<?xml version='1.0' encoding='UTF-8'?>
<?xml-stylesheet href="/static/style.xsl" type="text/xsl"?>
<rss xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title>Most recent sightings.</title>
    <link>https://vulnerability.circl.lu</link>
    <description>Contains only the most 10 recent sightings.</description>
    <docs>http://www.rssboard.org/rss-specification</docs>
    <generator>python-feedgen</generator>
    <language>en</language>
    <lastBuildDate>Sun, 31 May 2026 19:27:38 +0000</lastBuildDate>
    <item>
      <title>9416eaf6-8726-46ce-96f4-7eb5446638f4</title>
      <link>https://vulnerability.circl.lu/sighting/9416eaf6-8726-46ce-96f4-7eb5446638f4/export</link>
      <description>{"uuid": "9416eaf6-8726-46ce-96f4-7eb5446638f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-56679", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3leebhzqw722i", "content": "", "creation_timestamp": "2024-12-28T10:15:32.493176Z"}</description>
      <content:encoded>{"uuid": "9416eaf6-8726-46ce-96f4-7eb5446638f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-56679", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3leebhzqw722i", "content": "", "creation_timestamp": "2024-12-28T10:15:32.493176Z"}</content:encoded>
      <guid isPermaLink="false">https://vulnerability.circl.lu/sighting/9416eaf6-8726-46ce-96f4-7eb5446638f4/export</guid>
      <pubDate>Sat, 28 Dec 2024 10:15:32 +0000</pubDate>
    </item>
    <item>
      <title>55df9197-b629-4fb8-bc6a-4841f2a6da7c</title>
      <link>https://vulnerability.circl.lu/sighting/55df9197-b629-4fb8-bc6a-4841f2a6da7c/export</link>
      <description>{"uuid": "55df9197-b629-4fb8-bc6a-4841f2a6da7c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-56675", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/168", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: GHSA-ppp3-73jm-5rm6\n\ud83d\udd17 Aliases: CVE-2024-56675\n\ud83d\udd39 Details: In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors\n\nUprobes always use bpf_prog_run_array_uprobe() under tasks-trace-RCU\nprotection. But it is possible to attach a non-sleepable BPF program to a\nuprobe, and non-sleepable BPF programs are freed via normal RCU (see\n__bpf_prog_put_noref()). This leads to UAF of the bpf_prog because a normal\nRCU grace period does not imply a tasks-trace-RCU grace period.\n\nFix it by explicitly waiting for a tasks-trace-RCU grace period after\nremoving the attachment of a bpf_prog to a perf_event.\n\ud83d\udd22 Severity: CVSS_V3: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\ud83d\uddd3\ufe0f Modified: 2025-01-06T15:30:59Z\n\ud83d\uddd3\ufe0f Published: 2024-12-27T15:31:56Z\n\ud83c\udff7\ufe0f CWE IDs: CWE-416\n\ud83d\udd17 References:\n1. https://nvd.nist.gov/vuln/detail/CVE-2024-5665\n2. https://git.kernel.org/stable/c/9245459a992d22fe0e92e988f49db1fec82c184a\n3. https://git.kernel.org/stable/c/9b53d2c2a38a1effc341d99be3f99faef104d\n4. https://git.kernel.org/stable/c/ef1b808e3bc98612feceedf985c2fbbeb28f956\n5. https://git.kernel.org/stable/c/f9f85df30118f3f411261e6682fc60ebcce23e5", "creation_timestamp": "2025-01-06T15:37:11.000000Z"}</description>
      <content:encoded>{"uuid": "55df9197-b629-4fb8-bc6a-4841f2a6da7c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-56675", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/168", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: GHSA-ppp3-73jm-5rm6\n\ud83d\udd17 Aliases: CVE-2024-56675\n\ud83d\udd39 Details: In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors\n\nUprobes always use bpf_prog_run_array_uprobe() under tasks-trace-RCU\nprotection. But it is possible to attach a non-sleepable BPF program to a\nuprobe, and non-sleepable BPF programs are freed via normal RCU (see\n__bpf_prog_put_noref()). This leads to UAF of the bpf_prog because a normal\nRCU grace period does not imply a tasks-trace-RCU grace period.