Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-3964 State: PUBLISHED Published: 2022-11-13T00:00:00 Last Updated: 2024-08-03T01:27:53.103Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: unspecified Products: ffmpeg Problem Types: CWE-119 Description: A vulnerability classified as problematic has been found in ffmpeg. This affects an unknown part of the file libavcodec/rpzaenc.c of the component QuickTime RPZA Video Encoder. The manipulation of the argument y_size leads to out-of-bounds read. It is possible to initiate the attack remotely. The name of the patch is 92f9b28ed84a77138105475beba16c146bdaf984. It is recommended to apply a patch to fix this issue. The associated identifier of
28ed84a77138105475beba16c146bdaf984. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-213543. Additional Analyst Notes: - CVE Program Container: References: - https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/92f9b28ed84a77138105475beba16c146bdaf984 - https://vuldb.com/?id.213543 - https://security.gentoo.org/glsa/202312-14
CVE ID: CVE-2022-3965 State: PUBLISHED Published: 2022-11-13T00:00:00 Last Updated: 2024-08-03T01:27:53.975Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: unspecified Products: ffmpeg Problem Types: CWE-119 Description: A vulnerability classified as problematic was found in ffmpeg. This vulnerability affects the function smc_encode_stream of the file libavcodec/smcenc.c of the component QuickTime Graphics Video Encoder. The manipulation of the argument y_size leads to out-of-bounds read. The attack can be initiated remotely. The name of the patch is 13c13109759090b7f7182480d075e13b36ed8edd. It is recommended to apply a patch to fix this issue. The identifi
he patch is 13c13109759090b7f7182480d075e13b36ed8edd. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-213544. Additional Analyst Notes: - CVE Program Container: References: - https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/13c13109759090b7f7182480d075e13b36ed8edd - https://vuldb.com/?id.213544 - https://security.gentoo.org/glsa/202312-14
CVE ID: CVE-2022-3966 State: PUBLISHED Published: 2022-11-13T00:00:00.000Z Last Updated: 2025-04-15T13:15:38.121Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: unspecified Products: Ultimate Member Plugin Problem Types: CWE-22 Description: A vulnerability, which was classified as critical, has been found in Ultimate Member Plugin up to 2.5.0. This issue affects the function load_template of the file includes/core/class-shortcodes.php of the component Template Handler. The manipulation of the argument tpl leads to pathname traversal. The attack may be initiated remotely. Upgrading to version 2.5.1 is able to address this issue. The name of the patch is e1bc
ttack may be initiated remotely. Upgrading to version 2.5.1 is able to address this issue. The name of the patch is e1bc94c1100f02a129721ba4be5fbc44c3d78ec4. It is recommended to upgrade the affected component. The identifier VDB-213545 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ultimatemember/ultimatemember/commit/e1bc94c1100f02a129721ba4be5fbc44c3d78ec4 - https://github.com/ultimatemember/ultimatemember/releases/tag/2.5.1 - https://vuldb.com/?id.213545
CVE ID: CVE-2022-3967 State: PUBLISHED Published: 2022-11-13T00:00:00.000Z Last Updated: 2025-04-15T13:15:29.919Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: unspecified Products: Vesta Control Panel Problem Types: CWE-707 Description: A vulnerability, which was classified as critical, was found in Vesta Control Panel. Affected is an unknown function of the file func/main.sh of the component sed Handler. The manipulation leads to argument injection. An attack has to be approached locally. The name of the patch is 39561c32c12cabe563de48cc96eccb9e2c655e25. It is recommended to apply a patch to fix this issue. VDB-213546 is the identifier assigned to this v
c96eccb9e2c655e25. It is recommended to apply a patch to fix this issue. VDB-213546 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/serghey-rodin/vesta/commit/39561c32c12cabe563de48cc96eccb9e2c655e25 - https://vuldb.com/?id.213546
CVE ID: CVE-2022-3968 State: PUBLISHED Published: 2022-11-13T00:00:00 Last Updated: 2024-11-19T21:00:56.063Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: unspecified Products: emlog Problem Types: CWE-707 Description: A vulnerability has been found in emlog and classified as problematic. Affected by this vulnerability is an unknown functionality of the file admin/article_save.php. The manipulation of the argument tag leads to cross site scripting. The attack can be launched remotely. The name of the patch is 5bf7a79826e0ea09bcc8a21f69a0c74107761a02. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-2
07761a02. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-213547. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/emlog/emlog/commit/5bf7a79826e0ea09bcc8a21f69a0c74107761a02 - https://vuldb.com/?id.213547
