Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-0223 State: PUBLISHED Published: 2023-03-09T00:00:00.000Z Last Updated: 2025-02-28T21:29:52.818Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper access control in GitLab Description: An issue has been discovered in GitLab affecting all versions starting from 15.5 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. Non-project members could retrieve release descriptions via the API, even if the release visibility is restricted to project members only in the project settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vul
icted to project members only in the project settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/387870 - https://hackerone.com/reports/1824226 - https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0223.json
CVE ID: CVE-2023-0224 State: PUBLISHED Published: 2024-01-16T15:54:45.597Z Last Updated: 2025-06-13T16:07:48.744Z Vendors: Unknown Products: GiveWP Problem Types: CWE-89 SQL Injection Description: The GiveWP WordPress plugin before 2.24.1 does not properly escape user input before it reaches SQL queries, which could let unauthenticated attackers perform SQL Injection attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d8da539d-0a1b-46ef-b48d-710c59cf68e1/ - https://givewp.com/core-2-24-0-vulnerability-patched/
CVE ID: CVE-2023-0225 State: PUBLISHED Published: 2023-04-03T00:00:00.000Z Last Updated: 2025-02-18T15:13:40.669Z Vendors: n/a Products: Samba Problem Types: CWE-732 Description: A flaw was found in Samba. An incomplete access check on dnsHostName allows authenticated but otherwise unprivileged users to delete this attribute from any object in the directory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.samba.org/samba/security/CVE-2023-0225.html - https://security.netapp.com/advisory/ntap-20230406-0007/ - https://security.gentoo.org/glsa/202309-06
CVE ID: CVE-2023-0227 State: PUBLISHED Published: 2023-01-12T00:00:00.000Z Last Updated: 2025-04-08T13:39:15.554Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H) Vendors: pyload Products: pyload/pyload Problem Types: CWE-613 Description: Insufficient Session Expiration in GitHub repository pyload/pyload prior to 0.5.0b3.dev36. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/af3101d7-fea6-463a-b7e4-a48be219e31b - https://github.com/pyload/pyload/commit/c035714c0596b704b11af0f8a669352f128ad2d9
CVE ID: CVE-2023-0228 State: PUBLISHED Published: 2023-03-02T01:44:01.106Z Last Updated: 2025-03-05T20:45:30.761Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ABB Products: Symphony Plus S+ Operations Problem Types: CWE-287 Description: Improper Authentication vulnerability in ABB Symphony Plus S+ Operations.This issue affects Symphony Plus S+ Operations: from 2.X through 2.1 SP2, 2.2, from 3.X through 3.3 SP1, 3.3 SP2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=7PAA006722&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2023-0229 State: PUBLISHED Published: 2023-01-25T00:00:00.000Z Last Updated: 2025-04-01T15:07:42.482Z Vendors: n/a Products: github.com/openshift/apiserver-library-go Problem Types: CWE-20 Description: A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that contains an issue that can allow low-privileged users to set the seccomp profile for pods they control to "unconfined." By default, the seccomp profile used in the restricted-v2 Security Context Constraint (SCC) is "runtime/default," allowing users to disable seccomp for pods they can create and modify. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refe
mp for pods they can create and modify. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2160349
CVE ID: CVE-2023-0230 State: PUBLISHED Published: 2023-02-27T15:24:26.720Z Last Updated: 2025-03-10T18:07:43.646Z Vendors: Unknown Products: VK All in One Expansion Unit Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The VK All in One Expansion Unit WordPress plugin before 9.86.0.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a4ad73b2-6a70-48ff-bf4c-28f81b193748
CVE ID: CVE-2023-0231 State: PUBLISHED Published: 2023-02-21T08:50:38.876Z Last Updated: 2025-03-12T16:19:50.699Z Vendors: Unknown Products: ShopLentor Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The ShopLentor WordPress plugin before 2.5.4 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/533c19d5-219c-4389-a8bf-8b3a35b33b20
CVE ID: CVE-2023-0232 State: PUBLISHED Published: 2023-02-21T08:51:02.165Z Last Updated: 2025-03-12T20:48:45.543Z Vendors: Unknown Products: ShopLentor Problem Types: CWE-502 Deserialization of Untrusted Data Description: The ShopLentor WordPress plugin before 2.5.4 unserializes user input from cookies in order to track viewed products and user data, which could lead to PHP Object Injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1885a708-0e8a-4f4c-8e26-069bebe9a518 - https://plugins.trac.wordpress.org/changeset/2852711/woolentor-addons/trunk/includes/helper-function.php
