Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-7271 State: PUBLISHED Published: 2024-07-25T11:49:14.969Z Last Updated: 2024-08-02T08:57:35.022Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-840 Description: Privilege escalation vulnerability in the NMS module Impact: Successful exploitation of this vulnerability will affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2024/7/
CVE ID: CVE-2023-7272 State: PUBLISHED Published: 2024-07-17T15:00:20.172Z Last Updated: 2024-08-02T08:57:35.165Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Eclipse Foundation Products: Parsson Problem Types: CWE-787 Description: In Eclipse Parsson before 1.0.4 and 1.1.3, a document with a large depth of nested objects can allow an attacker to cause a Java stack overflow exception and denial of service. Eclipse Parsson allows processing (e.g. parse, generate, transform and query) JSON documents. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/12
CVE ID: CVE-2023-7273 State: PUBLISHED Published: 2024-10-01T12:34:10.481Z Last Updated: 2024-10-01T13:16:05.468Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Kiteworks Products: OwnCloud Problem Types: CWE-352 Description: Cross site request forgery in Kiteworks OwnCloud allows an unauthenticated attacker to forge requests. If a request has no Authorization header, it is created with an empty string as value by a rewrite rule. The CSRF check is done by comparing the header value to null, meaning that the existing CSRF check is bypassed in this case. An attacker can, for example, create a new administrator account if the request is executed in the browser
in this case. An attacker can, for example, create a new administrator account if the request is executed in the browser of an authenticated victim. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/2041007 - https://cirosec.de/sa/sa-2023-012
CVE ID: CVE-2023-7279 State: PUBLISHED Published: 2024-09-02T14:00:06.559Z Last Updated: 2024-09-03T14:15:51.867Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Secure Systems Engineering Products: Connaisseur Problem Types: CWE-1333 Description: A vulnerability has been found in Secure Systems Engineering Connaisseur up to 3.3.0 and classified as problematic. This vulnerability affects unknown code of the file connaisseur/res/targets_schema.json of the component Delegation Name Handler. The manipulation leads to inefficient regular expression complexity. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version
n complexity. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 3.3.1 is able to address this issue. The name of the patch is 524b73ff7306707f6d3a4d1e86401479bca91b02. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276268 - https://vuldb.com/?ctiid.276268 - https://github.com/sse-secure-systems/connaisseur/pull/1407 - https://github.com/sse-secure-systems/connaisseur/commit/524b73ff7306707f6d3a4d1e86401479bca91b02 - https://github.com/sse-secure-systems/connaisseur/releases/tag/v3.3.1
CVE ID: CVE-2023-7281 State: PUBLISHED Published: 2024-09-23T21:56:30.680Z Last Updated: 2024-09-24T18:30:49.744Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Compositing in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://issues.chromium.org/issues/40055233
CVE ID: CVE-2023-7282 State: PUBLISHED Published: 2024-09-23T21:56:30.976Z Last Updated: 2024-09-24T17:51:13.002Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Navigation in Google Chrome prior to 113.0.5672.63 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://issues.chromium.org/issues/40056040
CVE ID: CVE-2023-7286 State: PUBLISHED Published: 2024-10-16T06:43:32.686Z Last Updated: 2024-10-16T18:05:43.218Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: podpirate Products: ACF Quick Edit Fields Problem Types: CWE-639 Description: The plugin ACF Quick Edit Fields for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.2.2. This makes it possible for attackers without the edit_users capability to access metadata of other users, this includes contributor-level users and above. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5954bdc0-0
alyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5954bdc0-09e9-4691-95ff-02f7304514c9?source=cve - https://plugins.trac.wordpress.org/changeset?new=2828750%40acf-quickedit-fields&old=2816195%40acf-quickedit-fields#file89 - https://wpscan.com/vulnerability/3538e80e-c2c5-4e7b-97c3-b7debad7a136
