Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-2145 State: PUBLISHED Published: 2023-04-18T11:00:07.358Z Last Updated: 2024-08-02T06:12:20.563Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Campcodes Products: Online Thesis Archiving System Problem Types: CWE-89 Description: A vulnerability was found in Campcodes Online Thesis Archiving System 1.0. It has been classified as critical. Affected is an unknown function of the file projects_per_curriculum.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-226266 is the identifier assigned to this vulnerability. Additional Analyst Notes:
d to the public and may be used. VDB-226266 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.226266 - https://vuldb.com/?ctiid.226266 - https://github.com/E1CHO/cve_hub/blob/main/Online%20Thesis%20Archiving%20System/Online%20Thesis%20Archiving%20System%20-%20vuln%201.pdf
CVE ID: CVE-2023-2146 State: PUBLISHED Published: 2023-04-18T11:31:03.764Z Last Updated: 2024-08-02T06:12:20.590Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Campcodes Products: Online Thesis Archiving System Problem Types: CWE-89 Description: A vulnerability was found in Campcodes Online Thesis Archiving System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file classes/Master.php. The manipulation of the argument name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226267. Additional Anal
disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226267. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.226267 - https://vuldb.com/?ctiid.226267 - https://github.com/E1CHO/cve_hub/blob/main/Online%20Thesis%20Archiving%20System/Online%20Thesis%20Archiving%20System%20-%20vuln%203.pdf
CVE ID: CVE-2023-2147 State: PUBLISHED Published: 2023-04-18T11:31:04.789Z Last Updated: 2024-08-02T06:12:20.534Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Campcodes Products: Online Thesis Archiving System Problem Types: CWE-89 Description: A vulnerability was found in Campcodes Online Thesis Archiving System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/students/view_details.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-226268. Additional Analyst Note
een disclosed to the public and may be used. The identifier of this vulnerability is VDB-226268. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.226268 - https://vuldb.com/?ctiid.226268 - https://github.com/E1CHO/cve_hub/blob/main/Online%20Thesis%20Archiving%20System/Online%20Thesis%20Archiving%20System%20-%20vuln%204.pdf
CVE ID: CVE-2023-2148 State: PUBLISHED Published: 2023-04-18T12:00:10.080Z Last Updated: 2024-11-22T16:03:44.629Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Campcodes Products: Online Thesis Archiving System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in Campcodes Online Thesis Archiving System 1.0. This affects an unknown part of the file /admin/curriculum/view_curriculum.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226269 was assigned to this vulnerability. Additional Analyst Notes
ed to the public and may be used. The identifier VDB-226269 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.226269 - https://vuldb.com/?ctiid.226269 - https://github.com/E1CHO/cve_hub/blob/main/Online%20Thesis%20Archiving%20System/Online%20Thesis%20Archiving%20System%20-%20vuln%205.pdf
CVE ID: CVE-2023-2149 State: PUBLISHED Published: 2023-04-18T12:31:03.850Z Last Updated: 2025-02-05T16:32:20.474Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Campcodes Products: Online Thesis Archiving System Problem Types: CWE-89 Description: A vulnerability classified as critical was found in Campcodes Online Thesis Archiving System 1.0. This vulnerability affects unknown code of the file /admin/user/manage_user.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-226270 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program
ic and may be used. VDB-226270 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.226270 - https://vuldb.com/?ctiid.226270 - https://github.com/E1CHO/cve_hub/blob/main/Online%20Thesis%20Archiving%20System/Online%20Thesis%20Archiving%20System%20-%20vuln%207.pdf
CVE ID: CVE-2023-2150 State: PUBLISHED Published: 2023-04-18T13:00:05.441Z Last Updated: 2024-08-02T06:12:20.538Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: SourceCodester Products: Task Reminder System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in SourceCodester Task Reminder System 1.0. This issue affects some unknown processing of the file Master.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226271. Additional Analyst Notes: - CVE Program Cont
may be used. The associated identifier of this vulnerability is VDB-226271. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.226271 - https://vuldb.com/?ctiid.226271 - https://youtu.be/o46oHLvY2-E
CVE ID: CVE-2023-2151 State: PUBLISHED Published: 2023-04-18T13:00:06.902Z Last Updated: 2024-08-02T06:12:20.540Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Student Study Center Desk Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in SourceCodester Student Study Center Desk Management System 1.0. Affected is an unknown function of the file manage_student.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-226272. Additiona
exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-226272. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.226272 - https://vuldb.com/?ctiid.226272 - https://github.com/xzz0787/vul/blob/main/README.pdf
CVE ID: CVE-2023-2152 State: PUBLISHED Published: 2023-04-18T13:31:03.309Z Last Updated: 2024-08-02T06:12:20.560Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SourceCodester Products: Student Study Center Desk Management System Problem Types: CWE-73 Description: A vulnerability has been found in SourceCodester Student Study Center Desk Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file index.php. The manipulation of the argument page leads to file inclusion. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226273 was a