\n\nFix it by explicitly waiting for a tasks-trace-RCU grace period after\nremoving the attachment of a bpf_prog to a perf_event.\n\ud83d\udd22 Severity: CVSS_V3: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\ud83d\uddd3\ufe0f Modified: 2025-01-06T15:30:59Z\n\ud83d\uddd3\ufe0f Published: 2024-12-27T15:31:56Z\n\ud83c\udff7\ufe0f CWE IDs: CWE-416\n\ud83d\udd17 References:\n1. https://nvd.nist.gov/vuln/detail/CVE-2024-5665\n2. https://git.kernel.org/stable/c/9245459a992d22fe0e92e988f49db1fec82c184a\n3. https://git.kernel.org/stable/c/9b53d2c2a38a1effc341d99be3f99faef104d\n4. https://git.kernel.org/stable/c/ef1b808e3bc98612feceedf985c2fbbeb28f956\n5. https://git.kernel.org/stable/c/f9f85df30118f3f411261e6682fc60ebcce23e5", "creation_timestamp": "2025-01-06T15:37:11.000000Z"}</content:encoded>
      <guid isPermaLink="false">https://vulnerability.circl.lu/sighting/55df9197-b629-4fb8-bc6a-4841f2a6da7c/export</guid>
      <pubDate>Mon, 06 Jan 2025 15:37:11 +0000</pubDate>
    </item>
    <item>
      <title>4e786067-ca44-468a-a030-807fc5d2d504</title>
      <link>https://vulnerability.circl.lu/sighting/4e786067-ca44-468a-a030-807fc5d2d504/export</link>
      <description>{"uuid": "4e786067-ca44-468a-a030-807fc5d2d504", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-56673", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/170", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: GHSA-58c3-gqj2-fvq8\n\ud83d\udd17 Aliases: CVE-2024-56673\n\ud83d\udd39 Details: In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: mm: Do not call pmd dtor on vmemmap page table teardown\n\nThe vmemmap's, which is used for RV64 with SPARSEMEM_VMEMMAP, page\ntables are populated using pmd (page middle directory) hugetables.\nHowever, the pmd allocation is not using the generic mechanism used by\nthe VMA code (e.g. pmd_alloc()), or the RISC-V specific\ncreate_pgd_mapping()/alloc_pmd_late(). Instead, the vmemmap page table\ncode allocates a page, and calls vmemmap_set_pmd(). This results in\nthat the pmd ctor is *not* called, nor would it make sense to do so.\n\nNow, when tearing down a vmemmap page table pmd, the cleanup code\nwould unconditionally, and incorrectly call the pmd dtor, which\nresults in a crash (best case).\n\nThis issue was found when running the HMM selftests:\n\n  | tools/testing/selftests/mm# ./test_hmm.sh smoke\n  | ... # when unloading the test_hmm.ko module\n  | page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10915b\n  | flags: 0x1000000000000000(node=0|zone=1)\n  | raw: 1000000000000000 0000000000000000 dead000000000122 0000000000000000\n  | raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000\n  | page dumped because: VM_BUG_ON_PAGE(ptdesc-&amp;gt;pmd_huge_pte)\n  | ------------[ cut here ]------------\n  | kernel BUG at include/linux/mm.h:3080!\n  | Kernel BUG [#1]\n  | Modules linked in: test_hmm(-) sch_fq_codel fuse drm drm_panel_orientation_quirks backlight dm_mod\n  | CPU: 1 UID: 0 PID: 514 Comm: modprobe Tainted: G        W          6.12.0-00982-gf2a4f1682d07 #2\n  | Tainted: [W]=WARN\n  | Hardware name: riscv-virtio qemu/qemu, BIOS 2024.10 10/01/2024\n  | epc : remove_pgd_mapping+0xbec/0x1070\n  |  ra : remove_pgd_mapping+0xbec/0x1070\n  | epc : ffffffff80010a68 ra : ffffffff80010a68 sp : ff20000000a73940\n  |  gp : ffffffff827b2d88 tp : ff6000008785da40 t0 : ffffffff80fbce04\n  |  t1 : 0720072007200720 t2 : 706d756420656761 s0 : ff20000000a73a50\n  |  s1 : ff6000008915cff8 a0 : 0000000000000039 a1 : 0000000000000008\n  |  a2 : ff600003fff0de20 a3 : 0000000000000000 a4 : 0000000000000000\n  |  a5 : 0000000000000000 a6 : c0000000ffffefff a7 : ffffffff824469b8\n  |  s2 : ff1c0000022456c0 s3 : ff1ffffffdbfffff s4 : ff6000008915c000\n  |  s5 : ff6000008915c000 s6 : ff6000008915c000 s7 : ff1ffffffdc00000\n  |  s8 : 0000000000000001 s9 : ff1ffffffdc00000 s10: ffffffff819a31f0\n  |  s11: ffffffffffffffff t3 : ffffffff8000c950 t4 : ff60000080244f00\n  |  t5 : ff60000080244000 t6 : ff20000000a73708\n  | status: 0000000200000120 badaddr: ffffffff80010a68 cause: 0000000000000003\n  | [] remove_pgd_mapping+0xbec/0x1070\n  | [] vmemmap_free+0x14/0x1e\n  | [] section_deactivate+0x220/0x452\n  | [] sparse_remove_section+0x4a/0x58\n  | [] __remove_pages+0x7e/0xba\n  | [] memunmap_pages+0x2bc/0x3fe\n  | [] dmirror_device_remove_chunks+0x2ea/0x518 [test_hmm]\n  | [] hmm_dmirror_exit+0x3e/0x1018 [test_hmm]\n  | [] __riscv_sys_delete_module+0x15a/0x2a6\n  | [] do_trap_ecall_u+0x1f2/0x266\n  | [] _new_vmalloc_restore_context_a0+0xc6/0xd2\n  | Code: bf51 7597 0184 8593 76a5 854a 4097 0029 80e7 2c00 (9002) 7597\n  | ---[ end trace 0000000000000000 ]---\n  | Kernel panic - not syncing: Fatal exception in interrupt\n\nAdd a check to avoid calling the pmd dtor, if the calling context is\nvmemmap_free().\n\ud83d\udd22 Severity: CVSS_V3: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\ud83d\uddd3\ufe0f Modified: 2025-01-06T15:30:59Z\n\ud83d\uddd3\ufe0f Published: 2024-12-27T15:31:56Z\n\ud83d\udd17 References:\n1. https://nvd.nist.gov/vuln/detail/CVE-2024-5663\n2. https://git.kernel.org/stable/c/21f1b85c8912262adf510e63614a114425eb10\n3. https://git.kernel.org/stable/c/344945806f2faf68be98bac02836c86f223aa9", "creation_timestamp": "2025-01-06T15:37:42.000000Z"}</description>
      <content:encoded>{"uuid": "4e786067-ca44-468a-a030-807fc5d2d504", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-56673", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/170", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: GHSA-58c3-gqj2-fvq8\n\ud83d\udd17 Aliases: CVE-2024-56673\n\ud83d\udd39 Details: In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: mm: Do not call pmd dtor on vmemmap page table teardown\n\nThe vmemmap's, which is used for RV64 with SPARSEMEM_VMEMMAP, page\ntables are populated using pmd (page middle directory) hugetables.\nHowever, the pmd allocation is not using the generic mechanism used by\nthe VMA code (e.g. pmd_alloc()), or the RISC-V specific\ncreate_pgd_mapping()/alloc_pmd_late(). Instead, the vmemmap page table\ncode allocates a page, and calls vmemmap_set_pmd(). This results in\nthat the pmd ctor is *not* called, nor would it make sense to do so.\n\nNow, when tearing down a vmemmap page table pmd, the cleanup code\nwould unconditionally, and incorrectly call the pmd dtor, which\nresults in a crash (best case).\n\nThis issue was found when running the HMM selftests:\n\n  | tools/testing/selftests/mm# ./test_hmm.sh smoke\n  | ... # when unloading the test_hmm.ko module\n  | page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10915b\n  | flags: 0x1000000000000000(node=0|zone=1)\n  | raw: 1000000000000000 0000000000000000 dead000000000122 0000000000000000\n  | raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000\n  | page dumped because: VM_BUG_ON_PAGE(ptdesc-&amp;gt;pmd_huge_pte)\n  | ------------[ cut here ]------------\n  | kernel BUG at include/linux/mm.h:3080!