rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-13271 Content Entity Clone - Moderately critical - Information Disclosure - SA-CONTRIB-2024-035
Incorrect Authorization vulnerability in Drupal Content Entity Clone allows Forceful Browsing.This issue affects Content Entity Clone: from 0.0.0 before 1.0.4.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Drupal
product: Content Entity Clone
default_status: unaffected
Credits: lang: en
value: Vojislav Jovanovic
lang: en
value: orakili
lang: en
value: Vojislav Jovanovic
lang: en
value: Greg Knaddison
lang: en
value: Juraj Nemec
Published: 2025-01-09T19:19:49.832Z
CVE-2024-13272 Paragraphs table - Critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-036
Insufficient Granularity of Access Control vulnerability in Drupal Paragraphs table allows Content Spoofing.This issue affects Paragraphs table: from 0.0.0 before 1.23.0, from 2.0.0 before 2.0.2.
Problem types: cwe_id: CWE-1220
description: CWE-1220 Insufficient Granularity of Access Control
Affected products: vendor: Drupal
product: Paragraphs table
default_status: unaffected
Credits: lang: en
value: James Williams
lang: en
value: James Williams
lang: en
value: NGUYEN Bao
lang: en
value: Steven Jones
lang: en
value: Joseph Olstad
lang: en
value: Greg Knaddison
lang: en
value: Jess
lang: en
value: Juraj Nemec
Published: 2025-01-09T19:20:41.907Z
CVE-2024-13273 Open Social - Moderately critical - Cross Site Scripting, Denial of Service - SA-CONTRIB-2024-037
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Open Social allows Cross-Site Scripting (XSS).This issue affects Open Social: from 0.0.0 before 12.3.8, from 12.4.0 before 12.4.5, from 13.0.0 before 13.0.0-alpha11.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Drupal
product: Open Social
default_status: unaffected
Credits: lang: en
value: Thiago Régis
lang: en
value: Thiago Régis
lang: en
value: Ronald te Brake
lang: en
value: Greg Knaddison
lang: en
value: Juraj Nemec
Published: 2025-01-09T19:26:21.730Z
CVE-2024-13274 Open Social - Moderately critical - Denial of Service - SA-CONTRIB-2024-038
Improper Control of Interaction Frequency vulnerability in Drupal Open Social allows Functionality Misuse.This issue affects Open Social: from 0.0.0 before 12.3.8, from 12.4.0 before 12.4.5.
Problem types: cwe_id: CWE-799
description: CWE-799 Improper Control of Interaction Frequency
Affected products: vendor: Drupal
product: Open Social
default_status: unaffected
Credits: lang: en
value: vnech
lang: en
value: Ronald te Brake
lang: en
value: vnech
lang: en
value: Greg Knaddison
lang: en
value: Juraj Nemec
lang: en
value: Heine Deelstra
Published: 2025-01-09T19:27:04.989Z
CVE-2024-13275 Security Kit - Less critical - Denial of Service - SA-CONTRIB-2024-039
Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Drupal Security Kit allows HTTP DoS.This issue affects Security Kit: from 0.0.0 before 2.0.3.
Problem types: cwe_id: CWE-843
description: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
Affected products: vendor: Drupal
product: Security Kit
default_status: unaffected
Credits: lang: en
value: _b0lli
lang: en
value: jweowu
lang: en
value: Drew Webber
lang: en
value: Greg Knaddison
lang: en
value: Drew Webber
lang: en
value: Heine Deelstra
Published: 2025-01-09T19:27:30.461Z
CVE-2024-13276 File Entity (fieldable files) - Moderately critical - Information Disclosure - SA-CONTRIB-2024-040
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal File Entity (fieldable files) allows Forceful Browsing.This issue affects File Entity (fieldable files): from 7.X-* before 7.X-2.39.
