Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2023-1504
A vulnerability classified as critical was found in SourceCodester Alphaware Simple E-Commerce System 1.0. This vulnerability affects unknown code. The manipulation of the argument email/password with the input test1%40test.com ' AND (SELECT 6077 FROM (SELECT(SLEEP(5)))dltn) AND 'PhRa'='PhRa leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223408.
Affected Products: Alphaware Simple E-Commerce System
References: [{'url': 'https://vuldb.com/?id.223408', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.223408', 'tags': ['signature', 'permissions-required']}]
CVE State: PUBLISHED
Explain CVE-2023-1505
A vulnerability, which was classified as critical, has been found in SourceCodester E-Commerce System 1.0. This issue affects some unknown processing of the file /ecommerce/admin/settings/setDiscount.php. The manipulation of the argument id with the input 201737 AND (SELECT 8973 FROM (SELECT(SLEEP(5)))OoAD) leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-223409 was assigned to this vulnerability.
Affected Products: E-Commerce System
References: [{'url': 'https://vuldb.com/?id.223409', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.223409', 'tags': ['signature', 'permissions-required']}]
CVE State: PUBLISHED
Explain CVE-2023-1506
A vulnerability, which was classified as critical, was found in SourceCodester E-Commerce System 1.0. Affected is an unknown function of the file login.php. The manipulation of the argument U_USERNAME leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-223410 is the identifier assigned to this vulnerability.
Affected Products: E-Commerce System
References: [{'url': 'https://vuldb.com/?id.223410', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.223410', 'tags': ['signature', 'permissions-required']}]
CVE State: PUBLISHED
Explain CVE-2023-1507
A vulnerability has been found in SourceCodester E-Commerce System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /ecommerce/admin/category/controller.php of the component Category Name Handler. The manipulation of the argument CATEGORY leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223411.
Affected Products: E-Commerce System
References: [{'url': 'https://vuldb.com/?id.223411', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.223411', 'tags': ['signature', 'permissions-required']}]
CVE State: PUBLISHED
Explain CVE-2023-1508
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Adam Retail Automation Systems Mobilmen Terminal Software allows SQL Injection.This issue affects Mobilmen Terminal Software: before 3.


Affected Products: Mobilmen Terminal Software
References: [{'tags': ['government-resource'], 'url': 'https://www.usom.gov.tr/bildirim/tr-23-0284'}]
CVE State: PUBLISHED
Explain CVE-2023-1509
The GMAce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.2. This is due to missing nonce validation on the gmace_manager_server function called via the wp_ajax_gmace_manager AJAX action. This makes it possible for unauthenticated attackers to modify arbitrary files and achieve remote code execution via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Products: GMAce
References: [{'url': 'https://www.wordfence.com/threat-intel/vulnerabilities/id/826b3913-9a37-4e15-80fd-b35cefb51af8?source=cve'}, {'url': 'https://plugins.trac.wordpress.org/browser/gmace/trunk/gmace.php?rev=1583327#L84'}, {'url': 'https://plugins.trac.wordpress.org/browser/gmace/trunk/inc/filemanager.php?rev=1583319#L27'}]
CVE State: PUBLISHED
Explain CVE-2023-1513
A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak.
Affected Products: Linux kernel (KVM)
References: [{'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2179892'}, {'url': 'https://lore.kernel.org/kvm/20230214103304.3689213-1-gregkh%40linuxfoundation.org/'}, {'url': 'https://github.com/torvalds/linux/commit/2c10b61421a28e95a46ab489fd56c0f442ff6952'}, {'name': '[debian-lts-announce] 20230502 [SECURITY] [DLA 3404-1] linux-5.10 security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html'}, {'name': '[debian-lts-announce] 20230503 [SECURITY] [DLA 3403-1] linux security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html'}]
CVE State: PUBLISHED
Explain CVE-2023-1515
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19.
Affected Products: pimcore/pimcore
References: [{'url': 'https://huntr.dev/bounties/ae0f2ec4-a245-4d0b-9d4d-bd8310dd6282'}, {'url': 'https://github.com/pimcore/pimcore/commit/44c6b37aa649a0e3105fa41f3d74a3e511acf964'}]
CVE State: PUBLISHED
Explain CVE-2023-1516
RoboDK versions 5.5.3 and prior contain an insecure permission 
assignment to critical directories vulnerability, which could allow a 
local user to escalate privileges and write files to the RoboDK process 
and achieve code execution.  


Affected Products: RoboDK 
References: [{'url': 'https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-01'}, {'url': 'https://robodk.com/contact'}]
CVE State: PUBLISHED
Explain CVE-2023-1517
Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.19.
