Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-50858 State: PUBLISHED Published: 2023-12-28T10:31:43.530Z Last Updated: 2024-08-02T22:23:44.036Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Bill Minozzi Products: Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Bill Minozzi Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan.This issue affects Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan: from n/a through 4.34. Additional Analyst Notes: - CVE Program Container: References: -
er Enumeration Anti Hacker Scan: from n/a through 4.34. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/antihacker/wordpress-anti-hacker-plugin-4-34-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-50859 State: PUBLISHED Published: 2023-12-28T10:16:51.601Z Last Updated: 2024-08-02T22:23:44.216Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Themeum Products: WP Crowdfunding Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum WP Crowdfunding allows Stored XSS.This issue affects WP Crowdfunding: from n/a through 2.1.6. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-crowdfunding/wordpress-wp-crowdfunding-plugin-2-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-50860 State: PUBLISHED Published: 2023-12-28T10:14:11.022Z Last Updated: 2024-08-02T22:23:43.709Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: TMS Products: Booking for Appointments and Events Calendar – Amelia Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TMS Booking for Appointments and Events Calendar – Amelia allows Stored XSS.This issue affects Booking for Appointments and Events Calendar – Amelia: from n/a through 1.0.85. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/ameliabookin
itional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/ameliabooking/wordpress-amelia-plugin-1-0-85-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-50861 State: PUBLISHED Published: 2024-03-15T14:04:37.855Z Last Updated: 2024-08-28T15:00:28.956Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: realmag777 Products: HUSKY – Products Filter for WooCommerce (formerly WOOF) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in realmag777 HUSKY – Products Filter for WooCommerce (formerly WOOF).This issue affects HUSKY – Products Filter for WooCommerce (formerly WOOF): from n/a through 1.3.4.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/woocommerce-products-filter/wordpr
- CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/woocommerce-products-filter/wordpress-husky-plugin-1-3-4-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-50862 State: PUBLISHED Published: 2024-01-04T14:29:39.872Z Last Updated: 2025-06-17T20:29:10.566Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Kashipara Group Products: Travel Website Problem Types: CWE-89 Description: Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'hotelIDHidden' parameter of the booking.php resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/evans/ - https://www.kashipara.com/
CVE ID: CVE-2023-50863 State: PUBLISHED Published: 2024-01-04T14:30:22.853Z Last Updated: 2025-06-17T20:29:10.681Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Kashipara Group Products: Travel Website Problem Types: CWE-89 Description: Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'hotelIDHidden' parameter of the generateReceipt.php resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/evans/ - https://www.kashipara.com/
CVE ID: CVE-2023-50864 State: PUBLISHED Published: 2024-01-04T14:31:24.671Z Last Updated: 2025-06-17T20:29:10.800Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Kashipara Group Products: Travel Website Problem Types: CWE-89 Description: Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'hotelId' parameter of the hotelDetails.php resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/evans/ - https://www.kashipara.com/
CVE ID: CVE-2023-50865 State: PUBLISHED Published: 2024-01-04T14:32:13.376Z Last Updated: 2025-06-17T20:29:10.927Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Kashipara Group Products: Travel Website Problem Types: CWE-89 Description: Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'city' parameter of the hotelSearch.php resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/evans/ - https://www.kashipara.com/
CVE ID: CVE-2023-50866 State: PUBLISHED Published: 2024-01-04T14:32:53.660Z Last Updated: 2025-06-03T14:42:26.433Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Kashipara Group Products: Travel Website Problem Types: CWE-89 Description: Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the loginAction.php resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/evans/ - https://www.kashipara.com/
CVE ID: CVE-2023-50867 State: PUBLISHED Published: 2024-01-04T14:33:52.582Z Last Updated: 2025-06-17T20:29:11.098Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Kashipara Group Products: Travel Website Problem Types: CWE-89 Description: Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the signupAction.php resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/evans/ - https://www.kashipara.com/
CVE ID: CVE-2023-50868 State: PUBLISHED Published: 2024-02-14T00:00:00.000Z Last Updated: 2025-11-04T18:20:42.287Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nlnetlabs.nl/news/2024/Feb
tional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/ - https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html - https://www.isc.org/blogs/2024-bind-security-release/ - https://datatracker.ietf.org/doc/html/rfc5155 - https://kb.isc.org/docs/cve-2023-50868 - https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1 - https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html - https://access.redhat.com/security/cve/CVE-2023-50868 - https://bugzilla.suse.com/show_bug.cgi?id=1219826 - http://www.openwall.com/lists/oss-security/2024/02/16/2 - http://www
