Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-25575 State: PUBLISHED Published: 2022-03-24T21:32:44 Last Updated: 2024-08-03T04:42:50.001Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Parking Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via crafted payloads injected into the user name, password, and verification code text boxes. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gou-web/Parking-management-systemXSS-/blob/main/README.md
CVE ID: CVE-2022-25576 State: PUBLISHED Published: 2022-03-24T22:06:49 Last Updated: 2024-08-03T04:42:49.958Z Vendors: n/a Products: n/a Problem Types: n/a Description: Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component anchor/routes/posts.php. This vulnerability allows attackers to arbitrarily delete posts. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/butterflyhack/anchorcms-0.12.7-CSRF - https://github.com/anchorcms/anchor-cms
CVE ID: CVE-2022-25577 State: PUBLISHED Published: 2022-03-25T16:17:30 Last Updated: 2024-08-03T04:42:50.039Z Vendors: n/a Products: n/a Problem Types: n/a Description: ALF-BanCO v8.2.5 and below was discovered to use a hardcoded password to encrypt the SQLite database containing the user's data. Attackers who are able to gain remote or local access to the system are able to read and modify the data. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ph0nkybit/proof-of-concepts/tree/main/Use_Of_Hardcoded_Password_In_ALF-BanCO_8.2.x
CVE ID: CVE-2022-25578 State: PUBLISHED Published: 2022-03-18T22:25:20 Last Updated: 2024-08-03T04:42:50.091Z Vendors: n/a Products: n/a Problem Types: n/a Description: taocms v3.0.2 allows attackers to execute code injection via arbitrarily editing the .htaccess file. Additional Analyst Notes: - CVE Program Container: References: - http://taocms.com - https://github.com/taogogo/taocms/issues/28
CVE ID: CVE-2022-25581 State: PUBLISHED Published: 2022-03-18T22:25:21 Last Updated: 2024-08-03T04:42:50.082Z Vendors: n/a Products: n/a Problem Types: n/a Description: Classcms v2.5 and below contains an arbitrary file upload via the component \class\classupload. This vulnerability allows attackers to execute code injection via a crafted .txt file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/k0xx11/Vulscve/blob/master/classcms2.5-rce.md
CVE ID: CVE-2022-25582 State: PUBLISHED Published: 2022-03-25T16:45:09 Last Updated: 2024-08-03T04:42:50.037Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the Column module of ClassCMS v2.5 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Add Articles field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/k0xx11/Vulscve/blob/master/classcms2.5-xss.md
CVE ID: CVE-2022-25584 State: PUBLISHED Published: 2022-04-05T00:53:01 Last Updated: 2024-08-03T04:42:49.961Z Vendors: n/a Products: n/a Problem Types: n/a Description: Seyeon Tech Co., Ltd FlexWATCH FW3170-PS-E Network Video System 4.23-3000_GY allows attackers to access sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/NSSCYCTFER/Flexwatch
CVE ID: CVE-2022-25585 State: PUBLISHED Published: 2022-06-21T13:21:53 Last Updated: 2024-08-03T04:42:50.300Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unioncms v1.0.13 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Default settings. Additional Analyst Notes: - CVE Program Container: References: - http://unioncms.com - https://github.com/union-home/unioncms/issues/5
CVE ID: CVE-2022-25590 State: PUBLISHED Published: 2022-03-25T18:50:11 Last Updated: 2024-08-03T04:42:50.032Z Vendors: n/a Products: n/a Problem Types: n/a Description: SurveyKing v0.2.0 was discovered to retain users' session cookies after logout, allowing attackers to login to the system and access data using the browser cache when the user exits the application. Additional Analyst Notes: - CVE Program Container: References: - http://surveyking.com - https://github.com/javahuang/SurveyKing - https://github.com/javahuang/SurveyKing/issues/7
CVE ID: CVE-2022-25591 State: PUBLISHED Published: 2022-05-13T14:33:56 Last Updated: 2024-08-03T04:42:50.036Z Vendors: n/a Products: n/a Problem Types: n/a Description: BlogEngine.NET v3.3.8.0 was discovered to contain an arbitrary file deletion vulnerability which allows attackers to delete files within the web server root directory via a crafted HTTP request. Additional Analyst Notes: - CVE Program Container: References: - https://blogengine.io/ - https://www.0xlanks.me/blog/cve-2022-25591-advisory/
