Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-0559 State: PUBLISHED Published: 2023-02-21T08:50:46.871Z Last Updated: 2025-03-14T18:12:24.923Z Vendors: Unknown Products: GS Portfolio for Envato Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The GS Portfolio for Envato WordPress plugin before 1.4.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e5549261-66e2-4a5e-8781-bc555b629ccc
CVE ID: CVE-2023-0560 State: PUBLISHED Published: 2023-01-28T16:10:46.083Z Last Updated: 2024-08-02T05:17:49.888Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Tours & Travels Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in SourceCodester Online Tours & Travels Management System 1.0. This issue affects some unknown processing of the file admin/practice_pdf.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219701 was assigned to this vulnerab
y. The exploit has been disclosed to the public and may be used. The identifier VDB-219701 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.219701 - https://vuldb.com/?ctiid.219701 - https://github.com/linmoren/online-tours-travels-management-system/blob/main/admin_practice_pdf_id.md
CVE ID: CVE-2023-0561 State: PUBLISHED Published: 2023-01-28T16:10:49.794Z Last Updated: 2024-08-02T05:17:50.157Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Tours & Travels Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in SourceCodester Online Tours & Travels Management System 1.0. Affected is an unknown function of the file /user/s.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-219702 is the identifier assigned to this vulnerability. Additional An
been disclosed to the public and may be used. VDB-219702 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.219702 - https://vuldb.com/?ctiid.219702 - https://github.com/linmoren/online-tours-travels-management-system/blob/main/_user_s_id.md
CVE ID: CVE-2023-0562 State: PUBLISHED Published: 2023-01-28T22:23:53.698Z Last Updated: 2024-11-25T16:30:46.500Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Bank Locker Management System Problem Types: CWE-89 Description: A vulnerability was found in PHPGurukul Bank Locker Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file index.php of the component Login. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-219716. Additional Analys
has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-219716. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.219716 - https://vuldb.com/?ctiid.219716 - https://github.com/ctflearner/Vulnerability/blob/main/Bank_Locker_Management_System/Bank%20Locker%20Management%20System-SQL%20.md
CVE ID: CVE-2023-0563 State: PUBLISHED Published: 2023-01-28T22:24:06.709Z Last Updated: 2024-08-02T05:17:49.691Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: PHPGurukul Products: Bank Locker Management System Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in PHPGurukul Bank Locker Management System 1.0. This affects an unknown part of the file add-locker-form.php of the component Assign Locker. The manipulation of the argument ahname leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219717 was assigned to this vulnerability.
exploit has been disclosed to the public and may be used. The identifier VDB-219717 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.219717 - https://vuldb.com/?ctiid.219717 - https://github.com/ctflearner/Vulnerability/blob/main/Bank_Locker_Management_System/BLMS_XSS_IN_ADMIN_BROWSER.md
CVE ID: CVE-2023-0564 State: PUBLISHED Published: 2023-01-29T00:00:00.000Z Last Updated: 2025-03-28T15:46:16.878Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: froxlor Products: froxlor/froxlor Problem Types: CWE-521 Description: Weak Password Requirements in GitHub repository froxlor/froxlor prior to 2.0.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/a4f86d6f-0d5d-428d-a4b3-551b20a21ce6 - https://github.com/froxlor/froxlor/commit/2a84e9c1207fd3d792b7fb198fd0c66fe1a66a7a
CVE ID: CVE-2023-0565 State: PUBLISHED Published: 2023-01-29T00:00:00.000Z Last Updated: 2025-03-28T15:45:51.454Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N) Vendors: froxlor Products: froxlor/froxlor Problem Types: CWE-840 Description: Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/12d78294-1723-4450-a239-023952666102 - https://github.com/froxlor/froxlor/commit/2feb8020941a82bfb4ac68890f6ced0e5b3c4a15
