deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-38335
Published: 2023-07-20
Description: Omnis Studio 10.22.00 has incorrect access control. It advertises a feature for making Omnis libraries "always private" - this is supposed to be an irreversible operation. However, due to implementation issues, "always private" Omnis libraries can be opened by the Omnis Studio browser by bypassing specific checks. This violates the expected behavior of an "irreversible operation".
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-276
References: http://packetstormsecurity.com/files/173695/Omnis-Studio-10.22.00-Library-Setting-Bypass.html; http://seclists.org/fulldisclosure/2023/Jul/41; http://seclists.org/fulldisclosure/2023/Jul/43
CVE: CVE-2023-3791
Published: 2023-07-20
Description: A vulnerability was found in IBOS OA 4.5.5 and classified as critical. Affected by this issue is the function actionExport of the file ?r=contact/default/export of the component Personal Office Address Book. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-235058 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/zry-wyj/cve/blob/main/ibos.md; https://vuldb.com/?ctiid.235058; https://vuldb.com/?id.235058
CVE: CVE-2023-37164
Published: 2023-07-20
Description: Diafan CMS v6.0 was discovered to contain a reflected cross-site scripting via the cat_id parameter at /shop/?module=shop&action=search.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/51529; https://www.exploit-db.com/exploits/51529
CVE: CVE-2023-37165
Published: 2023-07-20
Description: Millhouse-Project v1.414 was discovered to contain a remote code execution (RCE) vulnerability via the component /add_post_sql.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/51450; https://www.exploit-db.com/exploits/51450
CVE: CVE-2023-37600
Published: 2023-07-20
Description: Office Suite Premium Version v10.9.1.42602 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the id parameter at /api?path=profile.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/173143/Office-Suite-Premium-10.9.1.42602-Cross-Site-Scripting.html; https://packetstormsecurity.com/files/173143/Office-Suite-Premium-10.9.1.42602-Cross-Site-Scripting.html
CVE: CVE-2023-37601
Published: 2023-07-20
Description: Office Suite Premium v10.9.1.42602 was discovered to contain a local file inclusion (LFI) vulnerability via the component /etc/hosts.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://packetstormsecurity.com/files/173146/Office-Suite-Premium-10.9.1.42602-Local-File-Inclusion.html; https://packetstormsecurity.com/files/173146/Office-Suite-Premium-10.9.1.42602-Local-File-Inclusion.html
CVE: CVE-2023-37602
Published: 2023-07-20
Description: An arbitrary file upload vulnerability in the component /workplace#!explorer of Alkacon OpenCMS v15.0 allows attackers to execute arbitrary code via uploading a crafted PNG file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/51564; https://www.exploit-db.com/exploits/51564
CVE: CVE-2023-38523
Published: 2023-07-20
Description: The web interface on multiple Samsung Harman AMX N-Series devices allows directory listing for the /tmp/ directory, without authentication, exposing sensitive information such as the command history and screenshot of the file being processed. This affects N-Series N1115 Wallplate Video Encoder before 1.15.61, N-Series N1x22A Video Encoder/Decoder before 1.15.61, N-Series N1x33A Video Encoder/Decoder before 1.15.61, N-Series N1x33 Video Encoder/Decoder before 1.15.61, N-Series N2x35 Video Encoder/Decoder before 1.15.61, N-Series N2x35A Video Encoder/Decoder before 1.15.61, N-Series N2xx2 Video Encoder/Decoder before 1.15.61, N-Series N2xx2A Video Encoder/Decoder before 1.15.61, N-Series N3000 Video Encoder/Decoder before 2.12.105, and N-Series N4321 Audio Transceiver before 1.00.06.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: https://help.harmanpro.com/n1115-svsi-firmware; https://help.harmanpro.com/n1x22a-updater; https://help.harmanpro.com/n1x33-updater
CVE: CVE-2023-38617
Published: 2023-07-20
Description: Office Suite Premium Version v10.9.1.42602 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the filter parameter at /api?path=files.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/173143/Office-Suite-Premium-10.9.1.42602-Cross-Site-Scripting.html; https://packetstormsecurity.com/files/173143/Office-Suite-Premium-10.9.1.42602-Cross-Site-Scripting.html
CVE: CVE-2023-3792
Published: 2023-07-20
Description: A vulnerability was found in Beijing Netcon NS-ASG 6.3. It has been classified as problematic. This affects an unknown part of the file /admin/test_status.php. The manipulation leads to direct request. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-235059. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-425
