Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2023-0495
The HT Slider For Elementor WordPress plugin before 1.4.0 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
Affected Products: HT Slider For Elementor
References: [{'url': 'https://wpscan.com/vulnerability/2e3af480-b1a4-404c-b0fc-2b7b6a6b9c27', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0496
The HT Event WordPress plugin before 1.4.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
Affected Products: HT Event
References: [{'url': 'https://wpscan.com/vulnerability/451b47d5-7bd2-4a82-9c8e-fe6601bcd2ab', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0497
The HT Portfolio WordPress plugin before 1.1.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
Affected Products: HT Portfolio
References: [{'url': 'https://wpscan.com/vulnerability/ae5b7776-9d0d-4db8-81c3-237b16cd9c62', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0498
The WP Education WordPress plugin before 1.2.7 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
Affected Products: WP Education
References: [{'url': 'https://wpscan.com/vulnerability/8fa051ad-5b35-46d8-be95-0ac4e73d5eff', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0499
The QuickSwish WordPress plugin before 1.1.0 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
Affected Products: QuickSwish
References: [{'url': 'https://wpscan.com/vulnerability/9342470a-a0ad-4f0b-b95f-7daa39a6362b', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0500
The WP Film Studio WordPress plugin before 1.3.5 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
Affected Products: WP Film Studio
References: [{'url': 'https://wpscan.com/vulnerability/95a6a11e-da5d-4fac-aff6-a3f7624682b7', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0501
The WP Insurance WordPress plugin before 2.1.4 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
Affected Products: WP Insurance
References: [{'url': 'https://wpscan.com/vulnerability/36fd6c0d-3f0c-4f7d-aa17-5b2d084ab94c', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0502
The WP News WordPress plugin through 1.1.9 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
Affected Products: WP News
References: [{'url': 'https://wpscan.com/vulnerability/c959f4ce-b6ea-4aee-9a98-aa98d2a62138', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0503
The Free WooCommerce Theme 99fy Extension WordPress plugin before 1.2.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
Affected Products: Free WooCommerce Theme 99fy Extension
References: [{'url': 'https://wpscan.com/vulnerability/3cb148fb-1f30-4316-a421-10da51d849f3', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0504
The HT Politic WordPress plugin before 2.3.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
Affected Products: HT Politic
References: [{'url': 'https://wpscan.com/vulnerability/b427841d-a3ad-4e3a-8964-baad90a9aedb', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0505
The Ever Compare WordPress plugin through 1.2.3 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
Affected Products: Ever Compare
References: [{'url': 'https://wpscan.com/vulnerability/dbabff3e-b021-49ed-aaf3-b73a77d4b354', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0507
Grafana is an open-source platform for monitoring and observability. 

Starting with the 8.1 branch, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. 

The stored XSS vulnerability was possible due to map attributions weren't properly sanitized and allowed arbitrary JavaScript to be executed in the context of the currently authorized user of the Grafana instance. 

An attacker needs to have the Editor role in order to change a panel to include a map attribution containing JavaScript. 

This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard. 

Users may upgrade to version 8.5.21, 9.2.13 and 9.3.8 to receive a fix. 


Affected Products: Grafana
References: [{'url': 'https://grafana.com/security/security-advisories/cve-2023-0507/'}, {'url': 'https://security.netapp.com/advisory/ntap-20230413-0001/'}]
CVE State: PUBLISHED
Explain CVE-2023-0508
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. Open redirection was possible via HTTP response splitting in the NPM package API.
Affected Products: GitLab
References: [{'url': 'https://gitlab.com/gitlab-org/gitlab/-/issues/389328'}, {'url': 'https://hackerone.com/reports/1842314'}, {'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0508.json'}]
CVE State: PUBLISHED
Explain CVE-2023-0509
Improper Certificate Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev44.
