Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-6134 State: PUBLISHED Published: 2023-12-14T21:42:12.160Z Last Updated: 2025-11-11T16:25:15.697Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Red Hat Products: Red Hat build of Keycloak 22, Red Hat build of Keycloak 22.0.7, Red Hat Single Sign-On 7, Red Hat Single Sign-On 7.6 for RHEL 7, Red Hat Single Sign-On 7.6 for RHEL 8, Red Hat Single Sign-On 7.6 for RHEL 9, RHEL-8 based Middleware Containers, Single Sign-On 7.6.6 Problem Types: CWE-79 Description: A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an attacker to submit a specially
ects, but permits them if a wildcard is appended to the token. This issue could allow an attacker to submit a specially crafted request leading to cross-site scripting (XSS) or further attacks. This flaw is the result of an incomplete fix for CVE-2020-10748. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:7854 - https://access.redhat.com/errata/RHSA-2023:7855 - https://access.redhat.com/errata/RHSA-2023:7856 - https://access.redhat.com/errata/RHSA-2023:7857 - https://access.redhat.com/errata/RHSA-2023:7858 - https://access.redhat.com/errata/RHSA-2023:7860 - https://access.redhat.com/errata/RHSA-2023:7861 - https://access.redhat.com/
//access.redhat.com/errata/RHSA-2023:7860 - https://access.redhat.com/errata/RHSA-2023:7861 - https://access.redhat.com/errata/RHSA-2024:0798 - https://access.redhat.com/errata/RHSA-2024:0799 - https://access.redhat.com/errata/RHSA-2024:0800 - https://access.redhat.com/errata/RHSA-2024:0801 - https://access.redhat.com/errata/RHSA-2024:0804 - https://access.redhat.com/security/cve/CVE-2023-6134 - https://bugzilla.redhat.com/show_bug.cgi?id=2249673
CVE ID: CVE-2023-6135 State: PUBLISHED Published: 2023-12-19T13:38:46.388Z Last Updated: 2025-02-13T17:26:05.649Z Vendors: Mozilla Products: Firefox Problem Types: NSS susceptible to "Minerva" attack Description: Multiple NSS NIST curves were susceptible to a side-channel attack known as "Minerva". This attack could potentially allow an attacker to recover the private key. This vulnerability affects Firefox < 121. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1853908 - https://www.mozilla.org/security/advisories/mfsa2023-56/ - https://security.gentoo.org/glsa/202401-10
CVE ID: CVE-2023-6136 State: PUBLISHED Published: 2023-11-30T14:14:32.153Z Last Updated: 2024-08-02T08:21:17.724Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Bowo Products: Debug Log Manager Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Bowo Debug Log Manager.This issue affects Debug Log Manager: from n/a through 2.3.0. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/debug-log-manager/wordpress-debug-log-manager-plugin-2-2-0-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve
CVE ID: CVE-2023-6137 State: PUBLISHED Published: 2023-11-30T12:50:03.408Z Last Updated: 2024-08-02T08:21:17.404Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: finnj Products: Frontier Post Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in finnj Frontier Post allows Cross Site Request Forgery.This issue affects Frontier Post: from n/a through 6.1. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/frontier-post/wordpress-frontier-post-plugin-6-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-6138 State: PUBLISHED Published: 2024-02-14T22:12:16.966Z Last Updated: 2024-11-21T21:37:16.403Z Vendors: HP Inc. Products: Certain HP Workstation PCs Description: A potential security vulnerability has been identified in the system BIOS for certain HP Workstation PCs, which might allow escalation of privilege, arbitrary code execution, or denial of service. HP is releasing mitigation for the potential vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hp.com/us-en/document/ish_10167884-10167908-16/hpsbhf03915
CVE ID: CVE-2023-6139 State: PUBLISHED Published: 2024-01-08T19:00:31.085Z Last Updated: 2025-06-03T14:34:52.005Z Vendors: Unknown Products: Essential Real Estate Problem Types: CWE-862 Missing Authorization Description: The Essential Real Estate WordPress plugin before 4.4.0 does not apply proper capability checks on its AJAX actions, which among other things, allow attackers with a subscriber account to conduct Denial of Service attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/96396a22-f523-4c51-8b72-52be266988aa
CVE ID: CVE-2023-6140 State: PUBLISHED Published: 2024-01-08T19:00:36.658Z Last Updated: 2024-09-04T15:36:41.937Z Vendors: Unknown Products: Essential Real Estate Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The Essential Real Estate WordPress plugin before 4.4.0 does not prevent users with limited privileges on the site, like subscribers, from momentarily uploading malicious PHP files disguised as ZIP archives, which may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c837eaf3-fafd-45a2-8f5e-03afb28a765b
