deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-39562
Published: 2024-07-10
Description: A Missing Release of Resource after Effective Lifetime vulnerability the xinetd process, responsible for spawning SSH daemon (sshd) instances, of Juniper Networks Junos OS Evolved allows an unauthenticated network-based attacker to cause a Denial of Service (DoS) by blocking SSH access for legitimate users.  Continued receipt of these connections will create a sustained Denial of Service (DoS) condition.

The issue is triggered when a high rate of concurrent SSH requests are received and terminated in a specific way, causing xinetd to crash, and leaving defunct sshd processes. Successful exploitation of this vulnerability blocks both SSH access as well as services which rely upon SSH, such as SFTP, and Netconf over SSH.

Once the system is in this state, legitimate users will be unable to SSH to the device until service is manually restored.  See WORKAROUND section below.

Administrators can monitor an increase in defunct sshd processes by utilizing the CLI command:

  > show system processes | match sshd
  root     25219 30901  0 Jul16 ?        00:00:00 [sshd] <defunct>

This issue affects Juniper Networks Junos OS Evolved:
  *  All versions prior to 21.4R3-S7-EVO
  *  22.3-EVO versions prior to 22.3R2-S2-EVO, 22.3R3-S2-EVO;
  *  22.4-EVO versions prior to 22.4R3-EVO;
  *  23.2-EVO versions prior to 23.2R2-EVO.



This issue does not affect Juniper Networks Junos OS Evolved 22.1-EVO nor 22.2-EVO.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772, CWE-772
References: https://supportportal.juniper.net/JSA75724; https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N; https://supportportal.juniper.net/JSA75724
CVE: CVE-2024-39565
Published: 2024-07-10
Description: An Improper Neutralization of Data within XPath Expressions ('XPath Injection') vulnerability in J-Web shipped with Juniper Networks Junos OS allows an unauthenticated, network-based attacker to execute remote commands on the target device. 

While an administrator is logged into a J-Web session or has previously logged in and subsequently logged out of their J-Web session, the attacker can arbitrarily execute commands on the target device with the other user's credentials. In the worst case, the attacker will have full control over the device.
This issue affects Junos OS: 



  *  All versions before 21.2R3-S8, 
  *  from 21.4 before 21.4R3-S7,
  *  from 22.2 before 22.2R3-S4,
  *  from 22.3 before 22.3R3-S3,
  *  from 22.4 before 22.4R3-S2,
  *  from 23.2 before 23.2R2,
  *  from 23.4 before 23.4R1-S1, 23.4R2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-643
References: https://support.juniper.net/support/downloads/?p=283; https://supportportal.juniper.net/JSA83023; https://www.first.org/cvss/calculator/v4-0#CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/AU:Y/R:I/V:C/RE:L/U:Amber
CVE: CVE-2024-6036
Published: 2024-07-10
Description: A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to restart the server at will by sending a specific request to the `/queue/join?` endpoint with `"fn_index":66`. This unrestricted server restart capability can severely disrupt service availability, cause data loss or corruption, and potentially compromise system integrity.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-400
References: https://huntr.com/bounties/e9eaaea9-5750-4955-9142-2f12ad4b06db; https://huntr.com/bounties/e9eaaea9-5750-4955-9142-2f12ad4b06db
CVE: CVE-2024-6037
Published: 2024-07-10
Description: A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240410 allows an attacker to create arbitrary folders at any location on the server, including the root directory (C: dir). This can lead to uncontrolled resource consumption, resulting in resource exhaustion, denial of service (DoS), server unavailability, and potential data loss or corruption.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-770
References: https://github.com/gaizhenbiao/chuanhuchatgpt/commit/71cb89c4c948dae5aaa0ae64b98f98e3965bdb37; https://huntr.com/bounties/eca6904f-f9fd-40c8-9e85-96f54daf405e; https://huntr.com/bounties/eca6904f-f9fd-40c8-9e85-96f54daf405e
CVE: CVE-2024-6650
Published: 2024-07-10
Description: A vulnerability was found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0 and classified as problematic. Affected by this issue is the function save_designation of the file /classes/Master.php. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-271058 is the identifier assigned to this vulnerability.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/Xu-Mingming/cve/blob/main/xss1.md; https://vuldb.com/?ctiid.271058; https://vuldb.com/?id.271058
CVE: CVE-2024-6652
Published: 2024-07-10
Description: A vulnerability was found in itsourcecode Gym Management System 1.0. It has been classified as critical. This affects an unknown part of the file manage_member.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-271059.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/littletree7/cve/issues/1; https://vuldb.com/?ctiid.271059; https://vuldb.com/?id.271059
CVE: CVE-2024-6447
Published: 2024-07-11
Description: The FULL – Cliente plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the license plan parameter in all versions up to, and including, 3.1.12 due to insufficient input sanitization and output escaping as well as missing authorization and capability checks on the related functions. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an administrative user accesses wp-admin dashboard
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/full-customer/tags/3.1.12/app/api/Connection.php#L43; https://plugins.trac.wordpress.org/browser/full-customer/tags/3.1.12/app/controller/actions.php#L125; https://plugins.trac.wordpress.org/browser/full-customer/tags/3.1.12/app/controller/inc/License.php#L55
CVE: CVE-2024-6653
Published: 2024-07-11
Description: A vulnerability was found in code-projects Simple Task List 1.0. It has been declared as critical. This vulnerability affects unknown code of the file loginForm.php of the component Login. The manipulation of the argument username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-271060.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/hantianj/cve/issues/1; https://vuldb.com/?ctiid.271060; https://vuldb.com/?id.271060
CVE: CVE-2024-40618
Published: 2024-07-11
Description: Whale browser before 3.26.244.21 allows an attacker to execute malicious JavaScript due to improper sanitization when processing a built-in extension.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79
References: https://cve.naver.com/detail/cve-2024-40618.html; https://cve.naver.com/detail/cve-2024-40618.html
CVE: CVE-2016-15039
Published: 2024-07-11
Description: A vulnerability classified as critical was found in mhuertos phpLDAPadmin up to 665dbc2690ebeb5392d38f1fece0a654225a0b38. Affected by this vulnerability is the function makeHttpRequest of the file htdocs/js/ajax_functions.js. The manipulation leads to http request smuggling. The attack can be launched remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named dd6e9583a2eb2ca085583765e8a63df5904cb036. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-270523.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-444
References: https://github.com/mhuertos/phpLDAPadmin/commit/dd6e9583a2eb2ca085583765e8a63df5904cb036; https://vuldb.com/?ctiid.270523; https://vuldb.com/?id.270523
CVE: CVE-2024-22387
Published: 2024-07-11
Description: External Control of Critical State Data (CWE-642) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticated user to modify device I/O connections leading to unexpected behavior that in some circumstances could compromise site physical security controls. Gallagher recommend the diagnostic web page is not enabled (default is off) unless advised by Gallagher Technical support. This interface is intended only for diagnostic purposes.