CVE ID: CVE-2023-0233 State: PUBLISHED Published: 2023-05-15T12:15:47.088Z Last Updated: 2025-01-14T18:13:55.785Z Vendors: Unknown Products: ActiveCampaign Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The ActiveCampaign WordPress plugin before 8.1.12 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e95c85fd-fa47-45bd-b8e0-a7f33edd7130
CVE ID: CVE-2023-0234 State: PUBLISHED Published: 2023-02-06T19:59:32.911Z Last Updated: 2025-03-25T18:09:53.520Z Vendors: Unknown Products: SiteGround Security Problem Types: CWE-89 SQL Injection Description: The SiteGround Security WordPress plugin before 1.3.1 does not properly sanitize user input before using it in an SQL query, leading to an authenticated SQL injection issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/acf3e369-1290-4b3f-83bf-2209b9dd06e1 - https://github.com/namah-age/CVEs/blob/master/1.md - https://www.siteground.com/viewtos/responsible_disclosure_policy?scid=4&lang=en
CVE ID: CVE-2023-0235 State: REJECTED Published: N/A Last Updated: 2023-01-13T00:00:00 Description: No description available.
CVE ID: CVE-2023-0236 State: PUBLISHED Published: 2023-02-06T19:59:21.460Z Last Updated: 2025-03-25T18:13:00.269Z Vendors: Unknown Products: Tutor LMS Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Tutor LMS WordPress plugin before 2.0.10 does not sanitise and escape the reset_key and user_id parameters before outputting then back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/503835db-426d-4b49-85f7-c9a20d6ff5b8
CVE ID: CVE-2023-0237 State: REJECTED Published: N/A Last Updated: 2023-01-13T00:00:00 Description: No description available.
CVE ID: CVE-2023-0238 State: PUBLISHED Published: 2023-08-29T14:56:50.791Z Last Updated: 2024-09-30T17:47:12.727Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Cloudflare Products: WARP Client Problem Types: CWE-200 Description: Due to lack of a security policy, the WARP Mobile Client (<=6.29) for Android was susceptible to this vulnerability which allowed a malicious app installed on a victim's device to exploit a peculiarity in an Android function, wherein under certain conditions, the malicious app could dictate the task behaviour of the WARP app. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/c
WARP app. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cloudflare/advisories/security/advisories/GHSA-23rx-f69w-g75c - https://developers.cloudflare.com/warp-client/
CVE ID: CVE-2023-0240 State: PUBLISHED Published: 2023-01-30T13:17:09.182Z Last Updated: 2024-08-02T05:02:43.942Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Linux Products: Linux Kernel Problem Types: CWE-416 Description: There is a logic error in io_uring's implementation which can be used to trigger a use-after-free vulnerability leading to privilege escalation. In the io_prep_async_work function the assumption that the last io_grab_identity call cannot return false is not true, and in this case the function will use the init_cred or the previous linked requests identity to do operations instead of using the current identity. This can lead to reference
he previous linked requests identity to do operations instead of using the current identity. This can lead to reference counting issues causing use-after-free. We recommend upgrading past version 5.10.161. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/io_uring?h=linux-5.10.y&id=788d0824269bef539fe31a785b1517882eafed93 - https://github.com/gregkh/linux/commit/1e6fa5216a0e59ef02e8b6b40d553238a3b81d49 - https://kernel.dance/#788d0824269bef539fe31a785b1517882eafed93
CVE ID: CVE-2023-0241 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-02-19T16:09:17.684Z Vendors: n/a Products: pgadmin Problem Types: CWE-22 Description: pgAdmin 4 versions prior to v6.19 contains a directory traversal vulnerability. A user of the product may change another user's settings or alter the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pgadmin-org/pgadmin4/issues/5734 - https://jvn.jp/en/jp/JVN01398015/
CVE ID: CVE-2023-0242 State: PUBLISHED Published: 2023-01-18T20:57:30.570Z Last Updated: 2025-04-03T19:51:46.758Z Vendors: Rapid7 Products: Velociraptor Problem Types: CWE-269 Description: Rapid7 Velociraptor allows users to be created with different privileges on the server. Administrators are generally allowed to run any command on the server including writing arbitrary files. However, lower privilege users are generally forbidden from writing or modifying files on the server. The VQL copy() function applies permission checks for reading files but does not check for permission to write files. This allows a low privilege user (usually, users with the Velociraptor "investigator" role) to ove