CVE ID: CVE-2023-7287 State: PUBLISHED Published: 2024-10-16T06:43:24.306Z Last Updated: 2024-10-16T16:02:28.943Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: paytiumsupport Products: Paytium: Mollie payment forms & donations Problem Types: CWE-862 Description: The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized subscription cancellation due to a missing capability check on the pt_cancel_subscription function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to cancel a subscription to the plugin. Additional Analyst Notes: - CISA ADP Vulnric
ackers with subscriber-level access to cancel a subscription to the plugin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/060f31ab-cfa4-4ca8-846a-de76848b28fb?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2853869%40paytium%2Ftrunk&old=2824314%40paytium%2Ftrunk&sfp_email=&sfph_mail=#file0
CVE ID: CVE-2023-7288 State: PUBLISHED Published: 2024-10-16T06:43:26.248Z Last Updated: 2024-10-16T15:32:34.534Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: paytiumsupport Products: Paytium: Mollie payment forms & donations Problem Types: CWE-862 Description: The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the update_profile_preference function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to change plugin settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
s with subscriber-level access to change plugin settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2e9bee86-f491-4f68-b10b-051e0fb1a67b?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2853869%40paytium%2Ftrunk&old=2824314%40paytium%2Ftrunk&sfp_email=&sfph_mail=#file0
CVE ID: CVE-2023-7289 State: PUBLISHED Published: 2024-10-16T06:43:39.840Z Last Updated: 2024-10-16T19:32:38.843Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: paytiumsupport Products: Paytium: Mollie payment forms & donations Problem Types: CWE-862 Description: The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized API key update due to a missing capability check on the paytium_sw_save_api_keys function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to change plugin API keys. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - h
th subscriber-level access to change plugin API keys. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a92beff1-3bc6-459e-aeca-5cbdf2152388?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2853869%40paytium%2Ftrunk&old=2824314%40paytium%2Ftrunk&sfp_email=&sfph_mail=#file0
CVE ID: CVE-2023-7290 State: PUBLISHED Published: 2024-10-16T06:43:41.271Z Last Updated: 2024-10-16T19:34:02.071Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: paytiumsupport Products: Paytium: Mollie payment forms & donations Problem Types: CWE-862 Description: The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the check_for_verified_profiles function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to check profile statuses. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
with subscriber-level access to check profile statuses. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/af55c470-b94d-49ee-8b72-44652dcccd73?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2853869%40paytium%2Ftrunk&old=2824314%40paytium%2Ftrunk&sfp_email=&sfph_mail=#file0
CVE ID: CVE-2023-7291 State: PUBLISHED Published: 2024-10-16T06:43:43.626Z Last Updated: 2024-10-16T15:29:24.633Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) Vendors: paytiumsupport Products: Paytium: Mollie payment forms & donations Problem Types: CWE-862 Description: The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the create_mollie_account function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to set up a mollie account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
ith subscriber-level access to set up a mollie account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d4491b89-2120-4edb-a396-e45ba09b3b99?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2853869%40paytium%2Ftrunk&old=2824314%40paytium%2Ftrunk&sfp_email=&sfph_mail=#file0
CVE ID: CVE-2023-7292 State: PUBLISHED Published: 2024-10-16T06:43:45.569Z Last Updated: 2024-10-16T15:28:26.163Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: paytiumsupport Products: Paytium: Mollie payment forms & donations Problem Types: CWE-862 Description: The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized notification dismissal due to a missing capability check on the paytium_notice_dismiss function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to dismiss admin notices. Additional Analyst Notes: - CISA ADP Vulnrichment: References