Affected Products: pimcore/pimcore
References: [{'url': 'https://huntr.dev/bounties/82adf0dd-8ebd-4d15-9f91-6060c8fa5a0d'}, {'url': 'https://github.com/pimcore/pimcore/commit/3a22700dacd8a439cffcb208838a4199e732cff7'}]
CVE State: PUBLISHED
Explain CVE-2023-1518
CP Plus KVMS Pro versions 2.01.0.T.190521 and prior are vulnerable to 
sensitive credentials being leaked because they are insufficiently 
protected.   


Affected Products: KVMS Pro
References: [{'url': 'https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-02'}]
CVE State: PUBLISHED
Explain CVE-2023-1524
The Download Manager WordPress plugin before 3.2.71 does not adequately validate passwords for password-protected files. Upon validation, a master key is generated and exposed to the user, which may be used to download any password-protected file on the server, allowing a user to download any file with the knowledge of any one file's password.
Affected Products: Download Manager
References: [{'url': 'https://wpscan.com/vulnerability/3802d15d-9bfd-4762-ab8a-04475451868e', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-1525
The Site Reviews WordPress plugin before 6.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Affected Products: Site Reviews
References: [{'url': 'https://wpscan.com/vulnerability/4ae6bf90-b100-4bb5-bdd7-8acdbd950596', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-1526
Certain DesignJet and PageWide XL TAA compliant models may have risk of potential information disclosure if the hard disk drive is physically removed from the printer.
Affected Products: HP DesignJet and PageWide XL
References: [{'url': 'https://support.hp.com/us-en/document/ish_7869666-7869691-16/hpsbpi03837'}]
CVE State: PUBLISHED
Explain CVE-2023-1527
Cross-site Scripting (XSS) - Generic in GitHub repository tsolucio/corebos prior to 8.0.
Affected Products: tsolucio/corebos
References: [{'url': 'https://huntr.dev/bounties/f0272a31-9944-4545-8428-a26154d20348'}, {'url': 'https://github.com/tsolucio/corebos/commit/aaaca69185bce2be6a82956c69541938dc871268'}]
CVE State: PUBLISHED
Explain CVE-2023-1528
Use after free in Passwords in Google Chrome prior to 111.0.5563.110 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Affected Products: Chrome
References: [{'url': 'https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop_21.html'}, {'url': 'https://crbug.com/1421773'}, {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FG3CRADL7IL5IHK4NCHG4LAYLKHFXETX/'}, {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HO3QZY4UQFP4XNF43ILMVVOABMB7KAQ5/'}, {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NGWWGQULJ7QRNP4GY57HE7OO7VMRWMPN/'}]
CVE State: PUBLISHED
Explain CVE-2023-1529
Out of bounds memory access in WebHID in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a malicious HID device. (Chromium security severity: High)
Affected Products: Chrome
References: [{'url': 'https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop_21.html'}, {'url': 'https://crbug.com/1419718'}, {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FG3CRADL7IL5IHK4NCHG4LAYLKHFXETX/'}, {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HO3QZY4UQFP4XNF43ILMVVOABMB7KAQ5/'}, {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NGWWGQULJ7QRNP4GY57HE7OO7VMRWMPN/'}]
CVE State: PUBLISHED
Explain CVE-2023-1530
Use after free in PDF in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Affected Products: Chrome
References: [{'url': 'https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop_21.html'}, {'url': 'https://crbug.com/1419831'}, {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FG3CRADL7IL5IHK4NCHG4LAYLKHFXETX/'}, {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HO3QZY4UQFP4XNF43ILMVVOABMB7KAQ5/'}, {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NGWWGQULJ7QRNP4GY57HE7OO7VMRWMPN/'}]
CVE State: PUBLISHED
Explain CVE-2023-1531
Use after free in ANGLE in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Affected Products: Chrome
References: [{'url': 'https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop_21.html'}, {'url': 'https://crbug.com/1415330'}, {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FG3CRADL7IL5IHK4NCHG4LAYLKHFXETX/'}, {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HO3QZY4UQFP4XNF43ILMVVOABMB7KAQ5/'}, {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NGWWGQULJ7QRNP4GY57HE7OO7VMRWMPN/'}, {'url': 'https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1724'}]
