Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2016-15022 State: PUBLISHED Published: 2023-01-29T18:58:03.644Z Last Updated: 2025-03-27T19:30:48.838Z Severity: LOW (CVSS 2 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N) Vendors: mosbth Products: cimage Problem Types: CWE-79 Description: A vulnerability was found in mosbth cimage up to 0.7.18. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file check_system.php. The manipulation of the argument $_SERVER['SERVER_SOFTWARE'] leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 0.7.19 is able to address this
an attack is rather high. The exploitation appears to be difficult. Upgrading to version 0.7.19 is able to address this issue. The patch is named 401478c8393989836beeddfeac5ce44570af162b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-219715. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.219715 - https://vuldb.com/?ctiid.219715 - https://github.com/mosbth/cimage/commit/401478c8393989836beeddfeac5ce44570af162b - https://github.com/mosbth/cimage/releases/tag/v0.7.19
CVE ID: CVE-2016-15023 State: PUBLISHED Published: 2023-01-31T19:58:03.084Z Last Updated: 2024-08-06T03:47:34.734Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SiteFusion Products: Application Server Problem Types: CWE-22 Description: A vulnerability, which was classified as problematic, was found in SiteFusion Application Server up to 6.6.6. This affects an unknown part of the file getextension.php of the component Extension Handler. The manipulation leads to path traversal. Upgrading to version 6.6.7 is able to address this issue. The identifier of the patch is 49fff155c303d6cd06ce8f97bba56c9084bf08ac. It is recommended to upgrade the affected component. T
ntifier of the patch is 49fff155c303d6cd06ce8f97bba56c9084bf08ac. It is recommended to upgrade the affected component. The identifier VDB-219765 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.219765 - https://vuldb.com/?ctiid.219765 - https://github.com/sitefusion/server/pull/67 - https://github.com/sitefusion/server/commit/49fff155c303d6cd06ce8f97bba56c9084bf08ac - https://github.com/sitefusion/server/releases/tag/v6.6.7
CVE ID: CVE-2016-15024 State: PUBLISHED Published: 2023-02-19T18:00:05.404Z Last Updated: 2024-08-06T03:47:35.041Z Severity: LOW (CVSS 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: doomsider Products: shadow Problem Types: CWE-404 Description: A vulnerability was found in doomsider shadow. It has been classified as problematic. Affected is an unknown function. The manipulation leads to denial of service. Attacking locally is a requirement. The complexity of an attack is rather high. The exploitability is told to be difficult. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch
leases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as 3332c5ba9ec3014ddc74e2147190a050eee97bc0. It is recommended to apply a patch to fix this issue. VDB-221478 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.221478 - https://vuldb.com/?ctiid.221478 - https://github.com/doomsider/shadow/commit/3332c5ba9ec3014ddc74e2147190a050eee97bc0
CVE ID: CVE-2016-15025 State: PUBLISHED Published: 2023-02-20T09:31:04.566Z Last Updated: 2024-08-06T03:47:34.757Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: n/a Products: generator-hottowel Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in generator-hottowel 0.0.11. Affected is an unknown function of the file app/templates/src/server/_app.js of the component 404 Error Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is c17092fd4103143a9ddab93c8983ace8bf174396. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability
143a9ddab93c8983ace8bf174396. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-221484. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.221484 - https://vuldb.com/?ctiid.221484 - https://github.com/johnpapa/generator-hottowel/pull/174 - https://github.com/johnpapa/generator-hottowel/commit/c17092fd4103143a9ddab93c8983ace8bf174396
CVE ID: CVE-2016-15026 State: PUBLISHED Published: 2023-02-20T11:00:05.072Z Last Updated: 2024-08-06T03:47:34.744Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: 3breadt Products: dd-plist Problem Types: CWE-611 Description: A vulnerability was found in 3breadt dd-plist 1.17 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. An attack has to be approached locally. Upgrading to version 1.18 is able to address this issue. The patch is identified as 8c954e8d9f6f6863729e50105a8abf3f87fff74c. It is recommended to upgrade the affected component. VDB-221486 is the identifier
54e8d9f6f6863729e50105a8abf3f87fff74c. It is recommended to upgrade the affected component. VDB-221486 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.221486 - https://vuldb.com/?ctiid.221486 - https://github.com/3breadt/dd-plist/pull/26 - https://github.com/3breadt/dd-plist/commit/8c954e8d9f6f6863729e50105a8abf3f87fff74c - https://github.com/3breadt/dd-plist/releases/tag/dd-plist-1.18
