deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-4107
Published: 2025-05-08
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-4440
Published: 2025-05-08
Description: A vulnerability was found in H3C GR-1800AX up to 100R008 and classified as critical. Affected by this issue is the function EnableIpv6 of the file /goform/aspForm. The manipulation of the argument param leads to buffer overflow. Access to the local network is required for this attack to succeed. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.0 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/CH13hh/tmp_store_cc/blob/main/H3C%20GR-1800AX/1.md; https://vuldb.com/?ctiid.308048; https://vuldb.com/?id.308048
CVE: CVE-2025-4441
Published: 2025-05-08
Description: A vulnerability was found in D-Link DIR-605L 2.13B01. It has been classified as critical. This affects the function formSetWAN_Wizard534. The manipulation of the argument curTime leads to buffer overflow. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/jylsec/vuldb/blob/main/D-Link/dlink_dir605l/Buffer_overflow-formSetWAN_Wizard534-curTime/README.md; https://vuldb.com/?ctiid.308049; https://vuldb.com/?id.308049
CVE: CVE-2025-4442
Published: 2025-05-09
Description: A vulnerability was found in D-Link DIR-605L 2.13B01. It has been declared as critical. This vulnerability affects the function formSetWAN_Wizard55. The manipulation of the argument curTime leads to buffer overflow. The attack can be initiated remotely. The vendor was contacted early about this disclosure. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/jylsec/vuldb/blob/main/D-Link/dlink_dir605l/Buffer_overflow-formSetWAN_Wizard55-curTime/README.md; https://vuldb.com/?ctiid.308050; https://vuldb.com/?id.308050
CVE: CVE-2025-4443
Published: 2025-05-09
Description: A vulnerability was found in D-Link DIR-605L 2.13B01. It has been rated as critical. This issue affects the function sub_454F2C. The manipulation of the argument sysCmd leads to command injection. The attack may be initiated remotely. The vendor was contacted early about this disclosure. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77, CWE-77
References: https://github.com/jylsec/vuldb/blob/main/D-Link/dlink_dir605l/Command_injection-sub_454F2C-sysCmd/README.md; https://vuldb.com/?ctiid.308051; https://vuldb.com/?id.308051
CVE: CVE-2025-4445
Published: 2025-05-09
Description: A vulnerability classified as critical has been found in D-Link DIR-605L 2.13B01. Affected is the function wake_on_lan. The manipulation of the argument mac leads to command injection. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77, CWE-77
References: https://github.com/jylsec/vuldb/blob/main/D-Link/dlink_dir605l/Command_injection-wake_on_lan-mac/README.md; https://vuldb.com/?ctiid.308052; https://vuldb.com/?id.308052
CVE: CVE-2025-4446
Published: 2025-05-09
Description: A vulnerability has been found in H3C GR-5400AX up to 100R008 and classified as critical. This vulnerability affects the function Edit_List_SSID of the file /goform/aspForm. The manipulation of the argument param leads to buffer overflow. The attack needs to be approached within the local network.
CVSS Score: 8.0 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/CH13hh/tmp_store_cc/blob/main/H3C%20GB5400AX/5.md; https://vuldb.com/?ctiid.308056; https://vuldb.com/?id.308056
CVE: CVE-2025-4448
Published: 2025-05-09
Description: A vulnerability classified as critical was found in D-Link DIR-619L 2.04B04. This vulnerability affects the function formEasySetupWizard. The manipulation of the argument curTime leads to buffer overflow. The attack can be initiated remotely. The vendor was contacted early about this disclosure. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/jylsec/vuldb/blob/main/D-Link/dlink_dir619l/Buffer_overflow-formEasySetupWizard-curTime/README.md; https://vuldb.com/?ctiid.308062; https://vuldb.com/?id.308062
CVE: CVE-2025-4449
Published: 2025-05-09
Description: A vulnerability, which was classified as critical, has been found in D-Link DIR-619L 2.04B04. This issue affects the function formEasySetupWizard3. The manipulation of the argument wan_connected leads to buffer overflow. The attack may be initiated remotely. The vendor was contacted early about this disclosure. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/jylsec/vuldb/blob/main/D-Link/dlink_dir619l/Buffer_overflow-formEasySetupWizard3-wan_connected/README.md; https://vuldb.com/?ctiid.308063; https://vuldb.com/?id.308063
CVE: CVE-2025-4450
Published: 2025-05-09