Affected Products: pyload/pyload
References: [{'url': 'https://huntr.dev/bounties/a370e0c2-a41c-4871-ad91-bc6f31a8e839'}, {'url': 'https://github.com/pyload/pyload/commit/a9098bdf7406e6faf9df3da6ff2d584e90c13bbb'}]
CVE State: PUBLISHED
Explain CVE-2023-0511
Relative Path Traversal vulnerability in ForgeRock Access Management Java Policy Agent allows Authentication Bypass. This issue affects Access Management Java Policy Agent: all versions up to 5.10.1


Affected Products: Access Management Java Policy Agent
References: [{'url': 'https://backstage.forgerock.com/downloads/browse/am/featured/java-agents'}, {'url': 'https://backstage.forgerock.com/knowledge/kb/article/a21576868'}]
CVE State: PUBLISHED
Explain CVE-2023-0512
Divide By Zero in GitHub repository vim/vim prior to 9.0.1247.
Affected Products: vim/vim
References: [{'url': 'https://huntr.dev/bounties/de83736a-1936-4872-830b-f1e9b0ad2a74'}, {'url': 'https://github.com/vim/vim/commit/870219c58c0804bdc55419b2e455c06ac715a835'}, {'url': 'https://support.apple.com/kb/HT213677'}, {'url': 'https://support.apple.com/kb/HT213675'}, {'url': 'https://support.apple.com/kb/HT213670'}, {'name': '20230327 APPLE-SA-2023-03-27-3 macOS Ventura 13.3', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2023/Mar/17'}, {'name': '20230327 APPLE-SA-2023-03-27-4 macOS Monterey 12.6.4', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2023/Mar/18'}, {'name': '20230327 APPLE-SA-2023-03-27-5 macOS Big Sur 11.7.5', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2023/Mar/21'}, {'name': 'FEDORA-2023-030318ca00', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IE44W6WMMREYCW3GJHPSYP7NK2VT5NY6/'}]
CVE State: PUBLISHED
Explain CVE-2023-0513
A vulnerability has been found in isoftforce Dreamer CMS up to 4.0.1 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.1.3 is able to address this issue. It is recommended to upgrade the affected component. VDB-219334 is the identifier assigned to this vulnerability.
Affected Products: Dreamer CMS
References: [{'url': 'https://vuldb.com/?id.219334', 'tags': ['vdb-entry']}, {'url': 'https://vuldb.com/?ctiid.219334', 'tags': ['signature', 'permissions-required']}, {'url': 'https://gitee.com/isoftforce/dreamer_cms/issues/I68UYM', 'tags': ['exploit', 'issue-tracking']}, {'url': 'https://gitee.com/isoftforce/dreamer_cms/tree/Latest_Stable_Release_4.1.3', 'tags': ['patch']}]
CVE State: PUBLISHED
Explain CVE-2023-0514
The Membership Database WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Affected Products: Membership Database
References: [{'url': 'https://wpscan.com/vulnerability/c6cc400a-9bfb-417d-9206-5582a49d0f05', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0515
A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0 and classified as critical. This issue affects some unknown processing of the file admin/forget_password.php of the component Parameter Handler. The manipulation of the argument email leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-219335.
Affected Products: Online Tours & Travels Management System
References: [{'url': 'https://vuldb.com/?id.219335', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.219335', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/linmoren/online-tours-travels-management-system/blob/main/admin_forget_password_email.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-0516
A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been classified as critical. Affected is an unknown function of the file user/forget_password.php of the component Parameter Handler. The manipulation of the argument email leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-219336.
Affected Products: Online Tours & Travels Management System
References: [{'url': 'https://vuldb.com/?id.219336', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.219336', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/linmoren/online-tours-travels-management-system/blob/main/user_forget_password_email.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-0518
An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versions starting from 15.8 before 15.8.1. It was possible to trigger a DoS attack by uploading a malicious Helm chart.
Affected Products: GitLab
References: [{'url': 'https://gitlab.com/gitlab-org/gitlab/-/issues/383082'}, {'url': 'https://hackerone.com/reports/1766973'}, {'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0518.json'}]
CVE State: PUBLISHED
Explain CVE-2023-0519
Cross-site Scripting (XSS) - Stored in GitHub repository modoboa/modoboa prior to 2.0.4.
