Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-4928 State: PUBLISHED Published: 2023-03-06T01:00:05.340Z Last Updated: 2024-08-03T01:55:46.064Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: n/a Products: icplayer Problem Types: CWE-79 Description: A vulnerability was found in icplayer up to 0.819. It has been declared as problematic. Affected by this vulnerability is the function AddonText_Selection_create of the file addons/Text_Selection/src/presenter.js. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 0.820 is able to address this issue. The identifier of the patch is 2223628e6db1df73f6d633d2c0422d995990f0a3. It is recommended to upgrade the affect
issue. The identifier of the patch is 2223628e6db1df73f6d633d2c0422d995990f0a3. It is recommended to upgrade the affected component. The identifier VDB-222289 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.222289 - https://vuldb.com/?ctiid.222289 - https://github.com/icplayer/icplayer/pull/881 - https://github.com/icplayer/icplayer/commit/2223628e6db1df73f6d633d2c0422d995990f0a3 - https://github.com/icplayer/icplayer/releases/tag/v0.820
CVE ID: CVE-2022-4929 State: PUBLISHED Published: 2023-03-06T02:31:04.497Z Last Updated: 2024-08-03T01:55:46.032Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: n/a Products: icplayer Problem Types: CWE-79 Description: A vulnerability was found in icplayer up to 0.818. It has been rated as problematic. Affected by this issue is some unknown functionality of the file addons/Commons/src/tts-utils.js. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 0.819 is able to address this issue. The patch is identified as fa785969f213c76384f1fe67d47b17d57fcc60c8. It is recommended to upgrade the affected component. VDB-222290 is the ide
as fa785969f213c76384f1fe67d47b17d57fcc60c8. It is recommended to upgrade the affected component. VDB-222290 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.222290 - https://vuldb.com/?ctiid.222290 - https://github.com/icplayer/icplayer/pull/885 - https://github.com/icplayer/icplayer/commit/fa785969f213c76384f1fe67d47b17d57fcc60c8 - https://github.com/icplayer/icplayer/releases/tag/v0.819
CVE ID: CVE-2022-4930 State: PUBLISHED Published: 2023-03-06T15:31:04.748Z Last Updated: 2025-03-05T19:40:38.305Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: nuxsmin Products: sysPass Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in nuxsmin sysPass up to 3.2.4. Affected by this vulnerability is an unknown functionality of the component URL Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 3.2.5 is able to address this issue. The patch is named 4da4d031732ecca67519851fd0c34597dbb8ee55. It is recommended to upgrade the affected component. The associated identifier of this vu
ecca67519851fd0c34597dbb8ee55. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-222319. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.222319 - https://vuldb.com/?ctiid.222319 - https://github.com/nuxsmin/sysPass/pull/1832 - https://github.com/nuxsmin/sysPass/commit/4da4d031732ecca67519851fd0c34597dbb8ee55 - https://github.com/nuxsmin/sysPass/releases/tag/3.2.5
CVE ID: CVE-2022-4931 State: PUBLISHED Published: 2023-03-07T14:43:32.933Z Last Updated: 2025-01-13T17:01:17.948Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: willmot Products: BackUpWordPress Problem Types: CWE-862 Missing Authorization Description: The BackupWordPress plugin for WordPress is vulnerable to information disclosure in versions up to, and including 3.12. This is due to missing authorization on the heartbeat_received() function that triggers on WordPress heartbeat. This makes it possible for authenticated attackers, with subscriber-level permissions and above to retrieve back-up paths that can subsequently be used to download the back-up. Add
scriber-level permissions and above to retrieve back-up paths that can subsequently be used to download the back-up. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/747c86f4-118b-4a9c-899c-e9067d2c7a02 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2683799%40backupwordpress&new=2683799%40backupwordpress&sfp_email=&sfph_mail=
CVE ID: CVE-2022-4932 State: PUBLISHED Published: 2023-03-07T14:47:47.177Z Last Updated: 2025-01-13T17:01:08.575Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: boldgrid Products: Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid Problem Types: CWE-862 Missing Authorization Description: The Total Upkeep plugin for WordPress is vulnerable to information disclosure in versions up to, and including 1.14.13. This is due to missing authorization on the heartbeat_received() function that triggers on WordPress heartbeat. This makes it possible for authenticated attackers, with subscriber-level permissions and above to retrieve back-up paths
