deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-30478
Published: 2024-03-29
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bulletin WordPress Announcement & Notification Banner Plugin – Bulletin.This issue affects WordPress Announcement & Notification Banner Plugin – Bulletin: from n/a through 3.8.5.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/bulletin-announcements/wordpress-announcement-notification-banner-bulletin-plugin-3-8-5-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/bulletin-announcements/wordpress-announcement-notification-banner-bulletin-plugin-3-8-5-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-30486
Published: 2024-03-29
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Max Foundry Media Library Folders.This issue affects Media Library Folders: from n/a through 8.1.7.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/media-library-plus/wordpress-media-library-folders-plugin-8-1-7-author-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/media-library-plus/wordpress-media-library-folders-plugin-8-1-7-author-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-30487
Published: 2024-03-29
Description: Missing Authorization vulnerability in Sonaar Music MP3 Audio Player for Music, Radio & Podcast by Sonaar.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through 5.1.
CVSS Score: 7.6 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/mp3-music-player-by-sonaar/wordpress-mp3-audio-player-for-music-radio-podcast-by-sonaar-plugin-5-1-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/mp3-music-player-by-sonaar/wordpress-mp3-audio-player-for-music-radio-podcast-by-sonaar-plugin-5-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-30488
Published: 2024-03-29
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Katie Zotpress zotpress.This issue affects Zotpress: from n/a through <= 7.3.7.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/zotpress/vulnerability/wordpress-zotpress-plugin-7-3-7-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/zotpress/wordpress-zotpress-plugin-7-3-7-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-30490
Published: 2024-03-29
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.8.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/profilegrid-user-profiles-groups-and-communities/wordpress-profilegrid-plugin-5-7-8-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/profilegrid-user-profiles-groups-and-communities/wordpress-profilegrid-plugin-5-7-8-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-30491
Published: 2024-03-29
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.8.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/profilegrid-user-profiles-groups-and-communities/wordpress-profilegrid-user-profiles-memberships-groups-and-communities-plugin-5-7-8-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/profilegrid-user-profiles-groups-and-communities/wordpress-profilegrid-user-profiles-memberships-groups-and-communities-plugin-5-7-8-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-30493
Published: 2024-03-29
Description: Cross-Site Request Forgery (CSRF) vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.7.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/church-admin/vulnerability/wordpress-church-admin-plugin-4-1-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/church-admin/wordpress-church-admin-plugin-4-1-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-30494
Published: 2024-03-29
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 沈唁 OSS Aliyun.This issue affects OSS Aliyun: from n/a through 1.4.10.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/oss-aliyun/wordpress-oss-aliyun-plugin-1-4-10-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/oss-aliyun/wordpress-oss-aliyun-plugin-1-4-10-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-30495
Published: 2024-03-29
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Faboba Falang multilanguage.This issue affects Falang multilanguage: from n/a through 1.3.47.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/falang/wordpress-falang-multilanguage-for-wordpress-plugin-1-3-47-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/falang/wordpress-falang-multilanguage-for-wordpress-plugin-1-3-47-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-30496
Published: 2024-03-29
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BdThemes Element Pack Elementor Addons.This issue affects Element Pack Elementor Addons: from n/a through 5.5.3.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/bdthemes-element-pack-lite/wordpress-element-pack-lite-plugin-5-5-3-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/bdthemes-element-pack-lite/wordpress-element-pack-lite-plugin-5-5-3-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-30497
Published: 2024-03-29
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in I Thirteen Web Solution WP Responsive Tabs horizontal vertical and accordion Tabs.This issue affects WP Responsive Tabs horizontal vertical and accordion Tabs: from n/a through 1.1.17.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/responsive-horizontal-vertical-and-accordion-tabs/wordpress-wp-responsive-tabs-horizontal-vertical-and-accordion-tabs-plugin-1-1-17-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/responsive-horizontal-vertical-and-accordion-tabs/wordpress-wp-responsive-tabs-horizontal-vertical-and-accordion-tabs-plugin-1-1-17-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-30498