Affected Products: modoboa/modoboa
References: [{'url': 'https://huntr.dev/bounties/891ad0cb-d12f-4c5e-aac8-d7326caf2129'}, {'url': 'https://github.com/modoboa/modoboa/commit/eef9ab72b5305578a3ad7a7463bd284aa645e98b'}]
CVE State: PUBLISHED
Explain CVE-2023-0520
The RapidExpCart WordPress plugin through 1.0 does not sanitize and escape the url parameter in the rapidexpcart endpoint before storing it and outputting it back in the page, leading to a Stored Cross-Site Scripting vulnerability which could be used against high-privilege users such as admin, furthermore lack of csrf protection means an attacker can trick a logged in admin to perform the attack by submitting a hidden form.
Affected Products: RapidExpCart
References: [{'url': 'https://wpscan.com/vulnerability/be4f7ff9-af79-477b-9f47-e40e25a3558e', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0522
The Enable/Disable Auto Login when Register WordPress plugin through 1.1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Affected Products: Enable/Disable Auto Login when Register
References: [{'url': 'https://wpscan.com/vulnerability/c7984bfb-86a3-4530-90ae-17ab39af1c54', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0523
An issue has been discovered in GitLab affecting all versions starting from 15.6 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. An XSS was possible via a malicious email address for certain instances.
Affected Products: GitLab
References: [{'url': 'https://gitlab.com/gitlab-org/gitlab/-/issues/389487'}, {'url': 'https://hackerone.com/reports/1842867'}, {'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0523.json'}]
CVE State: PUBLISHED
Explain CVE-2023-0524
As part of our Security Development Lifecycle, a potential privilege escalation issue was identified internally. This could allow a malicious actor with sufficient permissions to modify environment variables and abuse an impacted plugin in order to escalate privileges. We have resolved the issue and also made several defense-in-depth fixes alongside. While the probability of successful exploitation is low, Tenable is committed to securing our customers’ environments and our products. The updates have been distributed via the Tenable plugin feed in feed serial numbers equal to or greater than #202212212055.
Affected Products: Tenable.io, Tenable.sc, Nessus
References: [{'url': 'https://www.tenable.com/security/tns-2023-04'}]
CVE State: PUBLISHED
Explain CVE-2023-0525
Weak Encoding for Password vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.49.000 and prior, GT25 model versions 01.49.000 and prior, GT23 model versions 01.49.000 and prior, GT21 model versions 01.49.000 and prior, GOT SIMPLE Series GS25 model versions 01.49.000 and prior, GS21 model versions 01.49.000 and prior, GT Designer3 Version1 (GOT2000) versions 1.295H and prior and GT SoftGOT2000 versions 1.295H and prior allows a remote unauthenticated attacker to obtain plaintext passwords by sniffing packets containing encrypted passwords and decrypting the encrypted passwords, in the case of transferring data with GT Designer3 Version1(GOT2000) and GOT2000 Series or GOT SIMPLE Series with the Data Transfer Security function enabled, or in the case of transferring data by the SoftGOT-GOT link function with GT SoftGOT2000 and GOT2000 series with the Data Transfer Security function enabled.
Affected Products: GOT2000 Series GT27 model
References: [{'url': 'https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-008_en.pdf'}, {'url': 'https://jvn.jp/vu/JVNVU95285923/index.html'}, {'url': 'https://www.cisa.gov/news-events/ics-advisories/icsa-23-215-02'}]
CVE State: PUBLISHED
Explain CVE-2023-0526
The Post Shortcode WordPress plugin through 2.0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Affected Products: Post Shortcode
References: [{'url': 'https://wpscan.com/vulnerability/0ec58310-243d-40c8-9fa6-8753947bfa89', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0527
A vulnerability was found in PHPGurukul Online Security Guards Hiring System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file search-request.php. The manipulation of the argument searchdata with the input "><script>alert(document.domain)</script> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-219596.