CVE ID: CVE-2022-3969 State: PUBLISHED Published: 2022-11-13T00:00:00.000Z Last Updated: 2025-04-15T13:15:23.474Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: unspecified Products: OpenKM Problem Types: CWE-377 Description: A vulnerability was found in OpenKM up to 6.3.11 and classified as problematic. Affected by this issue is the function getFileExtension of the file src/main/java/com/openkm/util/FileUtils.java. The manipulation leads to insecure temporary file. Upgrading to version 6.3.12 is able to address this issue. The name of the patch is c069e4d73ab8864345c25119d8459495f45453e1. It is recommended to upgrade the affected component. The identifier of
tch is c069e4d73ab8864345c25119d8459495f45453e1. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-213548. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/openkm/document-management-system/pull/332 - https://github.com/openkm/document-management-system/releases/tag/v6.3.12 - https://github.com/openkm/document-management-system/commit/c069e4d73ab8864345c25119d8459495f45453e1 - https://vuldb.com/?id.213548
CVE ID: CVE-2022-3970 State: PUBLISHED Published: 2022-11-13T00:00:00.000Z Last Updated: 2025-04-15T13:15:13.383Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: unspecified Products: LibTIFF Problem Types: CWE-189 Description: A vulnerability was found in LibTIFF. It has been classified as critical. This affects the function TIFFReadRGBATileExt of the file libtiff/tif_getimage.c. The manipulation leads to integer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 227500897dfb07fb7d27f7aa570050e62617e3be. It is recommended to apply a patch to fix this issue. The ide
of the patch is 227500897dfb07fb7d27f7aa570050e62617e3be. It is recommended to apply a patch to fix this issue. The identifier VDB-213549 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53137 - https://oss-fuzz.com/download?testcase_id=5738253143900160 - https://gitlab.com/libtiff/libtiff/-/commit/227500897dfb07fb7d27f7aa570050e62617e3be - https://vuldb.com/?id.213549 - https://security.netapp.com/advisory/ntap-20221215-0009/ - https://lists.debian.org/debian-lts-announce/2023/01/msg00018.html - https://support.apple.com/kb/HT213843 - https://support.apple.com/
ebian.org/debian-lts-announce/2023/01/msg00018.html - https://support.apple.com/kb/HT213843 - https://support.apple.com/kb/HT213841
CVE ID: CVE-2022-3971 State: PUBLISHED Published: 2022-11-13T00:00:00.000Z Last Updated: 2025-04-15T13:15:03.625Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: unspecified Products: matrix-appservice-irc Problem Types: CWE-707 Description: A vulnerability was found in matrix-appservice-irc up to 0.35.1. It has been declared as critical. This vulnerability affects unknown code of the file src/datastore/postgres/PgDataStore.ts. The manipulation of the argument roomIds leads to sql injection. Upgrading to version 0.36.0 is able to address this issue. The name of the patch is 179313a37f06b298150edba3e2b0e5a73c1415e7. It is recommended to upgrade the affected c
is issue. The name of the patch is 179313a37f06b298150edba3e2b0e5a73c1415e7. It is recommended to upgrade the affected component. VDB-213550 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/matrix-org/matrix-appservice-irc/pull/1619 - https://github.com/matrix-org/matrix-appservice-irc/releases/tag/0.36.0 - https://github.com/matrix-org/matrix-appservice-irc/commit/179313a37f06b298150edba3e2b0e5a73c1415e7 - https://vuldb.com/?id.213550
CVE ID: CVE-2022-3972 State: PUBLISHED Published: 2022-11-13T00:00:00.000Z Last Updated: 2025-04-14T15:56:10.156Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Pingkon Products: HMS-PHP Problem Types: CWE-707 Description: A vulnerability was found in Pingkon HMS-PHP. It has been rated as critical. This issue affects some unknown processing of the file admin/adminlogin.php. The manipulation of the argument uname/pass leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-213551. Additional Analyst Notes: - CVE Program Container: - CISA A
e associated identifier of this vulnerability is VDB-213551. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Pingkon/HMS-PHP/issues/1 - https://vuldb.com/?id.213551
CVE ID: CVE-2022-3973 State: PUBLISHED Published: 2022-11-13T00:00:00.000Z Last Updated: 2025-04-14T15:55:57.657Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Pingkon Products: HMS-PHP Problem Types: CWE-707 Description: A vulnerability classified as critical has been found in Pingkon HMS-PHP. Affected is an unknown function of the file /admin/admin.php of the component Data Pump Metadata. The manipulation of the argument uname/pass leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-213552. Additional Analyst Notes: - CVE Program Cont
public and may be used. The identifier of this vulnerability is VDB-213552. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Pingkon/HMS-PHP/issues/1 - https://vuldb.com/?id.213552
