deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-3248
Published: 2024-04-02
Description: In Xpdf 4.05 (and earlier), a PDF object loop in the attachments leads to infinite recursion and a stack overflow.

CVSS Score: 2.9 (LOW)
CWE: CWE-674, CWE-674
References: https://forum.xpdfreader.com/viewtopic.php?t=43657; https://forum.xpdfreader.com/viewtopic.php?t=43657
CVE: CVE-2024-3218
Published: 2024-04-03
Description: A vulnerability classified as critical has been found in Shibang Communications IP Network Intercom Broadcasting System 1.0. This affects an unknown part of the file /php/busyscreenshotpush.php. The manipulation of the argument jsondata[callee]/jsondata[imagename] leads to path traversal: '../filedir'. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259065 was assigned to this vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-24
References: https://github.com/garboa/cve_3/blob/main/file_put_content.md; https://vuldb.com/?ctiid.259065; https://vuldb.com/?id.259065
CVE: CVE-2024-3221
Published: 2024-04-03
Description: A vulnerability classified as critical was found in SourceCodester PHP Task Management System 1.0. This vulnerability affects unknown code of the file attendance-info.php. The manipulation of the argument user_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-259066 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/SLthendieck/cve-report/blob/main/1.pdf; https://vuldb.com/?ctiid.259066; https://vuldb.com/?id.259066
CVE: CVE-2024-3222
Published: 2024-04-03
Description: A vulnerability, which was classified as critical, has been found in SourceCodester PHP Task Management System 1.0. This issue affects some unknown processing of the file admin-password-change.php. The manipulation of the argument admin_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259067.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/SLthendieck/cve-report/blob/main/2.pdf; https://vuldb.com/?ctiid.259067; https://vuldb.com/?id.259067
CVE: CVE-2024-3223
Published: 2024-04-03
Description: A vulnerability, which was classified as critical, was found in SourceCodester PHP Task Management System 1.0. Affected is an unknown function of the file admin-manage-user.php. The manipulation of the argument admin_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259068.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/SLthendieck/cve-report/blob/main/3.pdf; https://vuldb.com/?ctiid.259068; https://vuldb.com/?id.259068
CVE: CVE-2024-3224
Published: 2024-04-03
Description: A vulnerability has been found in SourceCodester PHP Task Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file task-details.php. The manipulation of the argument task_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259069 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/php%20task%20management%20system/php%20task%20management%20system%20-%20vuln%203.pdf; https://vuldb.com/?ctiid.259069; https://vuldb.com/?id.259069
CVE: CVE-2024-3225
Published: 2024-04-03
Description: A vulnerability was found in SourceCodester PHP Task Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file edit-task.php. The manipulation of the argument task_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-259070 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/php%20task%20management%20system/php%20task%20management%20system%20-%20vuln%204.pdf; https://vuldb.com/?ctiid.259070; https://vuldb.com/?id.259070
CVE: CVE-2024-3226
Published: 2024-04-03
Description: A vulnerability was found in Campcodes Online Patient Record Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/login.php. The manipulation of the argument password leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259071.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Online%20Patient%20Record%20Management%20System%20-%20vuln%201.pdf; https://vuldb.com/?ctiid.259071; https://vuldb.com/?id.259071
CVE: CVE-2024-1327
Published: 2024-04-03
Description: The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's image box widget in all versions up to, and including, 2.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/2.6.2/class/elements/views/class-view-abstract.php#L123; https://www.wordfence.com/threat-intel/vulnerabilities/id/34a42180-9d08-4049-8da8-27ee1f64600a?source=cve; https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/2.6.2/class/elements/views/class-view-abstract.php#L123
CVE: CVE-2024-24724
Published: 2024-04-03
Description: Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Remote Code Execution because input is passed to the Twig template engine (messengerSettings.php) without sanitization.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1336
References: https://gibbonedu.org/download/; https://packetstormsecurity.com/files/177857; https://gibbonedu.org/download/
CVE: CVE-2024-25864
Published: 2024-04-03
Description: Server Side Request Forgery (SSRF) vulnerability in Friendica versions after v.2023.12, allows a remote attacker to execute arbitrary code and obtain sensitive information via the fpostit.php component.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-918
References: https://github.com/friendica/friendica/issues/13877; https://github.com/friendica/friendica/issues/13877
CVE: CVE-2024-26495
Published: 2024-04-03