Affected Products: Online Security Guards Hiring System
References: [{'url': 'https://vuldb.com/?id.219596', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.219596', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/ctflearner/Vulnerability/blob/main/Online-Security-guard-POC.md', 'tags': ['exploit']}, {'url': 'http://packetstormsecurity.com/files/172667/Online-Security-Guards-Hiring-System-1.0-Cross-Site-Scripting.html'}]
CVE State: PUBLISHED
Explain CVE-2023-0528
A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been classified as critical. This affects an unknown part of the file admin/abc.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219597 was assigned to this vulnerability.
Affected Products: Online Tours & Travels Management System
References: [{'url': 'https://vuldb.com/?id.219597', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.219597', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/linmoren/online-tours-travels-management-system/blob/main/admin_abc_id.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-0529
A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file admin/add_payment.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-219598 is the identifier assigned to this vulnerability.
Affected Products: Online Tours & Travels Management System
References: [{'url': 'https://vuldb.com/?id.219598', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.219598', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/linmoren/online-tours-travels-management-system/blob/main/_admin_add_payment_id.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-0530
A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file admin/approve_user.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-219599.
Affected Products: Online Tours & Travels Management System
References: [{'url': 'https://vuldb.com/?id.219599', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.219599', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/linmoren/online-tours-travels-management-system/blob/main/admin_approve_user_id.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-0531
A vulnerability classified as critical has been found in SourceCodester Online Tours & Travels Management System 1.0. Affected is an unknown function of the file admin/booking_report.php. The manipulation of the argument to_date leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-219600.
Affected Products: Online Tours & Travels Management System
References: [{'url': 'https://vuldb.com/?id.219600', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.219600', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/linmoren/online-tours-travels-management-system/blob/main/tototo_date.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-0532
A vulnerability classified as critical was found in SourceCodester Online Tours & Travels Management System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/disapprove_user.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219601 was assigned to this vulnerability.
Affected Products: Online Tours & Travels Management System
References: [{'url': 'https://vuldb.com/?id.219601', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.219601', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/linmoren/online-tours-travels-management-system/blob/main/admin_disapprove_user_id.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-0533
A vulnerability, which was classified as critical, has been found in SourceCodester Online Tours & Travels Management System 1.0. Affected by this issue is some unknown functionality of the file admin/expense_report.php. The manipulation of the argument from_date leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-219602 is the identifier assigned to this vulnerability.
Affected Products: Online Tours & Travels Management System
References: [{'url': 'https://vuldb.com/?id.219602', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.219602', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/linmoren/online-tours-travels-management-system/blob/main/admin_expense_report_from_date.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-0534
A vulnerability, which was classified as critical, was found in SourceCodester Online Tours & Travels Management System 1.0. This affects an unknown part of the file admin/expense_report.php. The manipulation of the argument to_date leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-219603.
Affected Products: Online Tours & Travels Management System
References: [{'url': 'https://vuldb.com/?id.219603', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.219603', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/linmoren/online-tours-travels-management-system/blob/main/admin_expense_report_to_date.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-0535
The Donation Block For PayPal WordPress plugin before 2.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected Products: Donation Block For PayPal
References: [{'url': 'https://wpscan.com/vulnerability/8c50321a-dba8-4379-9b9c-4c349e44b2ed', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0536
The Wp-D3 WordPress plugin through 2.4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected Products: Wp-D3
References: [{'url': 'https://wpscan.com/vulnerability/7b19d792-8083-4c0c-a45e-a99c1f5f0df0', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0537