CVE ID: CVE-2023-6141 State: PUBLISHED Published: 2024-01-08T19:00:35.602Z Last Updated: 2025-06-18T16:04:52.195Z Vendors: Unknown Products: Essential Real Estate Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Essential Real Estate WordPress plugin before 4.4.0 does not apply proper capability checks on its AJAX actions, which among other things, allow attackers with a subscriber account to conduct Stored XSS attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/df12513b-9664-45be-8824-2924bfddf364
CVE ID: CVE-2023-6142 State: PUBLISHED Published: 2023-11-20T23:24:48.652Z Last Updated: 2025-05-19T13:54:39.840Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Dev Blog Products: Dev Blog Problem Types: CWE-79 Description: Dev blog v1.0 allows to exploit an XSS through an unrestricted file upload, together with a bad entropy of filenames. With this an attacker can upload a malicious HTML file, then guess the filename of the uploaded file and send it to a potential victim. Additional Analyst Notes: - CVE Program Container: References: - https://fluidattacks.com/advisories/bunny/ - https://github.com/Armanidrisi/devblog/
CVE ID: CVE-2023-6143 State: PUBLISHED Published: 2024-03-04T09:54:23.132Z Last Updated: 2024-08-28T19:03:56.048Z Vendors: Arm Ltd Products: Midgard GPU Kernel Driver, Bifrost GPU Kernel Driver, Valhall GPU Kernel Driver, Arm 5th Gen GPU Architecture Kernel Driver Problem Types: CWE-416 Description: Use After Free vulnerability in Arm Ltd Midgard GPU Kernel Driver, Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to exploit a software race condition to perform improper memory processing operations. If the system’s memory is carefully prepared by the user and the system is under heavy lo
memory processing operations. If the system’s memory is carefully prepared by the user and the system is under heavy load, then this in turn cause a use-after-free.This issue affects Midgard GPU Kernel Driver: from r13p0 through r32p0; Bifrost GPU Kernel Driver: from r1p0 through r18p0; Valhall GPU Kernel Driver: from r37p0 through r46p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r46p0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE ID: CVE-2023-6144 State: PUBLISHED Published: 2023-11-20T23:20:38.606Z Last Updated: 2024-08-02T08:21:17.568Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Dev Blog Products: Dev Blog Problem Types: CWE-639 Description: Dev blog v1.0 allows to exploit an account takeover through the "user" cookie. With this, an attacker can access any user's session just by knowing their username. Additional Analyst Notes: - CVE Program Container: References: - https://fluidattacks.com/advisories/almighty/ - https://github.com/Armanidrisi/devblog/
CVE ID: CVE-2023-6145 State: PUBLISHED Published: 2023-12-21T13:58:18.662Z Last Updated: 2024-08-02T08:21:17.609Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: İstanbul Soft Informatics and Consultancy Limited Company Products: Softomi Advanced C2C Marketplace Software Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in İstanbul Soft Informatics and Consultancy Limited Company Softomi Advanced C2C Marketplace Software allows SQL Injection.This issue affects Softomi Advanced C2C Marketplace Software: before 12122023. Additional Analyst Notes: - CVE Program Container: Refe
ects Softomi Advanced C2C Marketplace Software: before 12122023. Additional Analyst Notes: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-23-0724
CVE ID: CVE-2023-6146 State: PUBLISHED Published: 2023-12-08T14:21:56.577Z Last Updated: 2024-10-09T13:48:40.807Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: Qualys Products: Qualysguard Problem Types: CWE-79 Description: A Qualys web application was found to have a stored XSS vulnerability resulting from the absence of HTML encoding in the presentation of logging information to users. This vulnerability allowed a user with login access to the application to introduce XSS payload via browser details. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.qualys.com/security-advisories/
CVE ID: CVE-2023-6147 State: PUBLISHED Published: 2024-01-09T08:08:43.883Z Last Updated: 2025-02-13T17:26:06.210Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: Qualys,Inc. Products: Policy Compliance Connector Jenkins Plugin Problem Types: CWE-611 Description: Qualys Jenkins Plugin for Policy Compliance prior to version and including 1.0.5 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access to configure or edit jobs to utilize the plugin and configure potential a rouge endpoint via which it was possible to control respo
e or edit jobs to utilize the plugin and configure potential a rouge endpoint via which it was possible to control response for certain request which could be injected with XXE payloads leading to XXE while processing the response data Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.qualys.com/security-advisories/ - http://www.openwall.com/lists/oss-security/2024/01/24/6