Published: 2024-03-29
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks CRM Perks Forms.This issue affects CRM Perks Forms: from n/a through 1.1.4.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/crm-perks-forms/wordpress-crm-perks-forms-plugin-1-1-4-unauthenticated-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/crm-perks-forms/wordpress-crm-perks-forms-plugin-1-1-4-unauthenticated-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-30499
Published: 2024-03-29
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks CRM Perks Forms.This issue affects CRM Perks Forms: from n/a through 1.1.4.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/crm-perks-forms/wordpress-crm-perks-forms-plugin-1-1-4-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/crm-perks-forms/wordpress-crm-perks-forms-plugin-1-1-4-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-30500
Published: 2024-03-29
Description: Unrestricted Upload of File with Dangerous Type vulnerability in CubeWP CubeWP – All-in-One Dynamic Content Framework.This issue affects CubeWP – All-in-One Dynamic Content Framework: from n/a through 1.1.12.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/cubewp-framework/wordpress-cubewp-plugin-1-1-12-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/cubewp-framework/wordpress-cubewp-plugin-1-1-12-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-30501
Published: 2024-03-29
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.9.4.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/download-monitor/wordpress-download-monitor-theme-4-9-4-admin-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/download-monitor/wordpress-download-monitor-theme-4-9-4-admin-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-30510
Published: 2024-03-29
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Salon Booking System Salon booking system.This issue affects Salon booking system: from n/a through 9.5.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/salon-booking-system/wordpress-salon-booking-system-plugin-9-5-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/salon-booking-system/wordpress-salon-booking-system-plugin-9-5-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-30634
Published: 2024-03-29
Description: Tenda F1202 v1.2.0.20(408) has a stack overflow vulnerability via the mitInterface parameter in the fromAddressNat function.
CVSS Score: 8.0 (HIGH)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/F/F1202/fromAddressNat_mitInterface.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/F/F1202/fromAddressNat_mitInterface.md
CVE: CVE-2024-30635
Published: 2024-03-29
Description: Tenda F1202 v1.2.0.20(408) has a stack overflow vulnerability located in the funcpara1 parameter in the formSetCfm function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/F/F1202/formSetCfm.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/F/F1202/formSetCfm.md
CVE: CVE-2024-30636
Published: 2024-03-29
Description: Tenda F1202 v1.2.0.20(408) has a stack overflow vulnerability via the PPPOEPassword parameter in the formQuickIndex function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/F/F1202/formQuickIndex.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/F/F1202/formQuickIndex.md
CVE: CVE-2024-30637
Published: 2024-03-29
Description: Tenda F1202 v1.2.0.20(408) has a command injection vulnerablility in the formWriteFacMac function in the mac parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/F/F1202/formWriteFacMac.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/F/F1202/formWriteFacMac.md
CVE: CVE-2024-30638
Published: 2024-03-29
Description: Tenda F1202 v1.2.0.20(408) has a stack overflow vulnerability via the entrys parameter in the fromAddressNat function.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/F/F1202/fromAddressNat_entrys.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/F/F1202/fromAddressNat_entrys.md
CVE: CVE-2024-30639
Published: 2024-03-29
Description: Tenda F1202 v1.2.0.20(408) has a stack overflow vulnerability in the page parameter of fromAddressNat function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/F/F1202/fromAddressNat_page.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/F/F1202/fromAddressNat_page.md
CVE: CVE-2024-23537
Published: 2024-03-29
Description: Improper Privilege Management vulnerability in Apache Fineract.This issue affects Apache Fineract: <1.8.5.

Users are recommended to upgrade to version 1.9.0, which fixes the issue.
CVSS Score: 8.4 (HIGH)
CWE: CWE-269
References: http://www.openwall.com/lists/oss-security/2024/03/29/1; https://cwiki.apache.org/confluence/display/FINERACT/Apache+Fineract+Security+Report; https://lists.apache.org/thread/fq1ns4nprw2vqpkwwj9sw45jkwxmt9f1
CVE: CVE-2024-23538
Published: 2024-03-29
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Fineract.This issue affects Apache Fineract: <1.8.5.

Users are recommended to upgrade to version 1.8.5 or 1.9.0, which fix the issue.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-89
References: http://www.openwall.com/lists/oss-security/2024/03/29/2; https://cwiki.apache.org/confluence/display/FINERACT/Apache+Fineract+Security+Report; https://lists.apache.org/thread/by32w2dylzgbqm5940x3wj7519wolqxs
CVE: CVE-2024-23539
Published: 2024-03-29
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Fineract.This issue affects Apache Fineract: <1.8.5.