This issue affects: Gallagher Controller 6000 and 7000 

9.10 prior to vCR9.10.240520a (distributed in 9.10.1268(MR1)), 9.00 prior to vCR9.00.240521a (distributed in 9.00.1990(MR3)), 8.90 prior to vCR8.90.240520a (distributed in 8.90.1947 (MR4)), 8.80 prior to vCR8.80.240520a (distributed in 8.80.1726 (MR5)), 8.70 prior to vCR8.70.240520a (distributed in 8.70.2824 (MR7)), all versions of 8.60 and prior.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-642
References: https://security.gallagher.com/Security-Advisories/CVE-2024-22387; https://security.gallagher.com/Security-Advisories/CVE-2024-22387
CVE: CVE-2024-23194
Published: 2024-07-11
Description: Improper output Neutralization for Logs (CWE-117) in the Command Centre API Diagnostics Endpoint could allow an attacker limited ability to modify Command Centre log files. 

This issue affects: Gallagher Command Centre v9.10 prior to vEL9.10.1268 (MR1).
CVSS Score: 3.3 (LOW)
CWE: CWE-117
References: https://security.gallagher.com/Security-Advisories/CVE-2024-23194; https://security.gallagher.com/Security-Advisories/CVE-2024-23194
CVE: CVE-2024-23317
Published: 2024-07-11
Description: External Control of File Name or Path (CWE-73) in the Controller 6000 and Controller 7000 allows an attacker with local access to the Controller to perform arbitrary code execution. 

This issue affects: 9.10 prior to vCR9.10.240520a (distributed in 9.10.1268(MR1)), 9.00 prior to vCR9.00.240521a (distributed in 9.00.1990(MR3)), 8.90 prior to vCR8.90.240520a (distributed in 8.90.1947 (MR4)), 8.80 prior to vCR8.80.240520a (distributed in 8.80.1726 (MR5)), 8.70 prior to vCR8.70.240520a (distributed in 8.70.2824 (MR7)), all versions of 8.60 and prior.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-73
References: https://security.gallagher.com/Security-Advisories/CVE-2024-23317; https://security.gallagher.com/Security-Advisories/CVE-2024-23317
CVE: CVE-2024-23485
Published: 2024-07-11
Description: Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation (CWE-1304) in the Controller 6000 and 7000 can lead to secured door locks connected via Aperio Communication Hubs to momentarily allow free access. 