CVE ID: CVE-2022-25594 State: PUBLISHED Published: 2022-04-07T18:22:31.482278Z Last Updated: 2024-09-16T22:14:37.842Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Microprogram Products: parking lot management system Problem Types: CWE-200 Description: Microprogram’s parking lot management system is vulnerable to sensitive information exposure. An unauthorized remote attacker can input specific URLs to acquire partial system configuration information. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5973-6b449-1.html
CVE ID: CVE-2022-25595 State: PUBLISHED Published: 2022-04-07T18:22:33.136013Z Last Updated: 2024-09-16T17:33:17.584Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ASUS Products: RT-AC86U Problem Types: CWE-20 Description: ASUS RT-AC86U has improper user request handling, which allows an unauthenticated LAN attacker to cause a denial of service by sending particular request a server-to-client reply attempt. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5792-3f3f5-1.html
CVE ID: CVE-2022-25596 State: PUBLISHED Published: 2022-04-07T18:22:35.012252Z Last Updated: 2024-09-17T00:46:09.147Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ASUS Products: RT-AC86U Problem Types: CWE-787 Description: ASUS RT-AC56U’s configuration function has a heap-based buffer overflow vulnerability due to insufficient validation for the decryption parameter length, which allows an unauthenticated LAN attacker to execute arbitrary code, perform arbitrary operations and disrupt service. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5793-4f9d3-1.html
CVE ID: CVE-2022-25597 State: PUBLISHED Published: 2022-04-07T18:22:37.045539Z Last Updated: 2024-09-16T20:37:57.432Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ASUS Products: RT-AC86U Problem Types: CWE-78 Description: ASUS RT-AC86U’s LPD service has insufficient filtering for special characters in the user request, which allows an unauthenticated LAN attacker to perform command injection attack, execute arbitrary commands and disrupt or terminate service. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5794-09c33-1.html
CVE ID: CVE-2022-25598 State: PUBLISHED Published: 2022-03-30T09:20:12 Last Updated: 2024-08-03T04:42:49.991Z Vendors: Apache Software Foundation Products: Apache DolphinScheduler Problem Types: CWE-1333 Description: Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks, Apache DolphinScheduler users should upgrade to version 2.0.5 or higher. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/hwnw7xr969sg5nv84wz75nfr2c76fl93
CVE ID: CVE-2022-25599 State: PUBLISHED Published: 2022-02-21T17:49:32.713Z Last Updated: 2025-02-20T20:31:08.858Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Spiffy Plugins Products: Spiffy Calendar (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability leading to event deletion was discovered in Spiffy Calendar WordPress plugin (versions <= 4.9.0). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/spiffy-calendar/#developers - https://patchstack.com/database/vulnerability/spiffy-calendar/wordpress-spiffy-calendar-plugin-4-9-0-event-dele
lopers - https://patchstack.com/database/vulnerability/spiffy-calendar/wordpress-spiffy-calendar-plugin-4-9-0-event-deletion-via-cross-site-request-forgery-csrf-vulnerability
CVE ID: CVE-2022-25600 State: PUBLISHED Published: 2022-03-11T17:54:09.346Z Last Updated: 2025-02-20T20:30:45.302Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Flippercode Products: WP Google Map Plugin (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability affecting Delete Marker Category, Delete Map, and Copy Map functions in WP Google Map plugin (versions <= 4.2.3). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/wp-google-map-plugin/#developers - https://patchstack.com/database/vulnerability/wp-google-map-plugin/wordpress-wp-google-m
