CVE-2024-8617
published 2025-05-15CVE-2024-8617: The Quiz Maker WordPress plugin before 6.5.9.9 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to…
PriorityP418medium4.8CVSS 3.1
AVNACLPRHUIRSCCLILAN
EPSS
0.27%
17.9th percentile
The Quiz Maker WordPress plugin before 6.5.9.9 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ays-pro | quiz_maker | < 6.5.9.9 | 6.5.9.9 |
CVSS provenance
nvdv3.14.8MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-9mpf-r669-m5wq: The Quiz Maker WordPress plugin before 6
ghsa_unreviewed·2025-05-15
CVE-2024-8617 [MEDIUM] CWE-79 GHSA-9mpf-r669-m5wq: The Quiz Maker WordPress plugin before 6
The Quiz Maker WordPress plugin before 6.5.9.9 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Red Hat
kernel: sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
vendor_redhat·2024-10-21·CVSS 5.5
CVE-2024-49944 [MEDIUM] kernel: sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
kernel: sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
In the Linux kernel, the following vulnerability has been resolved:
sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
In sctp_listen_start() invoked by sctp_inet_listen(), it should set the
sk_state back to CLOSED if sctp_autobind() fails due to whatever reason.
Otherwise, next time when calling sctp_inet_listen(), if sctp_sk(sk)->reuse
is already set via setsockopt(SCTP_REUSE_PORT), sctp_sk(sk)->bind_hash will
be dereferenced as sk_state is LISTENING, which causes a crash as bind_hash
is NULL.
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: 0010:sctp_inet_listen+0x7f0/0xa20 net/sctp/socket.c:8617
Call Trace:
__sys_listen_socket net/socket.c:1883 [inline]
__
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-05-15
Published