Description: Cross Site Scripting (XSS) vulnerability in Friendica versions after v.2023.12, allows a remote attacker to execute arbitrary code and obtain sensitive information via the BBCode tags in the post content and post comments function.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/friendica/friendica/issues/13884; https://github.com/friendica/friendica/issues/13884
CVE: CVE-2024-28219
Published: 2024-04-03
Description: In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-680
References: https://lists.debian.org/debian-lts-announce/2024/04/msg00008.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4XLPUT3VK4GQ6EVY525TT2QNUIXNRU5M/; https://pillow.readthedocs.io/en/stable/releasenotes/10.3.0.html#security
CVE: CVE-2024-28755
Published: 2024-04-03
Description: An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When an SSL context was reset with the mbedtls_ssl_session_reset() API, the maximum TLS version to be negotiated was not restored to the configured one. An attacker was able to prevent an Mbed TLS server from establishing any TLS 1.3 connection, potentially resulting in a Denial of Service or forced version downgrade from TLS 1.3 to TLS 1.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-326
References: https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.6.0; https://github.com/hey3e; https://hey3e.github.io
CVE: CVE-2024-28836
Published: 2024-04-03
Description: An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When negotiating the TLS version on the server side, it can fall back to the TLS 1.2 implementation of the protocol if it is disabled. If the TLS 1.2 implementation was disabled at build time, a TLS 1.2 client could put a TLS 1.3-only server into an infinite loop processing a TLS 1.2 ClientHello, resulting in a denial of service. If the TLS 1.2 implementation was disabled at runtime, a TLS 1.2 client can successfully establish a TLS 1.2 connection with the server.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-835
References: https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.6.0; https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/; https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.6.0
CVE: CVE-2024-30166
Published: 2024-04-03
Description: In Mbed TLS 3.3.0 through 3.5.2 before 3.6.0, a malicious client can cause information disclosure or a denial of service because of a stack buffer over-read (of less than 256 bytes) in a TLS 1.3 server via a TLS 3.1 ClientHello.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-121
References: https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.6.0; https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/; https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.6.0
CVE: CVE-2024-3162
Published: 2024-04-03
Description: The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Testimonial Widget Attributes in all versions up to, and including, 2.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-32721 is likely a duplicate of this issue.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-87, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3062484; https://www.wordfence.com/threat-intel/vulnerabilities/id/d54c7623-25af-4bf1-a6e0-9022ec26f391?source=cve; https://plugins.trac.wordpress.org/changeset/3062484
CVE: CVE-2024-3227
Published: 2024-04-03
Description: A vulnerability was found in Panwei eoffice OA up to 9.5. It has been declared as critical. This vulnerability affects unknown code of the file /general/system/interface/theme_set/save_image.php of the component Backend. The manipulation of the argument image_type leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259072.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-24
References: https://github.com/garboa/cve_3/blob/main/upload.md; https://vuldb.com/?ctiid.259072; https://vuldb.com/?id.259072
CVE: CVE-2024-2879
Published: 2024-04-03
Description: The LayerSlider plugin for WordPress is vulnerable to SQL Injection via the ls_get_popup_markup action in versions 7.9.11 and 7.10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://layerslider.com/release-log/; https://www.wordfence.com/threat-intel/vulnerabilities/id/3fddf96e-029c-4753-ba82-043ca64b78d3?source=cve; https://layerslider.com/release-log/
CVE: CVE-2024-31009
Published: 2024-04-03
Description: SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via lgid parameter in Banner.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/ss122-0ss/semcms/blob/main/README.md; https://github.com/ss122-0ss/semcms/blob/main/README.md
CVE: CVE-2024-31010
Published: 2024-04-03
Description: SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via the ID parameter in Banner.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/ss122-0ss/semcms/blob/main/README.md; https://github.com/ss122-0ss/semcms/blob/main/README.md
CVE: CVE-2024-31012
Published: 2024-04-03
Description: An issue was discovered in SEMCMS v.4.8, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via the upload.php file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/ss122-0ss/semcmsv4.8/blob/main/readme.md; https://github.com/ss122-0ss/semcmsv4.8/blob/main/readme.md
CVE: CVE-2024-31013
Published: 2024-04-03
Description: Cross Site Scripting (XSS) vulnerability in emlog version Pro 2.3, allow remote attackers to execute arbitrary code via a crafted payload to the bottom of the homepage in footer_info parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/emlog/emlog/issues/291; https://github.com/emlog/emlog/issues/291
CVE: CVE-2024-2322