Users are recommended to upgrade to version 1.8.5 or 1.9.0, which fix the issue.
CVSS Score: 8.3 (HIGH)
CWE: CWE-89
References: http://www.openwall.com/lists/oss-security/2024/03/29/3; https://cwiki.apache.org/confluence/display/FINERACT/Apache+Fineract+Security+Report; https://lists.apache.org/thread/g8sv1gnjv716lx2h89jbvjdgtrrjmy7h
CVE: CVE-2024-27619
Published: 2024-03-29
Description: Dlink Dir-3040us A1 1.20b03a hotfix is vulnerable to Buffer Overflow. Any user having read/write access to ftp server can write directly to ram causing buffer overflow if file or files uploaded are greater than available ram. Ftp server allows change of directory to root which is one level up than root of usb flash directory. During upload ram is getting filled and causing system resource exhaustion (no free memory) which causes system to crash and reboot.
CVSS Score: 7.3 (HIGH)
CWE: CWE-120
References: http://dir-3040us.com; https://github.com/ioprojecton/dir-3040_dos; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2024-28405
Published: 2024-03-29
Description: SEMCMS 4.8 is vulnerable to Incorrect Access Control. The code installs SEMCMS_Funtion.php before checking if the admin is a valid user in the admin page because authentication function is called from there, users gain admin privileges.
CVSS Score: 7.2 (HIGH)
CWE: CWE-284
References: https://github.com/turabiaslan/semcms; https://github.com/turabiaslan/semcms/blob/main/README.md; https://github.com/turabiaslan/semcms
CVE: CVE-2024-28867
Published: 2024-03-29
Description: Swift Prometheus is a Swift client for the Prometheus monitoring system, supporting counters, gauges and histograms. In code which applies _un-sanitized string values into metric names or labels_, an attacker could make use of this and send a `?lang` query parameter containing newlines, `}`  or similar characters which can lead to the attacker taking over the exported format -- including creating unbounded numbers of stored metrics, inflating server memory usage, or causing "bogus" metrics. This vulnerability is fixed in2.0.0-alpha.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-74
References: https://github.com/swift-server/swift-prometheus/commit/bfcd4bbfabe11aae4b035424ee9724582e288501; https://github.com/swift-server/swift-prometheus/security/advisories/GHSA-x768-cvr2-345r; https://github.com/swift-server/swift-prometheus/commit/bfcd4bbfabe11aae4b035424ee9724582e288501
CVE: CVE-2024-29020
Published: 2024-03-29
Description: JumpServer is an open source bastion host and an operation and maintenance security audit system. An authorized attacker can obtain sensitive information contained within playbook files if they manage to learn the playbook_id of another user. This breach of confidentiality can lead to information disclosure and exposing sensitive data. This vulnerability is fixed in v3.10.6.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://github.com/jumpserver/jumpserver/security/advisories/GHSA-7mqc-23hr-cr62; https://github.com/jumpserver/jumpserver/security/advisories/GHSA-7mqc-23hr-cr62
CVE: CVE-2024-29024
Published: 2024-03-29
Description: JumpServer is an open source bastion host and an operation and maintenance security audit system.
