Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-2490 State: PUBLISHED Published: 2022-07-20T11:35:44.000Z Last Updated: 2025-04-15T14:03:45.903Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Simple E-Learning System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in SourceCodester Simple E-Learning System 1.0. Affected is an unknown function of the file search.php. The manipulation of the argument classCode with the input 1'||(SELECT 0x74666264 WHERE 5610=5610 AND (SELECT 7504 FROM(SELECT COUNT(*),CONCAT(0x7171627a71,(SELECT (ELT(7504=7504,1))),0x71717a7071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a))
(0x7171627a71,(SELECT (ELT(7504=7504,1))),0x71717a7071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a))||' leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Simple-E-Learning-System.md#search.php - https://vuldb.com/?id.204552
CVE ID: CVE-2022-2491 State: PUBLISHED Published: 2022-07-20T11:35:50.000Z Last Updated: 2025-04-15T14:03:37.347Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Library Management System Problem Types: CWE-89 Description: A vulnerability has been found in SourceCodester Library Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file lab.php. The manipulation of the argument Section with the input 1' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,CONCAT(0x71716b7171,0x546e4444736b7743575a666d4873746a6450616261527a67627944426946507245664143694c6a4c,0x7162706b71),NULL,NULL,NULL,NULL# leads to sq
4736b7743575a666d4873746a6450616261527a67627944426946507245664143694c6a4c,0x7162706b71),NULL,NULL,NULL,NULL# leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Library-Management-System-with-QR-code-Attendance-and-Auto-Generate-Library-Card.md - https://vuldb.com/?id.204574
CVE ID: CVE-2022-2492 State: PUBLISHED Published: 2022-07-20T11:35:56.000Z Last Updated: 2025-04-15T14:03:25.449Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Library Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Library Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /index.php. The manipulation of the argument RollNo with the input admin' AND (SELECT 2625 FROM (SELECT(SLEEP(5)))MdIL) AND 'KXmq'='KXmq&Password=1231312312 leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the publ
word=1231312312 leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Library-Management-System-with-QR-code-Attendance-and-Auto-Generate-Library-Card.md#index.php - https://vuldb.com/?id.204575
CVE ID: CVE-2022-2493 State: PUBLISHED Published: 2022-07-22T03:47:17 Last Updated: 2024-08-03T00:39:07.731Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: openemr Products: openemr/openemr Problem Types: CWE-1083 Description: Data Access from Outside Expected Data Manager Component in GitHub repository openemr/openemr prior to 7.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/8a4d54e2-e1cd-47c3-9304-ac8be87c80f1 - https://github.com/openemr/openemr/commit/871ae5198d8ca18fd17257ae7c5c906a52dca908
CVE ID: CVE-2022-2494 State: PUBLISHED Published: 2022-07-22T03:48:01 Last Updated: 2024-08-03T00:39:07.768Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: openemr Products: openemr/openemr Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/74ddb017-c1fd-4e72-bd30-3b2033911472 - https://github.com/openemr/openemr/commit/152e551208e6de534ab194c87e9ffa4d56d294a8
CVE ID: CVE-2022-2495 State: PUBLISHED Published: 2022-07-22T03:48:29 Last Updated: 2024-08-03T00:39:07.744Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:L/A:L) Vendors: microweber Products: microweber/microweber Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.21. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/00affb69-275d-4f4c-b419-437922bc7798 - https://github.com/microweber/microweber/commit/d35e691e72d358430abc8e99f5ba9eb374423b9f
CVE ID: CVE-2022-2497 State: PUBLISHED Published: 2022-08-05T15:09:19 Last Updated: 2024-08-03T00:39:07.794Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Information exposure in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. A malicious developer could exfiltrate an integration's access token by modifying the integration URL such that authenticated requests are sent to an attacker controlled server. Additional Analyst Notes: - CVE Program Container: Ref
authenticated requests are sent to an attacker controlled server. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/362671 - https://hackerone.com/reports/1557992 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2497.json
