generated content from 2025-01-24

mapping.csv

@@ -264937,3 +264937,33 @@ vulnerability,CVE-2024-55192,vulnerability--e0f9c58c-fe0d-4da1-a718-37379a3854e8
 vulnerability,CVE-2023-46401,vulnerability--67fd1a31-bc90-4841-861d-c8848bdb2ccd
 vulnerability,CVE-2023-46400,vulnerability--7ad3058b-98a0-4c1e-9eb5-461be69f402b
 vulnerability,CVE-2021-42718,vulnerability--b18f05f9-0e84-4abc-9adb-b06fec1a41f7
+vulnerability,CVE-2024-12494,vulnerability--f339b22e-a310-4243-919a-37aa65b9db75
+vulnerability,CVE-2024-13409,vulnerability--12ce560d-c2e1-44d3-8dd1-949a6c44da8d
+vulnerability,CVE-2024-13335,vulnerability--87fe25e6-5510-453c-8af7-ddec4b257bea
+vulnerability,CVE-2024-13354,vulnerability--468d031b-4e71-4cad-8445-80ed6db42526
+vulnerability,CVE-2024-13683,vulnerability--3d4bf35f-adac-4ef8-a415-1837cc970e88
+vulnerability,CVE-2024-13583,vulnerability--4ed6d900-271c-4742-b024-4d3e6cc8009c
+vulnerability,CVE-2024-13542,vulnerability--2d6e9714-6775-4dcd-bdf8-1fb4e1428114
+vulnerability,CVE-2024-13545,vulnerability--555e794d-98a6-4d09-8dca-666f4c818bb8
+vulnerability,CVE-2024-13408,vulnerability--7172dc6a-7126-4403-b2d8-4ef0b03eb379
+vulnerability,CVE-2024-13680,vulnerability--83db971b-b80b-4d97-b3c7-9be9bf3e9986
+vulnerability,CVE-2024-13594,vulnerability--2d6e5aae-48fc-4129-95cc-f2c966dbe0a6
+vulnerability,CVE-2024-13659,vulnerability--132ebff9-4a09-4aed-80ca-a467ff362856
+vulnerability,CVE-2024-13572,vulnerability--10f3c388-4add-4dc4-9f70-d5c83c6da778
+vulnerability,CVE-2024-11931,vulnerability--e3577e46-69d1-420d-9d9f-57c7e0611a18
+vulnerability,CVE-2025-22714,vulnerability--8125dae8-872d-4869-a1d4-c41376f8be20
+vulnerability,CVE-2025-23734,vulnerability--62358aea-ac81-4161-97be-38994633557d
+vulnerability,CVE-2025-23422,vulnerability--5af9aad7-40de-4550-91d1-7b8908783ed8
+vulnerability,CVE-2025-23621,vulnerability--1c509581-d5f5-4025-9f80-7874acb72f82
+vulnerability,CVE-2025-23427,vulnerability--a8e1b75e-90c8-46b9-9a51-03a157e89258
+vulnerability,CVE-2025-23837,vulnerability--a2e092bb-c9f1-49cc-9442-6ccdcc88d693
+vulnerability,CVE-2025-23885,vulnerability--761165b6-fc92-4773-b018-0124d04fc9d9
+vulnerability,CVE-2025-23622,vulnerability--7c54e115-2430-4d34-bdd3-1e16cda3f43b
+vulnerability,CVE-2025-23711,vulnerability--f48fd620-e93e-4884-90c6-a1b7bf99d832
+vulnerability,CVE-2025-23888,vulnerability--f8c863d7-3dda-43d0-96c0-f80064b4fc5a
+vulnerability,CVE-2025-23737,vulnerability--c3d2617b-ed9e-4230-a6ca-de6c39fc08e1
+vulnerability,CVE-2025-23889,vulnerability--d0b64cff-f87d-441c-ba4a-79698a9d8b8b
+vulnerability,CVE-2025-23838,vulnerability--d294ebb7-4af0-4ea9-b5a3-50540cfa89b8
+vulnerability,CVE-2025-23522,vulnerability--2300c5d3-a0d4-4227-8311-1f206509f945
+vulnerability,CVE-2025-23839,vulnerability--f1a0339f-6449-4631-b744-073e1820fa3e
+vulnerability,CVE-2025-0314,vulnerability--758f97a0-41b2-4919-bfbf-af3d431e9324