CVE ID: CVE-2023-6148 State: PUBLISHED Published: 2024-01-09T08:14:51.063Z Last Updated: 2025-04-17T17:59:33.171Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: Qualys,Inc. Products: Policy Compliance Connector Jenkins Plugin Problem Types: CWE-79 Description: Qualys Jenkins Plugin for Policy Compliance prior to version and including 1.0.5 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access and access to configure or edit jobs to utilize the plugin to configure a potential rouge endpoint via which it was possible to cont
o configure or edit jobs to utilize the plugin to configure a potential rouge endpoint via which it was possible to control response for certain request which could be injected with XSS payloads leading to XSS while processing the response data Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.qualys.com/security-advisories/ - http://www.openwall.com/lists/oss-security/2024/01/24/6
CVE ID: CVE-2023-6149 State: PUBLISHED Published: 2024-01-09T08:21:12.804Z Last Updated: 2025-06-16T19:55:06.009Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: Qualys,Inc. Products: Web App Scanning Connector Jenkins Plugin Problem Types: CWE-611 Description: Qualys Jenkins Plugin for WAS prior to version and including 2.0.11 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access to configure or edit jobs to utilize the plugin and configure potential a rouge endpoint via which it was possible to control response for certai
to utilize the plugin and configure potential a rouge endpoint via which it was possible to control response for certain request which could be injected with XXE payloads leading to XXE while processing the response data Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.qualys.com/security-advisories/
CVE ID: CVE-2023-6150 State: PUBLISHED Published: 2023-11-28T09:25:50.738Z Last Updated: 2024-09-26T12:11:50.414Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: ESKOM Computer Products: e-municipality module Problem Types: CWE-648 Description: Incorrect Use of Privileged APIs vulnerability in ESKOM Computer e-municipality module allows Collect Data as Provided by Users.This issue affects e-municipality module: before v.105. Additional Analyst Notes: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-23-0664
CVE ID: CVE-2023-6151 State: PUBLISHED Published: 2023-11-28T09:29:12.504Z Last Updated: 2024-09-26T12:11:28.941Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: ESKOM Computer Products: e-municipality module Problem Types: CWE-648 Description: Incorrect Use of Privileged APIs vulnerability in ESKOM Computer e-municipality module allows Collect Data as Provided by Users.This issue affects e-municipality module: before v.105. Additional Analyst Notes: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-23-0664
CVE ID: CVE-2023-6152 State: PUBLISHED Published: 2024-02-13T21:38:01.404Z Last Updated: 2025-02-15T00:10:28.890Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Grafana Products: Grafana, Grafana Enterprise Problem Types: CWE-863 Description: A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration option "verify_email_enabled" will only validate email only on sign up. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://grafana.com/security/security-advisories/cve-2023-6152/ - https://github.com/grafana/bugbounty/security/advisories/G
s://grafana.com/security/security-advisories/cve-2023-6152/ - https://github.com/grafana/bugbounty/security/advisories/GHSA-3hv4-r2fm-h27f
CVE ID: CVE-2023-6153 State: PUBLISHED Published: 2024-03-27T12:09:29.109Z Last Updated: 2024-08-23T18:47:48.931Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: TeoSOFT Software Products: TeoBASE Problem Types: CWE-305 Description: Authentication Bypass by Primary Weakness vulnerability in TeoSOFT Software TeoBASE allows Authentication Bypass.This issue affects TeoBASE: through 20240327. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-24-0238
CVE ID: CVE-2023-6154 State: PUBLISHED Published: 2024-04-01T10:06:57.864Z Last Updated: 2024-08-12T18:40:14.131Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Bitdefender Products: Total Security, Internet Security, Antivirus Plus, Antivirus Free Problem Types: CWE-15 Description: A configuration setting issue in seccenter.exe as used in Bitdefender Total Security, Bitdefender Internet Security, Bitdefender Antivirus Plus, Bitdefender Antivirus Free allows an attacker to change the product's expected behavior and potentially load a third-party library upon execution. This issue affects Total Security: 27.0.25.114; Internet Security: 27.0.25.114; Antivirus P
arty library upon execution. This issue affects Total Security: 27.0.25.114; Internet Security: 27.0.25.114; Antivirus Plus: 27.0.25.114; Antivirus Free: 27.0.25.114. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bitdefender.com/support/security-advisories/local-privilege-escalation-in-bitdefender-total-security-va-11168/
