deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-21282
Published: 2024-10-15
Description: Vulnerability in the Oracle Financials product of Oracle E-Business Suite (component: Common Components).  Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financials.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Financials accessible data as well as  unauthorized access to critical data or complete access to all Oracle Financials accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVSS Score: 8.1 (HIGH)
CWE: CWE-863
References: https://www.oracle.com/security-alerts/cpuoct2024.html
CVE: CVE-2024-21283
Published: 2024-10-15
Description: Vulnerability in the PeopleSoft Enterprise HCM Global Payroll Core product of Oracle PeopleSoft (component: Global Payroll for Core).  Supported versions that are affected are 9.2.48-9.2.50. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise HCM Global Payroll Core.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise HCM Global Payroll Core accessible data as well as  unauthorized access to critical data or complete access to all PeopleSoft Enterprise HCM Global Payroll Core accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVSS Score: 8.1 (HIGH)
CWE: CWE-863
References: https://www.oracle.com/security-alerts/cpuoct2024.html
CVE: CVE-2024-21284
Published: 2024-10-15
Description: Vulnerability in the Oracle Banking Liquidity Management product of Oracle Financial Services Applications (component: Reports).   The supported version that is affected is 14.5.0.12.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Liquidity Management.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Banking Liquidity Management. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H).
CVSS Score: 7.1 (HIGH)
CWE: CWE-863
References: https://www.oracle.com/security-alerts/cpuoct2024.html
CVE: CVE-2024-21285
Published: 2024-10-15
Description: Vulnerability in the Oracle Banking Liquidity Management product of Oracle Financial Services Applications (component: Reports).   The supported version that is affected is 14.5.0.12.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Liquidity Management.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Banking Liquidity Management. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H).
CVSS Score: 7.1 (HIGH)
CWE: CWE-863
References: https://www.oracle.com/security-alerts/cpuoct2024.html
CVE: CVE-2024-21286
Published: 2024-10-15
Description: Vulnerability in the PeopleSoft Enterprise ELM Enterprise Learning Management product of Oracle PeopleSoft (component: Enterprise Learning Management).   The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise ELM Enterprise Learning Management.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise ELM Enterprise Learning Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise ELM Enterprise Learning Management accessible data as well as  unauthorized read access to a subset of PeopleSoft Enterprise ELM Enterprise Learning Management accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
CVSS Score: 5.4 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpuoct2024.html
CVE: CVE-2024-44337
Published: 2024-10-15
Description: The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Prior to pseudoversion `v0.0.0[PII_REDACTED]2818-a2a9c4f`, which corresponds with commit `a2a9c4f76ef5a5c32108e36f7c47f8d310322252`, there was a logical problem in the paragraph function of the parser/block.go file, which allowed a remote attacker to cause a denial of service (DoS) condition by providing a tailor-made input that caused an infinite loop, causing the program to hang and consume resources indefinitely. Submit `a2a9c4f76ef5a5c32108e36f7c47f8d310322252` contains fixes to this problem.
CVSS Score: 5.1 (MEDIUM)
References: https://github.com/Brinmon/CVE-2024-44337; https://github.com/gomarkdown/markdown/commit/a2a9c4f76ef5a5c32108e36f7c47f8d310322252
CVE: CVE-2024-49195
Published: 2024-10-15
Description: Mbed TLS 3.5.x through 3.6.x before 3.6.2 has a buffer underrun in pkwrite when writing an opaque key pair
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2024-10-1/; https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/
CVE: CVE-2024-31955
Published: 2024-10-15
Description: An issue was discovered in Samsung eMMC with KLMAG2GE4A and KLM8G1WEMB firmware. Code bypass through Electromagnetic Fault Injection allows an attacker to successfully authenticate and write to the RPMB (Replay Protected Memory Block) area without possessing secret information.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-295
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2024-41311
Published: 2024-10-15
Description: In Libheif 1.17.6, insufficient checks in ImageOverlay::parse() decoding a heif file containing an overlay image with forged offsets can lead to an out-of-bounds read and write.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125, CWE-787, CWE-125, CWE-787
References: https://gist.github.com/flyyee/79f1b224069842ee320115cafa5c35c0; https://github.com/strukturag/libheif/commit/a3ed1b1eb178c5d651d6ac619c8da3d71ac2be36; https://github.com/strukturag/libheif/issues/1226
CVE: CVE-2024-44775
Published: 2024-10-15
Description: kmqtt v0.2.7 is vulnerable to Denial of Service (DoS) due to a Null Pointer Exception. A remote attacker can cause the broker to crash by sending a specially crafted MQTT CONNECT packet that triggers an unhandled null reference, leading to an immediate process termination.