CVE ID: CVE-2022-3974 State: PUBLISHED Published: 2022-11-13T00:00:00.000Z Last Updated: 2025-04-15T13:14:53.749Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Axiomatic Products: Bento4 Problem Types: CWE-119 Description: A vulnerability classified as critical was found in Axiomatic Bento4. Affected by this vulnerability is the function AP4_StdcFileByteStream::ReadPartial of the file Ap4StdCFileByteStream.cpp of the component mp4info. The manipulation leads to heap-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-213553 was assigned to this vulnerability. Additiona
as been disclosed to the public and may be used. The identifier VDB-213553 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/axiomatic-systems/Bento4/issues/812 - https://github.com/axiomatic-systems/Bento4/files/9987970/mp4info_overflow_ReadPartial341.zip - https://vuldb.com/?id.213553
CVE ID: CVE-2022-3975 State: PUBLISHED Published: 2022-11-13T00:00:00.000Z Last Updated: 2025-04-15T13:14:45.323Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: NukeViet Products: CMS Problem Types: CWE-707 Description: A vulnerability, which was classified as problematic, has been found in NukeViet CMS. Affected by this issue is the function filterAttr of the file vendor/vinades/nukeviet/Core/Request.php of the component Data URL Handler. The manipulation of the argument attrSubSet leads to cross site scripting. The attack may be launched remotely. Upgrading to version 4.5 is able to address this issue. The name of the patch is 0b3197fad950bb3383e83039a8ee4c9
motely. Upgrading to version 4.5 is able to address this issue. The name of the patch is 0b3197fad950bb3383e83039a8ee4c9509b3ce02. It is recommended to upgrade the affected component. VDB-213554 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nukeviet/nukeviet - https://github.com/nukeviet/nukeviet/commit/0b3197fad950bb3383e83039a8ee4c9509b3ce02 - https://vuldb.com/?id.213554
CVE ID: CVE-2022-3976 State: PUBLISHED Published: 2022-11-13T00:00:00.000Z Last Updated: 2025-04-15T13:14:35.393Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: MZ Automation Products: libiec61850 Problem Types: CWE-22 Description: A vulnerability has been found in MZ Automation libiec61850 up to 1.4 and classified as critical. This vulnerability affects unknown code of the file src/mms/iso_mms/client/mms_client_files.c of the component MMS File Services. The manipulation of the argument filename leads to path traversal. Upgrading to version 1.5 is able to address this issue. The name of the patch is 10622ba36bb3910c151348f1569f039ecdd8786f. It is recommend
on 1.5 is able to address this issue. The name of the patch is 10622ba36bb3910c151348f1569f039ecdd8786f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-213556. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mz-automation/libiec61850 - https://github.com/mz-automation/libiec61850/commit/10622ba36bb3910c151348f1569f039ecdd8786f - https://vuldb.com/?id.213556
CVE ID: CVE-2022-3977 State: PUBLISHED Published: 2023-01-12T00:00:00.000Z Last Updated: 2025-04-08T18:03:56.887Z Vendors: n/a Products: Kernel Problem Types: CWE-416 Description: A use-after-free flaw was found in the Linux kernel MCTP (Management Component Transport Protocol) functionality. This issue occurs when a user simultaneously calls DROPTAG ioctl and socket close happens, which could allow a local user to crash the system or potentially escalate their privileges on the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3a732b46736cd8a29092e4b0b1a9ba83e672bf89
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3a732b46736cd8a29092e4b0b1a9ba83e672bf89 - https://security.netapp.com/advisory/ntap-20230223-0005/
CVE ID: CVE-2022-3978 State: PUBLISHED Published: 2022-11-13T00:00:00.000Z Last Updated: 2025-04-15T13:14:26.482Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: unspecified Products: NodeBB Problem Types: CWE-863 Description: A vulnerability, which was classified as problematic, was found in NodeBB up to 2.5.7. This affects an unknown part of the file /register/abort. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 2.5.8 is able to address this issue. The name of the patch is 2f9d8c350e54543f608d3d4c8e1a49bbb6cdea38. It is recommended to upgrade the affected component. The associated
e patch is 2f9d8c350e54543f608d3d4c8e1a49bbb6cdea38. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-213555. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/NodeBB/NodeBB/issues/11017 - https://github.com/NodeBB/NodeBB/releases/tag/v2.5.8 - https://github.com/NodeBB/NodeBB/commit/2f9d8c350e54543f608d3d4c8e1a49bbb6cdea38 - https://vuldb.com/?id.213555
CVE ID: CVE-2022-3979 State: PUBLISHED Published: 2022-11-13T00:00:00.000Z Last Updated: 2025-11-03T19:27:27.428Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: NagVis Problem Types: CWE-704 Description: A vulnerability was found in NagVis up to 1.9.33 and classified as problematic. This issue affects the function checkAuthCookie of the file share/server/core/classes/CoreLogonMultisite.php. The manipulation of the argument hash leads to incorrect type conversion. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 1.9.34 is able to address this issue.