CVE ID: CVE-2023-6155 State: PUBLISHED Published: 2023-12-26T18:33:11.835Z Last Updated: 2024-09-12T12:30:30.651Z Vendors: Unknown Products: Quiz Maker Problem Types: CWE-200 Information Exposure Description: The Quiz Maker WordPress plugin before 6.4.9.5 does not adequately authorize the `ays_quiz_author_user_search` AJAX action, allowing an unauthenticated attacker to perform a search for users of the system, ultimately leaking user email addresses. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c62be802-e91a-4bcf-990d-8fd8ef7c9a28
CVE ID: CVE-2023-6156 State: PUBLISHED Published: 2023-11-22T16:24:15.515Z Last Updated: 2024-08-02T08:21:17.614Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: Checkmk GmbH Products: Checkmk Problem Types: CWE-140 Description: Improper neutralization of livestatus command delimiters in the availability timeline in Checkmk <= 2.0.0p39, < 2.1.0p37, and < 2.2.0p15 allows arbitrary livestatus command execution for authorized users. Additional Analyst Notes: - CVE Program Container: References: - https://checkmk.com/werk/16221
CVE ID: CVE-2023-6157 State: PUBLISHED Published: 2023-11-22T16:24:22.002Z Last Updated: 2024-08-02T08:21:17.625Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: Checkmk GmbH Products: Checkmk Problem Types: CWE-140 Description: Improper neutralization of livestatus command delimiters in ajax_search in Checkmk <= 2.0.0p39, < 2.1.0p37, and < 2.2.0p15 allows arbitrary livestatus command execution for authorized users. Additional Analyst Notes: - CVE Program Container: References: - https://checkmk.com/werk/16221
CVE ID: CVE-2023-6158 State: PUBLISHED Published: 2024-01-10T14:32:07.924Z Last Updated: 2025-06-03T14:27:58.455Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: ashanjay, EventON Products: EventON, EventON Pro Problem Types: CWE-862 Missing Authorization Description: The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the evo_eventpost_update_meta function in all versions up to, and including, 4.5.4 (for Pro) and 2.2.7 (for free). This makes it possible for unauthenticated attackers to update and remove arbitrary post metadata. Not
2.2.7 (for free). This makes it possible for unauthenticated attackers to update and remove arbitrary post metadata. Note that certain parameters may allow for content injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/19f94c4f-145b-4058-aabd-06525fce3cea?source=cve - https://docs.myeventon.com/documentations/eventon-changelog/ - https://plugins.trac.wordpress.org/changeset/3017578/eventon-lite/trunk/includes/admin/class-admin-ajax.php
CVE ID: CVE-2023-6159 State: PUBLISHED Published: 2024-01-26T02:02:29.909Z Last Updated: 2025-11-20T04:11:18.264Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-1333 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 12.7 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 It was possible for an attacker to trigger a Regular Expression Denial of Service via a `Cargo.toml` containing maliciously crafted input. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://about.gitlab.com/releases/2024/01/25/critical-security-release-g
ntainer: - CISA ADP Vulnrichment: References: - https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/ - https://gitlab.com/gitlab-org/gitlab/-/issues/431924 - https://hackerone.com/reports/2251278
CVE ID: CVE-2023-6160 State: PUBLISHED Published: 2023-11-22T15:33:26.141Z Last Updated: 2024-10-10T20:41:25.704Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:L) Vendors: chrisbadgett Products: LifterLMS – WordPress LMS Plugin for eLearning Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 7.4.2 via the maybe_serve_export function. This makes it possible for authenticated attackers, with administrator or LMS manager access and above, to read the contents of arbitrary
sible for authenticated attackers, with administrator or LMS manager access and above, to read the contents of arbitrary CSV files on the server, which can contain sensitive information as well as removing those files from the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6d0fcd82-6d4a-454f-8056-a896e8d41d00?source=cve - https://plugins.trac.wordpress.org/changeset/2989461/
CVE ID: CVE-2023-6161 State: PUBLISHED Published: 2024-01-08T19:00:27.990Z Last Updated: 2025-06-17T14:52:07.947Z Vendors: Unknown Products: WP Crowdfunding Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Crowdfunding WordPress plugin before 2.1.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ca7b6a39-a910-4b4f-b9cc-be444ec44942
CVE ID: CVE-2023-6163 State: PUBLISHED Published: 2024-01-15T15:10:41.014Z Last Updated: 2025-06-09T20:47:31.725Z Vendors: Unknown Products: WP Crowdfunding Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Crowdfunding WordPress plugin before 2.1.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7ed6de4d-0a37-497f-971d-b6711893c557