Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-1530 State: PUBLISHED Published: 2022-04-29T08:50:10 Last Updated: 2024-08-03T00:10:02.958Z Severity: LOW (CVSS 3.8 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L) Vendors: livehelperchat Products: livehelperchat/livehelperchat Problem Types: CWE-79 Description: Cross-site Scripting (XSS) in GitHub repository livehelperchat/livehelperchat prior to 3.99v. The attacker can execute malicious JavaScript on the application. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/8fd8de01-7e83-4324-9cc8-a97acb9b70d6 - https://github.com/livehelperchat/livehelperchat/commit/edef7a8387be718d0de2dfd1e722789afb0461bc
CVE ID: CVE-2022-1531 State: PUBLISHED Published: 2022-04-29T09:10:10 Last Updated: 2024-08-03T00:10:03.429Z Severity: CRITICAL (CVSS 10 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: rtxteam Products: rtxteam/rtx Problem Types: CWE-89 Description: SQL injection vulnerability in ARAX-UI Synonym Lookup functionality in GitHub repository rtxteam/rtx prior to checkpoint_2022-04-20 . This vulnerability is critical as it can lead to remote code execution and thus complete server takeover. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/fc4eb544-ef1e-412d-9fdb-0ceb04e038fe - https://github.com/rtxteam/rtx/commit/fa2797e656e3dba18f990a2db1f0f029d4
bounties/fc4eb544-ef1e-412d-9fdb-0ceb04e038fe - https://github.com/rtxteam/rtx/commit/fa2797e656e3dba18f990a2db1f0f029d41f1921
CVE ID: CVE-2022-1532 State: PUBLISHED Published: 2022-06-13T12:41:54 Last Updated: 2024-08-03T00:10:02.923Z Vendors: Unknown Products: Themify – WooCommerce Product Filter Problem Types: CWE-79 Description: Themify WordPress plugin before 1.3.8 does not sanitise and escape the page parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d106cd93-cb9b-4558-9a29-0d556fd7c9e1
CVE ID: CVE-2022-1533 State: PUBLISHED Published: 2022-04-29T10:15:20 Last Updated: 2024-08-03T00:10:03.020Z Severity: MEDIUM (CVSS 6.6 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: bfabiszewski Products: bfabiszewski/libmobi Problem Types: CWE-126 Description: Buffer Over-read in GitHub repository bfabiszewski/libmobi prior to 0.11. This vulnerability is capable of arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/cb574ce1-fbf7-42ea-9e6a-91e17adecdc3 - https://github.com/bfabiszewski/libmobi/commit/eafc415bc6067e72577f70d6dd5acbf057ce6e6f
CVE ID: CVE-2022-1534 State: PUBLISHED Published: 2022-04-29T10:15:14 Last Updated: 2024-08-03T00:10:02.994Z Severity: MEDIUM (CVSS 6.6 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: bfabiszewski Products: bfabiszewski/libmobi Problem Types: CWE-126 Description: Buffer Over-read at parse_rawml.c:1416 in GitHub repository bfabiszewski/libmobi prior to 0.11. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/9a90ffa1-38f5-4685-9c00-68ba9068ce3d - https://github.
