Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-6827 State: PUBLISHED Published: 2023-12-15T07:30:42.053Z Last Updated: 2024-08-02T08:42:07.635Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: g5theme Products: Essential Real Estate Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The Essential Real Estate plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'ajaxUploadFonts' function in versions up to, and including, 4.3.5. This makes it possible for authenticated attackers with subscriber-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code
scriber-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8bb2ce22-077b-41dd-a2ff-cc1db9d20d38?source=cve - https://plugins.trac.wordpress.org/browser/essential-real-estate/tags/4.3.5/lib/smart-framework/core/fonts/fonts.class.php#L524 - https://plugins.trac.wordpress.org/changeset/3009780/essential-real-estate
CVE ID: CVE-2023-6828 State: PUBLISHED Published: 2024-01-11T08:32:37.581Z Last Updated: 2024-11-06T18:53:38.358Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: reputeinfosystems Products: Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ arf_http_referrer_url’ parameter in all versions up to, and including, 1.5.8 due to insufficient input sanitization and ou
f_http_referrer_url’ parameter in all versions up to, and including, 1.5.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6e349cae-a996-4a32-807a-a98ebcb01edd?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3013347@arforms-form-builder/trunk&old=2998602@arforms-form-builder/trunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6830 State: PUBLISHED Published: 2024-01-09T06:41:00.765Z Last Updated: 2025-06-03T14:33:09.789Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: sswells Products: Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Formidable Forms plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 6.7. This vulnerability allows unauthenticated users to inject arbitrary HTML code into form fields. When the form data is viewed by an administrator in the Entries
ed users to inject arbitrary HTML code into form fields. When the form data is viewed by an administrator in the Entries View Page, the injected HTML code is rendered, potentially leading to admin area defacement or redirection to malicious websites. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ff294b0f-97fe-4d27-bf93-f5bbb57ac1f6?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3017166%40formidable%2Ftrunk&old=3009066%40formidable%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6831 State: PUBLISHED Published: 2023-12-15T00:00:31.210Z Last Updated: 2024-08-02T08:42:07.635Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: mlflow Products: mlflow/mlflow Problem Types: CWE-29 Description: Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.com/bounties/0acdd745-0167-4912-9d5c-02035fe5b314 - https://github.com/mlflow/mlflow/commit/1da75dfcecd4d169e34809ade55748384e8af6c1
CVE ID: CVE-2023-6832 State: PUBLISHED Published: 2023-12-15T00:00:34.102Z Last Updated: 2024-11-27T17:05:43.688Z Severity: MEDIUM (CVSS 6 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L) Vendors: microweber Products: microweber/microweber Problem Types: CWE-840 Description: Business Logic Errors in GitHub repository microweber/microweber prior to 2.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/53105a20-f4b1-45ad-a734-0349de6d7376 - https://github.com/microweber/microweber/commit/890e9838aabbc799ebefcf6b20ba25e0fd6dbfee
CVE ID: CVE-2023-6833 State: PUBLISHED Published: 2024-04-23T05:35:48.828Z Last Updated: 2024-08-02T08:42:07.916Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Hitachi Products: Hitachi Ops Center Administrator Problem Types: CWE-532 Description: Insertion of Sensitive Information into Log File vulnerability in Hitachi Ops Center Administrator allows local users to gain sensitive information.This issue affects Hitachi Ops Center Administrator: before 11.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-121/index.html
CVE ID: CVE-2023-6835 State: PUBLISHED Published: 2023-12-15T09:16:27.473Z Last Updated: 2024-08-02T08:42:07.483Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: WSO2 Products: WSO2 API Manager, WSO2 IoT Server Problem Types: CWE-20 Description: Multiple WSO2 products have been identified as vulnerable due to lack of server-side input validation in the Forum feature, API rating could be manipulated. Additional Analyst Notes: - CVE Program Container: References: - https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2021-1357/
