deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-20884
Published: 2024-06-04
Description: Incorrect use of privileged API vulnerability in getSemBatteryUsageStats in BatteryStatsService prior to SMR Jun-2024 Release 1 allows local attackers to use privileged API.
CVSS Score: 6.2 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=06; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=06
CVE: CVE-2024-20885
Published: 2024-06-04
Description: Improper component protection vulnerability in Samsung Dialer prior to SMR May-2024 Release 1 allows local attackers to make a call without proper permission.
CVSS Score: 5.1 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=06; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=06
CVE: CVE-2024-20886
Published: 2024-06-04
Description: Arbitrary directory creation in Samsung Live Wallpaper PC prior to version 3.3.8.0 allows attacker to create arbitrary directory.
CVSS Score: 6.2 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=06; https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=06
CVE: CVE-2024-20887
Published: 2024-06-04
Description: Arbitrary directory creation in GalaxyBudsManager PC prior to version 2.1.240315.51 allows attacker to create arbitrary directory.
CVSS Score: 6.2 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=06; https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=06
CVE: CVE-2024-5485
Published: 2024-06-04
Description: The SureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Trigger Link shortcode in all versions up to, and including, 1.0.47 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3096816/; https://wordpress.org/plugins/suretriggers/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/ab19f7b1-2b1e-43bc-9843-ddee0fc74f50?source=cve
CVE: CVE-2023-38520
Published: 2024-06-04
Description: External Control of Assumed-Immutable Web Parameter vulnerability in PINPOINT.WORLD Pinpoint Booking System allows Functionality Misuse.This issue affects Pinpoint Booking System: from n/a through 2.9.9.3.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-472
References: https://patchstack.com/database/vulnerability/booking-system/wordpress-pinpoint-booking-system-plugin-2-9-9-3-4-parameter-tampering?_s_id=cve; https://patchstack.com/database/vulnerability/booking-system/wordpress-pinpoint-booking-system-plugin-2-9-9-3-4-parameter-tampering?_s_id=cve
CVE: CVE-2023-39161
Published: 2024-06-04
Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WP Discussion Board Discussion Board allows Content Spoofing, Cross-Site Scripting (XSS).This issue affects Discussion Board: from n/a through 2.4.8.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-80
References: https://patchstack.com/database/vulnerability/wp-discussion-board/wordpress-discussion-board-plugin-2-4-8-content-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-discussion-board/wordpress-discussion-board-plugin-2-4-8-content-injection-vulnerability?_s_id=cve
CVE: CVE-2023-40332
Published: 2024-06-04
Description: Improper Control of Interaction Frequency vulnerability in Lester ‘GaMerZ’ Chan WP-PostRatings allows Functionality Misuse.This issue affects WP-PostRatings: from n/a through 1.91.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-799, CWE-290
References: https://patchstack.com/database/vulnerability/wp-postratings/wordpress-wp-postratings-plugin-1-91-rating-limit-bypass-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-postratings/wordpress-wp-postratings-plugin-1-91-rating-limit-bypass-vulnerability?_s_id=cve
CVE: CVE-2023-40557
Published: 2024-06-04
Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in PickPlugins Tabs & Accordion allows Code Injection.This issue affects Tabs & Accordion: from n/a through 1.3.10.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-80
References: https://patchstack.com/database/vulnerability/tabs/wordpress-tabs-accordion-plugin-1-3-8-content-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/tabs/wordpress-tabs-accordion-plugin-1-3-8-content-injection-vulnerability?_s_id=cve
CVE: CVE-2023-40673
Published: 2024-06-04
Description: : Improper Control of Interaction Frequency vulnerability in cartpauj Cartpauj Register Captcha allows Functionality Misuse.This issue affects Cartpauj Register Captcha: from n/a through 1.0.02.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-799
References: https://patchstack.com/database/vulnerability/cartpauj-register-captcha/wordpress-cartpauj-register-captcha-plugin-1-0-02-captcha-bypass-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/cartpauj-register-captcha/wordpress-cartpauj-register-captcha-plugin-1-0-02-captcha-bypass-vulnerability?_s_id=cve
CVE: CVE-2023-41134
Published: 2024-06-04
Description: Authentication Bypass by Spoofing vulnerability in pluginkollektiv Antispam Bee allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Antispam Bee: from n/a through 2.11.3.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-290
References: https://patchstack.com/database/vulnerability/antispam-bee/wordpress-antispam-bee-plugin-2-11-3-country-ip-restriction-bypass-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/antispam-bee/wordpress-antispam-bee-plugin-2-11-3-country-ip-restriction-bypass-vulnerability?_s_id=cve
CVE: CVE-2023-44235
Published: 2024-06-04
Description: Improper Restriction of Excessive Authentication Attempts vulnerability in Devnath verma WP Captcha allows Functionality Bypass.This issue affects WP Captcha: from n/a through 2.0.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-307
References: https://patchstack.com/database/vulnerability/wp-captcha/wordpress-wp-captcha-plugin-2-0-0-captcha-bypass-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-captcha/wordpress-wp-captcha-plugin-2-0-0-captcha-bypass-vulnerability?_s_id=cve
CVE: CVE-2024-36104
Published: 2024-06-04
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.14.