- CVE Program Container: References: - https://huntr.dev/bounties/9a90ffa1-38f5-4685-9c00-68ba9068ce3d - https://github.com/bfabiszewski/libmobi/commit/fb1ab50e448ddbed746fd27ae07469bc506d838b
CVE ID: CVE-2022-1536 State: PUBLISHED Published: 2022-04-29T13:10:12.000Z Last Updated: 2025-04-15T14:40:54.853Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: unspecified Products: automad Problem Types: CWE-79 Description: A vulnerability has been found in automad up to 1.10.9 and classified as problematic. This vulnerability affects the Dashboard. The manipulation of the argument title with the input Home</title><script>alert("home")</script><title> leads to a cross site scripting. The attack can be initiated remotely but requires an authentication. The exploit details have disclosed to the public and may be used. Additional Analyst Notes: - CVE Program Co
entication. The exploit details have disclosed to the public and may be used. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/automad%3C%3D1.10.9%20Stored%20Cross-Site%20Scripting%28XSS%29.md - https://vuldb.com/?id.198706
CVE ID: CVE-2022-1537 State: PUBLISHED Published: 2022-05-10T00:00:00 Last Updated: 2024-08-03T00:10:03.294Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: gruntjs Products: gruntjs/grunt Problem Types: CWE-367 Description: file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc
both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/0179c3e5-bc02-4fc9-8491-a1a319b51b4d - https://github.com/gruntjs/grunt/commit/58016ffac5ed9338b63ecc2a63710f5027362bae - https://lists.debian.org/debian-lts-announce/2023/04/msg00006.html
CVE ID: CVE-2022-1538 State: PUBLISHED Published: 2024-01-16T15:50:34.551Z Last Updated: 2025-06-20T16:56:12.222Z Vendors: Unknown Products: Theme Demo Import Problem Types: CWE-94 Improper Control of Generation of Code ('Code Injection') Description: Theme Demo Import WordPress plugin before 1.1.1 does not validate the imported file, allowing high-privilege users such as admin to upload arbitrary files (such as PHP) even when FILE_MODS and FILE_EDIT are disallowed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b19adf7c-3983-487b-9b46-0f2922b08c1c/
CVE ID: CVE-2022-1539 State: PUBLISHED Published: 2022-07-25T12:46:03 Last Updated: 2024-08-03T00:10:03.492Z Vendors: Unknown Products: Exports and Reports Problem Types: CWE-1236 Description: The Exports and Reports WordPress plugin before 0.9.2 does not sanitize and validate data when generating the CSV to export, which could lead to a CSV injection, by the use of Microsoft Excel DDE function, or to leak data via maliciously injected hyperlinks. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/50f70927-9677-4ba4-a388-0a41ed356523
CVE ID: CVE-2022-1540 State: PUBLISHED Published: 2022-12-05T16:50:37.267Z Last Updated: 2025-04-23T15:05:12.055Z Vendors: Unknown Products: PostmagThemes Demo Import Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The PostmagThemes Demo Import WordPress plugin through 1.0.7 does not validate the imported file, allowing high-privilege users such as admin to upload arbitrary files (such as PHP) leading to RCE. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/77a524d8-0b1a-407a-98d2-d8d0ed78fa0f
CVE ID: CVE-2022-1541 State: PUBLISHED Published: 2022-06-06T08:51:05 Last Updated: 2024-08-03T00:10:02.951Z Vendors: Unknown Products: Video Slider – Slider Carousel Problem Types: CWE-79 Description: The Video Slider WordPress plugin before 1.4.8 does not sanitize or escape some of its video settings, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/053a9815-cf0a-472e-844a-3dea407ce022
CVE ID: CVE-2022-1542 State: PUBLISHED Published: 2022-05-30T08:35:51 Last Updated: 2024-08-03T00:10:02.947Z Vendors: Unknown Products: hpb Dashboard Problem Types: CWE-79 Description: The HPB Dashboard WordPress plugin through 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/40916242-df03-49a1-9a6a-9af33907e359