CVE State: PUBLISHED
Explain CVE-2023-1532
Out of bounds read in GPU Video in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Affected Products: Chrome
References: [{'url': 'https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop_21.html'}, {'url': 'https://crbug.com/1421268'}, {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FG3CRADL7IL5IHK4NCHG4LAYLKHFXETX/'}, {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HO3QZY4UQFP4XNF43ILMVVOABMB7KAQ5/'}, {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NGWWGQULJ7QRNP4GY57HE7OO7VMRWMPN/'}, {'url': 'http://packetstormsecurity.com/files/171959/Chrome-media-mojom-VideoFrame-Missing-Validation.html'}]
CVE State: PUBLISHED
Explain CVE-2023-1533
Use after free in WebProtect in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Affected Products: Chrome
References: [{'url': 'https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop_21.html'}, {'url': 'https://crbug.com/1422183'}, {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FG3CRADL7IL5IHK4NCHG4LAYLKHFXETX/'}, {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HO3QZY4UQFP4XNF43ILMVVOABMB7KAQ5/'}, {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NGWWGQULJ7QRNP4GY57HE7OO7VMRWMPN/'}]
CVE State: PUBLISHED
Explain CVE-2023-1534
Out of bounds read in ANGLE in Google Chrome prior to 111.0.5563.110 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Affected Products: Chrome
References: [{'url': 'https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop_21.html'}, {'url': 'https://crbug.com/1422594'}, {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FG3CRADL7IL5IHK4NCHG4LAYLKHFXETX/'}, {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HO3QZY4UQFP4XNF43ILMVVOABMB7KAQ5/'}, {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NGWWGQULJ7QRNP4GY57HE7OO7VMRWMPN/'}, {'url': 'http://packetstormsecurity.com/files/171961/Chrome-GL_ShaderBinary-Untrusted-Process-Exposure.html'}, {'url': 'http://packetstormsecurity.com/files/171965/Chrome-SpvGetMappedSamplerName-Out-Of-Bounds-String-Copy.html'}]
CVE State: PUBLISHED
Explain CVE-2023-1535
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.7.
Affected Products: answerdev/answer
References: [{'url': 'https://github.com/answerdev/answer/commit/c3743bad4f2a69f69f8f1e1e5b4b6524fc03da25'}, {'url': 'https://huntr.dev/bounties/4d4b0caa-6d8c-4574-ae7e-e9ef5e2e1a40'}]
CVE State: PUBLISHED
Explain CVE-2023-1536
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.7.
Affected Products: answerdev/answer
References: [{'url': 'https://huntr.dev/bounties/538207f4-f805-419a-a314-51716643f05e'}, {'url': 'https://github.com/answerdev/answer/commit/c3743bad4f2a69f69f8f1e1e5b4b6524fc03da25'}]
CVE State: PUBLISHED
Explain CVE-2023-1537
Authentication Bypass by Capture-replay in GitHub repository answerdev/answer prior to 1.0.6.
Affected Products: answerdev/answer
References: [{'url': 'https://github.com/answerdev/answer/commit/813ad0b9894673b1bdd489a2e9ab60a44fe990af'}, {'url': 'https://huntr.dev/bounties/171cde18-a447-446c-a9ab-297953ad9b86'}]
CVE State: PUBLISHED
Explain CVE-2023-1538
Observable Timing Discrepancy in GitHub repository answerdev/answer prior to 1.0.6.
Affected Products: answerdev/answer
References: [{'url': 'https://github.com/answerdev/answer/commit/813ad0b9894673b1bdd489a2e9ab60a44fe990af'}, {'url': 'https://huntr.dev/bounties/ac0271eb-660f-4966-8b57-4bc660a9a1a0'}]
CVE State: PUBLISHED
Explain CVE-2023-1539
Improper Restriction of Excessive Authentication Attempts in GitHub repository answerdev/answer prior to 1.0.6.
Affected Products: answerdev/answer
References: [{'url': 'https://huntr.dev/bounties/b4df67f4-14ea-4051-97d4-26690c979a28'}, {'url': 'https://github.com/answerdev/answer/commit/813ad0b9894673b1bdd489a2e9ab60a44fe990af'}]
CVE State: PUBLISHED
Explain CVE-2023-1540
Observable Response Discrepancy in GitHub repository answerdev/answer prior to 1.0.6.
Affected Products: answerdev/answer
References: [{'url': 'https://huntr.dev/bounties/d8d6c259-a0f2-4209-a3b0-ecbf3eb092f4'}, {'url': 'https://github.com/answerdev/answer/commit/1de3ec27e50ba7389c9449c59e8ea3a37a908ee4'}]
CVE State: PUBLISHED
Explain CVE-2023-1541
Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6.
