rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-6894 RD Station <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
The RD Station plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.3.2 due to insufficient input sanitization and output escaping of post metaboxes added by the plugin. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: filipe-mateus-do-nascimento
product: RD Station
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Craig Smith
Published: 2024-09-05T09:29:49.865Z
CVE-2024-6895 Insecure Account Profile Management
Insufficient authentication in user account management in Yugabyte Platform allows local network attackers with a compromised user session to change critical security information without re-authentication. An attacker with user session and access to application can modify settings such as password and email without being prompted for the current password, enabling account takeover.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: YugabyteDB
product: YugabyteDB Anywhere
default_status: unaffected
Published: 2024-07-19T14:47:50.432Z
CVE-2024-6896 AMP for WP – Accelerated Mobile Pages <= 1.0.96.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.96.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: mohammed_kaludi
product: AMP for WP – Accelerated Mobile Pages
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: wesley
Published: 2024-07-24T11:00:09.141Z
CVE-2024-6897 aThemes Starter Sites <= 1.0.53 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
The aThemes Starter Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.53 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: smub
product: aThemes Starter Sites
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: wesley
Published: 2024-07-27T11:13:39.560Z
CVE-2024-6898 SourceCodester Record Management System index.php sql injection
A vulnerability was found in SourceCodester Record Management System 1.0. It has been classified as critical. This affects an unknown part of the file index.php. The manipulation of the argument UserName leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-271923.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: SourceCodester
product: Record Management System
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: netmanzhang (VulDB User)
Published: 2024-07-19T03:31:04.103Z
CVE-2024-6899 SourceCodester Record Management System view_info.php sql injection
A vulnerability was found in SourceCodester Record Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file view_info.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-271924.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: SourceCodester
product: Record Management System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: netmanzhang (VulDB User)
Published: 2024-07-19T05:00:05.474Z
CVE-2024-6900 SourceCodester Record Management System edit_emp.php sql injection
A vulnerability was found in SourceCodester Record Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file edit_emp.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-271925 was assigned to this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: SourceCodester
product: Record Management System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: netmanzhang (VulDB User)
Published: 2024-07-19T06:31:04.488Z
CVE-2024-6901 SourceCodester Record Management System entry.php sql injection
A vulnerability classified as critical has been found in SourceCodester Record Management System 1.0. Affected is an unknown function of the file entry.php. The manipulation of the argument school leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-271926 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: SourceCodester
product: Record Management System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: netmanzhang (VulDB User)
Published: 2024-07-19T07:00:06.580Z
CVE-2024-6902 SourceCodester Record Management System sort_user.php sql injection
A vulnerability classified as critical was found in SourceCodester Record Management System 1.0. Affected by this vulnerability is an unknown functionality of the file sort_user.php. The manipulation of the argument sort leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-271927.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: SourceCodester
product: Record Management System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: netmanzhang (VulDB User)
Published: 2024-07-19T07:31:04.198Z
CVE-2024-6903 SourceCodester Record Management System sort1_user.php sql injection
A vulnerability, which was classified as critical, has been found in SourceCodester Record Management System 1.0. Affected by this issue is some unknown functionality of the file sort1_user.php. The manipulation of the argument position leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-271928.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: SourceCodester
product: Record Management System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: netmanzhang (VulDB User)
Published: 2024-07-19T08:00:05.354Z
CVE-2024-6904 SourceCodester Record Management System sort2_user.php sql injection
A vulnerability, which was classified as critical, was found in SourceCodester Record Management System 1.0. This affects an unknown part of the file sort2_user.php. The manipulation of the argument qualification leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-271929 was assigned to this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: SourceCodester
product: Record Management System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: netmanzhang (VulDB User)
Published: 2024-07-19T08:31:03.862Z
CVE-2024-6905 SourceCodester Record Management System view_info_user.php sql injection
A vulnerability has been found in SourceCodester Record Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file view_info_user.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-271930 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: SourceCodester
product: Record Management System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: netmanzhang (VulDB User)
Published: 2024-07-19T09:00:07.227Z
CVE-2024-6906 SourceCodester Record Management System add_leave_non_user.php sql injection
A vulnerability was found in SourceCodester Record Management System 1.0 and classified as critical. This issue affects some unknown processing of the file add_leave_non_user.php. The manipulation of the argument LSS leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-271931.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: SourceCodester
product: Record Management System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: netmanzhang (VulDB User)
Published: 2024-07-19T09:31:04.414Z
CVE-2024-6907 SourceCodester Record Management System sort.php cross site scripting
A vulnerability was found in SourceCodester Record Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file sort.php. The manipulation of the argument sort leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-271932.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: SourceCodester
product: Record Management System
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: netmanzhang (VulDB User)
Published: 2024-07-19T10:00:07.558Z
CVE-2024-6908 Admin Can Escalate Privileges to SuperAdmin Using Manual PUT Request
Improper privilege management in Yugabyte Platform allows authenticated admin users to escalate privileges to SuperAdmin via a crafted PUT HTTP request, potentially leading to unauthorized access to sensitive system functions and data.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: YugabyteDB
product: YugabyteDB Anywhere
default_status: unaffected
Published: 2024-07-19T14:57:00.607Z
CVE-2024-6910 EventON < 2.2.17 - Admin+ Stored XSS
The EventON WordPress plugin before 2.2.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: EventON
default_status: unaffected
Credits: lang: en
value: Wesley "dk4trin" Santos
lang: en
value: WPScan
Published: 2024-09-09T06:00:02.015Z
CVE-2024-6911 Unauthenticated Local File Inclusion
Files on the Windows system are accessible without authentication to external parties due to a local file inclusion in PerkinElmer ProcessPlus.This issue affects ProcessPlus: through 1.11.6507.0.
Problem types: cwe_id: CWE-552
description: CWE-552 Files or Directories Accessible to External Parties
Affected products: vendor: PerkinElmer
product: ProcessPlus
default_status: unaffected
Credits: lang: en
value: S. Dietz (CyberDanube)
lang: en
value: T. Weber (CyberDanube)
Published: 2024-07-22T20:44:30.475Z
CVE-2024-6912 Hardcoded MSSQL Credentials
Use of hard-coded MSSQL credentials in PerkinElmer ProcessPlus on Windows allows an attacker to login remove on all prone installations.This issue affects ProcessPlus: through 1.11.6507.0.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: PerkinElmer
product: ProcessPlus
default_status: unaffected
Credits: lang: en
value: S. Dietz (CyberDanube)
lang: en
value: T. Weber (CyberDanube)
Published: 2024-07-22T20:51:15.342Z
CVE-2024-6913 Execution with Unnecessary Privileges
Execution with unnecessary privileges in PerkinElmer ProcessPlus allows an attacker to spawn a remote shell on the windows system.This issue affects ProcessPlus: through 1.11.6507.0.
Problem types: cwe_id: CWE-250
description: CWE-250 Execution with Unnecessary Privileges
Affected products: vendor: PerkinElmer
product: ProcessPlus
default_status: unaffected
Credits: lang: en
value: S. Dietz (CyberDanube)
lang: en
value: T. Weber (CyberDanube)
Published: 2024-07-22T21:00:08.315Z
CVE-2024-6914 Incorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account Takeover
An incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic flaw in the account recovery-related SOAP admin service. A malicious actor can exploit this vulnerability to reset the password of any user account, leading to a complete account takeover, including accounts with elevated privileges.

