deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-5734
Published: 2024-06-07
Description: A vulnerability classified as critical has been found in itsourcecode Online Discussion Forum 1.0. Affected is an unknown function of the file /members/poster.php. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-267408.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/kingshao0312/cve/issues/2; https://vuldb.com/?ctiid.267408; https://vuldb.com/?id.267408
CVE: CVE-2024-36673
Published: 2024-06-07
Description: Sourcecodester Pharmacy/Medical Store Point of Sale System 1.0 is vulnerable SQL Injection via login.php. This vulnerability stems from inadequate validation of user inputs for the email and password parameters, allowing attackers to inject malicious SQL queries.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/CveSecLook/cve/issues/39; https://github.com/CveSecLook/cve/issues/39
CVE: CVE-2024-5382
Published: 2024-06-07
Description: The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ma-template' REST API route in all versions up to, and including, 2.0.6.1. This makes it possible for unauthenticated attackers to create or modify existing Master Addons templates or make settings modifications related to these templates.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/changeset/3096299/master-addons; https://www.wordfence.com/threat-intel/vulnerabilities/id/e3820f80-9b80-4672-b2ff-3864793d2de2?source=cve; https://plugins.trac.wordpress.org/changeset/3096299/master-addons
CVE: CVE-2024-5438
Published: 2024-06-07
Description: The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.1 via the 'attempt_delete' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Instructor-level access and above, to delete arbitrary quiz attempts.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://plugins.trac.wordpress.org/browser/tutor/trunk/classes/Quiz.php#L1806; https://plugins.trac.wordpress.org/changeset/3098465/; https://www.wordfence.com/threat-intel/vulnerabilities/id/00ec14d4-d97b-40b1-b61b-05e911f49bb0?source=cve
CVE: CVE-2024-5542
Published: 2024-06-07
Description: The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Navigation Menu widget of the plugin's Mega Menu extension in all versions up to, and including, 2.0.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3096299/master-addons; https://www.wordfence.com/threat-intel/vulnerabilities/id/5151f429-b1f3-43d4-94cf-3ff382b80190?source=cve; https://plugins.trac.wordpress.org/changeset/3096299/master-addons
CVE: CVE-2024-5599
Published: 2024-06-07
Description: The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.7 via the 'fileorganizer_ajax_handler' function. This makes it possible for unauthenticated attackers to extract sensitive data including backups or other sensitive information if the files have been moved to the built-in Trash folder.
CVSS Score: 7.5 (HIGH)
CWE: CWE-922
References: https://plugins.trac.wordpress.org/browser/fileorganizer/trunk/main/ajax.php#L85; https://plugins.trac.wordpress.org/changeset/3098763/; https://www.wordfence.com/threat-intel/vulnerabilities/id/78e7b65d-91f8-477e-b992-3148c1b65d7b?source=cve
CVE: CVE-2024-31878
Published: 2024-06-07
Description: IBM i 7.2, 7.3, 7.4, and 7.5 Service Tools Server (SST) is vulnerable to SST user enumeration by a remote attacker.  This vulnerability can be used by a malicious actor to gather information about SST users that can be targeted in further attacks.   IBM X-Force ID:  287538.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/287538; https://www.ibm.com/support/pages/node/7156725; https://exchange.xforce.ibmcloud.com/vulnerabilities/287538
CVE: CVE-2024-37160
Published: 2024-06-07
Description: Formwork is a flat file-based Content Management System (CMS). An attackers (requires administrator privilege) to execute arbitrary web scripts by modifying site options via /panel/options/site. This type of attack is suitable for persistence, affecting visitors across all pages (except the dashboard). This vulnerability is fixed in 1.13.1.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/getformwork/formwork/commit/9d471204f7ebb51c3c27131581c2b834315b5e0b; https://github.com/getformwork/formwork/commit/f5312015a5a5e89b95ef2bd07e496f8474d579c5; https://github.com/getformwork/formwork/security/advisories/GHSA-5pxr-7m4j-jjc6
CVE: CVE-2024-36773
Published: 2024-06-07
Description: A cross-site scripting (XSS) vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Themes parameter at index.php.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/OoLs5/VulDiscovery/blob/main/cve-2024-36773.md; https://github.com/OoLs5/VulDiscovery/blob/main/cve-2024-36773.md
CVE: CVE-2024-36787
Published: 2024-06-07
Description: An issue in Netgear WNR614 JNR1010V2 N300-V1.1.0.54_1.0.1 allows attackers to bypass authentication and access the administrative interface via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1390
References: https://redfoxsec.com/blog/security-advisory-multiple-vulnerabilities-in-netgear-wnr614-router/; https://redfoxsec.com/blog/security-advisory-multiple-vulnerabilities-in-netgear-wnr614-router/
CVE: CVE-2024-36788
Published: 2024-06-07
Description: Netgear WNR614 JNR1010V2 N300-V1.1.0.54_1.0.1 does not properly set the HTTPOnly flag for cookies. This allows attackers to possibly intercept and access sensitive communications between the router and connected devices.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-922
References: https://redfoxsec.com/blog/security-advisory-multiple-vulnerabilities-in-netgear-wnr614-router/; https://redfoxsec.com/blog/security-advisory-multiple-vulnerabilities-in-netgear-wnr614-router/
CVE: CVE-2024-36789
Published: 2024-06-07
Description: An issue in Netgear WNR614 JNR1010V2/N300-V1.1.0.54_1.0.1 allows attackers to create passwords that do not conform to defined security standards.