CVSS Score: 7.5 (HIGH)
CWE: CWE-444
References: https://gist.github.com/pengwGit/26fd8630392af5d8829c2e220091ac4f
CVE: CVE-2024-48411
Published: 2024-10-15
Description: itsourcecode Online Tours and Travels Management System v1.0 is vulnerable to SQL Injection (SQLI) via a crafted payload to the val-email parameter in forget_password.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/Comitora/CVEs/blob/main/CVE-2024-48411
CVE: CVE-2024-48710
Published: 2024-10-15
Description: In TP-Link TL-WDR7660 1.0, the wlanTimerRuleJsonToBin function handles the parameter string name without checking it, which can lead to stack overflow vulnerabilities.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/sezangel/IOT-vul/blob/main/TPlink/TL-WDR7660/1/readme.md
CVE: CVE-2024-48712
Published: 2024-10-15
Description: In TP-Link TL-WDR7660 1.0, the rtRuleJsonToBin function handles the parameter string name without checking it, which can lead to stack overflow vulnerabilities.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/sezangel/IOT-vul/blob/main/TPlink/TL-WDR7660/3/readme.md
CVE: CVE-2024-48713
Published: 2024-10-15
Description: In TP-Link TL-WDR7660 1.0, the wacWhitelistJsonToBin function handles the parameter string name without checking it, which can lead to stack overflow vulnerabilities.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/sezangel/IOT-vul/blob/main/TPlink/TL-WDR7660/4/read.md
CVE: CVE-2024-48714
Published: 2024-10-15
Description: In TP-Link TL-WDR7660 v1.0, the guestRuleJsonToBin function handles the parameter string name without checking it, which can lead to stack overflow vulnerabilities.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/sezangel/IOT-vul/tree/main/TPlink/TL-WDR7660/2
CVE: CVE-2024-48779
Published: 2024-10-15
Description: An issue in Wanxing Technology's Yitu project Management Software 3.2.2 allows a remote attacker to execute arbitrary code via the platformpluginpath parameter to specify that the qt plugin loads the directory.
CVSS Score: 9.8 (CRITICAL)
References: https://gist.github.com/zty-1995/3fcdf702017ad6721e5011f74c1f6cee
CVE: CVE-2024-48781
Published: 2024-10-15
Description: An issue in Wanxing Technology Yitu Project Management Kirin Edition 2.3.6 allows a remote attacker to execute arbitrary code via a specially constructed so file/opt/EdrawProj-2/plugins/imageformat.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://gist.github.com/zty-1995/a7948be24b3411759a6afa3cc616dc12
CVE: CVE-2024-48782
Published: 2024-10-15
Description: File Upload vulnerability in DYCMS Open-Source Version v2.0.9.41 allows a remote attacker to execute arbitrary code via the application only detecting the extension of image files in the front-end.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://gist.github.com/zty-1995/7750a2ea1231971f973f02dc4c893b46
CVE: CVE-2024-48783
Published: 2024-10-15
Description: An issue in Ruijie NBR3000D-E Gateway allows a remote attacker to obtain sensitive information via the /tool/shell/postgresql.conf component.
