deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-48747
Published: 2024-06-04
Description: Improper Authentication vulnerability in Pluggabl LLC Booster for WooCommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Booster for WooCommerce: from n/a through 7.1.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://patchstack.com/database/vulnerability/woocommerce-jetpack/wordpress-booster-for-woocommerce-plugin-7-1-2-authenticated-production-creation-modification-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-jetpack/wordpress-booster-for-woocommerce-plugin-7-1-2-authenticated-production-creation-modification-vulnerability?_s_id=cve
CVE: CVE-2023-48753
Published: 2024-06-04
Description: Authentication Bypass by Spoofing vulnerability in 10up Restricted Site Access allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Restricted Site Access: from n/a through 7.4.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-290
References: https://patchstack.com/database/vulnerability/restricted-site-access/wordpress-restricted-site-access-plugin-7-4-1-ip-restriction-bypass-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/restricted-site-access/wordpress-restricted-site-access-plugin-7-4-1-ip-restriction-bypass-vulnerability?_s_id=cve
CVE: CVE-2023-49741
Published: 2024-06-04
Description: Authentication Bypass by Spoofing vulnerability in wpdevart Coming soon and Maintenance mode allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Coming soon and Maintenance mode: from n/a through 3.7.3.
CVSS Score: 3.7 (LOW)
CWE: CWE-290
References: https://patchstack.com/database/vulnerability/coming-soon-page/wordpress-coming-soon-and-maintenance-mode-plugin-3-7-3-ip-filtering-bypass-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/coming-soon-page/wordpress-coming-soon-and-maintenance-mode-plugin-3-7-3-ip-filtering-bypass-vulnerability?_s_id=cve
CVE: CVE-2023-49748
Published: 2024-06-04
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPServeur, NicolasKulka, wpformation WPS Hide Login allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPS Hide Login: from n/a through 1.9.11.
CVSS Score: 3.7 (LOW)
CWE: CWE-200
References: https://patchstack.com/database/vulnerability/wps-hide-login/wordpress-wps-hide-login-plugin-1-9-11-secret-login-page-location-disclosure-on-multisites-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wps-hide-login/wordpress-wps-hide-login-plugin-1-9-11-secret-login-page-location-disclosure-on-multisites-vulnerability?_s_id=cve
CVE: CVE-2023-49774
Published: 2024-06-04
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Photo Album Plus: from n/a through 8.5.02.005.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://patchstack.com/database/vulnerability/wp-photo-album-plus/wordpress-wp-photo-album-plus-plugin-8-5-02-005-ip-bypass-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-photo-album-plus/wordpress-wp-photo-album-plus-plugin-8-5-02-005-ip-bypass-vulnerability?_s_id=cve
CVE: CVE-2023-49822
Published: 2024-06-04
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in David Vongries Ultimate Dashboard allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Ultimate Dashboard: from n/a through 3.7.10.
CVSS Score: 3.7 (LOW)
CWE: CWE-200
References: https://patchstack.com/database/vulnerability/ultimate-dashboard/wordpress-ultimate-dashboard-plugin-3-7-10-secret-login-page-location-disclosure-on-multisites-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ultimate-dashboard/wordpress-ultimate-dashboard-plugin-3-7-10-secret-login-page-location-disclosure-on-multisites-vulnerability?_s_id=cve
CVE: CVE-2023-49852
Published: 2024-06-04
Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Vsourz Digital Responsive Slick Slider WordPress allows Code Injection.This issue affects Responsive Slick Slider WordPress: from n/a through 1.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-80
References: https://patchstack.com/database/vulnerability/responsive-slick-slider/wordpress-responsive-slick-slider-wordpress-plugin-1-4-content-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/responsive-slick-slider/wordpress-responsive-slick-slider-wordpress-plugin-1-4-content-injection-vulnerability?_s_id=cve
CVE: CVE-2024-37052
Published: 2024-06-04
Description: Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user’s system when interacted with.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://hiddenlayer.com/sai-security-advisory/mlflow-june2024; https://hiddenlayer.com/sai-security-advisory/mlflow-june2024
CVE: CVE-2024-37053
Published: 2024-06-04
Description: Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user’s system when interacted with.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://hiddenlayer.com/sai-security-advisory/mlflow-june2024; https://hiddenlayer.com/sai-security-advisory/mlflow-june2024
CVE: CVE-2024-37054
Published: 2024-06-04
Description: Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to run arbitrary code on an end user’s system when interacted with.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://hiddenlayer.com/sai-security-advisory/mlflow-june2024; https://hiddenlayer.com/sai-security-advisory/mlflow-june2024
CVE: CVE-2024-37055
Published: 2024-06-04
