diff --git a/advisories/unreviewed/2024/09/GHSA-69wq-4pfq-hqxh/GHSA-69wq-4pfq-hqxh.json b/advisories/unreviewed/2024/09/GHSA-69wq-4pfq-hqxh/GHSA-69wq-4pfq-hqxh.json new file mode 100644 index 00000000000..d6bdffe5875 --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-69wq-4pfq-hqxh/GHSA-69wq-4pfq-hqxh.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-69wq-4pfq-hqxh", + "modified": "2024-09-08T06:30:33Z", + "published": "2024-09-08T06:30:33Z", + "aliases": [ + "CVE-2024-6928" + ], + "details": "The Opti Marketing WordPress plugin through 2.0.9 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6928" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/7bb9474f-2b9d-4856-b36d-a43da3db0245" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-08T06:15:02Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-93jv-pgxc-4w5p/GHSA-93jv-pgxc-4w5p.json b/advisories/unreviewed/2024/09/GHSA-93jv-pgxc-4w5p/GHSA-93jv-pgxc-4w5p.json new file mode 100644 index 00000000000..bbccb0c9206 --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-93jv-pgxc-4w5p/GHSA-93jv-pgxc-4w5p.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-93jv-pgxc-4w5p", + "modified": "2024-09-08T06:30:32Z", + "published": "2024-09-08T06:30:32Z", + "aliases": [ + "CVE-2024-8569" + ], + "details": "A vulnerability has been found in code-projects Hospital Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file user-login.php. The manipulation of the argument username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8569" + }, + { + "type": "WEB", + "url": "https://github.com/teachersongsec/cve/issues/1" + }, + { + "type": "WEB", + "url": "https://code-projects.org" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.276799" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.276799" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.403125" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-08T05:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-9w8j-43xw-xc7m/GHSA-9w8j-43xw-xc7m.json b/advisories/unreviewed/2024/09/GHSA-9w8j-43xw-xc7m/GHSA-9w8j-43xw-xc7m.json new file mode 100644 index 00000000000..ccd5ba78e5d --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-9w8j-43xw-xc7m/GHSA-9w8j-43xw-xc7m.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9w8j-43xw-xc7m", + "modified": "2024-09-08T06:30:32Z", + "published": "2024-09-08T06:30:32Z", + "aliases": [ + "CVE-2024-6853" + ], + "details": "The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating welcome popups, which could allow attackers to make logged admins perform such action via a CSRF attack", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6853" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/d1ce78c3-5d6c-465e-9ce8-6d92f7480333" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-08T06:15:02Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-mf53-vhfr-cjjw/GHSA-mf53-vhfr-cjjw.json b/advisories/unreviewed/2024/09/GHSA-mf53-vhfr-cjjw/GHSA-mf53-vhfr-cjjw.json new file mode 100644 index 00000000000..3fc335085e3 --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-mf53-vhfr-cjjw/GHSA-mf53-vhfr-cjjw.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mf53-vhfr-cjjw", + "modified": "2024-09-08T06:30:33Z", + "published": "2024-09-08T06:30:33Z", + "aliases": [ + "CVE-2024-6859" + ], + "details": "The WP MultiTasking WordPress plugin through 0.1.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6859" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/34ae6121-304f-495b-bcc1-4fbd3d70a9fb" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-08T06:15:02Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-p726-6587-94ph/GHSA-p726-6587-94ph.json b/advisories/unreviewed/2024/09/GHSA-p726-6587-94ph/GHSA-p726-6587-94ph.json new file mode 100644 index 00000000000..0930dc08347 --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-p726-6587-94ph/GHSA-p726-6587-94ph.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p726-6587-94ph", + "modified": "2024-09-08T06:30:33Z", + "published": "2024-09-08T06:30:33Z", + "aliases": [ + "CVE-2024-6856" + ], + "details": "The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6856" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/9700845e-89ca-4f9b-95f0-4b46a975b662" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-08T06:15:02Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-q7wh-m245-cv47/GHSA-q7wh-m245-cv47.json b/advisories/unreviewed/2024/09/GHSA-q7wh-m245-cv47/GHSA-q7wh-m245-cv47.json new file mode 100644 index 00000000000..c96499dbe99 --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-q7wh-m245-cv47/GHSA-q7wh-m245-cv47.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q7wh-m245-cv47", + "modified": "2024-09-08T06:30:32Z", + "published": "2024-09-08T06:30:32Z", + "aliases": [ + "CVE-2024-6852" + ], + "details": "The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6852" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/e6c7c153-8080-40b3-85e2-604ce7c66e32" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-08T06:15:02Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-rf9h-8cx8-5xww/GHSA-rf9h-8cx8-5xww.json b/advisories/unreviewed/2024/09/GHSA-rf9h-8cx8-5xww/GHSA-rf9h-8cx8-5xww.json new file mode 100644 index 00000000000..00c5ff16c24 --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-rf9h-8cx8-5xww/GHSA-rf9h-8cx8-5xww.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rf9h-8cx8-5xww", + "modified": "2024-09-08T06:30:33Z", + "published": "2024-09-08T06:30:33Z", + "aliases": [ + "CVE-2024-6925" + ], + "details": "The TrueBooker WordPress plugin before 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6925" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/1da75fd7-e44f-4043-b8f4-7ee975356982" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-08T06:15:02Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-vqjc-v52h-6f2g/GHSA-vqjc-v52h-6f2g.json b/advisories/unreviewed/2024/09/GHSA-vqjc-v52h-6f2g/GHSA-vqjc-v52h-6f2g.json new file mode 100644 index 00000000000..81c1a341af8 --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-vqjc-v52h-6f2g/GHSA-vqjc-v52h-6f2g.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vqjc-v52h-6f2g", + "modified": "2024-09-08T06:30:32Z", + "published": "2024-09-08T06:30:32Z", + "aliases": [ + "CVE-2024-6855" + ], + "details": "The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating exit popups, which could allow attackers to make logged admins perform such action via a CSRF attack", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6855" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/1124b07a-6274-49df-be77-615fda8f3a38" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-08T06:15:02Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-xwhw-83c9-38cf/GHSA-xwhw-83c9-38cf.json b/advisories/unreviewed/2024/09/GHSA-xwhw-83c9-38cf/GHSA-xwhw-83c9-38cf.json new file mode 100644 index 00000000000..d2cb980328f --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-xwhw-83c9-38cf/GHSA-xwhw-83c9-38cf.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xwhw-83c9-38cf", + "modified": "2024-09-08T06:30:33Z", + "published": "2024-09-08T06:30:33Z", + "aliases": [ + "CVE-2024-6924" + ], + "details": "The TrueBooker WordPress plugin before 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6924" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/39e79801-6ec7-4579-bc6b-fd7e899733a8" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-08T06:15:02Z" + } +} \ No newline at end of file