cve,link,title,description,vendor,products,score,severity,epss,cisa,cisa_published,article,ransomware,exploited,exploited_date,poc,trended,trended_no_1,trended_no_1_date,published,trended_score
CVE-2024-3954,https://securityvulnerability.io/vulnerability/CVE-2024-3954,"Ditty – Responsive News Tickers, Sliders, and Lists <= 3.1.38 - Authenticated (Contributor+) PHP Object Injection","The Ditty plugin for WordPress contains a vulnerability that allows for PHP Object Injection due to improper handling of untrusted input during the addition of new content. This issue affects all versions of the plugin up to 3.1.38. Authenticated users with contributor-level access and above can exploit this flaw to inject malicious PHP objects. While there is no known primitive object propagation (POP) chain within the plugin itself, the presence of a POP chain through other installed plugins or themes could potentially enable attackers to perform destructive actions such as deleting arbitrary files, extracting sensitive data, or executing unauthorized code. Users are advised to update to the latest version of the Ditty plugin to mitigate these risks.",Wordpress,"Ditty – Responsive News Tickers, Sliders, And Lists",8.8,HIGH,0.0004299999854993075,false,,false,false,false,,,false,false,,2024-05-14T15:42:00.000Z,0