From f56a62805bb1b6477e35e46b4c0a2d42d4d9b1db Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Tue, 30 Jul 2024 06:32:22 +0000
Subject: [PATCH] Publish Advisories

GHSA-42w6-9898-chc9
GHSA-4c34-f6qc-56qv
GHSA-579f-f345-5j7p
GHSA-6r36-crx2-h5cg
GHSA-7ggq-cf75-fcfc
GHSA-7jw8-q7xc-w2cq
GHSA-853h-mwm5-5qqr
GHSA-96vr-9q65-96gj
GHSA-cf26-j7rw-5r6f
GHSA-crvp-99p3-9m36
GHSA-cx67-m2rh-98xh
GHSA-f25c-wxgv-xhrw
GHSA-g2j4-8f3h-m86r
GHSA-g6ff-r3gx-pgfx
GHSA-jrjf-m2v9-j4qr
GHSA-q7vw-x6cm-vm3g
GHSA-qjh7-f97r-9p56
GHSA-rp4m-cvm9-gmvp
GHSA-vcwx-63wp-cqr7
GHSA-vfqx-2vvp-j7qq
GHSA-vh4q-xf3f-7h4p
GHSA-wq5w-42wp-4qfx
GHSA-xg5j-69w2-9h88
---
 .../GHSA-42w6-9898-chc9.json                  | 35 ++++++++++++
 .../GHSA-4c34-f6qc-56qv.json                  | 35 ++++++++++++
 .../GHSA-579f-f345-5j7p.json                  | 35 ++++++++++++
 .../GHSA-6r36-crx2-h5cg.json                  | 35 ++++++++++++
 .../GHSA-7ggq-cf75-fcfc.json                  | 54 +++++++++++++++++++
 .../GHSA-7jw8-q7xc-w2cq.json                  | 35 ++++++++++++
 .../GHSA-853h-mwm5-5qqr.json                  | 54 +++++++++++++++++++
 .../GHSA-96vr-9q65-96gj.json                  | 35 ++++++++++++
 .../GHSA-cf26-j7rw-5r6f.json                  | 35 ++++++++++++
 .../GHSA-crvp-99p3-9m36.json                  | 54 +++++++++++++++++++
 .../GHSA-cx67-m2rh-98xh.json                  | 35 ++++++++++++
 .../GHSA-f25c-wxgv-xhrw.json                  | 35 ++++++++++++
 .../GHSA-g2j4-8f3h-m86r.json                  | 35 ++++++++++++
 .../GHSA-g6ff-r3gx-pgfx.json                  | 54 +++++++++++++++++++
 .../GHSA-jrjf-m2v9-j4qr.json                  | 35 ++++++++++++
 .../GHSA-q7vw-x6cm-vm3g.json                  | 54 +++++++++++++++++++
 .../GHSA-qjh7-f97r-9p56.json                  | 35 ++++++++++++
 .../GHSA-rp4m-cvm9-gmvp.json                  | 35 ++++++++++++
 .../GHSA-vcwx-63wp-cqr7.json                  | 35 ++++++++++++
 .../GHSA-vfqx-2vvp-j7qq.json                  | 35 ++++++++++++
 .../GHSA-vh4q-xf3f-7h4p.json                  | 35 ++++++++++++
 .../GHSA-wq5w-42wp-4qfx.json                  | 54 +++++++++++++++++++
 .../GHSA-xg5j-69w2-9h88.json                  | 35 ++++++++++++
 23 files changed, 919 insertions(+)
 create mode 100644 advisories/unreviewed/2024/07/GHSA-42w6-9898-chc9/GHSA-42w6-9898-chc9.json
 create mode 100644 advisories/unreviewed/2024/07/GHSA-4c34-f6qc-56qv/GHSA-4c34-f6qc-56qv.json
 create mode 100644 advisories/unreviewed/2024/07/GHSA-579f-f345-5j7p/GHSA-579f-f345-5j7p.json
 create mode 100644 advisories/unreviewed/2024/07/GHSA-6r36-crx2-h5cg/GHSA-6r36-crx2-h5cg.json
 create mode 100644 advisories/unreviewed/2024/07/GHSA-7ggq-cf75-fcfc/GHSA-7ggq-cf75-fcfc.json
 create mode 100644 advisories/unreviewed/2024/07/GHSA-7jw8-q7xc-w2cq/GHSA-7jw8-q7xc-w2cq.json
 create mode 100644 advisories/unreviewed/2024/07/GHSA-853h-mwm5-5qqr/GHSA-853h-mwm5-5qqr.json
 create mode 100644 advisories/unreviewed/2024/07/GHSA-96vr-9q65-96gj/GHSA-96vr-9q65-96gj.json
 create mode 100644 advisories/unreviewed/2024/07/GHSA-cf26-j7rw-5r6f/GHSA-cf26-j7rw-5r6f.json
 create mode 100644 advisories/unreviewed/2024/07/GHSA-crvp-99p3-9m36/GHSA-crvp-99p3-9m36.json
 create mode 100644 advisories/unreviewed/2024/07/GHSA-cx67-m2rh-98xh/GHSA-cx67-m2rh-98xh.json
 create mode 100644 advisories/unreviewed/2024/07/GHSA-f25c-wxgv-xhrw/GHSA-f25c-wxgv-xhrw.json
 create mode 100644 advisories/unreviewed/2024/07/GHSA-g2j4-8f3h-m86r/GHSA-g2j4-8f3h-m86r.json
 create mode 100644 advisories/unreviewed/2024/07/GHSA-g6ff-r3gx-pgfx/GHSA-g6ff-r3gx-pgfx.json
 create mode 100644 advisories/unreviewed/2024/07/GHSA-jrjf-m2v9-j4qr/GHSA-jrjf-m2v9-j4qr.json
 create mode 100644 advisories/unreviewed/2024/07/GHSA-q7vw-x6cm-vm3g/GHSA-q7vw-x6cm-vm3g.json
 create mode 100644 advisories/unreviewed/2024/07/GHSA-qjh7-f97r-9p56/GHSA-qjh7-f97r-9p56.json
