Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-6274 State: PUBLISHED Published: 2023-11-24T14:00:04.902Z Last Updated: 2024-08-02T08:28:20.357Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Byzoro Products: Smart S80 Problem Types: CWE-434 Description: A vulnerability was found in Byzoro Smart S80 up to 20231108. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /sysmanage/updatelib.php of the component PHP File Handler. The manipulation of the argument file_upload leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-246103
exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-246103. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.246103 - https://vuldb.com/?ctiid.246103 - https://vuldb.com/?submit.234888 - https://github.com/Carol7S/cve/blob/main/rce.md
CVE ID: CVE-2023-6275 State: PUBLISHED Published: 2023-11-24T15:00:06.295Z Last Updated: 2025-06-03T14:09:44.986Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: TOTVS Products: Fluig Platform Problem Types: CWE-79 Description: A vulnerability was found in TOTVS Fluig Platform 1.6.x/1.7.x/1.8.0/1.8.1. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /mobileredir/openApp.jsp of the component mobileredir. The manipulation of the argument redirectUrl/user with the input "><script>alert(document.domain)</script> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be u
to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.7.1-231128, 1.8.0-231127 and 1.8.1-231127 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-246104. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.246104 - https://vuldb.com/?ctiid.246104 - https://tdn.totvs.com/pages/releaseview.action?pageId=761497686
CVE ID: CVE-2023-6276 State: PUBLISHED Published: 2023-11-24T15:31:04.202Z Last Updated: 2025-06-03T14:06:08.825Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Tongda Products: OA 2017 Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in Tongda OA 2017 up to 11.9. This affects an unknown part of the file general/wiki/cp/ct/delete.php. The manipulation of the argument PROJ_ID_STR leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-
to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-246105 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.246105 - https://vuldb.com/?ctiid.246105 - https://github.com/YXuanZ1216/cve/blob/main/sql.md
CVE ID: CVE-2023-6277 State: PUBLISHED Published: 2023-11-24T18:20:16.683Z Last Updated: 2025-11-20T18:08:32.085Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-400 Description: An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFOpen() API may allow a remote attacker to cause a denial of service via a craft input with size smaller than 379 KB. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-6277
s: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-6277 - https://bugzilla.redhat.com/show_bug.cgi?id=2251311 - https://gitlab.com/libtiff/libtiff/-/issues/614 - https://gitlab.com/libtiff/libtiff/-/merge_requests/545
CVE ID: CVE-2023-6278 State: PUBLISHED Published: 2024-01-29T14:44:14.702Z Last Updated: 2025-06-20T19:42:54.122Z Vendors: Unknown Products: Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo WordPress plugin before 2.2.25 does not sanitise and escape the biteship_error and biteship_message parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulne
admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/dfe5001f-31b9-4de2-a240-f7f5a992ac49/
CVE ID: CVE-2023-6279 State: PUBLISHED Published: 2024-01-29T14:44:19.154Z Last Updated: 2025-06-02T18:57:30.391Z Vendors: Unknown Products: Woostify Sites Library Problem Types: CWE-862 Missing Authorization Description: The Woostify Sites Library WordPress plugin before 1.4.8 does not have authorisation in an AJAX action, allowing any authenticated users, such as subscriber to update arbitrary blog options and set them to 'activated' which could lead to DoS when using a specific option name Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/626bbc7d-0d0f-4418-ac61-666278a1cbdb/
CVE ID: CVE-2023-6280 State: PUBLISHED Published: 2023-12-19T15:00:07.403Z Last Updated: 2024-08-02T08:28:21.761Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L) Vendors: 52North Products: 52North WPS Problem Types: CWE-611 Description: An XXE (XML External Entity) vulnerability has been detected in 52North WPS affecting versions prior to 4.0.0-beta.11. This vulnerability allows the use of external entities in its WebProcessingService servlet for an attacker to retrieve files by making HTTP requests to the internal network. Additional Analyst Notes: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/xml-external-entity-reference-5
CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/xml-external-entity-reference-52north-wps
CVE ID: CVE-2023-6282 State: PUBLISHED Published: 2024-01-25T11:37:11.290Z Last Updated: 2024-10-18T15:23:29.039Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: IceHrm Products: IceHrm Problem Types: CWE-79 Description: IceHrm 23.0.0.OS does not sufficiently encode user-controlled input, which creates a Cross-Site Scripting (XSS) vulnerability via /icehrm/app/fileupload_page.php, in multiple parameters. An attacker could exploit this vulnerability by sending a specially crafted JavaScript payload and partially hijacking the victim's browser. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/in
r. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-icehrm
CVE ID: CVE-2023-6287 State: PUBLISHED Published: 2023-11-27T14:04:01.568Z Last Updated: 2024-08-26T09:47:54.792Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Checkmk GmbH Products: Checkmk Appliance Problem Types: CWE-598 Description: Sensitive data exposure in Webconf in Tribe29 Checkmk Appliance before 1.6.8 allows local attacker to retrieve passwords via reading log files. Additional Analyst Notes: - CVE Program Container: References: - https://checkmk.com/werk/9554
CVE ID: CVE-2023-6288 State: PUBLISHED Published: 2023-12-06T13:49:50.204Z Last Updated: 2024-08-02T08:28:20.356Z Vendors: Devolutions Products: Remote Desktop Manager Description: Code injection in Remote Desktop Manager 2023.3.9.3 and earlier on macOS allows an attacker to execute code via the DYLIB_INSERT_LIBRARIES environment variable. Additional Analyst Notes: - CVE Program Container: References: - https://devolutions.net/security/advisories/DEVO-2023-0021/
CVE ID: CVE-2023-6289 State: PUBLISHED Published: 2023-12-18T20:08:00.760Z Last Updated: 2025-05-07T20:32:33.463Z Vendors: Unknown Products: Swift Performance Lite Problem Types: CWE-287 Improper Authentication Description: The Swift Performance Lite WordPress plugin before 2.3.6.15 does not prevent users from exporting the plugin's settings, which may include sensitive information such as Cloudflare API tokens. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8c83dd57-9291-4dfc-846d-5ad47534e2ad
CVE ID: CVE-2023-6290 State: PUBLISHED Published: 2024-01-22T19:14:26.723Z Last Updated: 2024-08-29T14:31:11.952Z Vendors: Unknown Products: SEOPress Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The SEOPress WordPress plugin before 7.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/78a13958-cd12-4ea8-b326-1e3184da970b/
CVE ID: CVE-2023-6291 State: PUBLISHED Published: 2024-01-26T14:23:43.185Z Last Updated: 2025-11-11T16:12:14.005Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Red Hat Products: Red Hat build of Keycloak 22, Red Hat build of Keycloak 22.0.7, Red Hat Single Sign-On 7, Red Hat Single Sign-On 7.6 for RHEL 7, Red Hat Single Sign-On 7.6 for RHEL 8, Red Hat Single Sign-On 7.6 for RHEL 9, RHEL-8 based Middleware Containers, Single Sign-On 7.6.6, Migration Toolkit for Applications 6, Migration Toolkit for Applications 7, OpenShift Serverless, Red Hat Data Grid 8, Red Hat Decision Manager 7, Red Hat Fuse 7, Red Hat JBoss Data Grid 7, Red Hat JBoss Enterprise Applicat
at Data Grid 8, Red Hat Decision Manager 7, Red Hat Fuse 7, Red Hat JBoss Data Grid 7, Red Hat JBoss Enterprise Application Platform 6, Red Hat Process Automation 7 Problem Types: CWE-601 Description: A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, making it possible for the attacker to impersonate other users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2023:7854 - https://access.redhat.com/errata/RHSA-2023:7855 - https://access.redhat.com/errata/RHSA-2023:7856
rrata/RHSA-2023:7854 - https://access.redhat.com/errata/RHSA-2023:7855 - https://access.redhat.com/errata/RHSA-2023:7856 - https://access.redhat.com/errata/RHSA-2023:7857 - https://access.redhat.com/errata/RHSA-2023:7858 - https://access.redhat.com/errata/RHSA-2023:7860 - https://access.redhat.com/errata/RHSA-2023:7861 - https://access.redhat.com/errata/RHSA-2024:0798 - https://access.redhat.com/errata/RHSA-2024:0799 - https://access.redhat.com/errata/RHSA-2024:0800 - https://access.redhat.com/errata/RHSA-2024:0801 - https://access.redhat.com/errata/RHSA-2024:0804 - https://access.redhat.com/security/cve/CVE-2023-6291 - https://bugzilla.redhat.com/show_bug.cgi?id=2251407
