Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-2414 State: PUBLISHED Published: 2022-07-29T18:58:57 Last Updated: 2024-08-03T00:39:07.366Z Vendors: n/a Products: Dogtag PKI Problem Types: CWE-611 Description: Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dogtagpki/pki/pull/4021
CVE ID: CVE-2022-2415 State: PUBLISHED Published: 2022-07-28T00:41:25 Last Updated: 2024-08-03T00:39:07.233Z Vendors: Google Products: Chrome Problem Types: Heap buffer overflow Description: Heap buffer overflow in WebGL in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/06/stable-channel-update-for-desktop_21.html - https://crbug.com/1316368 - http://packetstormsecurity.com/files/167972/Chrome-WebGL-Uniform-Integer-Overflows.html
CVE ID: CVE-2022-2416 State: PUBLISHED Published: 2023-08-02T05:26:10.773Z Last Updated: 2024-10-11T14:08:57.814Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: Octopus Deploy Products: Octopus Server Problem Types: Blind SSRF vulnerability that allows enumeration/recon of an environment Description: In affected versions of Octopus Deploy it is possible for a low privileged guest user to craft a request that allows enumeration/recon of an environment. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://advisories.octopus.com/post/2023/sa2023-11/
CVE ID: CVE-2022-2417 State: PUBLISHED Published: 2022-08-05T15:10:27 Last Updated: 2024-08-03T00:39:06.949Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper input validation in GitLab Description: Insufficient validation in GitLab CE/EE affecting all versions from 12.10 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 allows an authenticated and authorised user to import a project that includes branch names which are 40 hexadecimal characters, which could be abused in supply chain attacks where a victim pinned to a specific Git commit of the project. Additional Analyst Notes: - CVE Program Contai
in attacks where a victim pinned to a specific Git commit of the project. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/361179 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2417.json
CVE ID: CVE-2022-2418 State: PUBLISHED Published: 2022-07-15T06:10:13.000Z Last Updated: 2025-04-15T14:06:37.735Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: URVE Products: Web Manager Problem Types: CWE-434 Description: A vulnerability was found in URVE Web Manager. It has been classified as critical. This affects an unknown part of the file kreator.html5/img_upload.php. The manipulation leads to unrestricted upload. Access to the local network is required for this attack. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/joinia/webray.co
ional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/joinia/webray.com.cn/blob/main/URVE/URVE%20Web%20Manager%20img_upload.php%20File%20upload%20vulnerability.md - https://vuldb.com/?id.203901
CVE ID: CVE-2022-2419 State: PUBLISHED Published: 2022-07-15T06:10:21.000Z Last Updated: 2025-04-15T14:06:23.561Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: URVE Products: Web Manager Problem Types: CWE-434 Description: A vulnerability was found in URVE Web Manager. It has been declared as critical. This vulnerability affects unknown code of the file _internal/collector/upload.php. The manipulation leads to unrestricted upload. Access to the local network is required for this attack to succeed. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://githu
and may be used. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/joinia/webray.com.cn/blob/main/URVE/URVE%20Web%20Manager%20upload.php%20File%20upload%20vulnerability.md - https://vuldb.com/?id.203902
CVE ID: CVE-2022-2420 State: PUBLISHED Published: 2022-07-15T06:10:28.000Z Last Updated: 2025-04-15T14:06:08.784Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: URVE Products: Web Manager Problem Types: CWE-434 Description: A vulnerability was found in URVE Web Manager. It has been rated as critical. This issue affects some unknown processing of the file _internal/uploader.php. The manipulation leads to unrestricted upload. The attack needs to be approached within the local network. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/joinia/web
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/joinia/webray.com.cn/blob/main/URVE/URVE%20Web%20Manager%20uploader.php%20%20File%20upload%20vulnerability.md - https://vuldb.com/?id.203903
CVE ID: CVE-2022-2421 State: PUBLISHED Published: 2022-10-25T00:00:00 Last Updated: 2025-03-11T13:40:55.218Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Socket.io Products: Socket.io-Parser Problem Types: CWE-89 Description: Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://csirt.divd.nl/CVE-2022-2421 - https://csirt.divd.nl/DIVD-2022-00045
CVE ID: CVE-2022-2422 State: PUBLISHED Published: 2022-10-25T00:00:00 Last Updated: 2025-03-11T13:41:09.960Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Feather js Products: Feathers-Sequalize Problem Types: CWE-89 Description: Due to improper input validation in the Feathers js library, it is possible to perform a SQL injection attack on the back-end database, in case the feathers-sequelize package is used. Additional Analyst Notes: - CVE Program Container: References: - https://csirt.divd.nl/DIVD-2022-00020 - https://csirt.divd.nl/CVE-2022-2422
CVE ID: CVE-2022-2423 State: PUBLISHED Published: 2022-08-08T13:50:23 Last Updated: 2024-08-03T00:39:07.417Z Vendors: Unknown Products: DW Promobar Problem Types: CWE-79 Description: The DW Promobar WordPress plugin through 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/714b4f2b-3f17-4730-8c25-21d8da4cb8d2
CVE ID: CVE-2022-2424 State: PUBLISHED Published: 2022-08-08T13:50:39 Last Updated: 2024-08-03T00:39:07.557Z Vendors: Unknown Products: Google Maps Anywhere Problem Types: CWE-79 Description: The Google Maps Anywhere WordPress plugin through 1.2.6.3 does not sanitise and escape any of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/2f9d3256-85c0-44fa-b0be-faa8989a1909