CVE ID: CVE-2022-2498 State: PUBLISHED Published: 2022-08-05T15:10:57 Last Updated: 2024-08-03T00:39:07.874Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Incorrect execution-assigned permissions in GitLab Description: An issue in pipeline subscriptions in GitLab EE affecting all versions from 12.8 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 triggered new pipelines with the person who created the tag as the pipeline creator instead of the subscription's author. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/243703 - https://hackerone.c
Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/243703 - https://hackerone.com/reports/966824 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2498.json
CVE ID: CVE-2022-2499 State: PUBLISHED Published: 2022-08-05T15:09:33 Last Updated: 2024-08-03T00:39:07.654Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Authorization bypass through user-controlled key in GitLab Description: An issue has been discovered in GitLab EE affecting all versions starting from 13.10 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. GitLab's Jira integration has an insecure direct object reference vulnerability that may be exploited by an attacker to leak Jira issues. Additional Analyst Notes: - CVE Program Container: References: - http
y be exploited by an attacker to leak Jira issues. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/360800 - https://hackerone.com/reports/1538068 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2499.json
CVE ID: CVE-2022-2500 State: PUBLISHED Published: 2022-08-05T15:12:34 Last Updated: 2024-08-03T00:39:07.807Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab Description: A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1. A stored XSS flaw in job error messages allows attackers to perform arbitrary actions on behalf of victims at client side. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitl
half of victims at client side. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/363725 - https://hackerone.com/reports/1579645 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2500.json
CVE ID: CVE-2022-2501 State: PUBLISHED Published: 2022-08-05T15:12:09 Last Updated: 2024-08-03T00:39:07.844Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper access control in GitLab Description: An improper access control issue in GitLab EE affecting all versions from 12.0 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 allows an attacker to bypass IP allow-listing and download artifacts. This attack only bypasses IP allow-listing, proper permissions are still required. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/364822 - https:/
nal Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/364822 - https://hackerone.com/reports/1591412 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2501.json
CVE ID: CVE-2022-2502 State: PUBLISHED Published: 2023-07-26T05:25:27.002Z Last Updated: 2025-03-05T18:47:06.707Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Hitachi Energy Products: RTU500 series Problem Types: CWE-20 Description: A vulnerability exists in the HCI IEC 60870-5-104 function included in certain versions of the RTU500 series product. The vulnerability can only be exploited, if the HCI 60870-5-104 is configured with support for IEC 62351-5 and the CMU contains the license feature ‘Advanced security’ which must be ordered separately. If these preconditions are fulfilled, an attacker could exploit the vulnerability by sending a specially crafted
rately. If these preconditions are fulfilled, an attacker could exploit the vulnerability by sending a specially crafted message to the RTU500, causing the targeted RTU500 CMU to reboot. The vulnerability is caused by a missing input data validation which eventually if exploited causes an internal buffer to overflow in the HCI IEC 60870-5-104 function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://publisher.hitachienergy.com/preview?DocumentID=8DBD000121&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2022-2503 State: PUBLISHED Published: 2022-08-12T00:00:00.000Z Last Updated: 2025-04-21T13:50:47.533Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N) Vendors: Linux Kernel Products: Linux Kernel Problem Types: CWE-302 Description: Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out the target with an equivalent dm-linear target and bypass verification till reboot. This allows root to bypass LoadPin and can be used to load untrusted and unverified kernel mo
verification till reboot. This allows root to bypass LoadPin and can be used to load untrusted and unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for peripherals that do not verify firmware updates. We recommend upgrading past commit 4caae58406f8ceb741603eee460d79bacca9b1b5 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/google/security-research/security/advisories/GHSA-6vq3-w69p-w63m - https://security.netapp.com/advisory/ntap-20230214-0005/