Problem types: cwe_id: CWE-201
description: CWE-201 Insertion of Sensitive Information Into Sent Data
Affected products: vendor: Drupal
product: File Entity (fieldable files)
default_status: unaffected
Credits: lang: en
value: Devin Zuczek
lang: en
value: Devin Zuczek
lang: en
value: Joseph Olstad
lang: en
value: Greg Knaddison
lang: en
value: Damien McKenna
lang: en
value: Juraj Nemec
Published: 2025-01-09T19:28:40.601Z
CVE-2024-13277 Smart IP Ban - Critical - Access bypass - SA-CONTRIB-2024-041
Incorrect Authorization vulnerability in Drupal Smart IP Ban allows Forceful Browsing.This issue affects Smart IP Ban: from 7.X-1.0 before 7.X-1.1.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Drupal
product: Smart IP Ban
default_status: unaffected
Credits: lang: en
value: Shawn Gants
lang: en
value: Sivaji Ganesh Jojodae
lang: en
value: Greg Knaddison
lang: en
value: Damien McKenna
lang: en
value: Juraj Nemec
Published: 2025-01-09T19:29:22.124Z
CVE-2024-13278 Diff - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-042
Incorrect Authorization vulnerability in Drupal Diff allows Functionality Misuse.This issue affects Diff: from 0.0.0 before 1.8.0.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Drupal
product: Diff
default_status: unaffected
Credits: lang: en
value: Matthias Vogel
lang: en
value: Matthias Vogel
lang: en
value: Lucas Hedding
lang: en
value: Adam Bramley
lang: en
value: Greg Knaddison
lang: en
value: Juraj Nemec
Published: 2025-01-09T19:31:12.862Z
CVE-2024-13279 Two-factor Authentication (TFA) - Critical - Access bypass - SA-CONTRIB-2024-043
Session Fixation vulnerability in Drupal Two-factor Authentication (TFA) allows Session Fixation.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.8.0.
Problem types: cwe_id: CWE-384
description: CWE-384 Session Fixation
Affected products: vendor: Drupal
product: Two-factor Authentication (TFA)
default_status: unaffected
Credits: lang: en
value: Francesco Placella
lang: en
value: Francesco Placella
lang: en
value: Juraj Nemec
lang: en
value: Conrad Lara
lang: en
value: Greg Knaddison
lang: en
value: Juraj Nemec
Published: 2025-01-09T19:31:45.632Z
CVE-2024-13280 Persistent Login - Moderately critical - Access bypass - SA-CONTRIB-2024-044
Insufficient Session Expiration vulnerability in Drupal Persistent Login allows Forceful Browsing.This issue affects Persistent Login: from 0.0.0 before 1.8.0, from 2.0.* before 2.2.2.
Problem types: cwe_id: CWE-613
description: CWE-613 Insufficient Session Expiration
Affected products: vendor: Drupal
product: Persistent Login
default_status: unaffected
Credits: lang: en
value: Geoff Appleby
lang: en
value: Geoff Appleby
lang: en
value: Greg Knaddison
lang: en
value: Juraj Nemec
lang: en
value: Drew Webber
Published: 2025-01-09T19:34:03.443Z
CVE-2024-13281 Monster Menus - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-045
Incorrect Authorization vulnerability in Drupal Monster Menus allows Forceful Browsing.This issue affects Monster Menus: from 0.0.0 before 9.3.2.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Drupal
product: Monster Menus
default_status: unaffected
Credits: lang: en
value: Dan Wilga
lang: en
value: Dan Wilga
lang: en
value: Ian McBride
lang: en
value: Greg Knaddison
lang: en
value: Juraj Nemec
lang: en
value: Damien McKenna
Published: 2025-01-09T19:35:17.772Z
CVE-2024-13282 Block permissions - Moderately critical - Access bypass - SA-CONTRIB-2024-046
Incorrect Authorization vulnerability in Drupal Block permissions allows Forceful Browsing.This issue affects Block permissions: from 1.0.0 before 1.2.0.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Drupal
product: Block permissions
default_status: unaffected
Credits: lang: en
value: Francesco Sardara
lang: en
value: Francesco Sardara
lang: en
value: Evgenii Nikitin
lang: en
value: Greg Knaddison
lang: en
value: Juraj Nemec
Published: 2025-01-09T19:35:48.354Z
CVE-2024-13283 Facets - Critical - Cross Site Scripting - SA-CONTRIB-2024-047
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Facets allows Cross-Site Scripting (XSS).This issue affects Facets: from 0.0.0 before 2.0.9.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Drupal
product: Facets
default_status: unaffected
Credits: lang: en
value: Andrea Racco
lang: en
value: Andrea Racco
lang: en
value: Markus Kalkbrenner
lang: en
value: Joris Vercammen
lang: en
value: Jimmy Henderickx
lang: en
value: Greg Knaddison
lang: en
value: Juraj Nemec
Published: 2025-01-09T19:36:22.779Z
CVE-2024-13284 Gutenberg - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-048
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Gutenberg allows Cross Site Request Forgery.This issue affects Gutenberg: from 0.0.0 before 2.13.0, from 3.0.0 before 3.0.5.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Drupal
product: Gutenberg
default_status: unaffected
Credits: lang: en
value: Mingsong
lang: en
value: Mingsong
lang: en
value: Lee Rowlands
lang: en
value: Eirik Morland
lang: en
value: Stephan Zeidler
lang: en
value: Cathy Theys
lang: en
value: codebymikey
lang: en
value: Marco Fernandes
lang: en
value: Greg Knaddison
lang: en
value: Juraj Nemec
Published: 2025-01-09T19:36:54.376Z
CVE-2024-13285 wkhtmltopdf - Highly critical - Unsupported - SA-CONTRIB-2024-049
Vulnerability in Drupal wkhtmltopdf.This issue affects wkhtmltopdf: *.*.
