deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-47346
Published: 2024-10-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Newsletters newsletters-lite allows Reflected XSS.This issue affects Newsletters: from n/a through <= 4.9.9.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/newsletters-lite/vulnerability/wordpress-newsletters-plugin-4-9-9-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-47347
Published: 2024-10-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Chartify chart-builder allows Reflected XSS.This issue affects Chartify: from n/a through <= 2.7.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/chart-builder/vulnerability/wordpress-chartify-plugin-2-7-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-47348
Published: 2024-10-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YellowPencil YellowPencil Visual CSS Style Editor yellow-pencil-visual-theme-customizer allows Reflected XSS.This issue affects YellowPencil Visual CSS Style Editor: from n/a through <= 7.6.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/yellow-pencil-visual-theme-customizer/vulnerability/wordpress-visual-css-style-editor-plugin-7-6-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-47349
Published: 2024-10-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amauri WPMobile.App wpappninja.This issue affects WPMobile.App: from n/a through <= 11.50.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wpappninja/vulnerability/wordpress-wpmobile-app-plugin-11-50-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-47352
Published: 2024-10-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes WP Bulk Delete wp-bulk-delete allows Stored XSS.This issue affects WP Bulk Delete: from n/a through <= 1.3.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-bulk-delete/vulnerability/wordpress-wp-bulk-delete-plugin-1-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-47355
Published: 2024-10-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows Stored XSS.This issue affects Cozy Blocks: from n/a through <= 2.0.11.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/cozy-addons/vulnerability/wordpress-cozy-blocks-plugin-2-0-11-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-9553
Published: 2024-10-06
Description: A vulnerability classified as critical has been found in D-Link DIR-605L 2.13B01 BETA. This affects the function formdumpeasysetup of the file /goform/formdumpeasysetup. The manipulation of the argument curTime leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-605L/formdumpeasysetup.md; https://vuldb.com/?ctiid.279351; https://vuldb.com/?id.279351
CVE: CVE-2024-44041
Published: 2024-10-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Northern Beaches Websites IdeaPush ideapush allows Stored XSS.This issue affects IdeaPush: from n/a through <= 8.66.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ideapush/vulnerability/wordpress-ideapush-plugin-8-66-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-44042
Published: 2024-10-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fahad Mahmood WP Datepicker wp-datepicker allows Stored XSS.This issue affects WP Datepicker: from n/a through <= 2.1.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-datepicker/vulnerability/wordpress-wp-datepicker-plugin-2-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-44043
Published: 2024-10-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Photo Gallery by 10Web photo-gallery allows Stored XSS.This issue affects Photo Gallery by 10Web: from n/a through <= 1.8.27.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/photo-gallery/vulnerability/wordpress-photo-gallery-by-10web-mobile-friendly-image-gallery-plugin-1-8-27-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-44045
Published: 2024-10-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevon Adonis WP Abstracts wp-abstracts-manuscripts-manager allows Stored XSS.This issue affects WP Abstracts: from n/a through <= 2.6.5.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-abstracts-manuscripts-manager/vulnerability/wordpress-wp-abstracts-plugin-2-6-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-44046
Published: 2024-10-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify – WooCommerce Product Filter themify-wc-product-filter allows Stored XSS.This issue affects Themify – WooCommerce Product Filter: from n/a through <= 1.5.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/themify-wc-product-filter/vulnerability/wordpress-themify-plugin-1-5-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-45246
Published: 2024-10-06
Description: Diebold Nixdorf – CWE-427: Uncontrolled Search Path Element
CVSS Score: 7.3 (HIGH)
CWE: CWE-427
References: https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2024-45247
Published: 2024-10-06
Description: Sonarr – CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2024-45454
Published: 2024-10-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through <= 1.5.121.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/unlimited-elements-for-elementor/vulnerability/wordpress-unlimited-elements-for-elementor-plugin-1-5-121-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-47297
Published: 2024-10-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople CP Polls cp-polls allows Reflected XSS.This issue affects CP Polls: from n/a through <= 1.0.74.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/cp-polls/vulnerability/wordpress-polls-cp-plugin-1-0-74-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-47298
Published: 2024-10-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder bold-page-builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through <= 5.1.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/bold-page-builder/vulnerability/wordpress-bold-page-builder-plugin-5-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-47299
Published: 2024-10-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd coming-soon allows Stored XSS.This issue affects Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: from n/a through <= 6.17.4.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/coming-soon/vulnerability/wordpress-website-builder-by-seedprod-6-17-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-47300
Published: 2024-10-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Tauqeer CubeWP Forms cubewp-forms allows Stored XSS.This issue affects CubeWP Forms: from n/a through <= 1.1.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/cubewp-forms/vulnerability/wordpress-cubewp-forms-plugin-1-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-47301
Published: 2024-10-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bit Apps Bit Form bit-form allows Stored XSS.This issue affects Bit Form: from n/a through <= 2.13.10.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/bit-form/vulnerability/wordpress-bit-form-plugin-2-13-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-47306
Published: 2024-10-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Secure Copy Content Protection and Content Locking secure-copy-content-protection-subscribe-to-view allows Stored XSS.This issue affects Secure Copy Content Protection and Content Locking: from n/a through <= 4.2.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/secure-copy-content-protection-subscribe-to-view/vulnerability/wordpress-secure-copy-content-protection-and-content-locking-plugin-4-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-47307
Published: 2024-10-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Essential Plugin Meta slider and carousel with lightbox meta-slider-and-carousel-with-lightbox allows Stored XSS.This issue affects Meta slider and carousel with lightbox: from n/a through <= 2.0.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/meta-slider-and-carousel-with-lightbox/vulnerability/wordpress-meta-slider-and-carousel-with-lightbox-plugin-2-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-47310
Published: 2024-10-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arisoft ARI Fancy Lightbox ari-fancy-lightbox allows Stored XSS.This issue affects ARI Fancy Lightbox: from n/a through <= 1.3.17.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ari-fancy-lightbox/vulnerability/wordpress-ari-fancy-lightbox-popup-for-wordpress-plugin-1-3-17-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-47313
Published: 2024-10-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchthemes Catch Base catch-base allows Stored XSS.This issue affects Catch Base: from n/a through <= 3.4.6.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/catch-base/vulnerability/wordpress-catch-base-theme-3-4-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-47320
Published: 2024-10-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mark Westguard WS Form LITE ws-form allows Stored XSS.This issue affects WS Form LITE: from n/a through <= 1.9.238.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ws-form/vulnerability/wordpress-ws-form-lite-plugin-1-9-238-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-47322
Published: 2024-10-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ex-Themes WP Timeline – Vertical and Horizontal timeline plugin wp-timelines allows Reflected XSS.This issue affects WP Timeline – Vertical and Horizontal timeline plugin: from n/a through <= 3.6.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-timelines/vulnerability/wordpress-wp-timeline-plugin-3-6-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-9554
Published: 2024-10-06
Description: A vulnerability classified as problematic was found in Sovell Smart Canteen System up to 3.0.7303.30513. Affected by this vulnerability is the function Check_ET_CheckPwdz201 of the file suanfa.py of the component Password Reset Handler. The manipulation leads to authorization bypass. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.7 (LOW)
CWE: CWE-639
References: https://github.com/qieziwa/Code_vulnerability/blob/main/%E9%9B%84%E4%BC%9F-%E9%A4%90%E5%8E%85%E6%95%B0%E5%AD%97%E5%8C%96%E4%BB%BB%E6%84%8F%E5%AF%86%E7%A0%81%E9%87%8D%E7%BD%AE.md; https://vuldb.com/?ctiid.279361; https://vuldb.com/?id.279361
CVE: CVE-2024-44010
Published: 2024-10-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchthemes Full frame full-frame allows Stored XSS.This issue affects Full frame: from n/a through <= 2.7.2.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/full-frame/vulnerability/wordpress-full-frame-theme-2-7-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-44022
Published: 2024-10-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Trustmary Review & testimonial widgets trustmary allows Stored XSS.This issue affects Review & testimonial widgets: from n/a through <= 1.0.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/trustmary/vulnerability/wordpress-review-testimonial-widgets-plugin-1-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-44024
Published: 2024-10-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Medical Addon for Elementor medical-addon-for-elementor allows Stored XSS.This issue affects Medical Addon for Elementor: from n/a through <= 1.6.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/medical-addon-for-elementor/vulnerability/wordpress-medical-addon-for-elementor-plugin-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-44025
Published: 2024-10-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicejob NiceJob nicejob allows Stored XSS.This issue affects NiceJob: from n/a through < 3.6.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/nicejob/vulnerability/wordpress-nicejob-plugin-3-6-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-44026
Published: 2024-10-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Charity Addon for Elementor charity-addon-for-elementor allows Stored XSS.This issue affects Charity Addon for Elementor: from n/a through <= 1.3.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/charity-addon-for-elementor/vulnerability/wordpress-charity-addon-for-elementor-plugin-1-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-44027
Published: 2024-10-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atawai Gum Elementor Addon gum-elementor-addon allows Stored XSS.This issue affects Gum Elementor Addon: from n/a through <= 1.3.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/gum-elementor-addon/vulnerability/wordpress-gum-elementor-addon-plugin-1-3-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-44028
Published: 2024-10-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in nicejob NiceJob nicejob allows Stored XSS.This issue affects NiceJob: from n/a through < 3.6.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/nicejob/vulnerability/wordpress-nicejob-plugin-3-6-5-csrf-to-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-44029
Published: 2024-10-06
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in David Garlitz viala allows Reflected XSS.This issue affects viala: from n/a through 1.3.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/viala/wordpress-viala-theme-1-3-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-44032
Published: 2024-10-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Restaurant & Cafe Addon for Elementor restaurant-cafe-addon-for-elementor allows Stored XSS.This issue affects Restaurant & Cafe Addon for Elementor: from n/a through <= 1.5.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/restaurant-cafe-addon-for-elementor/vulnerability/wordpress-restaurant-cafe-addon-for-elementor-plugin-1-5-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-44033
Published: 2024-10-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Primary Addon for Elementor primary-addon-for-elementor allows Stored XSS.This issue affects Primary Addon for Elementor: from n/a through <= 1.5.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/primary-addon-for-elementor/vulnerability/wordpress-primary-addon-for-elementor-plugin-1-5-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-44035
Published: 2024-10-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atawai Gum Elementor Addon gum-elementor-addon allows Stored XSS.This issue affects Gum Elementor Addon: from n/a through <= 1.3.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/gum-elementor-addon/vulnerability/wordpress-gum-elementor-addon-plugin-1-3-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-44036
Published: 2024-10-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pierre Lebedel Kodex Posts likes kodex-posts-likes allows Stored XSS.This issue affects Kodex Posts likes: from n/a through <= 2.5.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/kodex-posts-likes/vulnerability/wordpress-kodex-posts-likes-plugin-2-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-44037
Published: 2024-10-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in magepeopleteam Multipurpose Ticket Booking Manager bus-booking-manager allows Stored XSS.This issue affects Multipurpose Ticket Booking Manager: from n/a through <= 4.2.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/bus-booking-manager/vulnerability/wordpress-multipurpose-ticket-booking-manager-plugin-4-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-44039
Published: 2024-10-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Travel WP Travel wp-travel allows Stored XSS.This issue affects WP Travel: from n/a through <= 9.3.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-travel/vulnerability/wordpress-wp-travel-ultimate-travel-booking-system-tour-management-engine-plugin-9-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-44040
Published: 2024-10-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in plainware ShiftController Employee Shift Scheduling shiftcontroller allows Stored XSS.This issue affects ShiftController Employee Shift Scheduling: from n/a through <= 4.9.64.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/shiftcontroller/vulnerability/wordpress-shiftcontroller-employee-shift-scheduling-plugin-4-9-64-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-45248
Published: 2024-10-06
Description: Multi-DNC – CWE-35: Path Traversal: '.../...//'
CVSS Score: 7.5 (HIGH)
CWE: CWE-35
References: https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2024-45249
Published: 2024-10-06
Description: Cavok – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2024-45250
Published: 2024-10-06
Description: ZKteco – CWE 200 Exposure of Sensitive Information to an Unauthorized Actor
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2024-45251
Published: 2024-10-06
Description: Elsight – CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2024-45252
Published: 2024-10-06
Description: Elsight – CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.gov.il/en/Departments/faq/cve_advisories
CVE: CVE-2024-47338
Published: 2024-10-06
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal WPExperts Square For GiveWP wpexperts-square-for-give allows SQL Injection.This issue affects WPExperts Square For GiveWP: from n/a through <= 1.3.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/wpexperts-square-for-give/vulnerability/wordpress-wpexperts-square-for-givewp-plugin-1-3-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-47350
Published: 2024-10-06
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YITHEMES YITH WooCommerce Ajax Search yith-woocommerce-ajax-search.This issue affects YITH WooCommerce Ajax Search: from n/a through <= 2.8.0.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/yith-woocommerce-ajax-search/vulnerability/wordpress-yith-woocommerce-ajax-search-plugin-2-8-0-sql-injection-vulnerability?_s_id=cve