2021-01-26 Bluetooth firmware update is not present, allow a Bluetooth outage via a "Spectra" attack.
CVSS Score: 8.8 (HIGH)
References: https://bugzilla.redhat.com/show_bug.cgi?id=2052676; https://github.com/RPi-Distro/bluez-firmware/commit/8445a53ce2c51a77472b908a0c8f6f8e1fa5c37a; https://security-tracker.debian.org/tracker/CVE-2020-10370
CVE: CVE-2023-40457
Published: 2024-11-11
Description: The BGP daemon in Extreme Networks ExtremeXOS (aka EXOS) 30.7.1.1 allows an attacker (who is not on a directly connected network) to cause a denial of service (BGP session reset) because of BGP attribute error mishandling (for attribute 21 and 25). NOTE: the vendor disputes this because it is "evaluating support for RFC 7606 as a future feature" and believes that "customers that have chosen to not require or implement RFC 7606 have done so willingly and with knowledge of what is needed to defend against these types of attacks."
CWE: CWE-209
References: https://blog.benjojo.co.uk/asset/JgH8G5duO1; https://blog.benjojo.co.uk/post/bgp-path-attributes-grave-error-handling; https://supportdocs.extremenetworks.com/support/documentation/extremexos-32-5/
CVE: CVE-2024-11059
Published: 2024-11-11
Description: A vulnerability was found in Project Worlds Free Download Online Shopping System up to 192.168.1.88. It has been rated as critical. This issue affects some unknown processing of the file /online-shopping-webvsite-in-php-master/success.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Sy0ung-cmd/Cve-report/blob/main/SQLi-1.md; https://vuldb.com/?ctiid.283805; https://vuldb.com/?id.283805
CVE: CVE-2024-11060
Published: 2024-11-11
Description: A vulnerability classified as critical has been found in Jinher Network Collaborative Management Platform 金和数字化智能办公平台 1.0. Affected is an unknown function of the file /C6/JHSoft.Web.AcceptAip/AcceptShow.aspx/. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/Sy0ung/CVE/blob/main/verdors/JinherNetwork/Jinher-OA-System/SQLi-1.md; https://vuldb.com/?ctiid.283806; https://vuldb.com/?id.283806
CVE: CVE-2024-11061
Published: 2024-11-11
Description: A vulnerability classified as critical was found in Tenda AC10 16.03.10.13. Affected by this vulnerability is the function FUN_0044db3c of the file /goform/fast_setting_wifi_set. The manipulation of the argument timeZone leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://tasty-foxtrot-3a8.notion.site/Tenda-AC10v4-FUN_0044db3c-stack-overflow-13a0448e619580ae96fee2899545e159; https://vuldb.com/?ctiid.283807; https://vuldb.com/?id.283807
CVE: CVE-2024-41992
Published: 2024-11-11
Description: Wi-Fi Alliance wfa_dut (in Wi-Fi Test Suite) through 9.0.0 allows OS command injection via 802.11x frames because the system() library function is used. For example, on Arcadyan FMIMG51AX000J devices, this leads to wfaTGSendPing remote code execution as root via traffic to TCP port 8000 or 8080 on a LAN interface. On other devices, this may be exploitable over a WAN interface.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://ssd-disclosure.com/ssd-advisory-arcadyan-fmimg51ax000j-wifi-alliance-rce/; https://www.kb.cert.org/vuls/id/123336
CVE: CVE-2024-48939
Published: 2024-11-11
Description: Insufficient validation performed on the REST API License file in Paxton Net2 before 6.07.14023.5015 (SR4) enables use of the REST API with an invalid License File. Attackers may be able to retrieve access-log data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-922
References: https://github.com/gitaware/CVE/blob/main/CVE-2024-48939/20241020_vuln_discl_paxton_API_license.pdf; https://paxton-access.co.uk; https://seclists.org/fulldisclosure/2024/Oct/3
CVE: CVE-2024-38826
Published: 2024-11-11
Description: Authenticated users can upload specifically crafted files to leak server resources. This behavior can potentially be used to run a denial of service attack against Cloud Controller.

