deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-11827
Published: 2024-12-13
Description: The Out of the Block: OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ootb_query shortcode in all versions up to, and including, 2.8.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/ootb-openstreetmap/tags/2.8.3/includes/classes/Query.php#L283; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3207248%40ootb-openstreetmap%2Ftrunk&old=3190811%40ootb-openstreetmap%2Ftrunk&sfp_email=&sfph_mail=#file2; https://wordpress.org/plugins/ootb-openstreetmap/#developers
CVE: CVE-2024-21576
Published: 2024-12-13
Description: ComfyUI-Bmad-Nodes is vulnerable to Code Injection. The issue stems from a validation bypass in the BuildColorRangeHSVAdvanced, FilterContour and FindContour custom nodes. In the entrypoint function to each node, there’s a call to eval which can be triggered by generating a workflow that injects a crafted string into the node. This can result in executing arbitrary code on the server.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-94
References: https://github.com/bmad4ever/comfyui_bmad_nodes/blob/392af9490cbadf32a1fe92ff820ebabe88c51ee8/cv_nodes.py#L1814
CVE: CVE-2024-21577
Published: 2024-12-13
Description: ComfyUI-Ace-Nodes is vulnerable to Code Injection. The ACE_ExpressionEval node contains an eval() in its entrypoint function that accepts arbitrary user-controlled data. A user can create a workflow that results in executing arbitrary code on the server.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-94
References: https://github.com/hay86/ComfyUI_AceNodes/blob/5ba01db8a3b7afb8e4aecfaa48823ddeb132bbbb/nodes.py#L1193
CVE: CVE-2024-9608
Published: 2024-12-13
Description: The MyParcel plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 4.24.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Please note this is only exploitable when the WooCommerce store is set to Belgium.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3206928/woocommerce-myparcel/tags/4.24.2/includes/admin/settings/class-wcmypa-settings.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/d6c85f2b-965d-477f-9d9a-4a3f315c4904?source=cve
CVE: CVE-2024-11986
Published: 2024-12-13
Description: Improper input handling in the 'Host Header' allows an unauthenticated attacker to store a payload in web application logs. When an Administrator views the logs using the application's standard functionality, it enables the execution of the payload, resulting in Stored XSS or 'Cross-Site Scripting'.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79
References: https://crushftp.com/crush11wiki/Wiki.jsp?page=Update
CVE: CVE-2024-22461
Published: 2024-12-13
Description: Dell RecoverPoint for Virtual Machines 6.0.x contains an OS Command injection vulnerability. A low privileged remote attacker could potentially exploit this vulnerability by running any command as root, leading to gaining of root-level access and compromise of complete system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-347, CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000259765/dsa-2024-429-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities
CVE: CVE-2024-38488
Published: 2024-12-13
Description: Dell RecoverPoint for Virtual Machines 6.0.x contains a vulnerability. An improper Restriction of Excessive Authentication vulnerability where a Network attacker could potentially exploit this vulnerability, leading to a brute force attack or a dictionary attack against the RecoverPoint login form and a complete system compromise.