ssion to write files. This allows a low privilege user (usually, users with the Velociraptor "investigator" role) to overwrite files on the server, including Velociraptor configuration files. To exploit this vulnerability, the attacker must already have a Velociraptor user account at a low privilege level (at least "analyst") and be able to log into the GUI and create a notebook where they can run the VQL query invoking the copy() VQL function. Typically, most users deploy Velociraptor with limited access to a trusted group (most users will be administrators within the GUI). This vulnerability is associated with program files https://github.Com/Velocidex/velociraptor/blob/master/vql/filesyst
. This vulnerability is associated with program files https://github.Com/Velocidex/velociraptor/blob/master/vql/filesystem/copy.go https://github.Com/Velocidex/velociraptor/blob/master/vql/filesystem/copy.go and program routines copy(). This issue affects Velociraptor versions before 0.6.7-5. Version 0.6.7-5, released January 16, 2023, fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.velociraptor.app/announcements/2023-cves/#:~:text=to%20upgrade%20clients.-,CVE%2D2023%2D0242,-Insufficient%20Permission%20Check
CVE ID: CVE-2023-0243 State: PUBLISHED Published: 2023-01-12T14:46:36.016Z Last Updated: 2025-04-07T14:56:54.368Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: TuziCMS Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in TuziCMS 2.0.6. This affects the function index of the file App\Manage\Controller\ArticleController.class.php of the component Article Module. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-218151. Additional Analyst Notes: - CVE Prog
lic and may be used. The associated identifier of this vulnerability is VDB-218151. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.218151 - https://vuldb.com/?ctiid.218151 - https://github.com/yeyinshi/tuzicms/issues/12
CVE ID: CVE-2023-0244 State: PUBLISHED Published: 2023-01-12T14:49:40.968Z Last Updated: 2024-08-02T05:02:44.042Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: TuziCMS Problem Types: CWE-89 Description: A vulnerability classified as critical was found in TuziCMS 2.0.6. This vulnerability affects the function delall of the file \App\Manage\Controller\KefuController.class.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-218152. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.co
r of this vulnerability is VDB-218152. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.218152 - https://vuldb.com/?ctiid.218152 - https://github.com/yeyinshi/tuzicms/issues/13
CVE ID: CVE-2023-0245 State: PUBLISHED Published: 2023-01-12T14:52:10.601Z Last Updated: 2024-08-02T05:02:44.123Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Flight Booking Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in SourceCodester Online Flight Booking Management System. This issue affects some unknown processing of the file add_contestant.php. The manipulation of the argument add_contestant leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-218153 was assigned to this vulner
ely. The exploit has been disclosed to the public and may be used. The identifier VDB-218153 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.218153 - https://vuldb.com/?ctiid.218153 - https://github.com/f4cky0u/Security-vulnerabilities/blob/main/Online%20Flight%20Booking%20Management%20System%20add_contestant.php%20has%20SQLinject.md
CVE ID: CVE-2023-0246 State: PUBLISHED Published: 2023-01-12T14:57:07.023Z Last Updated: 2024-11-25T17:05:25.445Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: earclink Products: ESPCMS Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in earclink ESPCMS P8.21120101. Affected is an unknown function of the component Content Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-218154 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.218154 - https://vuldb.com/?ctiid.218154 - https://gitee.com/earclink/espcms/issues/I6812Q
CVE ID: CVE-2023-0247 State: PUBLISHED Published: 2023-01-12T00:00:00.000Z Last Updated: 2025-04-07T20:07:36.321Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: bits-and-blooms Products: bits-and-blooms/bloom Problem Types: CWE-427 Description: Uncontrolled Search Path Element in GitHub repository bits-and-blooms/bloom prior to 3.3.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/cab50e44-0995-4ac1-a5d5-889293b9704f - https://github.com/bits-and-blooms/bloom/commit/658f1393d4c52254a3d22f5f64f217405ec5fefb