ers with subscriber-level access to dismiss admin notices. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/eb6642c0-9011-419b-bef6-5aa594993c01?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2853869%40paytium%2Ftrunk&old=2824314%40paytium%2Ftrunk&sfp_email=&sfph_mail=#file0
CVE ID: CVE-2023-7293 State: PUBLISHED Published: 2024-10-16T06:43:46.043Z Last Updated: 2024-10-16T15:12:28.957Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: paytiumsupport Products: Paytium: Mollie payment forms & donations Problem Types: CWE-862 Description: The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the check_mollie_account_details function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to verify the existence of a mollie account. Additional Analyst Notes: - CISA ADP Vulnric
s with subscriber-level access to verify the existence of a mollie account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f065648a-436a-459c-8ab1-c948c78b43c9?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2853869%40paytium%2Ftrunk&old=2824314%40paytium%2Ftrunk&sfp_email=&sfph_mail=#file0
CVE ID: CVE-2023-7294 State: PUBLISHED Published: 2024-10-16T06:43:46.535Z Last Updated: 2024-10-16T15:07:42.579Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) Vendors: paytiumsupport Products: Paytium: Mollie payment forms & donations Problem Types: CWE-862 Description: The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the create_mollie_profile function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to create a mollie payment profile. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
subscriber-level access to create a mollie payment profile. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fbbd3209-7ed6-4409-a24e-9f6225cf10f5?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2853869%40paytium%2Ftrunk&old=2824314%40paytium%2Ftrunk&sfp_email=&sfph_mail=#file0
CVE ID: CVE-2023-7295 State: PUBLISHED Published: 2024-10-16T07:31:53.115Z Last Updated: 2024-10-16T12:58:15.441Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: nik00726 Products: Video Grid Problem Types: CWE-79 Description: The Video Grid plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search_term parameter in versions up to, and including, 1.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: -
if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/db5247ad-dbbf-4d8e-92f5-3a673b97d080?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2824307%40video-grid%2Ftags%2F1.21&new=2900422%40video-grid%2Ftags%2F1.22
CVE ID: CVE-2023-7296 State: PUBLISHED Published: 2024-10-16T07:31:50.234Z Last Updated: 2024-10-16T12:57:56.478Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: blindsidenetworks Products: BigBlueButton Problem Types: CWE-79 Description: The BigBlueButton plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the moderator code and viewer code fields in versions up to, and including, 3.0.0-beta.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with author privileges or higher to inject arbitrary web scripts in pages that execute if they can successfully trick a user into perfo
vileges or higher to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5f829d21-5347-46ec-9218-2b3cbe7d7b95?source=cve - https://plugins.trac.wordpress.org/browser/bigbluebutton/trunk/public/partials/bigbluebutton-join-display.php#L26
CVE ID: CVE-2023-7297 State: PUBLISHED Published: 2025-05-15T20:09:27.658Z Last Updated: 2025-11-13T21:15:10.200Z Vendors: Unknown Products: TwitterPosts Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The TwitterPosts WordPress plugin through 1.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/3632dfa1-2948-4622-a8fd-31edb8b22383/
CVE ID: CVE-2023-7298 State: PUBLISHED Published: 2024-12-09T15:09:34.167Z Last Updated: 2025-08-18T20:14:57.902Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Autodesk Products: Autodesk FBX SDK Problem Types: CWE-787 Description: A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://autodesk.com/trust/security-advisories/adsk-sa-2023-0025
CVE ID: CVE-2023-7299 State: PUBLISHED Published: 2024-11-23T13:00:15.959Z Last Updated: 2024-11-26T19:13:15.271Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: DataGear Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in DataGear up to 4.60. It has been declared as critical. This vulnerability affects unknown code of the file /dataSet/resolveSql. The manipulation of the argument sql leads to sql injection. The attack can be initiated remotely. Upgrading to version 4.7.0 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.28565
ade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.285658 - https://vuldb.com/?ctiid.285658 - https://vuldb.com/?submit.442943 - https://github.com/datageartech/datagear/issues/29