CVE ID: CVE-2022-2504 State: PUBLISHED Published: 2023-02-23T11:33:24.705Z Last Updated: 2024-08-03T00:39:07.889Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SDD Computer Software Products: SDD-Baro Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SDD Computer Software SDD-Baro allows SQL Injection.This issue affects SDD-Baro: before 2.8.432. Additional Analyst Notes: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-23-0107
CVE ID: CVE-2022-2505 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T14:59:30.642Z Vendors: Mozilla Products: Firefox ESR, Firefox, Thunderbird Problem Types: Memory safety bugs fixed in Firefox 103 and 102.1 Description: Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 102. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 102.1, Firefox < 103, and Thunderbird < 102.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www
underbird < 102.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-28/ - https://www.mozilla.org/security/advisories/mfsa2022-30/ - https://www.mozilla.org/security/advisories/mfsa2022-32/ - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1769739%2C1772824
CVE ID: CVE-2022-2507 State: PUBLISHED Published: 2023-04-19T00:00:00.000Z Last Updated: 2025-02-05T15:50:48.042Z Vendors: Octopus Deploy Products: Octopus Server Problem Types: Weak Content Security Policy Header Description: In affected versions of Octopus Deploy it is possible to render user supplied input into the webpage Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://advisories.octopus.com/post/2023/sa2023-06/
CVE ID: CVE-2022-2508 State: PUBLISHED Published: 2022-10-27T00:00:00.000Z Last Updated: 2025-05-07T13:30:24.572Z Vendors: Octopus Deploy Products: Octopus Server Problem Types: Information Exposure Description: In affected versions of Octopus Server it is possible to reveal the existence of resources in a space that the user does not have access to due to verbose error messaging. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://advisories.octopus.com/post/2022/sa2022-22/
CVE ID: CVE-2022-2509 State: PUBLISHED Published: 2022-08-01T14:01:10 Last Updated: 2024-08-03T00:39:07.997Z Vendors: n/a Products: GnuTLS Problem Types: Double Free Description: A vulnerability found in gnutls. This security flaw happens because of a double free error occurs during verification of pkcs7 signatures in gnutls_pkcs7_verify function. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2022-2509 - https://lists.gnupg.org/pipermail/gnutls-help/2022-July/004746.html - https://www.debian.org/security/2022/dsa-5203 - https://lists.debian.org/debian-lts-announce/2022/08/msg00002.html - https://lists.fedoraproject.org/archives/li
-5203 - https://lists.debian.org/debian-lts-announce/2022/08/msg00002.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6FL27JS3VM74YEQU7PGB62USO3KSBYZX/
CVE ID: CVE-2022-2510 State: PUBLISHED Published: 2022-07-22T15:57:13.504012Z Last Updated: 2024-09-16T16:38:23.076Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Hallo Welt! GmbH Products: BlueSpice Problem Types: CWE-79 Description: Cross-site Scripting (XSS) vulnerability in "Extension:ExtendedSearch" of Hallo Welt! GmbH BlueSpice allows attacker to inject arbitrary HTML (XSS) on page "Special:SearchCenter", using the search term in the URL. Additional Analyst Notes: - CVE Program Container: References: - https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-01
CVE ID: CVE-2022-2511 State: PUBLISHED Published: 2022-07-22T15:56:23.016618Z Last Updated: 2024-09-17T01:56:03.334Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Hallo Welt! GmbH Products: BlueSpice Problem Types: CWE-79 Description: Cross-site Scripting (XSS) vulnerability in the "commonuserinterface" component of BlueSpice allows an attacker to inject arbitrary HTML into a page using the title parameter of the call URL. Additional Analyst Notes: - CVE Program Container: References: - https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-02
CVE ID: CVE-2022-2512 State: PUBLISHED Published: 2022-08-05T15:09:47 Last Updated: 2024-08-03T00:39:07.942Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper access control in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.0 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. Membership changes are not reflected in TODO for confidential notes, allowing a former project members to read updates via TODOs. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gi
ead updates via TODOs. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/365742 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2512.json