Affected Products: answerdev/answer
References: [{'url': 'https://huntr.dev/bounties/8fd891c6-b04e-4dac-818f-9ea30861cd92'}, {'url': 'https://github.com/answerdev/answer/commit/15390adbfcd5fd37af4661f992f8873ae5a6b840'}]
CVE State: PUBLISHED
Explain CVE-2023-1542
Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6.
Affected Products: answerdev/answer
References: [{'url': 'https://huntr.dev/bounties/d947417c-5a12-407a-9a2f-fa696f65126f'}, {'url': 'https://github.com/answerdev/answer/commit/4ca2429d190a6e614f5bbee1173c80a7cffcc568'}]
CVE State: PUBLISHED
Explain CVE-2023-1543
Insufficient Session Expiration in GitHub repository answerdev/answer prior to 1.0.6.
Affected Products: answerdev/answer
References: [{'url': 'https://huntr.dev/bounties/f82388d6-dfc3-4fbc-bea6-eb40cf5b2683'}, {'url': 'https://github.com/answerdev/answer/commit/cd742b75605c99776f32d271c0a60e0f468e181c'}]
CVE State: PUBLISHED
Explain CVE-2023-1544
A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to allocate and initialize a huge number of page tables to be used as a ring of descriptors for CQ and async events, potentially leading to an out-of-bounds read and crash of QEMU.
Affected Products: QEMU
References: [{'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2180364'}, {'url': 'https://lists.nongnu.org/archive/html/qemu-devel/2023-03/msg00206.html'}, {'url': 'https://security.netapp.com/advisory/ntap-20230511-0005/'}]
CVE State: PUBLISHED
Explain CVE-2023-1545
SQL Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.0.23.
Affected Products: nilsteampassnet/teampass
References: [{'url': 'https://huntr.dev/bounties/942c015f-7486-49b1-94ae-b1538d812bc2'}, {'url': 'https://github.com/nilsteampassnet/teampass/commit/4780252fdb600ef2ec2758f17a37d738570cbe66'}]
CVE State: PUBLISHED
Explain CVE-2023-1546
The MyCryptoCheckout WordPress plugin before 2.124 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting
Affected Products: MyCryptoCheckout
References: [{'url': 'https://wpscan.com/vulnerability/bb065397-370f-4ee1-a2c8-20e4dc4415a0', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-1547
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Elra Parkmatik allows SQL Injection through SOAP Parameter Tampering, Command Line Execution through SQL Injection.This issue affects Parkmatik: before 02.01-a51.


Affected Products: Parkmatik
References: [{'tags': ['government-resource'], 'url': 'https://www.usom.gov.tr/bildirim/tr-23-0404'}]
CVE State: PUBLISHED
Explain CVE-2023-1548

A CWE-269: Improper Privilege Management vulnerability exists that could cause a local user to
perform a denial of service through the console server service that is part of EcoStruxure Control Expert. Affected Products: EcoStruxure Control Expert (V15.1 and above)
Affected Products: EcoStruxure Control Expert
References: [{'url': 'https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-101-03.pdf'}]
CVE State: PUBLISHED
Explain CVE-2023-1549
The Ad Inserter WordPress plugin before 2.7.27 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present
Affected Products: Ad Inserter
References: [{'url': 'https://wpscan.com/vulnerability/c94b3a68-673b-44d7-9251-f3590cc5ee9e', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-1550
Insertion of Sensitive Information into log file vulnerability in NGINX Agent. NGINX Agent version 2.0 before 2.23.3 inserts sensitive information into a log file. An authenticated attacker with local access to read agent log files may gain access to private keys. This issue is only exposed when the non-default trace level logging is enabled. Note: NGINX Agent is included with NGINX Instance Manager and used in conjunction with NGINX API Connectivity Manager, and NGINX Management Suite Security Monitoring.
Affected Products: NGINX Agent
References: [{'url': 'https://my.f5.com/manage/s/article/K000133135'}, {'url': 'https://security.netapp.com/advisory/ntap-20230511-0008/'}]
CVE State: PUBLISHED
Explain CVE-2023-1552
ToolboxST prior to version 7.10 is affected by a deserialization vulnerability. An attacker with local access to an HMI or who has conducted a social engineering attack on an authorized operator could execute code in a Toolbox user's context through the deserialization of an untrusted configuration file. Two CVSS scores have been provided to capture the differences between the two aforementioned attack vectors. 

Customers are advised to update to ToolboxST 7.10 which can be found in ControlST 7.10. If unable to update at this time customers should ensure they are following the guidance laid out in GE Gas Power's Secure Deployment Guide (GEH-6839). Customers should ensure they are not running ToolboxST as an Administrative user. 