https://bugzilla.suse.com/show_bug.cgi?id=1219826 - http://www.openwall.com/lists/oss-security/2024/02/16/2 - http://www.openwall.com/lists/oss-security/2024/02/16/3 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVYA42BLXUCIDLD35YIJPJSHDIADNYMP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/ - https://lists.debian.org/debian-lts-announce/2024/02/msg00006.html - https://lists.fedoraproject.org/archives/list/package-announce%4
.debian.org/debian-lts-announce/2024/02/msg00006.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TEXGOYGW7DBS3N2QSSQONZ4ENIRQEAPG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQESRWMJCF4JEYJEAKLRM6CT55GLJAB7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6FV5O347JTX7P5O
YSDZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6FV5O347JTX7P5OZA6NGO4MKTXRXMKOZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGSLGKUAQTW5JPPZCMF5YPEYALLRUZZ6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/ - https://security.netapp.com/advisory/ntap-20240307-0008/ - https://lists.debian.org/debian-lts-announce/2024/05/msg00011.html
CVE ID: CVE-2023-50870 State: PUBLISHED Published: 2023-12-15T13:48:13.075Z Last Updated: 2024-08-02T22:23:44.029Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-352 Description: In JetBrains TeamCity before 2023.11.1 a CSRF on login was possible Additional Analyst Notes: - CVE Program Container: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2023-50871 State: PUBLISHED Published: 2023-12-15T13:48:13.458Z Last Updated: 2024-08-02T22:23:43.874Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: JetBrains Products: YouTrack Problem Types: CWE-285 Description: In JetBrains YouTrack before 2023.3.22268 authorization check for inline comments inside thread replies was missed Additional Analyst Notes: - CVE Program Container: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2023-50872 State: PUBLISHED Published: 2024-04-16T00:00:00.000Z Last Updated: 2025-06-03T02:11:58.569Z Vendors: n/a Products: n/a Problem Types: n/a Description: The API in Accredible Credential.net December 6th, 2023 allows an Insecure Direct Object Reference attack that discloses partial information about certificates and their respective holder. NOTE: the excellium-services.com web page about this issue mentions "Vendor says that it's not a security issue." Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://help.accredible.com/accredible-product-release-notes - https://excellium-services.com/cert-xlm-advisory/CVE-2023-50872 - http
accredible.com/accredible-product-release-notes - https://excellium-services.com/cert-xlm-advisory/CVE-2023-50872 - https://cds.thalesgroup.com/en/tcs-cert/CVE-2023-50872
CVE ID: CVE-2023-50873 State: PUBLISHED Published: 2023-12-28T10:28:27.063Z Last Updated: 2024-09-09T17:58:10.712Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Marios Alexandrou Products: Add Any Extension to Pages Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Marios Alexandrou Add Any Extension to Pages.This issue affects Add Any Extension to Pages: from n/a through 1.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/add-any-extension-to-pages/wordpress-add-any-extension-to-pages-plugin-1-4-cross-site-request-forgery-csrf-vuln
rability/add-any-extension-to-pages/wordpress-add-any-extension-to-pages-plugin-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-50874 State: PUBLISHED Published: 2023-12-28T10:01:09.439Z Last Updated: 2024-08-02T22:23:44.075Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Darren Cooney Products: WordPress Infinite Scroll – Ajax Load More Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Darren Cooney WordPress Infinite Scroll – Ajax Load More allows Stored XSS.This issue affects WordPress Infinite Scroll – Ajax Load More: from n/a through 6.1.0.1. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/ajax-load-more/wordpress
yst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/ajax-load-more/wordpress-ajax-load-more-plugin-6-1-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-50875 State: PUBLISHED Published: 2024-02-12T06:50:03.646Z Last Updated: 2024-08-02T22:23:43.911Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Automattic Products: Sensei LMS – Online Courses, Quizzes, & Learning Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic Sensei LMS – Online Courses, Quizzes, & Learning allows Stored XSS.This issue affects Sensei LMS – Online Courses, Quizzes, & Learning: from n/a through 4.17.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vu
tional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/sensei-lms/wordpress-sensei-lms-plugin-4-17-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-50876 State: PUBLISHED Published: 2024-12-09T11:29:57.285Z Last Updated: 2024-12-09T13:59:59.401Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Molongui Products: Molongui Problem Types: CWE-862 Description: Missing Authorization vulnerability in Molongui Molongui allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Molongui: from n/a through 4.7.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/molongui-authorship/vulnerability/wordpress-molongui-plugin-4-7-3-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-50877 State: PUBLISHED Published: 2024-12-09T11:29:58.154Z Last Updated: 2024-12-09T13:59:59.284Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: woobewoo Products: Product Filter by WBW Problem Types: CWE-862 Description: Missing Authorization vulnerability in woobewoo Product Filter by WBW allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Filter by WBW: from n/a through 2.5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/woo-product-filter/vulnerability/wordpress-product-filter-by-wbw-plugin-2-5-0-broken-access-control-vuln