This allows attackers to brute-force the password of valid users in an automated manner.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-307
References: https://www.dell.com/support/kbdoc/en-us/000259765/dsa-2024-429-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities
CVE: CVE-2024-48007
Published: 2024-12-13
Description: Dell RecoverPoint for Virtual Machines 6.0.x contains use of hard-coded credentials vulnerability. A Remote unauthenticated attacker could potentially exploit this vulnerability by gaining access to the source code, easily retrieving these secrets and reusing them to access the system leading to gaining access to unauthorized data.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-798, CWE-798
References: https://www.dell.com/support/kbdoc/en-us/000259765/dsa-2024-429-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities
CVE: CVE-2024-48008
Published: 2024-12-13
Description: Dell RecoverPoint for Virtual Machines 6.0.x contains a OS Command Injection vulnerability. An Low privileged remote attacker could potentially exploit this vulnerability leading to information disclosure ,allowing of unintended actions like reading files that may contain sensitive information
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-11, CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000259765/dsa-2024-429-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities
CVE: CVE-2024-55889
Published: 2024-12-13
Description: phpMyFAQ is an open source FAQ web application. Prior to version 3.2.10, a vulnerability exists in the FAQ Record component where a privileged attacker can trigger a file download on a victim's machine upon page visit by embedding it in an <iframe> element without user interaction or explicit consent. Version 3.2.10 fixes the issue.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-451
References: https://github.com/thorsten/phpMyFAQ/commit/fa0f7368dc3288eedb1915def64ef8fb270f711d; https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-m3r7-8gw7-qwvc; https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-m3r7-8gw7-qwvc
CVE: CVE-2022-43472
Published: 2024-12-13
Description: Missing Authorization vulnerability in StylemixThemes eRoom – Zoom Meetings & Webinar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eRoom – Zoom Meetings & Webinar: from n/a through 1.4.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/eroom-zoom-meetings-webinar/vulnerability/wordpress-eroom-plugin-1-4-6-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2022-44578
Published: 2024-12-13
Description: Missing Authorization vulnerability in Pierre JEHAN Owl Carousel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Owl Carousel: from n/a through 0.5.3.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/owl-carousel/vulnerability/wordpress-owl-carousel-plugin-0-5-3-broken-access-control-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-45806
Published: 2024-12-13
Description: Missing Authorization vulnerability in Strategy11 Form Builder Team Formidable Forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Formidable Forms: from n/a through 5.5.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/formidable/vulnerability/wordpress-formidable-forms-plugin-5-5-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2022-45819
Published: 2024-12-13
Description: Missing Authorization vulnerability in Popup Maker Popup Maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup Maker: from n/a through 1.17.1.
CVSS Score: 3.5 (LOW)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/popup-maker/vulnerability/wordpress-popup-maker-plugin-1-17-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2022-45826
Published: 2024-12-13
Description: Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 2.9.13.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/sunshine-photo-cart/vulnerability/wordpress-sunshine-photo-cart-plugin-2-9-13-auth-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2022-45840
Published: 2024-12-13
Description: Missing Authorization vulnerability in Lucian Apostol Auto Affiliate Links allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Auto Affiliate Links: from n/a through 6.2.1.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/wp-auto-affiliate-links/vulnerability/wordpress-auto-affiliate-links-plugin-6-2-1-5-unauth-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2022-45841
Published: 2024-12-13
Description: Missing Authorization vulnerability in RoboSoft Robo Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Robo Gallery: from n/a through 3.2.9.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/robo-gallery/vulnerability/wordpress-robo-gallery-plugin-3-2-9-auth-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2022-46795
Published: 2024-12-13
Description: Missing Authorization vulnerability in Tyche Softwares Print Invoice & Delivery Notes for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through 4.7.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/woocommerce-delivery-notes/vulnerability/wordpress-print-invoice-delivery-notes-for-woocommerce-plugin-4-7-2-csrf-plugin-settings-reset-vulnerability?_s_id=cve
CVE: CVE-2022-46796
Published: 2024-12-13
Description: Missing Authorization vulnerability in VillaTheme CURCY allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CURCY: from n/a through 2.1.25.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/woo-multi-currency/vulnerability/wordpress-curcy-plugin-2-1-25-unauthenticated-plugin-settings-change-vulnerability?_s_id=cve
CVE: CVE-2022-46807
Published: 2024-12-13
Description: Missing Authorization vulnerability in Lauri Karisola / WP Trio Stock Sync for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stock Sync for WooCommerce: from n/a through 2.3.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/stock-sync-for-woocommerce/vulnerability/wordpress-stock-sync-for-woocommerce-plugin-2-3-2-broken-access-control-csrf?_s_id=cve
