Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-4636 State: PUBLISHED Published: 2023-01-10T19:54:23.077Z Last Updated: 2025-01-16T22:02:48.888Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Black Box Products: KVM ACR1020A-T, KVM ACR1002A-R, KVM ACR1002A-T, KVM ACR1000A-T-R2, KVM ACR1000A-R-R2 Problem Types: CWE-22 Description: Black Box KVM Firmware version 3.4.31307 on models ACR1000A-R-R2, ACR1000A-T-R2, ACR1002A-T, ACR1002A-R, and ACR1020A-T is vulnerable to path traversal, which may allow an attacker to steal user credentials and other sensitive information through local file inclusion. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:/
local file inclusion. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-23-010-01
CVE ID: CVE-2022-4637 State: PUBLISHED Published: 2022-12-21T00:00:00.000Z Last Updated: 2025-04-14T17:28:05.801Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: n/a Products: ep3-bs Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in ep3-bs up to 1.7.x. This affects an unknown part. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.8.0 is able to address this issue. The name of the patch is ef49e709c8adecc3a83cdc6164a67162991d2213. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216495. Addi
It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216495. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.216495 - https://github.com/tkrebs/ep3-bs/issues/564 - https://github.com/tkrebs/ep3-bs/commit/ef49e709c8adecc3a83cdc6164a67162991d2213 - https://github.com/tkrebs/ep3-bs/releases/tag/1.8.0
CVE ID: CVE-2022-4638 State: PUBLISHED Published: 2022-12-21T00:00:00.000Z Last Updated: 2025-04-14T17:27:52.132Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: unspecified Products: collective.contact.widget Problem Types: CWE-707 Description: A vulnerability classified as problematic was found in collective.contact.widget up to 1.12. This vulnerability affects the function title of the file src/collective/contact/widget/widgets.py. The manipulation leads to cross site scripting. The attack can be initiated remotely. The name of the patch is 5da36305ca7ed433782be8901c47387406fcda12. It is recommended to apply a patch to fix this issue. The identifier of this
5da36305ca7ed433782be8901c47387406fcda12. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216496. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/collective/collective.contact.widget/commit/5da36305ca7ed433782be8901c47387406fcda12 - https://vuldb.com/?id.216496
CVE ID: CVE-2022-4639 State: PUBLISHED Published: 2022-12-21T00:00:00.000Z Last Updated: 2025-04-14T17:27:41.046Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: unspecified Products: sslh Problem Types: CWE-119 Description: A vulnerability, which was classified as critical, has been found in sslh. This issue affects the function hexdump of the file probe.c of the component Packet Dumping Handler. The manipulation of the argument msg_info leads to format string. The attack may be initiated remotely. The name of the patch is b19f8a6046b080e4c2e28354a58556bb26040c6f. It is recommended to apply a patch to fix this issue. The identifier VDB-216497 was assigned t
c2e28354a58556bb26040c6f. It is recommended to apply a patch to fix this issue. The identifier VDB-216497 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/yrutschle/sslh/pull/353 - https://github.com/yrutschle/sslh/commit/b19f8a6046b080e4c2e28354a58556bb26040c6f - https://vuldb.com/?id.216497
CVE ID: CVE-2022-4640 State: PUBLISHED Published: 2022-12-21T00:00:00.000Z Last Updated: 2025-04-10T18:12:44.620Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: Mingsoft Products: MCMS Problem Types: CWE-707 Description: A vulnerability has been found in Mingsoft MCMS 5.2.9 and classified as problematic. Affected by this vulnerability is the function save of the component Article Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216499. Additional An
ommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216499. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/mingSoft/MCMS/issues/I65KI5 - https://vuldb.com/?id.216499
CVE ID: CVE-2022-4641 State: PUBLISHED Published: 2022-12-21T00:00:00.000Z Last Updated: 2025-04-10T18:12:15.359Z Severity: LOW (CVSS 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: unspecified Products: pig-vector Problem Types: CWE-377 Description: A vulnerability was found in pig-vector and classified as problematic. Affected by this issue is the function LogisticRegression of the file src/main/java/org/apache/mahout/pig/LogisticRegression.java. The manipulation leads to insecure temporary file. The attack needs to be approached locally. The name of the patch is 1e7bd9fab5401a2df18d2eabd802adcf0dcf1f15. It is recommended to apply a patch to fix this issue. The identifier of thi