Published: 2024-04-03
Description: The WooCommerce Cart Abandonment Recovery WordPress plugin before 1.2.27 does not have CSRF check in its bulk actions, which could allow attackers to make logged in admins delete arbitrary email templates as well as delete and unsubscribe users from abandoned orders via CSRF attacks.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/c740ed3b-d6b8-4afc-8c6b-a1ec37597055/; https://wpscan.com/vulnerability/c740ed3b-d6b8-4afc-8c6b-a1ec37597055/
CVE: CVE-2024-31011
Published: 2024-04-03
Description: Arbitrary file write vulnerability in beescms v.4.0, allows a remote attacker to execute arbitrary code via a file path that was not isolated and the suffix was not verified in admin_template.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/ss122-0ss/beescms/blob/main/readme.md; https://github.com/ss122-0ss/beescms/blob/main/readme.md
CVE: CVE-2021-27312
Published: 2024-04-03
Description: Server Side Request Forgery (SSRF) vulnerability in Gleez Cms 1.2.0, allows remote attackers to execute arbitrary code and obtain sensitive information via modules/gleez/classes/request.php.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-918
References: https://gist.github.com/LioTree/8d10d123d31f50db05a25586e62a87ba; https://github.com/gleez/cms/issues/805; https://gist.github.com/LioTree/8d10d123d31f50db05a25586e62a87ba
CVE: CVE-2024-30998
Published: 2024-04-03
Description: SQL Injection vulnerability in PHPGurukul Men Salon Management System v.2.0, allows remote attackers to execute arbitrary code and obtain sensitive information via the email parameter in the index.php component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/efekaanakkar/CVEs/blob/main/PHPGurukul-Men-Salon-Management-System-2.0.md; https://github.com/efekaanakkar/CVEs/blob/main/PHPGurukul-Men-Salon-Management-System-2.0.md
CVE: CVE-2024-31008
Published: 2024-04-03
Description: An issue was discovered in WUZHICMS version 4.1.0, allows an attacker to execute arbitrary code and obtain sensitive information via the index.php file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-290
References: https://github.com/majic-banana/vulnerability/blob/main/POC/WUZHICMS4.1.0-Captcha%20bypass%20%28logic%20vulnerability%29.md; https://github.com/majic-banana/vulnerability/blob/main/POC/WUZHICMS4.1.0-Captcha%20bypass%20%28logic%20vulnerability%29.md
CVE: CVE-2024-24506
Published: 2024-04-03
Description: Cross Site Scripting (XSS) vulnerability in Lime Survey Community Edition Version v.5.3.32+220817, allows remote attackers to execute arbitrary code via the Administrator email address parameter in the General Setting function.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://bugs.limesurvey.org/bug_relationship_graph.php?bug_id=19364&graph=relation; https://www.exploit-db.com/exploits/51926; https://bugs.limesurvey.org/bug_relationship_graph.php?bug_id=19364&graph=relation
CVE: CVE-2024-28515
Published: 2024-04-03
Description: Buffer Overflow vulnerability in CSAPP_Lab CSAPP Lab3 15-213 Fall 20xx allows a remote attacker to execute arbitrary code via the lab3 of csapp,lab3/buflab-update.pl component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://gist.github.com/heshi906/090b647a76981b8aa621e99fd6e1795d; https://github.com/heshi906/CVE-2024-28515; https://gist.github.com/heshi906/090b647a76981b8aa621e99fd6e1795d
CVE: CVE-2023-34423
Published: 2024-04-03
Description: Survey Maker prior to 3.6.4 contains a stored cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is logging in to the website using the product with the administrative privilege.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN51098626/; https://wordpress.org/plugins/survey-maker/; https://jvn.jp/en/jp/JVN51098626/
CVE: CVE-2023-35764
Published: 2024-04-03
Description: Insufficient verification of data authenticity issue in Survey Maker prior to 3.6.4 allows a remote unauthenticated attacker to spoof an IP address when posting.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-345
References: https://jvn.jp/en/jp/JVN51098626/; https://wordpress.org/plugins/survey-maker/; https://jvn.jp/en/jp/JVN51098626/
CVE: CVE-2024-28589
Published: 2024-04-03
Description: An issue was discovered in Axigen Mail Server for Windows versions 10.5.18 and before, allows local low-privileged attackers to execute arbitrary code and escalate privileges via insecure DLL loading from a world-writable directory during service initialization.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-732
References: https://www.axigen.com/knowledgebase/Local-Privilege-Escalation-Vulnerability-on-Axigen-for-Windows-CVE-2024-28589-_402.html; https://www.axigen.com/knowledgebase/Local-Privilege-Escalation-Vulnerability-on-Axigen-for-Windows-CVE-2024-28589-_402.html
CVE: CVE-2024-29734
Published: 2024-04-03
Description: Uncontrolled search path element issue exists in SonicDICOM Media Viewer 2.3.2 and earlier, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with the privileges of the running application.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://jvn.jp/en/jp/JVN40367518/; https://jvn.jp/en/jp/JVN40367518/
CVE: CVE-2024-0172
Published: 2024-04-03
Description: Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper privilege management security vulnerability. An unauthenticated local attacker could potentially exploit this vulnerability, leading to privilege escalation.