ck is rather high. The exploitation is known to be difficult. Upgrading to version 1.9.34 is able to address this issue. The identifier of the patch is 7574fd8a2903282c2e0d1feef5c4876763db21d5. It is recommended to upgrade the affected component. The identifier VDB-213557 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.213557 - https://vuldb.com/?ctiid.213557 - https://github.com/NagVis/nagvis/commit/7574fd8a2903282c2e0d1feef5c4876763db21d5 - https://github.com/NagVis/nagvis/releases/tag/nagvis-1.9.34 - https://www.sonarsource.com/blog/checkmk-rce-chain-2/
CVE ID: CVE-2022-3980 State: PUBLISHED Published: 2022-11-16T00:00:00.000Z Last Updated: 2025-04-29T14:12:08.837Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Sophos Products: Sophos Mobile managed on-premises Problem Types: n/a Description: An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in Sophos Mobile managed on-premises between versions 5.0.0 and 9.7.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sophos.com/en-us/security-advisories/sophos-sa-20221116-smc-xee
CVE ID: CVE-2022-3981 State: PUBLISHED Published: 2022-12-12T17:54:44.914Z Last Updated: 2025-04-22T14:57:07.782Z Vendors: Unknown Products: Icegram Express Problem Types: CWE-89 SQL Injection Description: The Icegram Express WordPress plugin before 5.5.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by any authenticated users, such as subscriber Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/78054d08-0227-426c-903d-d146e0919028
CVE ID: CVE-2022-3982 State: PUBLISHED Published: 2022-12-12T17:54:47.850Z Last Updated: 2025-04-22T14:52:56.748Z Vendors: Unknown Products: Booking calendar, Appointment Booking System Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The Booking calendar, Appointment Booking System WordPress plugin before 3.2.2 does not validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/4d91f3e1-4de9-46c1-b5ba-cc55b7726867
CVE ID: CVE-2022-3983 State: PUBLISHED Published: 2022-12-19T13:41:43.213Z Last Updated: 2025-04-17T13:46:12.292Z Vendors: Unknown Products: Checkout for PayPal Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Checkout for PayPal WordPress plugin before 1.0.14 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0b48bbd6-7c77-44b8-a5d6-34e4a0747cf1
CVE ID: CVE-2022-3984 State: PUBLISHED Published: 2022-12-19T13:41:46.964Z Last Updated: 2025-04-17T13:43:12.739Z Vendors: Unknown Products: Flowplayer Video Player Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Flowplayer Video Player WordPress plugin before 1.0.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b4694e9d-3f38-4295-929d-0ad37b3cbbaa
CVE ID: CVE-2022-3985 State: PUBLISHED Published: 2022-12-19T13:41:40.864Z Last Updated: 2025-04-17T14:14:29.826Z Vendors: Unknown Products: Videojs HTML5 Player Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Videojs HTML5 Player WordPress plugin before 1.1.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/58f82e13-153e-41e8-a22b-a2e96b46a6dc
CVE ID: CVE-2022-3986 State: PUBLISHED Published: 2022-12-19T13:41:38.527Z Last Updated: 2025-04-17T13:57:10.985Z Vendors: Unknown Products: WP Stripe Checkout Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Stripe Checkout WordPress plugin before 1.2.2.21 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ad8077a1-7cbe-4aa1-ad7d-acb41027ed0a
CVE ID: CVE-2022-3987 State: PUBLISHED Published: 2022-12-19T13:41:47.729Z Last Updated: 2025-04-17T13:41:59.141Z Vendors: Unknown Products: Responsive Lightbox2 Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Responsive Lightbox2 WordPress plugin before 1.0.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d9309a09-34ba-4e56-b683-e677ad277b29
CVE ID: CVE-2022-3988 State: PUBLISHED Published: 2022-11-14T00:00:00.000Z Last Updated: 2025-04-15T13:14:17.399Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: unspecified Products: Frappe Problem Types: CWE-707 Description: A vulnerability was found in Frappe. It has been rated as problematic. Affected by this issue is some unknown functionality of the file frappe/templates/includes/navbar/navbar_search.html of the component Search. The manipulation of the argument q leads to cross site scripting. The attack may be launched remotely. The name of the patch is bfab7191543961c6cb77fe267063877c31b616ce. It is recommended to apply a patch to fix this issue. The i
me of the patch is bfab7191543961c6cb77fe267063877c31b616ce. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-213560. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/frappe/frappe/pull/18847 - https://github.com/frappe/frappe/commit/bfab7191543961c6cb77fe267063877c31b616ce - https://vuldb.com/?id.213560