 create mode 100644 advisories/unreviewed/2024/07/GHSA-rp4m-cvm9-gmvp/GHSA-rp4m-cvm9-gmvp.json
 create mode 100644 advisories/unreviewed/2024/07/GHSA-vcwx-63wp-cqr7/GHSA-vcwx-63wp-cqr7.json
 create mode 100644 advisories/unreviewed/2024/07/GHSA-vfqx-2vvp-j7qq/GHSA-vfqx-2vvp-j7qq.json
 create mode 100644 advisories/unreviewed/2024/07/GHSA-vh4q-xf3f-7h4p/GHSA-vh4q-xf3f-7h4p.json
 create mode 100644 advisories/unreviewed/2024/07/GHSA-wq5w-42wp-4qfx/GHSA-wq5w-42wp-4qfx.json
 create mode 100644 advisories/unreviewed/2024/07/GHSA-xg5j-69w2-9h88/GHSA-xg5j-69w2-9h88.json

diff --git a/advisories/unreviewed/2024/07/GHSA-42w6-9898-chc9/GHSA-42w6-9898-chc9.json b/advisories/unreviewed/2024/07/GHSA-42w6-9898-chc9/GHSA-42w6-9898-chc9.json
new file mode 100644
index 00000000000..20805e965bf
--- /dev/null
+++ b/advisories/unreviewed/2024/07/GHSA-42w6-9898-chc9/GHSA-42w6-9898-chc9.json
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-42w6-9898-chc9",
+  "modified": "2024-07-30T06:30:37Z",
+  "published": "2024-07-30T06:30:37Z",
+  "aliases": [
+    "CVE-2024-5807"
+  ],
+  "details": "The Business Card WordPress plugin through 1.0.0 does not prevent high privilege users like administrators from uploading malicious PHP files, which could allow them to run arbitrary code on servers hosting their site, even in MultiSite configurations.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5807"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/badb16b5-8c06-4170-b605-ea7af8982c1f"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T06:15:02Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/07/GHSA-4c34-f6qc-56qv/GHSA-4c34-f6qc-56qv.json b/advisories/unreviewed/2024/07/GHSA-4c34-f6qc-56qv/GHSA-4c34-f6qc-56qv.json
new file mode 100644
index 00000000000..8975c502b30
--- /dev/null
+++ b/advisories/unreviewed/2024/07/GHSA-4c34-f6qc-56qv/GHSA-4c34-f6qc-56qv.json
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-4c34-f6qc-56qv",
+  "modified": "2024-07-30T06:30:36Z",
+  "published": "2024-07-30T06:30:36Z",
+  "aliases": [
+    "CVE-2024-4096"
+  ],
+  "details": "The Responsive Tabs WordPress plugin through 4.0.8 does not sanitise and escape some of its Tab settings, which could allow high privilege users such as Contributors and above to perform Stored Cross-Site Scripting attacks",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4096"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/4dba5e9e-24be-458a-9150-7c7a958e66cb"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T06:15:02Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/07/GHSA-579f-f345-5j7p/GHSA-579f-f345-5j7p.json b/advisories/unreviewed/2024/07/GHSA-579f-f345-5j7p/GHSA-579f-f345-5j7p.json
new file mode 100644
index 00000000000..821b1cf5009
--- /dev/null
+++ b/advisories/unreviewed/2024/07/GHSA-579f-f345-5j7p/GHSA-579f-f345-5j7p.json
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-579f-f345-5j7p",
+  "modified": "2024-07-30T06:30:37Z",
+  "published": "2024-07-30T06:30:37Z",
+  "aliases": [
+    "CVE-2024-6224"
+  ],
+  "details": "The Send email only on Reply to My Comment WordPress plugin through 1.0.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6224"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/54457f1b-6572-4de0-9100-3433c715c5ce"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T06:15:03Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/07/GHSA-6r36-crx2-h5cg/GHSA-6r36-crx2-h5cg.json b/advisories/unreviewed/2024/07/GHSA-6r36-crx2-h5cg/GHSA-6r36-crx2-h5cg.json
new file mode 100644
index 00000000000..f62b6de7f14
--- /dev/null
+++ b/advisories/unreviewed/2024/07/GHSA-6r36-crx2-h5cg/GHSA-6r36-crx2-h5cg.json
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-6r36-crx2-h5cg",
+  "modified": "2024-07-30T06:30:35Z",
+  "published": "2024-07-30T06:30:35Z",
+  "aliases": [
+    "CVE-2024-1286"
+  ],