CVE ID: CVE-2023-0248 State: PUBLISHED Published: 2023-12-14T20:57:33.625Z Last Updated: 2024-10-08T14:19:18.925Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L) Vendors: Sensormatic Electronics, a subsidiary of Johnson Controls, Inc. Products: ioSmart Gen1 Problem Types: CWE-200, CWE-401 Description: An attacker with physical access to the Kantech Gen1 ioSmart card reader with firmware version prior to 1.07.02 in certain circumstances can recover the reader's communication memory between the card and reader. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.johnsoncontrols.com/cyber-solutions/security-advisories - ht
ntainer: - CISA ADP Vulnrichment: References: - https://www.johnsoncontrols.com/cyber-solutions/security-advisories - https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-02
CVE ID: CVE-2023-0249 State: PUBLISHED Published: 2023-02-08T22:43:50.324Z Last Updated: 2025-01-16T21:57:51.418Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DIAScreen Problem Types: CWE-787 Description: Delta Electronics DIAScreen versions 1.2.1.23 and prior are vulnerable to out-of-bounds write, which may allow an attacker to remotely execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-23-033-01
CVE ID: CVE-2023-0250 State: PUBLISHED Published: 2023-02-08T22:45:50.148Z Last Updated: 2025-01-16T21:57:44.030Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DIAScreen Problem Types: CWE-121 Description: Delta Electronics DIAScreen versions 1.2.1.23 and prior are vulnerable to a stack-based buffer overflow, which could allow an attacker to remotely execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-23-033-01
CVE ID: CVE-2023-0251 State: PUBLISHED Published: 2023-02-08T22:47:40.716Z Last Updated: 2025-01-16T21:57:37.048Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DIAScreen Problem Types: CWE-119 Description: Delta Electronics DIAScreen versions 1.2.1.23 and prior are vulnerable to a buffer overflow through improper restrictions of operations within memory, which could allow an attacker to remotely execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-23-033-01
CVE ID: CVE-2023-0252 State: PUBLISHED Published: 2023-02-06T19:59:49.263Z Last Updated: 2025-03-25T17:38:13.714Z Vendors: Unknown Products: Contextual Related Posts Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Contextual Related Posts WordPress plugin before 3.3.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5754a4fd-1adf-47aa-976f-3b28750058c2
CVE ID: CVE-2023-0253 State: REJECTED Published: 2023-02-02T14:38:56.927Z Last Updated: 2024-08-06T14:07:18.247Z Description: No description available.
CVE ID: CVE-2023-0254 State: PUBLISHED Published: 2023-01-12T17:34:26.499Z Last Updated: 2025-01-13T17:12:30.326Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: wpinsider-1 Products: Simple Membership WP user Import Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Simple Membership WP user Import plugin for WordPress is vulnerable to SQL Injection via the ‘orderby’ parameter in versions up to, and including, 1.7 due to insufficient escaping on the user supplied parameter. This makes it possible for authenticated attackers with administrative privileges to append additional SQL queries
ter. This makes it possible for authenticated attackers with administrative privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6f781533-b633-4452-95bd-c32ed0de2ea9 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2829005%40simple-membership-wp-user-import&new=2829005%40simple-membership-wp-user-import&sfp_email=&sfph_mail=
CVE ID: CVE-2023-0255 State: PUBLISHED Published: 2023-02-13T14:32:21.404Z Last Updated: 2025-03-21T15:24:56.742Z Vendors: Unknown Products: Enable Media Replace Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The Enable Media Replace WordPress plugin before 4.0.2 does not prevent authors from uploading arbitrary files to the site, which may allow them to upload PHP shells on affected sites. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b0239208-1e23-4774-9b8c-9611704a07a0
CVE ID: CVE-2023-0256 State: PUBLISHED Published: 2023-01-12T21:03:04.018Z Last Updated: 2025-04-08T18:11:38.981Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Food Ordering System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Online Food Ordering System 2.0. It has been classified as critical. Affected is an unknown function of the file /fos/admin/ajax.php?action=login of the component Login Page. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-218184. Additional Analyst Notes: - CVE Program Container: - C
ack remotely. The identifier of this vulnerability is VDB-218184. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.218184 - https://vuldb.com/?ctiid.218184