Publish Advisories

GHSA-27vp-6288-jjwg GHSA-3v9v-qj74-rc8h GHSA-4mvm-94p9-x8vm GHSA-58xh-xqmq-2mmr GHSA-cc7h-jmr5-hg42 GHSA-f4fh-p6rp-2w6j GHSA-gmj8-2ww5-fff3 GHSA-jpvx-wrqv-j9x2 GHSA-q623-2j2j-23jj GHSA-qjv9-wmrf-56gg GHSA-rp59-p734-2pfh GHSA-rvvm-rjf3-jr7v GHSA-vg2c-gcf5-56f2 GHSA-w3pw-m4q2-x98m GHSA-wrpc-6v65-cc7f GHSA-xp28-88f3-2f49
2026-05-22 18:04:22 -07:00 · 2024-07-29 06:31:55 +00:00
parent f720bc7292
commit 950ec39f29
16 changed files with 688 additions and 0 deletions
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-27vp-6288-jjwg",
+  "modified": "2024-07-29T06:30:25Z",
+  "published": "2024-07-29T06:30:25Z",
+  "aliases": [
+    "CVE-2024-5882"
+  ],
+  "details": "The Ultimate Classified Listings WordPress plugin before 1.3 does not validate the `ucl_page` and `layout` parameters allowing unauthenticated users to access PHP files on the server from the listings page",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5882"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/5e8d7808-8f3e-4fc9-a1e7-e108da031ca7"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-29T06:15:02Z"
+  }
+}
@@ -0,0 +1,54 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-3v9v-qj74-rc8h",
+  "modified": "2024-07-29T06:30:24Z",
+  "published": "2024-07-29T06:30:24Z",
+  "aliases": [
+    "CVE-2024-7183"
+  ],
+  "details": "A vulnerability, which was classified as critical, was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. Affected is the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272604. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7183"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/A3600R/setUploadSetting.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.272604"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.272604"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.378052"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-120"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-29T05:15:01Z"
+  }
+}
@@ -0,0 +1,54 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-4mvm-94p9-x8vm",
+  "modified": "2024-07-29T06:30:24Z",
+  "published": "2024-07-29T06:30:24Z",
+  "aliases": [
+    "CVE-2024-7184"
+  ],
+  "details": "A vulnerability has been found in TOTOLINK A3600R 4.1.2cu.5182_B20201102 and classified as critical. Affected by this vulnerability is the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument url leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272605 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7184"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/A3600R/setUrlFilterRules.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.272605"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.272605"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.378053"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-120"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-29T05:15:02Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-58xh-xqmq-2mmr",
+  "modified": "2024-07-29T06:30:26Z",
+  "published": "2024-07-29T06:30:26Z",
+  "aliases": [
+    "CVE-2024-6487"
+  ],
+  "details": "The Inline Related Posts WordPress plugin before 3.8.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6487"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/eeec9608-a7b2-4926-bac2-4c81a65dd473"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-29T06:15:02Z"
+  }
+}
@@ -0,0 +1,54 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-cc7h-jmr5-hg42",
+  "modified": "2024-07-29T06:30:24Z",
+  "published": "2024-07-29T06:30:24Z",
+  "aliases": [
+    "CVE-2024-7182"
+  ],
+  "details": "A vulnerability, which was classified as critical, has been found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. This issue affects the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272603. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7182"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/A3600R/setUpgradeFW.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.272603"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.272603"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.378051"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-120"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-29T04:15:02Z"
+  }
+}
@@ -0,0 +1,54 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-f4fh-p6rp-2w6j",
+  "modified": "2024-07-29T06:30:26Z",
+  "published": "2024-07-29T06:30:26Z",
+  "aliases": [
+    "CVE-2024-7186"
+  ],
+  "details": "A vulnerability was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. It has been classified as critical. This affects the function setWiFiAclAddConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument comment leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272607. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7186"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/A3600R/setWiFiAclAddConfig.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.272607"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.272607"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.378055"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-120"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-29T06:15:03Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-gmj8-2ww5-fff3",
+  "modified": "2024-07-29T06:30:25Z",
+  "published": "2024-07-29T06:30:25Z",
+  "aliases": [
+    "CVE-2024-5883"
+  ],
+  "details": "The Ultimate Classified Listings WordPress plugin before 1.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5883"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/a1894884-c739-4ef4-8d9c-392171ab3d68"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-29T06:15:02Z"
+  }
+}
@@ -0,0 +1,42 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-jpvx-wrqv-j9x2",
+  "modified": "2024-07-29T06:30:24Z",
+  "published": "2024-07-29T06:30:24Z",
+  "aliases": [
+    "CVE-2024-7202"
+  ],