CVE ID: CVE-2023-6292 State: PUBLISHED Published: 2024-01-16T15:57:34.872Z Last Updated: 2025-06-02T15:09:04.835Z Vendors: Unknown Products: Ecwid Ecommerce Shopping Cart Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Ecwid Ecommerce Shopping Cart WordPress plugin before 6.12.5 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d4cf799e-2571-4b96-a303-78dcafbfcf40/
CVE ID: CVE-2023-6293 State: PUBLISHED Published: 2023-11-24T19:51:55.099Z Last Updated: 2024-08-02T08:28:21.695Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: robinbuschmann Products: robinbuschmann/sequelize-typescript Problem Types: CWE-1321 Description: Prototype Pollution in GitHub repository robinbuschmann/sequelize-typescript prior to 2.1.6. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.com/bounties/36a7ecbf-4d3d-462e-86a3-cda7b1ec64e2 - https://github.com/robinbuschmann/sequelize-typescript/commit/5ce8afdd1671b08c774ce106b000605ba8fccf78
CVE ID: CVE-2023-6294 State: PUBLISHED Published: 2024-02-12T16:06:01.185Z Last Updated: 2025-04-24T15:43:33.724Z Vendors: Unknown Products: Popup Builder Problem Types: CWE-918 Server-Side Request Forgery (SSRF) Description: The Popup Builder WordPress plugin before 4.2.6 does not validate a parameter before making a request to it, which could allow users with the administrator role to perform SSRF attack in Multisite WordPress configurations. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/eaeb5706-b19c-4266-b7df-889558ee2614/
CVE ID: CVE-2023-6295 State: PUBLISHED Published: 2023-12-18T20:08:01.584Z Last Updated: 2024-08-02T08:28:21.296Z Vendors: Unknown Products: SiteOrigin Widgets Bundle Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The SiteOrigin Widgets Bundle WordPress plugin before 1.51.0 does not validate user input before using it to generate paths passed to include function/s, allowing users with the administrator role to perform LFI attacks in the context of Multisite WordPress sites. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/adc9ed9f-55b4-43a9-a79d-c7120764f47c
CVE ID: CVE-2023-6296 State: PUBLISHED Published: 2023-11-26T21:31:04.142Z Last Updated: 2025-02-13T17:26:16.997Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: n/a Products: osCommerce Problem Types: CWE-79 Description: A vulnerability was found in osCommerce 4. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /catalog/compare of the component Instant Message Handler. The manipulation of the argument compare with the input 40dz4iq"><script>alert(1)</script>zohkx leads to cross site scripting. The attack may be launched remotely. VDB-246122 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early abou
aunched remotely. VDB-246122 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.246122 - https://vuldb.com/?ctiid.246122 - http://packetstormsecurity.com/files/175925/osCommerce-4-Cross-Site-Scripting.html
CVE ID: CVE-2023-6297 State: PUBLISHED Published: 2023-11-26T22:31:04.240Z Last Updated: 2025-06-03T14:03:48.835Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: PHPGurukul Products: Nipah Virus Testing Management System Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in PHPGurukul Nipah Virus Testing Management System 1.0. This affects an unknown part of the file patient-search-report.php of the component Search Report Page. The manipulation of the argument Search By Patient Name with the input <script>alert(document.cookie)</script> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disc
ookie)</script> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-246123. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.246123 - https://vuldb.com/?ctiid.246123 - https://github.com/dhabaleshwar/niv_testing_rxss/blob/main/exploit.md
CVE ID: CVE-2023-6298 State: PUBLISHED Published: 2023-11-26T23:00:04.961Z Last Updated: 2025-02-13T17:26:17.520Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:N/A:P) Vendors: Apryse Products: iText Problem Types: CWE-129 Description: A vulnerability classified as problematic was found in Apryse iText 8.0.2. This vulnerability affects the function main of the file PdfDocument.java. The manipulation leads to improper validation of array index. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The identifier of this vulnerability is VDB-246124. NOTE: The vendor was contacted
lity is still doubted at the moment. The identifier of this vulnerability is VDB-246124. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. A statement published afterwards explains that the exception is not a vulnerability and the identified CWEs might not apply to the software. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.246124 - https://vuldb.com/?ctiid.246124 - https://drive.google.com/drive/folders/1OBAeGH_rNfa1os6g6QlIt4pL-2NKHZm_?usp=sharing - https://kb.itextpdf.com/itext/statement-regarding-cve-2022-24198-and-2023-6298