The Product Slider For WooCommerce Lite WordPress plugin through 1.1.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Affected Products: Product Slider For WooCommerce Lite
References: [{'url': 'https://wpscan.com/vulnerability/d7369f1d-d1a0-4576-a676-c70525a6c743', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0538
The Campaign URL Builder WordPress plugin before 1.8.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Affected Products: Campaign URL Builder
References: [{'url': 'https://wpscan.com/vulnerability/4869fdc7-4fc7-4917-bc00-b6ced9ccc871', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0539
The GS Insever Portfolio WordPress plugin before 1.4.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected Products: GS Insever Portfolio
References: [{'url': 'https://wpscan.com/vulnerability/a4b6a83a-6394-4dfc-8bb3-4982867dab7d', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0540
The GS Filterable Portfolio WordPress plugin before 1.6.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected Products: GS Filterable Portfolio
References: [{'url': 'https://wpscan.com/vulnerability/b35b3da2-468d-4fe5-bff6-812432197a38', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0541
The GS Books Showcase WordPress plugin before 1.3.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected Products: GS Books Showcase
References: [{'url': 'https://wpscan.com/vulnerability/8453e587-cc8c-491a-af09-fc4ab215134b', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0542
The Custom Post Type List Shortcode WordPress plugin through 1.4.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected Products: Custom Post Type List Shortcode
References: [{'url': 'https://wpscan.com/vulnerability/17de2f77-3e6c-4c22-9196-6e5577ee7fcf', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0543
The Arigato Autoresponder and Newsletter WordPress plugin before 2.1.7.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Affected Products: Arigato Autoresponder and Newsletter
References: [{'url': 'https://wpscan.com/vulnerability/e3771938-40b5-4e8b-bb5a-847131a2b4a7', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0544
The WP Login Box WordPress plugin through 2.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Affected Products: WP Login Box
References: [{'url': 'https://wpscan.com/vulnerability/8ef9585f-67d7-4651-977a-fcad113882bd', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0545
The Hostel WordPress plugin before 1.1.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Affected Products: Hostel
References: [{'url': 'https://wpscan.com/vulnerability/b604afc8-61d0-4e98-8950-f3d29f9e9ee1', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0546
The Contact Form Plugin WordPress plugin before 4.3.25 does not properly sanitize and escape the srcdoc attribute in iframes in it's custom HTML field type, allowing a logged in user with roles as low as contributor to inject arbitrary javascript into a form which will trigger for any visitor to the form or admins previewing or editing the form.
Affected Products: Contact Form Plugin
References: [{'url': 'https://wpscan.com/vulnerability/078f33cd-0f5c-46fe-b858-2107a09c6b69', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0547
OCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be accepted. Thunderbird versions from 68 to 102.9.1 were affected by this bug. This vulnerability affects Thunderbird < 102.10.
Affected Products: Thunderbird
References: [{'url': 'https://www.mozilla.org/security/advisories/mfsa2023-15/'}, {'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1811298'}]
CVE State: PUBLISHED
Explain CVE-2023-0548
The Namaste! LMS WordPress plugin before 2.5.9.4 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Affected Products: Namaste! LMS
References: [{'url': 'https://wpscan.com/vulnerability/b6c1ed7a-5b2d-4985-847d-56586b1aae9b', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0549
A vulnerability, which was classified as problematic, has been found in YAFNET up to 3.1.10. This issue affects some unknown processing of the file /forum/PostPrivateMessage of the component Private Message Handler. The manipulation of the argument subject/message leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.11 is able to address this issue. The name of the patch is 2237a9d552e258a43570bb478a92a5505e7c8797. It is recommended to upgrade the affected component. The identifier VDB-219665 was assigned to this vulnerability.
Affected Products: YAFNET
References: [{'url': 'https://vuldb.com/?id.219665', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.219665', 'tags': ['signature', 'permissions-required']}, {'url': 'https://drive.google.com/drive/folders/1ct6Tp_cnsYO8L_JSvlBCf_Ae7KW3JAcD?usp=sharing', 'tags': ['exploit']}, {'url': 'https://github.com/YAFNET/YAFNET/security/advisories/GHSA-4hwx-678w-9cp5', 'tags': ['related']}, {'url': 'https://github.com/YAFNET/YAFNET/commit/2237a9d552e258a43570bb478a92a5505e7c8797', 'tags': ['patch']}, {'url': 'https://github.com/YAFNET/YAFNET/releases/tag/v3.1.11', 'tags': ['patch']}]
CVE State: PUBLISHED
Explain CVE-2023-0550
The Quick Restaurant Menu plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. This is due to the fact that during menu item deletion/modification, the plugin does not verify that the post ID provided to the AJAX action is indeed a menu item. This makes it possible for authenticated attackers, with subscriber-level access or higher, to modify or delete arbitrary posts.
