Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
this issue. The name of the patch is c3e6d69422e1f0c80fe53f2d757b8df97619af2b. It is recommended to upgrade the affected component. The identifier VDB-216737 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.216737 - https://github.com/aws-amplify/aws-sdk-android/pull/3100 - https://github.com/aws-amplify/aws-sdk-android/commit/c3e6d69422e1f0c80fe53f2d757b8df97619af2b - https://github.com/aws-amplify/aws-sdk-android/releases/tag/release_v2.59.1
CVE ID: CVE-2022-4726 State: PUBLISHED Published: 2022-12-24T00:00:00.000Z Last Updated: 2025-04-10T18:04:02.766Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Sanitization Management System Problem Types: CWE-707 Description: A vulnerability classified as critical was found in SourceCodester Sanitization Management System 1.0. Affected by this vulnerability is an unknown functionality of the component Admin Login. The manipulation of the argument username/password leads to sql injection. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-216739. Additional Analyst Notes: - CVE Program Conta
d remotely. The associated identifier of this vulnerability is VDB-216739. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.216739
CVE ID: CVE-2022-4727 State: PUBLISHED Published: 2022-12-24T00:00:00.000Z Last Updated: 2025-04-10T20:11:21.213Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: OpenMRS Products: Appointment Scheduling Module Problem Types: CWE-707 Description: A vulnerability, which was classified as problematic, was found in OpenMRS Appointment Scheduling Module up to 1.16.x. This affects the function getNotes of the file api/src/main/java/org/openmrs/module/appointmentscheduling/AppointmentRequest.java of the component Notes Handler. The manipulation of the argument notes leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.1
e argument notes leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.17.0 is able to address this issue. The name of the patch is 2ccbe39c020809765de41eeb8ee4c70b5ec49cc8. It is recommended to upgrade the affected component. The identifier VDB-216741 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/openmrs/openmrs-module-appointmentscheduling/pull/39 - https://github.com/openmrs/openmrs-module-appointmentscheduling/releases/tag/1.17.0 - https://github.com/openmrs/openmrs-module-appointmentscheduling/commit/2ccbe39c020809765de41eeb8ee4c70b5ec49cc8 -
17.0 - https://github.com/openmrs/openmrs-module-appointmentscheduling/commit/2ccbe39c020809765de41eeb8ee4c70b5ec49cc8 - https://vuldb.com/?id.216741
CVE ID: CVE-2022-4728 State: PUBLISHED Published: 2022-12-24T00:00:00.000Z Last Updated: 2025-04-10T20:11:56.308Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: Graphite Products: Web Problem Types: CWE-707 Description: A vulnerability has been found in Graphite Web and classified as problematic. This vulnerability affects unknown code of the component Cookie Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 2f178f490e10efc03cd1d27c72f64ecab224eb23. It is recommended to apply a patch to fix this issue. VDB-216742 is the identifier
8f490e10efc03cd1d27c72f64ecab224eb23. It is recommended to apply a patch to fix this issue. VDB-216742 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/graphite-project/graphite-web/issues/2744 - https://github.com/graphite-project/graphite-web/pull/2785 - https://github.com/graphite-project/graphite-web/commit/2f178f490e10efc03cd1d27c72f64ecab224eb23 - https://vuldb.com/?id.216742
CVE ID: CVE-2022-4729 State: PUBLISHED Published: 2022-12-24T00:00:00.000Z Last Updated: 2025-04-10T20:13:07.449Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: Graphite Products: Web Problem Types: CWE-707 Description: A vulnerability was found in Graphite Web and classified as problematic. This issue affects some unknown processing of the component Template Name Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 2f178f490e10efc03cd1d27c72f64ecab224eb23. It is recommended to apply a patch to fix this issue. The associated identifi
2f178f490e10efc03cd1d27c72f64ecab224eb23. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216743. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/graphite-project/graphite-web/pull/2785 - https://github.com/graphite-project/graphite-web/commit/2f178f490e10efc03cd1d27c72f64ecab224eb23 - https://github.com/graphite-project/graphite-web/issues/2745 - https://vuldb.com/?id.216743
CVE ID: CVE-2022-4730 State: PUBLISHED Published: 2022-12-24T00:00:00.000Z Last Updated: 2025-04-10T20:13:32.836Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: Graphite Products: Web Problem Types: CWE-707 Description: A vulnerability was found in Graphite Web. It has been classified as problematic. Affected is an unknown function of the component Absolute Time Range Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 2f178f490e10efc03cd1d27c72f64ecab224eb23. It is recommended to apply a patch to fix this issue. The identif