CVE ID: CVE-2022-2513 State: PUBLISHED Published: 2022-11-22T10:30:34.309Z Last Updated: 2025-08-27T20:32:51.508Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Hitachi Energy Products: PCM600, 670 Connectivity Package, 650 Connectivity Package, SAM600-IO Connectivity Package, GMS600 Connectivity Package, PWC600 Connectivity Package Problem Types: CWE-312 Description: A vulnerability exists in the Intelligent Electronic Device (IED) Connectivity Package (ConnPack) credential storage function in Hitachi Energy’s PCM600 product included in the versions listed below, where IEDs credentials are stored in a cleartext format in the PCM600 database and logs files. A
versions listed below, where IEDs credentials are stored in a cleartext format in the PCM600 database and logs files. An attacker having get access to the exported backup file can exploit the vulnerability and obtain user credentials of the IEDs. Additionally, an attacker with administrator access to the PCM600 host machine can obtain other user credentials by analyzing database log files. The credentials may be used to perform unauthorized modifications such as loading incorrect configurations, reboot the IEDs or cause a denial-of-service on the IEDs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://publisher.hitachienergy.com/preview?Docume
otes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://publisher.hitachienergy.com/preview?DocumentID=8DBD000120&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2022-2514 State: PUBLISHED Published: 2022-07-25T13:42:34 Last Updated: 2024-08-03T00:39:08.013Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: beancount Products: beancount/fava Problem Types: CWE-79 Description: The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected XSS due to the lack of escaping of error messages which contained the parameters in verbatim. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/dbf77139-4384-4dc5-9994-45a5e0747429 - https://github.com/beancount/fava/commit/ca9e3882c7b5fbf5273ba52340b9fea6a99f3711
CVE ID: CVE-2022-2515 State: PUBLISHED Published: 2022-09-06T17:18:58.000Z Last Updated: 2025-05-05T16:18:18.824Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: rpetersen29 Products: Simple Banner – An easy to use Banner/Bar/Notification/Announcement for the top or bottom of your website Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Simple Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `pro_version_activation_code` parameter in versions up to, and including, 2.11.0 due to insufficient input sanitization and output escaping. This makes it possible
ersions up to, and including, 2.11.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, including those without administrative capabilities when access is granted to those users, to inject arbitrary web scripts in page that will execute whenever a user role having access to "Simple Banner" accesses the plugin's settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3bb9520d-e679-4e8a-ae3c-8207f17d45a2?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2758766%40simple-banner&new=2758766%4
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2758766%40simple-banner&new=2758766%40simple-banner&sfp_email=&sfph_mail= - https://gist.github.com/Xib3rR4dAr/6aa9e730c1d030a5ee9f9d1eae6fbd5e - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2515
CVE ID: CVE-2022-2516 State: PUBLISHED Published: 2022-09-06T17:18:58.000Z Last Updated: 2025-02-13T20:45:04.030Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: visualcomposer Products: Visual Composer Website Builder, Landing Page Builder, Custom Theme Builder, Maintenance Mode & Coming Soon Pages Problem Types: CWE-79 Description: The Visual Composer Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post/page 'Title' value in versions up to, and including, 45.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with access to the visual composer editor to i
n and output escaping. This makes it possible for authenticated attackers with access to the visual composer editor to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2778808%40visualcomposer&new=2778808%40visualcomposer&sfp_email=&sfph_mail= - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2516
CVE ID: CVE-2022-2517 State: PUBLISHED Published: 2022-09-06T17:18:58.000Z Last Updated: 2025-02-13T20:44:46.653Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: justinbusa Products: Beaver Builder – WordPress Page Builder Problem Types: CWE-79 Description: The Beaver Builder – WordPress Page Builder for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Caption - On Hover' value associated with images in versions up to, and including, 2.5.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with access to the Beaver Builder editor to inject arbitrary web scripts in pages that will ex