CVSS Score: 7.9 (HIGH)
CWE: CWE-269
References: https://www.dell.com/support/kbdoc/en-us/000223727/dsa-2024-035-security-update-for-dell-poweredge-server-bios-for-an-improper-privilege-management-security-vulnerability; https://www.dell.com/support/kbdoc/en-us/000223727/dsa-2024-035-security-update-for-dell-poweredge-server-bios-for-an-improper-privilege-management-security-vulnerability
CVE: CVE-2024-3251
Published: 2024-04-03
Description: A vulnerability was found in SourceCodester Computer Laboratory Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/?page=borrow/view_borrow. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259100.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/0xAlmighty/Vulnerability-Research/blob/main/SourceCodester/CLMS/SourceCodester-CLMS-SQLi.md; https://vuldb.com/?ctiid.259100; https://vuldb.com/?id.259100
CVE: CVE-2024-3252
Published: 2024-04-03
Description: A vulnerability classified as critical has been found in SourceCodester Internship Portal Management System 1.0. This affects an unknown part of the file admin/check_admin.php. The manipulation of the argument username/password leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259101 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/thisissuperann/Vul/blob/main/Internship-Portal-Management-System-01; https://vuldb.com/?ctiid.259101; https://vuldb.com/?id.259101
CVE: CVE-2024-3253
Published: 2024-04-03
Description: A vulnerability classified as critical was found in SourceCodester Internship Portal Management System 1.0. This vulnerability affects unknown code of the file admin/add_admin.php. The manipulation of the argument name/username/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-259102 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/thisissuperann/Vul/blob/main/Internship-Portal-Management-System-03; https://vuldb.com/?ctiid.259102; https://vuldb.com/?id.259102
CVE: CVE-2024-25918
Published: 2024-04-03
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through <= 0.1.0.8.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-94
References: https://patchstack.com/database/Wordpress/Plugin/instawp-connect/vulnerability/wordpress-instawp-connect-plugin-0-1-0-8-remote-code-execution-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/instawp-connect/wordpress-instawp-connect-plugin-0-1-0-8-remote-code-execution-vulnerability?_s_id=cve
CVE: CVE-2024-27191
Published: 2024-04-03
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in inpersttion Slivery Extender slivery-extender allows Remote Code Inclusion.This issue affects Slivery Extender: from n/a through <= 1.0.2.
CVSS Score: 8.5 (HIGH)
CWE: CWE-94
References: https://patchstack.com/database/Wordpress/Plugin/slivery-extender/vulnerability/wordpress-slivery-extender-plugin-1-0-2-remote-code-execution-rce-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/slivery-extender/wordpress-slivery-extender-plugin-1-0-2-remote-code-execution-rce-vulnerability?_s_id=cve
CVE: CVE-2024-27951
Published: 2024-04-03
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Themeisle Multiple Page Generator Plugin – MPG allows Upload a Web Shell to a Web Server.This issue affects Multiple Page Generator Plugin – MPG: from n/a through 3.4.0.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/multiple-pages-generator-by-porthas/wordpress-multiple-page-generator-plugin-3-4-0-remote-code-execution-rce-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/multiple-pages-generator-by-porthas/wordpress-multiple-page-generator-plugin-3-4-0-remote-code-execution-rce-vulnerability?_s_id=cve
CVE: CVE-2024-27972
Published: 2024-04-03
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Jack Arturo WP Fusion Lite wp-fusion-lite.This issue affects WP Fusion Lite: from n/a through <= 3.41.24.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-94
References: https://patchstack.com/database/Wordpress/Plugin/wp-fusion-lite/vulnerability/wordpress-wp-fusion-lite-plugin-3-41-24-remote-code-execution-rce-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-fusion-lite/wordpress-wp-fusion-lite-plugin-3-41-24-remote-code-execution-rce-vulnerability?_s_id=cve