CVE: CVE-2022-46811
Published: 2024-12-13
Description: Missing Authorization vulnerability in VillaTheme(villatheme.com) ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce: from n/a through 1.0.21.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/woo-alidropship/vulnerability/wordpress-ald-dropshipping-and-fulfillment-for-aliexpress-and-woocommerce-plugin-1-0-21-broken-access-control-csrf?_s_id=cve
CVE: CVE-2022-46838
Published: 2024-12-13
Description: Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/js-support-ticket/vulnerability/wordpress-js-help-desk-plugin-2-7-1-unauthenticated-settings-change-vulnerability?_s_id=cve
CVE: CVE-2022-46840
Published: 2024-12-13
Description: Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/js-support-ticket/vulnerability/wordpress-js-help-desk-plugin-2-7-1-broken-access-control?_s_id=cve
CVE: CVE-2022-46846
Published: 2024-12-13
Description: Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Trending/Popular Post Slider and Widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trending/Popular Post Slider and Widget: from n/a through 1.5.7.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/wp-trending-post-slider-and-widget/vulnerability/wordpress-trending-popular-post-slider-and-widget-plugin-1-5-7-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2022-47168
Published: 2024-12-13
Description: Missing Authorization vulnerability in printful Printful Integration for WooCommerce printful-shipping-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Printful Integration for WooCommerce: from n/a through <= 2.2.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/printful-shipping-for-woocommerce/vulnerability/wordpress-printful-integration-for-woocommerce-plugin-2-2-2-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2022-47176
Published: 2024-12-13
Description: Missing Authorization vulnerability in Depicter Slider and Popup by Averta Depicter Slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Depicter Slider: from n/a through 1.9.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/depicter/vulnerability/wordpress-depicter-slider-plugin-1-7-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2022-47182
Published: 2024-12-13
Description: Missing Authorization vulnerability in Wpexpertsio APIExperts Square for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.4.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/woosquare/vulnerability/wordpress-apiexperts-square-for-woocommerce-plugin-4-2-5-broken-access-control?_s_id=cve
CVE: CVE-2022-47429
Published: 2024-12-13
Description: Missing Authorization vulnerability in 8Degree Themes Coming Soon Landing Page and Maintenance Mode WordPress Plugin allows Retrieve Embedded Sensitive Data.This issue affects Coming Soon Landing Page and Maintenance Mode WordPress Plugin: from n/a through 2.2.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/8-degree-coming-soon-page/vulnerability/wordpress-coming-soon-landing-page-and-maintenance-mode-wordpress-plugin-plugin-2-2-0-broken-access-control?_s_id=cve
CVE: CVE-2022-47594
Published: 2024-12-13
Description: Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through 3.8.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/essential-blocks/vulnerability/wordpress-essential-blocks-for-gutenberg-plugin-3-8-5-broken-access-control?_s_id=cve
CVE: CVE-2023-22697
Published: 2024-12-13
Description: Missing Authorization vulnerability in Survey Maker team Survey Maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Survey Maker: from n/a through 3.2.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/survey-maker/vulnerability/wordpress-survey-maker-plugin-3-2-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2023-25988
Published: 2024-12-13
Description: Missing Authorization vulnerability in Video Gallery by Total-Soft Video Gallery – YouTube Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Video Gallery – YouTube Gallery: from n/a through 1.7.6.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/gallery-videos/vulnerability/wordpress-video-gallery-youtube-gallery-plugin-1-7-6-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2023-27456
Published: 2024-12-13
Description: Missing Authorization vulnerability in HashThemes Total allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Total: from n/a through 2.1.19.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/theme/total/vulnerability/wordpress-total-theme-2-1-19-authenticated-arbitrary-plugin-activation?_s_id=cve
CVE: CVE-2023-28990
Published: 2024-12-13
Description: Missing Authorization vulnerability in HashThemes Viral Mag allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Viral Mag: from n/a through 1.0.9.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/theme/viral-mag/vulnerability/wordpress-viral-mag-theme-1-0-9-authenticated-arbitrary-plugin-activation-vulnerability?_s_id=cve
CVE: CVE-2023-30490
Published: 2024-12-13
Description: Missing Authorization vulnerability in Matthew Ruddy Easing Slider  allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easing Slider : from n/a through 3.0.8.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/easing-slider/vulnerability/wordpress-easing-slider-plugin-3-0-8-plugin-settings-reset-vulnerability?_s_id=cve
CVE: CVE-2023-32506
Published: 2024-12-13
Description: Missing Authorization vulnerability in Link Whisper Link Whisper Free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Link Whisper Free: from n/a through 0.6.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/link-whisper/vulnerability/wordpress-link-whisper-free-plugin-0-6-3-unauthenticated-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2023-32507
Published: 2024-12-13
Description: Missing Authorization vulnerability in wp3sixty Woo Custom Emails allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woo Custom Emails: from n/a through 2.2.