Affected Products: ToolboxST
References: [{'url': 'https://www.ge.com/content/dam/cyber_security/global/en_US/pdfs/2023-03-23_ToolboxST_Deserialization_of_Untrusted_Configuration_Data.pdf'}]
CVE State: PUBLISHED
Explain CVE-2023-1554
The Quick Paypal Payments WordPress plugin before 5.7.26.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Affected Products: Quick Paypal Payments
References: [{'url': 'https://wpscan.com/vulnerability/0d247a3d-154e-4da7-a147-c1c7e1b5e87e', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-1556
A vulnerability was found in SourceCodester Judging Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file summary_results.php. The manipulation of the argument main_event_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-223549 was assigned to this vulnerability.
Affected Products: Judging Management System
References: [{'url': 'https://vuldb.com/?id.223549', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.223549', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/debug601/bug_report/blob/main/vendors/oretnom23/judging-management-system/SQLi-1.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1557
A vulnerability was found in SourceCodester E-Commerce System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /ecommerce/admin/user/controller.php?action=edit of the component Username Handler. The manipulation of the argument USERID leads to improper access controls. The attack may be launched remotely. VDB-223550 is the identifier assigned to this vulnerability.
Affected Products: E-Commerce System
References: [{'url': 'https://vuldb.com/?id.223550', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.223550', 'tags': ['signature', 'permissions-required']}]
CVE State: PUBLISHED
Explain CVE-2023-1558
A vulnerability classified as critical has been found in Simple and Beautiful Shopping Cart System 1.0. This affects an unknown part of the file uploadera.php. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223551.
Affected Products: Simple and Beautiful Shopping Cart System
References: [{'url': 'https://vuldb.com/?id.223551', 'tags': ['vdb-entry']}, {'url': 'https://vuldb.com/?ctiid.223551', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/nightcloudos/bug_report/blob/main/simple%20and%20beautiful%20shopping%20cart%20system/simple%20and%20beautiful%20shopping%20cart%20system%20uploadera.php%20has%20a%20file%20upload%20vulnerability.pdf', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1559
A vulnerability classified as problematic was found in SourceCodester Storage Unit Rental Management System 1.0. This vulnerability affects unknown code of the file classes/Users.php?f=save. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223552.
Affected Products: Storage Unit Rental Management System
References: [{'url': 'https://vuldb.com/?id.223552', 'tags': ['vdb-entry']}, {'url': 'https://vuldb.com/?ctiid.223552', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/ret2hh/bug_report/blob/main/UPLOAD.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1560
A vulnerability, which was classified as problematic, has been found in TinyTIFF 3.0.0.0. This issue affects some unknown processing of the file tinytiffreader.c of the component File Handler. The manipulation leads to buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The identifier VDB-223553 was assigned to this vulnerability.
Affected Products: TinyTIFF
References: [{'url': 'https://vuldb.com/?id.223553', 'tags': ['vdb-entry']}, {'url': 'https://vuldb.com/?ctiid.223553', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/10cksYiqiyinHangzhouTechnology/Security-Issue-Report-of-TinyTIFF', 'tags': ['related']}, {'url': 'https://github.com/10cksYiqiyinHangzhouTechnology/Security-Issue-Report-of-TinyTIFF/blob/main/id8', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1561
A vulnerability, which was classified as critical, was found in code-projects Simple Online Hotel Reservation System 1.0. Affected is an unknown function of the file add_room.php. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. VDB-223554 is the identifier assigned to this vulnerability.
Affected Products: Simple Online Hotel Reservation System
References: [{'url': 'https://vuldb.com/?id.223554', 'tags': ['vdb-entry']}, {'url': 'https://vuldb.com/?ctiid.223554', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/sincere9/Bug-Hub/blob/main/SIMPLE%20ONLINE%20HOTEL%20RESERVATION%20SYSTEM/SIMPLE%20ONLINE%20HOTEL%20RESERVATION%20SYSTEM%20has%20a%20file%20upload%20(RCE)%20vulnerability.pdf', 'tags': ['related']}]
CVE State: PUBLISHED
Explain CVE-2023-1563
A vulnerability has been found in SourceCodester Student Study Center Desk Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/assign/assign.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223555.
Affected Products: Student Study Center Desk Management System
References: [{'url': 'https://vuldb.com/?id.223555', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.223555', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/E1CHO/cve_hub/blob/main/Student%20Study%20Center%20Desk%20Management%20System/Student%20Study%20Center%20Desk%20Management%20System%20-%20vlun3.pdf', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1564
A vulnerability was found in SourceCodester Air Cargo Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file admin/transactions/update_status.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223556.