CVE ID: CVE-2023-0566 State: PUBLISHED Published: 2023-01-29T00:00:00.000Z Last Updated: 2025-03-28T15:44:12.607Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L) Vendors: froxlor Products: froxlor/froxlor Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in froxlor/froxlor prior to 2.0.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/8339e4f1-d430-4845-81b5-36dd9fcdac49 - https://github.com/froxlor/froxlor/commit/bd5b99dc1c06f594b9563d459a50bf3b32504876
CVE ID: CVE-2023-0567 State: PUBLISHED Published: 2023-02-16T06:15:50.127Z Last Updated: 2024-08-02T05:17:50.104Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: PHP Group Products: PHP Problem Types: n/a Description: In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugs.php.net/bug.php?id=81744 - https://github.com/php/php-src/sec
ainer: - CISA ADP Vulnrichment: References: - https://bugs.php.net/bug.php?id=81744 - https://github.com/php/php-src/security/advisories/GHSA-7fj2-8x79-rjf4
CVE ID: CVE-2023-0568 State: PUBLISHED Published: 2023-02-16T06:34:04.101Z Last Updated: 2025-03-18T14:57:10.966Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: PHP Group Products: PHP Problem Types: CWE-131 Description: In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting, this may lead to the byte after the allocated buffer being overwritten with NUL value, which might lead to unauthorized data access or modification. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
d data access or modification. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugs.php.net/bug.php?id=81746 - https://security.netapp.com/advisory/ntap-20230517-0001/
CVE ID: CVE-2023-0569 State: PUBLISHED Published: 2023-01-29T00:00:00.000Z Last Updated: 2025-03-28T15:43:33.505Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: publify Products: publify/publify Problem Types: CWE-521 Description: Weak Password Requirements in GitHub repository publify/publify prior to 9.2.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/81b1e1da-10dd-435e-94ae-4bdd41df6df9 - https://github.com/publify/publify/commit/8905e4e639cf03b758da558568a86c9816253b2d
CVE ID: CVE-2023-0570 State: PUBLISHED Published: 2023-01-29T17:27:33.927Z Last Updated: 2024-08-02T05:17:49.621Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Tours & Travels Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in SourceCodester Online Tours & Travels Management System 1.0. This affects an unknown part of the file user\operations\payment_operation.php. The manipulation of the argument booking_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219729 was assigned to
attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219729 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.219729 - https://vuldb.com/?ctiid.219729 - https://github.com/linmoren/online-tours-travels-management-system/blob/main/user_operations_payment_operation_booking_id.md
CVE ID: CVE-2023-0571 State: PUBLISHED Published: 2023-01-29T17:30:35.874Z Last Updated: 2024-08-02T05:17:50.131Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Canteen Management System Problem Types: CWE-79 Description: A vulnerability has been found in SourceCodester Canteen Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file createcustomer.php of the component Add Customer. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-219730 is the identifier assigned to this vulnerability.
e exploit has been disclosed to the public and may be used. VDB-219730 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.219730 - https://vuldb.com/?ctiid.219730 - https://github.com/ctflearner/Vulnerability/blob/main/Canteen%20Management%20System/Canteen_Management_System_XSS_IN_Add_Customer.md
CVE ID: CVE-2023-0572 State: PUBLISHED Published: 2023-01-29T00:00:00.000Z Last Updated: 2025-03-28T15:42:50.200Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: froxlor Products: froxlor/froxlor Problem Types: CWE-391 Description: Unchecked Error Condition in GitHub repository froxlor/froxlor prior to 2.0.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/4ab24ee2-3ff6-4248-9555-0af3e5f754ec - https://github.com/froxlor/froxlor/commit/7b08a71c59430d06c1efb012a6c6448262aacdb1
CVE ID: CVE-2023-0574 State: PUBLISHED Published: 2023-02-09T14:55:29.165Z Last Updated: 2025-03-24T18:33:02.110Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: YugabyteDB Products: YugabyteDB Anywhere Problem Types: CWE-918, CWE-915, CWE-307 Description: Server-Side Request Forgery (SSRF), Improperly Controlled Modification of Dynamically-Determined Object Attributes, Improper Restriction of Excessive Authentication Attempts vulnerability in YugaByte, Inc. Yugabyte Managed allows Accessing Functionality Not Properly Constrained by ACLs, Communication Channel Manipulation, Authentication Abuse.This issue affects Yugabyte Managed: from 2.0.0.0 through 2.13.0
