deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-0472
Published: 2025-01-16
Description: Information exposure in the PMB platform affecting versions 4.2.13 and earlier. This vulnerability allows an attacker to upload a file to the environment and enumerate the internal files of a machine by looking at the request response.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-434
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-pmb-platform
CVE: CVE-2025-0473
Published: 2025-01-16
Description: Vulnerability in the PMB platform that allows an attacker to persist temporary files on the server, affecting versions 4.0.10 and above. This vulnerability exists in the file upload functionality on the ‘/pmb/authorities/import/iimport_authorities’ endpoint. When a file is uploaded via this resource, the server will create a temporary file that will be deleted after the client sends a POST request to ‘/pmb/authorities/import/iimport_authorities’. This workflow is automated by the web client, however an attacker can trap and launch the second POST request to prevent the temporary file from being deleted.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-459
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-pmb-platform
CVE: CVE-2024-57159
Published: 2025-01-16
Description: 07FLYCMS V1.3.9 was discovered to contain a Cross-Site Request Forgery (CSRF) via /erp.07fly.net:80/oa/OaWorkReport/add.html.
CVSS Score: 3.5 (LOW)
CWE: CWE-352
References: https://github.com/1091101/yang.xian/tree/main/6/readme.md
CVE: CVE-2024-57160
Published: 2025-01-16
Description: 07FLYCMS V1.3.9 was discovered to contain a Cross-Site Request Forgery (CSRF) via /erp.07fly.net:80/oa/OaTask/edit.html.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/1091101/yang.xian/tree/main/7/readme.md
CVE: CVE-2024-57161
Published: 2025-01-16
Description: 07FLYCMS V1.3.9 was discovered to contain a Cross-Site Request Forgery (CSRF) via /erp.07fly.net:80/oa/OaWorkReport/edit.html
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/1091101/yang.xian/tree/main/8/readme.md
CVE: CVE-2024-57162
Published: 2025-01-16
Description: Campcodes Cybercafe Management System v1.0 is vulnerable to SQL Injection in /ccms/view-user-detail.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/h1-wh0areu/bug_report/blob/main/cybercafe-management-system/SQLi-1.md
CVE: CVE-2024-57611
Published: 2025-01-16
Description: 07FLYCMS V1.3.9 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/doAdminAction.php?act=editShop&shopId.
CVSS Score: 3.5 (LOW)
CWE: CWE-352
References: https://github.com/daodaoshao/Yunpeng-Yin/tree/main/7/readme.md
CVE: CVE-2023-4319
Published: 2025-01-16
Description: Rejected reason: This CVE ID is a reservation duplicate of CVE-2023-4677. Notes: All CVE users should reference CVE-2023-4677 instead of this CVE ID.
CVE: CVE-2025-0518
Published: 2025-01-16
Description: Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within an Executable. This vulnerability is associated with program files  https://github.Com/FFmpeg/FFmpeg/blob/master/libavfilter/af_pan.C .

This issue affects FFmpeg: 7.1.

Issue was fixed:  https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a

 https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a This issue was discovered by: Simcha Kosman
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125, CWE-252
References: https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a; https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html
CVE: CVE-2024-37181
Published: 2025-01-16
Description: Time-of-check time-of-use race condition in some Intel(R) Neural Compressor software before version v3.0 may allow an authenticated user to potentially enable information disclosure via adjacent access.
CVSS Score: 2.6 (LOW)
CWE: CWE-367
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01219.html
CVE: CVE-2024-41746
Published: 2025-01-16
Description: IBM CICS TX Advanced 10.1, 11.1, and Standard 11.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7171873
CVE: CVE-2024-50633
Published: 2025-01-16
Description: A Broken Object Level Authorization (BOLA) vulnerability in Indico through 3.3.5 allows attackers to read information by sending a crafted POST request to the component /api/principals. NOTE: this is disputed by the Supplier because the product intentionally lets all users retrieve certain information about other user accounts (this functionality is, in the current design, not restricted to any privileged roles such as event organizer).