\n  | Kernel BUG [#1]\n  | Modules linked in: test_hmm(-) sch_fq_codel fuse drm drm_panel_orientation_quirks backlight dm_mod\n  | CPU: 1 UID: 0 PID: 514 Comm: modprobe Tainted: G        W          6.12.0-00982-gf2a4f1682d07 #2\n  | Tainted: [W]=WARN\n  | Hardware name: riscv-virtio qemu/qemu, BIOS 2024.10 10/01/2024\n  | epc : remove_pgd_mapping+0xbec/0x1070\n  |  ra : remove_pgd_mapping+0xbec/0x1070\n  | epc : ffffffff80010a68 ra : ffffffff80010a68 sp : ff20000000a73940\n  |  gp : ffffffff827b2d88 tp : ff6000008785da40 t0 : ffffffff80fbce04\n  |  t1 : 0720072007200720 t2 : 706d756420656761 s0 : ff20000000a73a50\n  |  s1 : ff6000008915cff8 a0 : 0000000000000039 a1 : 0000000000000008\n  |  a2 : ff600003fff0de20 a3 : 0000000000000000 a4 : 0000000000000000\n  |  a5 : 0000000000000000 a6 : c0000000ffffefff a7 : ffffffff824469b8\n  |  s2 : ff1c0000022456c0 s3 : ff1ffffffdbfffff s4 : ff6000008915c000\n  |  s5 : ff6000008915c000 s6 : ff6000008915c000 s7 : ff1ffffffdc00000\n  |  s8 : 0000000000000001 s9 : ff1ffffffdc00000 s10: ffffffff819a31f0\n  |  s11: ffffffffffffffff t3 : ffffffff8000c950 t4 : ff60000080244f00\n  |  t5 : ff60000080244000 t6 : ff20000000a73708\n  | status: 0000000200000120 badaddr: ffffffff80010a68 cause: 0000000000000003\n  | [] remove_pgd_mapping+0xbec/0x1070\n  | [] vmemmap_free+0x14/0x1e\n  | [] section_deactivate+0x220/0x452\n  | [] sparse_remove_section+0x4a/0x58\n  | [] __remove_pages+0x7e/0xba\n  | [] memunmap_pages+0x2bc/0x3fe\n  | [] dmirror_device_remove_chunks+0x2ea/0x518 [test_hmm]\n  | [] hmm_dmirror_exit+0x3e/0x1018 [test_hmm]\n  | [] __riscv_sys_delete_module+0x15a/0x2a6\n  | [] do_trap_ecall_u+0x1f2/0x266\n  | [] _new_vmalloc_restore_context_a0+0xc6/0xd2\n  | Code: bf51 7597 0184 8593 76a5 854a 4097 0029 80e7 2c00 (9002) 7597\n  | ---[ end trace 0000000000000000 ]---\n  | Kernel panic - not syncing: Fatal exception in interrupt\n\nAdd a check to avoid calling the pmd dtor, if the calling context is\nvmemmap_free().\n\ud83d\udd22 Severity: CVSS_V3: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\ud83d\uddd3\ufe0f Modified: 2025-01-06T15:30:59Z\n\ud83d\uddd3\ufe0f Published: 2024-12-27T15:31:56Z\n\ud83d\udd17 References:\n1. https://nvd.nist.gov/vuln/detail/CVE-2024-5663\n2. https://git.kernel.org/stable/c/21f1b85c8912262adf510e63614a114425eb10\n3. https://git.kernel.org/stable/c/344945806f2faf68be98bac02836c86f223aa9", "creation_timestamp": "2025-01-06T15:37:42.000000Z"}</content:encoded>
      <guid isPermaLink="false">https://vulnerability.circl.lu/sighting/4e786067-ca44-468a-a030-807fc5d2d504/export</guid>
      <pubDate>Mon, 06 Jan 2025 15:37:42 +0000</pubDate>
    </item>
    <item>
      <title>dff8c977-6ccc-4d4e-b971-38006ce8614a</title>
      <link>https://vulnerability.circl.lu/sighting/dff8c977-6ccc-4d4e-b971-38006ce8614a/export</link>
      <description>{"uuid": "dff8c977-6ccc-4d4e-b971-38006ce8614a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-5667", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/6527", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-5667\n\ud83d\udd25 CVSS Score: 6.4 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)\n\ud83d\udd39 Description: Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Featherlight.js JavaScript library (versions 1.7.13 to 1.7.14) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.\n\ud83d\udccf Published: 2025-03-05T09:21:46.075Z\n\ud83d\udccf Modified: 2025-03-05T09:21:46.075Z\n\ud83d\udd17 References:\n1. https://www.wordfence.com/threat-intel/vulnerabilities/id/44b173da-a6b9-424c-95a1-a87a9b8ee4af?source=cve\n2. https://plugins.trac.wordpress.org/changeset/3137531/responsive-lightbox\n3. https://plugins.trac.wordpress.org/browser/wp-featherlight/trunk/js/wpFeatherlight.pkgd.js", "creation_timestamp": "2025-03-05T09:36:05.000000Z"}</description>