An authenticated user can exploit the Insecure Direct Object Reference (IDOR) vulnerability in the file manager's bulk transfer by manipulating job IDs to upload malicious files,  potentially compromising the integrity and security of the system. This vulnerability is fixed in v3.10.6.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://github.com/jumpserver/jumpserver/security/advisories/GHSA-8wqm-rfc7-q27q; https://github.com/jumpserver/jumpserver/security/advisories/GHSA-8wqm-rfc7-q27q
CVE: CVE-2024-29201
Published: 2024-03-29
Description: JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can bypass the input validation mechanism in JumpServer's Ansible to execute arbitrary code within the Celery container. Since the Celery container runs with root privileges and has database access, attackers could steal sensitive information from all hosts or manipulate the database. This vulnerability is fixed in v3.10.7.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://github.com/jumpserver/jumpserver/security/advisories/GHSA-pjpp-cm9x-6rwj; https://www.sonarsource.com/blog/diving-into-jumpserver-attackers-gateway-to-internal-networks-2-2; https://github.com/jumpserver/jumpserver/security/advisories/GHSA-pjpp-cm9x-6rwj
CVE: CVE-2024-29202
Published: 2024-03-29
Description: JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can exploit a Jinja2 template injection vulnerability in JumpServer's Ansible to execute arbitrary code within the Celery container. Since the Celery container runs with root privileges and has database access, attackers could steal sensitive information from all hosts or manipulate the database. This vulnerability is fixed in v3.10.7.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://github.com/jumpserver/jumpserver/security/advisories/GHSA-2vvr-vmvx-73ch; https://www.sonarsource.com/blog/diving-into-jumpserver-attackers-gateway-to-internal-networks-2-2; https://github.com/jumpserver/jumpserver/security/advisories/GHSA-2vvr-vmvx-73ch
CVE: CVE-2024-29890
Published: 2024-03-29
Description: DataLens is a business intelligence and data visualization system. A specifically crafted request allowed the creation of a special chart type with the ability to pass custom javascript code that would later be executed in an unprotected sandbox on subsequent requests to that chart. The problem was fixed in the datalens-ui version `0.1449.0`. Restricting access to the API for creating or modifying charts (`/charts/api/charts/v1/`) would mitigate the issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: https://github.com/datalens-tech/datalens/security/advisories/GHSA-6278-2wvc-4p93; https://github.com/datalens-tech/datalens/security/advisories/GHSA-6278-2wvc-4p93
CVE: CVE-2024-29893
Published: 2024-03-29
Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically,  it's possible to crash the repo server component through an out of memory error by pointing it to a malicious Helm registry. The loadRepoIndex() function in the ArgoCD's helm package, does not limit the size nor time while fetching the data. It fetches it and creates a byte slice from the retrieved data in one go. If the registry is implemented to push data continuously, the repo server will keep allocating memory until it runs out of it. A patch for this vulnerability has been released in v2.10.3, v2.9.8, and v2.8.12.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://github.com/argoproj/argo-cd/commit/14f681e3ee7c38731943b98f92277e88a3db109d; https://github.com/argoproj/argo-cd/commit/36b8a12a38f8d92d55bffc81deed44389bf6eb59; https://github.com/argoproj/argo-cd/commit/3e5a878f6e30d935fa149723ea2a2e93748fcddd
CVE: CVE-2024-30502
Published: 2024-03-29
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel Engine.This issue affects WP Travel Engine: from n/a through 5.7.9.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/wp-travel-engine/wordpress-wp-travel-engine-plugin-5-7-9-unauth-blind-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-travel-engine/wordpress-wp-travel-engine-plugin-5-7-9-unauth-blind-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-30504
Published: 2024-03-29
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel Engine.This issue affects WP Travel Engine: from n/a through 5.7.9.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/wp-travel-engine/wordpress-wp-travel-engine-plugin-5-7-9-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-travel-engine/wordpress-wp-travel-engine-plugin-5-7-9-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-30505
Published: 2024-03-29
Description: Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.18.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/church-admin/vulnerability/wordpress-church-admin-plugin-4-1-18-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/church-admin/wordpress-church-admin-plugin-4-1-18-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-30506
Published: 2024-03-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vsourz Digital All In One Redirection allows Stored XSS.This issue affects All In One Redirection: from n/a through 2.2.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/all-in-one-redirection-404-pages-list/wordpress-all-in-one-redirection-plugin-2-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/all-in-one-redirection-404-pages-list/wordpress-all-in-one-redirection-plugin-2-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-30507
Published: 2024-03-29
Description: Authorization Bypass Through User-Controlled Key vulnerability in Molongui.This issue affects Molongui: from n/a through 4.7.7.
CVSS Score: 2.7 (LOW)
CWE: CWE-639
References: https://patchstack.com/database/vulnerability/molongui-authorship/wordpress-molongui-authorship-plugin-4-7-7-insecure-direct-object-references-idor-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/molongui-authorship/wordpress-molongui-authorship-plugin-4-7-7-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE: CVE-2024-30508
Published: 2024-03-29
Description: Missing Authorization vulnerability in ThimPress WP Hotel Booking.This issue affects WP Hotel Booking: from n/a through 2.0.9.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/wp-hotel-booking/wordpress-wp-hotel-booking-plugin-2-0-9-2-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-hotel-booking/wordpress-wp-hotel-booking-plugin-2-0-9-2-broken-access-control-vulnerability?_s_id=cve