the patch is 2f178f490e10efc03cd1d27c72f64ecab224eb23. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216744. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/graphite-project/graphite-web/pull/2785 - https://github.com/graphite-project/graphite-web/commit/2f178f490e10efc03cd1d27c72f64ecab224eb23 - https://github.com/graphite-project/graphite-web/issues/2746 - https://vuldb.com/?id.216744
CVE ID: CVE-2022-4731 State: PUBLISHED Published: 2022-12-25T10:20:23.561Z Last Updated: 2024-08-03T01:48:40.417Z Severity: LOW (CVSS 2.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N) Vendors: n/a Products: myapnea Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in myapnea up to 29.0.x. Affected is an unknown function of the component Title Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 29.1.0 is able to address this issue. The name of the patch is 99934258530d761bd5d09809bfa6c14b598f8d18. It is recommended to upgrade the affected component. VDB-216750 is the identi
99934258530d761bd5d09809bfa6c14b598f8d18. It is recommended to upgrade the affected component. VDB-216750 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.216750 - https://vuldb.com/?ctiid.216750 - https://github.com/myapnea/myapnea.org/commit/99934258530d761bd5d09809bfa6c14b598f8d18 - https://github.com/myapnea/myapnea.org/releases/tag/v29.1.0
CVE ID: CVE-2022-4732 State: PUBLISHED Published: 2022-12-24T00:00:00.000Z Last Updated: 2025-04-10T20:13:51.907Z Severity: MEDIUM (CVSS 4.7 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: microweber Products: microweber/microweber Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.3.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/d5be2e96-1f2f-4357-a385-e184cf0119aa - https://github.com/microweber/microweber/commit/0d279ac81052ce7ee97c18c811a9b8e912189da0
CVE ID: CVE-2022-4733 State: PUBLISHED Published: 2022-12-24T00:00:00.000Z Last Updated: 2025-04-10T20:14:10.632Z Severity: MEDIUM (CVSS 6.7 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L) Vendors: openemr Products: openemr/openemr Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.0.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/f353adfb-e5b8-43e7-957a-894670fd4ccd - https://github.com/openemr/openemr/commit/4565d8d1eb80c6aa42cf6b1810ba0a64e0f6abde
CVE ID: CVE-2022-4734 State: PUBLISHED Published: 2022-12-25T00:00:00.000Z Last Updated: 2025-04-10T18:18:16.245Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: usememos Products: usememos/memos Problem Types: CWE-212 Description: Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository usememos/memos prior to 0.9.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/4b4421dc-73af-4dec-884c-836f9732cb5b - https://github.com/usememos/memos/commit/05b41804e33a34102f1f75bb2d69195dda6a1210
CVE ID: CVE-2022-4735 State: PUBLISHED Published: 2022-12-25T15:59:34.306Z Last Updated: 2024-11-19T19:49:40.661Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: asrashley Products: dash-live Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in asrashley dash-live. This vulnerability affects the function ready of the file static/js/media.js of the component DOM Node Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The name of the patch is 24d01757a5319cc14c4aa1d8b53d1ab24d48e451. It is recommended to apply a patch to fix this issue. VDB-216766 is the identifier assigned to this v
8b53d1ab24d48e451. It is recommended to apply a patch to fix this issue. VDB-216766 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.216766 - https://vuldb.com/?ctiid.216766 - https://github.com/asrashley/dash-live/pull/7 - https://github.com/asrashley/dash-live/commit/24d01757a5319cc14c4aa1d8b53d1ab24d48e451
CVE ID: CVE-2022-4736 State: PUBLISHED Published: 2022-12-25T19:14:44.347Z Last Updated: 2025-04-10T18:17:49.978Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: n/a Products: Venganzas del Pasado Problem Types: CWE-79 Description: A vulnerability was found in Venganzas del Pasado and classified as problematic. Affected by this issue is some unknown functionality. The manipulation of the argument the_title leads to cross site scripting. The attack may be launched remotely. The name of the patch is 62339b2ec445692c710b804bdf07aef4bd247ff7. It is recommended to apply a patch to fix this issue. VDB-216770 is the identifier assigned to this vulnerability. Additiona
s recommended to apply a patch to fix this issue. VDB-216770 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.216770 - https://vuldb.com/?ctiid.216770 - https://www.openbugbounty.org/reports/3022583/ - https://github.com/jschwindt/Venganzas-del-Pasado/commit/62339b2ec445692c710b804bdf07aef4bd247ff7
