deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-35676
Published: 2024-06-08
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in wpecommerce Recurring PayPal Donations allows Stored XSS.This issue affects Recurring PayPal Donations: from n/a through 1.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/recurring-donation/wordpress-recurring-paypal-donations-plugin-1-7-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/recurring-donation/wordpress-recurring-paypal-donations-plugin-1-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-35678
Published: 2024-06-08
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BestWebSoft Contact Form to DB by BestWebSoft.This issue affects Contact Form to DB by BestWebSoft: from n/a through 1.7.2.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/contact-form-to-db/wordpress-contact-form-to-db-by-bestwebsoft-plugin-1-7-2-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/contact-form-to-db/wordpress-contact-form-to-db-by-bestwebsoft-plugin-1-7-2-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-21748
Published: 2024-06-08
Description: Missing Authorization vulnerability in Icegram.This issue affects Icegram: from n/a through 3.1.21.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/icegram/wordpress-icegram-engage-plugin-3-1-20-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/icegram/wordpress-icegram-engage-plugin-3-1-20-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-22151
Published: 2024-06-08
Description: Missing Authorization vulnerability in Codection Import and export users and customers.This issue affects Import and export users and customers: from n/a through 1.24.6.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/import-users-from-csv-with-meta/wordpress-import-and-export-users-and-customers-plugin-1-24-6-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/import-users-from-csv-with-meta/wordpress-import-and-export-users-and-customers-plugin-1-24-6-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-4146
Published: 2024-06-08
Description: In lunary-ai/lunary version v1.2.13, an incorrect authorization vulnerability exists that allows unauthorized users to access and manipulate projects within an organization they should not have access to. Specifically, the vulnerability is located in the `checkProjectAccess` method within the authorization middleware, which fails to adequately verify if a user has the correct permissions to access a specific project. Instead, it only checks if the user is part of the organization owning the project, overlooking the necessary check against the `account_project` table for explicit project access rights. This flaw enables attackers to gain complete control over all resources within a project, including the ability to create, update, read, and delete any resource, compromising the privacy and security of sensitive information.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863, CWE-863
References: https://github.com/lunary-ai/lunary/commit/c43b6c62035f32ca455f66d5fd22ba661648cde7; https://huntr.com/bounties/a749e696-b398-4260-b2d0-b0054b9fffa7; https://github.com/lunary-ai/lunary/commit/c43b6c62035f32ca455f66d5fd22ba661648cde7
CVE: CVE-2024-4680
Published: 2024-06-08
Description: A vulnerability in zenml-io/zenml version 0.56.3 allows attackers to reuse old session credentials or session IDs due to insufficient session expiration. Specifically, the session does not expire after a password change, enabling an attacker to maintain access to a compromised account without the victim's ability to revoke this access. This issue was observed in a self-hosted ZenML deployment via Docker, where after changing the password from one browser, the session remained active and usable in another browser without requiring re-authentication.
CVSS Score: 8.8 (HIGH)
CWE: CWE-613
References: https://huntr.com/bounties/c88f6bd2-490d-4930-98dd-03651b20230a; https://huntr.com/bounties/c88f6bd2-490d-4930-98dd-03651b20230a
CVE: CVE-2024-5771
Published: 2024-06-08
Description: A vulnerability classified as critical was found in LabVantage LIMS 2017. This vulnerability affects unknown code of the file /labvantage/rc?command=page&page=SampleList&_iframename=list of the component POST Request Handler. The manipulation of the argument param1 leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-267454 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://gentle-khaan-c53.notion.site/Labvantage-LIMS-3bb2137a29944e7e9efc906f23b42a4a; https://vuldb.com/?ctiid.267454; https://vuldb.com/?id.267454
CVE: CVE-2024-5772
Published: 2024-06-09
Description: A vulnerability, which was classified as critical, has been found in Netentsec NS-ASG Application Security Gateway 6.3. This issue affects some unknown processing of the file /protocol/iscuser/deleteiscuser.php. The manipulation of the argument messagecontent leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-267455. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/charliecatsec/cve1/blob/main/NS-ASG-sql-deleteiscuser.md; https://vuldb.com/?ctiid.267455; https://vuldb.com/?id.267455
CVE: CVE-2024-5773
Published: 2024-06-09
Description: A vulnerability, which was classified as critical, was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected is an unknown function of the file /protocol/firewall/deletemacbind.php. The manipulation of the argument messagecontent leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-267456. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/L1OudFd8cl09/CVE/issues/3; https://vuldb.com/?ctiid.267456; https://vuldb.com/?id.267456
CVE: CVE-2024-5774
Published: 2024-06-09
Description: A vulnerability has been found in SourceCodester Stock Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file index.php of the component Login. The manipulation of the argument username/password leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-267457 was assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/CveSecLook/cve/issues/43; https://vuldb.com/?ctiid.267457; https://vuldb.com/?id.267457
CVE: CVE-2024-5775
Published: 2024-06-09
Description: A vulnerability was found in SourceCodester Vehicle Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file updatebill.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-267458 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/CveSecLook/cve/issues/44; https://vuldb.com/?ctiid.267458; https://vuldb.com/?id.267458
CVE: CVE-2023-51494
Published: 2024-06-09
Description: Missing Authorization vulnerability in Woo WooCommerce Product Vendors.This issue affects WooCommerce Product Vendors: from n/a through 2.2.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://patchstack.com/database/vulnerability/woocommerce-product-vendors/wordpress-woocommerce-product-vendors-plugin-2-2-1-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-product-vendors/wordpress-woocommerce-product-vendors-plugin-2-2-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2023-52230
Published: 2024-06-09
Description: Missing Authorization vulnerability in Pluggabl LLC Booster Plus for WooCommerce.This issue affects Booster Plus for WooCommerce: from n/a before 7.1.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/booster-plus-for-woocommerce/wordpress-booster-plus-for-woocommerce-plugin-7-1-3-authenticated-arbitrary-wordpress-option-disclosure-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/booster-plus-for-woocommerce/wordpress-booster-plus-for-woocommerce-plugin-7-1-3-authenticated-arbitrary-wordpress-option-disclosure-vulnerability?_s_id=cve
CVE: CVE-2023-52232
Published: 2024-06-09
Description: Missing Authorization vulnerability in Pluggabl LLC Booster Plus for WooCommerce.This issue affects Booster Plus for WooCommerce: from n/a before 7.1.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/booster-plus-for-woocommerce/wordpress-booster-plus-for-woocommerce-plugin-7-1-2-authenticated-arbitrary-post-page-deletion-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/booster-plus-for-woocommerce/wordpress-booster-plus-for-woocommerce-plugin-7-1-2-authenticated-arbitrary-post-page-deletion-vulnerability?_s_id=cve
CVE: CVE-2024-30534
Published: 2024-06-09
Description: Missing Authorization vulnerability in typps Calendarista Basic Edition calendarista-basic-edition.This issue affects Calendarista Basic Edition: from n/a through <= 3.0.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/calendarista-basic-edition/vulnerability/wordpress-calendarista-basic-edition-plugin-3-0-5-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/calendarista-basic-edition/wordpress-calendarista-basic-edition-plugin-3-0-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-30537
Published: 2024-06-09
Description: Missing Authorization vulnerability in WPClever WPC Badge Management for WooCommerce.This issue affects WPC Badge Management for WooCommerce: from n/a through 2.4.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/wpc-badge-management/wordpress-wpc-badge-management-for-woocommerce-plugin-2-4-0-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wpc-badge-management/wordpress-wpc-badge-management-for-woocommerce-plugin-2-4-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-30538
Published: 2024-06-09
Description: Missing Authorization vulnerability in DELUCKS GmbH DELUCKS SEO.This issue affects DELUCKS SEO: from n/a through 2.5.4.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/delucks-seo/wordpress-delucks-seo-plugin-2-5-4-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/delucks-seo/wordpress-delucks-seo-plugin-2-5-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-30539
Published: 2024-06-09
Description: Missing Authorization vulnerability in Awesome Support Team Awesome Support.This issue affects Awesome Support: from n/a through 6.1.7.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/awesome-support/wordpress-awesome-support-plugin-6-1-7-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/awesome-support/wordpress-awesome-support-plugin-6-1-7-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-31098
Published: 2024-06-09
Description: Missing Authorization vulnerability in Mr.Ebabi New Order Notification for Woocommerce.This issue affects New Order Notification for Woocommerce: from n/a through 2.0.2.