can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226273 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.226273 - https://vuldb.com/?ctiid.226273 - https://github.com/xzz0787/vul/blob/main/README.pdf
CVE ID: CVE-2023-2153 State: PUBLISHED Published: 2023-04-18T14:00:05.924Z Last Updated: 2024-08-02T06:12:20.527Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Complaint Management System Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Complaint Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file admin/assets/plugins/DataTables/examples/examples_support/editable_ajax.php of the component POST Parameter Handler. The manipulation of the argument value with the input 1><script>alert(666)</script> leads to cross site scripting. The attack may be launched remotely
nt value with the input 1><script>alert(666)</script> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-226274 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.226274 - https://vuldb.com/?ctiid.226274 - https://github.com/1406213367/bug_report/blob/main/XSS-1.md
CVE ID: CVE-2023-2154 State: PUBLISHED Published: 2023-04-18T14:00:07.432Z Last Updated: 2024-08-02T06:12:20.554Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: SourceCodester Products: Task Reminder System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Task Reminder System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/?page=reminders/view_reminder. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226275. Additional Analyst Notes:
to the public and may be used. The associated identifier of this vulnerability is VDB-226275. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.226275 - https://vuldb.com/?ctiid.226275 - https://youtu.be/teK82KkWtdA
CVE ID: CVE-2023-2155 State: PUBLISHED Published: 2023-04-18T14:31:03.901Z Last Updated: 2025-02-05T16:17:45.019Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: SourceCodester Products: Air Cargo Management System Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Air Cargo Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file classes/Master.php?f=save_cargo_type. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-226276. Additional A
ploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-226276. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.226276 - https://vuldb.com/?ctiid.226276 - https://github.com/kev6798/bug_report/blob/main/XSS-1.md
CVE ID: CVE-2023-2156 State: PUBLISHED Published: 2023-05-09T00:00:00 Last Updated: 2024-08-02T06:12:20.503Z Vendors: n/a Products: Linux kernel (RPL protocol) Problem Types: CWE-617 Description: A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol. This issue results from the lack of proper handling of user-supplied data, which can lead to an assertion failure. This may allow an unauthenticated remote attacker to create a denial of service condition on the system. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-547/ - https://bugzilla.redhat.com/show_bug.cgi?id=2196292 -
ces: - https://www.zerodayinitiative.com/advisories/ZDI-23-547/ - https://bugzilla.redhat.com/show_bug.cgi?id=2196292 - http://www.openwall.com/lists/oss-security/2023/05/17/8 - http://www.openwall.com/lists/oss-security/2023/05/17/9 - http://www.openwall.com/lists/oss-security/2023/05/18/1 - http://www.openwall.com/lists/oss-security/2023/05/19/1 - https://security.netapp.com/advisory/ntap-20230622-0001/ - https://www.debian.org/security/2023/dsa-5448 - https://www.debian.org/security/2023/dsa-5453 - https://lists.debian.org/debian-lts-announce/2023/08/msg00001.html
CVE ID: CVE-2023-2157 State: PUBLISHED Published: 2023-06-06T00:00:00 Last Updated: 2025-01-07T21:31:18.253Z Vendors: n/a Products: ImageMagick Problem Types: CWE-122 Description: A heap-based buffer overflow vulnerability was found in the ImageMagick package that can lead to the application crashing. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2208537 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/45DUUXYMAEEAW55GSLAXN25VPKCRAIDA/
CVE ID: CVE-2023-2158 State: PUBLISHED Published: 2023-04-27T17:04:22.879Z Last Updated: 2025-01-31T18:16:46.890Z Vendors: Synopsys Products: Code Dx Problem Types: CWE-321 Description: Code Dx versions prior to 2023.4.2 are vulnerable to user impersonation attack where a malicious actor is able to gain access to another user's account by crafting a custom "Remember Me" token. This is possible due to the use of a hard-coded cipher which was used when generating the token. A malicious actor who creates this token can supply it to a separate Code Dx system, provided they know the username they want to impersonate, and impersonate the user. Score 6.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
the username they want to impersonate, and impersonate the user. Score 6.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://community.synopsys.com/s/question/0D5Hr00006VdZblKAF/announcement-changelog-code-dx-202342
CVE ID: CVE-2023-2159 State: PUBLISHED Published: 2023-06-09T05:33:28.584Z Last Updated: 2024-12-28T00:51:43.451Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: niteo Products: CMP – Coming Soon & Maintenance Plugin by NiteoThemes Problem Types: CWE-284 Improper Access Control Description: The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to Maintenance Mode Bypass in versions up to, and including, 4.1.7. A correct cmp_bypass GET parameter in the URL (equal to the md5-hashed home_url in the default setting) allows users to visit a site placed in maintenance mode thus bypassing the plugin's provided feature. Additional Analyst Notes: - C
s to visit a site placed in maintenance mode thus bypassing the plugin's provided feature. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/af955f69-b18c-446e-b05e-6a57a5f16dfa?source=cve - https://plugins.trac.wordpress.org/browser/cmp-coming-soon-maintenance/tags/4.1.6/niteo-cmp.php#L808 - https://plugins.trac.wordpress.org/changeset/2900571/cmp-coming-soon-maintenance/tags/4.1.8/cmp-advanced.php?old=2873620&old_path=cmp-coming-soon-maintenance%2Ftags%2F4.1.7%2Fcmp-advanced.php
