Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-4750 State: PUBLISHED Published: 2023-02-21T08:50:45.322Z Last Updated: 2025-05-05T16:11:18.172Z Vendors: Unknown Products: WP Responsive Testimonials Slider And Widget Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Responsive Testimonials Slider And Widget WordPress plugin through 1.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7bdc1324-
nalyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7bdc1324-8d08-4185-971f-8d49367702cf
CVE ID: CVE-2022-4751 State: PUBLISHED Published: 2023-01-23T14:31:40.487Z Last Updated: 2025-04-03T12:58:53.511Z Vendors: Unknown Products: Word Balloon Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Word Balloon WordPress plugin before 4.19.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/dd5cc04a-042d-402a-ab7a-96aff3d57478
CVE ID: CVE-2022-4752 State: PUBLISHED Published: 2023-02-21T08:50:53.319Z Last Updated: 2025-03-13T19:51:47.574Z Vendors: Unknown Products: Opening Hours Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Opening Hours WordPress plugin through 2.3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/309799dd-dea7-489d-8d18-b6014534f5af
CVE ID: CVE-2022-4753 State: PUBLISHED Published: 2023-01-23T14:31:48.865Z Last Updated: 2025-04-03T19:21:46.515Z Vendors: Unknown Products: Print-O-Matic Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Print-O-Matic WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5d72ec1f-5379-4d8e-850c-afe8b41bb126
CVE ID: CVE-2022-4754 State: PUBLISHED Published: 2023-02-21T08:51:03.803Z Last Updated: 2025-03-12T15:22:23.404Z Vendors: Unknown Products: Easy Social Box / Page Plugin Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Easy Social Box / Page Plugin WordPress plugin through 4.1.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d2cc0ab2-9bfd-4a09-ac31-bd90e6da12db
CVE ID: CVE-2022-4755 State: PUBLISHED Published: 2022-12-27T09:39:11.575Z Last Updated: 2024-08-03T01:48:40.224Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: n/a Products: FlatPress Problem Types: CWE-79 Description: A vulnerability was found in FlatPress and classified as problematic. This issue affects the function main of the file fp-plugins/mediamanager/panels/panel.mediamanager.file.php of the component Media Manager Plugin. The manipulation of the argument mm-newgallery-name leads to cross site scripting. The attack may be initiated remotely. The name of the patch is d3f329496536dc99f9707f2f295d571d65a496f5. It is recommended to apply a patch to fix t
remotely. The name of the patch is d3f329496536dc99f9707f2f295d571d65a496f5. It is recommended to apply a patch to fix this issue. The identifier VDB-216869 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.216869 - https://vuldb.com/?ctiid.216869 - https://github.com/flatpressblog/flatpress/issues/177 - https://github.com/flatpressblog/flatpress/commit/d3f329496536dc99f9707f2f295d571d65a496f5
CVE ID: CVE-2022-4756 State: PUBLISHED Published: 2023-02-06T19:59:14.149Z Last Updated: 2025-03-25T20:44:44.644Z Vendors: Unknown Products: My YouTube Channel Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The My YouTube Channel WordPress plugin before 3.23.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d67b0f7a-fdb1-4305-9976-c5f7
Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d67b0f7a-fdb1-4305-9976-c5f77b0e3b61
CVE ID: CVE-2022-4757 State: PUBLISHED Published: 2023-02-27T15:24:30.431Z Last Updated: 2025-03-10T18:11:48.915Z Vendors: Unknown Products: List Pages Shortcode Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The List Pages Shortcode WordPress plugin before 1.7.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/30211ffd-8751-4354-96d3-6
CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/30211ffd-8751-4354-96d3-69b0106100b1
CVE ID: CVE-2022-4758 State: PUBLISHED Published: 2023-01-23T14:31:52.942Z Last Updated: 2025-04-02T15:31:51.805Z Vendors: Unknown Products: 10WebMapBuilder Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The 10WebMapBuilder WordPress plugin before 1.0.72 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c2c89234-5e9c-47c8-9827-8ab0b10fb7
am Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c2c89234-5e9c-47c8-9827-8ab0b10fb7d6
CVE ID: CVE-2022-4759 State: PUBLISHED Published: 2023-02-13T14:32:34.943Z Last Updated: 2025-03-20T20:41:24.834Z Vendors: Unknown Products: GigPress Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The GigPress WordPress plugin before 2.3.28 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/63328927-5614-4fa1-8f46-46ff0c8eb959
CVE ID: CVE-2022-4760 State: PUBLISHED Published: 2023-01-23T14:31:24.112Z Last Updated: 2025-04-02T15:42:05.936Z Vendors: Unknown Products: OneClick Chat to Order Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The OneClick Chat to Order WordPress plugin before 1.0.4.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ad710c22-878a-441b-
es: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ad710c22-878a-441b-9c5a-90511b913d9d
CVE ID: CVE-2022-4761 State: PUBLISHED Published: 2023-02-21T08:50:44.527Z Last Updated: 2025-03-12T20:28:43.654Z Vendors: Unknown Products: Post Views Count (Support caching plugins!) Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Post Views Count WordPress plugin through 3.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ad163020-8b9c-42cb-a55f-b137b224bafb
CVE ID: CVE-2022-4762 State: PUBLISHED Published: 2023-02-06T19:59:44.591Z Last Updated: 2025-03-25T18:23:42.678Z Vendors: Unknown Products: Materialis Companion Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Materialis Companion WordPress plugin before 1.3.40 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/4500566a-e5f2-40b8-a185-
CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/4500566a-e5f2-40b8-a185-2bcace221b4e
CVE ID: CVE-2022-4763 State: PUBLISHED Published: 2023-01-30T20:31:57.998Z Last Updated: 2025-03-27T15:29:55.966Z Vendors: Unknown Products: Icon Widget Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Icon Widget WordPress plugin before 1.3.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2f79a87f-c994-4a1e-b455-39d7d3c5c1b5
CVE ID: CVE-2022-4764 State: PUBLISHED Published: 2023-02-21T08:50:55.747Z Last Updated: 2025-03-12T20:26:35.473Z Vendors: Unknown Products: Simple File Downloader Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Simple File Downloader WordPress plugin through 1.0.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/788c6aa2-14cc-411f-95e8-5994f8c82d70
CVE ID: CVE-2022-4765 State: PUBLISHED Published: 2023-01-30T20:31:50.977Z Last Updated: 2025-03-27T19:14:22.502Z Vendors: Unknown Products: Portfolio for Elementor, Image Gallery & Post Grid | PowerFolio Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Portfolio for Elementor WordPress plugin before 2.3.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpsc
s such as admins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a21dc4a3-a4f3-4619-b8a3-493a27e14ccb
CVE ID: CVE-2022-4766 State: PUBLISHED Published: 2022-12-27T12:14:13.299Z Last Updated: 2024-08-03T01:48:40.437Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: n/a Products: dolibarr_project_timesheet Problem Types: CWE-352 Description: A vulnerability was found in dolibarr_project_timesheet up to 4.5.5. It has been declared as problematic. This vulnerability affects unknown code of the component Form Handler. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. Upgrading to version 4.5.6.a is able to address this issue. The name of the patch is 082282e9dab43963e6c8f03cfaddd7921de377f4. It is recommended to upgrade th
o address this issue. The name of the patch is 082282e9dab43963e6c8f03cfaddd7921de377f4. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216880. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.216880 - https://vuldb.com/?ctiid.216880 - https://github.com/delcroip/dolibarr_project_timesheet/pull/200 - https://github.com/delcroip/dolibarr_project_timesheet/commit/082282e9dab43963e6c8f03cfaddd7921de377f4 - https://github.com/delcroip/dolibarr_project_timesheet/releases/tag/4.5.6.a