References: https://github.com/CYN521/cve/blob/main/NS-ASG.md; https://vuldb.com/?ctiid.235059; https://vuldb.com/?id.235059
CVE: CVE-2020-24275
Published: 2023-07-20
Description: A HTTP response header injection vulnerability in Swoole v4.5.2 allows attackers to execute arbitrary code via supplying a crafted URL.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-74
References: https://blog.cal1.cn/post/HTTP%20Response%20Header%20Injection%20in%20Swoole%3C%3D4.5.2; https://github.com/swoole/swoole-src/pull/3539; https://github.com/swoole/swoole-src/pull/3545
CVE: CVE-2021-39425
Published: 2023-07-20
Description: SeedDMS v6.0.15 was discovered to contain an open redirect vulnerability. An attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://medium.com/%40rohitgautam26/cve-2021-39425-8a336eba34dd; https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/11-Client_Side_Testing/04-Testing_for_Client_Side_URL_Redirect; https://medium.com/%40rohitgautam26/cve-2021-39425-8a336eba34dd
CVE: CVE-2023-30200
Published: 2023-07-20
Description: In the module “Image: WebP, Compress, Zoom, Lazy load, Alt & More” (ultimateimagetool) in versions up to 2.1.02 from Advanced Plugins for PrestaShop, a guest can download personal informations without restriction by performing a path traversal attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/PrestaShop/PrestaShop/blob/6c05518b807d014ee8edb811041e3de232520c28/classes/Tools.php#L1247; https://security.friendsofpresta.org/modules/2023/07/20/ultimateimagetool.html; https://github.com/PrestaShop/PrestaShop/blob/6c05518b807d014ee8edb811041e3de232520c28/classes/Tools.php#L1247
CVE: CVE-2023-31753
Published: 2023-07-20
Description: SQL injection vulnerability in diskusi.php in eNdonesia 8.7, allows an attacker to execute arbitrary SQL commands via the "rid=" parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/khmk2k/CVE-2023-31753/; https://github.com/khmk2k/CVE-2023-31753/
CVE: CVE-2023-34625
Published: 2023-07-20
Description: ShowMojo MojoBox Digital Lockbox 1.4 is vulnerable to Authentication Bypass. The implementation of the lock opening mechanism via Bluetooth Low Energy (BLE) is vulnerable to replay attacks. A malicious user is able to intercept BLE requests and replicate them to open the lock at any time. Alternatively, an attacker with physical access to the device on which the Android app is installed, can obtain the latest BLE messages via the app logs and use them for opening the lock.
CVSS Score: 8.1 (HIGH)
CWE: CWE-294
References: https://mandomat.github.io/2023-03-15-testing-mojobox-security/; https://packetstormsecurity.com/2307-exploits/mojobox14-replay.txt; https://www.whid.ninja/blog/mojobox-yet-another-not-so-smartlock
CVE: CVE-2023-37649
Published: 2023-07-20
Description: Incorrect access control in the component /models/Content of Cockpit CMS v2.5.2 allows unauthorized attackers to access sensitive data.
CVSS Score: 7.5 (HIGH)
References: https://github.com/Cockpit-HQ/Cockpit/releases/tag/2.6.0; https://www.ghostccamm.com/blog/multi_cockpit_vulns/; https://github.com/Cockpit-HQ/Cockpit/releases/tag/2.6.0
CVE: CVE-2023-37650
Published: 2023-07-20
Description: A Cross-Site Request Forgery (CSRF) in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/Cockpit-HQ/Cockpit/releases/tag/2.6.0; https://www.ghostccamm.com/blog/multi_cockpit_vulns/; https://github.com/Cockpit-HQ/Cockpit/releases/tag/2.6.0
CVE: CVE-2023-3793
Published: 2023-07-20
Description: A vulnerability was found in Weaver e-cology. It has been rated as critical. This issue affects some unknown processing of the file filelFileDownloadForOutDoc.class of the component HTTP POST Request Handler. The manipulation of the argument fileid with the input 1+WAITFOR+DELAY leads to sql injection. Upgrading to version 10.58.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-235061 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.235061; https://vuldb.com/?id.235061; https://vuldb.com/?ctiid.235061
CVE: CVE-2023-3794
Published: 2023-07-20
Description: A vulnerability classified as problematic has been found in Bug Finder ChainCity Real Estate Investment Platform 1.0. Affected is an unknown function of the file /chaincity/user/ticket/create of the component New Ticket Handler. The manipulation of the argument subject leads to cross site scripting. It is possible to launch the attack remotely. VDB-235062 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.235062; https://vuldb.com/?id.235062; https://vuldb.com/?ctiid.235062
CVE: CVE-2023-24593
Published: 2023-07-20
Description: Rejected reason: Rejected by upstream.
CVE: CVE-2023-25180
Published: 2023-07-20
Description: Rejected reason: Rejected by upstream.
