From e1517907c9c0e0bbb5b112461092677ea01f3a18 Mon Sep 17 00:00:00 2001 From: CVE Team Date: Thu, 20 Feb 2025 09:00:33 +0000 Subject: [PATCH] "-Synchronized-Data." --- 2024/13xxx/CVE-2024-13888.json | 81 ++++++++++++++++++++++++++++++-- 2025/0xxx/CVE-2025-0897.json | 86 ++++++++++++++++++++++++++++++++-- 2025/1xxx/CVE-2025-1064.json | 76 ++++++++++++++++++++++++++++-- 3 files changed, 231 insertions(+), 12 deletions(-) diff --git a/2024/13xxx/CVE-2024-13888.json b/2024/13xxx/CVE-2024-13888.json index 9df9a566451..d4f5789b21e 100644 --- a/2024/13xxx/CVE-2024-13888.json +++ b/2024/13xxx/CVE-2024-13888.json @@ -1,17 +1,90 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-13888", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@wordfence.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "The WPMobile.App plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 11.56. This is due to insufficient validation on the redirect URL supplied via the 'redirect' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-601 URL Redirection to Untrusted Site ('Open Redirect')", + "cweId": "CWE-601" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "amauric", + "product": { + "product_data": [ + { + "product_name": "WPMobile.App", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "*", + "version_value": "11.56" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a139f0fc-f3e0-4759-aa8d-ba138e5ccc87?source=cve", + "refsource": "MISC", + "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a139f0fc-f3e0-4759-aa8d-ba138e5ccc87?source=cve" + }, + { + "url": "https://wordpress.org/plugins/wpappninja/#developers", + "refsource": "MISC", + "name": "https://wordpress.org/plugins/wpappninja/#developers" + }, + { + "url": "https://plugins.trac.wordpress.org/changeset/3243366", + "refsource": "MISC", + "name": "https://plugins.trac.wordpress.org/changeset/3243366" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "Krzysztof Zaj\u0105c" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", + "baseScore": 7.2, + "baseSeverity": "HIGH" } ] } diff --git a/2025/0xxx/CVE-2025-0897.json b/2025/0xxx/CVE-2025-0897.json index 311db87c719..28bba73434d 100644 --- a/2025/0xxx/CVE-2025-0897.json +++ b/2025/0xxx/CVE-2025-0897.json @@ -1,17 +1,95 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2025-0897", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@wordfence.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "The Modal Window \u2013 create popup modal window plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'iframeBox' shortcode in all versions up to, and including, 6.1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", + "cweId": "CWE-79" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "wpcalc", + "product": { + "product_data": [ + { + "product_name": "Modal Window \u2013 create popup modal window", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "*", + "version_value": "6.1.5" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/de4dfcc7-fcc0-46e5-8452-98783007368d?source=cve", + "refsource": "MISC", + "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/de4dfcc7-fcc0-46e5-8452-98783007368d?source=cve" + }, + { + "url": "https://plugins.trac.wordpress.org/browser/modal-window/trunk/public/class-shortcodes.php#L70", + "refsource": "MISC", + "name": "https://plugins.trac.wordpress.org/browser/modal-window/trunk/public/class-shortcodes.php#L70" + }, + { + "url": "https://wordpress.org/plugins/modal-window/#developers", + "refsource": "MISC", + "name": "https://wordpress.org/plugins/modal-window/#developers" + }, + { + "url": "https://plugins.trac.wordpress.org/changeset/3243077/", + "refsource": "MISC", + "name": "https://plugins.trac.wordpress.org/changeset/3243077/" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "Bassem Essam" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", + "baseScore": 6.4, + "baseSeverity": "MEDIUM" } ] } diff --git a/2025/1xxx/CVE-2025-1064.json b/2025/1xxx/CVE-2025-1064.json index c0948f9305f..0e989d1e1a2 100644 --- a/2025/1xxx/CVE-2025-1064.json +++ b/2025/1xxx/CVE-2025-1064.json @@ -1,17 +1,85 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2025-1064", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@wordfence.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's xoo_el_action shortcode in all versions up to, and including, 2.8.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", + "cweId": "CWE-79" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "xootix", + "product": { + "product_data": [ + { + "product_name": "Login/Signup Popup ( Inline Form + Woocommerce )", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "*", + "version_value": "2.8.5" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dd62a072-8619-4f51-a52f-2ada7e455cb1?source=cve", + "refsource": "MISC", + "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dd62a072-8619-4f51-a52f-2ada7e455cb1?source=cve" + }, + { + "url": "https://plugins.trac.wordpress.org/changeset/3239293/easy-login-woocommerce", + "refsource": "MISC", + "name": "https://plugins.trac.wordpress.org/changeset/3239293/easy-login-woocommerce" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "wesley" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", + "baseScore": 6.4, + "baseSeverity": "MEDIUM" } ] }