rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-24830 Advanced Access Manager < 6.8.0 - Admin+ Stored Cross-Site Scripting
The Advanced Access Manager WordPress plugin before 6.8.0 does not escape some of its settings when outputting them, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Advanced Access Manager
Credits: lang: en
value: Huy Nguyen
Published: 2021-11-23T19:16:13.000Z
CVE-2021-24831 Tab - Accordion, FAQ < 1.3.2 - Unauthenticated AJAX Calls
All AJAX actions of the Tab WordPress plugin before 1.3.2 are available to both unauthenticated and authenticated users, allowing unauthenticated attackers to modify various data in the plugin, such as add/edit/delete arbitrary tabs.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unknown
product: Tab – Accordion, FAQ
Credits: lang: en
value: Brandon Roldan
Published: 2022-01-03T12:49:05.000Z
CVE-2021-24832 WP SEO Redirect 301 < 2.3.2 - Redirect Deletion via CSRF
The WP SEO Redirect 301 WordPress plugin before 2.3.2 does not have CSRF in place when deleting redirects, which could allow attackers to make a logged in admin delete them via a CSRF attack
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: WP SEO Redirect 301
Credits: lang: en
value: Francesco Carlucci
Published: 2021-11-08T17:35:30.000Z
CVE-2021-24833 YOP Poll < 6.3.1 - Author+ Stored Cross-Site Scripting via Preview Module
The YOP Poll WordPress plugin before 6.3.1 is affected by a stored Cross-Site Scripting vulnerability, which exists in the Admin preview module where a user with a role as low as author is allowed to execute arbitrary script code within the context of the application. This vulnerability is due to insufficient validation of question and answer text parameters in Create Poll module.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: YOP Poll
Credits: lang: en
value: Vishnupriya Ilango
Published: 2021-11-17T10:15:46.000Z
CVE-2021-24834 YOP Poll < 6.3.1 - Author+ Stored Cross-Site Scripting via Options Module
The YOP Poll WordPress plugin before 6.3.1 is affected by a stored Cross-Site Scripting vulnerability which exists in the Create Poll - Options module where a user with a role as low as author is allowed to execute arbitrary script code within the context of the application. This vulnerability is due to insufficient validation of custom label parameters - vote button label , results link label and back to vote caption label.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: YOP Poll
Credits: lang: en
value: Vishnupriya Ilango
Published: 2021-11-17T10:15:47.000Z
CVE-2021-24835 WCFM - Frontend Manager for WooCommerce < 6.5.12 - Customer/Subscriber+ SQL Injection
The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible WordPress plugin before 6.5.12, when used in combination with another WCFM - WooCommerce Multivendor plugin such as WCFM - WooCommerce Multivendor Marketplace, does not escape the withdrawal_vendor parameter before using it in a SQL statement, allowing low privilege users such as Subscribers to perform SQL injection attacks
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible
Credits: lang: en
value: JrXnm
Published: 2021-11-08T17:35:31.000Z
CVE-2021-24836 Temporary Login Without Password < 1.7.1 - Subscriber+ Plugin's Settings Update
The Temporary Login Without Password WordPress plugin before 1.7.1 does not have authorisation and CSRF checks when updating its settings, which could allows any logged-in users, such as subscribers to update them
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Temporary Login Without Password
Credits: lang: en
value: apple502j
Published: 2021-12-13T10:41:04.000Z
CVE-2021-24837 Passster < 3.5.5.8 - Contributor+ Stored Cross-Site Scripting
The Passster WordPress plugin before 3.5.5.8 does not escape the area parameter of its shortcode, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Passster
default_status: unaffected
Credits: lang: en
value: apple502j
lang: en
value: WPScan
Published: 2023-01-23T14:31:59.842Z
CVE-2021-24838 AnyComment < 0.3.5 - Open Redirect
The AnyComment WordPress plugin before 0.3.5 has an API endpoint which passes user input via the redirect parameter to the wp_redirect() function without being validated first, leading to an Open Redirect issue, which according to the vendor, is a feature.
Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: Unknown
product: AnyComment
Credits: lang: en
value: Brandon Roldan
Published: 2022-01-17T13:00:27.000Z
CVE-2021-24839 SupportCandy < 2.2.5 - Unauthenticated Arbitrary Ticket Deletion
The SupportCandy WordPress plugin before 2.2.5 does not have authorisation and CSRF checks in its wpsc_tickets AJAX action, which could allow unauthenticated users to call it and delete arbitrary tickets via the set_delete_permanently_bulk_ticket setting_action. Other actions may be affected as well.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unknown
product: SupportCandy – Helpdesk & Support Ticket System
Credits: lang: en
value: Brandon Roldan
Published: 2022-02-07T15:47:09.000Z
CVE-2021-24840 Squaretype Modern Blog < 3.0.4 - Unauthenticated Private/Schedule Posts Disclosure
The Squaretype WordPress theme before 3.0.4 allows unauthenticated users to manipulate the query_vars used to retrieve the posts to display in one of its REST endpoint, without any validation. As a result, private and scheduled posts could be retrieved via a crafted request.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: Unknown
product: Squaretype
Credits: lang: en
value: Emil Kylander Edwartz
Published: 2021-11-08T17:35:33.000Z
CVE-2021-24841 Helpful < 4.4.59 - Admin+ Stored Cross-Site Scripting
The Helpful WordPress plugin before 4.4.59 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Helpful
Credits: lang: en
value: Mika
Published: 2021-11-17T10:15:49.000Z
CVE-2021-24842 Bulk Datetime Change < 1.12 - Missing Authorisation
The Bulk Datetime Change WordPress plugin before 1.12 does not enforce capability checks which allows users with Contributor roles to 1) list private post titles of other users and 2) change the posted date of other users' posts.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unknown
product: Bulk Datetime Change
Credits: lang: en
value: apple502j
Published: 2021-11-29T08:25:40.000Z
CVE-2021-24843 SupportCandy < 2.2.7 - Arbitrary Ticket Deletion via CSRF
The SupportCandy WordPress plugin before 2.2.7 does not have CRSF check in its wpsc_tickets AJAX action, which could allow attackers to make a logged in admin call it and delete arbitrary tickets via the set_delete_permanently_bulk_ticket setting_action.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: SupportCandy – Helpdesk & Support Ticket System
Credits: lang: en
value: Brandon Roldan
Published: 2022-02-07T15:47:10.000Z
CVE-2021-24844 Affiliate Manager < 2.8.7 - Admin+ SQL injection
The Affiliates Manager WordPress plugin before 2.8.7 does not validate the orderby parameter before using it in an SQL statement in the admin dashboard, leading to an SQL Injection issue
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Affiliates Manager
Credits: lang: en
value: JrXnm
Published: 2021-11-08T17:35:33.000Z
CVE-2021-24845 Improved Include Page <= 1.2 - Contributor+ Arbitrary Posts/Pages Access
The Improved Include Page WordPress plugin through 1.2 allows passing shortcode attributes with post_type & post_status which can be used to retrieve arbitrary content. This way, users with a role as low as Contributor can gain access to content they are not supposed to.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Unknown
product: Improved Include Page
Credits: lang: en
value: Francesco Carlucci
Published: 2021-12-13T10:41:05.000Z
CVE-2021-24846 Ni WooCommerce Custom Order Status < 1.9.7 - Subscriber+ SQL Injection
The get_query() function of the Ni WooCommerce Custom Order Status WordPress plugin before 1.9.7, used by the niwoocos_ajax AJAX action, available to all authenticated users, does not properly sanitise the sort parameter before using it in a SQL statement, leading to an SQL injection, exploitable by any authenticated users, such as subscriber
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Ni WooCommerce Custom Order Status
Credits: lang: en
value: JrXnm
Published: 2021-12-21T08:45:31.000Z