Affected Products: Quick Restaurant Menu
References: [{'url': 'https://www.wordfence.com/threat-intel/vulnerabilities/id/faa4fba5-cd19-4b96-aa09-07ed6d52a107'}, {'url': 'https://plugins.trac.wordpress.org/browser/quick-restaurant-menu/tags/2.0.2/includes/admin/ajax-functions.php'}, {'url': 'https://plugins.trac.wordpress.org/changeset/2851871/quick-restaurant-menu/trunk?contextall=1&old=2788636&old_path=%2Fquick-restaurant-menu%2Ftrunk'}]
CVE State: PUBLISHED
Explain CVE-2023-0552
The Registration Forms WordPress plugin before 3.8.2.3 does not properly validate the redirection URL when logging in and login out, leading to an Open Redirect vulnerability
Affected Products: Registration Forms
References: [{'url': 'https://wpscan.com/vulnerability/832c6155-a413-4641-849c-b98ba55e8551', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0553
The Quick Restaurant Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Products: Quick Restaurant Menu
References: [{'url': 'https://www.wordfence.com/threat-intel/vulnerabilities/id/cfd8a6a4-9159-480f-abe2-71972585217b'}, {'url': 'https://plugins.trac.wordpress.org/browser/quick-restaurant-menu/tags/2.0.2/includes/admin/settings/settings.php'}, {'url': 'https://plugins.trac.wordpress.org/changeset/2851871/quick-restaurant-menu/trunk?contextall=1&old=2788636&old_path=%2Fquick-restaurant-menu%2Ftrunk'}]
CVE State: PUBLISHED
Explain CVE-2023-0554
The Quick Restaurant Menu plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on its AJAX actions. This makes it possible for unauthenticated attackers to update menu items, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Products: Quick Restaurant Menu
References: [{'url': 'https://www.wordfence.com/threat-intel/vulnerabilities/id/bfc7c214-8d76-453c-a05d-682aa425b06e'}, {'url': 'https://plugins.trac.wordpress.org/browser/quick-restaurant-menu/tags/2.0.2/includes/admin/ajax-functions.php'}, {'url': 'https://plugins.trac.wordpress.org/changeset/2851871/quick-restaurant-menu/trunk?contextall=1&old=2788636&old_path=%2Fquick-restaurant-menu%2Ftrunk'}]
CVE State: PUBLISHED
Explain CVE-2023-0555
The Quick Restaurant Menu plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions up to, and including, 2.0.2. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke those actions intended for administrator use. Actions include menu item creation, update and deletion and other menu management functions. Since the plugin does not verify that a post ID passed to one of its AJAX actions belongs to a menu item, this can lead to arbitrary post deletion/alteration.
Affected Products: Quick Restaurant Menu
References: [{'url': 'https://www.wordfence.com/threat-intel/vulnerabilities/id/97984c7d-d6ff-480c-acfe-20ab0eb04141'}, {'url': 'https://plugins.trac.wordpress.org/browser/quick-restaurant-menu/tags/2.0.2/includes/admin/ajax-functions.php'}, {'url': 'https://plugins.trac.wordpress.org/changeset/2851871/quick-restaurant-menu/trunk?contextall=1&old=2788636&old_path=%2Fquick-restaurant-menu%2Ftrunk'}]
CVE State: PUBLISHED
Explain CVE-2023-0556
The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions in versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to obtain the blog metadata (via the function cstu_get_metadata) that includes the plugin's contentstudio_token. Knowing this token allows for other interactions with the plugin such as creating posts in versions prior to 1.2.5, which added other requirements to posting and updating.
Affected Products: ContentStudio
References: [{'url': 'https://www.wordfence.com/threat-intel/vulnerabilities/id/52db8d41-859a-4d68-8b83-3d3af8f1bf64'}, {'url': 'https://plugins.trac.wordpress.org/browser/contentstudio/tags/1.2.1/contentstudio-plugin.php#L517'}, {'url': 'https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2851006%40contentstudio%2Ftrunk&old=2844028%40contentstudio%2Ftrunk&sfp_email=&sfph_mail='}]
CVE State: PUBLISHED
Explain CVE-2023-0557
The ContentStudio plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.5. This could allow unauthenticated attackers to obtain a nonce needed for the creation of posts.