CVE ID: CVE-2022-1543 State: PUBLISHED Published: 2022-04-29T18:10:09 Last Updated: 2024-08-03T00:10:03.981Z Severity: CRITICAL (CVSS 9.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H) Vendors: erudika Products: erudika/scoold Problem Types: CWE-130 Description: Improper handling of Length parameter in GitHub repository erudika/scoold prior to 1.49.4. When the text size is large enough the service results in a momentary outage in a production environment. That can lead to memory corruption on the server. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/9889d435-3b9c-4e9d-93bc-5272e0723f9f - https://github.com/erudika/scoold/commit/62a0e92e1486ddc1767
//huntr.dev/bounties/9889d435-3b9c-4e9d-93bc-5272e0723f9f - https://github.com/erudika/scoold/commit/62a0e92e1486ddc17676a7ead2c07ff653d167ce
CVE ID: CVE-2022-1544 State: PUBLISHED Published: 2022-05-01T11:45:12 Last Updated: 2024-08-03T00:10:02.924Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: luyadev Products: luyadev/yii-helpers Problem Types: CWE-1236 Description: Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File in GitHub repository luyadev/yii-helpers prior to 1.2.1. Successful exploitation can lead to impacts such as client-sided command injection, code execution, or remote ex-filtration of contained confidential data. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/fa6d6e75-bc7a-40f6-9bdd-2541318912d4 -
Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/fa6d6e75-bc7a-40f6-9bdd-2541318912d4 - https://github.com/luyadev/yii-helpers/commit/9956ed63f516110c2b588471507b870e748c4cfb
CVE ID: CVE-2022-1545 State: PUBLISHED Published: 2022-05-11T14:25:17 Last Updated: 2024-08-03T00:10:02.897Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper authorization in GitLab Description: It was possible to disclose details of confidential notes created via the API in Gitlab CE/EE affecting all versions from 13.2 prior to 14.8.6, 14.9 prior to 14.9.4, and 14.10 prior to 14.10.1 if an unauthorised project member was tagged in the note. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/351030 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022
ferences: - https://gitlab.com/gitlab-org/gitlab/-/issues/351030 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1545.json
CVE ID: CVE-2022-1546 State: PUBLISHED Published: 2022-07-11T12:55:51 Last Updated: 2024-08-03T00:10:02.946Z Vendors: Unknown Products: WooCommerce – Product Importer Problem Types: CWE-79 Description: The WooCommerce - Product Importer WordPress plugin through 1.5.2 does not sanitise and escape the imported data before outputting it back in the page, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/5ec6182c-6917-4c48-90ce-e0ebe38e7595
CVE ID: CVE-2022-1547 State: PUBLISHED Published: 2022-05-23T07:15:35 Last Updated: 2024-08-03T00:10:03.549Z Vendors: Unknown Products: Check & Log Email Problem Types: CWE-79 Description: The Check & Log Email WordPress plugin before 1.0.6 does not sanitise and escape a parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/83eca346-7045-414e-81fc-e0d9b735f0bd
CVE ID: CVE-2022-1548 State: PUBLISHED Published: 2022-05-03T20:11:21 Last Updated: 2024-12-06T23:09:11.321Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Mattermost Products: Mattermost Playbooks Problem Types: CWE-264 Description: Mattermost Playbooks plugin 1.25 and earlier fails to properly restrict user-level permissions, which allows playbook members to escalate their membership privileges and perform actions restricted to playbook admins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates/
CVE ID: CVE-2022-1549 State: PUBLISHED Published: 2022-06-13T12:41:56 Last Updated: 2024-08-03T00:10:03.671Z Vendors: Unknown Products: WP Athletics Problem Types: CWE-79 Description: The WP Athletics WordPress plugin through 1.1.7 does not sanitize parameters before storing them in the database, nor does it escape the values when outputting them back in the admin dashboard, leading to a Stored Cross-Site Scripting vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/afef06f5-71a6-4372-9648-0db59f9b254f
CVE ID: CVE-2022-1550 State: REJECTED Published: 2022-06-06T18:20:13 Last Updated: 2022-06-06T18:20:13 Description: No description available.
