Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-1565 State: PUBLISHED Published: 2022-07-18T00:00:00.000Z Last Updated: 2025-01-31T18:52:23.756Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: wpallimport Products: Import any XML or CSV File to WordPress Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_import_get_gz.php file in versions up to, and including, 3.6.7. This makes it possible for authenticated attackers, with administrator level permissions and above, to upload arbitrary files on the affected sites server which may make remote cod
inistrator level permissions and above, to upload arbitrary files on the affected sites server which may make remote code execution possible. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5d281333-d9af-4eb7-bc5c-ea7ceeddac03?source=cve - https://plugins.trac.wordpress.org/changeset/2749264/wp-all-import/trunk?contextall=1&old=2737093&old_path=%2Fwp-all-import%2Ftrunk - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1565
CVE ID: CVE-2022-1566 State: PUBLISHED Published: 2022-05-30T08:35:58 Last Updated: 2024-08-03T00:10:03.472Z Vendors: Unknown Products: Quotes llama Problem Types: CWE-79 Description: The Quotes llama WordPress plugin before 1.0.0 does not sanitise and escape Quotes, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed. The attack could also be performed by tricking an admin to import a malicious CSV file Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0af030d8-b676-4826-91c0-98706b816f3c
CVE ID: CVE-2022-1567 State: PUBLISHED Published: 2022-05-10T19:38:58.000Z Last Updated: 2025-05-05T16:41:44.308Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: halmat Products: WP JS Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WP-JS plugin for WordPress contains a script called wp-js.php with the function wp_js_admin, that accepts unvalidated user input and echoes it back to the user. This can be used for reflected Cross-Site Scripting in versions up to, and including, 2.0.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.w
ncluding, 2.0.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0ab82117-73dd-4257-8dfc-01dadcc3a83f?source=cve - https://plugins.trac.wordpress.org/browser/wp-js/trunk/wp-js.php?rev=100281#L140 - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1567
CVE ID: CVE-2022-1568 State: PUBLISHED Published: 2022-05-30T08:36:00 Last Updated: 2024-08-03T00:10:03.533Z Vendors: Unknown Products: Team Members Problem Types: CWE-79 Description: The Team Members WordPress plugin before 5.1.1 does not escape some of its Team settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/88328d17-ffc9-4b94-8b01-ad2fd3047fbc
CVE ID: CVE-2022-1569 State: PUBLISHED Published: 2022-06-06T08:51:06 Last Updated: 2024-08-03T00:10:03.277Z Vendors: Unknown Products: Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! Problem Types: CWE-79 Description: The Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! WordPress plugin before 1.4.9.4 does not sanitise and escape some of its form fields, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/v
when unfiltered_html is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/5a2756c1-9abf-4fd6-8ce2-9f840514dfcc
CVE ID: CVE-2022-1570 State: PUBLISHED Published: 2022-06-06T08:51:07 Last Updated: 2024-08-03T00:10:03.619Z Vendors: Unknown Products: Files Download Delay Problem Types: CWE-862 Missing Authorization, CWE-352 Cross-Site Request Forgery (CSRF) Description: The Files Download Delay WordPress plugin before 1.0.7 does not have authorisation and CSRF checks when reseting its settings, which could allow any authenticated users, such as subscriber to perform such action. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/c0257564-48ee-4d02-865f-82c8b5e793c9
