rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-5723 Centreon updateServiceHost SQL Injection Remote Code Execution Vulnerability
Centreon updateServiceHost SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability.

The specific flaw exists within the updateServiceHost function. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the apache user. Was ZDI-CAN-23294.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Centreon
product: Centreon
default_status: unknown
Published: 2024-08-21T16:14:43.583Z
CVE-2024-5724 Photo Video Gallery Master <= 1.5.3 - Authenticated (Contributor+) PHP Object Injection
The Photo Video Gallery Master plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.5.3 via deserialization of untrusted input 'PVGM_all_photos_details' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: webhuntinfotech
product: Photo Video Gallery Master
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: Francesco Carlucci
Published: 2024-06-19T03:12:31.112Z
CVE-2024-5725 Centreon initCurveList SQL Injection Remote Code Execution Vulnerability
Centreon initCurveList SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability.

The specific flaw exists within the initCurveList function. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the apache user. Was ZDI-CAN-22683.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Centreon
product: Centreon
default_status: unknown
Published: 2024-08-21T16:14:52.027Z
CVE-2024-5726 Timeline Event History <= 3.1 - Authenticated (Contributor+) PHP Object Injection
The Timeline Event History plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1 via deserialization of untrusted input 'timelines-data' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: wpdiscover
product: Timeline Event History
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: Francesco Carlucci
Published: 2024-07-18T02:03:55.800Z
CVE-2024-5727 Widget4Call <= 1.0.7 - Reflected XSS
The Widget4Call WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Widget4Call
default_status: affected
Credits: lang: en
value: Bob Matyas
lang: en
value: WPScan
Published: 2024-06-28T06:00:03.875Z
CVE-2024-5728 Animated AL List <= 1.0.6 - Reflected XSS
The Animated AL List WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Animated AL List
default_status: affected
Credits: lang: en
value: Bob Matyas
lang: en
value: WPScan
Published: 2024-06-28T06:00:04.165Z
CVE-2024-5729 Simple AL Slider <= 1.2.10 - Reflected XSS
The Simple AL Slider WordPress plugin through 1.2.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Simple AL Slider
default_status: affected
Credits: lang: en
value: Bob Matyas
lang: en
value: WPScan
Published: 2024-06-28T06:00:04.527Z
CVE-2024-5730 Pagerank Tools <= 1.1.5 - Reflected XSS
The Pagerank tools WordPress plugin through 1.1.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Pagerank tools
default_status: affected
Credits: lang: en
value: Bob Matyas
lang: en
value: WPScan
Published: 2024-06-28T06:00:05.085Z
CVE-2024-5731 
A vulnerability in the IPS Manager, Central Manager, and Local Manager communication workflow allows an attacker to control the destination of a request by manipulating the parameter, thereby leveraging sensitive information.
Problem types: cwe_id: CWE-311
description: CWE-311: Missing encryption of sensitive data
Affected products: vendor: Trellix
product: Intrusion Prevention System (IPS) Manager
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Kentaro Kawane
Published: 2024-06-14T13:57:25.836Z
CVE-2024-5732 Clash Proxy Port improper authentication
A vulnerability was found in Clash up to 0.20.1 on Windows. It has been declared as critical. This vulnerability affects unknown code of the component Proxy Port. The manipulation leads to improper authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. VDB-267406 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: n/a
product: Clash
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: rollingchair (VulDB User)
Published: 2024-06-07T10:00:04.020Z
CVE-2024-5733 itsourcecode Online Discussion Forum register_me.php sql injection
A vulnerability was found in itsourcecode Online Discussion Forum 1.0. It has been rated as critical. This issue affects some unknown processing of the file register_me.php. The manipulation of the argument eaddress leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-267407.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: itsourcecode
product: Online Discussion Forum
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: wsy0312 (VulDB User)
Published: 2024-06-07T11:31:03.489Z
CVE-2024-5734 itsourcecode Online Discussion Forum poster.php unrestricted upload
A vulnerability classified as critical has been found in itsourcecode Online Discussion Forum 1.0. Affected is an unknown function of the file /members/poster.php. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-267408.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload
Affected products: vendor: itsourcecode
product: Online Discussion Forum
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: wsy0312 (VulDB User)
Published: 2024-06-07T11:31:04.948Z
CVE-2024-5735 Full Path Disclosure in AdmirorFrames Joomla! Extension
Full Path Disclosure vulnerability in AdmirorFrames Joomla! extension in afHelper.php script allows an unauthorised attacker to retrieve location of web root folder. This issue affects AdmirorFrames: before 5.0.
