Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-5233 State: PUBLISHED Published: 2023-09-28T04:31:35.728Z Last Updated: 2025-02-05T19:17:55.817Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: mcostales84 Products: Font Awesome Integration Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Font Awesome Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fawesome' shortcode in versions up to, and including, 5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permiss
on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a2791f48-895f-4099-87ec-41aaac2494a2?source=cve - https://plugins.trac.wordpress.org/browser/font-awesome-integration/tags/5.0/font-awesome-integration.php#L48
CVE ID: CVE-2023-5234 State: PUBLISHED Published: 2023-11-22T15:33:32.634Z Last Updated: 2024-08-02T07:52:08.431Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: peachpay Products: Related Products for WooCommerce Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Related Products for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'woo-related' shortcode in versions up to, and including, 3.3.15 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-leve
nd output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a98498b8-9397-42e9-9c99-a576975c9ac9?source=cve - https://plugins.trac.wordpress.org/browser/woo-related-products-refresh-on-reload/tags/3.3.15/woo-related-products.php#L303 - https://plugins.trac.wordpress.org/changeset/2988185/woo-related-products-refresh-on-reload
CVE ID: CVE-2023-5235 State: PUBLISHED Published: 2024-01-08T19:00:36.131Z Last Updated: 2025-06-11T17:05:31.530Z Vendors: Unknown Products: Ovic Responsive WPBakery Problem Types: CWE-269 Improper Privilege Management Description: The Ovic Responsive WPBakery WordPress plugin before 1.2.9 does not limit which options can be updated via some of its AJAX actions, which may allow attackers with a subscriber+ account to update blog options, such as 'users_can_register' and 'default_role'. It also unserializes user input in the process, which may lead to Object Injection attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerab
s. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/35c9a954-37fc-4818-a71f-34aaaa0fa3db
CVE ID: CVE-2023-5236 State: PUBLISHED Published: 2023-12-18T13:43:08.445Z Last Updated: 2025-11-21T05:57:06.838Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Data Grid 8.4.4, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4, Red Hat build of Debezium 2, Red Hat build of Debezium 3, Red Hat build of Quarkus, Red Hat Data Grid 8, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat Process Automation 7, Red Hat Single Sign-On 7 Description: A flaw was found
pplication Platform Expansion Pack, Red Hat Process Automation 7, Red Hat Single Sign-On 7 Description: A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and use it to cause out of memory errors and achieve a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2023:5396 - https://access.redhat.com/security/cve/CVE-2023-5236 - https://bugzilla.redhat.com/show_bug.cgi?id=2240999
CVE ID: CVE-2023-5237 State: PUBLISHED Published: 2023-10-31T13:54:44.838Z Last Updated: 2025-04-22T20:02:39.784Z Vendors: Unknown Products: Memberlite Shortcodes Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Memberlite Shortcodes WordPress plugin before 1.3.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a46d686c-6234-4aa8-a656-
CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a46d686c-6234-4aa8-a656-00a65c55d0b0 - https://research.cleantalk.org/cve-2023-5237-memberlite-shortcodes-stored-xss-via-shortcode
CVE ID: CVE-2023-5238 State: PUBLISHED Published: 2023-10-31T13:54:43.838Z Last Updated: 2025-04-22T20:03:05.795Z Vendors: Unknown Products: EventPrime Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to an HTML Injection on the plugin in the search area of the website. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/47a5fbfd-f47c-4356-8567-b29dadb48423
CVE ID: CVE-2023-5239 State: PUBLISHED Published: 2023-11-27T16:22:00.577Z Last Updated: 2024-08-02T07:52:08.529Z Vendors: Unknown Products: Security & Malware scan by CleanTalk Problem Types: CWE-290 Authentication Bypass by Spoofing Description: The Security & Malware scan by CleanTalk WordPress plugin before 2.121 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to bypass bruteforce protection. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/1d748f91-773b-49d6-8f68-a27d397713c3