Description: Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.24.0 or newer, enabling a maliciously uploaded pmdarima model to run arbitrary code on an end user’s system when interacted with.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://hiddenlayer.com/sai-security-advisory/mlflow-june2024; https://hiddenlayer.com/sai-security-advisory/mlflow-june2024
CVE: CVE-2024-37056
Published: 2024-06-04
Description: Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.23.0 or newer, enabling a maliciously uploaded LightGBM scikit-learn model to run arbitrary code on an end user’s system when interacted with.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://hiddenlayer.com/sai-security-advisory/mlflow-june2024; https://hiddenlayer.com/sai-security-advisory/mlflow-june2024
CVE: CVE-2024-37057
Published: 2024-06-04
Description: Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0rc0 or newer, enabling a maliciously uploaded Tensorflow model to run arbitrary code on an end user’s system when interacted with.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://hiddenlayer.com/sai-security-advisory/mlflow-june2024; https://hiddenlayer.com/sai-security-advisory/mlflow-june2024
CVE: CVE-2024-37058
Published: 2024-06-04
Description: Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously uploaded Langchain AgentExecutor model to run arbitrary code on an end user’s system when interacted with.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://hiddenlayer.com/sai-security-advisory/mlflow-june2024; https://hiddenlayer.com/sai-security-advisory/mlflow-june2024
CVE: CVE-2024-37059
Published: 2024-06-04
Description: Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously uploaded PyTorch model to run arbitrary code on an end user’s system when interacted with.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://hiddenlayer.com/sai-security-advisory/mlflow-june2024; https://hiddenlayer.com/sai-security-advisory/mlflow-june2024
CVE: CVE-2024-37060
Published: 2024-06-04
Description: Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.0 or newer, enabling a maliciously crafted Recipe to execute arbitrary code on an end user’s system when run.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://hiddenlayer.com/sai-security-advisory/mlflow-june2024; https://hiddenlayer.com/sai-security-advisory/mlflow-june2024
CVE: CVE-2024-37061
Published: 2024-06-04
Description: Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a maliciously crafted MLproject to execute arbitrary code on an end user’s system when run.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-94
References: https://hiddenlayer.com/sai-security-advisory/mlflow-june2024; https://hiddenlayer.com/sai-security-advisory/mlflow-june2024
CVE: CVE-2024-37062
Published: 2024-06-04
Description: Deserialization of untrusted data can occur in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library, enabling a malicously crafted report to run arbitrary code on an end user's system when loaded.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://hiddenlayer.com/sai-security-advisory/ydata-june2024; https://hiddenlayer.com/sai-security-advisory/ydata-june2024
CVE: CVE-2024-37063
Published: 2024-06-04
Description: A cross-site scripting (XSS) vulnerability in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library allows for payloads to be run when a maliocusly crafted report is viewed in the browser.
CVSS Score: 7.8 (HIGH)
CWE: CWE-79
References: https://hiddenlayer.com/sai-security-advisory/ydata-june2024; https://hiddenlayer.com/sai-security-advisory/ydata-june2024
CVE: CVE-2024-37064
Published: 2024-06-04
Description: Deseriliazation of untrusted data can occur in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library, enabling a maliciously crafted dataset to run arbitrary code on an end user's system when loaded.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://hiddenlayer.com/sai-security-advisory/ydata-june2024; https://hiddenlayer.com/sai-security-advisory/ydata-june2024
CVE: CVE-2024-37065
Published: 2024-06-04
Description: Deserialization of untrusted data can occur in versions 0.6 or newer of the skops python library, enabling a maliciously crafted model to run arbitrary code on an end user's system when loaded.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://hiddenlayer.com/sai-security-advisory/skops-june2024; https://hiddenlayer.com/sai-security-advisory/skops-june2024
CVE: CVE-2024-4254
Published: 2024-06-04
Description: The 'deploy-website.yml' workflow in the gradio-app/gradio repository, specifically in the 'main' branch, is vulnerable to secrets exfiltration due to improper authorization. The vulnerability arises from the workflow's explicit checkout and execution of code from a fork, which is unsafe as it allows the running of untrusted code in an environment with access to push to the base repository and access secrets. This flaw could lead to the exfiltration of sensitive secrets such as GITHUB_TOKEN, HF_TOKEN, VERCEL_ORG_ID, VERCEL_PROJECT_ID, COMMENT_TOKEN, AWSACCESSKEYID, AWSSECRETKEY, and VERCEL_TOKEN. The vulnerability is present in the workflow file located at https://github.com/gradio-app/gradio/blob/72f4ca88ab569aae47941b3fb0609e57f2e13a27/.github/workflows/deploy-website.yml.