CVSS Score: 0.0 (NONE)
CWE: CWE-201
References: https://github.com/cetinpy/CVE-2024-50633; https://github.com/cetinpy/CVE-2024-50633/issues/1
CVE: CVE-2024-57768
Published: 2025-01-16
Description: JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component validRoleKey?sysRole.key.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gitee.com/r1bbit/JFinalOA/issues/IBHUMT
CVE: CVE-2024-57769
Published: 2025-01-16
Description: JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component borrowmoney/listData?applyUser.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://gitee.com/r1bbit/JFinalOA/issues/IBHUNR
CVE: CVE-2024-57770
Published: 2025-01-16
Description: JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component apply/save#oaContractApply.id.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://gitee.com/r1bbit/JFinalOA/issues/IBHUP1
CVE: CVE-2024-57771
Published: 2025-01-16
Description: A cross-site scripting (XSS) vulnerability in the common/getEditPage?view interface of JFinalOA before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://gitee.com/r1bbit/JFinalOA/issues/IBHUPO; https://gitee.com/r1bbit/JFinalOA/issues/IBHUPO
CVE: CVE-2024-57772
Published: 2025-01-16
Description: A cross-site scripting (XSS) vulnerability in the /bumph/getDraftListPage?type interface of JFinalOA before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://gitee.com/r1bbit/JFinalOA/issues/IBHUQ1; https://gitee.com/r1bbit/JFinalOA/issues/IBHUQ1
CVE: CVE-2024-57773
Published: 2025-01-16
Description: A cross-site scripting (XSS) vulnerability in the openSelectManyUserPage?orgid interface of JFinalOA before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://gitee.com/r1bbit/JFinalOA/issues/IBHUQ9; https://gitee.com/r1bbit/JFinalOA/issues/IBHUQ9
CVE: CVE-2024-57774
Published: 2025-01-16
Description: A cross-site scripting (XSS) vulnerability in the getBusinessUploadListPage?busid interface of JFinalOA before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://gitee.com/r1bbit/JFinalOA/issues/IBHUQQ; https://gitee.com/r1bbit/JFinalOA/issues/IBHUQQ
CVE: CVE-2024-57775
Published: 2025-01-16
Description: JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component getWorkFlowHis?insid.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://gitee.com/r1bbit/JFinalOA/issues/IBHURT
CVE: CVE-2024-57776
Published: 2025-01-16
Description: A cross-site scripting (XSS) vulnerability in the /apply/getEditPage?view interface of JFinalOA before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://gitee.com/r1bbit/JFinalOA/issues/IBHUS8
CVE: CVE-2025-20072
Published: 2025-01-16
Description: Mattermost Mobile versions <= 2.22.0 fail to properly validate the style of proto supplied to an action's style in post.props.attachments, which allows an attacker to crash the mobile via crafted malicious input.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-704
References: https://mattermost.com/security-updates
CVE: CVE-2024-52594
Published: 2025-01-16
Description: Gomatrixserverlib is a Go library for matrix federation. Gomatrixserverlib is vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions. The commit `c4f1e01` fixes this issue. Users are advised to upgrade. Users unable to upgrade should use a local firewall to limit the network segments and hosts the service using gomatrixserverlib can access.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/matrix-org/gomatrixserverlib/commit/c4f1e01eab0dd435709ad15463ed38a079ad6128; https://github.com/matrix-org/gomatrixserverlib/security/advisories/GHSA-4ff6-858j-r822
CVE: CVE-2024-57676
Published: 2025-01-16
Description: An access control issue in the component form2WlanBasicSetup.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the 2.4G and 5G wlan service of the device via a crafted POST request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Unauthorized_Vulnerability/D-Link/DIR-816/form2WlanBasicSetup.md; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2024-57677
Published: 2025-01-16
Description: An access control issue in the component form2Wan.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the wan service of the device via a crafted POST request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Unauthorized_Vulnerability/D-Link/DIR-816/form2Wan.md; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2024-57678
Published: 2025-01-16
Description: An access control issue in the component form2WlAc.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the 2.4G and 5G mac access control list of the device via a crafted POST request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Unauthorized_Vulnerability/D-Link/DIR-816/form2WlAc.md; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2024-57679
Published: 2025-01-16
Description: An access control issue in the component form2RepeaterSetup.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the 2.4G and 5G repeater service of the device via a crafted POST request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Unauthorized_Vulnerability/D-Link/DIR-816/form2RepeaterSetup.md; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2024-57680
Published: 2025-01-16
Description: An access control issue in the component form2PortriggerRule.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the port trigger of the device via a crafted POST request.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Unauthorized_Vulnerability/D-Link/DIR-816/form2PortriggerRule.md; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2024-57681
Published: 2025-01-16