CVE ID: CVE-2016-15027 State: PUBLISHED Published: 2023-02-20T17:00:05.423Z Last Updated: 2024-08-06T03:47:34.980Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: meta4creations Products: Post Duplicator Plugin Problem Types: CWE-79 Description: A vulnerability was found in meta4creations Post Duplicator Plugin 2.18 on WordPress. It has been classified as problematic. Affected is the function mtphr_post_duplicator_notice of the file includes/notices.php. The manipulation of the argument post-duplicated leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 2.19 is able to address this issue. The name of the patch is ca67c05e490c0cf93a1e9b
ttack remotely. Upgrading to version 2.19 is able to address this issue. The name of the patch is ca67c05e490c0cf93a1e9b2d93bfeff3dd96f594. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-221496. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.221496 - https://vuldb.com/?ctiid.221496 - https://github.com/meta4creations/post-duplicator/commit/ca67c05e490c0cf93a1e9b2d93bfeff3dd96f594 - https://github.com/meta4creations/post-duplicator/releases/tag/2.19
CVE ID: CVE-2016-15028 State: PUBLISHED Published: 2023-03-12T14:31:03.247Z Last Updated: 2024-08-06T03:47:34.929Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: ICEPAY Products: REST-API-NET Problem Types: CWE-354 Description: A vulnerability was found in ICEPAY REST-API-NET 0.9. It has been declared as problematic. Affected by this vulnerability is the function RestClient of the file Classes/RestClient.cs of the component Checksum Validation. The manipulation leads to improper validation of integrity check value. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version
ed remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 1.0 is able to address this issue. The patch is named 61f6b8758e5c971abff5f901cfa9f231052b775f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-222847. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.222847 - https://vuldb.com/?ctiid.222847 - https://github.com/ICEPAY/REST-API-NET/commit/61f6b8758e5c971abff5f901cfa9f231052b775f - https://github.com/ICEPAY/REST-API-NET/releases/tag/1.0
CVE ID: CVE-2016-15029 State: PUBLISHED Published: 2023-03-21T11:00:05.356Z Last Updated: 2024-08-06T03:47:34.725Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Ydalb Products: mapicoin Problem Types: CWE-79 Description: A vulnerability has been found in Ydalb mapicoin up to 1.9.0 and classified as problematic. This vulnerability affects unknown code of the file webroot/stats.php. The manipulation of the argument link/search leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.10.0 is able to address this issue. The patch is identified as 67e87f0f0c1ac238fcd050f4c3db298229bc9679. It is recommended to upgrade the affected component. VDB-2234
is identified as 67e87f0f0c1ac238fcd050f4c3db298229bc9679. It is recommended to upgrade the affected component. VDB-223402 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.223402 - https://vuldb.com/?ctiid.223402 - https://github.com/Ydalb/mapicoin/commit/67e87f0f0c1ac238fcd050f4c3db298229bc9679
CVE ID: CVE-2016-15030 State: PUBLISHED Published: 2023-03-25T17:31:04.124Z Last Updated: 2024-08-06T03:47:34.840Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Arno0x Products: TwoFactorAuth Problem Types: CWE-601 Description: A vulnerability classified as problematic has been found in Arno0x TwoFactorAuth. This affects an unknown part of the file login/login.php. The manipulation of the argument from leads to open redirect. It is possible to initiate the attack remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named 8549ad3cf197095f783643e41333586d6a4d0e54. It is recommended to apply a p
ed releases are unavailable. The patch is named 8549ad3cf197095f783643e41333586d6a4d0e54. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-223803. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.223803 - https://vuldb.com/?ctiid.223803 - https://github.com/Arno0x/TwoFactorAuth/pull/3 - https://github.com/Arno0x/TwoFactorAuth/commit/8549ad3cf197095f783643e41333586d6a4d0e54
CVE ID: CVE-2016-15031 State: PUBLISHED Published: 2023-05-06T00:31:03.699Z Last Updated: 2024-08-06T03:47:35.031Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: n/a Products: PHP-Login Problem Types: CWE-89 Description: A vulnerability was found in PHP-Login 1.0. It has been declared as critical. This vulnerability affects the function checkLogin of the file login/scripts/class.loginscript.php of the component POST Parameter Handler. The manipulation of the argument myusername leads to sql injection. The attack can be initiated remotely. Upgrading to version 2.0 is able to address this issue. The patch is identified as 0083ec652786ddbb81335ea20da590df40035679. It is recommende