Problem types: cwe_id: CWE-497
description: CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere
Affected products: vendor: Nikola Vasilijevski
product: AdmirorFrames
default_status: unaffected
Credits: lang: en
value: Marcin Wyczechowski [AFINE Team]
lang: en
value: Michał Majchrowicz [AFINE Team]
Published: 2024-06-28T11:24:18.916Z
CVE-2024-5736 SSRF in AdmirorFrames Joomla! Extension
Server Side Request Forgery (SSRF) vulnerability in AdmirorFrames Joomla! extension in afGdStream.php script allows to access local files or server pages available only from localhost. This issue affects AdmirorFrames: before 5.0.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: Nikola Vasilijevski
product: AdmirorFrames
default_status: unaffected
Credits: lang: en
value: Marcin Wyczechowski [AFINE Team]
lang: en
value: Michał Majchrowicz [AFINE Team]
Published: 2024-06-28T11:26:53.512Z
CVE-2024-5737 HTML Injection in AdmirorFrames Joomla! Extension
Script afGdStream.php in AdmirorFrames Joomla! extension doesn’t specify a content type and as a result default (text/html) is used. An attacker may embed HTML tags directly in image data which is rendered by a webpage as HTML. This issue affects AdmirorFrames: before 5.0.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Nikola Vasilijevski
product: AdmirorFrames
default_status: unaffected
Credits: lang: en
value: Marcin Wyczechowski [AFINE Team]
lang: en
value: Michał Majchrowicz [AFINE Team]
Published: 2024-06-28T11:29:03.154Z
CVE-2024-5739 
The in-app browser of LINE client for iOS versions below 14.9.0 contains a Universal XSS (UXSS) vulnerability. This vulnerability allows for cross-site scripting (XSS) where arbitrary JavaScript can be executed in the top frame from an embedded iframe on any displayed web site within the in-app browser. The in-app browser is usually opened by tapping on URLs contained in chat messages, and for the attack to be successful, the victim must trigger a click event on a malicious iframe. If an iframe embedded in any website can be controlled by an attacker, this vulnerability could be exploited to capture or alter content displayed in the top frame, as well as user session information. This vulnerability affects LINE client for iOS versions below 14.9.0 and does not affect other LINE clients such as LINE client for Android. Please update LINE client for iOS to version 14.9.0 or higher.
Problem types: description: na
Affected products: vendor: LINE Corporation
product: LINE client for iOS
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
exploitCodeMaturity: NOT_DEFINED
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
temporalScore: 6.1
temporalSeverity: MEDIUM
confidentialityRequirement: NOT_DEFINED
integrityRequirement: NOT_DEFINED
availabilityRequirement: NOT_DEFINED
modifiedAttackVector: NETWORK
modifiedAttackComplexity: LOW
modifiedPrivilegesRequired: NONE
modifiedUserInteraction: REQUIRED
modifiedScope: CHANGED
modifiedConfidentialityImpact: LOW
modifiedIntegrityImpact: LOW
modifiedAvailabilityImpact: NONE
environmentalScore: 6.1
environmentalSeverity: MEDIUM
Published: 2024-06-12T07:00:35.232Z
CVE-2024-5741 XSS in inventory view
Stored XSS in inventory tree rendering in Checkmk before 2.3.0p7, 2.2.0p28, 2.1.0p45 and 2.0.0 (EOL)
Problem types: cwe_id: CWE-80
description: CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: Checkmk GmbH
product: Checkmk
default_status: unaffected
CVSS v3.1: baseScore: 6.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Published: 2024-06-17T11:16:59.771Z
CVE-2024-5742 Nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file with a malicious symlink to a root-owned file
A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions of the running user provides a window of opportunity for attackers to escalate privileges through a malicious symlink.
Problem types: cwe_id: CWE-59
description: Improper Link Resolution Before File Access ('Link Following')
Affected products: default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 10
cpes: cpe:/o:redhat:enterprise_linux:10
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 6
cpes: cpe:/o:redhat:enterprise_linux:6
default_status: unknown
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: unknown
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-06-12T08:53:02.256Z
CVE-2024-5743 Command Injection Vulnerability
An attacker could exploit the 'Use of Password Hash With Insufficient Computational Effort' vulnerability in EveHome Eve Play to execute arbitrary code.

This issue affects Eve Play: through 1.1.42.
Problem types: cwe_id: CWE-916
description: CWE-916 Use of Password Hash With Insufficient Computational Effort
Affected products: vendor: EveHome
product: Eve Play
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: ABB PSIRT thanks the following parties for their efforts: Ville Salmela for reporting the vulnerabilities through responsible disclosure.