Affected Products: Air Cargo Management System
References: [{'url': 'https://vuldb.com/?id.223556', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.223556', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/333123www/bug_report/blob/main/SQLi-1.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1565
A vulnerability was found in FeiFeiCMS 2.7.130201. It has been classified as problematic. This affects an unknown part of the file \Public\system\slide_add.html of the component Extension Tool. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-223557 was assigned to this vulnerability.
Affected Products: FeiFeiCMS
References: [{'url': 'https://vuldb.com/?id.223557', 'tags': ['vdb-entry']}, {'url': 'https://vuldb.com/?ctiid.223557', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/1114506941/lsummer/blob/main/README.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1566
A vulnerability was found in SourceCodester Medical Certificate Generator App 1.0. It has been declared as critical. This vulnerability affects unknown code of the file action.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-223558 is the identifier assigned to this vulnerability.
Affected Products: Medical Certificate Generator App
References: [{'url': 'https://vuldb.com/?id.223558', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.223558', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/E1CHO/cve_hub/blob/main/Medical%20Certificate%20Generator%20App/Medical%20Certificate%20Generator%20App%20-%20vlun(2).pdf', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1567
A vulnerability was found in SourceCodester Student Study Center Desk Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /admin/assign/assign.php. The manipulation of the argument sid leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223559.
Affected Products: Student Study Center Desk Management System
References: [{'url': 'https://vuldb.com/?id.223559', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.223559', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/E1CHO/cve_hub/blob/main/Student%20Study%20Center%20Desk%20Management%20System/Student%20Study%20Center%20Desk%20Management%20System%20-%20vlun1.pdf', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1568
A vulnerability classified as problematic has been found in SourceCodester Student Study Center Desk Management System 1.0. Affected is an unknown function of the file /admin/reports/index.php of the component GET Parameter Handler. The manipulation of the argument date_to leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223560.
Affected Products: Student Study Center Desk Management System
References: [{'url': 'https://vuldb.com/?id.223560', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.223560', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/E1CHO/cve_hub/blob/main/Student%20Study%20Center%20Desk%20Management%20System/Student%20Study%20Center%20Desk%20Management%20System%20-%20vlun2.pdf', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1569
A vulnerability classified as problematic was found in SourceCodester E-Commerce System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/user/controller.php?action=edit. The manipulation of the argument U_NAME with the input <script>alert('1')</script> leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-223561 was assigned to this vulnerability.
Affected Products: E-Commerce System
References: [{'url': 'https://vuldb.com/?id.223561', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.223561', 'tags': ['signature', 'permissions-required']}]
CVE State: PUBLISHED
Explain CVE-2023-1570
A vulnerability, which was classified as problematic, has been found in syoyo tinydng. Affected by this issue is the function __interceptor_memcpy of the file tiny_dng_loader.h. The manipulation leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. It is recommended to apply a patch to fix this issue. VDB-223562 is the identifier assigned to this vulnerability.
Affected Products: tinydng
References: [{'url': 'https://vuldb.com/?id.223562', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.223562', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/syoyo/tinydng/issues/28', 'tags': ['issue-tracking']}, {'url': 'https://github.com/syoyo/tinydng/issues/29', 'tags': ['issue-tracking']}, {'url': 'https://github.com/10cksYiqiyinHangzhouTechnology/tinydngSecurityIssueReport1', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1571
A vulnerability, which was classified as critical, was found in DataGear up to 4.5.0. This affects an unknown part of the file /analysisProject/pagingQueryData. The manipulation of the argument queryOrder leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.5.1 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-223563.
Affected Products: DataGear
References: [{'url': 'https://vuldb.com/?id.223563', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.223563', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/yangyanglo/ForCVE/blob/main/2023-0x01.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1572
A vulnerability has been found in DataGear up to 1.11.1 and classified as problematic. This vulnerability affects unknown code of the component Plugin Handler. The manipulation leads to cross site scripting. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. Upgrading to version 1.12.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-223564.
Affected Products: DataGear
References: [{'url': 'https://vuldb.com/?id.223564', 'tags': ['vdb-entry']}, {'url': 'https://vuldb.com/?ctiid.223564', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/yangyanglo/ForCVE/edit/main/2023-0x03.md', 'tags': ['related']}, {'url': 'https://github.com/yangyanglo/ForCVE/blob/main/2023-0x03.md', 'tags': ['exploit']}, {'url': 'https://github.com/datageartech/datagear/releases/tag/v1.12.0', 'tags': ['patch']}]
CVE State: PUBLISHED
Explain CVE-2023-1573
A vulnerability was found in DataGear up to 1.11.1 and classified as problematic. This issue affects some unknown processing of the component Graph Dataset Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.12.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-223565 was assigned to this vulnerability.