his makes it possible for authenticated attackers, with subscriber-level permissions and above to retrieve back-up paths that can subsequently be used to download the back-up. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0e346146-1c00-4e03-a6c7-372566d7ffc9 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2684462%40boldgrid-backup&new=2684462%40boldgrid-backup&sfp_email=&sfph_mail=
CVE ID: CVE-2022-4933 State: PUBLISHED Published: 2023-03-20T04:31:04.242Z Last Updated: 2024-08-03T01:55:46.050Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: ATM Consulting Products: dolibarr_module_quicksupplierprice Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in ATM Consulting dolibarr_module_quicksupplierprice up to 1.1.6. Affected by this issue is the function upatePrice of the file script/interface.php. The manipulation leads to sql injection. The attack may be launched remotely. Upgrading to version 1.1.7 is able to address this issue. The patch is identified as ccad1e4282b0e393a32fcc852e82ec0e0af5446f. It is rec
sion 1.1.7 is able to address this issue. The patch is identified as ccad1e4282b0e393a32fcc852e82ec0e0af5446f. It is recommended to upgrade the affected component. VDB-223382 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.223382 - https://vuldb.com/?ctiid.223382 - https://github.com/ATM-Consulting/dolibarr_module_quicksupplierprice/pull/21 - https://github.com/ATM-Consulting/dolibarr_module_quicksupplierprice/commit/ccad1e4282b0e393a32fcc852e82ec0e0af5446f
CVE ID: CVE-2022-4934 State: PUBLISHED Published: 2023-04-04T00:00:00.000Z Last Updated: 2025-02-11T14:27:10.555Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Sophos Products: Sophos Web Appliance Problem Types: n/a Description: A post-auth command injection vulnerability in the exception wizard of Sophos Web Appliance older than version 4.3.10.4 allows administrators to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sophos.com/en-us/security-advisories/sophos-sa-20230404-swa-rce
CVE ID: CVE-2022-4935 State: PUBLISHED Published: 2023-04-05T17:27:39.743Z Last Updated: 2025-01-13T16:55:22.020Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: wclovers Products: WCFM Marketplace – Best Multivendor Marketplace for WooCommerce Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The WCFM Marketplace plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 3.4.11 due to missing capability checks on various AJAX actions. This makes it possible for authenticated attackers, with minimal permissions such as subscribers, to
rious AJAX actions. This makes it possible for authenticated attackers, with minimal permissions such as subscribers, to perform a wide variety of actions such as modifying shipping method details, modifying products, deleting arbitrary posts, and privilege escalation (via the wp_ajax_wcfm_vendor_store_online AJAX action). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/85730e9b-c5da-473c-a324-891c5c9f7ba3?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2630696%40wc-multivendor-marketplace&new=2630696%40wc-multivendor-marketplace&sfp_email=&sfph_ma
fph_mail=&reponame=&old=2630696%40wc-multivendor-marketplace&new=2630696%40wc-multivendor-marketplace&sfp_email=&sfph_mail=
CVE ID: CVE-2022-4936 State: PUBLISHED Published: 2023-04-05T17:27:54.412Z Last Updated: 2025-01-13T16:55:11.775Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: wclovers Products: WCFM Marketplace – Best Multivendor Marketplace for WooCommerce Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WCFM Marketplace plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.11 due to missing nonce checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of actions such as modifying shipping method details, modifying products, deleting arbitrary
s to perform a wide variety of actions such as modifying shipping method details, modifying products, deleting arbitrary posts, and more, via a forged request granted they can trick a site's administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5c2cc9a3-cd20-4c9e-baa4-1aea69f84331?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2632635%40wc-multivendor-marketplace&new=2632635%40wc-multivendor-marketplace&sfp_email=&sfph_mail=
CVE ID: CVE-2022-4937 State: PUBLISHED Published: 2023-04-05T17:40:18.027Z Last Updated: 2025-01-13T16:55:01.943Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: wclovers Products: WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible Problem Types: CWE-862 Missing Authorization Description: The WCFM Frontend Manager plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 6.6.0 due to missing capability checks on various AJAX actions. This makes it possible for authenticated attackers, with minimal permissions such as subscribers, to perform a wide variety of
kes it possible for authenticated attackers, with minimal permissions such as subscribers, to perform a wide variety of actions such as modifying knowledge bases, modifying notices, modifying payments, managing vendors, capabilities, and so much more. There were hundreds of AJAX endpoints affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d946d4b5-bed7-4808-b133-783b2dcd7992?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2630745%40wc-frontend-manager&new=2630745%40wc-frontend-manager&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.or