CVE ID: CVE-2022-1551 State: PUBLISHED Published: 2022-07-25T12:46:15 Last Updated: 2024-08-03T00:10:03.030Z Vendors: Unknown Products: SP Project & Document Manager Problem Types: CWE-425 Direct Request ('Forced Browsing') Description: The SP Project & Document Manager WordPress plugin before 4.58 uses an easily guessable path to store user files, bad actors could use that to access other users' sensitive files. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/51b4752a-7922-444d-a022-f1c7159b5d84
CVE ID: CVE-2022-1552 State: PUBLISHED Published: 2022-08-31T00:00:00 Last Updated: 2024-08-03T00:10:03.498Z Vendors: n/a Products: postgresql Problem Types: CWE-459 Description: A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pg_amcheck commands activated relevant protections too late or not at all during the process. This flaw allows an attacker with permission to create non-temporary objects in at least one schema to execute arbitrary SQL functions under a superuser identity. Additional Analyst Notes: - CVE
ts in at least one schema to execute arbitrary SQL functions under a superuser identity. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2081126 - https://www.postgresql.org/about/news/postgresql-143-137-1211-1116-and-1021-released-2449/ - https://www.postgresql.org/support/security/CVE-2022-1552/ - https://access.redhat.com/security/cve/CVE-2022-1552 - https://security.netapp.com/advisory/ntap-20221104-0005/ - https://security.gentoo.org/glsa/202211-04
CVE ID: CVE-2022-1553 State: PUBLISHED Published: 2022-05-16T14:31:58 Last Updated: 2024-08-03T00:10:03.456Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: publify Products: publify/publify Problem Types: CWE-284 Description: Leaking password protected articles content due to improper access control in GitHub repository publify/publify prior to 9.2.8. Attackers can leverage this vulnerability to view the contents of any password-protected article present on the publify website, compromising confidentiality and integrity of users. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/b398e4c9-6cdf-4973-ad86-da796cde221f -
Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/b398e4c9-6cdf-4973-ad86-da796cde221f - https://github.com/publify/publify/commit/1a78f16f460847274265a12a9555b3524892d7db
CVE ID: CVE-2022-1554 State: PUBLISHED Published: 2022-05-03T08:20:09 Last Updated: 2024-08-03T00:10:02.933Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L) Vendors: clinical-genomics Products: clinical-genomics/scout Problem Types: CWE-36 Description: Path Traversal due to `send_file` call in GitHub repository clinical-genomics/scout prior to 4.52. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/7acac778-5ba4-4f02-99e2-e4e17a81e600 - https://github.com/clinical-genomics/scout/commit/952a2e2319af2d95d22b017a561730feac086ff1
CVE ID: CVE-2022-1555 State: PUBLISHED Published: 2022-05-04T08:30:12 Last Updated: 2024-08-03T00:10:03.519Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: microweber Products: microweber/microweber Problem Types: CWE-79 Description: DOM XSS in microweber ver 1.2.15 in GitHub repository microweber/microweber prior to 1.2.16. inject arbitrary js code, deface website, steal cookie... Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/d9f9b5bd-16f3-4eaa-9e36-d4958b557687 - https://github.com/microweber/microweber/commit/724e2d186a33c0c27273107dc4f160a09384877f
CVE ID: CVE-2022-1556 State: PUBLISHED Published: 2022-05-30T08:35:52 Last Updated: 2024-08-03T00:10:03.475Z Vendors: Unknown Products: StaffList Problem Types: CWE-89 Description: The StaffList WordPress plugin before 3.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement when searching for Staff in the admin dashboard, leading to an SQL Injection Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/04890549-6bd1-44dd-8bce-7125c01be5d4 - https://packetstormsecurity.com/files/166918/
CVE ID: CVE-2022-1557 State: PUBLISHED Published: 2022-05-16T14:31:11 Last Updated: 2024-08-03T00:10:02.962Z Vendors: Unknown Products: ULeak Security & Monitoring Plugin Problem Types: CWE-79 Description: The ULeak Security & Monitoring WordPress plugin through 1.2.3 does not have authorisation and CSRF checks when updating its settings, and is also lacking sanitisation as well as escaping in some of them, which could allow any authenticated users such as subscriber to perform Stored Cross-Site Scripting attacks against admins viewing the settings Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e2b6dbf5-8709-4a2c-90be-3214ff55ed56 - https://