Affected Products: DataGear
References: [{'url': 'https://vuldb.com/?id.223565', 'tags': ['vdb-entry']}, {'url': 'https://vuldb.com/?ctiid.223565', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/yangyanglo/ForCVE/blob/main/2023-0x04.md', 'tags': ['exploit']}, {'url': 'https://github.com/datageartech/datagear/releases/tag/v1.12.0', 'tags': ['patch']}]
CVE State: PUBLISHED
Explain CVE-2023-1574
Information disclosure in the user creation feature of a MSSQL data source in Devolutions Remote Desktop Manager 2023.1.9 and below on Windows allows an attacker with access to the user interface to obtain sensitive information via the error message dialog that displays the password in clear text.












Affected Products: Remote Desktop Manager
References: [{'url': 'https://devolutions.net/security/advisories/DEVO-2023-0006'}]
CVE State: PUBLISHED
Explain CVE-2023-1575
The Mega Main Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings parameters in versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Affected Products: Mega Main Menu
References: [{'url': 'https://www.wordfence.com/threat-intel/vulnerabilities/id/a44ce6a3-0a9d-4bce-9251-f3a38b000645?source=cve'}, {'url': 'https://codecanyon.net/item/mega-main-menu-wordpress-menu-plugin/6135125'}]
CVE State: PUBLISHED
Explain CVE-2023-1578
SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.19.
Affected Products: pimcore/pimcore
References: [{'url': 'https://huntr.dev/bounties/7e441a14-8e55-4ab4-932c-4dc56bb1bc2e'}, {'url': 'https://github.com/pimcore/pimcore/commit/367b74488808d71ec3f66f4ca9e8df5217c2c8d2'}]
CVE State: PUBLISHED
Explain CVE-2023-1579
Heap based buffer overflow in binutils-gdb/bfd/libbfd.c in bfd_getl64.
Affected Products: binutils
References: [{'url': 'https://sourceware.org/bugzilla/show_bug.cgi?id=29988'}, {'url': 'https://security.netapp.com/advisory/ntap-20230511-0009/'}, {'url': 'https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=11d171f1910b508a81d21faa087ad1af573407d8'}]
CVE State: PUBLISHED
Explain CVE-2023-1580
Uncontrolled resource consumption in the logging feature in Devolutions Gateway 2023.1.1 and earlier allows an attacker to cause a denial of service by filling up the disk and render the system unusable.



Affected Products: Gateway
References: [{'url': 'https://devolutions.net/security/advisories/DEVO-2023-0007'}]
CVE State: PUBLISHED
Explain CVE-2023-1582
A race problem was found in fs/proc/task_mmu.c in the memory management sub-component in the Linux kernel. This issue may allow a local attacker with user privilege to cause a denial of service.
Affected Products: Linux
References: [{'url': 'https://lore.kernel.org/linux-mm/Yg6ac8WlwtnDH6M0%40kroah.com/'}]
CVE State: PUBLISHED
Explain CVE-2023-1583
A NULL pointer dereference was found in io_file_bitmap_get in io_uring/filetable.c in the io_uring sub-component in the Linux Kernel. When fixed files are unregistered, some context information (file_alloc_{start,end} and alloc_hint) is not cleared. A subsequent request that has auto index selection enabled via IORING_FILE_INDEX_ALLOC can cause a NULL pointer dereference. An unprivileged user can use the flaw to cause a system crash.
Affected Products: Linux kernel
References: [{'url': 'https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux-block.git/commit/?h=io_uring-6.3&id=761efd55a0227aca3a69deacdaa112fffd44fe37'}, {'url': 'https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=02a4d923e4400a36d340ea12d8058f69ebf3a383'}]
CVE State: PUBLISHED
Explain CVE-2023-1585
Avast and AVG Antivirus for Windows were susceptible to a Time-of-check/Time-of-use (TOCTOU)  vulnerability in the Quarantine process, leading to arbitrary file/directory deletion. The issue was fixed with Avast and AVG Antivirus version 22.11 and virus definitions from 14 February 2023 or later.  
