Publish Advisories

GHSA-42w6-9898-chc9 GHSA-4c34-f6qc-56qv GHSA-579f-f345-5j7p GHSA-6r36-crx2-h5cg GHSA-7ggq-cf75-fcfc GHSA-7jw8-q7xc-w2cq GHSA-853h-mwm5-5qqr GHSA-96vr-9q65-96gj GHSA-cf26-j7rw-5r6f GHSA-crvp-99p3-9m36 GHSA-cx67-m2rh-98xh GHSA-f25c-wxgv-xhrw GHSA-g2j4-8f3h-m86r GHSA-g6ff-r3gx-pgfx GHSA-jrjf-m2v9-j4qr GHSA-q7vw-x6cm-vm3g GHSA-qjh7-f97r-9p56 GHSA-rp4m-cvm9-gmvp GHSA-vcwx-63wp-cqr7 GHSA-vfqx-2vvp-j7qq GHSA-vh4q-xf3f-7h4p GHSA-wq5w-42wp-4qfx GHSA-xg5j-69w2-9h88
2026-05-22 18:04:22 -07:00 · 2024-07-30 06:32:22 +00:00
parent 383c38f0ae
commit f56a62805b
23 changed files with 919 additions and 0 deletions
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-42w6-9898-chc9",
+  "modified": "2024-07-30T06:30:37Z",
+  "published": "2024-07-30T06:30:37Z",
+  "aliases": [
+    "CVE-2024-5807"
+  ],
+  "details": "The Business Card WordPress plugin through 1.0.0 does not prevent high privilege users like administrators from uploading malicious PHP files, which could allow them to run arbitrary code on servers hosting their site, even in MultiSite configurations.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5807"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/badb16b5-8c06-4170-b605-ea7af8982c1f"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T06:15:02Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-4c34-f6qc-56qv",
+  "modified": "2024-07-30T06:30:36Z",
+  "published": "2024-07-30T06:30:36Z",
+  "aliases": [
+    "CVE-2024-4096"
+  ],
+  "details": "The Responsive Tabs WordPress plugin through 4.0.8 does not sanitise and escape some of its Tab settings, which could allow high privilege users such as Contributors and above to perform Stored Cross-Site Scripting attacks",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4096"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/4dba5e9e-24be-458a-9150-7c7a958e66cb"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T06:15:02Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-579f-f345-5j7p",
+  "modified": "2024-07-30T06:30:37Z",
+  "published": "2024-07-30T06:30:37Z",
+  "aliases": [
+    "CVE-2024-6224"
+  ],
+  "details": "The Send email only on Reply to My Comment WordPress plugin through 1.0.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6224"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/54457f1b-6572-4de0-9100-3433c715c5ce"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T06:15:03Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-6r36-crx2-h5cg",
+  "modified": "2024-07-30T06:30:35Z",
+  "published": "2024-07-30T06:30:35Z",
+  "aliases": [
+    "CVE-2024-1286"
+  ],
+  "details": "The pmpro-membership-maps WordPress plugin before 0.7 does not prevent users with at least the contributor role from leaking sensitive information about users with a membership on the site.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1286"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/49dc9ca3-d0ef-4a75-8b51-307e3e44e91b"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T06:15:01Z"
+  }
+}
@@ -0,0 +1,54 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-7ggq-cf75-fcfc",
+  "modified": "2024-07-30T06:30:35Z",
+  "published": "2024-07-30T06:30:35Z",
+  "aliases": [
+    "CVE-2024-7218"
+  ],
+  "details": "A vulnerability was found in SourceCodester School Log Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /admin/ajax.php?action=save_student. The manipulation of the argument name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272789 was assigned to this vulnerability.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7218"
+    },
+    {
+      "type": "WEB",
+      "url": "https://gist.github.com/topsky979/86480890cc621c240c86e95a3de9ecc4"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.272789"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.272789"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.380425"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T05:15:10Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-7jw8-q7xc-w2cq",
+  "modified": "2024-07-30T06:30:36Z",
+  "published": "2024-07-30T06:30:36Z",
+  "aliases": [
+    "CVE-2024-3669"
+  ],
+  "details": "The Web Directory Free WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3669"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/3c37c9a9-1424-427a-adc7-c2336a47e9cf"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T06:15:02Z"
+  }
+}
@@ -0,0 +1,54 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-853h-mwm5-5qqr",
+  "modified": "2024-07-30T06:30:35Z",
+  "published": "2024-07-30T06:30:35Z",
+  "aliases": [
+    "CVE-2024-7215"
+  ],
+  "details": "A vulnerability was found in TOTOLINK LR1200 9.3.1cu.2832 and classified as critical. Affected by this issue is the function NTPSyncWithHost of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument host_time leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-272786 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7215"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/LR1200/NTPSyncWithHost.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.272786"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.272786"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.378330"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-77"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T04:15:03Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-96vr-9q65-96gj",
+  "modified": "2024-07-30T06:30:36Z",
+  "published": "2024-07-30T06:30:36Z",
+  "aliases": [
+    "CVE-2024-3113"
+  ],
+  "details": "The FormFlow: WhatsApp Social and Advanced Form Builder with Easy Lead Collection WordPress plugin before 2.12.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3113"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/ad85c5c7-f4d1-4374-b3b7-8ee022d27d34"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T06:15:02Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-cf26-j7rw-5r6f",
+  "modified": "2024-07-30T06:30:37Z",
+  "published": "2024-07-30T06:30:37Z",
+  "aliases": [
+    "CVE-2024-6223"
+  ],
+  "details": "The Send email only on Reply to My Comment WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6223"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/cf7d1cea-0bf4-4b9e-bab4-71d5719a7c30"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T06:15:03Z"
+  }
+}
@@ -0,0 +1,54 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-crvp-99p3-9m36",
+  "modified": "2024-07-30T06:30:35Z",
+  "published": "2024-07-30T06:30:35Z",
+  "aliases": [
+    "CVE-2024-7216"
+  ],