CVE ID: CVE-2023-2160 State: PUBLISHED Published: 2023-04-18T00:00:00.000Z Last Updated: 2025-02-05T15:51:06.967Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: modoboa Products: modoboa/modoboa Problem Types: CWE-521 Description: Weak Password Requirements in GitHub repository modoboa/modoboa prior to 2.1.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/54fb6d6a-6b39-45b6-b62a-930260ba484b - https://github.com/modoboa/modoboa/commit/130257c96a2392ada795785a91178e656e27015c
CVE ID: CVE-2023-2161 State: PUBLISHED Published: 2023-05-16T04:31:26.482Z Last Updated: 2025-01-22T21:45:06.905Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: Schneider Electric Products: OPC Factory Server (OFS) Problem Types: CWE-611 Description: A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized read access to the file system when a malicious configuration file is loaded on to the software by a local user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-129-01&p_enDocType=Security+and
ichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-129-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-129-01.pdf
CVE ID: CVE-2023-2162 State: PUBLISHED Published: 2023-04-19T00:00:00.000Z Last Updated: 2025-03-19T15:32:43.543Z Vendors: n/a Products: Kernel Problem Types: CWE-416 Description: A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in SCSI sub-component in the Linux Kernel. In this flaw an attacker could leak kernel internal information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.spinics.net/lists/linux-scsi/msg181542.html - https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html - https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html
CVE ID: CVE-2023-2163 State: PUBLISHED Published: 2023-09-20T05:02:38.155Z Last Updated: 2025-02-27T20:49:30.067Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: Linux Products: Linux Kernel Problem Types: CWE-682 Description: Incorrect verifier pruning in BPF in Linux Kernel >=5.4 leads to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=71b547f561247897a0a14f3082730156c0533fed
CVE ID: CVE-2023-2164 State: PUBLISHED Published: 2023-08-01T23:36:10.665Z Last Updated: 2025-11-20T04:06:43.271Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-79 Description: An issue has been discovered in GitLab affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to trigger a stored XSS vulnerability via user interaction with a crafted URL in the WebIDE beta. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitla
ional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/407783 - https://hackerone.com/reports/1940598
CVE ID: CVE-2023-2166 State: PUBLISHED Published: 2023-04-19T00:00:00.000Z Last Updated: 2025-02-05T15:13:09.129Z Vendors: n/a Products: Linux Problem Types: CWE-476 Description: A null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux before Linux. ml_priv may not be initialized in the receive path of CAN frames. A local user could use this flaw to crash the system or potentially cause a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lore.kernel.org/lkml/CAO4mrfcV_07hbj8NUuZrA8FH-kaRsrFy-2metecpTuE5kKHn5w%40mail.gmail.com/
CVE ID: CVE-2023-2168 State: PUBLISHED Published: 2023-04-19T09:38:18.815Z Last Updated: 2025-01-13T16:51:00.502Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: stevejburge Products: TaxoPress is the WordPress Tag, Category, and Taxonomy Manager Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The TaxoPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Suggest Terms Title field in versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Editor+ permissions to inject
sanitization and output escaping. This makes it possible for authenticated attackers with Editor+ permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1c051bfd-2754-4faf-8062-91752555166c?source=cve - https://plugins.trac.wordpress.org/browser/simple-tags/trunk/inc/suggestterms-functions.php?rev=2743620#L151 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2868795%40simple-tags%2Ftrunk&old=2774153%40simple-tags%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-2169 State: PUBLISHED Published: 2023-04-19T09:38:19.339Z Last Updated: 2025-01-13T16:50:51.887Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: stevejburge Products: TaxoPress is the WordPress Tag, Category, and Taxonomy Manager Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The TaxoPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Related Posts functionality in versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Editor+ permissions to inje
ut sanitization and output escaping. This makes it possible for authenticated attackers with Editor+ permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/52574d99-1ffe-4152-bf13-9cdd11d7300a?source=cve - https://plugins.trac.wordpress.org/browser/simple-tags/trunk/inc/related-posts-functions.php?rev=2674563#L156 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2868795%40simple-tags%2Ftrunk&old=2774153%40simple-tags%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-2170 State: PUBLISHED Published: 2023-04-19T09:38:19.750Z Last Updated: 2025-01-13T16:50:42.033Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: stevejburge Products: TaxoPress is the WordPress Tag, Category, and Taxonomy Manager Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The TaxoPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Related Posts functionality in versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Editor+ permissions to inje
ut sanitization and output escaping. This makes it possible for authenticated attackers with Editor+ permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e98ed932-4e4c-4127-ae72-500e2a34f371?source=cve - https://plugins.trac.wordpress.org/browser/simple-tags/trunk/inc/related-posts-functions.php?rev=2674563#L155 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2868795%40simple-tags%2Ftrunk&old=2774153%40simple-tags%2Ftrunk&sfp_email=&sfph_mail=