rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-24147 Modern Events Calendar Lite < 5.16.5 - Authenticated Stored Cross-Site Scripting (XSS)
Unvalidated input and lack of output encoding in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not sanitise the mic_comment field (Notes on time) when adding/editing an event, allowing users with privilege as low as author to add events with a Cross-Site Scripting payload in them, which will be triggered in the frontend when viewing the event.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Modern Events Calendar Lite
Credits: lang: en
value: Nguyen Van Khanh - SunCSR (Sun* Cyber Security Research)
Published: 2021-03-18T14:57:50.000Z
CVE-2021-24148 MStore API < 3.2.0 - Authentication Bypass With Sign In With Apple
A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allowing unauthenticated users to recover an authentication cookie with only an email address.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: Unknown
product: MStore API
Credits: lang: en
value: Vincent Datrier
Published: 2021-03-18T14:57:50.000Z
CVE-2021-24149 Modern Events Calendar Lite < 5.16.6 - Authenticated SQL Injection
Unvalidated input in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.6, did not sanitise the mec[post_id] POST parameter in the mec_fes_form AJAX action when logged in as an author+, leading to an authenticated SQL Injection issue.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Modern Events Calendar Lite
Credits: lang: en
value: Nguyen Van Khanh - SunCSR (Sun* Cyber Security Research)
Published: 2021-03-18T14:57:50.000Z
CVE-2021-24150 Like Button Rating < 2.6.32 - Unauthenticated Full-Read SSRF
The LikeBtn WordPress Like Button Rating ♥ LikeBtn WordPress plugin before 2.6.32 was vulnerable to Unauthenticated Full-Read Server-Side Request Forgery (SSRF).
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: Unknown
product: Like Button Rating ♥ LikeBtn
Credits: lang: en
value: Lauritz Holme
Published: 2021-04-05T18:27:42.000Z
CVE-2021-24151 WP Editor < 1.2.7 - Authenticated SQL injection
The WP Editor WordPress plugin before 1.2.7 did not sanitise or validate its setting fields leading to an authenticated (admin+) blind SQL injection issue via an arbitrary parameter when making a request to save the settings.
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: WP Editor
default_status: unaffected
Credits: lang: en
value: Nguyen Van Khanh - SunCSR (Sun* Cyber Security Research)
lang: en
value: WPScan
Published: 2024-01-16T15:48:54.185Z
CVE-2021-24152 Popup Builder < 3.74 - Authenticated Reflected Cross-Site Scripting (XSS)
The "All Subscribers" setting page of Popup Builder was vulnerable to reflected Cross-Site Scripting.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Popup Builder – Responsive WordPress Pop up – Subscription & Newsletter
Credits: lang: en
value: Nguyen Anh Tien - SunCSR (Sun* Cyber Security Research)
Published: 2021-04-05T18:27:42.000Z
CVE-2021-24153 Yoast SEO < 3.4.1 - Authenticated Stored Cross-Site Scripting (XSS)
A Stored Cross-Site Scripting vulnerability was discovered in the Yoast SEO WordPress plugin before 3.4.1, which had built-in blacklist filters which were blacklisting Parenthesis as well as several functions such as alert but bypasses were found.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Yoast SEO
Credits: lang: en
value: Hammad Shamsi
Published: 2021-04-05T18:27:42.000Z
CVE-2021-24154 Theme Editor < 2.6 - Authenticated Arbitrary File Download
The Theme Editor WordPress plugin before 2.6 did not validate the GET file parameter before passing it to the download_file() function, allowing administrators to download arbitrary files on the web server, such as /etc/passwd
Problem types: cwe_id: CWE-552
description: CWE-552 Files or Directories Accessible to External Parties
Affected products: vendor: Unknown
product: Theme Editor
Credits: lang: en
value: Nguyen Van Khanh - SunCSR (Sun* Cyber Security Research)
Published: 2021-04-05T18:27:42.000Z
CVE-2021-24155 Backup Guard < 1.6.0 - Authenticated Arbitrary File Upload
The WordPress Backup and Migrate Plugin – Backup Guard WordPress plugin before 1.6.0 did not ensure that the imported files are of the SGBP format and extension, allowing high privilege users (admin+) to upload arbitrary files, including PHP ones, leading to RCE.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Unknown
product: WordPress Backup and Migrate Plugin – Backup Guard
Credits: lang: en
value: Nguyen Van Khanh - SunCSR (Sun* Cyber Security Research)
Published: 2021-04-05T18:27:42.000Z
CVE-2021-24156 Testimonial Rotator <= 3.0.3 - Authenticated Stored Cross-Site Scripting
Stored Cross-Site Scripting vulnerabilities in Testimonial Rotator 3.0.3 allow low privileged users (Contributor) to inject arbitrary JavaScript code or HTML without approval. This could lead to privilege escalation
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Testimonial Rotator
Credits: lang: en
value: Nguyen Anh Tien - SunCSR (Sun* Cyber Security Research)
Published: 2021-04-05T18:27:42.000Z
CVE-2021-24157 Orbit Fox by ThemeIsle < 2.10.3 - Authenticated Stored Cross Site Scripting
