Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-2335 State: PUBLISHED Published: 2022-08-17T20:13:15.000Z Last Updated: 2025-04-16T16:13:08.268Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Softing Products: Secure Integration Server Problem Types: CWE-191 Description: A crafted HTTP packet with a -1 content-length header can create a denial-of-service condition in Softing Secure Integration Server V1.22. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-4.html - https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-04
CVE ID: CVE-2022-2336 State: PUBLISHED Published: 2022-08-17T20:07:46.000Z Last Updated: 2025-04-16T16:13:22.673Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Softing Products: Secure Integration Server, edgeConnector Siemens, edgeConnector 840D, edgeConnector Modbus, edgeAggregator Problem Types: CWE-287 Description: Softing Secure Integration Server, edgeConnector, and edgeAggregator software ships with the default administrator credentials as `admin` and password as `admin`. This allows Softing to log in to the server directly to perform administrative functions. Upon installation or upon first login, the application does not ask the user to change t
rform administrative functions. Upon installation or upon first login, the application does not ask the user to change the `admin` password. There is no warning or prompt to ask the user to change the default password, and to change the password, many steps are required. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-04 - https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-6.html
CVE ID: CVE-2022-2337 State: PUBLISHED Published: 2022-08-17T20:18:49.000Z Last Updated: 2025-04-16T16:12:45.794Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Softing Products: Secure Integration Server Problem Types: CWE-476 Description: A crafted HTTP packet with a missing HTTP URI can create a denial-of-service condition in Softing Secure Integration Server V1.22. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-4.html - https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-04
CVE ID: CVE-2022-2338 State: PUBLISHED Published: 2022-08-17T20:15:03.000Z Last Updated: 2025-04-16T16:12:59.993Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Softing Products: Secure Integration Server Problem Types: CWE-319 Description: Softing Secure Integration Server V1.22 is vulnerable to authentication bypass via a machine-in-the-middle attack. The default the administration interface is accessible via plaintext HTTP protocol, facilitating the attack. The HTTP request may contain the session cookie in the request, which may be captured for use in authenticating to the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichmen
tured for use in authenticating to the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-04 - https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-5.html
CVE ID: CVE-2022-2339 State: PUBLISHED Published: 2022-07-07T03:15:12 Last Updated: 2024-08-03T00:32:09.612Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) Vendors: nocodb Products: nocodb/nocodb Problem Types: CWE-918 Description: With this SSRF vulnerability, an attacker can reach internal addresses to make a request as the server and read it's contents. This attack can lead to leak of sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/fff06de8-2a82-49b1-8e81-968731e87eef - https://github.com/nocodb/nocodb/commit/000ecd886738b965b5997cd905825e3244f48b95
CVE ID: CVE-2022-2340 State: PUBLISHED Published: 2022-07-25T12:48:23 Last Updated: 2024-08-03T00:32:09.356Z Vendors: Unknown Products: W-DALIL Problem Types: CWE-79 Description: The W-DALIL WordPress plugin through 2.0 does not sanitise and escape some of its fields, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/306ea895-0b90-4276-bb97-eecb34f9bfae - https://packetstormsecurity.com/files/167595/
CVE ID: CVE-2022-2341 State: PUBLISHED Published: 2022-07-25T12:48:36 Last Updated: 2024-08-03T00:32:09.764Z Vendors: Unknown Products: Simple Page Transition Problem Types: CWE-79 Description: The Simple Page Transition WordPress plugin through 1.4.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/4a98a024-1f84-482f-9dc9-4714ac42c094 - https://packetstormsecurity.com/files/167597/
CVE ID: CVE-2022-2342 State: PUBLISHED Published: 2022-07-07T10:10:10 Last Updated: 2024-08-03T00:32:09.879Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: outline Products: outline/outline Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository outline/outline prior to v0.64.4. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/b2caceaa-5b28-40ba-9980-70144159efba - https://github.com/outline/outline/commit/85657b7340cdeaa696034f294489df8d6a4914d3
