deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-32833
Published: 2024-04-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nick Halsey List Custom Taxonomy Widget allows Stored XSS.This issue affects List Custom Taxonomy Widget: from n/a through 4.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/list-custom-taxonomy-widget/wordpress-list-custom-taxonomy-widget-plugin-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/list-custom-taxonomy-widget/wordpress-list-custom-taxonomy-widget-plugin-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32834
Published: 2024-04-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebToffee WooCommerce Shipping Label allows Stored XSS.This issue affects WooCommerce Shipping Label: from n/a through 2.3.8.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/shipping-labels-for-woo/wordpress-woocommerce-shipping-label-plugin-2-3-8-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/shipping-labels-for-woo/wordpress-woocommerce-shipping-label-plugin-2-3-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32950
Published: 2024-04-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DeBAAT WP Media Category Management allows Reflected XSS.This issue affects WP Media Category Management: from n/a through 2.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-media-category-management/wordpress-wp-media-category-management-plugin-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-media-category-management/wordpress-wp-media-category-management-plugin-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32952
Published: 2024-04-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BloomPixel Max Addons Pro for Bricks allows Reflected XSS.This issue affects Max Addons Pro for Bricks: from n/a through 1.6.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/max-addons-pro-bricks/wordpress-max-addons-pro-for-bricks-plugin-1-6-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/max-addons-pro-bricks/wordpress-max-addons-pro-for-bricks-plugin-1-6-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32956
Published: 2024-04-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rometheme RTMKit rometheme-for-elementor.This issue affects RTMKit: from n/a through <= 1.4.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/rometheme-for-elementor/vulnerability/wordpress-romethemekit-for-elementor-plugin-1-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/rometheme-for-elementor/wordpress-romethemekit-for-elementor-plugin-1-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32721
Published: 2024-04-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jegtheme Jeg Elementor Kit allows Stored XSS.This issue affects Jeg Elementor Kit: from n/a through 2.6.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/jeg-elementor-kit/wordpress-jeg-elementor-kit-plugin-2-6-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/jeg-elementor-kit/wordpress-jeg-elementor-kit-plugin-2-6-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32722
Published: 2024-04-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Coupon & Discount Code Reveal Button allows Stored XSS.This issue affects Coupon & Discount Code Reveal Button: from n/a through 1.2.5.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/coupon-reveal-button/wordpress-coupon-discount-code-reveal-button-plugin-1-2-5-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/coupon-reveal-button/wordpress-coupon-discount-code-reveal-button-plugin-1-2-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32723
Published: 2024-04-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Code Tides Advanced Floating Content allows Stored XSS.This issue affects Advanced Floating Content: from n/a through 1.2.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/advanced-floating-content-lite/wordpress-advanced-floating-content-plugin-1-2-5-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/advanced-floating-content-lite/wordpress-advanced-floating-content-plugin-1-2-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-45852
Published: 2024-04-24
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in FormAssembly / Drew Buschhorn WP-FormAssembly allows Path Traversal.This issue affects WP-FormAssembly: from n/a through 2.0.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/formassembly-web-forms/wordpress-wp-formassembly-plugin-2-0-5-auth-arbitrary-file-read-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/formassembly-web-forms/wordpress-wp-formassembly-plugin-2-0-5-auth-arbitrary-file-read-vulnerability?_s_id=cve
CVE: CVE-2023-23976
Published: 2024-04-24
Description: Incorrect Default Permissions vulnerability in Metagauss RegistrationMagic allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects RegistrationMagic: from n/a through 5.1.9.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-276
References: https://patchstack.com/database/vulnerability/custom-registration-form-builder-with-submission-manager/wordpress-registrationmagic-custom-registration-forms-user-registration-and-user-login-plugin-plugin-5-1-9-2-arbitrary-price-change?_s_id=cve; https://patchstack.com/database/vulnerability/custom-registration-form-builder-with-submission-manager/wordpress-registrationmagic-custom-registration-forms-user-registration-and-user-login-plugin-plugin-5-1-9-2-arbitrary-price-change?_s_id=cve
CVE: CVE-2023-23985
Published: 2024-04-24
Description: Missing Authorization vulnerability in Quiz Maker team Quiz Maker.This issue affects Quiz Maker: from n/a through 6.3.9.4.