+  "details": "The pmpro-membership-maps WordPress plugin before 0.7 does not prevent users with at least the contributor role from leaking sensitive information about users with a membership on the site.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1286"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/49dc9ca3-d0ef-4a75-8b51-307e3e44e91b"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T06:15:01Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/07/GHSA-7ggq-cf75-fcfc/GHSA-7ggq-cf75-fcfc.json b/advisories/unreviewed/2024/07/GHSA-7ggq-cf75-fcfc/GHSA-7ggq-cf75-fcfc.json
new file mode 100644
index 00000000000..0888c02e41e
--- /dev/null
+++ b/advisories/unreviewed/2024/07/GHSA-7ggq-cf75-fcfc/GHSA-7ggq-cf75-fcfc.json
@@ -0,0 +1,54 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-7ggq-cf75-fcfc",
+  "modified": "2024-07-30T06:30:35Z",
+  "published": "2024-07-30T06:30:35Z",
+  "aliases": [
+    "CVE-2024-7218"
+  ],
+  "details": "A vulnerability was found in SourceCodester School Log Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /admin/ajax.php?action=save_student. The manipulation of the argument name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272789 was assigned to this vulnerability.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7218"
+    },
+    {
+      "type": "WEB",
+      "url": "https://gist.github.com/topsky979/86480890cc621c240c86e95a3de9ecc4"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.272789"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.272789"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.380425"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T05:15:10Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/07/GHSA-7jw8-q7xc-w2cq/GHSA-7jw8-q7xc-w2cq.json b/advisories/unreviewed/2024/07/GHSA-7jw8-q7xc-w2cq/GHSA-7jw8-q7xc-w2cq.json
new file mode 100644
index 00000000000..1ebd4283020
--- /dev/null
+++ b/advisories/unreviewed/2024/07/GHSA-7jw8-q7xc-w2cq/GHSA-7jw8-q7xc-w2cq.json
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-7jw8-q7xc-w2cq",
+  "modified": "2024-07-30T06:30:36Z",
+  "published": "2024-07-30T06:30:36Z",
+  "aliases": [
+    "CVE-2024-3669"
+  ],
+  "details": "The Web Directory Free WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3669"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/3c37c9a9-1424-427a-adc7-c2336a47e9cf"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T06:15:02Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/07/GHSA-853h-mwm5-5qqr/GHSA-853h-mwm5-5qqr.json b/advisories/unreviewed/2024/07/GHSA-853h-mwm5-5qqr/GHSA-853h-mwm5-5qqr.json
new file mode 100644
index 00000000000..8df817947dd
--- /dev/null
+++ b/advisories/unreviewed/2024/07/GHSA-853h-mwm5-5qqr/GHSA-853h-mwm5-5qqr.json
@@ -0,0 +1,54 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-853h-mwm5-5qqr",
+  "modified": "2024-07-30T06:30:35Z",
+  "published": "2024-07-30T06:30:35Z",
+  "aliases": [
+    "CVE-2024-7215"
+  ],
+  "details": "A vulnerability was found in TOTOLINK LR1200 9.3.1cu.2832 and classified as critical. Affected by this issue is the function NTPSyncWithHost of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument host_time leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-272786 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7215"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/LR1200/NTPSyncWithHost.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.272786"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.272786"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.378330"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-77"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T04:15:03Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/07/GHSA-96vr-9q65-96gj/GHSA-96vr-9q65-96gj.json b/advisories/unreviewed/2024/07/GHSA-96vr-9q65-96gj/GHSA-96vr-9q65-96gj.json