CVE ID: CVE-2023-6836 State: PUBLISHED Published: 2023-12-15T09:26:01.323Z Last Updated: 2024-08-02T08:42:08.180Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: WSO2 Products: WSO2 API Manager , WSO2 API Manager Analytics, WSO2 API Microgateway, WSO2 Enterprise Integrator, WSO2 IS as Key Manager, WSO2 Identity Server, WSO2 Micro Integrator Problem Types: CWE-611 Description: Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely used feature of XML parsers to access sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://security.docs.w
o access sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-0716/
CVE ID: CVE-2023-6837 State: PUBLISHED Published: 2023-12-15T09:41:22.719Z Last Updated: 2025-09-25T14:59:58.384Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) Vendors: WSO2 Products: WSO2 API Manager, WSO2 Identity Server, WSO2 Identity Server as Key Manager, WSO2 Carbon Identity Application Authentication Framework Problem Types: CWE-863 Description: Multiple WSO2 products have been identified as vulnerable to perform user impersonatoin using JIT provisioning. In order for this vulnerability to have any impact on your deployment, following conditions must be met: * An IDP configured for federated authentication and JIT provisioning enabled with the "Prompt for user
ons must be met: * An IDP configured for federated authentication and JIT provisioning enabled with the "Prompt for username, password and consent" option. * A service provider that uses the above IDP for federated authentication and has the "Assert identity using mapped local subject identifier" flag enabled. Attacker should have: * A fresh valid user account in the federated IDP that has not been used earlier. * Knowledge of the username of a valid user in the local IDP. When all preconditions are met, a malicious actor could use JIT provisioning flow to perform user impersonation. Additional Analyst Notes: - CVE Program Container: References: - https://security.docs.wso2.com/en/latest/sec
rsonation. Additional Analyst Notes: - CVE Program Container: References: - https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1573/
CVE ID: CVE-2023-6838 State: PUBLISHED Published: 2023-12-15T09:50:52.147Z Last Updated: 2024-08-02T08:42:07.910Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: WSO2 Products: WSO2 API Manager, WSO2 Identity Server, WSO2 IS as Key Manager Problem Types: CWE-79 Description: Reflected XSS vulnerability can be exploited by tampering a request parameter in Authentication Endpoint. This can be performed in both authenticated and unauthenticated requests. Additional Analyst Notes: - CVE Program Container: References: - https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-1233/
CVE ID: CVE-2023-6839 State: PUBLISHED Published: 2023-12-15T10:14:14.676Z Last Updated: 2024-10-08T14:14:43.216Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: WSO2 Products: WSO2 API Manager Problem Types: CWE-209 Description: Due to improper error handling, a REST API resource could expose a server side error containing an internal WSO2 specific package name in the HTTP response. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1334/
CVE ID: CVE-2023-6840 State: PUBLISHED Published: 2024-02-07T22:02:20.934Z Last Updated: 2025-11-20T04:11:43.314Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-862 Description: An issue has been discovered in GitLab EE affecting all versions from 16.4 prior to 16.6.7, 16.7 prior to 16.7.5, and 16.8 prior to 16.8.2 which allows a maintainer to change the name of a protected branch that bypasses the security policy added to block MR. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/435500 - https://hackerone.com/reports/2280292
CVE ID: CVE-2023-6841 State: PUBLISHED Published: 2024-09-10T16:15:32.639Z Last Updated: 2025-11-08T07:10:39.283Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat build of Quarkus, Red Hat Fuse 7, Red Hat Mobile Application Platform 4, Red Hat OpenShift Application Runtimes, Red Hat Process Automation 7, Red Hat Single Sign-On 7, Red Hat support for Spring Boot Problem Types: CWE-231 Description: A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with long attr
r by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with long attribute values. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-6841 - https://bugzilla.redhat.com/show_bug.cgi?id=2254714
CVE ID: CVE-2023-6842 State: PUBLISHED Published: 2024-01-09T06:41:00.196Z Last Updated: 2025-06-17T20:39:18.211Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: sswells Products: Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the name field label and description field label parameter in all versions up to 6.7 (inclusive) due to
