generated content from 2025-01-25

mapping.csv

@@ -265142,3 +265142,5 @@ vulnerability,CVE-2024-13709,vulnerability--7dbf8680-def9-4846-aaf8-049201b51000
 vulnerability,CVE-2025-0411,vulnerability--5f632a57-4d06-49de-9944-9043a25447c8
 vulnerability,CVE-2024-13721,vulnerability--1fb4b944-29e2-47e5-9a9c-4cf55eace87a
 vulnerability,CVE-2025-0682,vulnerability--3dc0b93a-9fa1-42ef-9290-9a4cf7cb3520
+vulnerability,CVE-2024-12600,vulnerability--771b4f1b-17f9-41d7-afbf-f9454be6ccca
+vulnerability,CVE-2024-10552,vulnerability--1e0b3205-9179-480a-9811-09829dd918e7

objects/vulnerability/vulnerability--1e0b3205-9179-480a-9811-09829dd918e7.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--61cdc185-099c-456c-ae8a-889c85403a5c",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--1e0b3205-9179-480a-9811-09829dd918e7",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-25T07:16:07.571969Z",
+            "modified": "2025-01-25T07:16:07.571969Z",
+            "name": "CVE-2024-10552",
+            "description": "The Flexmls® IDX Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘api_key’ and 'api_secret' parameters in all versions up to, and including, 3.14.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 3.14.25.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-10552"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--771b4f1b-17f9-41d7-afbf-f9454be6ccca.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--5dc7581d-b4ae-4d5d-9692-ee255b34c344",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--771b4f1b-17f9-41d7-afbf-f9454be6ccca",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-25T07:16:07.01416Z",
+            "modified": "2025-01-25T07:16:07.01416Z",
+            "name": "CVE-2024-12600",
+            "description": "The Custom Product Tabs Lite for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.0 via deserialization of untrusted input from the 'frs_woo_product_tabs' parameter. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-12600"
+                }
+            ]
+        }
+    ]
+}