Affected Products: Avast Antivirus
References: [{'url': 'https://support.norton.com/sp/static/external/tools/security-advisories.html'}]
CVE State: PUBLISHED
Explain CVE-2023-1586
Avast and AVG Antivirus for Windows were susceptible to a Time-of-check/Time-of-use (TOCTOU)  vulnerability in the restore process leading to arbitrary file creation. The issue was fixed with Avast and AVG Antivirus version 22.11
Affected Products: Avast Antivirus
References: [{'url': 'https://support.norton.com/sp/static/external/tools/security-advisories.html'}]
CVE State: PUBLISHED
Explain CVE-2023-1587
Avast and AVG Antivirus for Windows were susceptible to a NULL pointer dereference issue via RPC-interface. The issue was fixed with Avast and AVG Antivirus version 22.11
Affected Products: Avast Antivirus
References: [{'url': 'https://support.norton.com/sp/static/external/tools/security-advisories.html'}]
CVE State: PUBLISHED
Explain CVE-2023-1589
A vulnerability has been found in SourceCodester Online Tours & Travels Management System 1.0 and classified as critical. This vulnerability affects the function exec of the file admin/operations/approve_delete.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-223654 is the identifier assigned to this vulnerability.
Affected Products: Online Tours & Travels Management System
References: [{'url': 'https://vuldb.com/?id.223654', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.223654', 'tags': ['signature', 'permissions-required']}, {'url': 'https://blog.csdn.net/weixin_43864034/article/details/129729911', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1590
A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0 and classified as critical. This issue affects the function exec of the file admin/operations/currency.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223655.
Affected Products: Online Tours & Travels Management System
References: [{'url': 'https://vuldb.com/?id.223655', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.223655', 'tags': ['signature', 'permissions-required']}, {'url': 'https://blog.csdn.net/weixin_43864034/article/details/129730106', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1591
A vulnerability classified as critical has been found in SourceCodester Automatic Question Paper Generator System 1.0. This affects an unknown part of the file classes/Users.php?f=save_ruser. The manipulation of the argument id/email leads to sql injection. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-223659.
Affected Products: Automatic Question Paper Generator System
References: [{'url': 'https://vuldb.com/?id.223659', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.223659', 'tags': ['signature', 'permissions-required']}]
CVE State: PUBLISHED
Explain CVE-2023-1592
A vulnerability classified as critical was found in SourceCodester Automatic Question Paper Generator System 1.0. This vulnerability affects unknown code of the file admin/courses/view_class.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The identifier of this vulnerability is VDB-223660.
Affected Products: Automatic Question Paper Generator System
References: [{'url': 'https://vuldb.com/?id.223660', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.223660', 'tags': ['signature', 'permissions-required']}]
CVE State: PUBLISHED
Explain CVE-2023-1593
A vulnerability, which was classified as problematic, has been found in SourceCodester Automatic Question Paper Generator System 1.0. This issue affects some unknown processing of the file classes/Master.php?f=save_class. The manipulation of the argument description leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-223661 was assigned to this vulnerability.
Affected Products: Automatic Question Paper Generator System
References: [{'url': 'https://vuldb.com/?id.223661', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.223661', 'tags': ['signature', 'permissions-required']}]
CVE State: PUBLISHED
Explain CVE-2023-1594
A vulnerability, which was classified as critical, was found in novel-plus 3.6.2. Affected is the function MenuService of the file sys/menu/list. The manipulation of the argument sort leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-223662 is the identifier assigned to this vulnerability.
Affected Products: novel-plus
References: [{'url': 'https://vuldb.com/?id.223662', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.223662', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/OYyunshen/Poc/blob/main/Novel-PlusV3.6.2Sqli.pdf', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1595
A vulnerability has been found in novel-plus 3.6.2 and classified as critical. Affected by this vulnerability is an unknown functionality of the file common/log/list. The manipulation of the argument sort leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223663.
Affected Products: novel-plus
References: [{'url': 'https://vuldb.com/?id.223663', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.223663', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/1610349395/novel-plus-v3.6.2----Background-SQL-Injection-Vulnerability-/blob/main/novel-plus%20v3.6.2%20--%20Background%20SQL%20Injection%20Vulnerability.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1596
The tagDiv Composer WordPress plugin before 4.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Affected Products: tagDiv Composer
References: [{'url': 'https://wpscan.com/vulnerability/cada9be9-522a-4ce8-847d-c8fff2ddcc07', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-1597
The tagDiv Cloud Library WordPress plugin before 2.7 does not have authorisation and CSRF in an AJAX action accessible to both unauthenticated and authenticated users, allowing unauthenticated users to change arbitrary user metadata, which could lead to privilege escalation by setting themselves as an admin of the blog.
Affected Products: tagDiv Cloud Library
References: [{'url': 'https://wpscan.com/vulnerability/4eafe111-8874-4560-83ff-394abe7a803b', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED