deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-44091
Published: 2024-03-19
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows SQL Injection. This ulnerability allowed SQL injections to be made even if authentication failed.This issue affects Pandora FMS: from 700 through <776.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/; https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE: CVE-2023-44092
Published: 2024-03-19
Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Pandora FMS on all allows OS Command Injection. This vulnerability allowed to create a reverse shell and execute commands in the OS. This issue affects Pandora FMS: from 700 through <776.
CVSS Score: 7.6 (HIGH)
CWE: CWE-78
References: https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/; https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE: CVE-2023-4426
Published: 2024-03-19
Description: Rejected reason: **REJECT** Not a valid security issue - vendor unable to replicate.
CVE: CVE-2024-21677
Published: 2024-03-19
Description: This High severity Path Traversal vulnerability was introduced in version 6.13.0 of Confluence Data Center. This Path Traversal vulnerability, with a CVSS Score of 8.3, allows an unauthenticated attacker to exploit an undefinable vulnerability which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction.

Atlassian recommends that Confluence Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Data Center Atlassian recommends that Confluence Data Center customers upgrade to the latest version and that Confluence Server customers upgrade to the latest 8.5.x LTS version.

If you are unable to do so, upgrade your instance to one of the specified supported fixed versions See the release notes https://confluence.atlassian.com/doc/confluence-release-notes-327.html

You can download the latest version of Confluence Data Center and Server from the download center https://www.atlassian.com/software/confluence/download-archives. 

This vulnerability was reported via our Bug Bounty program.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-22
References: https://confluence.atlassian.com/pages/viewpage.action?pageId=[PII_REDACTED]; https://jira.atlassian.com/browse/CONFSERVER-94604; https://confluence.atlassian.com/pages/viewpage.action?pageId=[PII_REDACTED]
CVE: CVE-2024-27996
Published: 2024-03-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Survey Maker team Survey Maker allows Stored XSS.This issue affects Survey Maker: from n/a through 4.0.5.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/survey-maker/wordpress-survey-maker-plugin-4-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/survey-maker/wordpress-survey-maker-plugin-4-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-27997
Published: 2024-03-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visual Composer Visual Composer Website Builder visualcomposer.This issue affects Visual Composer Website Builder: from n/a through <= 45.6.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/visualcomposer/vulnerability/wordpress-visual-composer-website-builder-landing-page-builder-custom-theme-builder-maintenance-mode-coming-soon-pages-plugin-45-6-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/visualcomposer/wordpress-visual-composer-website-builder-landing-page-builder-custom-theme-builder-maintenance-mode-coming-soon-pages-plugin-45-6-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-27998
Published: 2024-03-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through <= 1.5.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/barcode-scanner-lite-pos-to-manage-products-inventory-and-orders/vulnerability/wordpress-barcode-scanner-and-inventory-manager-plugin-1-5-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/barcode-scanner-lite-pos-to-manage-products-inventory-and-orders/wordpress-barcode-scanner-and-inventory-manager-plugin-1-5-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-29089
Published: 2024-03-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Five Star Plugins Five Star Restaurant Menu allows Stored XSS.This issue affects Five Star Restaurant Menu: from n/a through 2.4.14.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/food-and-drink-menu/wordpress-restaurant-menu-and-food-ordering-plugin-2-4-14-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/food-and-drink-menu/wordpress-restaurant-menu-and-food-ordering-plugin-2-4-14-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-29091
Published: 2024-03-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dnesscarkey WP Armour – Honeypot Anti Spam allows Reflected XSS.This issue affects WP Armour – Honeypot Anti Spam: from n/a through 2.1.13.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/honeypot/wordpress-wp-armour-plugin-2-1-13-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/honeypot/wordpress-wp-armour-plugin-2-1-13-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-29092
Published: 2024-03-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maciej Bis Permalink Manager Lite allows Reflected XSS.This issue affects Permalink Manager Lite: from n/a through 2.4.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/permalink-manager/wordpress-permalink-manager-lite-plugin-2-4-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/permalink-manager/wordpress-permalink-manager-lite-plugin-2-4-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-29093
Published: 2024-03-19
Description: Cross-Site Request Forgery (CSRF) vulnerability in Saleswonder Team: Tobias Builder for WooCommerce reviews shortcodes – ReviewShort woo-product-reviews-shortcode.This issue affects Builder for WooCommerce reviews shortcodes – ReviewShort: from n/a through <= 1.01.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/woo-product-reviews-shortcode/vulnerability/wordpress-builder-for-woocommerce-reviews-shortcodes-reviewshort-plugin-1-01-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woo-product-reviews-shortcode/wordpress-builder-for-woocommerce-reviews-shortcodes-reviewshort-plugin-1-01-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-29094
Published: 2024-03-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes HT Easy GA4 ( Google Analytics 4 ) allows Stored XSS.This issue affects HT Easy GA4 ( Google Analytics 4 ): from n/a through 1.1.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/ht-easy-google-analytics/wordpress-ht-easy-ga4-plugin-1-1-7-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ht-easy-google-analytics/wordpress-ht-easy-ga4-plugin-1-1-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-2307
Published: 2024-03-19
Description: A flaw was found in osbuild-composer. A condition can be triggered that disables GPG verification for package repositories, which can expose the build phase to a Man-in-the-Middle attack, allowing untrusted code to be installed into an image being built.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-347
References: https://access.redhat.com/errata/RHSA-2024:2119; https://access.redhat.com/errata/RHSA-2024:2961; https://access.redhat.com/security/cve/CVE-2024-2307
CVE: CVE-2024-2442
Published: 2024-03-19
Description: 
Franklin Fueling System EVO 550 and EVO 5000 are vulnerable to a Path Traversal vulnerability that could allow an attacker to access sensitive files on the system.


CVSS Score: 7.5 (HIGH)
CWE: CWE-25
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-079-01; https://www.cisa.gov/news-events/ics-advisories/icsa-24-079-01
CVE: CVE-2024-2545
Published: 2024-03-19
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-1730. Reason: This candidate is a duplicate of CVE-2024-1730. Notes: All CVE users should reference CVE-2024-1730 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-28303
Published: 2024-03-19
Description: Open Source Medicine Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the date parameter at /admin/reports/index.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/onurkarasalihoglu/vulnerability-disclosures/blob/main/omos-sql-injection.md; https://github.com/onurkarasalihoglu/vulnerability-disclosures/blob/main/omos_sqli_exploit.py; https://github.com/onurkarasalihoglu/vulnerability-disclosures/blob/main/omos-sql-injection.md
CVE: CVE-2024-29027
Published: 2024-03-19
Description: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 6.5.5 and 7.0.0-alpha.29, calling an invalid Parse Server Cloud Function name or Cloud Job name crashes the server and may allow for code injection, internal store manipulation or remote code execution. The patch in versions 6.5.5 and 7.0.0-alpha.29 added string sanitation for Cloud Function name and Cloud Job name. As a workaround, sanitize the Cloud Function name and Cloud Job name before it reaches Parse Server.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-74
References: https://github.com/parse-community/parse-server/commit/5ae6d6a36d75c4511029f0ba5673ae4b2999179b; https://github.com/parse-community/parse-server/commit/9f6e3429d3b326cf4e2994733c618d08032fac6e; https://github.com/parse-community/parse-server/releases/tag/6.5.5
CVE: CVE-2024-28394
Published: 2024-03-19
Description: An issue in Advanced Plugins reportsstatistics v1.3.20 and before allows a remote attacker to execute arbitrary code via the Sales Reports, Statistics, Custom Fields & Export module.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: https://addons.prestashop.com/en/customer-administration/28379-sales-reports-statistics-custom-fields-export.html; https://security.friendsofpresta.org/modules/2024/03/14/reportsstatistics.html; https://addons.prestashop.com/en/customer-administration/28379-sales-reports-statistics-custom-fields-export.html
CVE: CVE-2024-28595
Published: 2024-03-19
Description: SQL Injection vulnerability in Employee Management System v1.0 allows attackers to run arbitrary SQL commands via the admin_id parameter in update-admin.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/shubham-s-pandey/CVE_POC/blob/main/CVE-2024-28595.md; https://github.com/shubham-s-pandey/CVE_POC/blob/main/CVE-2024-28595.md
CVE: CVE-2024-2169
Published: 2024-03-19
Description: Implementations of UDP application protocol are vulnerable to network loops.   An unauthenticated attacker can use maliciously-crafted packets against a vulnerable implementation that can lead to Denial of Service (DOS) and/or abuse of resources.