CVE ID: CVE-2023-5240 State: PUBLISHED Published: 2023-10-13T12:22:23.816Z Last Updated: 2024-09-17T20:28:22.828Z Vendors: Devolutions Products: Server Description: Improper access control in PAM propagation scripts in Devolutions Server 2023.2.8.0 and ealier allows an attack with permission to manage PAM propagation scripts to retrieve passwords stored in it via a GET request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2023-0017
CVE ID: CVE-2023-5241 State: PUBLISHED Published: 2023-10-19T05:34:10.565Z Last Updated: 2025-06-12T15:03:58.487Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H) Vendors: quantumcloud Products: AI ChatBot Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The AI ChatBot for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.8.9 as well as 4.9.2 via the qcld_openai_upload_pagetraining_file function. This allows subscriber-level attackers to append "<?php" to any existing file on the server resulting in potential DoS when appended to critical files such as wp-config.php. Ad
to any existing file on the server resulting in potential DoS when appended to critical files such as wp-config.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/25199281-5286-4d75-8d27-26ce215e0993?source=cve - https://plugins.trac.wordpress.org/browser/chatbot/trunk/includes/openai/qcld-bot-openai.php#L376 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2977505%40chatbot%2Ftrunk&old=2967435%40chatbot%2Ftrunk&sfp_email=&sfph_mail= - http://packetstormsecurity.com/files/175371/WordPress-AI-ChatBot-4.8.9-SQL-Injection-Traversal-File-Deletion.html
CVE ID: CVE-2023-5243 State: PUBLISHED Published: 2023-10-31T13:54:43.491Z Last Updated: 2025-04-23T16:10:27.890Z Vendors: Unknown Products: Login Screen Manager Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Login Screen Manager WordPress plugin through 3.5.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ad895200-a03a-4e92-b256-d6991547d38a
CVE ID: CVE-2023-5244 State: PUBLISHED Published: 2023-09-28T00:00:18.652Z Last Updated: 2024-09-23T19:10:18.839Z Severity: MEDIUM (CVSS 5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: microweber Products: microweber/microweber Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 2.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/a3bd58ba-ca59-4cba-85d1-799f73a76470 - https://github.com/microweber/microweber/commit/1cb846f8f54ff6f5c668f3ae64dd81740a7e8968
CVE ID: CVE-2023-5245 State: PUBLISHED Published: 2023-11-15T12:52:18.656Z Last Updated: 2024-08-02T07:52:08.515Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Problem Types: CWE-22 Description: FileUtil.extract() enumerates all zip file entries and extracts each file without validating whether file paths in the archive are outside the intended directory. When creating an instance of TensorflowModel using the saved_model format and an exported tensorflow model, the apply() function invokes the vulnerable implementation of FileUtil.extract(). Arbitrary file creation can directly lead to code execution Additional Analyst Notes: - CVE Program Container: References: - ht
ry file creation can directly lead to code execution Additional Analyst Notes: - CVE Program Container: References: - https://github.com/combust/mleap/pull/866#issuecomment-1738032225 - https://research.jfrog.com/vulnerabilities/mleap-path-traversal-rce-xray-532656/
CVE ID: CVE-2023-5246 State: PUBLISHED Published: 2023-10-23T12:22:19.895Z Last Updated: 2024-09-11T16:17:17.559Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: SICK AG Products: FX0-GMOD00000, FX0-GMOD00010, FX0-GMOD00030, FX0-GPNT00000, FX0-GPNT00010, FX0-GPNT00030, FX0-GETC00000, FX0-GETC00010, FX3-GEPR00000, FX3-GEPR00010, FX0-GENT00000, FX0-GENT00010, FX0-GENT00030 Problem Types: Authentication Bypass by Capture-replay Description: Authentication Bypass by Capture-replay in SICK Flexi Soft Gateways with Partnumbers 1044073, 1127717, 1130282, 1044074, 1121597, 1099832, 1051432, 1127487, 1069070, 1112296, 1044072, 1121596, 1099830 allows an unauthenticated
0282, 1044074, 1121597, 1099832, 1051432, 1127487, 1069070, 1112296, 1044072, 1121596, 1099830 allows an unauthenticated remote attacker to potentially impact the availability, integrity and confidentiality of the gateways via an authentication bypass by capture-replay. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://sick.com/.well-known/csaf/white/2023/sca-2023-0011.pdf - https://sick.com/.well-known/csaf/white/2023/sca-2023-0011.json