+  "details": "The query functionality of WinMatrix3 Web package from Simopro Technology lacks proper validation of user input, allowing unauthenticated remote attackers to inject SQL commands to read, modify, and delete database contents.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7202"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.twcert.org.tw/en/cp-139-7963-44648-2.html"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.twcert.org.tw/tw/cp-132-7962-dd216-1.html"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-89"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-29T04:15:02Z"
+  }
+}
@@ -0,0 +1,39 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-q623-2j2j-23jj",
+  "modified": "2024-07-29T06:30:25Z",
+  "published": "2024-07-29T06:30:24Z",
+  "aliases": [
+    "CVE-2024-41637"
+  ],
+  "details": "RaspAP before 3.1.5 allows an attacker to escalate privileges: the www-data user has write access to the restapi.service file and also possesses Sudo privileges to execute several critical commands without a password.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41637"
+    },
+    {
+      "type": "WEB",
+      "url": "https://blog.0xzon.dev/2024-07-27-CVE-2024-41637"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/RaspAP/raspap-webgui"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-29T06:15:02Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-qjv9-wmrf-56gg",
+  "modified": "2024-07-29T06:30:26Z",
+  "published": "2024-07-29T06:30:26Z",
+  "aliases": [
+    "CVE-2024-6362"
+  ],
+  "details": "The Ultimate Blocks  WordPress plugin before 3.2.0 does not validate and escape some of its post-grid block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6362"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/d2e2d06b-0f07-40b9-9b87-3373f62ae1a9"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-29T06:15:02Z"
+  }
+}
@@ -0,0 +1,54 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-rp59-p734-2pfh",
+  "modified": "2024-07-29T06:30:23Z",
+  "published": "2024-07-29T06:30:23Z",
+  "aliases": [
+    "CVE-2024-7181"
+  ],
+  "details": "A vulnerability classified as critical was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. This vulnerability affects the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument telnet_enabled leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-272602 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7181"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/A3600R/setTelnetCfg.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.272602"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.272602"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.378050"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-77"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-29T04:15:02Z"
+  }
+}
@@ -0,0 +1,54 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-rvvm-rjf3-jr7v",
+  "modified": "2024-07-29T06:30:26Z",
+  "published": "2024-07-29T06:30:26Z",
+  "aliases": [
+    "CVE-2024-7185"
+  ],
+  "details": "A vulnerability was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102 and classified as critical. Affected by this issue is the function setWebWlanIdx of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument webWlanIdx leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-272606 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7185"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/A3600R/setWebWlanIdx.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.272606"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.272606"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.378054"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-120"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-29T06:15:02Z"
+  }
+}
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-vg2c-gcf5-56f2",
+  "modified": "2024-07-29T06:30:24Z",
+  "published": "2024-07-29T06:30:24Z",
+  "aliases": [
+    "CVE-2024-37381"
+  ],
+  "details": "An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2024 flat allows an authenticated attacker within the same network to execute arbitrary code.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37381"
+    },
+    {
+      "type": "WEB",
+      "url": "https://forums.ivanti.com/s/article/Security-Advisory-EPM-July-2024-for-EPM-2024"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-29T06:15:01Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-w3pw-m4q2-x98m",
+  "modified": "2024-07-29T06:30:25Z",
+  "published": "2024-07-29T06:30:25Z",
+  "aliases": [
+    "CVE-2024-4483"
+  ],
+  "details": "The Email Encoder  WordPress plugin before 2.2.2 does not escape the WP_Email_Encoder_Bundle_options[protection_text] parameter before outputting it back in an attribute in an admin page, leading to a Stored Cross-Site Scripting",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4483"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/8f2ac76c-f3f8-41f9-a32a-f414825cf6f1"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-29T06:15:02Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-wrpc-6v65-cc7f",
+  "modified": "2024-07-29T06:30:26Z",
+  "published": "2024-07-29T06:30:26Z",
+  "aliases": [
+    "CVE-2024-6366"
+  ],
+  "details": "The User Profile Builder  WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media files via the async upload functionality of WP.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6366"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/5b90cbdd-52cc-4e7b-bf39-bea0dd59e19e"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-29T06:15:02Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-xp28-88f3-2f49",
+  "modified": "2024-07-29T06:30:25Z",
+  "published": "2024-07-29T06:30:25Z",
+  "aliases": [
+    "CVE-2024-5285"
+  ],
+  "details": "The wp-affiliate-platform WordPress plugin before 6.5.2 does not have CSRF check in place when deleting affiliates, which could allow attackers to make a logged in user change delete them via a CSRF attack",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5285"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/792f3904-88bd-47d1-9049-afccdd74853a"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-29T06:15:02Z"
+  }
+}