CVSS Score: 7.5 (HIGH)
References: https://kb.cert.org/vuls/id/417980; https://www.kb.cert.org/vuls/id/417980; http://www.openwall.com/lists/oss-security/2024/09/04/1
CVE: CVE-2024-24336
Published: 2024-03-19
Description: A multiple Cross-site scripting (XSS) vulnerability in the '/members/moremember.pl', and ‘/members/members-home.pl’ endpoints within Koha Library Management System version 23.05.05 and earlier allows malicious staff users to carry out CSRF attacks, including unauthorized changes to usernames and passwords of users visiting the affected page, via the 'Circulation note' and ‘Patrons Restriction’ components.
CVSS Score: 8.1 (HIGH)
CWE: CWE-352
References: https://nitipoom-jar.github.io/CVE-2024-24336/; https://nitipoom-jaroonchaipipat.github.io/security-research-portal/2024-24336; https://nitipoom-jar.github.io/CVE-2024-24336/
CVE: CVE-2024-28092
Published: 2024-03-19
Description: UBEE DDW365 XCNDDW365 8.14.3105 software on hardware 3.13.1 allows a remote attacker within Wi-Fi proximity to conduct stored XSS attacks via RgFirewallEL.asp, RgDdns.asp, RgTime.asp, RgDiagnostics.asp, or RgParentalBasic.asp. The affected fields are SMTP Server Name, SMTP Username, Host Name, Time Server 1, Time Server 2, Time Server 3, Target, Add Keyword, Add Domain, and Add Allowed Domain.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://github.com/actuator/cve/blob/main/Ubee/CVE-2024-28092; https://github.com/actuator/cve/blob/main/Ubee/CVE-2024-28092
CVE: CVE-2024-28283
Published: 2024-03-19
Description: There is stack-based buffer overflow vulnerability in pc_change_act function in Linksys E1000 router firmware version v.2.1.03 and before, leading to remote code execution.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-121
References: https://d05004.notion.site/Linksys-E1000-BOF-37b98eec45ea4fc991b9b5bea3db091d?pvs=4; https://d05004.notion.site/Linksys-E1000-BOF-37b98eec45ea4fc991b9b5bea3db091d?pvs=4
CVE: CVE-2024-28389
Published: 2024-03-19
Description: SQL injection vulnerability in KnowBand spinwheel v.3.0.3 and before allows a remote attacker to gain escalated privileges and obtain sensitive information via the SpinWheelFrameSpinWheelModuleFrontController::sendEmail() method.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://security.friendsofpresta.org/modules/2024/03/12/spinwheel.html; https://security.friendsofpresta.org/modules/2024/03/12/spinwheel.html
CVE: CVE-2024-28715
Published: 2024-03-19
Description: Cross Site Scripting vulnerability in DOraCMS v.2.18 and before allows a remote attacker to execute arbitrary code via the markdown0 function in the /app/public/apidoc/oas3/wrap-components/markdown.jsx endpoint.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: https://github.com/Lq0ne/CVE-2024-28715; https://github.com/Lq0ne/CVE-2024-28715
CVE: CVE-2024-2641
Published: 2024-03-19
Description: A vulnerability was found in Ruijie RG-NBS2009G-P up to 20240305. It has been classified as critical. Affected is an unknown function of the file /system/passwdManage.htm of the component Password Handler. The manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257280. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-285
References: https://h0e4a0r1t.github.io/2024/vulns/Unauthorized%20access%20vulnerability%20in%20Ruijie%20RG-NBS2009G-P%20switch.pdf; https://vuldb.com/?ctiid.257280; https://vuldb.com/?id.257280
CVE: CVE-2023-50811
Published: 2024-03-19
Description: An issue discovered in SELESTA Visual Access Manager 4.38.6 allows attackers to modify the “computer” POST parameter related to the ID of a specific reception by POST HTTP request interception. Iterating that parameter, it has been possible to access to the application and take control of many other receptions in addition the assigned one.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-444, CWE-863
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2024-2642
Published: 2024-03-19
Description: A vulnerability was found in Ruijie RG-NBS2009G-P up to 20240305. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /EXCU_SHELL. The manipulation of the argument Command1 leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257281 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-77
References: https://h0e4a0r1t.github.io/2024/vulns/Ruijie%20RG-NBS2009G-P%20switch%20has%20a%20foreground%20CLI%20command%20injection%20vulnerability.pdf; https://vuldb.com/?ctiid.257281; https://vuldb.com/?id.257281
CVE: CVE-2024-2644
Published: 2024-03-19