CVSS Score: 7.1 (HIGH)
CWE: CWE-214
References: https://huntr.com/bounties/59873fbd-5698-4ec3-87f9-5d70c6055d01; https://huntr.com/bounties/59873fbd-5698-4ec3-87f9-5d70c6055d01
CVE: CVE-2023-51511
Published: 2024-06-04
Description: Improper Authentication vulnerability in Pluggabl LLC Booster Elite for WooCommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Booster Elite for WooCommerce: from n/a before 7.1.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://patchstack.com/database/vulnerability/booster-elite-for-woocommerce/wordpress-booster-elite-for-woocommerce-plugin-7-1-3-authenticated-production-creation-modification-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/booster-elite-for-woocommerce/wordpress-booster-elite-for-woocommerce-plugin-7-1-3-authenticated-production-creation-modification-vulnerability?_s_id=cve
CVE: CVE-2023-51542
Published: 2024-06-04
Description: Authentication Bypass by Spoofing vulnerability in WPMU DEV Branda allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Branda: from n/a through 3.4.14.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-290
References: https://patchstack.com/database/vulnerability/branda-white-labeling/wordpress-branda-plugin-3-4-14-ip-restriction-bypass-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/branda-white-labeling/wordpress-branda-plugin-3-4-14-ip-restriction-bypass-vulnerability?_s_id=cve
CVE: CVE-2023-51543
Published: 2024-06-04
Description: Authentication Bypass by Spoofing vulnerability in Metagauss RegistrationMagic allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects RegistrationMagic: from n/a through 5.2.5.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-290, CWE-290
References: https://patchstack.com/database/vulnerability/custom-registration-form-builder-with-submission-manager/wordpress-registrationmagic-plugin-5-2-5-0-ip-limit-bypass-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/custom-registration-form-builder-with-submission-manager/wordpress-registrationmagic-plugin-5-2-5-0-ip-limit-bypass-vulnerability?_s_id=cve
CVE: CVE-2023-51544
Published: 2024-06-04
Description: Improper Control of Interaction Frequency vulnerability in Metagauss RegistrationMagic allows Functionality Misuse.This issue affects RegistrationMagic: from n/a through 5.2.5.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-799
References: https://patchstack.com/database/vulnerability/custom-registration-form-builder-with-submission-manager/wordpress-registrationmagic-plugin-5-2-5-0-form-submission-limit-bypass-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/custom-registration-form-builder-with-submission-manager/wordpress-registrationmagic-plugin-5-2-5-0-form-submission-limit-bypass-vulnerability?_s_id=cve
CVE: CVE-2023-51667
Published: 2024-06-04
Description: Authentication Bypass by Spoofing vulnerability in FeedbackWP Rate my Post – WP Rating System allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Rate my Post – WP Rating System: from n/a through 3.4.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-290
References: https://patchstack.com/database/vulnerability/rate-my-post/wordpress-rate-my-post-wp-rating-system-plugin-3-4-2-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/rate-my-post/wordpress-rate-my-post-wp-rating-system-plugin-3-4-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2023-52147
Published: 2024-06-04
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in All In One WP Security & Firewall Team All In One WP Security & Firewall allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects All In One WP Security & Firewall: from n/a through 5.2.4.
CVSS Score: 3.7 (LOW)
CWE: CWE-200
References: https://patchstack.com/database/vulnerability/all-in-one-wp-security-and-firewall/wordpress-all-in-one-security-aios-plugin-5-2-4-secret-login-page-location-disclosure-on-multisites-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/all-in-one-wp-security-and-firewall/wordpress-all-in-one-security-aios-plugin-5-2-4-secret-login-page-location-disclosure-on-multisites-vulnerability?_s_id=cve
CVE: CVE-2023-52176
Published: 2024-06-04
Description: Authentication Bypass by Spoofing vulnerability in miniorange Malware Scanner allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Malware Scanner: from n/a through 4.7.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-290
References: https://patchstack.com/database/vulnerability/miniorange-malware-protection/wordpress-malware-scanner-plugin-4-7-1-ip-restriction-bypass-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/miniorange-malware-protection/wordpress-malware-scanner-plugin-4-7-1-ip-restriction-bypass-vulnerability?_s_id=cve
CVE: CVE-2024-25600
Published: 2024-06-04
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Codeer Limited Bricks Builder allows Code Injection.This issue affects Bricks Builder: from n/a through 1.9.6.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-94
References: https://github.com/Chocapikk/CVE-2024-25600; https://github.com/K3ysTr0K3R/CVE-2024-25600-EXPLOIT; https://patchstack.com/articles/critical-rce-patched-in-bricks-builder-theme?_s_id=cve
CVE: CVE-2024-29170
Published: 2024-06-04
Description: Dell PowerScale OneFS versions 8.2.x through 9.8.0.x contain a use of hard coded credentials vulnerability. An adjacent network unauthenticated attacker could potentially exploit this vulnerability, leading to information disclosure of network traffic and denial of service.