objects/vulnerability/vulnerability--10f3c388-4add-4dc4-9f70-d5c83c6da778.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--248e1577-4102-48f3-92a9-99767ad38730",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--10f3c388-4add-4dc4-9f70-d5c83c6da778",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-24T12:36:34.67857Z",
+            "modified": "2025-01-24T12:36:34.67857Z",
+            "name": "CVE-2024-13572",
+            "description": "The Precious Metals Charts and Widgets for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'nfusion-widget' shortcode in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-13572"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--12ce560d-c2e1-44d3-8dd1-949a6c44da8d.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--3bd8173b-ea37-4a7f-a858-4833559644f8",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--12ce560d-c2e1-44d3-8dd1-949a6c44da8d",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-24T12:36:34.637491Z",
+            "modified": "2025-01-24T12:36:34.637491Z",
+            "name": "CVE-2024-13409",
+            "description": "The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.10 via the 'theme' parameter of the post_type_ajax_handler() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-13409"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--132ebff9-4a09-4aed-80ca-a467ff362856.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--8b81a84e-3e12-4186-b123-d3b30980d2d9",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--132ebff9-4a09-4aed-80ca-a467ff362856",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-24T12:36:34.67551Z",
+            "modified": "2025-01-24T12:36:34.67551Z",
+            "name": "CVE-2024-13659",
+            "description": "The Listamester plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'listamester' shortcode in all versions up to, and including, 2.3.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-13659"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--1c509581-d5f5-4025-9f80-7874acb72f82.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--2e308f6c-4924-417e-b098-1e6e2306e1c5",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--1c509581-d5f5-4025-9f80-7874acb72f82",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-24T12:36:44.509663Z",
+            "modified": "2025-01-24T12:36:44.509663Z",
+            "name": "CVE-2025-23621",
+            "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Causes – Donation Plugin allows Reflected XSS. This issue affects Causes – Donation Plugin: from n/a through 1.0.01.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2025-23621"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--2300c5d3-a0d4-4227-8311-1f206509f945.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--adacd0bd-812d-47a8-b415-5199ca5a343d",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--2300c5d3-a0d4-4227-8311-1f206509f945",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-24T12:36:44.547741Z",
+            "modified": "2025-01-24T12:36:44.547741Z",
+            "name": "CVE-2025-23522",
+            "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in humanmade limited, Joe Hoyle, Tom Wilmott, Matthew Haines-Young HM Portfolio allows Reflected XSS. This issue affects HM Portfolio: from n/a through 1.1.1.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2025-23522"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--2d6e5aae-48fc-4129-95cc-f2c966dbe0a6.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--dd01eddb-d935-4744-be12-36323eb69400",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--2d6e5aae-48fc-4129-95cc-f2c966dbe0a6",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-24T12:36:34.674476Z",
+            "modified": "2025-01-24T12:36:34.674476Z",
+            "name": "CVE-2024-13594",
+            "description": "The Simple Downloads List plugin for WordPress is vulnerable to SQL Injection via the 'category' attribute of the 'neofix_sdl' shortcode in all versions up to, and including, 1.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-13594"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--2d6e9714-6775-4dcd-bdf8-1fb4e1428114.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--ba8ae389-f839-4191-968d-51ea8a5e2bcd",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--2d6e9714-6775-4dcd-bdf8-1fb4e1428114",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-24T12:36:34.657084Z",
+            "modified": "2025-01-24T12:36:34.657084Z",
+            "name": "CVE-2024-13542",
+            "description": "The WP Google Street View (with 360° virtual tour) & Google maps + Local SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpgsv' shortcode in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-13542"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--3d4bf35f-adac-4ef8-a415-1837cc970e88.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--e490dcfa-b59f-476e-a2b2-672f708cee59",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--3d4bf35f-adac-4ef8-a415-1837cc970e88",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-24T12:36:34.647074Z",
+            "modified": "2025-01-24T12:36:34.647074Z",
+            "name": "CVE-2024-13683",
+            "description": "The Automate Hub Free by Sperse.IO plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.0. This is due to missing or incorrect nonce validation on the 'automate_hub' page. This makes it possible for unauthenticated attackers to update an activation status via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-13683"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--468d031b-4e71-4cad-8445-80ed6db42526.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--1c1f944b-808a-44fa-9afb-0f3fbbd019df",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--468d031b-4e71-4cad-8445-80ed6db42526",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-24T12:36:34.645427Z",
+            "modified": "2025-01-24T12:36:34.645427Z",
+            "name": "CVE-2024-13354",
+            "description": "The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML tags in several widgets in all versions up to, and including, 1.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-13354"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--4ed6d900-271c-4742-b024-4d3e6cc8009c.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--ee129445-f068-4bbd-96fc-4a592a5862a4",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--4ed6d900-271c-4742-b024-4d3e6cc8009c",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-24T12:36:34.652162Z",
+            "modified": "2025-01-24T12:36:34.652162Z",
+            "name": "CVE-2024-13583",
+            "description": "The Simple Gallery with Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'c2tw_sgwf' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-13583"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--555e794d-98a6-4d09-8dca-666f4c818bb8.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--cc08a596-05bf-4548-99b4-50693421fe29",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--555e794d-98a6-4d09-8dca-666f4c818bb8",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-24T12:36:34.660821Z",
+            "modified": "2025-01-24T12:36:34.660821Z",
+            "name": "CVE-2024-13545",
+            "description": "The Bootstrap Ultimate theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.9 via the path parameter. This makes it possible for unauthenticated attackers to include PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included. If php://filter is enabled on the server, this issue may directly lead to Remote Code Execution.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-13545"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--5af9aad7-40de-4550-91d1-7b8908783ed8.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--3a073dd4-a816-40f8-a358-5263448fbc4a",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--5af9aad7-40de-4550-91d1-7b8908783ed8",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-24T12:36:44.505037Z",
+            "modified": "2025-01-24T12:36:44.505037Z",
+            "name": "CVE-2025-23422",
+            "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in NotFound Store Locator allows PHP Local File Inclusion. This issue affects Store Locator: from n/a through 3.98.10.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2025-23422"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--62358aea-ac81-4161-97be-38994633557d.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--b428d2fb-3cdf-4a1f-ba04-6d41c7e8e636",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--62358aea-ac81-4161-97be-38994633557d",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-24T12:36:44.502986Z",
+            "modified": "2025-01-24T12:36:44.502986Z",
+            "name": "CVE-2025-23734",
+            "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Gigaom Sphinx allows Reflected XSS. This issue affects Gigaom Sphinx: from n/a through 0.1.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2025-23734"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--7172dc6a-7126-4403-b2d8-4ef0b03eb379.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--f43d3e55-5611-42fe-9449-72394a756341",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--7172dc6a-7126-4403-b2d8-4ef0b03eb379",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-24T12:36:34.664583Z",
+            "modified": "2025-01-24T12:36:34.664583Z",
+            "name": "CVE-2024-13408",
+            "description": "The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.10 via the 'theme' attribute of the `pgcu` shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php files can be uploaded and included.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-13408"
+                }
+            ]
+        }
+    ]
+}