Users are recommended to upgrade to version 18.12.14, which fixes the issue.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2024/06/03/1; https://issues.apache.org/jira/browse/OFBIZ-13092; https://lists.apache.org/thread/sv0xr8b1j7mmh5p37yldy9vmnzbodz2o
CVE: CVE-2024-4253
Published: 2024-06-04
Description: A command injection vulnerability exists in the gradio-app/gradio repository, specifically within the 'test-functional.yml' workflow. The vulnerability arises due to improper neutralization of special elements used in a command, allowing for unauthorized modification of the base repository or secrets exfiltration. The issue affects versions up to and including '@gradio/video@0.6.12'. The flaw is present in the workflow's handling of GitHub context information, where it echoes the full name of the head repository, the head branch, and the workflow reference without adequate sanitization. This could potentially lead to the exfiltration of sensitive secrets such as 'GITHUB_TOKEN', 'COMMENT_TOKEN', and 'CHROMATIC_PROJECT_TOKEN'.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78
References: https://github.com/gradio-app/gradio/commit/a0e70366a8a406fdd80abb21e8c88a3c8e682a2b; https://huntr.com/bounties/23cb3749-8ae9-4e1a-9023-4a20ca6b675e; https://github.com/gradio-app/gradio/commit/a0e70366a8a406fdd80abb21e8c88a3c8e682a2b
CVE: CVE-2024-5420
Published: 2024-06-04
Description: Missing input validation in the SEH Computertechnik utnserver Pro, SEH Computertechnik utnserver ProMAX, SEH Computertechnik INU-100 web-interface allows stored Cross-Site Scripting (XSS)..This issue affects utnserver Pro, utnserver ProMAX, INU-100 version 20.1.22 and below.
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2024/Jun/4; https://cyberdanube.com/security-research/multiple-vulnerabilities-in-seh-untserver-pro/; http://seclists.org/fulldisclosure/2024/Jun/4
CVE: CVE-2024-5421
Published: 2024-06-04
Description: Missing input validation and OS command integration of the input in the utnserver Pro, utnserver ProMAX, INU-100 web-interface allows authenticated command injection.This issue affects utnserver Pro, utnserver ProMAX, INU-100 version 20.1.22 and below.
CWE: CWE-78
References: http://seclists.org/fulldisclosure/2024/Jun/4; https://cyberdanube.com/en/en-multiple-vulnerabilities-in-seh-untserver-pro/index.html; http://seclists.org/fulldisclosure/2024/Jun/4
CVE: CVE-2024-5422
Published: 2024-06-04
Description: An uncontrolled resource consumption of file descriptors in SEH Computertechnik utnserver Pro, SEH Computertechnik utnserver ProMAX, SEH Computertechnik INU-100 allows DoS via HTTP.This issue affects utnserver Pro, utnserver ProMAX, INU-100 version 20.1.22 and below.