CVSS Score: 8.1 (HIGH)
CWE: CWE-521
References: https://redfoxsec.com/blog/security-advisory-multiple-vulnerabilities-in-netgear-wnr614-router/; https://redfoxsec.com/blog/security-advisory-multiple-vulnerabilities-in-netgear-wnr614-router/
CVE: CVE-2024-36790
Published: 2024-06-07
Description: Netgear WNR614 JNR1010V2/N300-V1.1.0.54_1.0.1 was discovered to store credentials in plaintext.
CVSS Score: 8.8 (HIGH)
CWE: CWE-312
References: https://redfoxsec.com/blog/security-advisory-multiple-vulnerabilities-in-netgear-wnr614-router/; https://redfoxsec.com/blog/security-advisory-multiple-vulnerabilities-in-netgear-wnr614-router/
CVE: CVE-2024-36792
Published: 2024-06-07
Description: An issue in the implementation of the WPS in Netgear WNR614 JNR1010V2/N300-V1.1.0.54_1.0.1 allows attackers to gain access to the router's pin.
CVSS Score: 8.2 (HIGH)
CWE: CWE-316
References: https://redfoxsec.com/blog/security-advisory-multiple-vulnerabilities-in-netgear-wnr614-router/; https://redfoxsec.com/blog/security-advisory-multiple-vulnerabilities-in-netgear-wnr614-router/
CVE: CVE-2024-37162
Published: 2024-06-07
Description: zsa is a library for building typesafe server actions in Next.js. All users are impacted. The zsa application transfers the parse error stack from the server to the client in production build mode. This can potentially reveal sensitive information about the server environment, such as the machine username and directory paths. An attacker could exploit this vulnerability to gain unauthorized access to sensitive server information. This information could be used to plan further attacks or gain a deeper understanding of the server infrastructure. This has been patched on `0.3.3`.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-209, CWE-209
References: https://github.com/IdoPesok/zsa/commit/86b86b282bde6780963f62406cc8bc65f2c86f3a; https://github.com/IdoPesok/zsa/security/advisories/GHSA-wjmj-h3xc-hxp8; https://github.com/IdoPesok/zsa/commit/86b86b282bde6780963f62406cc8bc65f2c86f3a
CVE: CVE-2024-32503
Published: 2024-06-07
Description: An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 850, Exynos 1080, Exynos 2100, Exynos 1280, Exynos 1380, Exynos 1330, Exynos W920, Exynos W930. The mobile processor lacks proper memory deallocation checking, which can result in a UAF (Use-After-Free) vulnerability.
CVSS Score: 8.4 (HIGH)
CWE: CWE-416, CWE-762
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2024-30162
Published: 2024-06-07
Description: Invision Community through 4.7.16 allows remote code execution via the applications/core/modules/admin/editor/toolbar.php IPS\core\modules\admin\editor\_toolbar::addPlugin() method. This method handles uploaded ZIP files that are extracted into the applications/core/interface/ckeditor/ckeditor/plugins/ directory without properly verifying their content. This can be exploited by admin users (with the toolbar_manage permission) to write arbitrary PHP files into that directory, leading to execution of arbitrary PHP code in the context of the web server user.