e Scripting via the name field label and description field label parameter in all versions up to 6.7 (inclusive) due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, this only affects multi-site installations and installations where unfiltered_html has been disabled. However, in the formidable settings admins can extend form creation, deletion and other management permissions to other user types, which makes it possible for this vulnerability to be exploited by lower level user types as lo
ions to other user types, which makes it possible for this vulnerability to be exploited by lower level user types as long as they have been granted the proper permissions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/47e402c3-e06c-4ac9-8c60-5666cb1101ce?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3017166%40formidable%2Ftrunk&old=3009066%40formidable%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6843 State: PUBLISHED Published: 2024-01-15T15:10:39.949Z Last Updated: 2025-06-03T14:00:36.623Z Vendors: Unknown Products: easy.jobs- Best Recruitment Plugin for Job Board Listing, Manager, Career Page for Elementor & Gutenberg Problem Types: CWE-284 Improper Access Control Description: The easy.jobs- Best Recruitment Plugin for Job Board Listing, Manager, Career Page for Elementor & Gutenberg WordPress plugin before 2.4.7 does not properly secure some of its AJAX actions, allowing any logged-in users to modify its settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/41508340-8caf-4dca-bd88-350b
Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/41508340-8caf-4dca-bd88-350b63b78ab0
CVE ID: CVE-2023-6844 State: PUBLISHED Published: 2024-05-23T01:56:19.259Z Last Updated: 2024-08-02T08:42:07.435Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N) Vendors: webvitaly Products: iframe Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The iframe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to and including 5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scri
makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c16e16dc-8888-4222-862f-a57a9f14e7f4?source=cve - https://plugins.trac.wordpress.org/browser/iframe/trunk/iframe.php#L37 - https://plugins.trac.wordpress.org/browser/iframe/trunk/iframe.php#L60 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3089839%40iframe%2Ftrunk&old=3036990%40iframe%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6845 State: PUBLISHED Published: 2024-01-08T19:00:38.284Z Last Updated: 2025-05-16T15:23:55.363Z Vendors: Unknown Products: CommentTweets Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The CommentTweets WordPress plugin through 0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/cbdaf158-f277-4be4-b022-68d18dae4c55 - https://magos-securitas.com/txt/2023-6845
CVE ID: CVE-2023-6846 State: PUBLISHED Published: 2024-02-05T21:27:12.028Z Last Updated: 2025-06-17T21:29:25.116Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: File Manager Products: File Manager Pro Problem Types: CWE-94 Improper Control of Generation of Code ('Code Injection') Description: The File Manager Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.3.4 via the mk_check_filemanager_php_syntax AJAX function. This makes it possible for authenticated attackers, with subscriber access and above, to execute code on the server. Version 8.3.5 introduces a capability check that prevents users lower than a
s and above, to execute code on the server. Version 8.3.5 introduces a capability check that prevents users lower than admin from executing this function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1e8e0257-a745-495f-a103-c032b95209fc?source=cve - https://gist.github.com/Kun19/046b2b305cac5f2edd38037984c2e8e3
CVE ID: CVE-2023-6847 State: PUBLISHED Published: 2023-12-21T20:46:07.362Z Last Updated: 2024-08-02T08:42:07.604Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: GitHub Products: Enterprise Server Problem Types: CWE-287 Description: An improper authentication vulnerability was identified in GitHub Enterprise Server that allowed a bypass of Private Mode by using a specially crafted API request. To exploit this vulnerability, an attacker would need network access to the Enterprise Server appliance configured in Private Mode. This vulnerability affected all versions of GitHub Enterprise Server since 3.9 and was fixed in version 3.9.7, 3.10.4, and 3.11.1. This vul