CVE ID: CVE-2022-4767 State: PUBLISHED Published: 2022-12-27T00:00:00.000Z Last Updated: 2025-04-10T18:17:16.712Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: usememos Products: usememos/memos Problem Types: CWE-400 Description: Denial of Service in GitHub repository usememos/memos prior to 0.9.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/75b4a085-923c-4ecc-bbf6-e049290db502 - https://github.com/usememos/memos/commit/f888c628408501daf639de07b90a72ab443b0f4c
CVE ID: CVE-2022-4768 State: PUBLISHED Published: 2022-12-27T22:33:35.180Z Last Updated: 2024-08-03T01:48:40.389Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Dropbox Products: merou Problem Types: CWE-74 Description: A vulnerability was found in Dropbox merou. It has been classified as critical. Affected is the function add_public_key of the file grouper/public_key.py of the component SSH Public Key Handler. The manipulation of the argument public_key_str leads to injection. It is possible to launch the attack remotely. The name of the patch is d93087973afa26bc0a2d0a5eb5c0fde748bdd107. It is recommended to apply a patch to fix this issue. VDB-216906 is t
patch is d93087973afa26bc0a2d0a5eb5c0fde748bdd107. It is recommended to apply a patch to fix this issue. VDB-216906 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.216906 - https://vuldb.com/?ctiid.216906 - https://github.com/dropbox/merou/pull/673 - https://github.com/dropbox/merou/commit/d93087973afa26bc0a2d0a5eb5c0fde748bdd107
CVE ID: CVE-2022-4769 State: PUBLISHED Published: 2023-04-03T18:53:51.840Z Last Updated: 2025-02-11T14:28:52.915Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Hitachi Vantara Products: Pentaho Business Analytics Server Problem Types: CWE-209 Description: Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2, including 8.3.x display the target path on host when a file is uploaded with an invalid character in its name. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.pentaho.com/hc/en-us/articles/14452244712589--Resolved-Pentaho-BA-Server-Generation-of-Error-Message-C
- https://support.pentaho.com/hc/en-us/articles/14452244712589--Resolved-Pentaho-BA-Server-Generation-of-Error-Message-Containing-Sensitive-Information-Versions-before-9-4-0-0-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-4769-
CVE ID: CVE-2022-4770 State: PUBLISHED Published: 2023-04-03T18:56:17.800Z Last Updated: 2025-02-11T14:28:35.632Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Hitachi Vantara Products: Pentaho Business Analytics Server Problem Types: CWE-209 Description: Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2, including 8.3.x display the full parametrized SQL query in an error message when an invalid character is used within a Pentaho Report (*.prpt). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.pentaho.com/hc/en-us/articles/14455209015949--Resolved-Hitachi-Vantar
SA ADP Vulnrichment: References: - https://support.pentaho.com/hc/en-us/articles/14455209015949--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Generation-of-Error-Message-Containing-Sensitive-Information-Versions-before-9-4-0-0-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-4770-
CVE ID: CVE-2022-4771 State: PUBLISHED Published: 2023-04-03T18:58:44.148Z Last Updated: 2025-02-11T14:28:21.236Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Hitachi Vantara Products: Pentaho Business Analytics Server Problem Types: CWE-79 Description: Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow a malicious URL to inject content into the Pentaho User Console through session variables. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.pentaho.com/hc/en-us/articles/14455436088717--Resolved-Pentaho-BA-Server-Improper-Neutralization-of-I
- https://support.pentaho.com/hc/en-us/articles/14455436088717--Resolved-Pentaho-BA-Server-Improper-Neutralization-of-Input-During-Web-Page-Generation-Cross-site-Scripting-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-4771-