- CVE Program Container: References: - https://wpscan.com/vulnerability/e2b6dbf5-8709-4a2c-90be-3214ff55ed56 - https://packetstormsecurity.com/files/166564/
CVE ID: CVE-2022-1558 State: PUBLISHED Published: 2022-05-23T07:15:37 Last Updated: 2024-08-03T00:10:02.951Z Vendors: Unknown Products: Curtain Problem Types: CWE-79 Description: The Curtain WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0414dad4-e90b-4122-8b77-a8a958ab824d - https://packetstormsecurity.com/files/166839/
CVE ID: CVE-2022-1559 State: PUBLISHED Published: 2022-05-16T14:31:13 Last Updated: 2024-08-03T00:10:03.423Z Vendors: Unknown Products: Clipr Problem Types: CWE-79 Description: The Clipr WordPress plugin through 1.2.3 does not sanitise and escape its API Key settings before outputting it in an attribute, leading to a Stored Cross-Site Scripting issue even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/99059337-c3cd-4e91-9a03-df32a05b719c - https://packetstormsecurity.com/files/166530/
CVE ID: CVE-2022-1560 State: PUBLISHED Published: 2022-05-16T14:31:15 Last Updated: 2024-08-03T00:10:03.383Z Vendors: Unknown Products: Amministrazione Aperta Problem Types: CWE-22 Description: The Amministrazione Aperta WordPress plugin before 3.8 does not validate the open parameter before using it in an include statement, leading to a Local File Inclusion issue. The original advisory mentions that unauthenticated users can exploit this, however the affected file generates a fatal error when accessed directly and the affected code is not reached. The issue can be exploited via the dashboard when logged in as an admin, or by making a logged in admin open a malicious link Additional Analyst
d via the dashboard when logged in as an admin, or by making a logged in admin open a malicious link Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/5c5fbbea-92d2-46bb-9a70-75155fffb6de
CVE ID: CVE-2022-1561 State: PUBLISHED Published: 2022-08-01T12:47:45.682543Z Last Updated: 2024-09-17T02:16:30.060Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: KrakenD Products: Lura Project, KrakenD-CE, KrakenD-EE Problem Types: CWE-471 Description: Lura and KrakenD-CE versions older than v2.0.2 and KrakenD-EE versions older than v2.0.0 do not sanitize URL parameters correctly, allowing a malicious user to alter the backend URL defined for a pipe when remote users send crafty URL requests. The vulnerability does not affect KrakenD itself, but the consumed backend might be vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https:
f, but the consumed backend might be vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://www.incibe-cert.es/en/early-warning/security-advisories/crafted-backend-urls-lura-project - https://www.krakend.io/blog/cve-2022-1561-crafted-backend-urls/
CVE ID: CVE-2022-1562 State: PUBLISHED Published: 2022-05-30T08:35:55 Last Updated: 2024-08-03T00:10:03.556Z Vendors: Unknown Products: Enable SVG Problem Types: CWE-79 Description: The Enable SVG WordPress plugin before 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/8e5b1e4f-c132-42ee-b2d0-7306ab4ab615
CVE ID: CVE-2022-1563 State: PUBLISHED Published: 2024-01-16T15:50:08.325Z Last Updated: 2025-06-20T16:56:50.304Z Vendors: Unknown Products: wp-graphql-woocommerce Problem Types: CWE-284 Improper Access Control Description: The WPGraphQL WooCommerce WordPress plugin before 0.12.4 does not prevent unauthenticated attackers from enumerating a shop's coupon codes and values via GraphQL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/19138092-50d3-4d63-97c5-aa8e1ce39456/ - https://github.com/wp-graphql/wp-graphql-woocommerce/
CVE ID: CVE-2022-1564 State: PUBLISHED Published: 2022-05-30T08:35:57 Last Updated: 2024-08-03T00:10:03.623Z Vendors: Unknown Products: Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder Problem Types: CWE-79 Description: The Form Maker by 10Web WordPress plugin before 1.14.12 does not sanitize and escape the Custom Text settings, which could allow high privilege user such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a487c7e7-667c-4c92-a427-c43cc13b348d