Description: A vulnerability, which was classified as critical, was found in D-Link DIR-619L 2.04B04. Affected is the function formSetEasy_Wizard. The manipulation of the argument curTime leads to buffer overflow. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/jylsec/vuldb/blob/main/D-Link/dlink_dir619l/Buffer_overflow-formSetEasy_Wizard-curTime/README.md; https://vuldb.com/?ctiid.308064; https://vuldb.com/?id.308064
CVE: CVE-2025-4451
Published: 2025-05-09
Description: A vulnerability has been found in D-Link DIR-619L 2.04B04 and classified as critical. Affected by this vulnerability is the function formSetWAN_Wizard52. The manipulation of the argument curTime leads to buffer overflow. The attack can be launched remotely. The vendor was contacted early about this disclosure. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/jylsec/vuldb/blob/main/D-Link/dlink_dir619l/Buffer_overflow-formSetWAN_Wizard52-curTime/README.md; https://vuldb.com/?ctiid.308065; https://vuldb.com/?id.308065
CVE: CVE-2025-4452
Published: 2025-05-09
Description: A vulnerability was found in D-Link DIR-619L 2.04B04 and classified as critical. Affected by this issue is the function formSetWizard2. The manipulation of the argument curTime leads to buffer overflow. The attack may be launched remotely. The vendor was contacted early about this disclosure. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/jylsec/vuldb/blob/main/D-Link/dlink_dir619l/Buffer_overflow-formSetWizard2-curTime/README.md; https://vuldb.com/?ctiid.308066; https://vuldb.com/?id.308066
CVE: CVE-2025-3810
Published: 2025-05-09
Description: The WPBookit plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.2. This is due to the plugin not properly validating a user's identity prior to updating their details like password and email through the edit_profile_data() function. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses and passwords, including administrators, and leverage that to gain access to their account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/changeset/3278939/wpbookit/trunk/core/admin/classes/controllers/class.wpb-profile-controller.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/54f1ebfb-67f1-461d-91f1-269b0a2c0653?source=cve
CVE: CVE-2025-3811
Published: 2025-05-09
Description: The WPBookit plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.2. This is due to the plugin not properly validating a user's identity prior to updating their details like email through the edit_newdata_customer_callback() function. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/changeset/3278939/wpbookit/trunk/core/admin/classes/controllers/class.wpb-customer-controller.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/a61cce43-0df7-4ca9-8897-24c7d131b505?source=cve
CVE: CVE-2025-4434
Published: 2025-05-09
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2025-4453
Published: 2025-05-09
Description: A vulnerability was found in D-Link DIR-619L 2.04B04. It has been classified as critical. This affects the function formSysCmd. The manipulation of the argument sysCmd leads to command injection. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77, CWE-77
References: https://github.com/jylsec/vuldb/blob/main/D-Link/dlink_dir619l/Command_injection-formSysCmd-sysCmd/README.md; https://vuldb.com/?ctiid.308067; https://vuldb.com/?id.308067
CVE: CVE-2025-4454
Published: 2025-05-09
Description: A vulnerability was found in D-Link DIR-619L 2.04B04. It has been declared as critical. This vulnerability affects the function wake_on_lan. The manipulation of the argument mac leads to command injection. The attack can be initiated remotely. The vendor was contacted early about this disclosure. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77, CWE-77
References: https://github.com/jylsec/vuldb/blob/main/D-Link/dlink_dir619l/Command_injection-wake_on_lan-mac/README.md; https://vuldb.com/?ctiid.308068; https://vuldb.com/?id.308068
CVE: CVE-2025-4455
Published: 2025-05-09
Description: A vulnerability was found in Patch My PC Home Updater up to 5.1.3.0. It has been rated as critical. This issue affects some unknown processing in the library advapi32.dll/BCrypt.dll/comctl32.dll/crypt32.dll/dwmapi.dll/gdi32.dll/gdiplus.dll/imm32.dll/iphlpapi.dll/kernel32.dll/mscms.dll/msctf.dll/ntdll.dll/ole32.dll/oleaut32.dll/PresentationNative_cor3.dll/secur32.dll/shcore.dll/shell32.dll/sspicli.dll/System.IO. The manipulation leads to uncontrolled search path. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.0 (HIGH)
CWE: CWE-426, CWE-427
References: https://gist.github.com/shellkraft/d7db265b53115d52a4ca5bffe5e9c6e4; https://vuldb.com/?ctiid.308069; https://vuldb.com/?id.308069
CVE: CVE-2025-3710
Published: 2025-05-09