The Cloud Foundry project recommends upgrading the following releases:

  *  Upgrade capi release version to 1.194.0 or greater
  *  Upgrade cf-deployment version to v44.1.0 or greater. This includes a patched capi release
CWE: CWE-400
References: https://www.cloudfoundry.org/blog/cve-2024-38826-cloud-controller-denial-of-service-attack/
CVE: CVE-2024-51571
Published: 2024-11-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in masterbip MasterBip para Elementor masterbip-for-elementor allows DOM-Based XSS.This issue affects MasterBip para Elementor: from n/a through <= 1.6.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/masterbip-for-elementor/vulnerability/wordpress-masterbip-para-elementor-plugin-1-6-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-51572
Published: 2024-11-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shawfactor LH QR Codes lh-qr-codes allows Stored XSS.This issue affects LH QR Codes: from n/a through <= 1.06.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/lh-qr-codes/vulnerability/wordpress-lh-qr-codes-plugin-1-06-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-51573
Published: 2024-11-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ersatzpole ML Responsive Audio player with playlist Shortcode mlr-audio allows Stored XSS.This issue affects ML Responsive Audio player with playlist Shortcode: from n/a through <= 0.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/mlr-audio/vulnerability/wordpress-ml-responsive-audio-plugin-0-2-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-51574
Published: 2024-11-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simple Goods Simple Goods simple-goods allows Stored XSS.This issue affects Simple Goods: from n/a through <= 0.1.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/simple-goods/vulnerability/wordpress-simple-goods-plugin-0-1-3-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-51575
Published: 2024-11-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Md. Abdullah Al Masum Extender All In One For Elementor extender-all-in-one-for-elementor allows Stored XSS.This issue affects Extender All In One For Elementor: from n/a through <= 1.0.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/extender-all-in-one-for-elementor/vulnerability/wordpress-extender-all-in-one-for-elementor-plugin-1-0-3-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-51788
Published: 2024-11-11
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Joshua Wolfe The Novel Design Store Directory noveldesign-store-directory allows Upload a Web Shell to a Web Server.This issue affects The Novel Design Store Directory: from n/a through <= 4.3.0.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/noveldesign-store-directory/vulnerability/wordpress-the-novel-design-store-directory-plugin-4-3-0-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-51789
Published: 2024-11-11
Description: Unrestricted Upload of File with Dangerous Type vulnerability in UjW0L Image Classify image-classify allows Upload a Web Shell to a Web Server.This issue affects Image Classify: from n/a through <= 1.0.0.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/image-classify/vulnerability/wordpress-image-classify-plugin-1-0-0-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-51790
Published: 2024-11-11
Description: Unrestricted Upload of File with Dangerous Type vulnerability in HB WEBSOL HB AUDIO GALLERY hb-audio-gallery allows Upload a Web Shell to a Web Server.This issue affects HB AUDIO GALLERY: from n/a through <= 3.0.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/hb-audio-gallery/vulnerability/wordpress-hb-audio-gallery-plugin-3-0-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-51791
Published: 2024-11-11
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Made I.T. Forms forms-by-made-it allows Upload a Web Shell to a Web Server.This issue affects Forms: from n/a through <= 2.8.0.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/forms-by-made-it/vulnerability/wordpress-forms-plugin-2-8-0-arbitrary-file-upload-vulnerability?_s_id=cve; https://github.com/JoshuaProvoste/0-click-RCE-Exploit-for-CVE-2024-51791
CVE: CVE-2024-51792
Published: 2024-11-11
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Dang Ngoc Binh Audio Record audio-record allows Upload a Web Shell to a Web Server.This issue affects Audio Record: from n/a through <= 1.0.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/audio-record/vulnerability/wordpress-audio-record-plugin-1-0-arbitrary-file-upload-vulnerability-2?_s_id=cve
CVE: CVE-2024-51793
Published: 2024-11-11
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Ateeq Rafeeq RepairBuddy computer-repair-shop allows Upload a Web Shell to a Web Server.This issue affects RepairBuddy: from n/a through <= 3.8115.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/computer-repair-shop/vulnerability/wordpress-repairbuddy-plugin-3-8115-arbitrary-file-upload-vulnerability?_s_id=cve; https://github.com/JoshuaProvoste/0-click-RCE-Exploit-for-CVE-2024-51793
CVE: CVE-2024-51820
Published: 2024-11-11
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wplsquared L Squared Hub WP l-squared-hub-wp-virtual-device allows SQL Injection.This issue affects L Squared Hub WP: from n/a through <= 1.0.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/l-squared-hub-wp-virtual-device/vulnerability/wordpress-l-squared-hub-wp-plugin-1-0-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-51837
Published: 2024-11-11
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sophia M Williams WP Contest wp-contest allows SQL Injection.This issue affects WP Contest: from n/a through <= 1.0.0.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/wp-contest/vulnerability/wordpress-wp-contest-plugin-1-0-0-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-51843
Published: 2024-11-11
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in fruitcakestudios Horsemanager fruitcake-horsemanager allows Blind SQL Injection.This issue affects Horsemanager: from n/a through <= 1.3.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/fruitcake-horsemanager/vulnerability/wordpress-horsemanager-plugin-1-3-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-51845
Published: 2024-11-11
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in richteam Share Buttons – Social Media rich-web-share-button allows Blind SQL Injection.This issue affects Share Buttons – Social Media: from n/a through <= 1.0.2.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/rich-web-share-button/vulnerability/wordpress-share-buttons-social-media-plugin-1-0-2-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-51882
Published: 2024-11-11
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopalkumar315 Gboy Custom Google Map gboy-custom-google-map allows Blind SQL Injection.This issue affects Gboy Custom Google Map: from n/a through <= 1.2.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/gboy-custom-google-map/vulnerability/wordpress-gboy-custom-google-map-plugin-1-2-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-52356
Published: 2024-11-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webangon The Pack Elementor addons the-pack-addon allows Stored XSS.This issue affects The Pack Elementor addons: from n/a through <= 2.1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/the-pack-addon/vulnerability/wordpress-the-pack-elementor-addons-plugin-2-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52357
Published: 2024-11-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lqd LIQUID BLOCKS liquid-blocks allows Stored XSS.This issue affects LIQUID BLOCKS: from n/a through <= 1.2.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/liquid-blocks/vulnerability/wordpress-liquid-blocks-plugin-1-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52358
Published: 2024-11-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberChimps Responsive Addons for Elementor responsive-addons-for-elementor allows DOM-Based XSS.This issue affects Responsive Addons for Elementor: from n/a through <= 1.5.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/responsive-addons-for-elementor/vulnerability/wordpress-responsive-addons-for-elementor-plugin-1-5-4-cross-site-scripting-xss-vulnerability?_s_id=cve