630745%40wc-frontend-manager&new=2630745%40wc-frontend-manager&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2629284%40wc-frontend-manager&new=2629284%40wc-frontend-manager&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2634199%40wc-frontend-manager&new=2634199%40wc-frontend-manager&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2633187%40wc-frontend-manager&new=2633187%40wc-frontend-manager&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2632630%40wc-frontend-man
&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2632630%40wc-frontend-manager&new=2632630%40wc-frontend-manager&sfp_email=&sfph_mail=
CVE ID: CVE-2022-4938 State: PUBLISHED Published: 2023-04-05T17:40:31.804Z Last Updated: 2025-01-13T16:54:52.695Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: wclovers Products: WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WCFM Frontend Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.6.0 due to missing nonce checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of actions such as modifying knowledge bases, modifying not
ible for unauthenticated attackers to perform a wide variety of actions such as modifying knowledge bases, modifying notices, modifying payments, managing vendors, capabilities, and so much more, via a forged request granted they can trick a site's administrator into performing an action such as clicking on a link. There were hundreds of AJAX endpoints affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/798b57ad-0922-435c-8b4d-8a96b388b314?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2632630%40wc-frontend-manager&new=2632630%40wc-frontend-
rac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2632630%40wc-frontend-manager&new=2632630%40wc-frontend-manager&sfp_email=&sfph_mail=
CVE ID: CVE-2022-4939 State: PUBLISHED Published: 2023-04-05T18:00:30.235Z Last Updated: 2025-01-13T16:54:42.803Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: wclovers Products: WCFM Membership – WooCommerce Memberships for Multivendor Marketplace Problem Types: CWE-862 Missing Authorization Description: THe WCFM Membership plugin for WordPress is vulnerable to privilege escalation in versions up to, and including 2.10.0, due to a missing capability check on the wp_ajax_nopriv_wcfm_ajax_controller AJAX action that controls membership settings. This makes it possible for unauthenticated attackers to modify the membership registration form in a way that a
ettings. This makes it possible for unauthenticated attackers to modify the membership registration form in a way that allows them to set the role for registration to that of any user including administrators. Once configured, the attacker can then register as an administrator. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0870de2d-bca5-4d57-a07f-877a416ce0d5?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2633191%40wc-multivendor-membership&new=2633191%40wc-multivendor-membership&sfp_email=&sfph_mail=
CVE ID: CVE-2022-4940 State: PUBLISHED Published: 2023-04-05T18:00:39.715Z Last Updated: 2025-01-13T16:54:33.384Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: wclovers Products: WCFM Membership – WooCommerce Memberships for Multivendor Marketplace Problem Types: CWE-862 Missing Authorization Description: The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 2.10.0 due to missing capability checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of actions such as modifying membership details, changing renewal information,
cated attackers to perform a wide variety of actions such as modifying membership details, changing renewal information, controlling membership approvals, and more. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9c6577a2-6722-4d3b-958d-1143dca414cd?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2633191%40wc-multivendor-membership&new=2633191%40wc-multivendor-membership&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2632641%40wc-multivendor-membership&new=2632641%40wc-multivendor-membership
hangeset?sfp_email=&sfph_mail=&reponame=&old=2632641%40wc-multivendor-membership&new=2632641%40wc-multivendor-membership&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2605020%40wc-multivendor-membership&new=2605020%40wc-multivendor-membership&sfp_email=&sfph_mail=
CVE ID: CVE-2022-4941 State: PUBLISHED Published: 2023-04-05T18:00:49.094Z Last Updated: 2025-01-13T16:54:23.879Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: wclovers Products: WCFM Membership – WooCommerce Memberships for Multivendor Marketplace Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WCFM Membership plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.9.10 due to missing nonce checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of actions such as modifying membership details, changing renewal information, controll