Description: The LCD KVM over IP Switch CL5708IM has a Stack-based Buffer Overflow vulnerability in firmware versions prior to v2.2.215, allowing unauthenticated remote attackers to exploit this vulnerability to execute arbitrary code on the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://www.twcert.org.tw/en/cp-139-10103-32121-2.html; https://www.twcert.org.tw/tw/cp-132-10095-a0f57-1.html
CVE: CVE-2025-3711
Published: 2025-05-09
Description: The LCD KVM over IP Switch CL5708IM has a Stack-based Buffer Overflow vulnerability in firmware versions prior to v2.2.215, allowing unauthenticated remote attackers to exploit this vulnerability to execute arbitrary code on the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://www.twcert.org.tw/en/cp-139-10104-63bf4-2.html; https://www.twcert.org.tw/tw/cp-132-10096-60a81-1.html
CVE: CVE-2025-3712
Published: 2025-05-09
Description: The LCD KVM over IP Switch CL5708IM has a Heap-based Buffer Overflow vulnerability in firmware versions prior to v2.2.215, allowing unauthenticated remote attackers to exploit this vulnerability to perform a denial-of-service attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-122
References: https://www.twcert.org.tw/en/cp-139-10105-1e8b5-2.html; https://www.twcert.org.tw/tw/cp-132-10097-326fa-1.html
CVE: CVE-2025-3713
Published: 2025-05-09
Description: The LCD KVM over IP Switch CL5708IM has a Heap-based Buffer Overflow vulnerability in firmware versions prior to v2.2.215, allowing unauthenticated remote attackers to exploit this vulnerability to perform a denial-of-service attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-122
References: https://www.twcert.org.tw/en/cp-139-10106-9080f-2.html; https://www.twcert.org.tw/tw/cp-132-10098-1a66d-1.html
CVE: CVE-2025-3714
Published: 2025-05-09
Description: The LCD KVM over IP Switch CL5708IM has a Stack-based Buffer Overflow vulnerability in firmware versions prior to v2.2.215, allowing unauthenticated remote attackers to exploit this vulnerability to execute arbitrary code on the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://www.twcert.org.tw/en/cp-139-10107-26b24-2.html; https://www.twcert.org.tw/tw/cp-132-10099-0ad69-1.html
CVE: CVE-2025-4456
Published: 2025-05-09
Description: A vulnerability classified as critical has been found in Project Worlds Car Rental Project 1.0. Affected is an unknown function of the file /signup.php. The manipulation of the argument fname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/[PII_REDACTED]/myCVE/issues/7; https://vuldb.com/?ctiid.308070; https://vuldb.com/?id.308070
CVE: CVE-2025-4457
Published: 2025-05-09
Description: A vulnerability classified as critical was found in Project Worlds Car Rental Project 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/approve.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/[PII_REDACTED]/myCVE/issues/8; https://vuldb.com/?ctiid.308071; https://vuldb.com/?id.308071
CVE: CVE-2025-4458
Published: 2025-05-09
Description: A vulnerability was found in code-projects Patient Record Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /edit_upatient.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/ABC-YOLO/cve/blob/main/cve2.md; https://vuldb.com/?ctiid.308077
CVE: CVE-2025-4459
Published: 2025-05-09
Description: A vulnerability was found in code-projects Patient Record Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file fecalysis_form.php. The manipulation of the argument itr_no leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/ABC-YOLO/cve/blob/main/cve3.md; https://vuldb.com/?ctiid.308078
CVE: CVE-2025-4460
Published: 2025-05-09
Description: A vulnerability classified as problematic has been found in TOTOLINK N150RT 3.4.0-B20190525. This affects an unknown part of the component URL Filtering Page. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/N150RT/XSS_Url_filering; https://vuldb.com/?ctiid.308079; https://vuldb.com/?id.308079
CVE: CVE-2025-47735
Published: 2025-05-09
Description: inner::drop in inner.rs in the wgp crate through 0.2.0 for Rust lacks drop_slow thread synchronization.
CVSS Score: 2.9 (LOW)
CWE: CWE-362
References: https://crates.io/crates/wgp; https://github.com/Nugine/wgp/issues/1; https://github.com/Nugine/wgp/issues/1
CVE: CVE-2025-47736
Published: 2025-05-09
Description: dialect/mod.rs in the libsql-sqlite3-parser crate through 0.13.0 before 14f422a for Rust can crash if the input is not valid UTF-8.
CVSS Score: 2.9 (LOW)
CWE: CWE-228
References: https://crates.io/crates/libsql-sqlite3-parser; https://github.com/gwenn/lemon-rs/issues/86; https://github.com/gwenn/lemon-rs/pull/8
CVE: CVE-2025-47737
Published: 2025-05-09
Description: lib.rs in the trailer crate through 0.1.2 for Rust mishandles allocating with a size of zero.
