Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-3175 State: PUBLISHED Published: 2023-07-10T12:40:53.443Z Last Updated: 2024-11-08T18:22:22.402Z Vendors: Unknown Products: AI ChatBot Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The AI ChatBot WordPress plugin before 4.6.1 does not adequately escape some settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7643980b-eaa2-45d1-bd9d-9afae0943f43
CVE ID: CVE-2023-3176 State: PUBLISHED Published: 2023-06-09T05:31:03.360Z Last Updated: 2024-08-02T06:48:08.048Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Lost and Found Information System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in SourceCodester Lost and Found Information System 1.0. Affected is an unknown function of the file admin\user\manage_user.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-231150 is the identifier assigned to this vulnerability. Additional A
been disclosed to the public and may be used. VDB-231150 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.231150 - https://vuldb.com/?ctiid.231150 - https://github.com/AnotherN/cvv/blob/main/imgs/Lost%20and%20Found%20Information%20System%20-%20multiple%20vulnerabilities.md#7sql-injection-vulnerability-in-adminusermanage_userphp
CVE ID: CVE-2023-3177 State: PUBLISHED Published: 2023-06-09T06:00:04.330Z Last Updated: 2024-11-22T15:36:59.661Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Lost and Found Information System Problem Types: CWE-89 Description: A vulnerability has been found in SourceCodester Lost and Found Information System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file admin\inquiries\view_inquiry.php. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231151. Addition
as been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231151. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.231151 - https://vuldb.com/?ctiid.231151 - https://github.com/AnotherN/cvv/blob/main/imgs/Lost%20and%20Found%20Information%20System%20-%20multiple%20vulnerabilities.md#4sql-injection-vulnerability-in-admininquiriesview_inquiryphp
CVE ID: CVE-2023-3178 State: PUBLISHED Published: 2024-01-16T15:55:29.719Z Last Updated: 2025-06-02T15:10:01.535Z Vendors: Unknown Products: POST SMTP Mailer Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the manage_postman_smtp capability delete arbitrary logs via a CSRF attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5341cb5d-d204-49e1-b013-f8959461995f/
CVE ID: CVE-2023-3179 State: PUBLISHED Published: 2023-07-17T13:29:54.425Z Last Updated: 2024-11-07T14:18:23.148Z Vendors: Unknown Products: POST SMTP Mailer Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the manage_postman_smtp capability resend an email to an arbitrary address (for example a password reset email could be resent to an attacker controlled email, and allow them to take over an account). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com
n account). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/542caa40-b199-4397-90bb-4fdb693ebb24
CVE ID: CVE-2023-3180 State: PUBLISHED Published: 2023-08-03T14:31:36.083Z Last Updated: 2024-09-25T19:56:37.371Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H) Vendors: n/a, Red Hat, Fedora Products: qemu, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8 Advanced Virtualization, Red Hat Enterprise Linux 9, Fedora, Extra Packages for Enterprise Linux Problem Types: CWE-122 Description: A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in virtio_crypto_handle_sym_req. There is no check for the value of `src_len` and `dst_len` in virtio_crypto_sym_op_helper,
virtio_crypto_handle_sym_req. There is no check for the value of `src_len` and `dst_len` in virtio_crypto_sym_op_helper, potentially leading to a heap buffer overflow when the two values differ. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-3180 - https://bugzilla.redhat.com/show_bug.cgi?id=2222424 - https://lists.debian.org/debian-lts-announce/2023/10/msg00006.html - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MURWGXDIF2WTDXV36T6HFJDBL632AO7R/ - https://security.netapp.com/advisory/ntap-20230831-0008/
CVE ID: CVE-2023-3181 State: PUBLISHED Published: 2024-01-25T15:22:47.828Z Last Updated: 2025-06-03T18:21:59.225Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Splashtop Products: Splashtop Software Updater Problem Types: CWE-379 Description: The C:\Program Files (x86)\Splashtop\Splashtop Software Updater\uninst.exe process creates a folder at C:\Windows\Temp~nsu.tmp and copies itself to it as Au_.exe. The C:\Windows\Temp~nsu.tmp\Au_.exe file is automatically launched as SYSTEM when the system reboots or when a standard user runs an MSI repair using Splashtop Streamer’s Windows Installer. Since the C:\Windows\Temp~nsu.tmp folder inherits permissions from C:\
air using Splashtop Streamer’s Windows Installer. Since the C:\Windows\Temp~nsu.tmp folder inherits permissions from C:\Windows\Temp and Au_.exe is susceptible to DLL hijacking, standard users can write a malicious DLL to it and elevate their privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0015.md
CVE ID: CVE-2023-3182 State: PUBLISHED Published: 2023-07-17T13:29:56.981Z Last Updated: 2024-10-30T14:08:29.791Z Vendors: Unknown Products: Membership Plugin Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Membership WordPress plugin before 3.2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/655a68ee-9447-41ca-899e-986a419fb7ed
CVE ID: CVE-2023-3183 State: PUBLISHED Published: 2023-06-09T13:00:03.696Z Last Updated: 2024-08-02T06:48:07.552Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Performance Indicator System Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Performance Indicator System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/addproduct.php. The manipulation of the argument prodname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-23
The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231163. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.231163 - https://vuldb.com/?ctiid.231163 - https://github.com/wenwochunfeng/bugReport/blob/main/XSS.md
CVE ID: CVE-2023-3184 State: PUBLISHED Published: 2023-06-09T13:00:04.777Z Last Updated: 2024-08-02T06:48:07.802Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: SourceCodester Products: Sales Tracker Management System Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Sales Tracker Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /classes/Users.php?f=save. The manipulation of the argument firstname/middlename/lastname/username leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this v
attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231164. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.231164 - https://vuldb.com/?ctiid.231164 - http://packetstormsecurity.com/files/172908/Sales-Tracker-Management-System-1.0-HTML-Injection.html - https://github.com/ctflearner/Vulnerability/blob/main/Sales_Tracker_Management_System/stms.md
CVE ID: CVE-2023-3185 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:05:52.254Z Description: No description available.