ackers to perform a wide variety of actions such as modifying membership details, changing renewal information, controlling membership approvals, and more, via a forged request granted they can trick a site's administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3758db41-a3c5-436a-bb9a-5886f10d1519?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2605020%40wc-multivendor-membership&new=2605020%40wc-multivendor-membership&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset
-membership&new=2605020%40wc-multivendor-membership&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2632641%40wc-multivendor-membership&new=2632641%40wc-multivendor-membership&sfp_email=&sfph_mail=
CVE ID: CVE-2022-4942 State: PUBLISHED Published: 2023-04-20T05:31:04.715Z Last Updated: 2024-08-03T01:55:46.139Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: mportuga Products: eslint-detailed-reporter Problem Types: CWE-79 Description: A vulnerability was found in mportuga eslint-detailed-reporter up to 0.9.0 and classified as problematic. Affected by this issue is the function renderIssue in the library lib/template-generator.js. The manipulation of the argument message leads to cross site scripting. The attack may be launched remotely. The patch is identified as 505c190efd4905990db6207863bdcbd9b1d7e1bd. It is recommended to apply a patch to fix this issue. VDB-226310 is the
ied as 505c190efd4905990db6207863bdcbd9b1d7e1bd. It is recommended to apply a patch to fix this issue. VDB-226310 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.226310 - https://vuldb.com/?ctiid.226310 - https://github.com/mportuga/eslint-detailed-reporter/pull/46 - https://github.com/mportuga/eslint-detailed-reporter/commit/505c190efd4905990db6207863bdcbd9b1d7e1bd
CVE ID: CVE-2022-4943 State: PUBLISHED Published: 2023-10-20T07:29:21.001Z Last Updated: 2024-09-16T18:14:57.040Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: cyberlord92 Products: miniOrange&#039;s Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email | Passwordless login Problem Types: CWE-862 Missing Authorization Description: The miniOrange's Google Authenticator plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when changing plugin settings in versions up to, and including, 5.6.5. This makes it possible for unauthenticated attackers to change the plugin's settings. Ad
ns up to, and including, 5.6.5. This makes it possible for unauthenticated attackers to change the plugin's settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7267ede1-7745-47cc-ac0d-4362140b4c23?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2842228%40miniorange-2-factor-authentication%2Ftrunk&old=2815645%40miniorange-2-factor-authentication%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2022-4944 State: PUBLISHED Published: 2023-04-22T18:00:05.128Z Last Updated: 2024-08-03T01:55:46.137Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: kalcaddle Products: KodExplorer Problem Types: CWE-352 Description: A vulnerability, which was classified as problematic, has been found in kalcaddle KodExplorer up to 4.49. Affected by this issue is some unknown functionality. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.50 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability
is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-227000. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.227000 - https://vuldb.com/?ctiid.227000 - https://github.com/kalcaddle/KodExplorer/issues/512 - https://www.mediafire.com/file/709i2vxybergtg7/poc.zip/file - https://github.com/kalcaddle/KodExplorer/releases/tag/4.50
CVE ID: CVE-2022-4945 State: PUBLISHED Published: 2023-05-22T21:15:33.441Z Last Updated: 2025-01-16T21:32:47.379Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Dataprobe, Inc. Products: Dataprobe iBoot-PDU FW Problem Types: CWE-256 Plaintext Storage of a Password Description: The Dataprobe cloud usernames and passwords are stored in plain text in a specific file. Any user able to read this specific file from the device could compromise other devices connected to the user's cloud. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-22-263-03 - https://dataprobe.com/su
DP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-22-263-03 - https://dataprobe.com/support/iboot-pdu/local_upgrade_pdu_procedure.pdf
CVE ID: CVE-2022-4946 State: PUBLISHED Published: 2023-06-05T13:39:00.602Z Last Updated: 2025-01-08T16:55:29.030Z Vendors: Unknown Products: Frontend Post WordPress Plugin Problem Types: CWE-601 URL Redirection to Untrusted Site ('Open Redirect') Description: The Frontend Post WordPress Plugin WordPress plugin through 2.8.4 does not validate an attribute of one of its shortcode, which could allow users with a role as low as contributor to add a malicious shortcode to a page/post, which will redirect users to an arbitrary domain. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/6e222018-a3e0-4af0-846c-6f00b67dfbc0