Description: An access control issue in the component form2alg.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the agl service of the device via a crafted POST request.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Unauthorized_Vulnerability/D-Link/DIR-816/form2alg.md; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2024-57682
Published: 2025-01-16
Description: An information disclosure vulnerability in the component d_status.asp of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to access sensitive information via a crafted POST request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Unauthorized_Vulnerability/D-Link/DIR-816/d_status.md; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2024-57683
Published: 2025-01-16
Description: An access control issue in the component websURLFilterAddDel of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the filter settings of the device via a crafted POST request.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Unauthorized_Vulnerability/D-Link/DIR-816/websURLFilterAddDel.md; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2024-57684
Published: 2025-01-16
Description: An access control issue in the component formDMZ.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the DMZ service of the device via a crafted POST request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Unauthorized_Vulnerability/D-Link/DIR-816/formDMZ.md; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2025-20621
Published: 2025-01-16
Description: Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly handle posts with attachments containing fields that cannot be cast to a String, which allows an attacker to cause the webapp to crash via creating and sending such a post to a channel.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1287
References: https://mattermost.com/security-updates
CVE: CVE-2025-20630
Published: 2025-01-16
Description: Mattermost Mobile versions <=2.22.0 fail to properly handle posts with attachments containing fields that cannot be cast to a String, which allows an attacker to cause the mobile to crash via creating and sending such a post to a channel.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1287
References: https://mattermost.com/security-updates
CVE: CVE-2024-36402
Published: 2025-01-16
Description: Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. MMR before version 1.3.5 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then also becomes available for download from the local homeserver in an unauthenticated way. The implication is that unauthenticated remote adversaries can use this functionality to plant problematic content into the media repository. MMR 1.3.5 introduces a partial mitigation in the form of new endpoints which require authentication for media downloads. The unauthenticated endpoints will be frozen in a future release, closing the attack vector. Though extremely limited, server operators can use more strict rate limits based on IP address as a partial workaround.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: https://github.com/matrix-org/matrix-spec-proposals/pull/3916; https://github.com/t2bot/matrix-media-repo/security/advisories/GHSA-8vmr-h7h5-cqhg
CVE: CVE-2024-36403
Published: 2025-01-16
Description: Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. MMR before version 1.3.5 is vulnerable to unbounded disk consumption, where an unauthenticated adversary can induce it to download and cache large amounts of remote media files. MMR's typical operating environment uses S3-like storage as a backend, with file-backed store as an alternative option. Instances using a file-backed store or those which self-host an S3 storage system are therefore vulnerable to a disk fill attack. Once the disk is full, authenticated users will be unable to upload new media, resulting in denial of service. For instances configured to use a cloud-based S3 storage option, this could result in high service fees instead of a denial of service. MMR 1.3.5 introduces a new default-on "leaky bucket" rate limit to reduce the amount of data a user can request at a time. This does not fully address the issue, but does limit an unauthenticated user's ability to request large amounts of data. Operators should note that the leaky bucket implementation introduced in MMR 1.3.5 requires the IP address associated with the request to be forwarded, to avoid mistakenly applying the rate limit to the reverse proxy instead. To avoid this issue, the reverse proxy should populate the X-Forwarded-For header when sending the request to MMR. Operators who cannot update may wish to lower the maximum file size they allow and implement harsh rate limits, though this can still lead to a large amount of data to be downloaded.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770
References: https://en.wikipedia.org/wiki/Leaky_bucket#As_a_meter; https://github.com/t2bot/matrix-media-repo/security/advisories/GHSA-vc2m-hw89-qjxf
CVE: CVE-2024-52602
Published: 2025-01-16
Description: Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. Matrix Media Repo (MMR) is vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions. This is fixed in MMR v1.3.8. Users are advised to upgrade. Restricting which hosts MMR is allowed to contact via (local) firewall rules or a transparent proxy and may provide a workaround for users unable to upgrade.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-918
References: https://github.com/t2bot/matrix-media-repo/releases/tag/v1.3.8; https://github.com/t2bot/matrix-media-repo/security/advisories/GHSA-r6jg-jfv6-2fjv; https://learn.snyk.io/lesson/ssrf-server-side-request-forgery
CVE: CVE-2024-52791
Published: 2025-01-16