CVSS Score: 3.7 (LOW)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/quiz-maker/wordpress-quiz-maker-plugin-6-3-9-4-content-spoofing?_s_id=cve; https://patchstack.com/database/vulnerability/quiz-maker/wordpress-quiz-maker-plugin-6-3-9-4-content-spoofing?_s_id=cve
CVE: CVE-2024-32702
Published: 2024-04-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reputeinfosystems ARForms arforms.This issue affects ARForms: from n/a through <= 6.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/arforms/vulnerability/wordpress-arforms-plugin-6-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/arforms/wordpress-arforms-plugin-6-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32707
Published: 2024-04-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Image Slider Widget allows Stored XSS.This issue affects Image Slider Widget: from n/a through 1.1.125.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/image-slider-widget/wordpress-image-slider-plugin-1-1-125-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/image-slider-widget/wordpress-image-slider-plugin-1-1-125-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32711
Published: 2024-04-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal myCred mycred.This issue affects myCred: from n/a through <= 2.6.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/mycred/vulnerability/wordpress-mycred-plugin-2-6-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/mycred/wordpress-mycred-plugin-2-6-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32772
Published: 2024-04-24
Description: Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.9.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://patchstack.com/database/vulnerability/profilegrid-user-profiles-groups-and-communities/wordpress-profilegrid-plugin-5-7-9-insecure-direct-object-references-idor-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/profilegrid-user-profiles-groups-and-communities/wordpress-profilegrid-plugin-5-7-9-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE: CVE-2024-32785
Published: 2024-04-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Webangon The Pack Elementor addons allows Cross-Site Scripting (XSS).This issue affects The Pack Elementor addons: from n/a through 2.0.8.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/the-pack-addon/wordpress-the-pack-elementor-addons-plugin-2-0-8-3-cross-site-request-forgery-csrf-to-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/the-pack-addon/wordpress-the-pack-elementor-addons-plugin-2-0-8-3-cross-site-request-forgery-csrf-to-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32789
Published: 2024-04-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Seers allows Cross-Site Scripting (XSS).This issue affects Seers: from n/a through 8.1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/seers-cookie-consent-banner-privacy-policy/wordpress-seers-plugin-8-0-6-cross-site-request-forgery-csrf-to-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/seers-cookie-consent-banner-privacy-policy/wordpress-seers-plugin-8-0-6-cross-site-request-forgery-csrf-to-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32808
Published: 2024-04-24
Description: Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.9.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-639
References: https://patchstack.com/database/vulnerability/profilegrid-user-profiles-groups-and-communities/wordpress-profilegrid-plugin-5-7-9-insecure-direct-object-reference-idor-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/profilegrid-user-profiles-groups-and-communities/wordpress-profilegrid-plugin-5-7-9-insecure-direct-object-reference-idor-vulnerability?_s_id=cve
CVE: CVE-2024-32823
Published: 2024-04-24
Description: Authorization Bypass Through User-Controlled Key vulnerability in FeedbackWP Rate my Post – WP Rating System.This issue affects Rate my Post – WP Rating System: from n/a through 3.4.4.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://patchstack.com/database/vulnerability/rate-my-post/wordpress-rate-my-post-plugin-3-4-4-insecure-direct-object-references-idor-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/rate-my-post/wordpress-rate-my-post-plugin-3-4-4-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE: CVE-2024-32954
Published: 2024-04-24
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Tribulant Newsletters.This issue affects Newsletters: from n/a through 4.9.5.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/newsletters-lite/wordpress-newsletters-plugin-4-9-5-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/newsletters-lite/wordpress-newsletters-plugin-4-9-5-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-28825
Published: 2024-04-24
Description: Improper restriction of excessive authentication attempts on some authentication methods in Checkmk before 2.3.0b5 (beta), 2.2.0p26, 2.1.0p43, and in Checkmk 2.0.0 (EOL) facilitates password brute-forcing.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-307, CWE-307
References: https://checkmk.com/werk/15198; https://checkmk.com/werk/15198
CVE: CVE-2024-4111
Published: 2024-04-24
Description: A vulnerability was found in Tenda TX9 22.03.02.10. It has been rated as critical. Affected by this issue is the function sub_42BD7C of the file /goform/SetLEDCfg. The manipulation of the argument time leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-261854 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/TX9/SetLEDCfg.md; https://vuldb.com/?ctiid.261854; https://vuldb.com/?id.261854
CVE: CVE-2023-23989
Published: 2024-04-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss RegistrationMagic.This issue affects RegistrationMagic: from n/a through 5.1.9.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/custom-registration-form-builder-with-submission-manager/wordpress-registrationmagic-custom-registration-forms-user-registration-and-user-login-plugin-plugin-5-1-9-2-content-injection?_s_id=cve; https://patchstack.com/database/vulnerability/custom-registration-form-builder-with-submission-manager/wordpress-registrationmagic-custom-registration-forms-user-registration-and-user-login-plugin-plugin-5-1-9-2-content-injection?_s_id=cve
CVE: CVE-2023-25785
Published: 2024-04-24
Description: Missing Authorization vulnerability in Shoaib Saleem WP Post Rating allows Functionality Misuse.This issue affects WP Post Rating: from n/a through 2.5.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/wp-post-comment-rating/wordpress-wp-post-rating-plugin-2-4-5-vote-manipulation-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-post-comment-rating/wordpress-wp-post-rating-plugin-2-4-5-vote-manipulation-vulnerability?_s_id=cve
CVE: CVE-2024-32699