CVE ID: CVE-2023-5247 State: PUBLISHED Published: 2023-11-30T03:57:30.083Z Last Updated: 2024-12-02T19:02:32.708Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Mitsubishi Electric Corporation Products: GX Works3, MELSOFT iQ AppPortal, MELSOFT Navigator, Motion Control Setting Problem Types: CWE-73 Description: Malicious Code Execution Vulnerability due to External Control of File Name or Path in multiple Mitsubishi Electric FA Engineering Software Products allows a malicious attacker to execute a malicious code by having legitimate users open a specially crafted project file, which could result in information disclosure, tampering and deletion, or a denial-o
en a specially crafted project file, which could result in information disclosure, tampering and deletion, or a denial-of-service (DoS) condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-016_en.pdf - https://jvn.jp/vu/JVNVU93383160/
CVE ID: CVE-2023-5249 State: PUBLISHED Published: 2024-02-05T10:01:18.468Z Last Updated: 2024-08-02T07:52:08.432Z Vendors: Arm Ltd Products: Bifrost GPU Kernel Driver, Valhall GPU Kernel Driver Problem Types: CWE-416 Description: Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver allows a local non-privileged user to make improper memory processing operations to exploit a software race condition. If the system’s memory is carefully prepared by the user, then this in turn cause a use-after-free.This issue affects Bifrost GPU Kernel Driver: from r35p0 through r40p0; Valhall GPU Kernel Driver: from r35p0 through r40p0. Additional Analyst Notes:
Kernel Driver: from r35p0 through r40p0; Valhall GPU Kernel Driver: from r35p0 through r40p0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE ID: CVE-2023-5250 State: PUBLISHED Published: 2023-10-30T13:48:59.691Z Last Updated: 2025-02-05T18:55:18.933Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: g5theme Products: Grid Plus – Unlimited grid layout Problem Types: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') Description: The Grid Plus plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.3.2 via a shortcode attribute. This allows subscriber-level, and above, attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be u
include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files with arbitrary content can be uploaded and included. This is limited to .php files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a6407792-2c76-4149-a9f9-d53002135bec?source=cve - https://plugins.trac.wordpress.org/browser/grid-plus/tags/1.3.2/core/grid.plus.base.class.php#L19
CVE ID: CVE-2023-5251 State: PUBLISHED Published: 2023-10-30T13:49:02.343Z Last Updated: 2025-02-05T18:54:39.813Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: g5theme Products: Grid Plus – Unlimited grid layout Problem Types: CWE-862 Missing Authorization Description: The Grid Plus plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'grid_plus_save_layout_callback' and 'grid_plus_delete_callback' functions in versions up to, and including, 1.3.2. This makes it possible for authenticated attackers with subscriber privileges or above, to add, update or delete grid layout. Addition
possible for authenticated attackers with subscriber privileges or above, to add, update or delete grid layout. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d2d34c84-473c-49f8-b55c-c869b5479974?source=cve - https://plugins.trac.wordpress.org/browser/grid-plus/tags/1.3.2/core/ajax_be.php#L10 - https://plugins.trac.wordpress.org/browser/grid-plus/tags/1.3.2/core/ajax_be.php#L69
CVE ID: CVE-2023-5252 State: PUBLISHED Published: 2023-10-30T13:48:56.654Z Last Updated: 2025-02-05T18:56:08.696Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: fareharbor Products: FareHarbor for WordPress Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The FareHarbor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.6.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrar
utes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/42ad6fef-4280-45db-a3e2-6d7522751fa7?source=cve - https://plugins.trac.wordpress.org/browser/fareharbor/tags/3.6.7/fareharbor.php#L287