CVE ID: CVE-2022-4737 State: PUBLISHED Published: 2022-12-25T19:26:47.064Z Last Updated: 2024-08-03T01:48:40.268Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Blood Bank Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Blood Bank Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file login.php. The manipulation of the argument username/password leads to sql injection. The attack may be initiated remotely. The identifier VDB-216773 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - ht
ifier VDB-216773 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.216773 - https://vuldb.com/?ctiid.216773
CVE ID: CVE-2022-4738 State: PUBLISHED Published: 2022-12-25T19:28:23.559Z Last Updated: 2024-11-19T19:48:24.951Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: SourceCodester Products: Blood Bank Management System Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in SourceCodester Blood Bank Management System 1.0. Affected is an unknown function of the file index.php?page=users of the component User Registration Handler. The manipulation of the argument Name leads to cross site scripting. It is possible to launch the attack remotely. VDB-216774 is the identifier assigned to this vulnerability. Additional Analyst No
ssible to launch the attack remotely. VDB-216774 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.216774 - https://vuldb.com/?ctiid.216774
CVE ID: CVE-2022-4739 State: PUBLISHED Published: 2022-12-25T19:30:31.988Z Last Updated: 2024-08-03T01:48:40.297Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: School Dormitory Management System Problem Types: CWE-89 Description: A vulnerability classified as critical was found in SourceCodester School Dormitory Management System 1.0. Affected by this vulnerability is an unknown functionality of the component Admin Login. The manipulation leads to sql injection. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-216775. Additional Analyst Notes: - CVE Program Container: References: - https://v
entifier of this vulnerability is VDB-216775. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.216775 - https://vuldb.com/?ctiid.216775
CVE ID: CVE-2022-4740 State: PUBLISHED Published: 2022-12-25T19:33:31.755Z Last Updated: 2024-08-03T01:48:40.205Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: n/a Products: kkFileView Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in kkFileView. Affected by this issue is the function setWatermarkAttribute of the file /picturesPreview. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-216776. Additional Analyst Notes: - CVE Program Container: References: - https://
dentifier of this vulnerability is VDB-216776. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.216776 - https://vuldb.com/?ctiid.216776 - https://gitee.com/kekingcn/file-online-preview/issues/I674AC
CVE ID: CVE-2022-4741 State: PUBLISHED Published: 2022-12-25T19:47:45.687Z Last Updated: 2024-08-03T01:48:40.295Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: n/a Products: docconv Problem Types: CWE-789 Description: A vulnerability was found in docconv up to 1.2.0 and classified as problematic. This issue affects the function ConvertDocx/ConvertODT/ConvertPages/ConvertXML/XMLToText. The manipulation leads to uncontrolled memory allocation. The attack may be initiated remotely. Upgrading to version 1.2.1 is able to address this issue. The name of the patch is 42bcff666855ab978e67a9041d0cdea552f20301. It is recommended to upgrade the affected component. Th
e name of the patch is 42bcff666855ab978e67a9041d0cdea552f20301. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216779. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.216779 - https://vuldb.com/?ctiid.216779 - https://github.com/sajari/docconv/pull/111 - https://github.com/sajari/docconv/commit/42bcff666855ab978e67a9041d0cdea552f20301 - https://github.com/sajari/docconv/releases/tag/v1.2.1
CVE ID: CVE-2022-4742 State: PUBLISHED Published: 2022-12-26T07:09:37.972Z Last Updated: 2024-08-03T01:48:40.272Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: json-pointer Problem Types: CWE-1321 Description: A vulnerability, which was classified as critical, has been found in json-pointer up to 0.6.1. Affected by this issue is the function set of the file index.js. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack may be launched remotely. Upgrading to version 0.6.2 is able to address this issue. The patch is identified as 859c9984b6c407fc2d5a0a7e47c7274daa681941. It is recommended to
is able to address this issue. The patch is identified as 859c9984b6c407fc2d5a0a7e47c7274daa681941. It is recommended to upgrade the affected component. VDB-216794 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.216794 - https://vuldb.com/?ctiid.216794 - https://github.com/manuelstofer/json-pointer/pull/36 - https://github.com/manuelstofer/json-pointer/commit/859c9984b6c407fc2d5a0a7e47c7274daa681941