is 1e7bd9fab5401a2df18d2eabd802adcf0dcf1f15. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216500. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tdunning/pig-vector/pull/2 - https://github.com/tdunning/pig-vector/commit/1e7bd9fab5401a2df18d2eabd802adcf0dcf1f15 - https://vuldb.com/?id.216500
CVE ID: CVE-2022-4642 State: PUBLISHED Published: 2022-12-21T00:00:00.000Z Last Updated: 2025-04-10T18:11:00.456Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: unspecified Products: tatoeba2 Problem Types: CWE-707 Description: A vulnerability was found in tatoeba2. It has been classified as problematic. This affects an unknown part of the component Profile Name Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version prod_2022-10-30 is able to address this issue. The name of the patch is 91110777fc8ddf1b4a2cf4e66e67db69b9700361. I
sion prod_2022-10-30 is able to address this issue. The name of the patch is 91110777fc8ddf1b4a2cf4e66e67db69b9700361. It is recommended to upgrade the affected component. The identifier VDB-216501 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Tatoeba/tatoeba2/issues/3002 - https://github.com/Tatoeba/tatoeba2/releases/tag/prod_2022-10-30 - https://github.com/Tatoeba/tatoeba2/commit/91110777fc8ddf1b4a2cf4e66e67db69b9700361 - https://vuldb.com/?id.216501
CVE ID: CVE-2022-4643 State: PUBLISHED Published: 2022-12-21T00:00:00 Last Updated: 2024-08-03T01:48:38.939Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: n/a Products: docconv Problem Types: CWE-78 Description: A vulnerability was found in docconv up to 1.2.0. It has been declared as critical. This vulnerability affects the function ConvertPDFImages of the file pdf_ocr.go. The manipulation of the argument path leads to os command injection. The attack can be initiated remotely. Upgrading to version 1.2.1 is able to address this issue. The name of the patch is b19021ade3d0b71c89d35cb00eb9e589a121faa5. It is recommended to upgrade the affected component. VD
e name of the patch is b19021ade3d0b71c89d35cb00eb9e589a121faa5. It is recommended to upgrade the affected component. VDB-216502 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.216502 - https://github.com/sajari/docconv/pull/110 - https://github.com/sajari/docconv/commit/b19021ade3d0b71c89d35cb00eb9e589a121faa5 - https://github.com/sajari/docconv/releases/tag/v1.2.1
CVE ID: CVE-2022-4644 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-10T18:09:50.729Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: ikus060 Products: ikus060/rdiffweb Problem Types: CWE-601 Description: Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/77e5f425-c764-4cb0-936a-7a76bfcf19b0 - https://github.com/ikus060/rdiffweb/commit/5f861670ef8f38ca8eea52a98672d0e0fabb5368
CVE ID: CVE-2022-4645 State: PUBLISHED Published: 2023-03-03T00:00:00.000Z Last Updated: 2025-04-04T20:37:39.327Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) Vendors: libtiff Products: libtiff Problem Types: Out-of-bounds read in libtiff Description: LibTIFF 4.4.0 has an out-of-bounds read in tiffcp in tools/tiffcp.c:948, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit e8131125. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/libtiff/libtiff/-/issues/277 - https://gitlab.com/libtiff/libtiff/-/commit/e8
richment: References: - https://gitlab.com/libtiff/libtiff/-/issues/277 - https://gitlab.com/libtiff/libtiff/-/commit/e813112545942107551433d61afd16ac094ff246 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4645.json - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BA6GRCAQ7NR2OK5N44UQRGUJBIYKWJJH/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ZTFA6GGOKFPIQNHDBMXYUR4XUXUJESE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OLM763GGZVVOAXIQXG6YGTYJ5VFYNECQ/ - https://security.netapp.com/advisory/ntap-20230331-0001/
CVE ID: CVE-2022-4646 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-09T18:34:30.323Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: ikus060 Products: ikus060/rdiffweb Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.5.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/17bc1b0f-1f5c-432f-88e4-c9866ccf6e10 - https://github.com/ikus060/rdiffweb/commit/e6f0d8002129be90fe82fa3e3ea0a6942caba398