ordpress/plugin/woo-product-filter/vulnerability/wordpress-product-filter-by-wbw-plugin-2-5-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-50878 State: PUBLISHED Published: 2023-12-29T12:32:10.418Z Last Updated: 2024-09-09T17:38:35.414Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: InspireUI Products: MStore API Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in InspireUI MStore API.This issue affects MStore API: from n/a through 4.10.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/mstore-api/wordpress-mstore-api-plugin-4-10-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-50879 State: PUBLISHED Published: 2023-12-29T11:31:24.984Z Last Updated: 2024-08-02T22:23:43.831Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Automattic Products: WordPress.com Editing Toolkit Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress.Com Editing Toolkit allows Stored XSS.This issue affects WordPress.Com Editing Toolkit: from n/a through 3.78784. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/full-site-editing/wordpress-wordpress-com-editing-toolkit-plugin-3-78
s: - https://patchstack.com/database/vulnerability/full-site-editing/wordpress-wordpress-com-editing-toolkit-plugin-3-78784-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-50880 State: PUBLISHED Published: 2023-12-29T11:28:39.308Z Last Updated: 2024-09-09T17:39:14.241Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: The BuddyPress Community Products: BuddyPress Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The BuddyPress Community BuddyPress allows Stored XSS.This issue affects BuddyPress: from n/a through 11.3.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/buddypress/wordpress-buddypress-plugin-11-3-1-cross-site-scripting-xss-vul
https://patchstack.com/database/vulnerability/buddypress/wordpress-buddypress-plugin-11-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-50881 State: PUBLISHED Published: 2023-12-29T11:26:11.706Z Last Updated: 2024-11-20T19:13:07.282Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: AAM Products: Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More allows Stored XSS.This issue affects Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: from n/a through 6.9.15. Additional Analyst No
Manager – Restricted Content, Users & Roles, Enhanced Security and More: from n/a through 6.9.15. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/advanced-access-manager/wordpress-advanced-access-manager-plugin-6-9-15-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-50882 State: PUBLISHED Published: 2024-12-09T11:29:56.427Z Last Updated: 2024-12-09T17:13:37.300Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: ProfilePress Membership Team Products: ProfilePress Problem Types: CWE-862 Description: Missing Authorization vulnerability in ProfilePress Membership Team ProfilePress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfilePress: from n/a through 4.13.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-user-avatar/vulnerability/wordpress-profilepress-plugin-4-13-2-broken-access-control-vu
com/database/wordpress/plugin/wp-user-avatar/vulnerability/wordpress-profilepress-plugin-4-13-2-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-50883 State: PUBLISHED Published: 2024-09-09T00:00:00 Last Updated: 2024-09-10T14:24:40.310Z Vendors: n/a Products: n/a Problem Types: n/a Description: ONLYOFFICE Docs before 8.0.1 allows XSS because a macro is an immediately-invoked function expression (IIFE), and therefore a sandbox escape is possible by directly calling the constructor of the Function object. NOTE: this issue exists because of an incorrect fix for CVE-2021-43446. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.onlyoffice.com/ - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-027.txt - https://www.syss.de/pentest-blog/cross-site-scripting-schwachstell
okumente/Publikationen/Advisories/SYSS-2023-027.txt - https://www.syss.de/pentest-blog/cross-site-scripting-schwachstelle-in-onlyoffice-docs-syss-2023-027
CVE ID: CVE-2023-50884 State: PUBLISHED Published: 2024-12-09T11:29:55.603Z Last Updated: 2024-12-09T17:15:38.987Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: LA-Studio Products: LA-Studio Element Kit for Elementor Problem Types: CWE-862 Description: Missing Authorization vulnerability in LA-Studio LA-Studio Element Kit for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.1.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/lastudio-element-kit/vulnerability/wordpress-la-studio-eleme
erences: - https://patchstack.com/database/wordpress/plugin/lastudio-element-kit/vulnerability/wordpress-la-studio-element-kit-for-elementor-plugin-1-1-5-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-50885 State: PUBLISHED Published: 2024-04-18T11:00:34.490Z Last Updated: 2024-08-02T22:23:43.816Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H) Vendors: AGILELOGIX Products: Store Locator WordPress Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AGILELOGIX Store Locator WordPress.This issue affects Store Locator WordPress: from n/a through 1.4.14. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/agile-store-locator/wordpress-store-locator-wordpress-plugin-1-4-14-arbitrary-file-dele
stack.com/database/vulnerability/agile-store-locator/wordpress-store-locator-wordpress-plugin-1-4-14-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE ID: CVE-2023-50886 State: PUBLISHED Published: 2024-03-15T14:14:58.686Z Last Updated: 2024-08-02T22:23:44.048Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: wpWax Products: Legal Pages Problem Types: CWE-352, CWE-863 Description: Cross-Site Request Forgery (CSRF), Incorrect Authorization vulnerability in wpWax Legal Pages.This issue affects Legal Pages: from n/a through 1.3.7. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/legal-pages/wordpress-legal-pages-plugin-1-3-7-broken-access-control-csrf-vulnerability?_s_id=cve