Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-0257 State: PUBLISHED Published: 2023-01-12T21:09:33.279Z Last Updated: 2024-08-02T05:02:44.094Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Food Ordering System Problem Types: CWE-434 Description: A vulnerability was found in SourceCodester Online Food Ordering System 2.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /fos/admin/index.php?page=menu of the component Menu Form. The manipulation of the argument Image with the input <?php system($_GET['c']); ?> leads to unrestricted upload. The attack can be launched remotely. The identifier VDB-218185 was assigned to thi
']); ?> leads to unrestricted upload. The attack can be launched remotely. The identifier VDB-218185 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.218185 - https://vuldb.com/?ctiid.218185
CVE ID: CVE-2023-0258 State: PUBLISHED Published: 2023-01-12T21:20:59.100Z Last Updated: 2024-08-02T05:02:44.033Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: SourceCodester Products: Online Food Ordering System Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Online Food Ordering System 2.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Category List Handler. The manipulation of the argument Reason with the input "><script>prompt(1)</script> leads to cross site scripting. The attack may be launched remotely. VDB-218186 is the identifier assigned to this vulnerability. Additional Analyst N
. The attack may be launched remotely. VDB-218186 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.218186 - https://vuldb.com/?ctiid.218186
CVE ID: CVE-2023-0259 State: PUBLISHED Published: 2023-02-13T14:32:19.847Z Last Updated: 2025-03-21T15:26:27.464Z Vendors: Unknown Products: WP Google Review Slider Problem Types: CWE-89 SQL Injection Description: The WP Google Review Slider WordPress plugin before 11.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d3bb0eac-1f4e-4191-8f3b-104a5bb54558
CVE ID: CVE-2023-0260 State: PUBLISHED Published: 2023-02-13T14:32:12.713Z Last Updated: 2025-03-21T18:02:28.483Z Vendors: Unknown Products: WP Review Slider Problem Types: CWE-89 SQL Injection Description: The WP Review Slider WordPress plugin before 12.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/9165d46b-2a27-4e83-a096-73ffe9057c80
CVE ID: CVE-2023-0261 State: PUBLISHED Published: 2023-02-13T14:32:10.388Z Last Updated: 2025-03-21T15:52:05.415Z Vendors: Unknown Products: WP TripAdvisor Review Slider Problem Types: CWE-89 SQL Injection Description: The WP TripAdvisor Review Slider WordPress plugin before 10.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/6a3b6752-8d72-4ab4-9d49-b722a947d2b0
CVE ID: CVE-2023-0262 State: PUBLISHED Published: 2023-02-13T14:32:28.589Z Last Updated: 2025-03-21T19:45:55.364Z Vendors: Unknown Products: WP Airbnb Review Slider Problem Types: CWE-89 SQL Injection Description: The WP Airbnb Review Slider WordPress plugin before 3.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5d8c28ac-a46c-45d3-acc9-2cd2e6356ba2
CVE ID: CVE-2023-0263 State: PUBLISHED Published: 2023-02-13T14:32:17.532Z Last Updated: 2025-03-21T19:33:19.108Z Vendors: Unknown Products: WP Yelp Review Slider Problem Types: CWE-89 SQL Injection Description: The WP Yelp Review Slider WordPress plugin before 7.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2b4a6459-3e49-4048-8a9f-d7bb350aa2f6
CVE ID: CVE-2023-0264 State: PUBLISHED Published: 2023-08-04T17:09:27.693Z Last Updated: 2024-08-02T05:02:44.110Z Vendors: redhat.com Products: Keycloak Description: A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the same realm could use that data to impersonate the victim and generate new session tokens. This issue could impact confidentiality, integrity, and availability. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2023-0264
CVE ID: CVE-2023-0265 State: PUBLISHED Published: 2023-04-04T00:00:00.000Z Last Updated: 2025-02-13T16:25:08.320Z Vendors: n/a Products: Uvdesk Problem Types: Insecure file upload Description: Uvdesk version 1.1.1 allows an authenticated remote attacker to execute commands on the server. This is possible because the application does not properly validate profile pictures uploaded by customers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/supply/ - https://github.com/uvdesk/community-skeleton
CVE ID: CVE-2023-0266 State: PUBLISHED Published: 2023-01-30T13:09:32.141Z Last Updated: 2025-10-21T23:15:27.844Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H) Vendors: Linux Products: Linux Kernel Problem Types: CWE-416 Description: A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. We recommend upgrading past commit 56b88b50565cd8b946a2d00b0c83927b7ebb055e Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.c
3927b7ebb055e Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/torvalds/linux/commit/becf9e5d553c2389d857a3c178ce80fdb34a02e1 - https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-5.10/alsa-pcm-move-rwsem-lock-inside-snd_ctl_elem_read-to-prevent-uaf.patch?id=72783cf35e6c55bca84c4bb7b776c58152856fd4 - https://github.com/torvalds/linux/commit/56b88b50565cd8b946a2d00b0c83927b7ebb055e - https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html
CVE ID: CVE-2023-0267 State: PUBLISHED Published: 2023-05-08T13:58:02.805Z Last Updated: 2025-01-29T15:02:55.153Z Vendors: Unknown Products: Ultimate Carousel For WPBakery Page Builder Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Ultimate Carousel For WPBakery Page Builder WordPress plugin through 2.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7ba7849d-e
alyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7ba7849d-e07b-465a-bfb7-10c8186be140
CVE ID: CVE-2023-0268 State: PUBLISHED Published: 2023-05-08T13:58:25.619Z Last Updated: 2025-01-28T21:09:03.212Z Vendors: Unknown Products: Mega Addons For WPBakery Page Builder Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Mega Addons For WPBakery Page Builder WordPress plugin before 4.3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/99389641-ad1e-45c1-a4
: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/99389641-ad1e-45c1-a42f-2a010ee22d76
CVE ID: CVE-2023-0269 State: REJECTED Published: N/A Last Updated: 2023-01-17T00:00:00 Description: No description available.