2.0 is able to address this issue. The patch is identified as 0083ec652786ddbb81335ea20da590df40035679. It is recommended to upgrade the affected component. VDB-228022 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.228022 - https://vuldb.com/?ctiid.228022 - https://github.com/ipoelnet/php-login/commit/0083ec652786ddbb81335ea20da590df40035679 - https://github.com/ipoelnet/php-login/releases/tag/v2.0
CVE ID: CVE-2016-15032 State: PUBLISHED Published: 2023-06-01T22:31:04.601Z Last Updated: 2024-08-06T03:47:34.816Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: mback2k Products: mh_httpbl Extension Problem Types: CWE-79 Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic has been found in mback2k mh_httpbl Extension up to 1.1.7 on TYPO3. This affects the function stopOutput of the file class.tx_mhhttpbl.php. The manipulation of the argument $_SERVER['REMOTE_ADDR'] leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.1.8 is able to address this issue. The patch is named a754bf306a433a8c18b55e2559
attack remotely. Upgrading to version 1.1.8 is able to address this issue. The patch is named a754bf306a433a8c18b55e25595593e8f19b9463. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230391. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.230391 - https://vuldb.com/?ctiid.230391 - https://github.com/mback2k/mh_httpbl/commit/a754bf306a433a8c18b55e25595593e8f19b9463 - https://github.com/mback2k/mh_httpbl/releases/tag/mh_httpbl_1.1.8_security
CVE ID: CVE-2016-15033 State: PUBLISHED Published: 2023-06-07T01:51:39.299Z Last Updated: 2024-12-28T00:54:02.511Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Ganesh Chandra Products: Delete All Comments Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The Delete All Comments plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the via the delete-all-comments.php file in versions up to, and including, 2.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible. Additional An
kers to upload arbitrary files on the affected sites server which may make remote code execution possible. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b1e98d2d-20b1-4fff-96d4-0fb8e0d2615a?source=cve - http://blog.nintechnet.com/arbitrary-file-upload-vulnerability-in-wordpress-delete-all-comments-plugin/ - https://wordpress.org/plugins/delete-all-comments/#developers
CVE ID: CVE-2016-15034 State: PUBLISHED Published: 2023-07-10T17:11:17.619Z Last Updated: 2024-08-06T03:47:34.820Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Dynacase Products: Webdesk Problem Types: CWE-89 Description: A vulnerability was found in Dynacase Webdesk and classified as critical. Affected by this issue is the function freedomrss_search of the file freedomrss_search.php. The manipulation leads to sql injection. Upgrading to version 3.2-20180305 is able to address this issue. The patch is identified as 750a9b35af182950c952faf6ddfdcc50a2b25f8b. It is recommended to upgrade the affected component. VDB-233366 is the identifier assigned to this v
f6ddfdcc50a2b25f8b. It is recommended to upgrade the affected component. VDB-233366 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.233366 - https://vuldb.com/?ctiid.233366 - https://github.com/dynacase-labs/dynacase-webdesk/commit/750a9b35af182950c952faf6ddfdcc50a2b25f8b - https://github.com/dynacase-labs/dynacase-webdesk/releases/tag/3.2-20180305
CVE ID: CVE-2016-15035 State: PUBLISHED Published: 2023-08-28T03:31:03.063Z Last Updated: 2024-08-06T03:47:34.839Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Doc2k Products: RE-Chat Problem Types: CWE-79 Description: A vulnerability was found in Doc2k RE-Chat 1.0. It has been classified as problematic. This affects an unknown part of the file js_on_radio-emergency.de_/re_chat.js. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The patch is named bd17d497ddd3bab4ef9c6831c747c37cc016c570. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-238155. Additional Analyst Notes: -
ly a patch to fix this issue. The associated identifier of this vulnerability is VDB-238155. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.238155 - https://vuldb.com/?ctiid.238155 - https://github.com/Doc2k/re-chat/commit/bd17d497ddd3bab4ef9c6831c747c37cc016c570
CVE ID: CVE-2016-15036 State: PUBLISHED Published: 2023-12-23T20:00:05.040Z Last Updated: 2024-08-06T03:47:34.872Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Deis Products: Workflow Manager Problem Types: CWE-362 Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Deis Workflow Manager up to 2.3.2. It has been classified as problematic. This affects an unknown part. The manipulation leads to race condition. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 2.3.3 is able to address this issue. The patch is named 31fe3bccbdde134a185752e53380330d16053f7f. It is recommended to