google-map-plugin/#developers - https://patchstack.com/database/vulnerability/wp-google-map-plugin/wordpress-wp-google-map-plugin-4-2-3-cross-site-request-forgery-csrf-vulnerability - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZQCIZQI267YHVYSFB3CRKNK3F4ASPLK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7CR6VGITIB2TXXZ6B5QRRWPU5S4BXQPD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IJX6NVXSRN3RX3YUVEJQ4WUTQSDL3DSR/
CVE ID: CVE-2022-25601 State: PUBLISHED Published: 2022-03-11T17:54:08.234Z Last Updated: 2025-02-20T20:30:53.168Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) Vendors: Jeff Starr Products: Contact Form X (WordPress plugin) Problem Types: CWE-79 Description: Reflected Cross-Site Scripting (XSS) vulnerability affecting parameter &tab discovered in Contact Form X WordPress plugin (versions <= 2.4). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/contact-form-x/#developers - https://patchstack.com/database/vulnerability/contact-form-x/wordpress-contact-form-x-plugin-2-4-authenticated-reflected-cr
ps://patchstack.com/database/vulnerability/contact-form-x/wordpress-contact-form-x-plugin-2-4-authenticated-reflected-cross-site-scripting-xss-vulnerability - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZQCIZQI267YHVYSFB3CRKNK3F4ASPLK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7CR6VGITIB2TXXZ6B5QRRWPU5S4BXQPD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IJX6NVXSRN3RX3YUVEJQ4WUTQSDL3DSR/
CVE ID: CVE-2022-25602 State: PUBLISHED Published: 2022-03-18T18:00:26.675Z Last Updated: 2025-02-20T20:30:18.857Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: ExpressTech Products: Responsive Menu (WordPress plugin) Problem Types: CWE-200 Description: Nonce token leak vulnerability leading to arbitrary file upload, theme deletion, plugin settings change discovered in Responsive Menu WordPress plugin (versions <= 4.1.7). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/responsive-menu/#developers - https://patchstack.com/database/vulnerability/responsive-menu/wordpress-responsive-menu-pl
responsive-menu/#developers - https://patchstack.com/database/vulnerability/responsive-menu/wordpress-responsive-menu-plugin-4-1-7-nonce-token-leak-leading-to-arbitrary-file-upload-theme-deletion-plugin-settings-change-vulnerability
CVE ID: CVE-2022-25603 State: PUBLISHED Published: 2022-03-18T18:00:22.779Z Last Updated: 2025-02-20T20:30:36.761Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Max Foundry Products: MaxGalleria (WordPress plugin) Problem Types: CWE-79 Description: Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability discovered in MaxGalleria WordPress plugin (versions 6.2.5). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/maxgalleria/ - https://patchstack.com/database/vulnerability/maxgalleria/wordpress-maxgalleria-plugin-6-2-5-stored-cross-site-scripting-xss-vul
patchstack.com/database/vulnerability/maxgalleria/wordpress-maxgalleria-plugin-6-2-5-stored-cross-site-scripting-xss-vulnerability
CVE ID: CVE-2022-25604 State: PUBLISHED Published: 2022-03-18T18:00:25.906Z Last Updated: 2025-02-20T20:30:27.040Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N) Vendors: Greg Priday Products: Price Table (WordPress plugin) Problem Types: CWE-79 Description: Authenticated (contributor of higher user role) Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Price Table plugin (versions <= 0.2.2). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/pricetable/ - https://patchstack.com/database/vulnerability/pricetable/wordpress-price-table-plugin-0-2-2-stored-cross-site-scripting-x
ttps://patchstack.com/database/vulnerability/pricetable/wordpress-price-table-plugin-0-2-2-stored-cross-site-scripting-xss-vulnerability
CVE ID: CVE-2022-25605 State: PUBLISHED Published: 2022-03-18T18:00:27.446Z Last Updated: 2025-02-20T20:30:10.178Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Lester 'GaMerZ' Chan Products: WP-DownloadManager (WordPress) Problem Types: CWE-79 Description: Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered in WP-DownloadManager WordPress plugin (versions <= 1.68.6). Vvulnerable parameters &download_path, &download_path_url, &download_page_url. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/wp-downloadmanager/#developers - https://patchstack.com/databa