CVE-2021-24847 SEO Redirection < 8.2 - Subscriber+ SQL Injection
The importFromRedirection AJAX action of the SEO Redirection Plugin – 301 Redirect Manager WordPress plugin before 8.2, available to any authenticated user, does not properly sanitise the offset parameter before using it in a SQL statement, leading an SQL injection when the redirection plugin is also installed
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: SEO Redirection Plugin – 301 Redirect Manager
Credits: lang: en
value: JrXnm
Published: 2021-11-17T10:15:51.000Z
CVE-2021-24848 Mediamatic < 2.8.1 - Subscriber+ SQL Injection
The mediamaticAjaxRenameCategory AJAX action of the Mediamatic WordPress plugin before 2.8.1, available to any authenticated user, does not sanitise the categoryID parameter before using it in a SQL statement, leading to an SQL injection
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Mediamatic – Media Library Folders
Credits: lang: en
value: JrXnm
Published: 2021-12-13T10:41:07.000Z
CVE-2021-24849 WCFM - WooCommerce Multivendor Marketplace < 3.4.12 - Unauthenticated SQL Injection
The wcfm_ajax_controller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated user, does not properly sanitise multiple parameters before using them in SQL statements, leading to SQL injections
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: WCFM Marketplace – Best Multivendor Marketplace for WooCommerce
Credits: lang: en
value: JrXnm
Published: 2021-12-21T08:45:32.000Z
CVE-2021-24850 Insert Pages < 3.7.0 - Contributor+ Stored Cross-Site Scripting
The Insert Pages WordPress plugin before 3.7.0 adds a shortcode that prints out other pages' content and custom fields. It can be used by users with a role as low as Contributor to perform Cross-Site Scripting attacks by storing the payload/s in another post's custom fields.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Insert Pages
Credits: lang: en
value: Francesco Carlucci
Published: 2021-11-17T10:15:52.000Z
CVE-2021-24851 Insert Pages < 3.7.0 - Contributor+ Arbitrary Posts/Pages Access
The Insert Pages WordPress plugin before 3.7.0 allows users with a role as low as Contributor to access content and metadata from arbitrary posts/pages regardless of their author and status (ie private), using a shortcode. Password protected posts/pages are not affected by such issue.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Unknown
product: Insert Pages
Credits: lang: en
value: Francesco Carlucci
Published: 2021-11-17T10:15:54.000Z
CVE-2021-24852 MouseWheel Smooth Scroll < 5.7 - Plugin's Setting Update via CSRF
The MouseWheel Smooth Scroll WordPress plugin before 5.7 does not have CSRF check in place on its settings page, which could allow attackers to make a logged in admin change them via a CSRF attack
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: MouseWheel Smooth Scroll
Credits: lang: en
value: apple502j
Published: 2021-11-17T10:15:55.000Z
CVE-2021-24853 QR Redirector < 1.6 - Subscriber+ Arbitrary QR Redirect Response Status Update
The QR Redirector WordPress plugin before 1.6 does not have capability and CSRF checks when saving bulk QR Redirector settings via the qr_save_bulk AJAX action, which could allow any authenticated user, such as subscriber to change the redirect response status code of arbitrary QR Redirects
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Unknown
product: QR Redirector
Credits: lang: en
value: apple502j
Published: 2021-11-17T10:15:57.000Z
CVE-2021-24854 QR Redirector < 1.6.1 - Contributor+ Stored Cross-Site Scripting
The QR Redirector WordPress plugin before 1.6.1 does not sanitise and escape some of the QR Redirect fields, which could allow users with a role as low as Contributor perform Stored Cross-Site Scripting attacks.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: QR Redirector
Credits: lang: en
value: apple502j
Published: 2021-11-17T10:15:58.000Z
CVE-2021-24855 Display Post Metadata < 1.5.0 - Contributor+ Stored Cross-Site Scripting