Affected products: vendor: Drupal
product: wkhtmltopdf
default_status: unaffected
Published: 2025-01-09T20:11:25.066Z
CVE-2024-13286 SVG Embed - Moderately critical - Cross site scripting - SA-CONTRIB-2024-050
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal SVG Embed allows Cross-Site Scripting (XSS).This issue affects SVG Embed: from 0.0.0 before 2.1.2.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Drupal
product: SVG Embed
default_status: unaffected
Credits: lang: en
value: Pierre Rudloff
lang: en
value: Ivo  Van Geertruyen
lang: en
value: Jürgen Haas
lang: en
value: Ivo Van Geertruyen
Published: 2025-01-09T20:13:01.429Z
CVE-2024-13287 Views SVG Animation - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-051
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Views SVG Animation allows Cross-Site Scripting (XSS).This issue affects Views SVG Animation: from 0.0.0 before 1.0.1.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Drupal
product: Views SVG Animation
default_status: unaffected
Credits: lang: en
value: Pierre Rudloff
lang: en
value: Jürgen Haas
lang: en
value: Juraj Nemec
Published: 2025-01-09T20:13:41.775Z
CVE-2024-13288 Monster Menus - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-052
Deserialization of Untrusted Data vulnerability in Drupal Monster Menus allows Object Injection.This issue affects Monster Menus: from 0.0.0 before 9.3.4, from 9.4.0 before 9.4.2.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Drupal
product: Monster Menus
default_status: unaffected
Credits: lang: en
value: Drew Webber
lang: en
value: Drew Webber
lang: en
value: Dan Wilga
lang: en
value: Greg Knaddison
lang: en
value: Juraj Nemec
lang: en
value: Drew Webber
Published: 2025-01-09T20:14:17.954Z
CVE-2024-13289 Cookiebot + GTM - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-055
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Cookiebot + GTM allows Cross-Site Scripting (XSS).This issue affects Cookiebot + GTM: from 0.0.0 before 1.0.18.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Drupal
product: Cookiebot + GTM
default_status: unaffected
Credits: lang: en
value: Pierre Rudloff
lang: en
value: Fabian de Rijk
lang: en
value: Greg Knaddison
lang: en
value: Juraj Nemec
lang: en
value: Cathy Theys
Published: 2025-01-09T20:15:15.665Z
CVE-2024-13290 OhDear Integration - Moderately critical - Access bypass - SA-CONTRIB-2024-056
Incorrect Authorization vulnerability in Drupal OhDear Integration allows Forceful Browsing.This issue affects OhDear Integration: from 0.0.0 before 2.0.4.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Drupal
product: OhDear Integration
default_status: unaffected
Credits: lang: en
value: casey
lang: en
value: casey
lang: en
value: Lio Novelli
lang: en
value: Greg Knaddison
lang: en
value: Juraj Nemec
Published: 2025-01-09T20:15:46.716Z
CVE-2024-13291 Basic HTTP Authentication - Critical - Access bypass - SA-CONTRIB-2024-057
Incorrect Authorization vulnerability in Drupal Basic HTTP Authentication allows Forceful Browsing.This issue affects Basic HTTP Authentication: from 7.X-1.0 before 7.X-1.4.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Drupal
product: Basic HTTP Authentication
default_status: unaffected
Credits: lang: en
value: Roderik Muit
lang: en
value: Roderik Muit
lang: en
value: Ivo  Van Geertruyen
lang: en
value: Ivo  Van Geertruyen
Published: 2025-01-09T20:16:29.195Z
CVE-2024-13292 Tooltip - Moderately critical - Cross site scripting - SA-CONTRIB-2024-058
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Tooltip allows Cross-Site Scripting (XSS).This issue affects Tooltip: from 0.0.0 before 1.1.2.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Drupal
product: Tooltip
default_status: unaffected
Credits: lang: en