CVSS Score: 7.5 (HIGH)
CWE: CWE-922
References: https://gist.github.com/zty-1995/8495b81e8d257e8f6df102a32ec3c583
CVE: CVE-2024-9486
Published: 2024-10-15
Description: A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image build process. Virtual machine images built using the Proxmox provider do not disable these default credentials, and nodes using the resulting images may be accessible via these default credentials. The credentials can be used to gain root access. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project with its Proxmox provider.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://github.com/kubernetes-sigs/image-builder/pull/1595; https://github.com/kubernetes/kubernetes/issues/128006; https://groups.google.com/g/kubernetes-security-announce/c/UKJG-oZogfA/m/Lu1hcnHmAQAJ
CVE: CVE-2024-9594
Published: 2024-10-15
Description: A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image build process when using the Nutanix, OVA, QEMU or raw providers. The credentials can be used to gain root access. The credentials are disabled at the conclusion of the image build process. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project. Because these images were vulnerable during the image build process, they are affected only if an attacker was able to reach the VM where the image build was happening and used the vulnerability to modify the image at the time the image build was occurring.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-798, CWE-798
References: https://github.com/kubernetes-sigs/image-builder/pull/1596; https://github.com/kubernetes/kubernetes/issues/128007; https://groups.google.com/g/kubernetes-security-announce/c/UKJG-oZogfA/m/Lu1hcnHmAQAJ
CVE: CVE-2024-9954
Published: 2024-10-15
Description: Use after free in AI in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_15.html; https://issues.chromium.org/issues/367755363
CVE: CVE-2024-9955
Published: 2024-10-15
Description: Use after free in WebAuthentication in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_15.html; https://issues.chromium.org/issues/370133761
CVE: CVE-2024-9956
Published: 2024-10-15
Description: Inappropriate implementation in WebAuthentication in Google Chrome on Android prior to 130.0.6723.58 allowed a local attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 7.8 (HIGH)
References: https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_15.html; https://issues.chromium.org/issues/370482421; http://seclists.org/fulldisclosure/2025/Jan/13
CVE: CVE-2024-9957
Published: 2024-10-15
Description: Use after free in UI in Google Chrome on iOS prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_15.html; https://issues.chromium.org/issues/358151317
CVE: CVE-2024-9958
Published: 2024-10-15
Description: Inappropriate implementation in PictureInPicture in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_15.html; https://issues.chromium.org/issues/40076120
CVE: CVE-2024-9959
Published: 2024-10-15
Description: Use after free in DevTools in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_15.html; https://issues.chromium.org/issues/368672129
CVE: CVE-2024-9960
Published: 2024-10-15
Description: Use after free in Dawn in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 7.5 (HIGH)
CWE: CWE-416, CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_15.html; https://issues.chromium.org/issues/354748063
CVE: CVE-2024-9961
Published: 2024-10-15
Description: Use after free in ParcelTracking in Google Chrome on iOS prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_15.html; https://issues.chromium.org/issues/357776197
CVE: CVE-2024-9962
Published: 2024-10-15
Description: Inappropriate implementation in Permissions in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_15.html; https://issues.chromium.org/issues/364508693
CVE: CVE-2024-9963
Published: 2024-10-15
Description: Insufficient data validation in Downloads in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_15.html; https://issues.chromium.org/issues/328278718
CVE: CVE-2024-9964
Published: 2024-10-15
Description: Inappropriate implementation in Payments in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_15.html; https://issues.chromium.org/issues/361711121
CVE: CVE-2024-9965
Published: 2024-10-15
Description: Insufficient data validation in DevTools in Google Chrome on Windows prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 8.8 (HIGH)
References: https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_15.html; https://issues.chromium.org/issues/352651673
CVE: CVE-2024-9966
Published: 2024-10-15
Description: Inappropriate implementation in Navigations in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 5.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_15.html; https://issues.chromium.org/issues/364773822
CVE: CVE-2024-10004
Published: 2024-10-15
Description: Opening an external link to an HTTP website when Firefox iOS was previously closed and had an HTTPS tab open could in some cases result in the padlock icon showing an HTTPS indicator incorrectly This vulnerability affects Firefox for iOS < 131.2.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-1021
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1904885; https://www.mozilla.org/security/advisories/mfsa2024-54/
CVE: CVE-2024-45085
Published: 2024-10-15
Description: IBM WebSphere Application Server 8.5 is vulnerable to a denial of service, under certain configurations, caused by an unexpected specially crafted request. A remote attacker could exploit this vulnerability to cause an error resulting in a denial of service.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-754
References: https://www.ibm.com/support/pages/node/7173128
CVE: CVE-2024-38139
Published: 2024-10-15
Description: Improper authentication in Microsoft Dataverse allows an authorized attacker to elevate privileges over a network.