CVE ID: CVE-2023-6299 State: PUBLISHED Published: 2023-11-26T23:00:05.998Z Last Updated: 2024-08-02T08:28:21.473Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:N/A:P) Vendors: Apryse Products: iText Problem Types: CWE-401 Description: A vulnerability, which was classified as problematic, has been found in Apryse iText 8.0.1. This issue affects some unknown processing of the file PdfDocument.java of the component Reference Table Handler. The manipulation leads to memory leak. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 8.0.2 is able to address this issue. It is recommended to upgrade the affected component. The identifi
rading to version 8.0.2 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-246125 was assigned to this vulnerability. NOTE: The vendor was contacted early about this vulnerability. The fix was introduced in the iText 8.0.2 release on October 25th 2023, prior to the disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.246125 - https://vuldb.com/?ctiid.246125 - https://drive.google.com/file/d/1_jeD7SvuliKc_02pPTPbfSnqAErzmFny/view?usp=sharing - https://kb.itextpdf.com/home/it7kb/releases/release-itext-core-8-0-2#ReleaseiTextCore8.0.2-Bugfixesandmiscellaneous
CVE ID: CVE-2023-6300 State: PUBLISHED Published: 2023-11-26T23:31:04.652Z Last Updated: 2024-10-10T20:33:30.982Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Best Courier Management System Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in SourceCodester Best Courier Management System 1.0. Affected is an unknown function. The manipulation of the argument page with the input </TiTlE><ScRiPt>alert(1)</ScRiPt> leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-246126 is the identifier assigned to this vulnerability
he exploit has been disclosed to the public and may be used. VDB-246126 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.246126 - https://vuldb.com/?ctiid.246126 - https://github.com/BigTiger2020/2023/blob/main/best-courier-management-system/best-courier-management-system%20-%20reflected%20xss.md
CVE ID: CVE-2023-6301 State: PUBLISHED Published: 2023-11-26T23:31:05.687Z Last Updated: 2024-08-02T08:28:21.497Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Best Courier Management System Problem Types: CWE-79 Description: A vulnerability has been found in SourceCodester Best Courier Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file parcel_list.php of the component GET Parameter Handler. The manipulation of the argument id with the input </TiTlE><ScRiPt>alert(1)</ScRiPt> leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the pub
)</ScRiPt> leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-246127. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.246127 - https://vuldb.com/?ctiid.246127 - https://github.com/BigTiger2020/2023/blob/main/best-courier-management-system/best-courier-management-system-reflected%20xss2.md
CVE ID: CVE-2023-6302 State: PUBLISHED Published: 2023-11-27T00:00:06.970Z Last Updated: 2024-08-29T19:13:04.588Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: n/a Products: CSZCMS Problem Types: CWE-275 Description: A vulnerability was found in CSZCMS 1.3.0 and classified as critical. Affected by this issue is some unknown functionality of the file \views\templates of the component File Manager Page. The manipulation leads to permission issues. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-246128. NOTE: The vendor was contacted early about this disclosure but did not respond in an
f this vulnerability is VDB-246128. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.246128 - https://vuldb.com/?ctiid.246128 - https://github.com/t34t/CVE/blob/main/CSZCMS/Code-Execution-Vulnerability-in-cszcmsV1.3.0.md
CVE ID: CVE-2023-6303 State: PUBLISHED Published: 2023-11-27T00:00:08.280Z Last Updated: 2024-08-02T08:28:21.610Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: n/a Products: CSZCMS Problem Types: CWE-79 Description: A vulnerability was found in CSZCMS 1.3.0. It has been classified as problematic. This affects an unknown part of the file /admin/settings/ of the component Site Settings Page. The manipulation of the argument Additional Meta Tag with the input <svg><animate onbegin=alert(1) attributeName=x dur=1s> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-246129 wa
initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-246129 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.246129 - https://vuldb.com/?ctiid.246129 - https://github.com/t34t/CVE/blob/main/CSZCMS/0-Store-XSS-Vulnerability-in-cszcmsV1.3.0.md