value: Pierre Rudloff
lang: en
value: Matthieu Scarset
lang: en
value: Greg Knaddison
lang: en
value: Juraj Nemec
lang: en
value: Ivo Van Geertruyen
Published: 2025-01-09T20:16:57.677Z
CVE-2024-13293 POST File - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-059
Cross-Site Request Forgery (CSRF) vulnerability in Drupal POST File allows Cross Site Request Forgery.This issue affects POST File: from 0.0.0 before 1.0.2.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Drupal
product: POST File
default_status: unaffected
Credits: lang: en
value: Pierre Rudloff
lang: en
value: Scott Joudry
lang: en
value: Greg Knaddison
lang: en
value: Juraj Nemec
Published: 2025-01-09T20:17:22.283Z
CVE-2024-13294 POST File - Critical - Cross Site Scripting, Arbitrary PHP code execution - SA-CONTRIB-2024-060
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal POST File allows Cross-Site Scripting (XSS).This issue affects POST File: from 0.0.0 before 1.0.2.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Drupal
product: POST File
default_status: unaffected
Credits: lang: en
value: Pierre Rudloff
lang: en
value: Scott Joudry
lang: en
value: Greg Knaddison
lang: en
value: Juraj Nemec
Published: 2025-01-09T20:17:48.275Z
CVE-2024-13295 Node export - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-061
Deserialization of Untrusted Data vulnerability in Drupal Node export allows Object Injection.This issue affects Node export: from 7.X-* before 7.X-3.3.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Drupal
product: Node export
default_status: unaffected
Credits: lang: en
value: Drew Webber
lang: en
value: Drew Webber
lang: en
value: Ivan Trokhanenko
lang: en
value: Drew Webber
lang: en
value: Greg Knaddison
Published: 2025-01-09T20:18:39.240Z
CVE-2024-13296 Mailjet - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-062
Deserialization of Untrusted Data vulnerability in Drupal Mailjet allows Object Injection.This issue affects Mailjet: from 0.0.0 before 4.0.1.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Drupal
product: Mailjet
default_status: unaffected
Credits: lang: en
value: Drew Webber
lang: en
value: Drew Webber
lang: en
value: Bohdan Artemchuk
lang: en
value: Drew Webber
Published: 2025-01-09T20:19:25.611Z
CVE-2024-13297 Eloqua - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-063
Deserialization of Untrusted Data vulnerability in Drupal Eloqua allows Object Injection.This issue affects Eloqua: from 7.X-* before 7.X-1.15.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Drupal
product: Eloqua
default_status: unaffected
Credits: lang: en
value: Drew Webber
lang: en
value: Albert Volkman
lang: en
value: Greg Knaddison
Published: 2025-01-09T20:21:09.904Z
CVE-2024-13298 Tarte au Citron - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-064
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Tarte au Citron allows Cross-Site Scripting (XSS).This issue affects Tarte au Citron: from 2.0.0 before 2.0.5.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Drupal
product: Tarte au Citron
default_status: unaffected
Credits: lang: en
value: Pierre Rudloff
lang: en
value: Kévin Le lostec
lang: en
value: Greg Knaddison
lang: en
value: Juraj Nemec
lang: en
value: cilefen
Published: 2025-01-09T20:21:56.291Z
CVE-2024-13299 Megamenu Framework - Critical - Unsupported - SA-CONTRIB-2024-065
Vulnerability in Drupal Megamenu Framework.This issue affects Megamenu Framework: *.*.
Affected products: vendor: Drupal
product: Megamenu Framework
default_status: unaffected
Credits: lang: en
value: Drew Webber
Published: 2025-01-09T20:22:31.347Z
CVE-2024-13300 Print Anything - Critical - Unsupported - SA-CONTRIB-2024-066
Vulnerability in Drupal Print Anything.This issue affects Print Anything: *.*.