Orbit Fox by ThemeIsle has a feature to add custom scripts to the header and footer of a page or post. There were no checks to verify that a user had the unfiltered_html capability prior to saving the script tags, thus allowing lower-level users to inject scripts that could potentially be malicious.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Orbit Fox by ThemeIsle
Credits: lang: en
value: Chloe Chamberland
Published: 2021-04-05T18:27:42.000Z
CVE-2021-24158 Orbit Fox by ThemeIsle < 2.10.3 - Authenticated Privilege Escalation
Orbit Fox by ThemeIsle has a feature to add a registration form to both the Elementor and Beaver Builder page builders functionality. As part of the registration form, administrators can choose which role to set as the default for users upon registration. This field is hidden from view for lower-level users, however, they can still supply the user_role parameter to update the default role for registration.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: Unknown
product: Orbit Fox by ThemeIsle
Credits: lang: en
value: Chloe Chamberland
Published: 2021-04-05T18:27:42.000Z
CVE-2021-24159 Contact Form 7 Style <=  3.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Due to the lack of sanitization and lack of nonce protection on the custom CSS feature, an attacker could craft a request to inject malicious JavaScript on a site using the Contact Form 7 Style WordPress plugin through 3.1.9. If an attacker successfully tricked a site’s administrator into clicking a link or attachment, then the request could be sent and the CSS settings would be successfully updated to include malicious JavaScript.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Contact Form 7 Style
Credits: lang: en
value: Chloe Chamberland
Published: 2021-04-05T18:27:43.000Z
CVE-2021-24160 Responsive Menu 4.0.0 - 4.0.3 - Authenticated Arbitrary File Upload
In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, subscribers could upload zip archives containing malicious PHP files that would get extracted to the /rmp-menu/ directory. These files could then be accessed via the front end of the site to trigger remote code execution and ultimately allow an attacker to execute commands to further infect a WordPress site.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: ExpressTech
product: Responsive Menu – Create Mobile-Friendly Menu
vendor: ExpressTech
product: Responsive Menu Pro
Credits: lang: en
value: Chloe Chamberland
Published: 2021-04-05T18:27:43.000Z
CVE-2021-24161 Responsive Menu < 4.0.4 - CSRF to Arbitrary File Upload
In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into uploading a zip archive containing malicious PHP files. The attacker could then access those files to achieve remote code execution and further infect the targeted site.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: ExpressTech
product: Responsive Menu – Create Mobile-Friendly Menu
vendor: ExpressTech
product: Responsive Menu Pro
Credits: lang: en
value: Chloe Chamberland
Published: 2021-04-05T18:27:43.000Z
CVE-2021-24162 Responsive Menu < 4.0.4 - CSRF to Settings Update
In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into importing all new settings. These settings could be modified to include malicious JavaScript, therefore allowing an attacker to inject payloads that could aid in further infection of the site.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: ExpressTech
product: Responsive Menu – Create Mobile-Friendly Menu
vendor: ExpressTech
product: Responsive Menu Pro
Credits: lang: en
value: Chloe Chamberland
Published: 2021-04-05T18:27:43.000Z
CVE-2021-24163 Ninja Forms < 3.4.34 - Authenticated SendWP Plugin Installation and Client Secret Key Disclosure
The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it have any nonce protection, therefore making it possible for low-level users, such as subscribers, to install and activate the SendWP Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4.34 and retrieve the client_secret key needed to establish the SendWP connection while also installing the SendWP plugin.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Unknown
product: Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
Credits: lang: en
value: Chloe Chamberland
Published: 2021-04-05T18:27:43.000Z
CVE-2021-24164 Ninja Forms < 3.4.34.1 - Authenticated OAuth Connection Key Disclosure
In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ajax_nf_oauth, and retrieve the connection url needed to establish a connection. They could also retrieve the client_id for an already established OAuth connection.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Unknown
product: Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
Credits: lang: en
value: Chloe Chamberland
Published: 2021-04-05T18:27:43.000Z
CVE-2021-24165 Ninja Forms < 3.4.34 - Administrator Open Redirect
In the Ninja Forms Contact Form WordPress plugin before 3.4.34, the wp_ajax_nf_oauth_connect AJAX action was vulnerable to open redirect due to the use of a user supplied redirect parameter and no protection in place.
Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: Unknown
product: Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
Credits: lang: en
value: Chloe Chamberland
Published: 2021-04-05T18:27:43.000Z
CVE-2021-24166 Ninja Forms < 3.4.34 - CSRF to OAuth Service Disconnection
The wp_ajax_nf_oauth_disconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4.34 had no nonce protection making it possible for attackers to craft a request to disconnect a site's OAuth connection.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
Credits: lang: en
value: Chloe Chamberland
Published: 2021-04-05T18:27:43.000Z
CVE-2021-24167 Web-Stat < 1.4.1 - API Key Disclosure
When visiting a site running Web-Stat < 1.4.0, the "wts_web_stat_load_init" function used the visitor’s browser to send an XMLHttpRequest request to https://wts2.one/ajax.htm?action=lookup_WP_account.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Unknown
product: Web-Stat
Credits: lang: en
value: Ramuel Gall
Published: 2021-04-05T18:27:43.000Z
CVE-2021-24168 Easy Contact Form Pro < 1.1.1.9 - Authenticated Stored Cross-Site Scripting (XSS)
The Easy Contact Form Pro WordPress plugin before 1.1.1.9 did not properly sanitise the text fields (such as Email Subject, Email Recipient, etc) when creating or editing a form, leading to an authenticated (author+) stored cross-site scripting issue. This could allow medium privilege accounts (such as author and editor) to perform XSS attacks against high privilege ones like administrator.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Easy Contact Form Pro
Credits: lang: en
value: Rahul Ramakant Singh
Published: 2021-04-05T18:27:44.000Z
CVE-2021-24169 Advanced Order Export For WooCommerce < 3.1.8 - Reflected Cross-Site Scripting (XSS)
This Advanced Order Export For WooCommerce WordPress plugin before 3.1.8 helps you to easily export WooCommerce order data. The tab parameter in the Admin Panel is vulnerable to reflected XSS.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Advanced Order Export For WooCommerce
Credits: lang: en
value: 0xB9
Published: 2021-04-05T18:27:44.000Z
CVE-2021-24170 User Profile Picture < 2.5.0 - Sensitive Information Disclosure
The REST API endpoint get_users in the User Profile Picture WordPress plugin before 2.5.0 returned more information than was required for its functionality to users with the upload_files capability. This included password hashes, hashed user activation keys, usernames, emails, and other less sensitive information.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: Unknown
product: User Profile Picture
Credits: lang: en
value: Chloe Chamberland
Published: 2021-04-05T18:27:44.000Z
CVE-2021-24171 WooCommerce Upload Files < 59.4 - Unauthenticated Arbitrary File Upload
The WooCommerce Upload Files WordPress plugin before 59.4 ran a single sanitization pass to remove blocked extensions such as .php. It was possible to bypass this and upload a file with a PHP extension by embedding a "blocked" extension within another "blocked" extension in the "wcuf_file_name" parameter. It was also possible to perform a double extension attack and upload files to a different location via path traversal using the "wcuf_current_upload_session_id" parameter.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Unknown
product: WooCommerce Upload Files
Credits: lang: en
value: Ramuel Gall
Published: 2021-04-05T18:27:44.000Z
CVE-2021-24172 VM Backups <= 1.0 - CSRF to Database Backup Download
The VM Backups WordPress plugin through 1.0 does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as generate backups of the DB, plugins, and current .