This vulnerability is exploitable only through the account recovery SOAP admin services exposed via the "/services" context path in affected products. The impact may be reduced if access to these endpoints has been restricted based on the "Security Guidelines for Production Deployment" by disabling exposure to untrusted networks.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: WSO2
product: WSO2 API Manager
default_status: unaffected
vendor: WSO2
product: WSO2 Governance Registry
default_status: unknown
vendor: WSO2
product: WSO2 Identity Server
default_status: unaffected
vendor: WSO2
product: WSO2 Identity Server as Key Manager
default_status: unaffected
vendor: WSO2
product: WSO2 IoT
default_status: unknown
vendor: WSO2
product: WSO2 Open Banking AM
default_status: unaffected
vendor: WSO2
product: WSO2 Open banking KM
default_status: unaffected
vendor: WSO2
product: WSO2 Open Banking IAM
default_status: unaffected
vendor: WSO2
product: WSO2 Carbon Identity Management
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Anonymous working with Trend Micro Zero Day Initiative
Published: 2025-05-22T18:26:15.042Z
CVE-2024-6915 JFrog Artifactory Cache Poisoning
JFrog Artifactory versions below 7.90.6, 7.84.20, 7.77.14, 7.71.23, 7.68.22, 7.63.22, 7.59.23, 7.55.18 are vulnerable to Improper Input Validation that could potentially lead to cache poisoning.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: JFrog
product: Artifactory
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 9.3
baseSeverity: CRITICAL
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L
version: 3.1
Credits: lang: en
value: Michael Stepankin (artsploit) from GitHub Security Lab
Published: 2024-08-05T19:34:31.571Z
CVE-2024-6916 Zowe CLI --show-inputs-only displays securely stored properties
A vulnerability in Zowe CLI allows local, privileged actors to display securely stored properties in cleartext within a terminal using the '--show-inputs-only' flag.
Problem types: description: CWE-257: Storing Passwords in a Recoverable Format
description: CWE-1295: Debug Messages Revealing Unnecessary Information
Affected products: vendor: Open Mainframe Project
product: Zowe CLI - Imperative
CVSS v3.1: baseScore: 5.9
baseSeverity: MEDIUM
version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N/E:P/RL:O/RC:C/CR:M/IR:X/AR:X/MAV:L/MAC:L/MPR:L/MUI:R/MS:C/MC:H/MI:N/MA:N
Credits: lang: en
value: Broadcom Inc.
Published: 2024-07-19T10:47:07.892Z
CVE-2024-6917 RCE in Veribilim Software's Veribase Order Management
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Veribilim Software Veribase Order Management allows OS Command Injection.