Affected Products: ContentStudio
References: [{'url': 'https://www.wordfence.com/threat-intel/vulnerabilities/id/62eb136f-3cb0-40dc-a154-015a7fa1077b'}, {'url': 'https://plugins.trac.wordpress.org/browser/contentstudio/trunk/contentstudio-plugin.php#L709'}, {'url': 'https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2851006%40contentstudio%2Ftrunk&old=2844028%40contentstudio%2Ftrunk&sfp_email=&sfph_mail='}]
CVE State: PUBLISHED
Explain CVE-2023-0558
The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to an unsecure token check that is susceptible to type juggling in versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to execute functions intended for use by users with proper API keys.
Affected Products: ContentStudio
References: [{'url': 'https://www.wordfence.com/threat-intel/vulnerabilities/id/c31828dc-ef94-4895-8395-a5d52a0a82bd'}, {'url': 'https://plugins.trac.wordpress.org/browser/contentstudio/trunk/contentstudio-plugin.php#L416'}, {'url': 'https://ti.wordfence.io/vulnerabilities/52db8d41-859a-4d68-8b83-3d3af8f1bf64'}]
CVE State: PUBLISHED
Explain CVE-2023-0559
The GS Portfolio for Envato WordPress plugin before 1.4.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Affected Products: GS Portfolio for Envato
References: [{'url': 'https://wpscan.com/vulnerability/e5549261-66e2-4a5e-8781-bc555b629ccc', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0560
A vulnerability, which was classified as critical, has been found in SourceCodester Online Tours & Travels Management System 1.0. This issue affects some unknown processing of the file admin/practice_pdf.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219701 was assigned to this vulnerability.
Affected Products: Online Tours & Travels Management System
References: [{'url': 'https://vuldb.com/?id.219701', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.219701', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/linmoren/online-tours-travels-management-system/blob/main/admin_practice_pdf_id.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-0561
A vulnerability, which was classified as critical, was found in SourceCodester Online Tours & Travels Management System 1.0. Affected is an unknown function of the file /user/s.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-219702 is the identifier assigned to this vulnerability.
Affected Products: Online Tours & Travels Management System
References: [{'url': 'https://vuldb.com/?id.219702', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.219702', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/linmoren/online-tours-travels-management-system/blob/main/_user_s_id.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-0562
A vulnerability was found in PHPGurukul Bank Locker Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file index.php of the component Login. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-219716.
Affected Products: Bank Locker Management System
References: [{'url': 'https://vuldb.com/?id.219716', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.219716', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/ctflearner/Vulnerability/blob/main/Bank_Locker_Management_System/Bank%20Locker%20Management%20System-SQL%20.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-0563
A vulnerability classified as problematic has been found in PHPGurukul Bank Locker Management System 1.0. This affects an unknown part of the file add-locker-form.php of the component Assign Locker. The manipulation of the argument ahname leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219717 was assigned to this vulnerability.
Affected Products: Bank Locker Management System
References: [{'url': 'https://vuldb.com/?id.219717', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.219717', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/ctflearner/Vulnerability/blob/main/Bank_Locker_Management_System/BLMS_XSS_IN_ADMIN_BROWSER.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-0564
Weak Password Requirements in GitHub repository froxlor/froxlor prior to 2.0.10.
Affected Products: froxlor/froxlor
References: [{'url': 'https://huntr.dev/bounties/a4f86d6f-0d5d-428d-a4b3-551b20a21ce6'}, {'url': 'https://github.com/froxlor/froxlor/commit/2a84e9c1207fd3d792b7fb198fd0c66fe1a66a7a'}]
CVE State: PUBLISHED
Explain CVE-2023-0565
Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.10.
Affected Products: froxlor/froxlor
References: [{'url': 'https://huntr.dev/bounties/12d78294-1723-4450-a239-023952666102'}, {'url': 'https://github.com/froxlor/froxlor/commit/2feb8020941a82bfb4ac68890f6ced0e5b3c4a15'}]
CVE State: PUBLISHED
Explain CVE-2023-0566
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in froxlor/froxlor prior to 2.0.10.