CVSS Score: 8.1 (HIGH)
CWE: CWE-798
References: https://www.dell.com/support/kbdoc/en-us/000225667/dsa-2024-210-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000225667/dsa-2024-210-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities
CVE: CVE-2024-33541
Published: 2024-06-04
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in BetterAddons Better Elementor Addons allows PHP Local File Inclusion.This issue affects Better Elementor Addons: from n/a through 1.4.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/better-elementor-addons/wordpress-better-elementor-addons-plugin-1-4-1-local-file-inclusion-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/better-elementor-addons/wordpress-better-elementor-addons-plugin-1-4-1-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-33557
Published: 2024-06-04
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in 8theme XStore Core allows PHP Local File Inclusion.This issue affects XStore Core: from n/a through 5.3.8.
CVSS Score: 8.5 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/et-core-plugin/wordpress-xstore-core-plugin-5-3-5-local-file-inclusion-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/et-core-plugin/wordpress-xstore-core-plugin-5-3-5-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-33560
Published: 2024-06-04
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in 8theme XStore allows PHP Local File Inclusion.This issue affects XStore: from n/a through 9.3.8.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/xstore/wordpress-xstore-theme-9-3-5-unauthenticated-local-file-inclusion-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/xstore/wordpress-xstore-theme-9-3-5-unauthenticated-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-36800
Published: 2024-06-04
Description: A SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via the ID parameter in Download.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/want1997/SEMCMS_VUL/blob/main/Download_sql_vul.md; https://github.com/want1997/SEMCMS_VUL/blob/main/Download_sql_vul.md
CVE: CVE-2024-36801
Published: 2024-06-04
Description: A SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via the lgid parameter in Download.php.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-89
References: https://github.com/want1997/SEMCMS_VUL/blob/main/Download_sql_vul_2.md; https://github.com/want1997/SEMCMS_VUL/blob/main/Download_sql_vul_2.md
CVE: CVE-2024-33568
Published: 2024-06-04
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Deserialization of Untrusted Data vulnerability in BdThemes Element Pack Pro allows Path Traversal, Object Injection.This issue affects Element Pack Pro: from n/a before 7.19.3.
CVSS Score: 8.5 (HIGH)
CWE: CWE-22, CWE-502, CWE-22
References: https://patchstack.com/database/vulnerability/bdthemes-element-pack/wordpress-element-pack-pro-plugin-7-7-4-arbitrary-file-read-and-phar-deserialization-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/bdthemes-element-pack/wordpress-element-pack-pro-plugin-7-7-4-arbitrary-file-read-and-phar-deserialization-vulnerability?_s_id=cve
CVE: CVE-2024-33628
Published: 2024-06-04
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in XforWooCommerce allows PHP Local File Inclusion.This issue affects XforWooCommerce: from n/a through 2.0.2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/xforwoocommerce/wordpress-xforwoocommerce-plugin-2-0-2-authenticated-local-file-inclusion-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/xforwoocommerce/wordpress-xforwoocommerce-plugin-2-0-2-authenticated-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-34384
Published: 2024-06-04
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in SinaExtra Sina Extension for Elementor allows PHP Local File Inclusion.This issue affects Sina Extension for Elementor: from n/a through 3.5.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/sina-extension-for-elementor/wordpress-sina-extension-for-elementor-plugin-3-5-1-local-file-inclusion-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/sina-extension-for-elementor/wordpress-sina-extension-for-elementor-plugin-3-5-1-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-34551
Published: 2024-06-04
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Select-Themes Stockholm allows PHP Local File Inclusion.This issue affects Stockholm: from n/a through 9.6.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://patchstack.com/database/vulnerability/stockholm/wordpress-stockholm-theme-9-6-unauthenticated-local-file-inclusion-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/stockholm/wordpress-stockholm-theme-9-6-unauthenticated-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-34552
Published: 2024-06-04
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Select-Themes Stockholm allows PHP Local File Inclusion.This issue affects Stockholm: from n/a through 9.6.
CVSS Score: 8.5 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/stockholm/wordpress-stockholm-theme-9-6-local-file-inclusion-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/stockholm/wordpress-stockholm-theme-9-6-local-file-inclusion-vulnerability?_s_id=cve