CVSS Score: 7.2 (HIGH)
CWE: CWE-345
References: http://seclists.org/fulldisclosure/2024/Apr/21; https://invisioncommunity.com; http://seclists.org/fulldisclosure/2024/Apr/21
CVE: CVE-2024-30163
Published: 2024-06-07
Description: Invision Community before 4.7.16 allow SQL injection via the applications/nexus/modules/front/store/store.php IPS\nexus\modules\front\store\_store::_categoryView() method, where user input passed through the filter request parameter is not properly sanitized before being used to execute SQL queries. This can be exploited by unauthenticated attackers to carry out Blind SQL Injection attacks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: http://seclists.org/fulldisclosure/2024/Apr/20; https://invisioncommunity.com/release-notes/4716-r128/; http://seclists.org/fulldisclosure/2024/Apr/20
CVE: CVE-2024-31958
Published: 2024-06-07
Description: An issue was discovered in Samsung Mobile Processor EExynos 2200, Exynos 1480, Exynos 2400. It lacks a check for the validation of native handles, which can result in an Out-of-Bounds Write.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-354
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2024-31959
Published: 2024-06-07
Description: An issue was discovered in Samsung Mobile Processor Exynos 2200, Exynos 1480, Exynos 2400. It lacks a check for the validation of native handles, which can result in code execution.
CVSS Score: 8.4 (HIGH)
CWE: CWE-20
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2024-32502
Published: 2024-06-07
Description: An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 850, Exynos 1080, Exynos 2100, Exynos 1280, Exynos 1380, Exynos 1330, Exynos W920, Exynos W930. The mobile processor lacks proper reference count checking, which can result in a UAF (Use-After-Free) vulnerability.
CVSS Score: 8.4 (HIGH)
CWE: CWE-416
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2024-37163
Published: 2024-06-07
Description: SkyScrape is a GUI Dashboard for AWS Infrastructure and Managing Resources and Usage Costs.  SkyScrape's API requests are currently unsecured HTTP requests, leading to potential vulnerabilities for the user's temporary credentials and data.  This affects version 1.0.0.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-319, CWE-319
References: https://github.com/oslabs-beta/SkyScraper/security/advisories/GHSA-vfqg-qhm5-5m3j; https://github.com/oslabs-beta/SkyScraper/security/advisories/GHSA-vfqg-qhm5-5m3j
CVE: CVE-2024-3380
Published: 2024-06-07
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-4152
Published: 2024-06-07
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-5745
Published: 2024-06-07
Description: A vulnerability was found in itsourcecode Bakery Online Ordering System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/modules/product/controller.php?action=add. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-267414 is the identifier assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-434
References: https://github.com/L1OudFd8cl09/CVE/blob/main/07_06_2024_a.md; https://vuldb.com/?ctiid.267414; https://vuldb.com/?id.267414
CVE: CVE-2023-6997
Published: 2024-06-07
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-23595
Published: 2024-06-07
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-36811
Published: 2024-06-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-37295. Reason: This candidate is a reservation duplicate of CVE-2024-37295. Notes: All CVE users should reference CVE-2024-37295 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-36827
Published: 2024-06-07
Description: An XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function of ebookmeta before v1.2.8 allows attackers to access sensitive information or cause a Denial of Service (DoS) via crafted XML input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611, CWE-611
References: https://github.com/dnkorpushov/ebookmeta/issues/16#issue[PII_REDACTED]; https://github.com/dnkorpushov/ebookmeta/issues/16#issue[PII_REDACTED]
CVE: CVE-2024-37388
Published: 2024-06-07
Description: An XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function of lxml before v4.9.1 allows attackers to access sensitive information or cause a Denial of Service (DoS) via crafted XML input.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-611, CWE-611
References: https://github.com/dnkorpushov/ebookmeta/issues/16#issue[PII_REDACTED]; https://github.com/dnkorpushov/ebookmeta/issues/16#issue[PII_REDACTED]
CVE: CVE-2024-3133
Published: 2024-06-07
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-5761
Published: 2024-06-07
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: [CVE-2024-5260]. Reason: This candidate is a reservation duplicate of [CVE-2024-5260]. Notes: All CVE users should reference [CVE-ID] instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2023-49221
Published: 2024-06-07
Description: Precor touchscreen console P62, P80, and P82 could allow a remote attacker (within the local network) to bypass security restrictions, and access the service menu, because there is a hard-coded service code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-798
References: https://securityintelligence.com/x-force/internet-connected-treadmill-vulnerabilities-discovered/; https://securityintelligence.com/x-force/internet-connected-treadmill-vulnerabilities-discovered/
CVE: CVE-2023-49222
Published: 2024-06-07
Description: Precor touchscreen console P82 contains a private SSH key that corresponds to a default public key. A remote attacker could exploit this to gain root privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-798
References: https://securityintelligence.com/x-force/internet-connected-treadmill-vulnerabilities-discovered/; https://securityintelligence.com/x-force/internet-connected-treadmill-vulnerabilities-discovered/
CVE: CVE-2023-49223
Published: 2024-06-07
Description: Precor touchscreen console P62, P80, and P82 could allow a remote attacker to obtain sensitive information because the root password is stored in /etc/passwd. An attacker could exploit this to extract files and obtain sensitive information.