CVSS Score: 2.9 (LOW)
CWE: CWE-762
References: https://crates.io/crates/trailer; https://github.com/Geal/trailer/issues/2; https://github.com/Geal/trailer/issues/2
CVE: CVE-2025-4461
Published: 2025-05-09
Description: A vulnerability classified as problematic was found in TOTOLINK N150RT 3.4.0-B20190525. This vulnerability affects unknown code of the component Virtual Server Page. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/N150RT/XSS_Virtual_Server; https://vuldb.com/?ctiid.308080; https://vuldb.com/?id.308080
CVE: CVE-2025-4462
Published: 2025-05-09
Description: A vulnerability, which was classified as critical, has been found in TOTOLINK N150RT 3.4.0-B20190525. This issue affects some unknown processing of the file /boafrm/formWsc. The manipulation of the argument localPin leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/N150RT/BufferOverflow_formWsc_2; https://vuldb.com/?ctiid.308081; https://vuldb.com/?id.308081
CVE: CVE-2025-4463
Published: 2025-05-09
Description: A vulnerability, which was classified as critical, was found in itsourcecode Gym Management System 1.0. Affected is an unknown function of the file /ajax.php?action=save_package. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/a25962208/cve/issues/1; https://itsourcecode.com/; https://vuldb.com/?ctiid.308082
CVE: CVE-2025-3462
Published: 2025-05-09
Description: "This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation in ASUS DriverHub may allow unauthorized sources to interact with the software's features via crafted HTTP requests.
Refer to the 'Security Update for ASUS DriverHub' section on the ASUS Security Advisory for more information.
CWE: CWE-346
References: https://www.asus.com/content/asus-product-security-advisory/; https://mrbruh.com/asusdriverhub/
CVE: CVE-2025-3463
Published: 2025-05-09
Description: "This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation vulnerability in ASUS DriverHub may allow untrusted sources to affect system behavior via crafted HTTP requests.
Refer to the 'Security Update for ASUS DriverHub' section on the ASUS Security Advisory for more information.
CWE: CWE-295
References: https://www.asus.com/content/asus-product-security-advisory/; https://mrbruh.com/asusdriverhub/
CVE: CVE-2025-4375
Published: 2025-05-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Sparx Systems Pro Cloud Server allows Cross-Site Request Forgery to perform Session Hijacking. Cross-Site Request Forgery is present at the whole application but it can be used to change the Pro Cloud Server Configuration password. 
This issue affects Pro Cloud Server: earlier than 6.0.165.
CWE: CWE-352
References: https://sparxsystems.com/products/procloudserver/6.1/
CVE: CVE-2025-4376
Published: 2025-05-09
Description: Improper Input Validation vulnerability in Sparx Systems Pro Cloud Server's WebEA model search field allows Cross-Site Scripting (XSS). 
This issue affects Pro Cloud Server: earlier than 6.0.165.
CWE: CWE-20
References: https://sparxsystems.com/products/procloudserver/6.1/
CVE: CVE-2025-4377
Published: 2025-05-09
Description: Improper Limitation of a Pathname caused a Path Traversal vulnerability in Sparx Systems Pro Cloud Server.

This vulnerability is present in logview.php and it allows reading arbitrary files on the filesystem. 

Logview is accessible on Pro Cloud Server Configuration interface. 


This issue affects Pro Cloud Server: earlier than 6.0.165.
CWE: CWE-20, CWE-22
References: https://sparxsystems.com/products/procloudserver/6.1/
CVE: CVE-2025-4464
Published: 2025-05-09
Description: A vulnerability has been found in itsourcecode Gym Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=save_plan. The manipulation of the argument plan leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/a25962208/cve/issues/2; https://itsourcecode.com/; https://vuldb.com/?ctiid.308083
CVE: CVE-2025-4465
Published: 2025-05-09
Description: A vulnerability was found in itsourcecode Gym Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /ajax.php?action=save_schedule. The manipulation of the argument member_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/TEhS411/cve/issues/3; https://itsourcecode.com/; https://vuldb.com/?ctiid.308084
CVE: CVE-2025-4466
Published: 2025-05-09
Description: A vulnerability was found in itsourcecode Gym Management System 1.0. It has been classified as critical. This affects an unknown part of the file /ajax.php?action=save_payment. The manipulation of the argument registration_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/TEhS411/cve/issues/4; https://itsourcecode.com/; https://vuldb.com/?ctiid.308085
CVE: CVE-2024-11617
Published: 2025-05-09
Description: The Envolve Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'zetra_languageUpload' and 'zetra_fontsUpload' functions in all versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://themeforest.net/item/envolve-consulting-business-wordpress-theme/28748459; https://www.wordfence.com/threat-intel/vulnerabilities/id/d0ad02d9-546f-4bcb-b567-785e3acfb489?source=cve