Vulnrichment: References: - https://wordpress.org/plugins/wp-downloadmanager/#developers - https://patchstack.com/database/vulnerability/wp-downloadmanager/wordpress-wp-downloadmanager-plugin-1-68-6-multiple-authenticated-stored-cross-site-scripting-xss-vulnerabilities
CVE ID: CVE-2022-25606 State: PUBLISHED Published: 2022-03-25T18:02:32.949Z Last Updated: 2025-02-20T20:29:34.538Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Lester 'GaMerZ' Chan Products: WP-DownloadManager (WordPress) Problem Types: CWE-79 Description: Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered in WP-DownloadManager WordPress plugin (versions <= 1.68.6). Vulnerable parameters &download_path, &download_path_url, &download_page_url, &download_categories. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/wp-downloadmanager/#developers - https://
ontainer: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/wp-downloadmanager/#developers - https://patchstack.com/database/vulnerability/wp-downloadmanager/wordpress-wp-downloadmanager-plugin-1-68-5-multiple-authenticated-stored-cross-site-scripting-xss-vulnerabilities
CVE ID: CVE-2022-25607 State: PUBLISHED Published: 2022-03-18T18:00:28.348Z Last Updated: 2025-02-20T20:30:01.099Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L) Vendors: FolioVision Products: FV Flowplayer Video Player (WordPress plugin) Problem Types: CWE-89 Description: Authenticated (author or higher user role) SQL Injection (SQLi) vulnerability discovered in FV Flowplayer Video Player WordPress plugin (versions <= 7.5.15.727). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/fv-wordpress-flowplayer/#developers - https://patchstack.com/database/vulnerability/fv-wordpress-flowplayer/wordpress-
s/fv-wordpress-flowplayer/#developers - https://patchstack.com/database/vulnerability/fv-wordpress-flowplayer/wordpress-fv-flowplayer-video-player-plugin-7-5-15-727-sql-injection-sqli-vulnerability
CVE ID: CVE-2022-25608 State: PUBLISHED Published: 2022-03-23T19:46:21.885Z Last Updated: 2025-02-20T20:29:51.723Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Yooslider Products: Yoo Slider – Image Slider & Video Slider (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) in Yoo Slider – Image Slider & Video Slider (WordPress plugin) allows attackers to trick authenticated users into unwanted slider duplicate or delete action. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/yoo-slider/#developers - https://patchstack.com/database/vulnerability/yoo-
References: - https://wordpress.org/plugins/yoo-slider/#developers - https://patchstack.com/database/vulnerability/yoo-slider/wordpress-yoo-slider-plugin-2-0-0-cross-site-request-forgery-csrf-vulnerability-leading-to-slider-duplicate-delete
CVE ID: CVE-2022-25609 State: PUBLISHED Published: 2022-03-23T19:46:22.688Z Last Updated: 2025-02-20T20:29:42.764Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Yooslider Products: Yoo Slider – Image Slider & Video Slider (WordPress plugin) Problem Types: CWE-79 Description: Stored Cross-Site Scripting (XSS) in Yoo Slider – Image Slider & Video Slider (WordPress plugin) allows attackers with contributor or higher user role to inject the malicious code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/yoo-slider/#developers - https://patchstack.com/database/vulnerability/yoo-slider/wordp
- https://wordpress.org/plugins/yoo-slider/#developers - https://patchstack.com/database/vulnerability/yoo-slider/wordpress-yoo-slider-plugin-2-0-0-stored-cross-site-scripting-xss-vulnerability
CVE ID: CVE-2022-25610 State: PUBLISHED Published: 2022-03-25T18:02:34.115Z Last Updated: 2025-02-20T20:29:26.717Z Severity: LOW (CVSS 3.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N) Vendors: Jeff Starr Products: Simple Ajax Chat (WordPress plugin) Problem Types: CWE-79 Description: Unauthenticated Stored Cross-Site Scripting (XSS) in Simple Ajax Chat <= 20220115 allows an attacker to store the malicious code. However, the attack requires specific conditions, making it hard to exploit. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/simple-ajax-chat/#developers - https://patchstack.com/database/vulnerability/simple-aja
- https://wordpress.org/plugins/simple-ajax-chat/#developers - https://patchstack.com/database/vulnerability/simple-ajax-chat/wordpress-simple-ajax-chat-plugin-20220115-unauthenticated-stored-cross-site-scripting-xss-vulnerability