+  "details": "A vulnerability was found in TOTOLINK LR1200 9.3.1cu.2832. It has been classified as problematic. This affects an unknown part of the file /etc/shadow.sample. The manipulation leads to use of hard-coded password. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272787. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7216"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/LR1200/shadow.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.272787"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.272787"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.378331"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-259"
+    ],
+    "severity": "LOW",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T04:15:04Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-cx67-m2rh-98xh",
+  "modified": "2024-07-30T06:30:37Z",
+  "published": "2024-07-30T06:30:37Z",
+  "aliases": [
+    "CVE-2024-6021"
+  ],
+  "details": "The Donation Block For PayPal WordPress plugin through 2.1.0 does not sanitise and escape form submissions, leading to a stored cross-site scripting vulnerability",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6021"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/9d83cffd-7dcd-4301-8d4d-3043b14e05b5"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T06:15:03Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-f25c-wxgv-xhrw",
+  "modified": "2024-07-30T06:30:37Z",
+  "published": "2024-07-30T06:30:37Z",
+  "aliases": [
+    "CVE-2024-6536"
+  ],
+  "details": "The Zephyr Project Manager WordPress plugin before 3.3.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors and admins to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6536"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/ee40c1c6-4186-4b97-866c-fb0e76cedeb8"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T06:15:04Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-g2j4-8f3h-m86r",
+  "modified": "2024-07-30T06:30:36Z",
+  "published": "2024-07-30T06:30:36Z",
+  "aliases": [
+    "CVE-2024-3986"
+  ],
+  "details": "The SportsPress  WordPress plugin before 2.7.22 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3986"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/76c78f8e-e3da-47d9-9bf4-70e9dd125b82"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T06:15:02Z"
+  }
+}
@@ -0,0 +1,54 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-g6ff-r3gx-pgfx",
+  "modified": "2024-07-30T06:30:37Z",
+  "published": "2024-07-30T06:30:37Z",
+  "aliases": [
+    "CVE-2024-7219"
+  ],
+  "details": "A vulnerability classified as critical has been found in SourceCodester School Log Management System 1.0. Affected is an unknown function of the file /admin/ajax.php?action=login. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-272790 is the identifier assigned to this vulnerability.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7219"
+    },
+    {
+      "type": "WEB",
+      "url": "https://gist.github.com/topsky979/03c7fe20c80455b4884ae9e6c3f3d978"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.272790"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.272790"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.380426"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-89"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T06:15:04Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-jrjf-m2v9-j4qr",
+  "modified": "2024-07-30T06:30:37Z",
+  "published": "2024-07-30T06:30:37Z",
+  "aliases": [
+    "CVE-2024-5808"
+  ],
+  "details": "The WP Ajax Contact Form WordPress plugin through 2.2.2 does not have CSRF check in place when deleting emails from the email list, which could allow attackers to make a logged in admin perform such action via a CSRF attack",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5808"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/1783bbce-3cc3-4a7e-a491-b713cee8278b"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T06:15:03Z"
+  }
+}
@@ -0,0 +1,54 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-q7vw-x6cm-vm3g",
+  "modified": "2024-07-30T06:30:37Z",
+  "published": "2024-07-30T06:30:37Z",
+  "aliases": [
+    "CVE-2024-7220"
+  ],
+  "details": "A vulnerability classified as critical was found in SourceCodester School Log Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/print_barcode.php. The manipulation of the argument tbl leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272791.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7220"
+    },
+    {
+      "type": "WEB",
+      "url": "https://gist.github.com/topsky979/5cd0b6a43815a0615b8493cde5c4dacf"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.272791"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.272791"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.380427"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-89"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T06:15:04Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-qjh7-f97r-9p56",
+  "modified": "2024-07-30T06:30:37Z",
+  "published": "2024-07-30T06:30:37Z",
+  "aliases": [
+    "CVE-2024-5765"
+  ],
+  "details": "The WpStickyBar  WordPress plugin through 2.1.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5765"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/0b73f84c-611e-4681-b362-35e721478ba4"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T06:15:02Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-rp4m-cvm9-gmvp",
+  "modified": "2024-07-30T06:30:37Z",
+  "published": "2024-07-30T06:30:37Z",
+  "aliases": [
+    "CVE-2024-5975"
+  ],
+  "details": "The CZ Loan Management WordPress plugin through 1.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5975"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/68f81943-b007-49c8-be9c-d0405b2ba4cf"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T06:15:03Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-vcwx-63wp-cqr7",
+  "modified": "2024-07-30T06:30:35Z",
+  "published": "2024-07-30T06:30:35Z",
+  "aliases": [
+    "CVE-2024-1287"
+  ],
+  "details": "The pmpro-member-directory WordPress plugin before 1.2.6 does not prevent users with at least the contributor role from leaking other users' sensitive information, including password hashes.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1287"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/169e5756-4e12-4add-82e9-47471c30f08c"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T06:15:02Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-vfqx-2vvp-j7qq",
+  "modified": "2024-07-30T06:30:37Z",
+  "published": "2024-07-30T06:30:37Z",
+  "aliases": [
+    "CVE-2024-6226"
+  ],
+  "details": "The WpStickyBar  WordPress plugin through 2.1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6226"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/e42ce8dc-51d4-471d-b3bb-ad2a6b735d02"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T06:15:03Z"
+  }
+}
--- a/Show More
+++ b/Show More