CVSS Score: 8.8 (HIGH)
CWE: CWE-798
References: https://securityintelligence.com/x-force/internet-connected-treadmill-vulnerabilities-discovered/; https://securityintelligence.com/x-force/internet-connected-treadmill-vulnerabilities-discovered/
CVE: CVE-2023-49224
Published: 2024-06-07
Description: Precor touchscreen console P62, P80, and P82 contains a default SSH public key in the authorized_keys file. A remote attacker could use this key to gain root privileges.
CVSS Score: 8.0 (HIGH)
CWE: CWE-798
References: https://securityintelligence.com/x-force/internet-connected-treadmill-vulnerabilities-discovered/; https://securityintelligence.com/x-force/internet-connected-treadmill-vulnerabilities-discovered/
CVE: CVE-2023-7261
Published: 2024-06-07
Description: Inappropriate implementation in Google Updator prior to 1.3.36.351 in Google Chrome allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: High)
CVSS Score: 7.8 (HIGH)
CWE: CWE-233
References: https://issues.chromium.org/issues/40064602; https://issues.chromium.org/issues/40064602
CVE: CVE-2024-1694
Published: 2024-06-07
Description: Inappropriate implementation in Google Updator prior to 1.3.36.351 in Google Chrome allowed a local attacker to bypass discretionary access control via a malicious file. (Chromium security severity: High)
CVSS Score: 7.8 (HIGH)
CWE: CWE-474
References: https://issues.chromium.org/issues/40946325; https://issues.chromium.org/issues/40946325
CVE: CVE-2024-0444
Published: 2024-06-07
Description: GStreamer AV1 Video Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the parsing of tile list data within AV1-encoded video files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22873.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/f368d63ecd89e01fd2cf0b1c4def5fc782b2c390; https://www.zerodayinitiative.com/advisories/ZDI-24-567/; https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/f368d63ecd89e01fd2cf0b1c4def5fc782b2c390
CVE: CVE-2024-5663
Published: 2024-06-08
Description: The Cards for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Cards widget in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/bb-bootstrap-cards/trunk/bb-bootstrap-cards-module/includes/frontend.php#L13; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3099081%40bb-bootstrap-cards&new=3099081%40bb-bootstrap-cards&sfp_email=&sfph_mail=#file4; https://wordpress.org/plugins/bb-bootstrap-cards/#developers
CVE: CVE-2024-3668
Published: 2024-06-08
Description: The PowerPack Pro for Elementor plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.10.17. This is due to the plugin not restricting low privileged users from setting a default role for a registration form. This makes it possible for authenticated attackers, with contributor-level access and above, to create a registration form with administrator set as the default role and then register as an administrator.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732, CWE-732
References: https://powerpackelements.com/change-logs/; https://www.wordfence.com/threat-intel/vulnerabilities/id/249ccc77-0daf-41bc-b5c5-991bf17d645d?source=cve; https://powerpackelements.com/change-logs/
CVE: CVE-2024-5770
Published: 2024-06-08
Description: The WP Force SSL & HTTPS SSL Redirect plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_save_setting' function in versions up to, and including, 1.66. This makes it possible for authenticated attackers, subscriber-level permissions and above, to update the plugin settings.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/wp-force-ssl/tags/1.66/wp-force-ssl.php#L953; https://plugins.trac.wordpress.org/changeset/3099110/; https://swisskyrepo.github.io/PayloadsAllTheThings/CRLF%20Injection/
CVE: CVE-2024-4661
Published: 2024-06-08
Description: The WP Reset plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_ajax function in all versions up to, and including, 2.02. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify the value fo the 'License Key' field for the 'Activate Pro License' setting.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/changeset/3097597/wp-reset; https://www.wordfence.com/threat-intel/vulnerabilities/id/0d2dc86e-f937-429f-9baa-0eb0a8715513?source=cve; https://plugins.trac.wordpress.org/changeset/3097597/wp-reset
CVE: CVE-2024-5087
Published: 2024-06-08
Description: The Minimal Coming Soon – Coming Soon Page plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the validate_ajax, deactivate_ajax, and save_ajax functions in all versions up to, and including, 2.38. This makes it possible for authenticated attackers, with Subscriber-level access and above, to edit the license key, which could disable features of the plugin.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/CRLF%20Injection/README.md; https://plugins.trac.wordpress.org/browser/minimal-coming-soon-maintenance-mode/tags/2.38/framework/wf-licensing.php#L51; https://plugins.trac.wordpress.org/browser/minimal-coming-soon-maintenance-mode/tags/2.38/framework/wf-licensing.php#L52