CVSS Score: 8.7 (HIGH)
CWE: CWE-287
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38139
CVE: CVE-2024-38190
Published: 2024-10-15
Description: Missing authorization in Power Platform allows an unauthenticated attacker to view sensitive information through a network attack vector.
CVSS Score: 8.6 (HIGH)
CWE: CWE-862
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38190
CVE: CVE-2024-38204
Published: 2024-10-15
Description: Improper access control in Imagine Cup allows an authorized attacker to elevate privileges over a network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38204
CVE: CVE-2024-49340
Published: 2024-10-16
Description: IBM Watson Studio Local 1.2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://www.ibm.com/support/pages/node/1144438
CVE: CVE-2024-8541
Published: 2024-10-16
Description: The Discount Rules for WooCommerce – Create Smart WooCommerce Coupons & Discounts, Bulk Discount, BOGO Coupons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.6.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a site administrator into performing an action such as clicking on a link. Please note that this is only exploitable when the 'Leave a Review' notice is present, which occurs after 100 orders are made and disappears after a user dismisses the notice.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/woo-discount-rules/tags/2.6.5/v2/App/Views/Admin/review-notice.php; https://plugins.trac.wordpress.org/changeset/3149013/; https://www.wordfence.com/threat-intel/vulnerabilities/id/3529044f-c3d8-4370-8ba5-9df0fb71ab3c?source=cve
CVE: CVE-2024-8787
Published: 2024-10-16
Description: The Smart Online Order for Clover plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.5.7. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/clover-online-orders/tags/1.5.7/admin/includes/class-moo-products-list.php#L572; https://plugins.trac.wordpress.org/browser/clover-online-orders/tags/1.5.7/admin/moo-OnlineOrders-admin.php#L477; https://plugins.trac.wordpress.org/changeset/3168446/clover-online-orders/tags/1.5.8/admin/includes/class-moo-products-list.php?old=3142847&old_path=clover-online-orders%2Ftags%2F1.5.7%2Fadmin%2Fincludes%2Fclass-moo-products-list.php
CVE: CVE-2024-9104
Published: 2024-10-16
Description: The UltimateAI plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.8.3. This is due to the improper empty value check and a missing default activated value check in the 'ultimate_ai_change_pass' function. This makes it possible for unauthenticated attackers to reset the password of the first user, whose account is not yet activated or the first user who activated their account, who are subscribers.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-703
References: https://codecanyon.net/item/ultimateai-ai-enhanced-wordpress-plugin-with-saas-for-content-code-chat-and-image-generation/51201953; https://www.wordfence.com/threat-intel/vulnerabilities/id/3faf976d-0763-4e47-9bc3-18c791ec4487?source=cve
CVE: CVE-2024-9105
Published: 2024-10-16
Description: The UltimateAI plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.8.3. This is due to insufficient verification on the user being supplied in the 'ultimate_ai_register_or_login_with_google' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://codecanyon.net/item/ultimateai-ai-enhanced-wordpress-plugin-with-saas-for-content-code-chat-and-image-generation/51201953; https://www.wordfence.com/threat-intel/vulnerabilities/id/c2475643-a0b4-444a-a2c6-a5c45e90e1dd?source=cve