CVE ID: CVE-2022-2343 State: PUBLISHED Published: 2022-07-08T00:00:00 Last Updated: 2024-08-03T00:32:09.611Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-122 Description: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0044. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/2ecb4345-2fc7-4e7f-adb0-83a20bb458f5 - https://github.com/vim/vim/commit/caea66442d86e7bbba3bf3dc202c3c0d549b9853 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/43Y3VJPOTTY3NTREDIFUPITM2POG4ZLP/ - https://security.gentoo.org/glsa/2022
age-announce%40lists.fedoraproject.org/message/43Y3VJPOTTY3NTREDIFUPITM2POG4ZLP/ - https://security.gentoo.org/glsa/202208-32 - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2022-2344 State: PUBLISHED Published: 2022-07-08T00:00:00 Last Updated: 2024-08-03T00:32:09.510Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-122 Description: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0045. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/4a095ed9-3125-464a-b656-c31b437e1996 - https://github.com/vim/vim/commit/baefde14550231f6468ac2ed2ed495bc381c0c92 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/43Y3VJPOTTY3NTREDIFUPITM2POG4ZLP/ - https://security.gentoo.org/glsa/2022
CVE ID: CVE-2022-2345 State: PUBLISHED Published: 2022-07-08T00:00:00 Last Updated: 2024-08-03T00:32:09.701Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-416 Description: Use After Free in GitHub repository vim/vim prior to 9.0.0046. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/1eed7009-db6d-487b-bc41-8f2fd260483f - https://github.com/vim/vim/commit/32acf1f1a72ebb9d8942b9c9d80023bf1bb668ea - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/43Y3VJPOTTY3NTREDIFUPITM2POG4ZLP/ - https://security.gentoo.org/glsa/202208-32 - http
%40lists.fedoraproject.org/message/43Y3VJPOTTY3NTREDIFUPITM2POG4ZLP/ - https://security.gentoo.org/glsa/202208-32 - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2022-2346 State: PUBLISHED Published: 2023-08-02T01:09:01.761Z Last Updated: 2024-10-11T14:08:43.852Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: Octopus Deploy Products: Octopus Server Problem Types: Guest user with low permissions able to interact with extension endpoints Description: In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact with extension endpoints. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://advisories.octopus.com/post/2023/sa2023-10/
CVE ID: CVE-2022-2347 State: PUBLISHED Published: 2022-09-23T12:50:08.787Z Last Updated: 2025-11-03T19:26:52.354Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Uboot Products: Uboot Problem Types: CWE-122 Description: There exists an unchecked length field in UBoot. The U-Boot DFU implementation does not bound the length field in USB DFU download setup packets, and it does not verify that the transfer direction corresponds to the specified command. Consequently, if a physical attacker crafts a USB DFU download setup packet with a `wLength` greater than 4096 bytes, they can write beyond the heap-allocated request buffer. Additional Analyst Notes: - CVE Progra
greater than 4096 bytes, they can write beyond the heap-allocated request buffer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://seclists.org/oss-sec/2022/q3/41
CVE ID: CVE-2022-2348 State: REJECTED Published: N/A Last Updated: 2022-12-30T00:00:00 Description: No description available.
CVE ID: CVE-2022-2349 State: REJECTED Published: N/A Last Updated: 2022-12-30T00:00:00 Description: No description available.
CVE ID: CVE-2022-2350 State: PUBLISHED Published: 2022-10-10T00:00:00 Last Updated: 2024-08-03T00:32:09.701Z Vendors: Unknown Products: Disable User Login Problem Types: CWE-862, CWE-352 Description: The Disable User Login WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating its settings, allowing unauthenticated attackers to block (or unblock) users at will. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/de28543b-c110-4a9f-bfe9-febccfba3a96
CVE ID: CVE-2022-2351 State: PUBLISHED Published: 2022-09-16T08:40:27 Last Updated: 2024-08-03T00:32:09.569Z Vendors: Unknown Products: Post SMTP Mailer/Email Log Problem Types: CWE-79 Description: The Post SMTP Mailer/Email Log WordPress plugin before 2.1.4 does not escape some of its settings before outputting them in the admins dashboard, allowing high privilege users to perform Cross-Site Scripting attacks against other users even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f3fda033-58f5-446d-ade4-2336a39bfb87
CVE ID: CVE-2022-2352 State: PUBLISHED Published: 2022-09-26T12:35:32.000Z Last Updated: 2025-05-21T19:21:14.244Z Vendors: Unknown Products: Post SMTP Mailer/Email Log Problem Types: CWE-918 Description: The Post SMTP Mailer/Email Log WordPress plugin before 2.1.7 does not have proper authorisation in some AJAX actions, which could allow high privilege users such as admin to perform blind SSRF on multisite installations for example. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/dc99ac40-646a-4f8e-b2b9-dc55d6d4c55c