The Display Post Metadata WordPress plugin before 1.5.0 adds a shortcode to print out custom fields, however their content is not sanitised or escaped which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Display Post Metadata
Credits: lang: en
value: Francesco Carlucci
Published: 2021-12-13T10:41:08.000Z
CVE-2021-24856 Shared Files < 1.6.61 - Admin+ Stored Cross-Site Scripting
The Shared Files WordPress plugin before 1.6.61 does not sanitise and escape the Download Counter Text settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Shared Files – Easy Download Manager and File Sharing Plugin with Frontend File Upload
Credits: lang: en
value: Mika
Published: 2021-11-17T10:16:00.000Z
CVE-2021-24857 ToTop Link <= 1.7.1 - Unauthenticated PHP Object Injection
The ToTop Link WordPress plugin through 1.7.1 passes base64 encoded user input to the unserialize() PHP function, which could lead to PHP Object injection if a plugin installed on the blog has a suitable gadget chain.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Unknown
product: ToTop Link
Credits: lang: en
value: Muhammed Kara
Published: 2021-12-13T10:41:09.000Z
CVE-2021-24858 WP Cookie User Info < 1.0.9 - Admin+ SQL Injection
The Cookie Notification Plugin for WordPress plugin before 1.0.9 does not sanitise or escape the id GET parameter before using it in a SQL statement, when retrieving the setting to edit in the admin dashboard, leading to an authenticated SQL Injection
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Cookie Notification Plugin for WordPress – WP Cookie User Info
Credits: lang: en
value: Shreya Pohekar of Codevigilant Project
Published: 2022-01-24T08:00:50.000Z
CVE-2021-24859 User Meta Shortcodes <= 0.5 - Contributor+ Unauthorized Arbitrary User Metadata Access
The User Meta Shortcodes WordPress plugin through 0.5 registers a shortcode that allows any user with a role as low as contributor to access other users metadata by specifying the user login as a parameter. This makes the WP instance vulnerable to data extrafiltration, including password hashes
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Unknown
product: User meta shortcodes
Credits: lang: en
value: Francesco Carlucci
Published: 2021-12-13T10:41:11.000Z
CVE-2021-24860 BSK PDF Manager < 3.1.2 - Admin+ SQL Injection
The BSK PDF Manager WordPress plugin before 3.1.2 does not validate and escape the orderby and order parameters before using them in a SQL statement, leading to a SQL injection issue
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: BSK PDF Manager
Credits: lang: en
value: JrXnm
Published: 2021-11-29T08:25:41.000Z
CVE-2021-24861 Quotes Collection <= 2.5.2 - Admin+ SQL Injection
The Quotes Collection WordPress plugin through 2.5.2 does not validate and escape the bulkcheck parameter before using it in a SQL statement, leading to a SQL injection
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Quotes Collection
Credits: lang: en
value: JrXnm
Published: 2021-12-13T10:41:12.000Z
CVE-2021-24862 RegistrationMagic < 5.0.1.6 - Admin+ SQL Injection
The RegistrationMagic WordPress plugin before 5.0.1.6 does not escape user input in its rm_chronos_ajax AJAX action before using it in a SQL statement when duplicating tasks in batches, which could lead to a SQL injection issue
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: RegistrationMagic – Custom Registration Forms, User Registration and User Login Plugin
Credits: lang: en
value: JrXnm
Published: 2022-01-10T15:30:30.000Z
CVE-2021-24863 StopBadBots < 6.67 - Unauthenticated SQL Injection
The WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots WordPress plugin before 6.67 does not sanitise and escape the User Agent before using it in a SQL statement to save it, leading to a SQL injection
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots
Credits: lang: en
value: JrXnm
Published: 2021-12-13T10:41:14.000Z
CVE-2021-24864 WP Cloudy < 4.4.9 - Admin+ SQL Injection