new file mode 100644
index 00000000000..90de48e073a
--- /dev/null
+++ b/advisories/unreviewed/2024/07/GHSA-96vr-9q65-96gj/GHSA-96vr-9q65-96gj.json
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-96vr-9q65-96gj",
+  "modified": "2024-07-30T06:30:36Z",
+  "published": "2024-07-30T06:30:36Z",
+  "aliases": [
+    "CVE-2024-3113"
+  ],
+  "details": "The FormFlow: WhatsApp Social and Advanced Form Builder with Easy Lead Collection WordPress plugin before 2.12.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3113"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/ad85c5c7-f4d1-4374-b3b7-8ee022d27d34"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T06:15:02Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/07/GHSA-cf26-j7rw-5r6f/GHSA-cf26-j7rw-5r6f.json b/advisories/unreviewed/2024/07/GHSA-cf26-j7rw-5r6f/GHSA-cf26-j7rw-5r6f.json
new file mode 100644
index 00000000000..2ef9074430c
--- /dev/null
+++ b/advisories/unreviewed/2024/07/GHSA-cf26-j7rw-5r6f/GHSA-cf26-j7rw-5r6f.json
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-cf26-j7rw-5r6f",
+  "modified": "2024-07-30T06:30:37Z",
+  "published": "2024-07-30T06:30:37Z",
+  "aliases": [
+    "CVE-2024-6223"
+  ],
+  "details": "The Send email only on Reply to My Comment WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6223"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/cf7d1cea-0bf4-4b9e-bab4-71d5719a7c30"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T06:15:03Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/07/GHSA-crvp-99p3-9m36/GHSA-crvp-99p3-9m36.json b/advisories/unreviewed/2024/07/GHSA-crvp-99p3-9m36/GHSA-crvp-99p3-9m36.json
new file mode 100644
index 00000000000..cb4567848d9
--- /dev/null
+++ b/advisories/unreviewed/2024/07/GHSA-crvp-99p3-9m36/GHSA-crvp-99p3-9m36.json
@@ -0,0 +1,54 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-crvp-99p3-9m36",
+  "modified": "2024-07-30T06:30:35Z",
+  "published": "2024-07-30T06:30:35Z",
+  "aliases": [
+    "CVE-2024-7216"
+  ],
+  "details": "A vulnerability was found in TOTOLINK LR1200 9.3.1cu.2832. It has been classified as problematic. This affects an unknown part of the file /etc/shadow.sample. The manipulation leads to use of hard-coded password. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272787. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7216"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/LR1200/shadow.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.272787"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.272787"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.378331"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-259"
+    ],
+    "severity": "LOW",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T04:15:04Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/07/GHSA-cx67-m2rh-98xh/GHSA-cx67-m2rh-98xh.json b/advisories/unreviewed/2024/07/GHSA-cx67-m2rh-98xh/GHSA-cx67-m2rh-98xh.json
new file mode 100644
index 00000000000..8990c484a43
--- /dev/null
+++ b/advisories/unreviewed/2024/07/GHSA-cx67-m2rh-98xh/GHSA-cx67-m2rh-98xh.json
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-cx67-m2rh-98xh",
+  "modified": "2024-07-30T06:30:37Z",
+  "published": "2024-07-30T06:30:37Z",
+  "aliases": [
+    "CVE-2024-6021"
+  ],
+  "details": "The Donation Block For PayPal WordPress plugin through 2.1.0 does not sanitise and escape form submissions, leading to a stored cross-site scripting vulnerability",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6021"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/9d83cffd-7dcd-4301-8d4d-3043b14e05b5"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T06:15:03Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/07/GHSA-f25c-wxgv-xhrw/GHSA-f25c-wxgv-xhrw.json b/advisories/unreviewed/2024/07/GHSA-f25c-wxgv-xhrw/GHSA-f25c-wxgv-xhrw.json