CVE ID: CVE-2023-5253 State: PUBLISHED Published: 2024-01-15T10:53:56.305Z Last Updated: 2025-06-17T21:09:23.231Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Nozomi Networks Products: Guardian, CMC Problem Types: CWE-306 Description: A missing authentication check in the WebSocket channel used for the Check Point IoT integration in Nozomi Networks Guardian and CMC, may allow an unauthenticated attacker to obtain assets data without authentication. Malicious unauthenticated users with knowledge on the underlying system may be able to extract limited asset information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
ract limited asset information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.nozominetworks.com/NN-2023:12-01
CVE ID: CVE-2023-5254 State: PUBLISHED Published: 2023-10-19T05:34:12.026Z Last Updated: 2025-02-05T19:12:23.191Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: quantumcloud Products: AI ChatBot Problem Types: CWE-200 Information Exposure Description: The ChatBot plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.8.9 via the qcld_wb_chatbot_check_user function. This can allow unauthenticated attackers to extract sensitive data including confirmation as to whether a user name exists on the site as well as order information for existing users. Additional Analyst Notes: - CVE Program Container: - CISA ADP V
he site as well as order information for existing users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d897daf8-5320-4546-9a63-1d34a15b2a58?source=cve - https://plugins.trac.wordpress.org/browser/chatbot/trunk/functions.php#L1224 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2977505%40chatbot%2Ftrunk&old=2967435%40chatbot%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-5255 State: PUBLISHED Published: 2023-10-03T17:54:55.177Z Last Updated: 2024-09-19T19:29:30.230Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Puppet Products: Puppet Enterprise Problem Types: CWE-404 Description: For certificates that utilize the auto-renew feature in Puppet Server, a flaw exists which prevents the certificates from being revoked. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.puppet.com/security/cve/cve-2023-5255-denial-service-revocation-auto-renewed-certificates
CVE ID: CVE-2023-5256 State: PUBLISHED Published: 2023-09-28T18:17:43.128Z Last Updated: 2024-09-23T18:25:29.327Z Vendors: Drupal Products: Core Problem Types: CWE-200 Description: In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation. This vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API. The core REST and contributed GraphQL modules are not affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.drupal.or
ffected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-core-2023-006
CVE ID: CVE-2023-5257 State: PUBLISHED Published: 2023-09-29T10:31:04.965Z Last Updated: 2024-08-02T07:52:08.570Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: WhiteHSBG Products: JNDIExploit Problem Types: CWE-22 Description: A vulnerability was found in WhiteHSBG JNDIExploit 1.4 on Windows. It has been rated as problematic. Affected by this issue is the function handleFileRequest of the file src/main/java/com/feihong/ldap/HTTPServer.java. The manipulation leads to path traversal. The exploit has been disclosed to the public and may be used. VDB-240866 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE
. VDB-240866 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.240866 - https://vuldb.com/?ctiid.240866 - https://github.com/WhiteHSBG/JNDIExploit/issues/10
CVE ID: CVE-2023-5258 State: PUBLISHED Published: 2023-09-29T11:31:04.769Z Last Updated: 2024-08-02T07:52:08.536Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: OpenRapid Products: RapidCMS Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in OpenRapid RapidCMS 1.3.1. This affects an unknown part of the file /resource/addgood.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240867. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Refer
r of this vulnerability is VDB-240867. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.240867 - https://vuldb.com/?ctiid.240867 - https://github.com/OpenRapid/rapidcms/issues/9 - https://github.com/yhy217/rapidcms-vul/issues/4
CVE ID: CVE-2023-5259 State: PUBLISHED Published: 2023-09-29T11:31:05.823Z Last Updated: 2024-09-23T17:22:57.651Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:N/A:P) Vendors: ForU Products: CMS Problem Types: CWE-404 Description: A vulnerability classified as problematic was found in ForU CMS. This vulnerability affects unknown code of the file /admin/cms_admin.php. The manipulation of the argument del leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The identifier