This issue affects: Gallagher Controller 6000 and 7000 9.10 prior to vCR9.10.240520a (distributed in 9.10.1268(MR1)), 9.00 prior to vCR9.00.240521a (distributed in 9.00.1990(MR3)),  8.90 prior to vCR8.90.240520a (distributed in 8.90.1947 (MR4)), 8.80 prior to vCR8.80.240520a (distributed in 8.80.1726 (MR5)), 8.70 prior to vCR8.70.240520a (distributed in 8.70.2824 (MR7)), all versions of 8.60 and prior.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-1304
References: https://security.gallagher.com/Security-Advisories/CVE-2024-23485; https://security.gallagher.com/Security-Advisories/CVE-2024-23485
CVE: CVE-2024-6210
Published: 2024-07-11
Description: The Duplicator plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 1.5.9. This makes it possible for unauthenticated attackers to obtain the full path to instances, which they may be able to use in combination with other vulnerabilities or to simplify reconnaissance work. On its own, this information is of very limited use.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/duplicator/trunk/installer/dup-installer/main.installer.php#L51; https://plugins.trac.wordpress.org/changeset/3108563/duplicator/trunk/installer/dup-installer/main.installer.php?old=3073248&old_path=duplicator%2Ftrunk%2Finstaller%2Fdup-installer%2Fmain.installer.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/d47d582d-7c90-4f49-aee1-03a8775b850d?source=cve
CVE: CVE-2024-6676
Published: 2024-07-11
Description: A vulnerability has been found in witmy my-springsecurity-plus up to 2024-07-03 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /api/user. The manipulation of the argument params.dataScope leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The associated identifier of this vulnerability is VDB-271111.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://gitee.com/witmy/my-springsecurity-plus/issues/IAAE8U; https://vuldb.com/?ctiid.271111; https://vuldb.com/?id.271111
CVE: CVE-2024-0619
Published: 2024-07-11
Description: The Payflex Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the payment_callback() function in all versions up to, and including, 2.5.0. This makes it possible for unauthenticated attackers to update the status of orders, which can potentially lead to revenue loss.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/changeset/3124507/; https://www.wordfence.com/threat-intel/vulnerabilities/id/9f740cfa-7163-4634-9705-0e01ee571a11?source=cve; https://plugins.trac.wordpress.org/browser/payflex-payment-gateway/trunk/partpay.php#L751
CVE: CVE-2024-6397
Published: 2024-07-11
Description: The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 0.1.0.44. This is due to insufficient verification of the API key. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username, and to perform a variety of other administrative tasks. NOTE: This vulnerability was partially fixed in 0.1.0.44, but was still exploitable via Cross-Site Request Forgery.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288, CWE-287
References: https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.0.43/includes/apis/class-instawp-rest-api.php#L256; https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.0.43/includes/class-instawp-hooks.php#L28; https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.0.43/includes/class-instawp-hooks.php#L40
CVE: CVE-2024-6554
Published: 2024-07-11
Description: The Branda – White Label WordPress, Custom Login Page Customizer plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.18. This is due the plugin utilizing composer without preventing direct access to the files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/branda-white-labeling/trunk/misc/composer/prefix-fixer.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3115603%40branda-white-labeling&new=3115603%40branda-white-labeling&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/0a79eb25-a7d1-4102-97e6-8fa8db9ed03e?source=cve
CVE: CVE-2024-22280
Published: 2024-07-11
Description: VMware Aria Automation does not apply correct input validation which allows for SQL-injection in the product. An authenticated malicious user could enter specially crafted SQL queries and perform unauthorised read/write operations in the database.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24598; https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24598
CVE: CVE-2024-1845
Published: 2024-07-11
Description: The VikRentCar Car Rental Management System WordPress plugin before 1.3.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wpscan.com/vulnerability/a8d7b564-36e0-4f05-9b49-1b441f453d0a/; https://wpscan.com/vulnerability/a8d7b564-36e0-4f05-9b49-1b441f453d0a/
CVE: CVE-2024-4655
Published: 2024-07-11
Description: The Ultimate Blocks  WordPress plugin before 3.1.9 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/a0dc73b3-3c51-4d03-963f-00fa7d8b0d51/; https://wpscan.com/vulnerability/a0dc73b3-3c51-4d03-963f-00fa7d8b0d51/
CVE: CVE-2024-5444
Published: 2024-07-11