Affected Products: froxlor/froxlor
References: [{'url': 'https://huntr.dev/bounties/8339e4f1-d430-4845-81b5-36dd9fcdac49'}, {'url': 'https://github.com/froxlor/froxlor/commit/bd5b99dc1c06f594b9563d459a50bf3b32504876'}]
CVE State: PUBLISHED
Explain CVE-2023-0567
In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid. 


Affected Products: PHP
References: [{'url': 'https://bugs.php.net/bug.php?id=81744'}, {'url': 'https://github.com/php/php-src/security/advisories/GHSA-7fj2-8x79-rjf4'}]
CVE State: PUBLISHED
Explain CVE-2023-0568
In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting, this may lead to the byte after the allocated buffer being overwritten with NUL value, which might lead to unauthorized data access or modification. 
Affected Products: PHP
References: [{'url': 'https://bugs.php.net/bug.php?id=81746'}, {'url': 'https://security.netapp.com/advisory/ntap-20230517-0001/'}]
CVE State: PUBLISHED
Explain CVE-2023-0569
Weak Password Requirements in GitHub repository publify/publify prior to 9.2.10.
Affected Products: publify/publify
References: [{'url': 'https://huntr.dev/bounties/81b1e1da-10dd-435e-94ae-4bdd41df6df9'}, {'url': 'https://github.com/publify/publify/commit/8905e4e639cf03b758da558568a86c9816253b2d'}]
CVE State: PUBLISHED
Explain CVE-2023-0570
A vulnerability, which was classified as critical, was found in SourceCodester Online Tours & Travels Management System 1.0. This affects an unknown part of the file user\operations\payment_operation.php. The manipulation of the argument booking_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219729 was assigned to this vulnerability.
Affected Products: Online Tours & Travels Management System
References: [{'url': 'https://vuldb.com/?id.219729', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.219729', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/linmoren/online-tours-travels-management-system/blob/main/user_operations_payment_operation_booking_id.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-0571
A vulnerability has been found in SourceCodester Canteen Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file createcustomer.php of the component Add Customer. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-219730 is the identifier assigned to this vulnerability.
Affected Products: Canteen Management System
References: [{'url': 'https://vuldb.com/?id.219730', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.219730', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/ctflearner/Vulnerability/blob/main/Canteen%20Management%20System/Canteen_Management_System_XSS_IN_Add_Customer.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-0572
Unchecked Error Condition in GitHub repository froxlor/froxlor prior to 2.0.10.
Affected Products: froxlor/froxlor
References: [{'url': 'https://huntr.dev/bounties/4ab24ee2-3ff6-4248-9555-0af3e5f754ec'}, {'url': 'https://github.com/froxlor/froxlor/commit/7b08a71c59430d06c1efb012a6c6448262aacdb1'}]
CVE State: PUBLISHED
Explain CVE-2023-0574
Server-Side Request Forgery (SSRF), Improperly Controlled Modification of Dynamically-Determined Object Attributes, Improper Restriction of Excessive Authentication Attempts vulnerability in YugaByte, Inc. Yugabyte Managed allows Accessing Functionality Not Properly Constrained by ACLs, Communication Channel Manipulation, Authentication Abuse.This issue affects Yugabyte Managed: from 2.0 through 2.13.


Affected Products: Yugabyte Managed
References: [{'url': 'https://www.yugabyte.com/'}]
CVE State: PUBLISHED
Explain CVE-2023-0575
External Control of Critical State Data, Improper Control of Generation of Code ('Code Injection') vulnerability in YugaByte, Inc. Yugabyte DB on Windows, Linux, MacOS, iOS (DevopsBase.Java:execCommand, TableManager.Java:runCommand modules) allows API Manipulation, Privilege Abuse. This vulnerability is associated with program files backup.Py.

This issue affects Yugabyte DB: Lesser then 2.2.


Affected Products: Yugabyte DB
References: [{'url': 'https://www.yugabyte.com/'}]
CVE State: PUBLISHED