CVE ID: CVE-2022-4647 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-09T18:35:42.198Z Severity: MEDIUM (CVSS 5.1 CVSS:3.0/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:L) Vendors: microweber Products: microweber/microweber Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/ccdd243d-726c-4199-b742-25c571491242 - https://github.com/microweber/microweber/commit/20df56615e61624f5fff149849753869e4b3b936
CVE ID: CVE-2022-4648 State: PUBLISHED Published: 2023-01-16T15:37:39.467Z Last Updated: 2025-04-07T14:56:31.137Z Vendors: Unknown Products: Real Testimonials Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Real Testimonials WordPress plugin before 2.6.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/9bbfb664-5b83-452b-82bb-562a1e1
ogram Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/9bbfb664-5b83-452b-82bb-562a1e18eb65
CVE ID: CVE-2022-4649 State: PUBLISHED Published: 2023-01-30T20:31:35.961Z Last Updated: 2025-03-28T14:04:17.568Z Vendors: Unknown Products: WP Extended Search Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Extended Search WordPress plugin before 2.1.2 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0d9ba176-97be-4b6b-9cf1-6c3047321a1e
CVE ID: CVE-2022-4650 State: PUBLISHED Published: 2023-01-23T14:31:55.502Z Last Updated: 2025-04-03T19:20:54.367Z Vendors: Unknown Products: HashBar Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The HashBar WordPress plugin before 1.3.6 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b430fdaa-191a-429e-b6d2-479b32bb1075
CVE ID: CVE-2022-4651 State: PUBLISHED Published: 2023-01-30T20:31:54.795Z Last Updated: 2025-03-27T15:39:51.340Z Vendors: Unknown Products: Justified Gallery Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Justified Gallery WordPress plugin before 1.7.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d8182075-7472-48c8-8e9d-94b12ab6fcf6
CVE ID: CVE-2022-4652 State: PUBLISHED Published: 2023-03-13T16:03:29.744Z Last Updated: 2025-02-27T20:37:08.905Z Vendors: Unknown Products: Video Background Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Video Background WordPress plugin before 2.7.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ebf3df99-6939-4ae9-ad55-004f33c1cfbc
CVE ID: CVE-2022-4653 State: PUBLISHED Published: 2023-01-16T15:37:45.683Z Last Updated: 2025-04-08T19:44:50.763Z Vendors: Unknown Products: Greenshift Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Greenshift WordPress plugin before 4.8.9 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/fa44ed44-9dac-4b4f-aaa3-503b76034578
CVE ID: CVE-2022-4654 State: PUBLISHED Published: 2023-01-30T20:31:37.715Z Last Updated: 2025-03-28T14:01:53.933Z Vendors: Unknown Products: Pricing Tables WordPress Plugin Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Pricing Tables WordPress Plugin WordPress plugin before 3.2.3 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a29744cd-b760-4757-8564-883d59fa4881
CVE ID: CVE-2022-4655 State: PUBLISHED Published: 2023-01-16T15:37:55.918Z Last Updated: 2025-04-04T18:10:49.090Z Vendors: Unknown Products: Welcart e-Commerce Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Welcart e-Commerce WordPress plugin before 2.8.9 does not validate and escapes one of its shortcode attributes, which could allow users with a role as low as a contributor to perform a Stored Cross-Site Scripting attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a1c70c80-e952-4cc7-aca0-c2dde3fa08a9
CVE ID: CVE-2022-4656 State: PUBLISHED Published: 2023-02-13T14:32:19.074Z Last Updated: 2025-03-20T18:36:55.634Z Vendors: Unknown Products: WP Visitor Statistics (Real Time Traffic) Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 6.5 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/05976ed8-5a26-4eae-adb2-0ea3b2722391
CVE ID: CVE-2022-4657 State: PUBLISHED Published: 2023-02-06T19:59:42.959Z Last Updated: 2025-03-25T19:47:30.775Z Vendors: Unknown Products: Restaurant Menu Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Restaurant Menu WordPress plugin before 2.3.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a90a413d-0e00-4da8-a339-d6cdfba70bb3
CVE ID: CVE-2022-4658 State: PUBLISHED Published: 2023-01-16T15:37:52.771Z Last Updated: 2025-04-04T20:38:52.466Z Vendors: Unknown Products: RSSImport Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The RSSImport WordPress plugin through 4.6.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c7a17eb9-2811-45ba-bab3-f53b2fa7d051
CVE ID: CVE-2022-4659 State: REJECTED Published: N/A Last Updated: 2022-12-30T00:00:00 Description: No description available.