CVE ID: CVE-2022-1571 State: PUBLISHED Published: 2022-05-04T10:20:09 Last Updated: 2024-08-03T00:10:03.490Z Severity: CRITICAL (CVSS 9.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L) Vendors: neorazorx Products: neorazorx/facturascripts Problem Types: CWE-79 Description: Cross-site scripting - Reflected in Create Subaccount in GitHub repository neorazorx/facturascripts prior to 2022.07. This vulnerability can be arbitrarily executed javascript code to steal user'cookie, perform HTTP request, get content of `same origin` page, etc ... Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/4578a690-73e5-4313-840c-ee15e5329741 - https://github.com/neorazorx
Container: References: - https://huntr.dev/bounties/4578a690-73e5-4313-840c-ee15e5329741 - https://github.com/neorazorx/facturascripts/commit/482c5a82b4d79e7a19614f5a67dc24593046cefd
CVE ID: CVE-2022-1572 State: PUBLISHED Published: 2022-06-27T08:56:52 Last Updated: 2024-08-03T00:10:03.642Z Vendors: Unknown Products: HTML2WP Problem Types: CWE-862 Missing Authorization, CWE-352 Cross-Site Request Forgery (CSRF) Description: The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks in an AJAX action, available to any authenticated users such as subscriber, which could allow them to delete arbitrary file Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/9afd1805-d449-4551-986a-f92cb47c95c5
CVE ID: CVE-2022-1573 State: PUBLISHED Published: 2022-06-27T08:56:56 Last Updated: 2024-08-03T00:10:03.374Z Vendors: Unknown Products: HTML2WP Problem Types: CWE-352 Description: The HTML2WP WordPress plugin through 1.0.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/9c1acd9c-999f-4a35-a272-1ad31552e685
CVE ID: CVE-2022-1574 State: PUBLISHED Published: 2022-06-27T08:57:00 Last Updated: 2024-08-03T00:10:03.721Z Vendors: Unknown Products: HTML2WP Problem Types: CWE-862 Missing Authorization, CWE-352 Cross-Site Request Forgery (CSRF) Description: The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks when importing files, and does not validate them, as a result, unauthenticated attackers can upload arbitrary files (such as PHP) on the remote server Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/c36d0ea8-bf5c-4af9-bd3d-911eb02adc14
CVE ID: CVE-2022-1575 State: PUBLISHED Published: 2022-05-05T11:45:12 Last Updated: 2024-08-03T00:10:03.557Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L) Vendors: jgraph Products: jgraph/drawio Problem Types: CWE-94 Description: Arbitrary Code Execution through Sanitizer Bypass in GitHub repository jgraph/drawio prior to 18.0.0. - Arbitrary (remote) code execution in the desktop app. - Stored XSS in the web app. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/033d3423-eb05-4b53-a747-1bfcba873127 - https://github.com/jgraph/drawio/commit/f768ed73875d5eca20110b9c1d72f2789cd1bab7
CVE ID: CVE-2022-1576 State: PUBLISHED Published: 2022-07-11T12:55:56 Last Updated: 2024-08-03T00:10:03.924Z Vendors: Unknown Products: WP Maintenance Mode & Coming Soon Problem Types: CWE-352 Description: The WP Maintenance Mode & Coming Soon WordPress plugin before 2.4.5 is lacking CSRF when emptying the subscribed users list, which could allow attackers to make a logged in admin perform such action via a CSRF attack Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/68deab46-1c16-46ae-a912-a104958ca4cf
CVE ID: CVE-2022-1577 State: PUBLISHED Published: 2022-06-06T08:51:09 Last Updated: 2024-08-03T00:10:03.450Z Vendors: Unknown Products: Database Backup for WordPress Problem Types: CWE-352 Description: The Database Backup for WordPress plugin before 2.5.2 does not have CSRF check in place when updating the schedule backup settings, which could allow an attacker to make a logged in admin change them via a CSRF attack. This could lead to cases where attackers can send backup notification emails to themselves, which contain more details. Or disable the automatic backup schedule Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/39388900-266d-4308-8
e Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/39388900-266d-4308-88e7-d40ca6bbe346