2.3.3 is able to address this issue. The patch is named 31fe3bccbdde134a185752e53380330d16053f7f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-248847. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.248847 - https://vuldb.com/?ctiid.248847 - https://github.com/deis/workflow-manager/pull/94 - https://github.com/deis/workflow-manager/commit/31fe3bccbdde134a185752e53380330d16053f7f - https://github.com/deis/workflow-manager/releases/tag/v2.3.3
CVE ID: CVE-2016-15037 State: PUBLISHED Published: 2024-01-21T05:00:04.936Z Last Updated: 2024-09-12T18:33:12.123Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: go4rayyan Products: Scumblr Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in go4rayyan Scumblr up to 2.0.1a. Affected by this issue is some unknown functionality of the component Task Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 2.0.2 is able to address this issue. The patch is identified as 5c9120f2362ddb7cbe48f2c4620715adddc4ee35. It is recommended to upgrade the affected component. VDB-2515
is identified as 5c9120f2362ddb7cbe48f2c4620715adddc4ee35. It is recommended to upgrade the affected component. VDB-251570 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.251570 - https://vuldb.com/?ctiid.251570 - https://github.com/go4rayyan/CG1/commit/5c9120f2362ddb7cbe48f2c4620715adddc4ee35 - https://github.com/go4rayyan/CG1/releases/tag/v2.0.2
CVE ID: CVE-2016-15038 State: PUBLISHED Published: 2024-04-01T05:31:03.915Z Last Updated: 2024-08-27T16:08:26.472Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: NUUO Products: NVRmini 2 Problem Types: CWE-22 Description: A vulnerability, which was classified as critical, was found in NUUO NVRmini 2 up to 3.0.8. Affected is an unknown function of the file /deletefile.php. The manipulation of the argument filename leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258780. Additional Analyst Notes: - CVE Program Container: - CISA ADP V
sed. The identifier of this vulnerability is VDB-258780. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.258780 - https://vuldb.com/?ctiid.258780 - https://www.exploit-db.com/exploits/40214
CVE ID: CVE-2016-15039 State: PUBLISHED Published: 2024-07-11T02:31:03.565Z Last Updated: 2024-08-06T03:47:34.923Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: mhuertos Products: phpLDAPadmin Problem Types: CWE-444 Description: A vulnerability classified as critical was found in mhuertos phpLDAPadmin up to 665dbc2690ebeb5392d38f1fece0a654225a0b38. Affected by this vulnerability is the function makeHttpRequest of the file htdocs/js/ajax_functions.js. The manipulation leads to http request smuggling. The attack can be launched remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named dd6e95
se versioning. This is why information about affected and unaffected releases are unavailable. The patch is named dd6e9583a2eb2ca085583765e8a63df5904cb036. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-270523. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.270523 - https://vuldb.com/?ctiid.270523 - https://github.com/mhuertos/phpLDAPadmin/commit/dd6e9583a2eb2ca085583765e8a63df5904cb036
CVE ID: CVE-2016-15040 State: PUBLISHED Published: 2024-10-16T06:43:31.617Z Last Updated: 2024-10-16T18:05:57.206Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: Kento Post View Counter Problem Types: CWE-89 Description: The Kento Post View Counter plugin for WordPress is vulnerable to SQL Injection via the 'kento_pvc_geo' parameter in versions up to, and including, 2.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive
nticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/525b466d-137a-467b-8b49-e51393a73866?source=cve - https://plugins.trac.wordpress.org/browser/kento-post-view-counter/trunk/index.php#L216
CVE ID: CVE-2016-15041 State: PUBLISHED Published: 2024-10-16T06:43:40.321Z Last Updated: 2024-10-16T13:00:56.836Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: mainwp Products: MainWP Dashboard: WordPress Management without the SaaS Problem Types: CWE-79 Description: The MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mwp_setup_purchase_username’ parameter in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages tha
n and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a9b1445f-3b6b-40fa-9a12-f55d63668dda?source=cve - https://klikki.fi/adv/mainwp.html - https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-mainwp-dashboard-cross-site-scripting-3-1-2/ - https://web.archive.org/web/20191101060009/https%3A//klikki.fi/adv/mainwp.html
CVE ID: CVE-2016-15042 State: PUBLISHED Published: 2024-10-16T07:31:49.718Z Last Updated: 2024-10-16T17:26:26.917Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: nmedia Products: N-Media Post Front-end Form, Frontend File Manager Plugin Problem Types: CWE-434 Description: The Frontend File Manager (versions < 4.0), N-Media Post Front-end Form (versions < 1.1) plugins for WordPress are vulnerable to arbitrary file uploads due to missing file type validation via the `nm_filemanager_upload_file` and `nm_postfront_upload_file` AJAX actions. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may ma