CVE ID: CVE-2022-4661 State: PUBLISHED Published: 2023-03-13T16:03:34.749Z Last Updated: 2025-02-27T15:50:31.153Z Vendors: Unknown Products: Widgets for WooCommerce Products on Elementor Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Widgets for WooCommerce Products on Elementor WordPress plugin before 1.0.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b95956
l Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b95956c9-40e5-47aa-86f6-e2da61b3c19f
CVE ID: CVE-2022-4662 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-09T18:36:53.874Z Vendors: n/a Products: Kernel Problem Types: CWE-455 Description: A flaw incorrect access control in the Linux kernel USB core subsystem was found in the way user attaches usb device. A local user could use this flaw to crash the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lore.kernel.org/all/CAB7eexLLApHJwZfMQ=X-PtRhw0BgO+5KcSMS05FNUYejJXqtSA%40mail.gmail.com/ - https://lore.kernel.org/all/20220913140355.910732567%40linuxfoundation.org/
CVE ID: CVE-2022-4663 State: PUBLISHED Published: 2023-01-03T13:56:11.724Z Last Updated: 2025-01-13T17:15:24.798Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: manishkrag Products: Members Import Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Members Import plugin for WordPress is vulnerable to Self Cross-Site Scripting via the user_login parameter in an imported CSV file in versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that execute if they can successfu
caping. This makes it possible for attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a site's administrator into uploading a CSV file with the malicious payload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3abbc407-f660-4b1f-9d48-436320e5fdd7 - https://plugins.trac.wordpress.org/browser/members-import/trunk/members-import.php#L113
CVE ID: CVE-2022-4664 State: PUBLISHED Published: 2023-02-06T19:59:12.545Z Last Updated: 2025-03-25T20:45:45.241Z Vendors: Unknown Products: Logo Slider Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Logo Slider WordPress plugin before 3.6.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d6a9cfaa-d3fa-442e-a9a1-b06588723e39
CVE ID: CVE-2022-4665 State: PUBLISHED Published: 2022-12-23T00:00:00.000Z Last Updated: 2025-04-09T18:51:04.931Z Severity: LOW (CVSS 3.1 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: ampache Products: ampache/ampache Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type in GitHub repository ampache/ampache prior to 5.5.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/5e7f3ecc-3b08-4e0e-8bf8-ae7ae229941f - https://github.com/ampache/ampache/commit/8293fa86e5f50a168b7f5c892ffbd6aa555134bd
CVE ID: CVE-2022-4666 State: PUBLISHED Published: 2023-02-21T08:51:01.367Z Last Updated: 2025-03-12T20:49:38.102Z Vendors: Unknown Products: Markup (JSON-LD) structured in schema.org Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Markup (JSON-LD) structured in schema.org WordPress plugin through 4.8.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a6d23f2f-950
yst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a6d23f2f-9504-40da-9b71-189033d8bd1d
CVE ID: CVE-2022-4667 State: PUBLISHED Published: 2023-01-30T20:31:59.713Z Last Updated: 2025-03-27T19:06:24.158Z Vendors: Unknown Products: RSS Aggregator by Feedzy Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The RSS Aggregator by Feedzy WordPress plugin before 4.1.1 does not validate and escape some of its block options before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a388232b-a399-46a5-83e6-