CVE ID: CVE-2022-2353 State: PUBLISHED Published: 2022-07-09T00:00:00 Last Updated: 2024-08-03T00:32:09.612Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: microweber Products: microweber/microweber Problem Types: CWE-352 Description: Prior to microweber/microweber v1.2.20, due to improper neutralization of input, an attacker can steal tokens to perform cross-site request forgery, fetch contents from same-site and redirect a user. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/7782c095-9e8c-48b0-a7f5-3a8f52e8af52 - https://github.com/microweber/microweber/commit/79c6914bab8c9da07ac950fda17648d08c68b130
CVE ID: CVE-2022-2354 State: PUBLISHED Published: 2022-08-15T08:36:54 Last Updated: 2024-08-03T00:32:09.812Z Vendors: Unknown Products: WP-DBManager Problem Types: CWE-863 Incorrect Authorization Description: The WP-DBManager WordPress plugin before 2.80.8 does not prevent administrators from running arbitrary commands on the server in multisite installations, where only super-administrators should. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/1c8c5861-ce87-4813-9e26-470d63c1903a
CVE ID: CVE-2022-2355 State: PUBLISHED Published: 2022-08-08T13:46:33.000Z Last Updated: 2025-08-27T18:39:38.353Z Vendors: Unknown Products: Easy Username Updater Problem Types: CWE-352 Description: The Easy Username Updater WordPress plugin before 1.0.5 does not implement CSRF checks, which could allow attackers to make a logged in admin change any user's username includes the admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/426b5a0f-c16d-429a-9396-b3aea7922826
CVE ID: CVE-2022-2356 State: PUBLISHED Published: 2022-08-08T13:46:51 Last Updated: 2024-08-03T00:32:09.645Z Vendors: Unknown Products: Frontend File Manager & Sharing – User Private Files Problem Types: CWE-434 Description: The Frontend File Manager & Sharing WordPress plugin before 1.1.3 does not filter file extensions when letting users upload files on the server, which may lead to malicious code being uploaded. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/67f3948e-27d4-47a8-8572-616143b9cf43
CVE ID: CVE-2022-2357 State: PUBLISHED Published: 2022-08-08T13:47:08 Last Updated: 2024-08-03T00:32:09.411Z Vendors: Unknown Products: WSM Downloader Problem Types: CWE-552 Description: The WSM Downloader WordPress plugin through 1.4.0 allows any visitor to use its remote file download feature to download any local files, including sensitive ones like wp-config.php. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/42499b84-684e-42e1-b7f0-de206d4da553
CVE ID: CVE-2022-2361 State: PUBLISHED Published: 2022-08-22T15:01:30 Last Updated: 2024-08-03T00:32:09.618Z Vendors: Unknown Products: WP Social Chat – Click To Chat App Problem Types: CWE-79 Description: The WP Social Chat WordPress plugin before 6.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/aa69377d-ba9e-4a2f-921c-be2ab5edcb4e
CVE ID: CVE-2022-2362 State: PUBLISHED Published: 2022-08-22T15:01:39 Last Updated: 2024-08-03T00:32:09.513Z Vendors: Unknown Products: Download Manager Problem Types: CWE-79 Description: The Download Manager WordPress plugin before 3.2.50 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based download blocking restrictions. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d94b721e-9ce2-45e5-a673-2a57b0137653
CVE ID: CVE-2022-2363 State: PUBLISHED Published: 2022-07-12T16:23:41.000Z Last Updated: 2025-04-15T14:07:10.159Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: SourceCodester Products: Simple Parking Management System Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in SourceCodester Simple Parking Management System 1.0. Affected by this issue is some unknown functionality of the file /ci_spms/admin/search/searching/. The manipulation of the argument search with the input "><script>alert("XSS")</script> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to t
("XSS")</script> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/CyberThoth/CVE/blob/eea3090b960da014312f7ad4b09aa58d23966d77/CVE/Simple%20Parking%20Management%20System/Cross%20Site%20Scripting%28Refelected%29/POC.md - https://vuldb.com/?id.203420
CVE ID: CVE-2022-2364 State: PUBLISHED Published: 2022-07-12T16:23:58.000Z Last Updated: 2025-04-15T14:07:01.422Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: SourceCodester Products: Simple Parking Management System Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in SourceCodester Simple Parking Management System 1.0. This affects an unknown part of the file /ci_spms/admin/category. The manipulation of the argument vehicle_type with the input "><script>alert("XSS")</script> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be