Published: 2025-01-13T17:25:49.740Z
CVE-2024-5744 WP eMember < 10.6.7 - Reflected XSS
The wp-eMember WordPress plugin before 10.6.7 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: wp-eMember
default_status: unaffected
Credits: lang: en
value: Bob Matyas
lang: en
value: WPScan
Published: 2024-07-13T06:00:13.171Z
CVE-2024-5745 itsourcecode Bakery Online Ordering System unrestricted upload
A vulnerability was found in itsourcecode Bakery Online Ordering System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/modules/product/controller.php?action=add. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-267414 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload
Affected products: vendor: itsourcecode
product: Bakery Online Ordering System
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: N3xu5Cr4ck37 (VulDB User)
Published: 2024-06-07T17:31:04.267Z
CVE-2024-5746 
A Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker with the Site Administrator role to gain arbitrary code execution capability on the GitHub Enterprise Server instance. Exploitation required authenticated access to GitHub Enterprise Server as a user with the Site Administrator role. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.13 and was fixed in versions 3.12.5, 3.11.11, 3.10.13, and 3.9.16. This vulnerability was reported via the GitHub Bug Bounty program.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: GitHub
product: GitHub Enterprise Server
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L
version: 3.1
Credits: lang: en
value: r31n
Published: 2024-06-20T21:31:37.111Z
CVE-2024-5749 Certain HP DesignJet products – Credential reflection
Certain HP DesignJet products may be vulnerable to credential reflection which allow viewing SMTP server credentials.
Problem types: cwe_id: CWE-306
description: CWE-306: Missing Authentication for Sensitive Resource
Affected products: vendor: HP Inc.
product: Certain HP DesignJet products
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2024-10-15T17:27:51.556Z
CVE-2024-5751 Remote Code Execution in BerriAI/litellm
BerriAI/litellm version v1.35.8 contains a vulnerability where an attacker can achieve remote code execution. The vulnerability exists in the `add_deployment` function, which decodes and decrypts environment variables from base64 and assigns them to `os.environ`. An attacker can exploit this by sending a malicious payload to the `/config/update` endpoint, which is then processed and executed by the server when the `get_secret` function is triggered. This requires the server to use Google KMS and a database to store a model.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code
Affected products: vendor: berriai
product: berriai/litellm
Published: 2024-06-27T18:40:49.896Z
CVE-2024-5752 Path Traversal in stitionai/devika
A path traversal vulnerability exists in stitionai/devika, specifically in the project creation functionality. In the affected version beacf6edaa205a5a5370525407a6db45137873b3, the project name is not validated, allowing an attacker to create a project with a crafted name that traverses directories. This can lead to arbitrary file overwrite when the application generates code and saves it to the specified project directory, potentially resulting in remote code execution.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: stitionai
product: stitionai/devika
Published: 2025-03-20T10:11:17.971Z
CVE-2024-5753 Local File Read (LFI) by Prompt Injection via Postgres SQL in vanna-ai/vanna
vanna-ai/vanna version v0.3.4 is vulnerable to SQL injection in some file-critical functions such as `pg_read_file()`. This vulnerability allows unauthenticated remote users to read arbitrary local files on the victim server, including sensitive files like `/etc/passwd`, by exploiting the exposed SQL queries via a Python Flask API.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command
Affected products: vendor: vanna-ai
product: vanna-ai/vanna
Published: 2024-07-05T19:27:22.046Z
CVE-2024-5754 BT: Encryption procedure host vulnerability
BT: Encryption procedure host vulnerability
Problem types: cwe_id: CWE-807
description: Reliance on Untrusted Inputs in a Security Decision
Affected products: vendor: zephyrproject-rtos
product: Zephyr
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
version: 3.1
Published: 2024-09-13T18:50:05.314Z
CVE-2024-5755 Email Validation Bypass in lunary-ai/lunary
In lunary-ai/lunary versions <=v1.2.11, an attacker can bypass email validation by using a dot character ('.') in the email address. This allows the creation of multiple accounts with essentially the same email address (e.g., 'attacker123@gmail.com' and 'attacker.123@gmail.com'), leading to incorrect synchronization and potential security issues.
Problem types: cwe_id: CWE-821
description: CWE-821 Incorrect Synchronization
Affected products: vendor: lunary-ai
product: lunary-ai/lunary
Published: 2024-06-27T18:45:48.607Z
CVE-2024-5756 Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.23 - Unauthenticated SQL Injection via optin
The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the db parameter in all versions up to, and including, 5.7.23 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: icegram
product: Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
baseScore: 9.8
baseSeverity: CRITICAL
Credits: lang: en
value: Arkadiusz Hydzik
Published: 2024-06-21T04:34:10.900Z