This issue affects Veribase Order Management: before v4.010.2.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Veribilim Software
product: Veribase Order Management
default_status: unaffected
Credits: lang: en
value: Tunahan TEKEOĞLU
Published: 2024-08-12T14:51:48.043Z
CVE-2024-6918 
CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability
exists that could cause a crash of the Accutech Manager when receiving a specially crafted
request over port 2536/TCP.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: Schneider Electric
product: Accutech Manager
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2024-08-20T12:11:23.899Z
CVE-2024-6919 SQLi in NAC Telecommunication's NACPremium
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NAC Telecommunication Systems Inc. NACPremium allows Blind SQL Injection.

This issue affects NACPremium: through 01082024.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: NAC Telecommunication Systems Inc.
product: NACPremium
default_status: unaffected
Credits: lang: en
value: Pınar TAŞĞIN
Published: 2024-09-02T12:25:47.833Z
CVE-2024-6920 Stored XSS in NAC Telecommunication's NACPremium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NAC Telecommunication Systems Inc. NACPremium allows Stored XSS.

This issue affects NACPremium: through 01082024.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: NAC Telecommunication Systems Inc.
product: NACPremium
default_status: unaffected
Credits: lang: en
value: Pınar TAŞĞIN
Published: 2024-09-02T12:54:21.756Z
CVE-2024-6921 Cleartext Username and Password in NAC Telecommunication's NACPremium
Cleartext Storage of Sensitive Information vulnerability in NAC Telecommunication Systems Inc. NACPremium allows Retrieve Embedded Sensitive Data.

This issue affects NACPremium: through 01082024.
Problem types: cwe_id: CWE-312
description: CWE-312 Cleartext Storage of Sensitive Information
Affected products: vendor: NAC Telecommunication Systems Inc.
product: NACPremium
default_status: unaffected
Credits: lang: en
value: Pınar TAŞĞIN
Published: 2024-09-02T13:24:14.899Z
CVE-2024-6922 Server-Side Request Forgery in Automation 360
Automation Anywhere Automation 360 v21-v32 is vulnerable to Server-Side Request Forgery in a web API component. An attacker with unauthenticated access to the Automation 360 Control Room HTTPS service (port 443) or HTTP service (port 80) can trigger arbitrary web requests from the server.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: Automationanywhere
product: Automation 360
default_status: unaffected
Published: 2024-07-26T13:52:28.961Z
CVE-2024-6923 Email header injection due to unquoted newlines
There is a MEDIUM severity vulnerability affecting CPython.

The 
email module didn’t properly quote newlines for email headers when 
serializing an email message allowing for header injection when an email
 is serialized.
Affected products: vendor: Python Software Foundation
product: CPython
default_status: unaffected
Credits: lang: en
value: Petr Viktorin
lang: en
value: Seth Larson
lang: en
value: John Whitlock
lang: en
value: Bas Bloemsaat
Published: 2024-08-01T13:40:11.069Z
CVE-2024-6924 TrueBooker < 1.0.3 - Multiple Unauthenticated SQLi
The TrueBooker  WordPress plugin before 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: TrueBooker
default_status: unaffected
Credits: lang: en
value: Project Black
lang: en
value: WPScan
Published: 2024-09-08T06:00:03.155Z
CVE-2024-6925 TrueBooker < 1.0.3 - Settings Update via CSRF
The TrueBooker  WordPress plugin before 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
Problem types: description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: TrueBooker
default_status: unaffected
Credits: lang: en
value: Bob Matyas
lang: en
value: WPScan
Published: 2024-09-08T06:00:03.340Z
CVE-2024-6926 Viral Signup <= 2.1 - Unauthenticated SQLi
The Viral Signup  WordPress plugin through 2.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Viral Signup
default_status: affected
Credits: lang: en
value: Project Black
lang: en
value: WPScan
Published: 2024-09-04T06:00:04.238Z