affected all versions of GitHub Enterprise Server since 3.9 and was fixed in version 3.9.7, 3.10.4, and 3.11.1. This vulnerability was reported via the GitHub Bug Bounty program. Additional Analyst Notes: - CVE Program Container: References: - https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7 - https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4 - https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1
CVE ID: CVE-2023-6848 State: PUBLISHED Published: 2023-12-16T06:31:04.404Z Last Updated: 2024-08-02T08:42:07.684Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: kalcaddle Products: kodbox Problem Types: CWE-77 Description: A vulnerability was found in kalcaddle kodbox up to 1.48. It has been declared as critical. Affected by this vulnerability is the function check of the file plugins/officeViewer/controller/libreOffice/index.class.php. The manipulation of the argument soffice leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.48.04 is able to address this issue. The identifier of
n disclosed to the public and may be used. Upgrading to version 1.48.04 is able to address this issue. The identifier of the patch is 63a4d5708d210f119c24afd941d01a943e25334c. It is recommended to upgrade the affected component. The identifier VDB-248209 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.248209 - https://vuldb.com/?ctiid.248209 - https://note.zhaoj.in/share/pf838kAzQyTQ - https://github.com/kalcaddle/kodbox/commit/63a4d5708d210f119c24afd941d01a943e25334c - https://github.com/kalcaddle/kodbox/releases/tag/1.48.04
CVE ID: CVE-2023-6849 State: PUBLISHED Published: 2023-12-16T08:00:06.005Z Last Updated: 2024-08-27T16:09:00.482Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: kalcaddle Products: kodbox Problem Types: CWE-918 Description: A vulnerability was found in kalcaddle kodbox up to 1.48. It has been rated as critical. Affected by this issue is the function cover of the file plugins/fileThumb/app.php. The manipulation of the argument path leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.48.04 is able to address this issue. The patch is identified as 63a4d5708d210f119c24afd941d
used. Upgrading to version 1.48.04 is able to address this issue. The patch is identified as 63a4d5708d210f119c24afd941d01a943e25334c. It is recommended to upgrade the affected component. VDB-248210 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.248210 - https://vuldb.com/?ctiid.248210 - https://note.zhaoj.in/share/jSsPAWT1pKsq - https://github.com/kalcaddle/kodbox/commit/63a4d5708d210f119c24afd941d01a943e25334c - https://github.com/kalcaddle/kodbox/releases/tag/1.48.04
CVE ID: CVE-2023-6850 State: PUBLISHED Published: 2023-12-16T08:31:04.330Z Last Updated: 2024-10-07T14:58:00.890Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: kalcaddle Products: KodExplorer Problem Types: CWE-434 Description: A vulnerability was found in kalcaddle KodExplorer up to 4.51.03. It has been declared as critical. This vulnerability affects unknown code of the file /index.php?pluginApp/to/yzOffice/getFile of the component API Endpoint Handler. The manipulation of the argument path/file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.52.01 is able to address this
tely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.52.01 is able to address this issue. The patch is identified as 5cf233f7556b442100cf67b5e92d57ceabb126c6. It is recommended to upgrade the affected component. VDB-248218 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.248218 - https://vuldb.com/?ctiid.248218 - https://note.zhaoj.in/share/L38RNzUOwOtN - https://github.com/kalcaddle/KodExplorer/commit/5cf233f7556b442100cf67b5e92d57ceabb126c6 - https://github.com/kalcaddle/KodExplorer/releases/tag/4.52.01
CVE ID: CVE-2023-6851 State: PUBLISHED Published: 2023-12-16T11:00:05.048Z Last Updated: 2024-08-02T08:42:07.941Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: kalcaddle Products: KodExplorer Problem Types: CWE-94 Description: A vulnerability was found in kalcaddle KodExplorer up to 4.51.03. It has been rated as critical. This issue affects the function unzipList of the file plugins/zipView/app.php of the component ZIP Archive Handler. The manipulation leads to code injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.52.01 is able to address this issue. The patch is named 5cf233f7556b442100cf67b5
and may be used. Upgrading to version 4.52.01 is able to address this issue. The patch is named 5cf233f7556b442100cf67b5e92d57ceabb126c6. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-248219. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.248219 - https://vuldb.com/?ctiid.248219 - https://note.zhaoj.in/share/D44UjzoFXYfi - https://github.com/kalcaddle/KodExplorer/commit/5cf233f7556b442100cf67b5e92d57ceabb126c6 - https://github.com/kalcaddle/KodExplorer/releases/tag/4.52.01