ommunication Channel Manipulation, Authentication Abuse.This issue affects Yugabyte Managed: from 2.0.0.0 through 2.13.0.0 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.yugabyte.com/
CVE ID: CVE-2023-0575 State: PUBLISHED Published: 2023-02-09T16:12:46.327Z Last Updated: 2025-03-24T18:34:16.202Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: YugabyteDB Products: YugabyteDB Problem Types: CWE-642, CWE-94 Description: External Control of Critical State Data, Improper Control of Generation of Code ('Code Injection') vulnerability in YugaByte, Inc. Yugabyte DB on Windows, Linux, MacOS, iOS (DevopsBase.Java:execCommand, TableManager.Java:runCommand modules) allows API Manipulation, Privilege Abuse. This vulnerability is associated with program files backup.Py. This issue affects Yugabyte DB: Lesser then 2.2.0.0 Additional Analyst Notes: - CVE
iated with program files backup.Py. This issue affects Yugabyte DB: Lesser then 2.2.0.0 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.yugabyte.com/
CVE ID: CVE-2023-0576 State: REJECTED Published: 2023-02-02T14:57:06.911Z Last Updated: 2023-02-06T14:21:17.584Z Description: No description available.
CVE ID: CVE-2023-0577 State: PUBLISHED Published: 2023-03-03T06:55:44.146Z Last Updated: 2025-03-05T20:00:51.334Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: ASOS Information Technologies Products: SOBIAD Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ASOS Information Technologies SOBIAD allows Cross-Site Scripting (XSS).This issue affects SOBIAD: before 23.02.01. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0125
CVE ID: CVE-2023-0578 State: PUBLISHED Published: 2023-03-03T06:57:04.626Z Last Updated: 2025-03-05T20:00:12.680Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: ASOS Information Technologies Products: Book Cites Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ASOS Information Technologies Book Cites allows Cross-Site Scripting (XSS).This issue affects Book Cites: before 23.01.05. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0125
CVE ID: CVE-2023-0579 State: PUBLISHED Published: 2023-08-16T11:03:21.175Z Last Updated: 2024-10-08T19:23:55.087Z Vendors: Unknown Products: YARPP Problem Types: CWE-89 SQL Injection Description: The YARPP WordPress plugin before 5.30.3 does not validate and escape some of its shortcode attributes before using them in SQL statement/s, which could allow any authenticated users, such as subscribers to perform SQL Injection attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/574f7607-96d8-4ef8-b96c-0425ad7e7690
CVE ID: CVE-2023-0580 State: PUBLISHED Published: 2023-04-06T16:19:51.149Z Last Updated: 2025-02-10T20:18:36.853Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: ABB Products: My Control System (on-premise) Problem Types: CWE-922 Description: Insecure Storage of Sensitive Information vulnerability in ABB My Control System (on-premise) allows an attacker who successfully exploited this vulnerability to gain access to the secure application data or take control of the application. Of the services that make up the My Control System (on-premise) application, the following ones are affected by this vulnerability: User Interface System Monitoring1 Asset Inventory
) application, the following ones are affected by this vulnerability: User Interface System Monitoring1 Asset Inventory This issue affects My Control System (on-premise): from 5.0;0 through 5.13. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=7PAA007893&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2023-0581 State: PUBLISHED Published: 2023-01-30T14:06:27.936Z Last Updated: 2025-01-13T17:09:35.434Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: LCWeb Products: PrivateContent Problem Types: CWE-602 Client-Side Enforcement of Server-Side Security Description: The PrivateContent plugin for WordPress is vulnerable to protection mechanism bypass due to the use of client side validation in versions up to, and including, 8.4.3. This is due to the plugin checking if an IP had been blocklist via client-side scripts rather than server-side. This makes it possible for unauthenticated attackers to bypass any login restrictions that may prevent a brute
ver-side. This makes it possible for unauthenticated attackers to bypass any login restrictions that may prevent a brute force attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/de73304e-7a28-4304-b1ed-2f6dd7738236 - https://lcweb.it/privatecontent/changelog