Description: Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. MMR makes requests to other servers as part of normal operation, and these resource owners can return large amounts of JSON back to MMR for parsing. In parsing, MMR can consume large amounts of memory and exhaust available memory. This is fixed in MMR v1.3.8. Users are advised to upgrade. For users unable to upgrade; forward proxies can be configured to block requests to unsafe hosts. Alternatively, MMR processes can be configured with memory limits and auto-restart. Running multiple MMR processes concurrently can help ensure a restart does not overly impact users.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-789
References: https://github.com/t2bot/matrix-media-repo/releases/tag/v1.3.8; https://github.com/t2bot/matrix-media-repo/security/advisories/GHSA-gp86-q8hg-fpxj
CVE: CVE-2024-55954
Published: 2025-01-16
Description: OpenObserve is a cloud-native observability platform. A vulnerability in the user management endpoint `/api/{org_id}/users/{email_id}` allows an "Admin" role user to remove a "Root" user from the organization. This violates the intended privilege hierarchy, enabling a non-root user to remove the highest-privileged account. Due to insufficient role checks, the `remove_user_from_org` function does not prevent an "Admin" user from removing a "Root" user. As a result, an attacker with an "Admin" role can remove critical "Root" users, potentially gaining effective full control by eliminating the highest-privileged accounts. The `DELETE /api/{org_id}/users/{email_id}` endpoint is affected. This issue has been addressed in release version `0.14.1` and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 8.7 (HIGH)
CWE: CWE-269, CWE-272, CWE-284, CWE-285, CWE-287
References: https://github.com/gaby/openobserve/blob/main/src/service/users.rs#L631; https://github.com/openobserve/openobserve/security/advisories/GHSA-m8gj-6r85-3r6m
CVE: CVE-2024-56136
Published: 2025-01-16
Description: Zulip server provides an open-source team chat that helps teams stay productive and focused. Zulip Server 7.0 and above are vulnerable to an information disclose attack, where, if a Zulip server is hosting multiple organizations, an unauthenticated user can make a request and determine if an email address is in use by a user. Zulip Server 9.4 resolves the issue, as does the `main` branch of Zulip Server. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/zulip/zulip/commit/c6334a765b1e6d71760e4a3b32ae5b8367f2ed4d; https://github.com/zulip/zulip/security/advisories/GHSA-5xg8-xhfj-4hm6
CVE: CVE-2024-56515
Published: 2025-01-16
Description: Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. If SVG or JPEGXL thumbnailers are enabled (they are disabled by default), a user may upload a file which claims to be either of these types and request a thumbnail to invoke a different decoder in ImageMagick. In some ImageMagick installations, this includes the capability to run Ghostscript to decode the image/file. If MP4 thumbnailers are enabled (also disabled by default), the same issue as above may occur with the ffmpeg installation instead. MMR uses a number of other decoders for all other file types when preparing thumbnails. Theoretical issues are possible with these decoders, however in testing they were not possible to exploit. This is fixed in MMR v1.3.8. MMR now inspects the mimetype of media prior to thumbnailing, and picks a thumbnailer based on those results instead of relying on user-supplied values. This may lead to fewer thumbnails when obscure file shapes are used. This also helps narrow scope of theoretical issues with all decoders MMR uses for thumbnails. Users are advised to upgrade. Users unable to upgrade may disable the SVG, JPEGXL, and MP4 thumbnail types in the MMR config which prevents the decoders from being invoked. Further disabling uncommon file types on the server is recommended to limit risk surface. Containers and other similar technologies may also be used to limit the impact of vulnerabilities in external decoders, like ImageMagick and ffmpeg. Some installations of ImageMagick may disable "unsafe" file types, like PDFs, already. This option can be replicated to other environments as needed. ffmpeg may be compiled with limited decoders/codecs. The Docker image for MMR disables PDFs and similar formats by default.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-502
References: https://github.com/t2bot/matrix-media-repo/releases/tag/v1.3.8; https://github.com/t2bot/matrix-media-repo/security/advisories/GHSA-rcxc-wjgw-579r
CVE: CVE-2025-23423
Published: 2025-01-16
Description: Missing Authorization vulnerability in Smackcoders Inc., SendGrid for WordPress wp-sendgrid-mailer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SendGrid for WordPress: from n/a through <= 1.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wp-sendgrid-mailer/vulnerability/wordpress-sendgrid-for-wordpress-plugin-1-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-23424
Published: 2025-01-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in bnovotny Marquee Style RSS News Ticker marquee-style-rss-news-ticker allows Cross Site Request Forgery.This issue affects Marquee Style RSS News Ticker: from n/a through <= 3.2.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/marquee-style-rss-news-ticker/vulnerability/wordpress-marquee-style-rss-news-ticker-plugin-3-2-0-csrf-to-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23426
Published: 2025-01-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in Binesh Dobhal go Social go-social allows Stored XSS.This issue affects go Social: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/go-social/vulnerability/wordpress-go-social-plugin-1-0-csrf-to-stored-cross-site-scripting-xss-vulnerability?_s_id=cve