CVE ID: CVE-2023-3186 State: PUBLISHED Published: 2023-07-17T13:29:50.962Z Last Updated: 2024-10-30T15:04:57.116Z Vendors: Unknown Products: Popup by Supsystic Problem Types: CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') Description: The Popup by Supsystic WordPress plugin before 1.10.19 has a prototype pollution vulnerability that could allow an attacker to inject arbitrary properties into Object.prototype. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/545007fc-3173-47b1-82c4-ed3fd1247b9c
CVE ID: CVE-2023-3187 State: PUBLISHED Published: 2023-06-09T21:00:04.486Z Last Updated: 2024-08-02T06:48:07.599Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: PHPGurukul Products: Teachers Record Management System Problem Types: CWE-434 Description: A vulnerability, which was classified as critical, has been found in PHPGurukul Teachers Record Management System 1.0. Affected by this issue is some unknown functionality of the file /changeimage.php of the component Profile Picture Handler. The manipulation of the argument newpic leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this
he attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231176. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.231176 - https://vuldb.com/?ctiid.231176 - https://github.com/ctflearner/Vulnerability/blob/main/Teacher_Record_Management_System/trms.md
CVE ID: CVE-2023-3188 State: PUBLISHED Published: 2023-06-10T00:00:00 Last Updated: 2025-01-06T17:11:32.042Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: owncast Products: owncast/owncast Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) in GitHub repository owncast/owncast prior to 0.1.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/0d0d526a-1c39-4e6a-b081-d3914468e495 - https://github.com/owncast/owncast/commit/f40135dbf28093864482f9662c23e478ea192b16
CVE ID: CVE-2023-3189 State: PUBLISHED Published: 2023-06-14T05:31:03.452Z Last Updated: 2024-08-02T06:48:07.833Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Online School Fees System Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in SourceCodester Online School Fees System 1.0. This affects an unknown part of the file /paysystem/branch.php of the component POST Parameter Handler. The manipulation of the argument branch leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231501 was assigned to t
tack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231501 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.231501 - https://vuldb.com/?ctiid.231501 - https://github.com/M9KJ-TEAM/CVEReport/blob/main/XSS.md
CVE ID: CVE-2023-3190 State: PUBLISHED Published: 2023-06-10T00:00:00 Last Updated: 2025-01-06T17:11:04.492Z Severity: LOW (CVSS 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: nilsteampassnet Products: nilsteampassnet/teampass Problem Types: CWE-116 Description: Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nilsteampassnet/teampass/commit/241dbd4159a5d63b55af426464d30dbb53925705 - https://huntr.dev/bounties/5562c4c4-0475-448f-a451-7c4666bc7180
CVE ID: CVE-2023-3191 State: PUBLISHED Published: 2023-06-10T00:00:00 Last Updated: 2025-01-06T17:05:33.472Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: nilsteampassnet Products: nilsteampassnet/teampass Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/19fed157-128d-4bfb-a30e-eadf748cbd1a - https://github.com/nilsteampassnet/teampass/commit/241dbd4159a5d63b55af426464d30dbb53925705
CVE ID: CVE-2023-3192 State: PUBLISHED Published: 2023-06-11T00:00:00 Last Updated: 2025-01-06T17:04:25.248Z Severity: MEDIUM (CVSS 4.2 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: froxlor Products: froxlor/froxlor Problem Types: CWE-384 Description: Session Fixation in GitHub repository froxlor/froxlor prior to 2.1.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/f3644772-9c86-4f55-a0fa-aeb11f411551 - https://github.com/froxlor/froxlor/commit/94d9c3eedf31bc8447e3aa349e32880dde02ee52
CVE ID: CVE-2023-3193 State: PUBLISHED Published: 2023-06-15T03:47:57.663Z Last Updated: 2024-10-22T15:42:25.535Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Liferay Products: Portal, DXP Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.73, and Liferay DXP 7.4 update 70 through 73 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/securi
itional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-3193
CVE ID: CVE-2023-3194 State: REJECTED Published: N/A Last Updated: 2025-08-06T22:20:40.872Z Description: No description available.