CVE: CVE-2023-3795
Published: 2023-07-20
Description: A vulnerability classified as critical was found in Bug Finder ChainCity Real Estate Investment Platform 1.0. Affected by this vulnerability is an unknown functionality of the file /property of the component GET Parameter Handler. The manipulation of the argument name leads to sql injection. The associated identifier of this vulnerability is VDB-235063. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.235063; https://vuldb.com/?id.235063; https://vuldb.com/?ctiid.235063
CVE: CVE-2023-3796
Published: 2023-07-20
Description: A vulnerability, which was classified as problematic, has been found in Bug Finder Foody Friend 1.0. Affected by this issue is some unknown functionality of the file /user/profile of the component Profile Picture Handler. The manipulation of the argument profile_picture leads to unrestricted upload. The attack may be launched remotely. The identifier of this vulnerability is VDB-235064. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-434
References: https://vuldb.com/?ctiid.235064; https://vuldb.com/?id.235064; https://vuldb.com/?ctiid.235064
CVE: CVE-2023-37645
Published: 2023-07-20
Description: eyoucms v1.6.3 was discovered to contain an information disclosure vulnerability via the component /custom_model_path/recruit.filelist.txt.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-668
References: https://github.com/weng-xianhu/eyoucms/issues/50; https://github.com/weng-xianhu/eyoucms/issues/50
CVE: CVE-2023-3797
Published: 2023-07-20
Description: A vulnerability, which was classified as critical, was found in Gen Technology Four Mountain Torrent Disaster Prevention and Control of Monitoring and Early Warning System up to 20230712. This affects an unknown part of the file /Duty/AjaxHandle/UploadFloodPlanFileUpdate.ashx. The manipulation of the argument Filedata leads to unrestricted upload. The exploit has been disclosed to the public and may be used. The identifier VDB-235065 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-434
References: https://github.com/segonse/cve/blob/main/sichuang/sichuang.md; https://vuldb.com/?ctiid.235065; https://vuldb.com/?id.235065
CVE: CVE-2023-3798
Published: 2023-07-20
Description: A vulnerability has been found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0 and classified as critical. This vulnerability affects unknown code of the file /App_Resource/UEditor/server/upload.aspx. The manipulation of the argument file leads to unrestricted upload. The exploit has been disclosed to the public and may be used. VDB-235066 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-434
References: https://github.com/RCEraser/cve/blob/main/wanjiang.md; https://vuldb.com/?ctiid.235066; https://vuldb.com/?id.235066
CVE: CVE-2023-3799
Published: 2023-07-20
Description: A vulnerability was found in IBOS OA 4.5.5 and classified as critical. This issue affects some unknown processing of the file ?r=article/category/del of the component Delete Category Handler. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-235067. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/GUIqizsq/cve/blob/main/sql.md; https://vuldb.com/?ctiid.235067; https://vuldb.com/?id.235067
CVE: CVE-2023-3800
Published: 2023-07-20
Description: A vulnerability was found in EasyAdmin8 2.0.2.2. It has been classified as problematic. Affected is an unknown function of the file /admin/index/index.html#/admin/mall.goods/index.html of the component File Upload Module. The manipulation leads to unrestricted upload. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-235068. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.9 (LOW)
CWE: CWE-434
References: https://github.com/wolf-leo/EasyAdmin8/issues/1; https://vuldb.com/?ctiid.235068; https://vuldb.com/?id.235068
CVE: CVE-2023-25835
Published: 2023-07-21
Description: There is a stored Cross‑Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS Sites versions 11.1 and below that may allow a remote, authenticated attacker with high‑privileged access to create a crafted link that is persisted within the site configuration. When accessed by a victim, the stored payload may execute arbitrary JavaScript code in the victim’s browser. Successful exploitation could allow the attacker to access sensitive user data and session information, alter trusted site content and user actions, and disrupt normal site functionality, resulting in a high impact to confidentiality, integrity, and availability.