Affected products: vendor: Drupal
product: Print Anything
default_status: unaffected
Credits: lang: en
value: Drew Webber
Published: 2025-01-09T20:23:03.508Z
CVE-2024-13301 OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) - Critical - Cross Site Scripting - SA-CONTRIB-2024-067
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) allows Cross-Site Scripting (XSS).This issue affects OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client): from 3.0.0 before 3.44.0, from 4.0.0 before 4.0.19.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Drupal
product: OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client)
default_status: unaffected
Credits: lang: en
value: Borut Piletic
lang: en
value: Borut Piletic
lang: en
value: singh_ankit
lang: en
value: Ivo  Van Geertruyen
lang: en
value: Greg Knaddison
lang: en
value: Damien McKenna
Published: 2025-01-09T20:23:31.496Z
CVE-2024-13302 Pages Restriction Access - Critical - Access bypass - SA-CONTRIB-2024-068
Incorrect Authorization vulnerability in Drupal Pages Restriction Access allows Forceful Browsing.This issue affects Pages Restriction Access: from 2.0.0 before 2.0.3.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Drupal
product: Pages Restriction Access
default_status: unaffected
Credits: lang: en
value: Pierre Rudloff
lang: en
value: Ivo  Van Geertruyen
lang: en
value: renatog
lang: en
value: Pierre Rudloff
lang: en
value: Greg Knaddison
lang: en
value: Damien McKenna
lang: en
value: Juraj Nemec
lang: en
value: Ivo Van Geertruyen
Published: 2025-01-09T20:24:05.171Z
CVE-2024-13303 Download All Files - Critical - Access bypass - SA-CONTRIB-2024-069
Missing Authorization vulnerability in Drupal Download All Files allows Forceful Browsing.This issue affects Download All Files: from 0.0.0 before 2.0.2.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Drupal
product: Download All Files
default_status: unaffected
Credits: lang: en
value: Pierre Rudloff
lang: en
value: Jeroen Tubex
lang: en
value: Jeroen Tubex
lang: en
value: striknin
lang: en
value: Giuseppe
lang: en
value: Greg Knaddison
lang: en
value: Damien McKenna
lang: en
value: Ivo Van Geertruyen
Published: 2025-01-09T20:24:30.952Z
CVE-2024-13304 Minify JS - Moderately critical - Cross site request forgery - SA-CONTRIB-2024-070
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Minify JS allows Cross Site Request Forgery.This issue affects Minify JS: from 0.0.0 before 3.0.3.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Drupal
product: Minify JS
default_status: unaffected
Credits: lang: en
value: Pierre Rudloff
lang: en
value: Ivo  Van Geertruyen
lang: en
value: Scott Joudry
lang: en
value: Ivo  Van Geertruyen
Published: 2025-01-09T20:25:04.098Z
CVE-2024-13305 Entity Form Steps - Moderately critical - Cross site scripting - SA-CONTRIB-2024-071
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Entity Form Steps allows Cross-Site Scripting (XSS).This issue affects Entity Form Steps: from 0.0.0 before 1.1.4.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Drupal
product: Entity Form Steps
default_status: unaffected
Credits: lang: en
value: Ide Braakman
lang: en
value: Rob
lang: en
value: Ivo Van Geertruyen
Published: 2025-01-09T20:25:32.400Z
CVE-2024-13306 WP Google Map < 1.9.4 - Admin+ Stored XSS
The Maps Plugin using Google Maps for WordPress  WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Maps Plugin using Google Maps for WordPress
default_status: unaffected
Credits: lang: en
value: Bob Matyas
lang: en
value: WPScan
Published: 2025-02-15T06:00:10.625Z
CVE-2024-13307 Reales WP - Real Estate WordPress Theme <= 2.1.2 - Missing Authorization to Unauthenticated Attachment Deletion and Favorite Property Updates
The Reales WP - Real Estate WordPress Theme theme for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'reales_delete_file', 'reales_delete_file_plans', 'reales_add_to_favourites', and 'reales_remove_from_favourites' functions in all versions up to, and including, 2.1.2. This makes it possible for unauthenticated attackers to delete arbitrary attachments, and add or remove favorite property listings for any user.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: pixel_prime
product: Reales WP - Real Estate WordPress Theme
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
baseScore: 5.3
baseSeverity: MEDIUM
Credits: lang: en
value: Lucio Sá
Published: 2025-04-24T08:23:51.329Z