CVE ID: CVE-2023-0270 State: PUBLISHED Published: 2023-02-13T14:32:02.489Z Last Updated: 2025-03-21T14:35:30.602Z Vendors: Unknown Products: YaMaps for WordPress Plugin Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The YaMaps for WordPress Plugin WordPress plugin before 0.6.26 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ca3ca694-54ca-4e7e-82e6-33aa240754e1
CVE ID: CVE-2023-0271 State: PUBLISHED Published: 2023-02-21T08:50:36.488Z Last Updated: 2025-03-14T18:15:36.723Z Vendors: Unknown Products: WP Font Awesome Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Font Awesome WordPress plugin before 1.7.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/fd7aaf06-4be7-48d6-83a1-cd5cd6c3d9c2
CVE ID: CVE-2023-0272 State: PUBLISHED Published: 2023-03-27T15:37:41.482Z Last Updated: 2025-02-19T16:01:14.072Z Vendors: Unknown Products: NEX-Forms Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The NEX-Forms WordPress plugin before 8.3.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/047b50c0-0eb3-4371-9e5d-3778fdafc66b
CVE ID: CVE-2023-0273 State: PUBLISHED Published: 2023-03-20T15:52:21.047Z Last Updated: 2025-02-26T18:55:16.183Z Vendors: Unknown Products: Custom Content Shortcode Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Custom Content Shortcode WordPress plugin through 4.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5cafbba6-478f-4f5d-a2d4-60c6a22f2f1e
CVE ID: CVE-2023-0274 State: PUBLISHED Published: 2023-08-16T11:03:26.919Z Last Updated: 2024-10-08T19:08:53.579Z Vendors: Unknown Products: URL Params Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The URL Params WordPress plugin before 2.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/4f6197b6-6d4c-4986-b54c-453b17e94812
CVE ID: CVE-2023-0275 State: PUBLISHED Published: 2023-02-13T14:32:18.294Z Last Updated: 2025-03-21T15:27:24.754Z Vendors: Unknown Products: Easy Accept Payments for PayPal Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Easy Accept Payments for PayPal WordPress plugin before 4.9.10 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/aab5d803-d621-4b12-a901-ff444733
gram Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/aab5d803-d621-4b12-a901-ff4447334d88
CVE ID: CVE-2023-0276 State: PUBLISHED Published: 2023-04-24T18:30:53.152Z Last Updated: 2025-02-04T18:36:45.244Z Vendors: Unknown Products: Weaver Xtreme Theme Support Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Weaver Xtreme Theme Support WordPress plugin before 6.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d00824a3-7df5-4b52-a31b-5fdfb19c970f
CVE ID: CVE-2023-0277 State: PUBLISHED Published: 2023-04-17T12:17:40.775Z Last Updated: 2025-02-06T15:30:15.424Z Vendors: Unknown Products: WC Fields Factory Problem Types: CWE-89 SQL Injection Description: The WC Fields Factory WordPress plugin through 4.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/69ffb2f1-b291-49bf-80a8-08d03ceca53b - https://bulletin.iese.de/post/wc-fields-factory_1-4-5
CVE ID: CVE-2023-0278 State: PUBLISHED Published: 2023-02-27T15:24:40.738Z Last Updated: 2025-03-10T18:14:48.314Z Vendors: Unknown Products: GeoDirectory Problem Types: CWE-89 SQL Injection Description: The GeoDirectory WordPress plugin before 2.2.24 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/98deb84e-01ca-4b70-a8f8-0a226daa85a6 - https://bulletin.iese.de/post/geodirectory_2-2-21
CVE ID: CVE-2023-0279 State: PUBLISHED Published: 2023-02-27T15:24:39.076Z Last Updated: 2025-03-10T18:13:40.797Z Vendors: Unknown Products: Media Library Assistant Problem Types: CWE-89 SQL Injection Description: The Media Library Assistant WordPress plugin before 3.06 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/42db1ba5-1b14-41bd-a2b3-7243a84c9d3d - https://bulletin.iese.de/post/media-library-assistant_3-05_1
CVE ID: CVE-2023-0280 State: PUBLISHED Published: 2023-05-08T13:58:17.650Z Last Updated: 2025-02-04T20:31:27.215Z Vendors: Unknown Products: Ultimate Carousel For Elementor Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Ultimate Carousel For Elementor WordPress plugin through 2.1.7 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/cb7ed9e6-0fa0-4ebb-9109-8f33defc8b32