CVSS Score: 8.4 (HIGH)
CWE: CWE-79
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-enterprise-sites-security-patch-is-now-available/; https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-enterprise-sites-security-patch-is-now-available/
CVE: CVE-2023-3801
Published: 2023-07-21
Description: A vulnerability was found in IBOS OA 4.5.5. It has been declared as critical. Affected by this vulnerability is the function actionEdit of the file ?r=officialdoc/officialdoc/edit of the component Mobile Notification Handler. The manipulation leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-235069 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/Wkingxc/CVE/blob/master/ibos_OA_1.md; https://github.com/funnn7/cve/blob/main/sql.md; https://vuldb.com/?ctiid.235069
CVE: CVE-2023-3802
Published: 2023-07-21
Description: A vulnerability was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /Controller/Ajaxfileupload.ashx. The manipulation of the argument file leads to unrestricted upload. The exploit has been disclosed to the public and may be used. VDB-235070 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-434, CWE-434
References: https://github.com/GUIqizsq/cve/blob/main/upload_1.md; https://vuldb.com/?ctiid.235070; https://vuldb.com/?id.235070
CVE: CVE-2023-32624
Published: 2023-07-21
Description: Cross-site scripting vulnerability in TS Webfonts for SAKURA 3.1.0 and earlier allows a remote unauthenticated attacker to inject an arbitrary script.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://ja.wordpress.org/plugins/ts-webfonts-for-sakura/#developers; https://jvn.jp/en/jp/JVN90560760/; https://ja.wordpress.org/plugins/ts-webfonts-for-sakura/#developers
CVE: CVE-2023-32625
Published: 2023-07-21
Description: Cross-site request forgery (CSRF) vulnerability in TS Webfonts for SAKURA 3.1.2 and earlier allows a remote unauthenticated attacker to hijack the authentication of a user and to change settings by having a user view a malicious page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://ja.wordpress.org/plugins/ts-webfonts-for-sakura/#developers; https://jvn.jp/en/jp/JVN90560760/; https://ja.wordpress.org/plugins/ts-webfonts-for-sakura/#developers
CVE: CVE-2023-3803
Published: 2023-07-21
Description: A vulnerability classified as problematic has been found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This affects an unknown part of the file /Service/ImageStationDataService.asmx of the component File Name Handler. The manipulation leads to insufficiently random values. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-235071. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.6 (LOW)
CWE: CWE-330, CWE-434
References: https://github.com/GUIqizsq/cve/blob/main/upload_2.md; https://vuldb.com/?ctiid.235071; https://vuldb.com/?id.235071
CVE: CVE-2023-3804
Published: 2023-07-21
Description: A vulnerability classified as problematic was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This vulnerability affects unknown code of the file /Service/FileHandler.ashx. The manipulation of the argument userFile leads to unrestricted upload. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-235072. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-434
References: https://github.com/yueying638/cve/blob/main/upload.md; https://vuldb.com/?ctiid.235072; https://vuldb.com/?id.235072
CVE: CVE-2023-38632
Published: 2023-07-21
Description: async-sockets-cpp through 0.3.1 has a stack-based buffer overflow in tcpsocket.hpp when processing malformed TCP packets.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/eminfedar/async-sockets-cpp/issues/31; https://github.com/eminfedar/async-sockets-cpp/issues/31
CVE: CVE-2023-3805
Published: 2023-07-21
Description: A vulnerability, which was classified as critical, has been found in Xiamen Four Letter Video Surveillance Management System up to 20230712. This issue affects some unknown processing in the library UserInfoAction.class of the component Login. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-235073 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-285
References: https://github.com/GUIqizsq/cve/blob/main/login.md; https://vuldb.com/?ctiid.235073; https://vuldb.com/?id.235073
CVE: CVE-2023-3806
Published: 2023-07-21
Description: A vulnerability, which was classified as critical, was found in SourceCodester House Rental and Property Listing System 1.0. Affected is an unknown function of the file btn_functions.php. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-235074 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/GZRsecurity/Cve-System/blob/main/House%20Rental%20and%20Property%20Listing%20System%20register.php%20has%20%20File%20Upload(RCE)%20Vulnerability.pdf; https://vuldb.com/?ctiid.235074; https://vuldb.com/?id.235074
CVE: CVE-2023-3807
Published: 2023-07-21
Description: A vulnerability has been found in Campcodes Beauty Salon Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file edit_product.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-235075.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Beauty%20Salon%20Management%20System%20-%20vuln%202.pdf; https://vuldb.com/?ctiid.235075; https://vuldb.com/?id.235075
CVE: CVE-2023-3808
Published: 2023-07-21
Description: A vulnerability was found in Hospital Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file patientforgotpassword.php. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-235076.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/GZRsecurity/Cve-System/blob/main/Hospital%20Management%20System%20patientforgotpassword.php%20has%20Sqlinjection.pdf; https://vuldb.com/?ctiid.235076; https://vuldb.com/?id.235076
CVE: CVE-2023-3813
Published: 2023-07-21
Description: The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file downloads in versions up to, and including, 4.6.6. This makes it possible for unauthenticated attackers to download the contents of arbitrary files on the server, which can contain sensitive information. The requires the premium version of the plugin to be activated. NOTE: This vulnerability was partially patched in version 4.6.5 and fully patched in version 4.6.9.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://plugins.trac.wordpress.org/browser/jupiterx-core/tags/4.6.9/includes/extensions/raven/includes/utils.php#L451; https://plugins.trac.wordpress.org/browser/jupiterx-core/trunk/includes/extensions/raven/includes/utils.php?rev=2777235#L425; https://plugins.trac.wordpress.org/changeset/3138013/jupiterx-core/trunk/includes/extensions/raven/includes/utils.php