Published: 2024-04-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in YITHEMES YITH WooCommerce Compare yith-woocommerce-compare.This issue affects YITH WooCommerce Compare: from n/a through <= 2.37.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/yith-woocommerce-compare/vulnerability/wordpress-yith-woocommerce-compare-plugin-2-37-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/yith-woocommerce-compare/wordpress-yith-woocommerce-compare-plugin-2-37-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-32728
Published: 2024-04-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Paid Member Subscriptions.This issue affects Paid Member Subscriptions: from n/a through 2.11.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/paid-member-subscriptions/wordpress-paid-membership-subscriptions-plugin-2-11-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/paid-member-subscriptions/wordpress-paid-membership-subscriptions-plugin-2-11-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-32773
Published: 2024-04-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in WP Royal Royal Elementor Kit.This issue affects Royal Elementor Kit: from n/a through 1.0.116.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/royal-elementor-kit/wordpress-royal-elementor-kit-theme-1-0-116-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/royal-elementor-kit/wordpress-royal-elementor-kit-theme-1-0-116-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-32793
Published: 2024-04-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 2.12.10.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/paid-memberships-pro/wordpress-paid-memberships-pro-plugin-2-12-10-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/paid-memberships-pro/wordpress-paid-memberships-pro-plugin-2-12-10-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-32794
Published: 2024-04-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 2.12.10.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/paid-memberships-pro/wordpress-paid-memberships-pro-plugin-2-12-10-cross-site-request-forgery-csrf-vulnerability-2?_s_id=cve; https://patchstack.com/database/vulnerability/paid-memberships-pro/wordpress-paid-memberships-pro-plugin-2-12-10-cross-site-request-forgery-csrf-vulnerability-2?_s_id=cve
CVE: CVE-2024-32795
Published: 2024-04-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Revmakx WPCal.Io – Easy Meeting Scheduler.This issue affects WPCal.Io – Easy Meeting Scheduler: from n/a through 0.9.5.8.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wpcal/wordpress-wpcal-io-0-9-5-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wpcal/wordpress-wpcal-io-0-9-5-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-32806
Published: 2024-04-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in CoSchedule Headline Analyzer.This issue affects Headline Analyzer: from n/a through 1.3.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/headline-analyzer/wordpress-headline-analyzer-plugin-1-3-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/headline-analyzer/wordpress-headline-analyzer-plugin-1-3-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-32872
Published: 2024-04-24
Description: Umbraco workflow provides workflows for the Umbraco content management system. Prior to versions 10.3.9, 12.2.6, and 13.0.6, an Umbraco Backoffice user can modify requests to a particular API endpoint to include SQL, which will be executed by the server. Umbraco Workflow versions 10.3.9, 12.2.6, 13.0.6, as well as Umbraco Plumber version 10.1.2, contain a patch for this issue.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/umbraco/Umbraco.Workflow.Issues/security/advisories/GHSA-287f-46j7-j4wh; https://github.com/umbraco/Umbraco.Workflow.Issues/security/advisories/GHSA-287f-46j7-j4wh
CVE: CVE-2024-32947
Published: 2024-04-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in AlumniOnline Web Services LLC WP ADA Compliance Check Basic.This issue affects WP ADA Compliance Check Basic: from n/a through 3.1.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-ada-compliance-check-basic/wordpress-wp-ada-compliance-check-basic-plugin-3-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-ada-compliance-check-basic/wordpress-wp-ada-compliance-check-basic-plugin-3-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-32958
Published: 2024-04-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Giorgos Sarigiannidis Slash Admin allows Cross-Site Scripting (XSS).This issue affects Slash Admin: from n/a through 3.8.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/slash-admin/wordpress-slash-admin-plugin-3-8-1-csrf-to-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/slash-admin/wordpress-slash-admin-plugin-3-8-1-csrf-to-xss-vulnerability?_s_id=cve
CVE: CVE-2024-4112
Published: 2024-04-24
Description: A vulnerability classified as critical has been found in Tenda TX9 22.03.02.10. This affects the function sub_42CB94 of the file /goform/SetVirtualServerCfg. The manipulation of the argument list leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-261855. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/TX9/formSetVirtualSer.md; https://vuldb.com/?ctiid.261855; https://vuldb.com/?id.261855
CVE: CVE-2024-4113
Published: 2024-04-24
Description: A vulnerability classified as critical was found in Tenda TX9 22.03.02.10. This vulnerability affects the function sub_42D4DC of the file /goform/SetSysTimeCfg. The manipulation of the argument time leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-261856. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/TX9/fromSetSysTime.md; https://vuldb.com/?ctiid.261856; https://vuldb.com/?id.261856
CVE: CVE-2024-4114
Published: 2024-04-24
Description: A vulnerability, which was classified as critical, has been found in Tenda TX9 22.03.02.10. This issue affects the function sub_42C014 of the file /goform/PowerSaveSet. The manipulation of the argument time leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-261857 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/TX9/setSmartPowerManagement.md; https://vuldb.com/?ctiid.261857; https://vuldb.com/?id.261857
CVE: CVE-2023-25790
Published: 2024-04-24
Description: Improper Authentication, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xtemos WoodMart allows Cross-Site Scripting (XSS).This issue affects WoodMart: from n/a through 7.0.4.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-79, CWE-287
References: https://patchstack.com/database/vulnerability/woodmart/wordpress-woodmart-theme-7-0-4-unauth-arbitrary-shortcodes-injection?_s_id=cve; https://patchstack.com/database/vulnerability/woodmart/wordpress-woodmart-theme-7-0-4-unauth-arbitrary-shortcodes-injection?_s_id=cve