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: VM Backups
Credits: lang: en
value: 0xB9
Published: 2021-04-05T18:27:44.000Z
CVE-2021-24173 VM Backups <= 1.0 - CSRF to Stored Cross-Site Scripting (XSS)
The VM Backups WordPress plugin through 1.0 does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as update the plugin's options, leading to a Stored Cross-Site Scripting issue.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: VM Backups
Credits: lang: en
value: 0xB9
Published: 2021-04-05T18:27:44.000Z
CVE-2021-24174 Database Backups <= 1.2.2.6 - CSRF to Backup Download
The Database Backups WordPress plugin through 1.2.2.6 does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as generate backups of the database, change the plugin's settings and delete backups.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Database Backups
Credits: lang: en
value: 0xB9
Published: 2021-04-05T18:27:44.000Z
CVE-2021-24175 The Plus Addons for Elementor Page Builder < 4.1.7 - Authentication Bypass
The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.7 was being actively exploited to by malicious actors to bypass authentication, allowing unauthenticated users to log in as any user (including admin) by just providing the related username, as well as create accounts with arbitrary roles, such as admin. These issues can be exploited even if registration is disabled, and the Login widget is not active.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: Unknown
product: The Plus Addons for Elementor Page Builder
Credits: lang: en
value: Ville Korhonen (Seravo), Antony Booker (WP Charged)
Published: 2021-04-05T18:27:44.000Z
CVE-2021-24176 JH 404 Logger <= 1.1 - Unauthenticated Stored Cross-Site Scripting (XSS)
The JH 404 Logger WordPress plugin through 1.1 doesn't sanitise the referer and path of 404 pages, when they are output in the dashboard, which leads to executing arbitrary JavaScript code in the WordPress dashboard.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: JH 404 Logger
Credits: lang: en
value: Ganesh Bagaria
Published: 2021-04-05T18:27:44.000Z
CVE-2021-24177 WP File Manager < 7.1 - Reflected Cross-Site Scripting (XSS)
In the default configuration of the File Manager WordPress plugin before 7.1, a Reflected XSS can occur on the endpoint /wp-admin/admin.php?page=wp_file_manager_properties when a payload is submitted on the User-Agent parameter. The payload is then reflected back on the web application response.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: File Manager
Credits: lang: en
value: Veno Eivazian
Published: 2021-04-05T18:27:45.000Z
CVE-2021-24178 Business Directory Plugin < 5.11.1 - Arbitrary Add/Edit/Delete Form Field to Stored XSS
The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.1 suffered from Cross-Site Request Forgery issues, allowing an attacker to make a logged in administrator add, edit or delete form fields, which could also lead to Stored Cross-Site Scripting issues.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Business Directory Team
product: Business Directory Plugin – Easy Listing Directories for WordPress
Credits: lang: en
value: 0xB9
Published: 2021-05-05T18:39:42.000Z
CVE-2021-24179 Business Directory Plugin < 5.11 - Arbitrary File Upload to RCE
The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11 suffered from a Cross-Site Request Forgery issue, allowing an attacker to make a logged in administrator import files. As the plugin also did not validate uploaded files, it could lead to RCE.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Business Directory Team
product: Business Directory Plugin – Easy Listing Directories for WordPress
Credits: lang: en
value: 0xB9
Published: 2021-05-05T18:39:42.000Z
CVE-2021-24180 Related Posts for WordPress < 2.0.4 - Authenticated Reflected Cross-Site Scripting (XSS)
Unvalidated input and lack of output encoding within the Related Posts for WordPress plugin before 2.0.4 lead to a Reflected Cross-Site Scripting (XSS) vulnerability within the 'lang' GET parameter while editing a post, triggered when users with the capability of editing posts access a malicious URL.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Related Posts for WordPress
Credits: lang: en
value: Nguyen Anh Tien - SunCSR (Sun* Cyber Security Research)
Published: 2021-04-05T18:27:45.000Z
CVE-2021-24181 Tutor LMS < 1.7.7 - SQL Injection via tutor_mark_answer_as_correct
The tutor_mark_answer_as_correct AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Tutor LMS – eLearning and online course solution
Credits: lang: en
value: Chloe Chamberland
Published: 2021-04-05T18:27:45.000Z
CVE-2021-24182 Tutor LMS < 1.8.3 - SQL Injection via tutor_quiz_builder_get_answers_by_question
The tutor_quiz_builder_get_answers_by_question AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Tutor LMS – eLearning and online course solution
Credits: lang: en
value: Chloe Chamberland
Published: 2021-04-05T18:27:45.000Z
CVE-2021-24183 Tutor LMS < 1.8.3 - SQL Injection via tutor_quiz_builder_get_question_form
The tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Tutor LMS – eLearning and online course solution
Credits: lang: en
value: Chloe Chamberland
Published: 2021-04-05T18:27:45.000Z
CVE-2021-24184 Tutor LMS < 1.7.7 - Unprotected AJAX including Privilege Escalation
Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing students to modify course information and elevate their privileges among many other actions.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unknown
product: Tutor LMS – eLearning and online course solution
Credits: lang: en
value: Chloe Chamberland
Published: 2021-04-05T18:27:45.000Z
CVE-2021-24185 Tutor LMS < 1.7.7 - SQL Injection via tutor_place_rating
The tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Tutor LMS – eLearning and online course solution
Credits: lang: en
value: Chloe Chamberland
Published: 2021-04-05T18:27:45.000Z