CVE ID: CVE-2022-1578 State: PUBLISHED Published: 2022-11-21T00:00:00.000Z Last Updated: 2025-04-30T14:57:01.537Z Vendors: Unknown Products: My wpdb Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The My wpdb WordPress plugin before 2.5 is missing CSRF check when running SQL queries, which could allow attacker to make a logged in admin run arbitrary SQL query via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c280da92-4ac2-43ea-93a2-6c583b79b98b
CVE ID: CVE-2022-1579 State: PUBLISHED Published: 2022-11-21T00:00:00.000Z Last Updated: 2025-04-30T14:58:30.475Z Vendors: Unknown Products: Login Block IPs Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The function check_is_login_page() uses headers for the IP check, which can be easily spoofed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/6f3d40fa-458b-44f0-9407-763e80b29668
CVE ID: CVE-2022-1580 State: PUBLISHED Published: 2022-09-19T14:00:47 Last Updated: 2024-08-03T00:10:03.579Z Vendors: Unknown Products: Site Offline Or Coming Soon Or Maintenance Mode Problem Types: CWE-639 Description: The Site Offline Or Coming Soon Or Maintenance Mode WordPress plugin before 1.5.3 prevents users from accessing a website but does not do so if the URL contained certain keywords. Adding those keywords to the URL's query string would bypass the plugin's main feature. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/7b6f91cd-5a00-49ca-93ff-db7220d2630a
CVE ID: CVE-2022-1581 State: PUBLISHED Published: 2022-11-21T00:00:00.000Z Last Updated: 2025-04-30T15:00:03.896Z Vendors: Unknown Products: WP-Polls Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The WP-Polls WordPress plugin before 2.76.0 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations to vote in certain situations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c1896ab9-9585-40e2-abbf-ef5153b3c6b2 - https://www.hightechdad.com/2009/12/21/warning-wp-polls-wordpress-poll-plugin-can-be-exp
9-9585-40e2-abbf-ef5153b3c6b2 - https://www.hightechdad.com/2009/12/21/warning-wp-polls-wordpress-poll-plugin-can-be-exploited/
CVE ID: CVE-2022-1582 State: PUBLISHED Published: 2022-05-30T08:36:01 Last Updated: 2024-08-03T00:10:03.636Z Vendors: Unknown Products: External Links in New Window / New Tab Problem Types: CWE-79 Description: The External Links in New Window / New Tab WordPress plugin before 1.43 does not properly escape URLs it concatenates to onclick event handlers, which makes Stored Cross-Site Scripting attacks possible. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/cbb75383-4351-4488-aaca-ddb0f6f120cd
CVE ID: CVE-2022-1583 State: PUBLISHED Published: 2022-05-30T08:36:03 Last Updated: 2024-08-03T00:10:03.760Z Vendors: Unknown Products: External Links in New Window / New Tab Problem Types: CWE-1022 Description: The External Links in New Window / New Tab WordPress plugin before 1.43 does not ensure window.opener is set to "null" when links to external sites are clicked, which may enable tabnabbing attacks to occur. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/aa9d727c-4d17-4220-b8cb-e6dec30361a9
CVE ID: CVE-2022-1584 State: PUBLISHED Published: 2022-05-04T17:00:13 Last Updated: 2024-08-03T00:10:03.814Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: microweber Products: microweber/microweber Problem Types: CWE-79 Description: Reflected XSS in GitHub repository microweber/microweber prior to 1.2.16. Executing JavaScript as the victim Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/69f4ca67-d615-4f25-b2d1-19df7bf1107d - https://github.com/microweber/microweber/commit/527abd148e6b7aff8df92a9f1aa951e5bebac59c
CVE ID: CVE-2022-1585 State: PUBLISHED Published: 2022-08-01T12:48:01 Last Updated: 2024-08-03T00:10:03.753Z Vendors: Unknown Products: WordPress project source code download Problem Types: CWE-552 Description: The Project Source Code Download WordPress plugin through 1.0.0 does not protect its backup generation and download functionalities, which may allow any visitors on the site to download the entire site, including sensitive files like wp-config.php. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e709958c-7bce-45d7-9a0a-6e0ed12cd03f