new file mode 100644
index 00000000000..2307018307a
--- /dev/null
+++ b/advisories/unreviewed/2024/07/GHSA-f25c-wxgv-xhrw/GHSA-f25c-wxgv-xhrw.json
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-f25c-wxgv-xhrw",
+  "modified": "2024-07-30T06:30:37Z",
+  "published": "2024-07-30T06:30:37Z",
+  "aliases": [
+    "CVE-2024-6536"
+  ],
+  "details": "The Zephyr Project Manager WordPress plugin before 3.3.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors and admins to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6536"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/ee40c1c6-4186-4b97-866c-fb0e76cedeb8"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T06:15:04Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/07/GHSA-g2j4-8f3h-m86r/GHSA-g2j4-8f3h-m86r.json b/advisories/unreviewed/2024/07/GHSA-g2j4-8f3h-m86r/GHSA-g2j4-8f3h-m86r.json
new file mode 100644
index 00000000000..c258b6f8175
--- /dev/null
+++ b/advisories/unreviewed/2024/07/GHSA-g2j4-8f3h-m86r/GHSA-g2j4-8f3h-m86r.json
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-g2j4-8f3h-m86r",
+  "modified": "2024-07-30T06:30:36Z",
+  "published": "2024-07-30T06:30:36Z",
+  "aliases": [
+    "CVE-2024-3986"
+  ],
+  "details": "The SportsPress  WordPress plugin before 2.7.22 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3986"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/76c78f8e-e3da-47d9-9bf4-70e9dd125b82"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T06:15:02Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/07/GHSA-g6ff-r3gx-pgfx/GHSA-g6ff-r3gx-pgfx.json b/advisories/unreviewed/2024/07/GHSA-g6ff-r3gx-pgfx/GHSA-g6ff-r3gx-pgfx.json
new file mode 100644
index 00000000000..3624f4ade48
--- /dev/null
+++ b/advisories/unreviewed/2024/07/GHSA-g6ff-r3gx-pgfx/GHSA-g6ff-r3gx-pgfx.json
@@ -0,0 +1,54 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-g6ff-r3gx-pgfx",
+  "modified": "2024-07-30T06:30:37Z",
+  "published": "2024-07-30T06:30:37Z",
+  "aliases": [
+    "CVE-2024-7219"
+  ],
+  "details": "A vulnerability classified as critical has been found in SourceCodester School Log Management System 1.0. Affected is an unknown function of the file /admin/ajax.php?action=login. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-272790 is the identifier assigned to this vulnerability.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7219"
+    },
+    {
+      "type": "WEB",
+      "url": "https://gist.github.com/topsky979/03c7fe20c80455b4884ae9e6c3f3d978"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.272790"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.272790"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.380426"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-89"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T06:15:04Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/07/GHSA-jrjf-m2v9-j4qr/GHSA-jrjf-m2v9-j4qr.json b/advisories/unreviewed/2024/07/GHSA-jrjf-m2v9-j4qr/GHSA-jrjf-m2v9-j4qr.json
new file mode 100644
index 00000000000..5fd8c95d2f8
--- /dev/null
+++ b/advisories/unreviewed/2024/07/GHSA-jrjf-m2v9-j4qr/GHSA-jrjf-m2v9-j4qr.json
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-jrjf-m2v9-j4qr",
+  "modified": "2024-07-30T06:30:37Z",
+  "published": "2024-07-30T06:30:37Z",
+  "aliases": [
+    "CVE-2024-5808"
+  ],
+  "details": "The WP Ajax Contact Form WordPress plugin through 2.2.2 does not have CSRF check in place when deleting emails from the email list, which could allow attackers to make a logged in admin perform such action via a CSRF attack",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5808"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/1783bbce-3cc3-4a7e-a491-b713cee8278b"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T06:15:03Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/07/GHSA-q7vw-x6cm-vm3g/GHSA-q7vw-x6cm-vm3g.json b/advisories/unreviewed/2024/07/GHSA-q7vw-x6cm-vm3g/GHSA-q7vw-x6cm-vm3g.json