CWE: CWE-400
References: http://seclists.org/fulldisclosure/2024/Jun/4; https://cyberdanube.com/en/en-multiple-vulnerabilities-in-seh-untserver-pro/index.html; http://seclists.org/fulldisclosure/2024/Jun/4
CVE: CVE-2023-45009
Published: 2024-06-04
Description: Improper Restriction of Excessive Authentication Attempts vulnerability in Forge12 Interactive GmbH Captcha/Honeypot for Contact Form 7 allows Functionality Bypass.This issue affects Captcha/Honeypot for Contact Form 7: from n/a through 1.11.3.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-307
References: https://patchstack.com/database/vulnerability/captcha-for-contact-form-7/wordpress-captcha-for-contact-form-7-plugin-1-11-3-capcha-bypass-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/captcha-for-contact-form-7/wordpress-captcha-for-contact-form-7-plugin-1-11-3-capcha-bypass-vulnerability?_s_id=cve
CVE: CVE-2023-5751
Published: 2024-06-04
Description: A local attacker with low privileges can read and modify any users files and cause a DoS in the working directory of the affected products due to exposure of resource to wrong sphere. 

CVSS Score: 7.8 (HIGH)
CWE: CWE-668
References: https://cert.vde.com/en/advisories/VDE-2024-027; https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=18354&token=f3e92a942c3a2f90c272a5ded7598c6a0b5f4924&download=; https://cert.vde.com/en/advisories/VDE-2024-027
CVE: CVE-2024-4581
Published: 2024-06-04
Description: The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Add Layer widget in all versions up to, and including, 6.7.11 due to insufficient input sanitization and output escaping on the user supplied 'class', 'id', and 'title' attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: Successful exploitation of this vulnerability requires an Administrator to give Slider Creation privileges to Author-level users.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.sliderrevolution.com/documentation/changelog/; https://www.wordfence.com/threat-intel/vulnerabilities/id/a99b8eb9-1511-4ec0-98f4-c0e0c989fa28?source=cve; https://www.sliderrevolution.com/documentation/changelog/
CVE: CVE-2024-5000
Published: 2024-06-04
Description: An unauthenticated remote attacker can use a malicious OPC UA client to send a crafted request to affected CODESYS products which can cause a DoS due to incorrect calculation of buffer size.


CVSS Score: 7.5 (HIGH)
CWE: CWE-131
References: https://cert.vde.com/en/advisories/VDE-2024-026; https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=18355&token=e3e5a937ce72602bec39718ddc2f4ba6d983ccd1&download=; https://cert.vde.com/en/advisories/VDE-2024-026
CVE: CVE-2023-45053
Published: 2024-06-04
Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in pluginever WP Content Pilot – Autoblogging & Affiliate Marketing Plugin allows Code Injection.This issue affects WP Content Pilot – Autoblogging & Affiliate Marketing Plugin: from n/a through 1.3.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-80
References: https://patchstack.com/database/vulnerability/wp-content-pilot/wordpress-wp-content-pilot-autoblogging-affiliate-marketing-plugin-plugin-1-3-3-html-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-content-pilot/wordpress-wp-content-pilot-autoblogging-affiliate-marketing-plugin-plugin-1-3-3-html-injection-vulnerability?_s_id=cve
CVE: CVE-2023-45635
Published: 2024-06-04
Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WP Darko Responsive Tabs allows Code Injection.This issue affects Responsive Tabs: from n/a before 4.0.6.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-80
References: https://patchstack.com/database/vulnerability/responsive-tabs/wordpress-responsive-tabs-plugin-4-0-6-html-content-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/responsive-tabs/wordpress-responsive-tabs-plugin-4-0-6-html-content-injection-vulnerability?_s_id=cve