CVE ID: CVE-2022-1586 State: PUBLISHED Published: 2022-05-16T00:00:00.000Z Last Updated: 2025-03-06T08:18:54.168Z Vendors: n/a Products: pcre2 Problem Types: CWE-125 Description: An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M2GLQQUEY5VFM57CFYXVIFOXN2HUZPD
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M2GLQQUEY5VFM57CFYXVIFOXN2HUZPDM/ - https://bugzilla.redhat.com/show_bug.cgi?id=2077976%2C - https://github.com/PCRE2Project/pcre2/commit/50a51cb7e67268e6ad417eb07c9de9bfea5cc55a%2C - https://github.com/PCRE2Project/pcre2/commit/d4fa336fbcc388f89095b184ba6d99422cfc676c - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KAX7767BCUFC7JMDGP7GOQ5GIZCAUGBB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXINO3KKI5DICQ45E2FKD6MKVMGJLEKJ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fe
rg/message/JXINO3KKI5DICQ45E2FKD6MKVMGJLEKJ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DWNG2NS3GINO6LQYUVC4BZLUQPJ3DYHA/ - https://security.netapp.com/advisory/ntap-20221028-0009/ - https://lists.debian.org/debian-lts-announce/2023/03/msg00014.html
CVE ID: CVE-2022-1587 State: PUBLISHED Published: 2022-05-16T00:00:00 Last Updated: 2024-08-03T00:10:03.682Z Vendors: n/a Products: pcre2 Problem Types: CWE-125 Description: An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M2GLQQUEY5VFM57CFYXVIFOXN2HUZPDM/ - https://bugzilla.redhat.com/show_bug.cgi?id=2077983%2C - https://github.com/PCR
sage/M2GLQQUEY5VFM57CFYXVIFOXN2HUZPDM/ - https://bugzilla.redhat.com/show_bug.cgi?id=2077983%2C - https://github.com/PCRE2Project/pcre2/commit/03654e751e7f0700693526b67dfcadda6b42c9d0 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KAX7767BCUFC7JMDGP7GOQ5GIZCAUGBB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXINO3KKI5DICQ45E2FKD6MKVMGJLEKJ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DWNG2NS3GINO6LQYUVC4BZLUQPJ3DYHA/ - https://security.netapp.com/advisory/ntap-20221028-0009/ - https://lists.debian.org/debian-lts-announce/2023/03/msg
A/ - https://security.netapp.com/advisory/ntap-20221028-0009/ - https://lists.debian.org/debian-lts-announce/2023/03/msg00014.html
CVE ID: CVE-2022-1588 State: REJECTED Published: 2022-05-05T06:45:11 Last Updated: 2022-05-23T15:30:10 Description: No description available.
CVE ID: CVE-2022-1589 State: PUBLISHED Published: 2022-05-30T08:36:04 Last Updated: 2024-08-03T00:10:03.626Z Vendors: Unknown Products: Change wp-admin login Problem Types: CWE-863 Incorrect Authorization, CWE-352 Cross-Site Request Forgery (CSRF) Description: The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, which could allow unauthenticated users to change the settings. The attacked could also be performed via a CSRF vector Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/257f9e14-4f43-4852-8384-80c15d087633
CVE ID: CVE-2022-1590 State: PUBLISHED Published: 2022-05-05T09:20:10.000Z Last Updated: 2025-04-15T14:40:45.664Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: unspecified Products: Bludit Problem Types: CWE-79 Description: A vulnerability was found in Bludit 3.13.1. It has been declared as problematic. This vulnerability affects the endpoint /admin/new-content of the New Content module. The manipulation of the argument content with the input <script>alert(1)</script> leads to cross site scripting. The attack can be initiated remotely but requires an authentication. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CVE
quires an authentication. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/joinia/webray.com.cn/blob/main/Bludit/Bluditreadme.md - https://vuldb.com/?id.199060
CVE ID: CVE-2022-1591 State: PUBLISHED Published: 2022-09-19T14:00:50 Last Updated: 2024-08-03T00:10:03.505Z Vendors: Unknown Products: WordPress Ping Optimizer Problem Types: CWE-352 Description: The WordPress Ping Optimizer WordPress plugin before 2.35.1.3.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/b1a52c7e-3422-40dd-af5a-ea4c622a87aa