Description: The Bible Text WordPress plugin through 0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/21eddf64-c71e-4aba-b1e9-fe67b4ddfb30/; https://wpscan.com/vulnerability/21eddf64-c71e-4aba-b1e9-fe67b4ddfb30/
CVE: CVE-2024-6025
Published: 2024-07-11
Description: The Quiz and Survey Master (QSM)  WordPress plugin before 9.0.5 does not sanitise and escape some of its Quiz settings, which could allow contributors and higher to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/15abc7dd-95b1-4dad-ba25-eb65105d3925/; https://wpscan.com/vulnerability/15abc7dd-95b1-4dad-ba25-eb65105d3925/
CVE: CVE-2024-6026
Published: 2024-07-11
Description: The Slider by 10Web  WordPress plugin before 1.2.56 does not sanitise and escape some of its Slide options, which could allow authenticated users with access to the Sliders (by default Administrator, however this can be changed via the Slider by 10Web  WordPress plugin before 1.2.56's options) and the ability to add images (Editor+) to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/01609d84-e9eb-46a9-b2cc-fe7e0c982984/; https://wpscan.com/vulnerability/01609d84-e9eb-46a9-b2cc-fe7e0c982984/
CVE: CVE-2024-6138
Published: 2024-07-11
Description: The Secure Copy Content Protection and Content Locking WordPress plugin before 4.0.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/9ef2a8d8-39d5-45d3-95de-e7bac4b7382d/; https://wpscan.com/vulnerability/9ef2a8d8-39d5-45d3-95de-e7bac4b7382d/
CVE: CVE-2024-2880
Published: 2024-07-11
Description: An issue was discovered in GitLab CE/EE affecting all versions starting from 16.5 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2 in which a user with `admin_group_member` custom role permission could ban group members.
CVSS Score: 2.7 (LOW)
CWE: CWE-284
References: https://gitlab.com/gitlab-org/gitlab/-/issues/451921; https://hackerone.com/reports/2431597; https://gitlab.com/gitlab-org/gitlab/-/issues/451921
CVE: CVE-2024-5257
Published: 2024-07-11
Description: An issue was discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.0.4 and from 17.1 prior to 17.1.2 where a Developer user with `admin_compliance_framework` custom role may have been able to modify the URL for a group namespace.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-284
References: https://gitlab.com/gitlab-org/gitlab/-/issues/463149; https://hackerone.com/reports/2513934; https://gitlab.com/gitlab-org/gitlab/-/issues/463149
CVE: CVE-2024-5470
Published: 2024-07-11
Description: An issue was discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.0.4 and from 17.1 prior to 17.1.2 where a Guest user with `admin_push_rules` permission may have been able to create project-level deploy tokens.
CVSS Score: 3.8 (LOW)
CWE: CWE-284
References: https://gitlab.com/gitlab-org/gitlab/-/issues/464312; https://hackerone.com/reports/2521480; https://gitlab.com/gitlab-org/gitlab/-/issues/464312
CVE: CVE-2024-6256
Published: 2024-07-11
Description: The Feeds for YouTube (YouTube video, channel, and gallery plugin) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'youtube-feed' shortcode in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/feeds-for-youtube/trunk/js/sb-youtube.js; https://plugins.trac.wordpress.org/changeset/3107577/; https://www.wordfence.com/threat-intel/vulnerabilities/id/228fab65-e5c2-41d1-ad41-fac4862894f2?source=cve
CVE: CVE-2024-6385
Published: 2024-07-11
Description: An issue was discovered in GitLab CE/EE affecting all versions starting from 15.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2, which allows an attacker to trigger a pipeline as another user under certain circumstances.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-284
References: https://gitlab.com/gitlab-org/gitlab/-/issues/469217; https://hackerone.com/reports/2578672; https://gitlab.com/gitlab-org/gitlab/-/issues/469217
CVE: CVE-2024-6624
Published: 2024-07-11
Description: The JSON API User plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.9.3. This is due to improper controls on custom user meta fields. This makes it possible for unauthenticated attackers to register as administrators on the site. The plugin requires the JSON API plugin to also be installed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://plugins.trac.wordpress.org/browser/json-api-user/trunk/controllers/User.php#L187; https://plugins.trac.wordpress.org/browser/json-api-user/trunk/controllers/User.php#L51; https://plugins.trac.wordpress.org/changeset/3115185/
CVE: CVE-2024-6666
Published: 2024-07-11
Description: The WP ERP plugin for WordPress is vulnerable to SQL Injection via the ‘vendor_id’ and 'status' parameter in all versions up to, and including, 1.13.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Accounting Manager access (erp_ac_view_sales_summary capability) and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://plugins.trac.wordpress.org/changeset/3064874/erp/tags/1.13.1/modules/accounting/includes/functions/transactions.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/e23335c9-0830-4c6b-8e0d-6897a7176ba5?source=cve; https://plugins.trac.wordpress.org/changeset/3064874/erp/tags/1.13.1/modules/accounting/includes/functions/transactions.php