CVE: CVE-2023-46310
Published: 2024-06-04
Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in gVectors Team wpDiscuz allows Code Injection.This issue affects wpDiscuz: from n/a through 7.6.10.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://patchstack.com/database/vulnerability/wpdiscuz/wordpress-wpdiscuz-plugin-7-6-10-content-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wpdiscuz/wordpress-wpdiscuz-plugin-7-6-10-content-injection-vulnerability?_s_id=cve
CVE: CVE-2023-46630
Published: 2024-06-04
Description: Improper Authentication vulnerability in wpase Admin and Site Enhancements (ASE) allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Admin and Site Enhancements (ASE): from n/a through 5.7.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://patchstack.com/database/vulnerability/admin-site-enhancements/wordpress-admin-and-site-enhancements-ase-plugin-5-7-1-password-protected-view-bypass-vulnerability-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/admin-site-enhancements/wordpress-admin-and-site-enhancements-ase-plugin-5-7-1-password-protected-view-bypass-vulnerability-vulnerability?_s_id=cve
CVE: CVE-2023-47189
Published: 2024-06-04
Description: Improper Authentication vulnerability in WPMU DEV Defender Security allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Defender Security: from n/a through 4.2.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: https://patchstack.com/database/vulnerability/defender-security/wordpress-defender-securit-plugin-4-2-0-masked-login-area-view-bypass-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/defender-security/wordpress-defender-securit-plugin-4-2-0-masked-login-area-view-bypass-vulnerability?_s_id=cve
CVE: CVE-2023-47513
Published: 2024-06-04
Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ARI Soft ARI Stream Quiz allows Code Injection.This issue affects ARI Stream Quiz: from n/a through 1.3.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-80
References: https://patchstack.com/database/vulnerability/ari-stream-quiz/wordpress-ari-stream-quiz-wordpress-quizzes-builder-plugin-1-2-32-content-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ari-stream-quiz/wordpress-ari-stream-quiz-wordpress-quizzes-builder-plugin-1-2-32-content-injection-vulnerability?_s_id=cve
CVE: CVE-2023-47663
Published: 2024-06-04
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-47769
Published: 2024-06-04
Description: Authentication Bypass by Spoofing vulnerability in WP Maintenance allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Maintenance: from n/a through 6.1.3.
CVSS Score: 3.7 (LOW)
CWE: CWE-290
References: https://patchstack.com/database/vulnerability/wp-maintenance/wordpress-wp-maintenance-plugin-6-1-3-ip-filtering-bypass-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-maintenance/wordpress-wp-maintenance-plugin-6-1-3-ip-filtering-bypass-vulnerability?_s_id=cve
CVE: CVE-2023-47818
Published: 2024-06-04
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in LWS LWS Hide Login allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects LWS Hide Login: from n/a through 2.1.8.
CVSS Score: 3.7 (LOW)
CWE: CWE-200
References: https://patchstack.com/database/vulnerability/lws-hide-login/wordpress-lws-hide-login-plugin-2-1-8-secret-login-page-location-disclosure-on-multisites-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/lws-hide-login/wordpress-lws-hide-login-plugin-2-1-8-secret-login-page-location-disclosure-on-multisites-vulnerability?_s_id=cve
CVE: CVE-2023-47837
Published: 2024-06-04
Description: Improper Privilege Management vulnerability in Repute Infosystems ARMember allows Privilege Escalation.This issue affects ARMember: from n/a through 4.0.10.