new file mode 100644
index 00000000000..4afb63d2a30
--- /dev/null
+++ b/advisories/unreviewed/2024/07/GHSA-q7vw-x6cm-vm3g/GHSA-q7vw-x6cm-vm3g.json
@@ -0,0 +1,54 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-q7vw-x6cm-vm3g",
+  "modified": "2024-07-30T06:30:37Z",
+  "published": "2024-07-30T06:30:37Z",
+  "aliases": [
+    "CVE-2024-7220"
+  ],
+  "details": "A vulnerability classified as critical was found in SourceCodester School Log Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/print_barcode.php. The manipulation of the argument tbl leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272791.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7220"
+    },
+    {
+      "type": "WEB",
+      "url": "https://gist.github.com/topsky979/5cd0b6a43815a0615b8493cde5c4dacf"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.272791"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.272791"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.380427"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-89"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T06:15:04Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/07/GHSA-qjh7-f97r-9p56/GHSA-qjh7-f97r-9p56.json b/advisories/unreviewed/2024/07/GHSA-qjh7-f97r-9p56/GHSA-qjh7-f97r-9p56.json
new file mode 100644
index 00000000000..b4f8b21ed8a
--- /dev/null
+++ b/advisories/unreviewed/2024/07/GHSA-qjh7-f97r-9p56/GHSA-qjh7-f97r-9p56.json
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-qjh7-f97r-9p56",
+  "modified": "2024-07-30T06:30:37Z",
+  "published": "2024-07-30T06:30:37Z",
+  "aliases": [
+    "CVE-2024-5765"
+  ],
+  "details": "The WpStickyBar  WordPress plugin through 2.1.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5765"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/0b73f84c-611e-4681-b362-35e721478ba4"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T06:15:02Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/07/GHSA-rp4m-cvm9-gmvp/GHSA-rp4m-cvm9-gmvp.json b/advisories/unreviewed/2024/07/GHSA-rp4m-cvm9-gmvp/GHSA-rp4m-cvm9-gmvp.json
new file mode 100644
index 00000000000..b3e37b2ad17
--- /dev/null
+++ b/advisories/unreviewed/2024/07/GHSA-rp4m-cvm9-gmvp/GHSA-rp4m-cvm9-gmvp.json
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-rp4m-cvm9-gmvp",
+  "modified": "2024-07-30T06:30:37Z",
+  "published": "2024-07-30T06:30:37Z",
+  "aliases": [
+    "CVE-2024-5975"
+  ],
+  "details": "The CZ Loan Management WordPress plugin through 1.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5975"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/68f81943-b007-49c8-be9c-d0405b2ba4cf"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T06:15:03Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/07/GHSA-vcwx-63wp-cqr7/GHSA-vcwx-63wp-cqr7.json b/advisories/unreviewed/2024/07/GHSA-vcwx-63wp-cqr7/GHSA-vcwx-63wp-cqr7.json
new file mode 100644
index 00000000000..a3931155bbc
--- /dev/null
+++ b/advisories/unreviewed/2024/07/GHSA-vcwx-63wp-cqr7/GHSA-vcwx-63wp-cqr7.json
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-vcwx-63wp-cqr7",
+  "modified": "2024-07-30T06:30:35Z",
+  "published": "2024-07-30T06:30:35Z",
+  "aliases": [
+    "CVE-2024-1287"
+  ],
+  "details": "The pmpro-member-directory WordPress plugin before 1.2.6 does not prevent users with at least the contributor role from leaking other users' sensitive information, including password hashes.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1287"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/169e5756-4e12-4add-82e9-47471c30f08c"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T06:15:02Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/07/GHSA-vfqx-2vvp-j7qq/GHSA-vfqx-2vvp-j7qq.json b/advisories/unreviewed/2024/07/GHSA-vfqx-2vvp-j7qq/GHSA-vfqx-2vvp-j7qq.json