CVE ID: CVE-2022-25611 State: PUBLISHED Published: 2022-03-25T18:02:35.154Z Last Updated: 2025-02-20T20:29:18.352Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N) Vendors: PressTigers Products: Simple Event Planner (WordPress plugin) Problem Types: CWE-79 Description: Authenticated Stored Cross-Site Scripting (XSS) in Simple Event Planner plugin <= 1.5.4 allows attackers with contributor or higher user roles to inject the malicious script by using vulnerable parameter &custom[add_seg][]. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/simple-event-planner/#developers - https://patchstack.com/data
Vulnrichment: References: - https://wordpress.org/plugins/simple-event-planner/#developers - https://patchstack.com/database/vulnerability/simple-event-planner/wordpress-simple-event-planner-plugin-1-5-4-authenticated-stored-cross-site-scripting-xss-vulnerability
CVE ID: CVE-2022-25612 State: PUBLISHED Published: 2022-03-25T18:02:36.241Z Last Updated: 2025-02-20T20:29:09.931Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N) Vendors: PressTigers Products: Simple Event Planner (WordPress plugin) Problem Types: CWE-79 Description: Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in Simple Event Planner WordPress plugin <= 1.5.4 allows user with author or higher user rights inject the malicious code via vulnerable parameters: &custom[event_organiser], &custom[organiser_email], &custom[organiser_contact]. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wo
organiser_contact]. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/simple-event-planner/#developers - https://patchstack.com/database/vulnerability/simple-event-planner/wordpress-simple-event-planner-plugin-1-5-4-multiple-authenticated-persistent-cross-site-scripting-xss-vulnerabilities
CVE ID: CVE-2022-25613 State: PUBLISHED Published: 2022-04-04T19:46:16.725Z Last Updated: 2025-02-20T20:29:01.144Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N) Vendors: FolioVision Products: FV Flowplayer Video Player (WordPress plugin) Problem Types: CWE-79 Description: Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in FV Flowplayer Video Player (WordPress plugin) versions <= 7.5.18.727 via &fv_wp_flowplayer_field_splash parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/fv-wordpress-flowplayer/#developers - https://patchstack.com/database/vulnerability/fv-wordpress
//wordpress.org/plugins/fv-wordpress-flowplayer/#developers - https://patchstack.com/database/vulnerability/fv-wordpress-flowplayer/wordpress-fv-flowplayer-video-player-plugin-7-5-18-727-authenticated-persistent-cross-site-scripting-xss-vulnerability
CVE ID: CVE-2022-25614 State: PUBLISHED Published: 2022-04-11T19:38:34.523Z Last Updated: 2025-02-20T20:27:32.875Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: StylemixThemes Products: eRoom – Zoom Meetings & Webinar (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) in StylemixThemes eRoom – Zoom Meetings & Webinar (WordPress plugin) <= 1.3.7 allows an attacker to Sync with Zoom Meetings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/eroom-zoom-meetings-webinar/#developers - https://patchstack.com/database/vulnerability/eroom-zoom-meetings-webi
plugins/eroom-zoom-meetings-webinar/#developers - https://patchstack.com/database/vulnerability/eroom-zoom-meetings-webinar/wordpress-eroom-plugin-1-3-7-cross-site-request-forgery-csrf-leading-to-sync-with-zoom-meetings-vulnerability
CVE ID: CVE-2022-25615 State: PUBLISHED Published: 2022-04-11T19:38:33.515Z Last Updated: 2025-02-20T20:27:41.373Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: StylemixThemes Products: eRoom – Zoom Meetings & Webinar (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) in StylemixThemes eRoom – Zoom Meetings & Webinar (WordPress plugin) <= 1.3.8 allows cache deletion. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/eroom-zoom-meetings-webinar/#developers - https://patchstack.com/database/vulnerability/eroom-zoom-meetings-webinar/wordpress-eroom-plug
ngs-webinar/#developers - https://patchstack.com/database/vulnerability/eroom-zoom-meetings-webinar/wordpress-eroom-plugin-1-3-8-cross-site-request-forgery-csrf-vulnerability-leading-to-cache-deletion