CVE ID: CVE-2023-0582 State: PUBLISHED Published: 2024-03-27T17:09:43.769Z Last Updated: 2025-04-14T17:03:58.780Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: forgerock Products: access management Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ForgeRock Access Management allows Authorization Bypass. This issue affects access management: before 7.3.0, before 7.2.1, before 7.1.4, through 7.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://backstage.forgerock.com/downloads/browse/am/featured - https://backstage.forgerock.com/
Container: References: - https://backstage.forgerock.com/downloads/browse/am/featured - https://backstage.forgerock.com/knowledge/kb/article/a64088600
CVE ID: CVE-2023-0583 State: PUBLISHED Published: 2023-06-03T01:59:27.897Z Last Updated: 2024-12-20T23:59:01.738Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: vektor-inc Products: VK Blocks Problem Types: CWE-285 Improper Authorization Description: The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'update_vk_blocks_options' function in versions up to, and including, 1.57.0.5. This allows authenticated attackers, with contributor-level permissions or above, to change plugin settings including default icons. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.c
icons. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/12a94f5b-bc30-4a65-b397-54488c836ec3?source=cve - https://plugins.trac.wordpress.org/browser/vk-blocks/trunk/inc/vk-blocks/App/RestAPI/BlockMeta/class-vk-blocks-entrypoint.php
CVE ID: CVE-2023-0584 State: PUBLISHED Published: 2023-06-03T01:59:28.995Z Last Updated: 2024-12-20T23:58:52.374Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: vektor-inc Products: VK Blocks Problem Types: CWE-285 Improper Authorization Description: The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'update_options' function in versions up to, and including, 1.57.0.5. This allows authenticated attackers, with contributor-level permissions or above, to change the 'vk_font_awesome_version' option to an arbitrary value. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wo
rbitrary value. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b90b7f6c-df7f-48a5-b283-cf5facbd71e5?source=cve - https://plugins.trac.wordpress.org/browser/vk-blocks/trunk/inc/vk-blocks/font-awesome/class-vk-blocks-font-awesome-api.php
CVE ID: CVE-2023-0585 State: PUBLISHED Published: 2023-02-24T14:46:43.084Z Last Updated: 2025-01-13T17:04:51.985Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: smub Products: All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 4.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Adminis
to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Administrator role or above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3db97180-9308-4891-9de9-acefe31d088f - https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/4.2.9/app/Common/Main/Updates.php?v=2829340#L624 - https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/4.2.9/app/Common/Main/Updates.php?v=2829340#L625 - https://plugins.trac.wordpress.o
org/browser/all-in-one-seo-pack/tags/4.2.9/app/Common/Main/Updates.php?v=2829340#L625 - https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/4.2.9/app/Common/Main/Updates.php?v=2829340#L665 - https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/4.2.9/app/Common/Main/Updates.php?v=2829340#L666 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2859011%40all-in-one-seo-pack%2Ftrunk&old=2847431%40all-in-one-seo-pack%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-0586 State: PUBLISHED Published: 2023-02-24T14:47:02.730Z Last Updated: 2025-01-13T17:04:39.715Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: smub Products: All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 4.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Contrib
to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Contributor+ role to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1c13f00e-3048-44cf-8979-2b0b0c508f3a - https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/4.2.9/app/Common/Admin/PostSettings.php?v=2829340#L202 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2859011%40all-in-one-seo-pack%2Ftrunk&old=2847431%40all-in-one-seo-pack%2F
changeset?sfp_email=&sfph_mail=&reponame=&new=2859011%40all-in-one-seo-pack%2Ftrunk&old=2847431%40all-in-one-seo-pack%2Ftrunk&sfp_email=&sfph_mail=