CVSS Score: 8.1 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/new-order-notification-for-woocommerce/wordpress-new-order-notification-for-woocommerce-plugin-2-0-2-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/new-order-notification-for-woocommerce/wordpress-new-order-notification-for-woocommerce-plugin-2-0-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-31246
Published: 2024-06-09
Description: Missing Authorization vulnerability in WPXPO PostX ultimate-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PostX: from n/a through <= 3.2.3.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/ultimate-post/vulnerability/wordpress-post-grid-gutenberg-blocks-and-wordpress-blog-plugin-postx-plugin-3-2-3-author-post-page-duplication-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ultimate-post/wordpress-post-grid-gutenberg-blocks-and-wordpress-blog-plugin-postx-plugin-3-2-3-author-post-page-duplication-vulnerability?_s_id=cve
CVE: CVE-2024-31294
Published: 2024-06-09
Description: Missing Authorization vulnerability in Fahad Mahmood WP Sort Order.This issue affects WP Sort Order: from n/a through 1.3.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/wp-sort-order/wordpress-wp-sort-order-plugin-1-3-1-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-sort-order/wordpress-wp-sort-order-plugin-1-3-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2023-23639
Published: 2024-06-09
Description: Missing Authorization vulnerability in MainWP MainWP Staging Extension.This issue affects MainWP Staging Extension: from n/a through 4.0.3.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://patchstack.com/database/vulnerability/mainwp-staging-extension/wordpress-mainwp-staging-extension-plugin-4-0-3-subscriber-arbitrary-plugin-activation-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/mainwp-staging-extension/wordpress-mainwp-staging-extension-plugin-4-0-3-subscriber-arbitrary-plugin-activation-vulnerability?_s_id=cve
CVE: CVE-2023-23640
Published: 2024-06-09
Description: Missing Authorization vulnerability in MainWP MainWP UpdraftPlus Extension.This issue affects MainWP UpdraftPlus Extension: from n/a through 4.0.6.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/mainwp-updraftplus-extension/wordpress-mainwp-updraftplus-extension-plugin-4-0-6-subscriber-arbitrary-plugin-activation-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/mainwp-updraftplus-extension/wordpress-mainwp-updraftplus-extension-plugin-4-0-6-subscriber-arbitrary-plugin-activation-vulnerability?_s_id=cve
CVE: CVE-2023-31080
Published: 2024-06-09
Description: Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates).This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 1.5.65.
CVSS Score: 8.3 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/unlimited-elements-for-elementor/wordpress-unlimited-elements-for-elementor-plugin-1-5-65-multiple-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/unlimited-elements-for-elementor/wordpress-unlimited-elements-for-elementor-plugin-1-5-65-multiple-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2023-34003
Published: 2024-06-09
Description: Missing Authorization vulnerability in Woo WooCommerce Box Office.This issue affects WooCommerce Box Office: from n/a through 1.1.51.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/woocommerce-box-office/wordpress-woocommerce-box-office-plugin-1-1-51-unauthenticated-save-ticket-barcode-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-box-office/wordpress-woocommerce-box-office-plugin-1-1-51-unauthenticated-save-ticket-barcode-vulnerability?_s_id=cve
CVE: CVE-2024-24716
Published: 2024-06-09
Description: Missing Authorization vulnerability in Awesome Support Team Awesome Support.This issue affects Awesome Support: from n/a through 6.1.6.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/awesome-support/wordpress-awesome-support-plugin-6-1-6-broken-access-control-vulnerability-3?_s_id=cve; https://patchstack.com/database/vulnerability/awesome-support/wordpress-awesome-support-plugin-6-1-6-broken-access-control-vulnerability-3?_s_id=cve
CVE: CVE-2024-25092
Published: 2024-06-09
Description: Missing Authorization vulnerability in XLPlugins NextMove Lite.This issue affects NextMove Lite: from n/a through 2.17.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862, CWE-862
References: https://patchstack.com/database/vulnerability/woo-thank-you-page-nextmove-lite/wordpress-nextmove-lite-plugin-2-17-0-subscriber-arbitrary-plugin-installation-activation-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woo-thank-you-page-nextmove-lite/wordpress-nextmove-lite-plugin-2-17-0-subscriber-arbitrary-plugin-installation-activation-vulnerability?_s_id=cve
CVE: CVE-2024-25929
Published: 2024-06-09
Description: Missing Authorization vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX.This issue affects Product Catalog Enquiry for WooCommerce by MultiVendorX: from n/a through 5.0.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/woocommerce-catalog-enquiry/wordpress-product-catalog-mode-for-woocommerce-plugin-5-0-5-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-catalog-enquiry/wordpress-product-catalog-mode-for-woocommerce-plugin-5-0-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-30464
