Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-5112 State: PUBLISHED Published: 2023-09-30T22:08:55.337Z Last Updated: 2024-09-20T17:21:19.814Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Os Commerce Products: Os Commerce Problem Types: CWE-79 Description: Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "specials_type_name[1]" parameter, potentially leading to unauthorized execution of scripts within a user's web browser. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/bts/ - https://www.oscommerce.com/
CVE ID: CVE-2023-5113 State: PUBLISHED Published: 2023-10-04T14:20:46.768Z Last Updated: 2024-09-19T19:47:53.092Z Vendors: HP Inc. Products: Certain HP Enterprise LaserJet, LaserJet Managed printers Description: Certain HP Enterprise LaserJet and HP LaserJet Managed Printers are potentially vulnerable to denial of service due to WS-Print request and potential injections of Cross Site Scripting via jQuery-UI. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hp.com/us-en/document/ish_9365285-9365309-16
CVE ID: CVE-2023-5114 State: PUBLISHED Published: 2023-10-31T11:29:12.590Z Last Updated: 2025-02-05T18:52:37.641Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: faikdjikic Products: idbbee Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The idbbee plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'idbbee' shortcode in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary
s. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ac763936-7147-4100-8a46-4c6d2f2224b4?source=cve - https://plugins.trac.wordpress.org/browser/idbbee/trunk/idbbee.php#L34
CVE ID: CVE-2023-5115 State: PUBLISHED Published: 2023-12-18T13:43:07.791Z Last Updated: 2025-11-20T17:29:54.523Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N) Vendors: Red Hat Products: Red Hat Ansible Automation Platform 2.3 for RHEL 8, Red Hat Ansible Automation Platform 2.3 for RHEL 9, Red Hat Ansible Automation Platform 2.4 for RHEL 8, Red Hat Ansible Automation Platform 2.4 for RHEL 9, Red Hat Ansible Automation Platform 1.2 Problem Types: CWE-36 Description: An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to
law allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:5701 - https://access.redhat.com/errata/RHSA-2023:5758 - https://access.redhat.com/security/cve/CVE-2023-5115 - https://bugzilla.redhat.com/show_bug.cgi?id=2233810
CVE ID: CVE-2023-5116 State: PUBLISHED Published: 2023-10-31T12:45:21.708Z Last Updated: 2025-02-05T18:52:22.955Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ipushpull Products: Live updates from Excel Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Live updates from Excel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ipushpull_page' shortcode in versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level
output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ab856722-e954-49de-a93f-46664da6e3e8?source=cve - https://plugins.trac.wordpress.org/browser/ipushpull/trunk/public/class-ipushpull-public.php#L113
CVE ID: CVE-2023-5117 State: PUBLISHED Published: 2024-12-25T14:46:47.927Z Last Updated: 2024-12-26T18:10:54.988Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-213 Description: An issue was discovered in GitLab CE/EE affecting all versions before 17.6.0 in which users were unaware that files uploaded to comments on confidential issues and epics of public projects could be accessed without authentication via a direct link to the uploaded file URL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/398250
CVE ID: CVE-2023-5118 State: PUBLISHED Published: 2024-01-11T15:23:44.745Z Last Updated: 2025-06-17T21:09:12.806Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Kofax Products: Capture Problem Types: CWE-79 Description: The application is vulnerable to Stored Cross-Site Scripting (XSS) in the endpoint /sofer/DocumentService.asc/SaveAnnotation, where input data transmitted via the POST method in the parameters author and text are not adequately sanitized and validated. This allows for the injection of malicious JavaScript code. The vulnerability was identified in the function for adding new annotations while editing document content. Reporters inform that th
ility was identified in the function for adding new annotations while editing document content. Reporters inform that the vulnerability has been removed in software versions above 11.1.x. Previous versions may also be vulnerable, but this has not been confirmed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2024/01/CVE-2023-5118/ - https://cert.pl/posts/2024/01/CVE-2023-5118/
CVE ID: CVE-2023-5119 State: PUBLISHED Published: 2023-11-20T18:55:11.173Z Last Updated: 2024-08-02T07:44:53.707Z Vendors: Unknown Products: Forminator Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Forminator WordPress plugin before 1.27.0 does not properly sanitize the redirect-url field in the form submission settings, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup). Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/229207bb-8f8d-4579-a8e2-54516474ccb4
CVE ID: CVE-2023-5120 State: PUBLISHED Published: 2023-10-20T06:35:16.563Z Last Updated: 2025-02-05T19:10:00.670Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: wpvividplugins Products: Migration, Backup, Staging – WPvivid Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image file path parameter in versions up to, and including, 0.9.89 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative privilege
input sanitization and output escaping. This makes it possible for authenticated attackers with administrative privileges to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/320f4260-20c2-4f27-91ba-d2488b417f62?source=cve - https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/tags/0.9.89/includes/upload-cleaner/class-wpvivid-uploads-cleaner.php#L161