CVSS Score: 7.3 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/woo-custom-emails/vulnerability/wordpress-woo-custom-emails-plugin-2-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2023-32519
Published: 2024-12-13
Description: Missing Authorization vulnerability in Webcodin WCP Contact Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCP Contact Form: from n/a through 3.1.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/wcp-contact-form/vulnerability/wordpress-wcp-contact-form-plugin-3-1-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2023-32520
Published: 2024-12-13
Description: Missing Authorization vulnerability in Webcodin WCP Contact Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCP Contact Form: from n/a through 3.1.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/wcp-contact-form/vulnerability/wordpress-wcp-contact-form-plugin-3-1-0-broken-access-control-vulnerability-2?_s_id=cve
CVE: CVE-2023-32574
Published: 2024-12-13
Description: Missing Authorization vulnerability in Fahad Mahmood Injection Guard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Injection Guard: from n/a through 1.2.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/injection-guard/vulnerability/wordpress-injection-guard-plugin-1-2-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2023-32581
Published: 2024-12-13
Description: Missing Authorization vulnerability in MobileMonkey WP-Chatbot for Messenger allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Chatbot for Messenger: from n/a through 4.7.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/wp-chatbot/vulnerability/wordpress-wp-chatbot-for-messenger-plugin-4-7-broken-access-control?_s_id=cve
CVE: CVE-2023-32585
Published: 2024-12-13
Description: Missing Authorization vulnerability in Total-Soft Portfolio Gallery – Responsive Image Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Portfolio Gallery – Responsive Image Gallery: from n/a through 1.4.6.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/gallery-portfolio/vulnerability/wordpress-portfolio-gallery-responsive-image-gallery-plugin-1-4-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2023-32586
Published: 2024-12-13
Description: Missing Authorization vulnerability in Thomas Michalak Soundcloud Is Gold allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Soundcloud Is Gold: from n/a through 2.5.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/soundcloud-is-gold/vulnerability/wordpress-soundcloud-is-gold-plugin-2-5-1-broken-access-control?_s_id=cve
CVE: CVE-2023-32593
Published: 2024-12-13
Description: Missing Authorization vulnerability in GS Plugins GS Pins for Pinterest allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GS Pins for Pinterest: from n/a through 1.6.7.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/gs-pinterest-portfolio/vulnerability/wordpress-gs-pins-for-pinterest-plugin-1-6-7-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2023-32599
Published: 2024-12-13
Description: Missing Authorization vulnerability in Bill Minozzi reCAPTCHA for all allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects reCAPTCHA for all: from n/a through 1.22.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/recaptcha-for-all/vulnerability/wordpress-recaptcha-for-all-plugin-1-22-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2023-32601
Published: 2024-12-13
Description: Missing Authorization vulnerability in Booking Ultra Pro Booking Ultra Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking Ultra Pro: from n/a through 1.1.12.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/booking-ultra-pro/vulnerability/wordpress-booking-ultra-pro-appointments-booking-calendar-plugin-plugin-1-1-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2023-32798
Published: 2024-12-13
Description: Missing Authorization vulnerability in 10up Simple Page Ordering allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Page Ordering: from n/a through 2.5.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/simple-page-ordering/vulnerability/wordpress-simple-page-ordering-plugin-2-5-0-broken-access-control-vulnerability?_s_id=cve