The WP Cloudy, weather plugin WordPress plugin before 4.4.9 does not escape the post_id parameter before using it in a SQL statement in the admin dashboard, leading to a SQL Injection issue
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: WP Cloudy, weather plugin
Credits: lang: en
value: JrXnm
Published: 2022-02-28T09:06:13.000Z
CVE-2021-24865 Advanced Custom Fields: Extended < 0.8.8.7 - Admin+ SQL Injection
The Advanced Custom Fields: Extended WordPress plugin before 0.8.8.7 does not validate the order and orderby parameters before using them in a SQL statement, leading to a SQL Injection issue
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Advanced Custom Fields: Extended
Credits: lang: en
value: JrXnm
Published: 2022-01-24T08:00:52.000Z
CVE-2021-24866 WP Data Access < 5.0.0 - Admin+ SQL Injection
The WP Data Access WordPress plugin before 5.0.0 does not properly sanitise and escape the backup_date parameter before using it a SQL statement, leading to a SQL injection issue and could allow arbitrary table deletion
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: WP Data Access
Credits: lang: en
value: JrXnm
Published: 2021-12-06T15:55:27.000Z
CVE-2021-24868 Document Embedder < 1.7.9 - Subscriber+ Arbitrary Private/Draft Post Title Disclosure
The Document Embedder WordPress plugin before 1.7.9 contains a AJAX action endpoint, which could allow any authenticated user, such as subscriber to enumerate the title of arbitrary private and draft posts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Credits: lang: en
value: apple502j
Published: 2022-02-01T12:21:27.000Z
CVE-2021-24869 WP Fastest Cache < 0.9.5 - Subscriber+ SQL Injection
The WP Fastest Cache WordPress plugin before 0.9.5 does not escape user input in the set_urls_with_terms method before using it in a SQL statement, leading to an SQL injection exploitable by low privilege users such as subscriber
Problem types: description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Unknown
product: WP Fastest Cache
default_status: unaffected
Credits: lang: en
value: Marc Montpas
lang: en
value: WPScan
Published: 2024-01-16T15:49:39.970Z
CVE-2021-24870 WP Fastest Cache < 0.9.5 - CSRF to Stored Cross-Site Scripting
The WP Fastest Cache WordPress plugin before 0.9.5 is lacking a CSRF check in its wpfc_save_cdn_integration AJAX action, and does not sanitise and escape some the options available via the action, which could allow attackers to make logged in high privilege users call it and set a Cross-Site Scripting payload
Problem types: description: CWE-352 Cross-Site Request Forgery (CSRF)
description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: WP Fastest Cache
default_status: unaffected
Credits: lang: en
value: Marc Montpas
lang: en
value: WPScan
Published: 2024-01-16T15:49:40.356Z
CVE-2021-24871 Get Custom Field Values < 4.0.1 - Contributor+ Stored Cross-Site Scripting
The Get Custom Field Values WordPress plugin before 4.0.1 does not escape custom fields before outputting them in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Get Custom Field Values
Credits: lang: en
value: Francesco Carlucci
Published: 2021-12-13T10:41:15.000Z
CVE-2021-24872 Get Custom Field Values < 4.0 - Contributors+ Arbitrary Post Metadata Access
The Get Custom Field Values WordPress plugin before 4.0 allows users with a role as low as Contributor to access other posts metadata without validating the permissions. Eg. contributors can access admin posts metadata.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Unknown
product: Get Custom Field Values
Credits: lang: en
value: Francesco Carlucci
Published: 2021-12-13T10:41:16.000Z
CVE-2021-24873 Tutor LMS < 1.9.11 - Reflected Cross-Site Scripting
The Tutor LMS WordPress plugin before 1.9.11 does not sanitise and escape user input before outputting back in attributes in the Student Registration page, leading to a Reflected Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Tutor LMS – eLearning and online course solution
Credits: lang: en
value: JrXnm
Published: 2021-11-23T19:16:14.000Z