CVE ID: CVE-2022-4743 State: PUBLISHED Published: 2023-01-12T00:00:00.000Z Last Updated: 2025-04-08T13:47:14.988Z Vendors: n/a Products: SDL2 Problem Types: NA Description: A potential memory leak issue was discovered in SDL2 in GLES_CreateTexture() function in SDL_render_gles.c. The vulnerability allows an attacker to cause a denial of service attack. The vulnerability affects SDL2 v2.0.4 and above. SDL-1.x are not affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2156290 - https://access.redhat.com/security/cve/CVE-2022-4743 - https://github.com/libsdl-org/SDL/pull/6269 - https://github.com/libsdl
//access.redhat.com/security/cve/CVE-2022-4743 - https://github.com/libsdl-org/SDL/pull/6269 - https://github.com/libsdl-org/SDL/commit/00b67f55727bc0944c3266e2b875440da132ce4b - https://lists.debian.org/debian-lts-announce/2023/02/msg00008.html - https://security.gentoo.org/glsa/202305-18
CVE ID: CVE-2022-4744 State: PUBLISHED Published: 2023-03-30T00:00:00.000Z Last Updated: 2025-02-14T15:45:30.671Z Vendors: n/a Products: Kernel Problem Types: CWE-460 Description: A double-free flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user registers the device when the register_netdevice function fails (NETDEV_REGISTER notifier). This flaw allows a local user to crash or potentially escalate their privileges on the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=158b515f703e - http://packetstormsecurity.com/files/171912/CentOS-St
/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=158b515f703e - http://packetstormsecurity.com/files/171912/CentOS-Stream-9-Missing-Kernel-Security-Fix.html - https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html - https://security.netapp.com/advisory/ntap-20230526-0009/
CVE ID: CVE-2022-4745 State: PUBLISHED Published: 2023-02-13T14:32:26.171Z Last Updated: 2025-04-03T13:07:59.847Z Vendors: Unknown Products: WP Customer Area Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP Customer Area WordPress plugin before 8.1.4 does not have CSRF checks when performing some actions such as chmod, mkdir and copy, which could allow attackers to make a logged-in admin perform them and create arbitrary folders, copy file for example. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/9703f42e-bdfe-4787-92c9-47963d9af425
CVE ID: CVE-2022-4746 State: PUBLISHED Published: 2023-01-23T14:31:33.275Z Last Updated: 2025-04-02T15:49:16.779Z Vendors: Unknown Products: FluentAuth Problem Types: CWE-290 Authentication Bypass by Spoofing Description: The FluentAuth WordPress plugin before 1.0.2 prioritizes getting a visitor's IP address from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass the IP-based blocks set by the plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/62e3babc-00c6-4a35-972f-8f03ba70ba32
CVE ID: CVE-2022-4747 State: PUBLISHED Published: 2023-02-06T19:59:31.288Z Last Updated: 2025-03-25T18:11:12.312Z Vendors: Unknown Products: Post Category Image With Grid and Slider Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Post Category Image With Grid and Slider WordPress plugin before 1.4.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com
as admins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/004f1872-1576-447f-8837-f29fa319cbdc
CVE ID: CVE-2022-4748 State: PUBLISHED Published: 2022-12-27T08:26:42.624Z Last Updated: 2024-08-03T01:48:40.421Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: FlatPress Problem Types: CWE-22 Description: A vulnerability was found in FlatPress. It has been classified as critical. This affects the function doItemActions of the file fp-plugins/mediamanager/panels/panel.mediamanager.file.php of the component File Delete Handler. The manipulation of the argument deletefile leads to path traversal. The name of the patch is 5d5c7f6d8f072d14926fc2c3a97cdd763802f170. It is recommended to apply a patch to fix this issue. The identifier VDB-216861 was
6d8f072d14926fc2c3a97cdd763802f170. It is recommended to apply a patch to fix this issue. The identifier VDB-216861 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.216861 - https://vuldb.com/?ctiid.216861 - https://github.com/flatpressblog/flatpress/issues/179 - https://github.com/flatpressblog/flatpress/commit/5d5c7f6d8f072d14926fc2c3a97cdd763802f170
CVE ID: CVE-2022-4749 State: PUBLISHED Published: 2023-01-30T20:31:49.670Z Last Updated: 2025-03-27T19:17:02.454Z Vendors: Unknown Products: Posts List Designer by Category Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Posts List Designer by Category WordPress plugin before 3.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8afc3
al Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8afc3b2a-81e5-4b6f-8f4c-c48492843569