CVE ID: CVE-2022-4772 State: PUBLISHED Published: 2022-12-27T22:47:46.170Z Last Updated: 2024-08-03T01:48:40.448Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: Widoco Problem Types: CWE-22 Description: A vulnerability was found in Widoco and classified as critical. Affected by this issue is the function unZipIt of the file src/main/java/widoco/WidocoUtils.java. The manipulation leads to path traversal. It is possible to launch the attack on the local host. The name of the patch is f2279b76827f32190adfa9bd5229b7d5a147fa92. It is recommended to apply a patch to fix this issue. VDB-216914 is the identifier assigned to this vulnerability. Additio
is recommended to apply a patch to fix this issue. VDB-216914 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.216914 - https://vuldb.com/?ctiid.216914 - https://github.com/dgarijo/Widoco/pull/551 - https://github.com/dgarijo/Widoco/commit/f2279b76827f32190adfa9bd5229b7d5a147fa92
CVE ID: CVE-2022-4773 State: PUBLISHED Published: 2022-12-27T23:05:37.534Z Last Updated: 2024-08-03T01:48:40.465Z Severity: LOW (CVSS 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: cloudsync Problem Types: CWE-22 Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic was found in cloudsync. Affected by this vulnerability is the function getItem of the file src/main/java/cloudsync/connector/LocalFilesystemConnector.java. The manipulation leads to path traversal. It is possible to launch the attack on the local host. The name of the patch is 3ad796833398af257c28e0ebeade68518e0e612a. It is recommended to apply a patch to fix this issue.
he name of the patch is 3ad796833398af257c28e0ebeade68518e0e612a. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216919. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.216919 - https://vuldb.com/?ctiid.216919 - https://github.com/HolgerHees/cloudsync/commit/3ad796833398af257c28e0ebeade68518e0e612a
CVE ID: CVE-2022-4774 State: PUBLISHED Published: 2023-05-15T12:15:44.681Z Last Updated: 2025-01-24T21:20:46.412Z Vendors: Unknown Products: Bit Form Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The Bit Form WordPress plugin before 1.9 does not validate the file types uploaded via it's file upload form field, allowing unauthenticated users to upload arbitrary files types such as PHP or HTML files to the server, leading to Remote Code Execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2ae5c375-a6a0-4c0b-a9ef-e4d2a28bce5e
CVE ID: CVE-2022-4775 State: PUBLISHED Published: 2023-01-23T14:32:01.696Z Last Updated: 2025-04-03T19:13:36.433Z Vendors: Unknown Products: GeoDirectory Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The GeoDirectory WordPress plugin before 2.2.22 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5ab3fc58-7d1c-4bcd-8bbd-86c62a3f979c
CVE ID: CVE-2022-4776 State: PUBLISHED Published: 2023-01-30T20:31:29.828Z Last Updated: 2025-03-27T20:44:03.444Z Vendors: Unknown Products: CC Child Pages Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The CC Child Pages WordPress plugin before 1.43 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d5ea8f7f-7d5a-4b2e-a070-a9aef7cac58a
CVE ID: CVE-2022-4777 State: PUBLISHED Published: 2023-02-21T08:50:42.128Z Last Updated: 2025-03-12T15:27:24.628Z Vendors: Unknown Products: Bootstrap Shortcodes Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Bootstrap Shortcodes WordPress plugin through 3.4.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b4c53bef-e868-46f1-965d-720b5b9a931e
CVE ID: CVE-2022-4778 State: PUBLISHED Published: 2022-12-28T14:20:24.269Z Last Updated: 2025-04-09T18:28:15.177Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: elvexys Products: StreamX Problem Types: n/a Description: StreamX applications from versions 6.02.01 to 6.04.34 are affected by a path traversal vulnerability that allows authenticated users to get unauthorized access to files on the server's filesystem. StreamX applications using StreamView HTML component with the public web server feature activated are affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://elvexys.com/products/xpg-gateway-rtu-pr
t Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://elvexys.com/products/xpg-gateway-rtu-protocol-converter/streamx-release-notes/