CVE ID: CVE-2023-0281 State: PUBLISHED Published: 2023-01-13T09:18:27.640Z Last Updated: 2025-04-04T14:52:43.490Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Flight Booking Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Online Flight Booking Management System. It has been rated as critical. Affected by this issue is some unknown functionality of the file judge_panel.php. The manipulation of the argument subevent_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-218276. Additio
he exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-218276. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.218276 - https://vuldb.com/?ctiid.218276 - https://github.com/qyhmsys/cve-list/blob/master/Online%20Flight%20Booking%20Management%20System%20judge_panel.md
CVE ID: CVE-2023-0282 State: PUBLISHED Published: 2023-02-06T19:59:24.802Z Last Updated: 2025-03-26T13:43:51.930Z Vendors: Unknown Products: YourChannel: Everything you want in a YouTube plugin. Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The YourChannel WordPress plugin before 1.2.2 does not sanitize and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/93693d45-5217-4571-bae5-aab8878cfe62
CVE ID: CVE-2023-0283 State: PUBLISHED Published: 2023-01-13T09:20:41.172Z Last Updated: 2024-08-02T05:02:44.142Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Flight Booking Management System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in SourceCodester Online Flight Booking Management System. This affects an unknown part of the file review_search.php of the component POST Parameter Handler. The manipulation of the argument txtsearch leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-218277 was assig
e the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-218277 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.218277 - https://vuldb.com/?ctiid.218277 - https://github.com/qyhmsys/cve-list/blob/master/Online%20Flight%20Booking%20Management%20System%20review_search.md
CVE ID: CVE-2023-0284 State: PUBLISHED Published: 2023-01-24T12:03:57.774Z Last Updated: 2025-03-27T20:22:06.041Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Tribe29 Products: Checkmk Problem Types: CWE-20 Description: Improper Input Validation of LDAP user IDs in Tribe29 Checkmk allows attackers that can control LDAP user IDs to manipulate files on the server. Checkmk <= 2.1.0p19, Checkmk <= 2.0.0p32, and all versions of Checkmk 1.6.0 (EOL) are affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://checkmk.com/werk/15181
CVE ID: CVE-2023-0285 State: PUBLISHED Published: 2023-02-21T08:50:42.950Z Last Updated: 2025-03-12T15:26:03.312Z Vendors: Unknown Products: Real Media Library: Media Library Folder & File Manager Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Real Media Library WordPress plugin before 4.18.29 does not sanitise and escape the created folder names, which could allow users with the role of author and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/adf09e29-baf5-4426-a281-6763c107d348
CVE ID: CVE-2023-0286 State: PUBLISHED Published: 2023-02-08T19:01:50.514Z Last Updated: 2025-11-04T19:14:36.256Z Vendors: OpenSSL Products: OpenSSL Problem Types: type confusion vulnerability Description: There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this v
her than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CR
ulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openssl.org/news/secadv/20230207.txt - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2f7530077e0ef79d98718138716bc51ca0cad658 - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2c6c9d439b484e1ba9830d8454a34fa4f80fdfe9 - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fd2af07dc083a350c959147097003a14a5e8ac4d - https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/018_x509.patch.sig - https://ftp.openbsd.org/pub/Open
4a5e8ac4d - https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/018_x509.patch.sig - https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.2-relnotes.txt - https://security.gentoo.org/glsa/202402-08
CVE ID: CVE-2023-0287 State: PUBLISHED Published: 2023-01-13T12:40:49.004Z Last Updated: 2025-04-04T15:03:25.254Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: ityouknow Products: favorites-web Problem Types: CWE-79 Description: A vulnerability was found in ityouknow favorites-web. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Comment Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-218294 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
e identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.218294 - https://vuldb.com/?ctiid.218294 - https://gitee.com/ityouknow/favorites-web/issues/I684L9