new file mode 100644
index 00000000000..ea9932888e4
--- /dev/null
+++ b/advisories/unreviewed/2024/07/GHSA-vfqx-2vvp-j7qq/GHSA-vfqx-2vvp-j7qq.json
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-vfqx-2vvp-j7qq",
+  "modified": "2024-07-30T06:30:37Z",
+  "published": "2024-07-30T06:30:37Z",
+  "aliases": [
+    "CVE-2024-6226"
+  ],
+  "details": "The WpStickyBar  WordPress plugin through 2.1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6226"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/e42ce8dc-51d4-471d-b3bb-ad2a6b735d02"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T06:15:03Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/07/GHSA-vh4q-xf3f-7h4p/GHSA-vh4q-xf3f-7h4p.json b/advisories/unreviewed/2024/07/GHSA-vh4q-xf3f-7h4p/GHSA-vh4q-xf3f-7h4p.json
new file mode 100644
index 00000000000..13909af3d57
--- /dev/null
+++ b/advisories/unreviewed/2024/07/GHSA-vh4q-xf3f-7h4p/GHSA-vh4q-xf3f-7h4p.json
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-vh4q-xf3f-7h4p",
+  "modified": "2024-07-30T06:30:37Z",
+  "published": "2024-07-30T06:30:37Z",
+  "aliases": [
+    "CVE-2024-5809"
+  ],
+  "details": "The WP Ajax Contact Form WordPress plugin through 2.2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against admin users",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5809"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/0af9fbcf-5f0e-4f7f-ae60-b46e704cf0a5"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T06:15:03Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/07/GHSA-wq5w-42wp-4qfx/GHSA-wq5w-42wp-4qfx.json b/advisories/unreviewed/2024/07/GHSA-wq5w-42wp-4qfx/GHSA-wq5w-42wp-4qfx.json
new file mode 100644
index 00000000000..fa029bf9e1f
--- /dev/null
+++ b/advisories/unreviewed/2024/07/GHSA-wq5w-42wp-4qfx/GHSA-wq5w-42wp-4qfx.json
@@ -0,0 +1,54 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-wq5w-42wp-4qfx",
+  "modified": "2024-07-30T06:30:35Z",
+  "published": "2024-07-30T06:30:35Z",
+  "aliases": [
+    "CVE-2024-7217"
+  ],
+  "details": "A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884. It has been declared as critical. This vulnerability affects the function loginauth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument password leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272788. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7217"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/CA300-PoE/loginauth_password.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.272788"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.272788"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.378333"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-120"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T05:15:09Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/07/GHSA-xg5j-69w2-9h88/GHSA-xg5j-69w2-9h88.json b/advisories/unreviewed/2024/07/GHSA-xg5j-69w2-9h88/GHSA-xg5j-69w2-9h88.json
new file mode 100644
index 00000000000..735c4102c7a
--- /dev/null
+++ b/advisories/unreviewed/2024/07/GHSA-xg5j-69w2-9h88/GHSA-xg5j-69w2-9h88.json
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-xg5j-69w2-9h88",
+  "modified": "2024-07-30T06:30:37Z",
+  "published": "2024-07-30T06:30:37Z",
+  "aliases": [
+    "CVE-2024-6230"
+  ],
+  "details": "The پلاگین پرداخت دلخواه WordPress plugin through 2.9.8 does not have CSRF check in place when resetting its form fields, which could allow attackers to make a logged in admin perform such action via a CSRF attack",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6230"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/311e3c15-0f58-4f3b-91f8-0c62c0eea55e"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T06:15:03Z"
+  }
+}
\ No newline at end of file