CVE ID: CVE-2022-1592 State: PUBLISHED Published: 2022-05-05T10:20:09 Last Updated: 2024-08-03T00:10:03.567Z Severity: CRITICAL (CVSS 9.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: clinical-genomics Products: clinical-genomics/scout Problem Types: CWE-918 Description: Server-Side Request Forgery in scout in GitHub repository clinical-genomics/scout prior to v4.42. An attacker could make the application perform arbitrary requests to fishing steal cookie, request to private area, or lead to xss... Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/352b39da-0f2e-415a-9793-5480cae8bd27 - https://github.com/clinical-genomics/scout/commit/b0ef15
tps://huntr.dev/bounties/352b39da-0f2e-415a-9793-5480cae8bd27 - https://github.com/clinical-genomics/scout/commit/b0ef15f4737d0c801154c1991b52ff5cab4f5c83
CVE ID: CVE-2022-1593 State: PUBLISHED Published: 2022-06-27T08:57:06 Last Updated: 2024-08-03T00:10:03.565Z Vendors: Unknown Products: Site Offline or Coming Soon Problem Types: CWE-79 Description: The Site Offline or Coming Soon WordPress plugin through 1.6.6 does not have CSRF check in place when updating its settings, and it also lacking sanitisation as well as escaping in some of them. As a result, attackers could make a logged in admin change them and put Cross-Site Scripting payloads in them via a CSRF attack Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/67678666-402b-4010-ac56-7067a0f40185
CVE ID: CVE-2022-1594 State: PUBLISHED Published: 2022-06-13T12:42:00 Last Updated: 2024-08-03T00:10:03.579Z Vendors: Unknown Products: HC Custom WP-Admin URL Problem Types: CWE-352 Description: The HC Custom WP-Admin URL WordPress plugin through 1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, allowing them to change the login URL Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/bb0efc5e-044b-47dc-9101-9aae40cdbaa5
CVE ID: CVE-2022-1595 State: PUBLISHED Published: 2022-06-13T12:42:03 Last Updated: 2024-08-03T00:10:03.550Z Vendors: Unknown Products: HC Custom WP-Admin URL Problem Types: CWE-200 Description: The HC Custom WP-Admin URL WordPress plugin through 1.4 leaks the secret login URL when sending a specific crafted request Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0218c90c-8f79-4f37-9a6f-60cf2f47d47b
CVE ID: CVE-2022-1596 State: PUBLISHED Published: 2022-06-21T14:23:42.343945Z Last Updated: 2024-09-16T23:11:43.087Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: ABB Products: REX640 PCL1, REX640 PCL2, REX640 PCL3 Problem Types: CWE-732 Description: Incorrect Permission Assignment for Critical Resource vulnerability in ABB REX640 PCL1, REX640 PCL2, REX640 PCL3 allows an authenticated attacker to launch an attack against the user database file and try to take control of an affected system node. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=2NGA001421
CVE ID: CVE-2022-1597 State: PUBLISHED Published: 2022-06-06T08:51:10 Last Updated: 2024-08-03T00:10:03.533Z Vendors: Unknown Products: WPQA Builder Problem Types: CWE-79 Description: The WPQA Builder WordPress plugin before 5.4, used as a companion for the Discy and Himer , does not sanitise and escape a parameter on its reset password form which makes it possible to perform Reflected Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/faff9484-9fc7-4300-bdad-9cd8a30a9a4e
CVE ID: CVE-2022-1598 State: PUBLISHED Published: 2022-06-06T08:51:12 Last Updated: 2024-08-03T00:10:03.660Z Vendors: Unknown Products: WPQA Builder Problem Types: CWE-306 Missing Authentication for Critical Function Description: The WPQA Builder WordPress plugin before 5.5 which is a companion to the Discy and Himer , lacks authentication in a REST API endpoint, allowing unauthenticated users to discover private questions sent between users on the site. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0416ae2f-5670-4080-a88d-3484bb19d8c8