CVE ID: CVE-2023-3195 State: PUBLISHED Published: 2023-06-16T00:00:00 Last Updated: 2024-12-03T16:24:31.268Z Vendors: n/a Products: ImageMagick Problem Types: CWE-121 Description: A stack-based buffer overflow issue was found in ImageMagick's coders/tiff.c. This flaw allows an attacker to trick the user into opening a specially crafted malicious tiff file, causing an application to crash, resulting in a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2214141 - https://www.openwall.com/lists/oss-security/2023/05/29/1 - https://github.com/ImageMagick/ImageMagick6/commit/85a370c79afeb45a9784
w.openwall.com/lists/oss-security/2023/05/29/1 - https://github.com/ImageMagick/ImageMagick6/commit/85a370c79afeb45a97842b0959366af5236e9023 - https://github.com/ImageMagick/ImageMagick/commit/f620340935777b28fa3f7b0ed7ed6bd86946934c - https://access.redhat.com/security/cve/CVE-2023-3195 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/45DUUXYMAEEAW55GSLAXN25VPKCRAIDA/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4UFQJCYJ23HWHNDOVKBHZQ7HCXXL6MM3/
CVE ID: CVE-2023-3196 State: PUBLISHED Published: 2023-10-03T15:20:05.609Z Last Updated: 2024-10-01T10:43:49.865Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: Capensis Products: Canopsis Problem Types: CWE-79 Description: This vulnerability could allow an attacker to store a malicious JavaScript payload in the login footer and login page description parameters within the administration panel. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-canopsis-capensis - https://git.canopsis.net/canopsis/canopsis-community/-/blob/develop/community/sou
le-vulnerabilities-canopsis-capensis - https://git.canopsis.net/canopsis/canopsis-community/-/blob/develop/community/sources/webcore/src/canopsis-next/src/helpers/html.js?ref_type=heads - https://git.canopsis.net/canopsis/canopsis-community/-/blob/develop/community/sources/webcore/src/canopsis-next/src/config.js?ref_type=heads#L38
CVE ID: CVE-2023-3197 State: PUBLISHED Published: 2023-06-24T02:00:18.262Z Last Updated: 2024-11-27T19:52:09.758Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: inspireui Products: MStore API Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The MStore API plugin for WordPress is vulnerable to Unauthenticated Blind SQL Injection via the 'id' parameter in versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQ
ient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/30aab1af-a78f-4bac-b3c5-30ea854ccef7?source=cve - https://plugins.trac.wordpress.org/changeset/2929891/mstore-api/trunk/controllers/helpers/vendor-wcfm.php
CVE ID: CVE-2023-3198 State: PUBLISHED Published: 2023-06-14T01:47:49.676Z Last Updated: 2024-12-03T16:32:34.921Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: inspireui Products: MStore API Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_status_order_message function. This makes it possible for unauthenticated attackers to update status order message via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Prog
an trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c5f30190-4576-4c2b-b069-72501538733b?source=cve - https://plugins.trac.wordpress.org/browser/mstore-api/trunk/mstore-api.php#L264 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2925048%40mstore-api&new=2925048%40mstore-api&sfp_email=&sfph_mail=
CVE ID: CVE-2023-3199 State: PUBLISHED Published: 2023-07-12T04:38:47.892Z Last Updated: 2024-10-23T14:55:46.450Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: inspireui Products: MStore API Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_status_order_title function. This makes it possible for unauthenticated attackers to update status order title via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program
rick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a604df5d-92b3-4df8-a7ef-00f0ee95cf0f?source=cve - https://plugins.trac.wordpress.org/browser/mstore-api/trunk/mstore-api.php#L256 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2925048%40mstore-api&new=2925048%40mstore-api&sfp_email=&sfph_mail=
CVE ID: CVE-2023-3200 State: PUBLISHED Published: 2023-06-14T01:47:49.257Z Last Updated: 2024-12-03T16:32:54.228Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: inspireui Products: MStore API Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_new_order_message function. This makes it possible for unauthenticated attackers to update new order message via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Co
ck a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/78f3c503-e255-44d2-8432-48dc2c5f553d?source=cve - https://plugins.trac.wordpress.org/browser/mstore-api/trunk/mstore-api.php#L248 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2925048%40mstore-api&new=2925048%40mstore-api&sfp_email=&sfph_mail=
CVE ID: CVE-2023-3201 State: PUBLISHED Published: 2023-06-14T01:47:50.095Z Last Updated: 2024-12-03T16:32:10.041Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: inspireui Products: MStore API Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_new_order_title function. This makes it possible for unauthenticated attackers to update new order title via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Contai
site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cb5cb1a5-30d2-434f-90f9-d37aecfbe158?source=cve - https://plugins.trac.wordpress.org/browser/mstore-api/trunk/mstore-api.php#L240 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2925048%40mstore-api&new=2925048%40mstore-api&sfp_email=&sfph_mail=