Description: A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been rated as critical. Affected by this issue is some unknown functionality of the file /protocol/firewall/addfirewall.php. The manipulation of the argument FireWallTableArray leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-257282 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/hundanchen69/cve/blob/main/NS-ASG-sql-laddfirewall.md; https://vuldb.com/?ctiid.257282; https://vuldb.com/?id.257282
CVE: CVE-2024-2645
Published: 2024-03-19
Description: A vulnerability classified as problematic has been found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /vpnweb/resetpwd/resetpwd.php. The manipulation of the argument UserId leads to improper neutralization of data within xpath expressions. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257283. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-643, CWE-91
References: https://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-laddfirewall.md; https://vuldb.com/?ctiid.257283; https://vuldb.com/?id.257283
CVE: CVE-2024-2646
Published: 2024-03-19
Description: A vulnerability classified as critical was found in Netentsec NS-ASG Application Security Gateway 6.3. This vulnerability affects unknown code of the file /vpnweb/index.php?para=index. The manipulation of the argument check_VirtualSiteId leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257284. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-index.md; https://vuldb.com/?ctiid.257284; https://vuldb.com/?id.257284
CVE: CVE-2024-2647
Published: 2024-03-19
Description: A vulnerability, which was classified as critical, has been found in Netentsec NS-ASG Application Security Gateway 6.3. This issue affects some unknown processing of the file /admin/singlelogin.php. The manipulation of the argument loginId leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257285 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-singlelogin.md; https://vuldb.com/?ctiid.257285; https://vuldb.com/?id.257285
CVE: CVE-2024-2648
Published: 2024-03-19
Description: A vulnerability, which was classified as problematic, was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected is an unknown function of the file /nac/naccheck.php. The manipulation of the argument username leads to improper neutralization of data within xpath expressions. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-257286 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-643, CWE-91
References: https://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-naccheck.md; https://vuldb.com/?ctiid.257286; https://vuldb.com/?id.257286
CVE: CVE-2024-2197
Published: 2024-03-20
Description: The Chirp Access app contains a hard-coded password, BEACON_PASSWORD. An attacker within Bluetooth range could change configuration settings within the Bluetooth beacon, effectively disabling the application's ability to notify users when they are near a Beacon-enabled access point. This variable cannot be used to change the configuration settings of the door readers or locksets and does not affect the ability for authorized users of the mobile application to lock or unlock access points.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-259
References: https://statement.chirpsystems.com/chirp-systems-icsa-24-067-01-response.html; https://www.cisa.gov/news-events/ics-advisories/icsa-24-067-01; https://statement.chirpsystems.com/chirp-systems-icsa-24-067-01-response.html
CVE: CVE-2024-2649
Published: 2024-03-20
Description: A vulnerability has been found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /protocol/iscdevicestatus/deleteonlineuser.php. The manipulation of the argument messagecontent leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257287. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-deleteonlineuser.md; https://vuldb.com/?ctiid.257287; https://vuldb.com/?id.257287
CVE: CVE-2024-1785
Published: 2024-03-20
Description: The Contests by Rewards Fuel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.62. This is due to missing or incorrect nonce validation on the ajax_handler() function. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious JavaScript via a forged request granted they can trick a site's user with the edit_posts capability into performing an action such as clicking on a link.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3039978%40contests-from-rewards-fuel&new=3039978%40contests-from-rewards-fuel&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/689f3667-2dda-40a8-8627-d38c6c6816fc?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3039978%40contests-from-rewards-fuel&new=3039978%40contests-from-rewards-fuel&sfp_email=&sfph_mail=