Published: 2024-06-09
Description: Missing Authorization vulnerability in WPZOOM Social Icons Widget & Block by WPZOOM.This issue affects Social Icons Widget & Block by WPZOOM: from n/a through 4.2.15.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/social-icons-widget-by-wpzoom/wordpress-social-icons-widget-block-by-wpzoom-plugin-4-2-15-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/social-icons-widget-by-wpzoom/wordpress-social-icons-widget-block-by-wpzoom-plugin-4-2-15-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-30465
Published: 2024-06-09
Description: Missing Authorization vulnerability in Pagelayer Team PageLayer.This issue affects PageLayer: from n/a through 1.8.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/pagelayer/wordpress-pagelayer-plugin-1-8-1-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/pagelayer/wordpress-pagelayer-plugin-1-8-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-30466
Published: 2024-06-09
Description: Missing Authorization vulnerability in OnTheGoSystems WooCommerce Multilingual & Multicurrency.This issue affects WooCommerce Multilingual & Multicurrency: from n/a through 5.3.4.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/woocommerce-multilingual/wordpress-woocommerce-multilingual-multicurrency-plugin-5-3-4-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-multilingual/wordpress-woocommerce-multilingual-multicurrency-plugin-5-3-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-30467
Published: 2024-06-09
Description: Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg.This issue affects Essential Blocks for Gutenberg: from n/a through 4.4.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/essential-blocks/wordpress-essential-blocks-plugin-4-4-9-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/essential-blocks/wordpress-essential-blocks-plugin-4-4-9-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-30470
Published: 2024-06-09
Description: Missing Authorization vulnerability in YITH YITH WooCommerce Account Funds Premium.This issue affects YITH WooCommerce Account Funds Premium: from n/a through 1.33.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/yith-woocommerce-account-funds-premium/wordpress-yith-woocommerce-account-funds-premium-plugin-1-32-0-broken-access-control-leading-to-arbitrary-funds-adding-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/yith-woocommerce-account-funds-premium/wordpress-yith-woocommerce-account-funds-premium-plugin-1-32-0-broken-access-control-leading-to-arbitrary-funds-adding-vulnerability?_s_id=cve
CVE: CVE-2024-30481
Published: 2024-06-09
Description: Broken Access Control vulnerability in Samuel Marshall JCH Optimize.This issue affects JCH Optimize: from n/a through 4.0.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://patchstack.com/database/vulnerability/jch-optimize/wordpress-jch-optimize-plugin-4-0-0-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/jch-optimize/wordpress-jch-optimize-plugin-4-0-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-30485
Published: 2024-06-09
Description: Missing Authorization vulnerability in XLPlugins Finale Lite.This issue affects Finale Lite: from n/a through 2.18.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/finale-woocommerce-sales-countdown-timer-discount/wordpress-finale-lite-plugin-2-18-0-subscriber-arbitrary-plugin-installation-activation-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/finale-woocommerce-sales-countdown-timer-discount/wordpress-finale-lite-plugin-2-18-0-subscriber-arbitrary-plugin-installation-activation-vulnerability?_s_id=cve
CVE: CVE-2024-30512
Published: 2024-06-09
Description: Missing Authorization vulnerability in weForms.This issue affects weForms: from n/a through 1.6.20.
CVSS Score: 3.7 (LOW)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/weforms/wordpress-weforms-plugin-1-6-20-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/weforms/wordpress-weforms-plugin-1-6-20-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-30515
Published: 2024-06-09
Description: Missing Authorization vulnerability in Pixelite Events Manager.This issue affects Events Manager: from n/a through 6.4.6.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/events-manager/wordpress-events-manager-plugin-6-4-6-4-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/events-manager/wordpress-events-manager-plugin-6-4-6-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-30517
Published: 2024-06-09
Description: Missing Authorization vulnerability in Sliced Invoices.This issue affects Sliced Invoices: from n/a through 3.9.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/sliced-invoices/wordpress-sliced-invoices-plugin-3-9-2-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/sliced-invoices/wordpress-sliced-invoices-plugin-3-9-2-broken-access-control-vulnerability?_s_id=cve