site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/CyberThoth/CVE/blob/eea3090b960da014312f7ad4b09aa58d23966d77/CVE/Simple%20Parking%20Management%20System/Cross%20Site%20Scripting%28Stored%29/POC.md - https://vuldb.com/?id.203421
CVE ID: CVE-2022-2365 State: PUBLISHED Published: 2022-07-10T21:50:10 Last Updated: 2024-08-03T00:32:09.698Z Severity: MEDIUM (CVSS 4 CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: zadam Products: zadam/trilium Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository zadam/trilium prior to 0.53.3. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/34b281cd-ff4a-4ab0-ae25-56aef557682f - https://github.com/zadam/trilium/commit/1dfc37704fdd90ab7afbd8a586bdfc5cfaadeb8a
CVE ID: CVE-2022-2366 State: PUBLISHED Published: 2022-07-11T14:08:50 Last Updated: 2024-12-06T23:08:46.139Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-276 Description: Incorrect default configuration for trusted IP header in Mattermost version 6.7.0 and earlier allows attacker to bypass some of the rate limitations in place or use manipulated IPs for audit logging via manipulating the request headers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates/
CVE ID: CVE-2022-2367 State: PUBLISHED Published: 2022-08-08T13:47:24 Last Updated: 2024-08-03T00:32:09.766Z Vendors: Unknown Products: WSM Downloader Problem Types: CWE-639 Description: The WSM Downloader WordPress plugin through 1.4.0 allows only specific popular websites to download images/files from, this can be bypassed due to the lack of good "link" parameter validation Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/46afb0c6-2d0c-4a20-a9de-48f35ca93f0f
CVE ID: CVE-2022-2368 State: PUBLISHED Published: 2022-07-11T08:00:13 Last Updated: 2024-08-03T00:32:09.607Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: microweber Products: microweber/microweber Problem Types: CWE-290 Description: Authentication Bypass by Spoofing in GitHub repository microweber/microweber prior to 1.2.20. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/a9595eda-a5e0-4717-8d64-b445ef83f452 - https://github.com/microweber/microweber/commit/53c000ccd5602536e28b15d9630eb8261b04a302
CVE ID: CVE-2022-2369 State: PUBLISHED Published: 2022-08-01T12:52:42 Last Updated: 2024-08-03T00:32:09.470Z Vendors: Unknown Products: YaySMTP – Simple WP SMTP Mail Problem Types: CWE-862 Description: The YaySMTP WordPress plugin before 2.2.1 does not have capability check in an AJAX action, allowing any logged in users, such as subscriber to view the Logs of the plugin Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/9ec8d318-9d25-4868-94c6-7c16444c275d
CVE ID: CVE-2022-2370 State: PUBLISHED Published: 2022-08-01T12:52:51 Last Updated: 2024-08-03T00:32:09.695Z Vendors: Unknown Products: YaySMTP Problem Types: CWE-862 Missing Authorization Description: The YaySMTP WordPress plugin before 2.2.1 does not have capability check before displaying the Mailer Credentials in JS code for the settings, allowing any authenticated users, such as subscriber to retrieve them Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/bedda2a9-6c52-478e-b17a-7a4488419334
CVE ID: CVE-2022-2371 State: PUBLISHED Published: 2022-08-08T13:47:39 Last Updated: 2024-08-03T00:32:09.561Z Vendors: Unknown Products: YaySMTP – Simple WP SMTP Mail Problem Types: CWE-79 Description: The YaySMTP WordPress plugin before 2.2.1 does not have proper authorisation when saving its settings, allowing users with a role as low as subscriber to change them, and use that to conduct Stored Cross-Site Scripting attack due to the lack of escaping in them as well. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/31405f1e-fc07-43f5-afc1-9cfbaf6911b7
CVE ID: CVE-2022-2372 State: PUBLISHED Published: 2022-08-08T13:47:54 Last Updated: 2024-08-03T00:32:09.568Z Vendors: Unknown Products: YaySMTP – Simple WP SMTP Mail Problem Types: CWE-79 Description: The YaySMTP WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/941fadb6-0009-4751-b979-88e87ebb1e45
CVE ID: CVE-2022-2373 State: PUBLISHED Published: 2022-08-29T17:15:35 Last Updated: 2024-08-03T00:32:09.698Z Vendors: Unknown Products: Simply Schedule Appointments – WordPress Booking Plugin Problem Types: CWE-862 Description: The Simply Schedule Appointments WordPress plugin before 1.5.7.7 is missing authorisation in a REST endpoint, allowing unauthenticated users to retrieve WordPress users details such as name and email address Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/6aa9aa0d-b447-4584-a07e-b8a0d1b83a31
CVE ID: CVE-2022-2374 State: PUBLISHED Published: 2022-08-29T17:15:36 Last Updated: 2024-08-03T00:32:09.669Z Vendors: Unknown Products: Simply Schedule Appointments – WordPress Booking Plugin Problem Types: CWE-79 Description: The Simply Schedule Appointments WordPress plugin before 1.5.7.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/12062d78-7a0d-4dc1-9bd6-6c54aa6bc761