      <content:encoded>{"uuid": "dff8c977-6ccc-4d4e-b971-38006ce8614a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-5667", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/6527", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-5667\n\ud83d\udd25 CVSS Score: 6.4 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)\n\ud83d\udd39 Description: Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Featherlight.js JavaScript library (versions 1.7.13 to 1.7.14) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.\n\ud83d\udccf Published: 2025-03-05T09:21:46.075Z\n\ud83d\udccf Modified: 2025-03-05T09:21:46.075Z\n\ud83d\udd17 References:\n1. https://www.wordfence.com/threat-intel/vulnerabilities/id/44b173da-a6b9-424c-95a1-a87a9b8ee4af?source=cve\n2. https://plugins.trac.wordpress.org/changeset/3137531/responsive-lightbox\n3. https://plugins.trac.wordpress.org/browser/wp-featherlight/trunk/js/wpFeatherlight.pkgd.js", "creation_timestamp": "2025-03-05T09:36:05.000000Z"}</content:encoded>
      <guid isPermaLink="false">https://vulnerability.circl.lu/sighting/dff8c977-6ccc-4d4e-b971-38006ce8614a/export</guid>
      <pubDate>Wed, 05 Mar 2025 09:36:05 +0000</pubDate>
    </item>
    <item>
      <title>6d8e9cf5-6ff4-4b56-bb06-403f386e4c3a</title>
      <link>https://vulnerability.circl.lu/sighting/6d8e9cf5-6ff4-4b56-bb06-403f386e4c3a/export</link>
      <description>{"uuid": "6d8e9cf5-6ff4-4b56-bb06-403f386e4c3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-5667", "type": "seen", "source": "https://t.me/cvedetector/19612", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-5667 - WordPress Featherlight.js Stored Cross-Site Scripting Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-5667 \nPublished : March 5, 2025, 10:15 a.m. | 48\u00a0minutes ago \nDescription : Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Featherlight.js JavaScript library (versions 1.7.13 to 1.7.14) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. \nSeverity: 6.4 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"05 Mar 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-03-05T12:45:53.000000Z"}</description>
      <content:encoded>{"uuid": "6d8e9cf5-6ff4-4b56-bb06-403f386e4c3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-5667", "type": "seen", "source": "https://t.me/cvedetector/19612", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-5667 - WordPress Featherlight.js Stored Cross-Site Scripting Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-5667 \nPublished : March 5, 2025, 10:15 a.m. | 48\u00a0minutes ago \nDescription : Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Featherlight.js JavaScript library (versions 1.7.13 to 1.7.14) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. \nSeverity: 6.4 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"05 Mar 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-03-05T12:45:53.000000Z"}</content:encoded>
      <guid isPermaLink="false">https://vulnerability.circl.lu/sighting/6d8e9cf5-6ff4-4b56-bb06-403f386e4c3a/export</guid>
      <pubDate>Wed, 05 Mar 2025 12:45:53 +0000</pubDate>
    </item>
    <item>
      <title>a14bd028-ebd8-4fb4-922e-5986ef7dd5eb</title>
      <link>https://vulnerability.circl.lu/sighting/a14bd028-ebd8-4fb4-922e-5986ef7dd5eb/export</link>
      <description>{"uuid": "a14bd028-ebd8-4fb4-922e-5986ef7dd5eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-56672", "type": "seen", "source": "https://gist.github.com/webmutation/894dd1a9a17615b7469198bb18bc3a16", "content": "", "creation_timestamp": "2025-04-12T00:10:16.000000Z"}</description>
      <content:encoded>{"uuid": "a14bd028-ebd8-4fb4-922e-5986ef7dd5eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-56672", "type": "seen", "source": "https://gist.github.com/webmutation/894dd1a9a17615b7469198bb18bc3a16", "content": "", "creation_timestamp": "2025-04-12T00:10:16.000000Z"}</content:encoded>
      <guid isPermaLink="false">https://vulnerability.circl.lu/sighting/a14bd028-ebd8-4fb4-922e-5986ef7dd5eb/export</guid>