CVSS Score: 8.3 (HIGH)
CWE: CWE-269
References: https://patchstack.com/database/vulnerability/armember-membership/wordpress-armember-plugin-4-0-10-membership-plan-bypass-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/armember-membership/wordpress-armember-plugin-4-0-10-membership-plan-bypass-vulnerability?_s_id=cve
CVE: CVE-2024-4637
Published: 2024-06-04
Description: The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 6.7.10 due to insufficient input sanitization and output escaping on the user supplied Elementor 'wrapperid' and 'zindex' display attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.sliderrevolution.com/documentation/changelog/; https://www.wordfence.com/threat-intel/vulnerabilities/id/457b5066-da37-4877-9abe-c912bc201f29?source=cve; https://www.sliderrevolution.com/documentation/changelog/
CVE: CVE-2024-5463
Published: 2024-06-04
Description: A vulnerability regarding buffer copy without checking the size of input ('Classic Buffer Overflow') has been found in the login component. This allows remote attackers to write specific files containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors. This attack only affects the login service which will automatically restart. The following models with Synology Camera Firmware versions before 1.1.1-0383 may be affected: BC500 and TC500.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.synology.com/en-global/security/advisory/Synology_SA_24_07; https://www.synology.com/en-global/security/advisory/Synology_SA_24_07
CVE: CVE-2023-48271
Published: 2024-06-04
Description: Authentication Bypass by Spoofing vulnerability in yonifre Maspik – Spam blacklist allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Maspik – Spam blacklist: from n/a through 0.10.3.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-290
References: https://patchstack.com/database/vulnerability/contact-forms-anti-spam/wordpress-maspik-spam-blacklist-plugin-0-9-2-ip-filtering-bypass-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/contact-forms-anti-spam/wordpress-maspik-spam-blacklist-plugin-0-9-2-ip-filtering-bypass-vulnerability?_s_id=cve
CVE: CVE-2023-48276
Published: 2024-06-04
Description: Improper Restriction of Excessive Authentication Attempts vulnerability in Nitin Rathod WP Forms Puzzle Captcha allows Functionality Bypass.This issue affects WP Forms Puzzle Captcha: from n/a through 4.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-307
References: https://patchstack.com/database/vulnerability/wp-forms-puzzle-captcha/wordpress-wp-forms-puzzle-captcha-plugin-4-1-captcha-bypass-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-forms-puzzle-captcha/wordpress-wp-forms-puzzle-captcha-plugin-4-1-captcha-bypass-vulnerability?_s_id=cve
CVE: CVE-2023-48285
Published: 2024-06-04
Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Tips and Tricks HQ Stripe Payments allows Code Injection.This issue affects Stripe Payments: from n/a through 2.0.79.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-80
References: https://patchstack.com/database/vulnerability/stripe-payments/wordpress-accept-stripe-payments-plugin-2-0-79-content-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/stripe-payments/wordpress-accept-stripe-payments-plugin-2-0-79-content-injection-vulnerability?_s_id=cve
CVE: CVE-2023-48290
Published: 2024-06-04
Description: Improper Restriction of Excessive Authentication Attempts vulnerability in 10Web Form Builder Team Form Maker by 10Web allows Functionality Bypass.This issue affects Form Maker by 10Web: from n/a through 1.15.20.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-307
References: https://patchstack.com/database/vulnerability/form-maker/wordpress-form-maker-by-10web-plugin-1-15-20-captcha-bypass-vulnerability-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/form-maker/wordpress-form-maker-by-10web-plugin-1-15-20-captcha-bypass-vulnerability-vulnerability?_s_id=cve
CVE: CVE-2023-48318
Published: 2024-06-04
Description: Improper Restriction of Excessive Authentication Attempts vulnerability in CodePeople Contact Form Email allows Functionality Bypass.This issue affects Contact Form Email: from n/a through 1.3.41.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-307, CWE-307
References: https://patchstack.com/database/vulnerability/contact-form-to-email/wordpress-contact-form-email-plugin-1-3-41-captcha-bypass-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/contact-form-to-email/wordpress-contact-form-email-plugin-1-3-41-captcha-bypass-vulnerability?_s_id=cve
CVE: CVE-2023-48335
Published: 2024-06-04
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Webcraftic Hide login page allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Hide login page: from n/a through 1.1.9.
CVSS Score: 3.7 (LOW)
CWE: CWE-200
References: https://patchstack.com/database/vulnerability/hide-login-page/wordpress-hide-login-page-plugin-1-1-7-secret-login-page-location-disclosure-on-multisites-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/hide-login-page/wordpress-hide-login-page-plugin-1-1-7-secret-login-page-location-disclosure-on-multisites-vulnerability?_s_id=cve
CVE: CVE-2023-48745
Published: 2024-06-04
Description: Improper Restriction of Excessive Authentication Attempts vulnerability in WebFactory Ltd Captcha Code allows Functionality Bypass.This issue affects Captcha Code: from n/a through 2.9.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-307
References: https://patchstack.com/database/vulnerability/captcha-code-authentication/wordpress-captcha-code-plugin-2-8-captcha-bypass-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/captcha-code-authentication/wordpress-captcha-code-plugin-2-8-captcha-bypass-vulnerability?_s_id=cve