CVE ID: CVE-2023-5121 State: PUBLISHED Published: 2023-10-20T07:29:31.733Z Last Updated: 2025-02-05T19:04:10.580Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: wpvividplugins Products: Migration, Backup, Staging – WPvivid Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings (the backup path parameter) in versions up to, and including, 0.9.89 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administra
insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cdcac5f9-a744-4853-8a80-ed38fec81dbb?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2956458%40wpvivid-backuprestore%2Ftrunk&old=2948265%40wpvivid-ba
press.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2956458%40wpvivid-backuprestore%2Ftrunk&old=2948265%40wpvivid-backuprestore%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-5122 State: PUBLISHED Published: 2024-02-14T15:06:12.573Z Last Updated: 2025-02-13T17:19:42.980Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: Grafana Products: grafana-csv-datasource Problem Types: CWE-918 Description: Grafana is an open-source platform for monitoring and observability. The CSV datasource plugin is a Grafana Labs maintained plugin for Grafana that allows for retrieving and processing CSV data from a remote endpoint configured by an administrator. If this plugin was configured to send requests to a bare host with no path (e.g. https://www.example.com/ https://www.example.com/` ), requests to an endpoint other than the one co
t with no path (e.g. https://www.example.com/ https://www.example.com/` ), requests to an endpoint other than the one configured by the administrator could be triggered by a specially crafted request from any user, resulting in an SSRF vector. AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://grafana.com/security/security-advisories/cve-2023-5122/ - https://security.netapp.com/advisory/ntap-20240503-0002/
CVE ID: CVE-2023-5123 State: PUBLISHED Published: 2024-02-14T15:06:11.126Z Last Updated: 2025-03-24T19:13:31.690Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Grafana Products: grafana-json-datasource Problem Types: CWE-22 Description: The JSON datasource plugin ( https://grafana.com/grafana/plugins/marcusolsson-json-datasource/ ) is a Grafana Labs maintained plugin for Grafana that allows for retrieving and processing JSON data from a remote endpoint (including a specific sub-path) configured by an administrator. Due to inadequate sanitization of the dashboard-supplied path parameter, it was possible to include path traversal characters (../) in the path par
ion of the dashboard-supplied path parameter, it was possible to include path traversal characters (../) in the path parameter and send requests to paths on the configured endpoint outside the configured sub-path. This means that if the datasource was configured by an administrator to point at some sub-path of a domain (e.g. https://example.com/api/some_safe_api/ ), it was possible for an editor to create a dashboard referencing the datasource which issues queries containing path traversal characters, which would in turn cause the datasource to instead query arbitrary subpaths on the configured domain (e.g. https://example.com/api/admin_api/) . In the rare case that this plugin is configured
ths on the configured domain (e.g. https://example.com/api/admin_api/) . In the rare case that this plugin is configured by an administrator to point back at the Grafana instance itself, this vulnerability becomes considerably more severe, as an administrator browsing a maliciously configured panel could be compelled to make requests to Grafana administrative API endpoints with their credentials, resulting in the potential for privilege escalation, hence the high score for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://grafana.com/security/security-advisories/cve-2023-5123/ - https://security.netapp.com/advisory/ntap-2024
nces: - https://grafana.com/security/security-advisories/cve-2023-5123/ - https://security.netapp.com/advisory/ntap-20240503-0007/
CVE ID: CVE-2023-5124 State: PUBLISHED Published: 2024-01-29T14:44:23.796Z Last Updated: 2025-05-22T17:24:53.316Z Vendors: Unknown Products: Page Builder: Pagelayer Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Page Builder: Pagelayer WordPress plugin before 1.8.0 doesn't prevent attackers with administrator privileges from inserting malicious JavaScript inside a post's header or footer code, even when unfiltered_html is disallowed, such as in multi-site WordPress configurations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1ef86546-3467-432c-a863-1ca3e5c65bd4/
CVE ID: CVE-2023-5125 State: PUBLISHED Published: 2023-09-23T04:29:41.200Z Last Updated: 2025-02-05T19:26:46.303Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: pankajagarwal Products: Contact Form by FormGet – Best Form Builder Plugin for WordPress Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Contact Form by FormGet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'formget' shortcode in versions up to, and including, 5.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacker
nt input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fdd73289-f292-4903-951e-6a89049d39a7?source=cve - https://plugins.trac.wordpress.org/browser/formget-contact-form/trunk/index.php?rev=2145639#L504
CVE ID: CVE-2023-5126 State: PUBLISHED Published: 2023-10-24T13:53:00.181Z Last Updated: 2025-02-05T18:58:30.410Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: cmc3215 Products: Delete Me Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Delete Me plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'plugin_delete_me' shortcode in versions up to, and including, 3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary w
s. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The shortcode is not displayed to administrators, so it cannot be used against administrator users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7a5123a7-8eb4-481e-88fe-6310be37a077?source=cve - https://plugins.trac.wordpress.org/browser/delete-me/tags/3.0/inc/shortcode.php#L83
CVE ID: CVE-2023-5127 State: PUBLISHED Published: 2023-10-24T13:52:58.747Z Last Updated: 2025-02-05T18:59:01.858Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: zayedbaloch Products: WP Font Awesome Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WP Font Awesome plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.7.9 due to insufficient input sanitization and output escaping on 'icon' user supplied attribute. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbit
tribute. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/59ee0b56-c11f-4951-aac0-8344200e4484?source=cve - https://plugins.trac.wordpress.org/browser/wp-font-awesome/trunk/wp-font-awesome.php?rev=2875119#L53 - https://plugins.trac.wordpress.org/browser/wp-font-awesome/trunk/wp-font-awesome.php?rev=2875119#L55 - https://plugins.trac.wordpress.org/browser/wp-font-awesome/trunk/wp-font-awesome.php?rev=
-awesome.php?rev=2875119#L55 - https://plugins.trac.wordpress.org/browser/wp-font-awesome/trunk/wp-font-awesome.php?rev=2875119#L68 - https://plugins.trac.wordpress.org/browser/wp-font-awesome/trunk/wp-font-awesome.php?rev=2875119#L70 - https://plugins.trac.wordpress.org/browser/wp-font-awesome/trunk/wp-font-awesome.php?rev=2875119#L83 - https://plugins.trac.wordpress.org/browser/wp-font-awesome/trunk/wp-font-awesome.php?rev=2875119#L85 - https://plugins.trac.wordpress.org/browser/wp-font-awesome/trunk/wp-font-awesome.php?rev=2875119#L99 - https://plugins.trac.wordpress.org/browser/wp-font-awesome/trunk/wp-font-awesome.php?rev=2875119#L101
CVE ID: CVE-2023-5128 State: PUBLISHED Published: 2023-11-22T15:33:24.310Z Last Updated: 2024-10-11T18:06:07.632Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: designplus Products: TCD Google Maps Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The TCD Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'map' shortcode in versions up to, and including, 1.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary
tes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/50f6d0aa-059d-48d9-873b-6404f288f002?source=cve - https://plugins.trac.wordpress.org/browser/tcd-google-maps/trunk/design-plus-google-maps.php?rev=2700917#L154 - https://plugins.trac.wordpress.org/browser/tcd-google-maps/trunk/design-plus-google-maps.php?rev=2700917#L169
CVE ID: CVE-2023-5129 State: REJECTED Published: 2023-09-25T20:42:25.119Z Last Updated: 2023-09-27T20:39:31.615Z Description: No description available.
CVE ID: CVE-2023-5130 State: PUBLISHED Published: 2024-01-18T21:14:26.662Z Last Updated: 2024-11-13T19:17:54.553Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:H) Vendors: Delta Electronics Products: WPLSoft Problem Types: CWE-119 Description: A buffer overflow vulnerability exists in Delta Electronics WPLSoft. An anonymous attacker can exploit this vulnerability by enticing a user to open a specially crafted DVP file to achieve code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2024/01/18/delta-electronics-wplsoft-buffer-overflow/
CVE ID: CVE-2023-5131 State: PUBLISHED Published: 2024-01-18T21:14:39.954Z Last Updated: 2025-06-17T21:19:20.642Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:H) Vendors: Delta Electronics Products: ISPSoft Problem Types: CWE-119 Description: A heap buffer-overflow exists in Delta Electronics ISPSoft. An anonymous attacker can exploit this vulnerability by enticing a user to open a specially crafted DVP file to achieve code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2024/01/18/delta-electronics-ispsoft-heap-buffer-overflow/
CVE ID: CVE-2023-5132 State: PUBLISHED Published: 2023-10-21T01:53:41.144Z Last Updated: 2025-02-05T18:59:52.312Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: soisytech Products: Soisy Pagamento Rateale Problem Types: CWE-862 Missing Authorization Description: The Soisy Pagamento Rateale plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the parseRemoteRequest function in versions up to, and including, 6.0.1. This makes it possible for unauthenticated attackers with knowledge of an existing WooCommerce Order ID to expose sensitive WooCommerce order information (e.g., Name, Address, Email Address, and other
ng WooCommerce Order ID to expose sensitive WooCommerce order information (e.g., Name, Address, Email Address, and other order metadata). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d3c997cd-37b4-4b9c-b99e-397be484aa36?source=cve - https://plugins.trac.wordpress.org/browser/soisy-pagamento-rateale/trunk/public/class-soisy-pagamento-rateale-public.php#L465
CVE ID: CVE-2023-5133 State: PUBLISHED Published: 2023-10-16T19:39:17.507Z Last Updated: 2025-04-23T16:11:40.829Z Vendors: Unknown Products: user-activity-log-pro Problem Types: CWE-290 Authentication Bypass by Spoofing Description: This user-activity-log-pro WordPress plugin before 2.3.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/36c30e54-75e4-4df1-b01a-60c51c0e76a3
CVE ID: CVE-2023-5134 State: PUBLISHED Published: 2023-09-23T07:34:02.132Z Last Updated: 2025-02-05T19:19:17.010Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: easyregistrationforms Products: Easy Registration Forms Problem Types: CWE-200 Information Exposure Description: The Easy Registration Forms for WordPress is vulnerable to Information Disclosure via the 'erforms_user_meta' shortcode in versions up to, and including, 2.1.1 due to insufficient controls on the information retrievable via the shortcode. This makes it possible for authenticated attackers, with subscriber-level capabilities or above, to retrieve arbitrary sensitive user meta. Additional A