      <pubDate>Sat, 12 Apr 2025 00:10:16 +0000</pubDate>
    </item>
    <item>
      <title>2e02519f-e9d1-4e77-a355-52a5cfc2dd28</title>
      <link>https://vulnerability.circl.lu/sighting/2e02519f-e9d1-4e77-a355-52a5cfc2dd28/export</link>
      <description>{"uuid": "2e02519f-e9d1-4e77-a355-52a5cfc2dd28", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-56670", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07", "content": "", "creation_timestamp": "2025-08-14T10:00:00.000000Z"}</description>
      <content:encoded>{"uuid": "2e02519f-e9d1-4e77-a355-52a5cfc2dd28", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-56670", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07", "content": "", "creation_timestamp": "2025-08-14T10:00:00.000000Z"}</content:encoded>
      <guid isPermaLink="false">https://vulnerability.circl.lu/sighting/2e02519f-e9d1-4e77-a355-52a5cfc2dd28/export</guid>
      <pubDate>Thu, 14 Aug 2025 10:00:00 +0000</pubDate>
    </item>
    <item>
      <title>75bde21b-55c4-4ca7-be00-0ab43de33fed</title>
      <link>https://vulnerability.circl.lu/sighting/75bde21b-55c4-4ca7-be00-0ab43de33fed/export</link>
      <description>{"uuid": "75bde21b-55c4-4ca7-be00-0ab43de33fed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2024-56677", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/", "content": "", "creation_timestamp": "2026-03-19T00:00:00.000000Z"}</description>
      <content:encoded>{"uuid": "75bde21b-55c4-4ca7-be00-0ab43de33fed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2024-56677", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/", "content": "", "creation_timestamp": "2026-03-19T00:00:00.000000Z"}</content:encoded>
      <guid isPermaLink="false">https://vulnerability.circl.lu/sighting/75bde21b-55c4-4ca7-be00-0ab43de33fed/export</guid>
      <pubDate>Thu, 19 Mar 2026 00:00:00 +0000</pubDate>
    </item>
    <item>
      <title>e7f5dbb2-8dd7-428f-9900-c4189138bf9a</title>
      <link>https://vulnerability.circl.lu/sighting/e7f5dbb2-8dd7-428f-9900-c4189138bf9a/export</link>
      <description>{"uuid": "e7f5dbb2-8dd7-428f-9900-c4189138bf9a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2024-56671", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/", "content": "", "creation_timestamp": "2026-03-19T00:00:00.000000Z"}</description>
      <content:encoded>{"uuid": "e7f5dbb2-8dd7-428f-9900-c4189138bf9a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2024-56671", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/", "content": "", "creation_timestamp": "2026-03-19T00:00:00.000000Z"}</content:encoded>
      <guid isPermaLink="false">https://vulnerability.circl.lu/sighting/e7f5dbb2-8dd7-428f-9900-c4189138bf9a/export</guid>
      <pubDate>Thu, 19 Mar 2026 00:00:00 +0000</pubDate>
    </item>
    <item>
      <title>ecdf3962-a90b-4561-8dbb-901ee8077426</title>
      <link>https://vulnerability.circl.lu/sighting/ecdf3962-a90b-4561-8dbb-901ee8077426/export</link>
      <description>{"uuid": "ecdf3962-a90b-4561-8dbb-901ee8077426", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2024-56674", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/", "content": "", "creation_timestamp": "2026-03-19T00:00:00.000000Z"}</description>
      <content:encoded>{"uuid": "ecdf3962-a90b-4561-8dbb-901ee8077426", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2024-56674", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/", "content": "", "creation_timestamp": "2026-03-19T00:00:00.000000Z"}</content:encoded>
      <guid isPermaLink="false">https://vulnerability.circl.lu/sighting/ecdf3962-a90b-4561-8dbb-901ee8077426/export</guid>
      <pubDate>Thu, 19 Mar 2026 00:00:00 +0000</pubDate>
    </item>
  </channel>
</rss>