CVE ID: CVE-2023-7300 State: PUBLISHED Published: 2024-12-26T09:01:23.842Z Last Updated: 2024-12-26T16:52:53.767Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Huawei Products: HarmonyOS AILife Solution 8.0 Problem Types: CWE-35 Description: Huawei Home Music System has a path traversal vulnerability. Successful exploitation of this vulnerability may cause the music host file to be deleted or the file permission to be changed.(Vulnerability ID:HWPSIRT-2023-60613) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.huawei.com/en/psirt/security-advisories/2024/huawei-sa-ptvihhms-91f7c6fa-en
CVE ID: CVE-2023-7303 State: PUBLISHED Published: 2025-05-07T22:00:06.639Z Last Updated: 2025-05-08T13:25:01.608Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: q2apro Products: q2apro-on-site-notifications Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, was found in q2apro q2apro-on-site-notifications up to 1.4.6. This affects the function process_request of the file q2apro-onsitenotifications-page.php. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.4.8 is able to address this issue. The patch is named 0ca85ca02f8aceb661e9b71fd229c45d388ea5b5. It is recommende
rsion 1.4.8 is able to address this issue. The patch is named 0ca85ca02f8aceb661e9b71fd229c45d388ea5b5. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307479 - https://vuldb.com/?ctiid.307479 - https://vuldb.com/?submit.564749 - https://github.com/q2apro/q2apro-on-site-notifications/issues/43 - https://github.com/q2apro/q2apro-on-site-notifications/issues/43#issuecomment-1694357344 - https://github.com/q2apro/q2apro-on-site-notifications/commit/0ca85ca02f8aceb661e9b71fd229c45d388ea5b5
CVE ID: CVE-2023-7304 State: PUBLISHED Published: 2025-10-15T01:22:10.130Z Last Updated: 2025-11-21T16:17:56.857Z Vendors: Ruijie Networks Co., Ltd. Products: RG-UAC Problem Types: CWE-78 Description: Ruijie RG-UAC Application Management Gateway contains a command injection vulnerability via the 'nmc_sync.php' interface. An unauthenticated attacker able to reach the affected endpoint can inject shell commands via crafted request data, causing the application to execute arbitrary commands on the host. Successful exploitation can yield full control of the application process and may lead to system-level access depending on the service privileges. VulnCheck has observed this vulnerability being
and may lead to system-level access depending on the service privileges. VulnCheck has observed this vulnerability being targeted by the RondoDox botnet campaign. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cn-sec.com/archives/2284248.html - https://www.vulncheck.com/advisories/ruijie-rg-uac-nmc-sync-php-command-injection
CVE ID: CVE-2023-7305 State: PUBLISHED Published: 2025-10-15T01:24:53.813Z Last Updated: 2025-11-07T17:14:37.318Z Vendors: Guangzhou Smart Software Co., Ltd. Products: SmartBI Problem Types: CWE-434 Description: SmartBI V8, V9, and V10 contain an unrestricted file upload vulnerability via the RMIServlet request handling logic. Under certain configurations or usage patterns, attackers can send specially crafted requests that cause the application to perform sensitive operations or execute arbitrary code on the host. The vendor released a fix in July 2023 to address the underlying flaw. VulnCheck has observed this vulnerability being exploited in the wild. Additional Analyst Notes: - CISA ADP
lying flaw. VulnCheck has observed this vulnerability being exploited in the wild. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.smartbi.com.cn/patchinfo - https://avd.aliyun.com/detail?id=AVD-2023-1673292 - https://jeyiuwai.pages.dev/posts/1day-%E8%B7%9F%E8%B8%AAsmartbi-rmiservlet-%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E/ - https://www.vulncheck.com/advisories/smartbi-rmiservlet-unrestricted-file-upload-rce
CVE ID: CVE-2023-7306 State: PUBLISHED Published: 2025-07-25T08:22:50.295Z Last Updated: 2025-08-05T20:12:38.564Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: nmedia Products: Frontend File Manager Plugin Problem Types: CWE-862 Description: The Frontend File Manager Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wpfm_delete_multiple_files() function in all versions up to, and including, 21.5. This makes it possible for unauthenticated attackers to delete arbitrary posts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/abf422ce-fa03-4bed-a4ec-b31d36de7633?source=cve - https://plugins.trac.wordpress.org/changeset/2912124/nmedia-user-file-uploader/trunk/inc/files.php