CVE ID: CVE-2022-2425 State: PUBLISHED Published: 2022-08-08T13:50:57 Last Updated: 2024-08-03T00:39:07.629Z Vendors: Unknown Products: WP DS Blog Map Problem Types: CWE-79 Description: The WP DS Blog Map WordPress plugin through 3.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ca684a25-28ba-4337-a6d4-9477b1643c9d
CVE ID: CVE-2022-2426 State: PUBLISHED Published: 2022-08-08T13:51:14 Last Updated: 2024-08-03T00:39:07.036Z Vendors: Unknown Products: Thinkific Uploader Problem Types: CWE-79 Description: The Thinkific Uploader WordPress plugin through 1.0.0 does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks against other administrators. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/00e36ad9-b55b-4d17-96fb-e415eec47422
CVE ID: CVE-2022-2428 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-05-13T19:48:23.382Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab Description: A crafted tag in the Jupyter Notebook viewer in GitLab EE/CE affecting all versions before 15.1.6, 15.2 to 15.2.4, and 15.3 to 15.3.2 allows an attacker to issue arbitrary HTTP requests Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/362272 - https://hackerone.com/repo
- CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/362272 - https://hackerone.com/reports/1563379 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2428.json
CVE ID: CVE-2022-2429 State: PUBLISHED Published: 2022-09-06T17:18:56.000Z Last Updated: 2025-01-31T18:51:31.150Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: homescript Products: Ultimate SMS Notifications for WooCommerce Problem Types: CWE-138 Description: The Ultimate SMS Notifications for WooCommerce plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.4.1 via the 'Export Utility' functionality. This makes it possible for authenticated attackers, such as a subscriber, to add untrusted input into billing information like their First Name that will embed into the exported CSV file triggered by an administrator and can
ling information like their First Name that will embed into the exported CSV file triggered by an administrator and can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2429 - https://plugins.trac.wordpress.org/browser/ultimate-sms-notifications/trunk/README.txt?rev=2441845#L92
CVE ID: CVE-2022-2430 State: PUBLISHED Published: 2022-09-06T17:18:56.000Z Last Updated: 2025-01-31T18:51:15.524Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: visualcomposer Products: Visual Composer Website Builder, Landing Page Builder, Custom Theme Builder, Maintenance Mode & Coming Soon Pages Problem Types: CWE-79 Description: The Visual Composer Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Text Block' feature in versions up to, and including, 45.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with access to the visual composer editor to inje
nd output escaping. This makes it possible for authenticated attackers with access to the visual composer editor to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2778808%40visualcomposer&new=2778808%40visualcomposer&sfp_email=&sfph_mail= - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2430
CVE ID: CVE-2022-2431 State: PUBLISHED Published: 2022-09-06T17:18:56.000Z Last Updated: 2025-01-31T19:01:32.209Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: download-manager Products: Download Manager Problem Types: CWE-73 Description: The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and including 3.2.50. This is due to insufficient file type and path validation on the deleteFiles() function found in the ~/Admin/Menu/Packages.php file that triggers upon download post deletion. This makes it possible for contributor level users and above to supply an arbitrary file path via the 'file[files]' parameter wh
es it possible for contributor level users and above to supply an arbitrary file path via the 'file[files]' parameter when creating a download post and once the user deletes the post the supplied arbitrary file will be deleted. This can be used by attackers to delete the /wp-config.php file which will reset the installation and make it possible for an attacker to achieve remote code execution on the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2762092%40download-manager&new=2762092%40download-manager&sfp_email=&sfph_mail= - https://packetstormsecurity.com/file
d=2762092%40download-manager&new=2762092%40download-manager&sfp_email=&sfph_mail= - https://packetstormsecurity.com/files/167920/wpdownloadmanager3250-filedelete.txt - https://www.wordfence.com/blog/2022/08/high-severity-vulnerability-patched-in-download-manager-plugin/
CVE ID: CVE-2022-2432 State: PUBLISHED Published: 2022-09-06T17:18:56.000Z Last Updated: 2025-01-31T19:00:44.451Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: ecwid Products: Ecwid Ecommerce Shopping Cart Problem Types: CWE-352 Description: The Ecwid Ecommerce Shopping Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.10.23. This is due to missing or incorrect nonce validation on the ecwid_update_plugin_params function. This makes it possible for unauthenticated attackers to update plugin options granted they can trick a site administrator into performing an action such as clicking on a link. Additiona
ugin options granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2755658%40ecwid-shopping-cart%2Ftrunk&old=2754114%40ecwid-shopping-cart%2Ftrunk&sfp_email=&sfph_mail= - https://www.wordfence.com/blog/2022/08/cross-site-request-forgery-vulnerability-patched-in-ecwid-ecommerce-shopping-cart-plugin/
CVE ID: CVE-2022-2433 State: PUBLISHED Published: 2022-09-06T17:18:56.000Z Last Updated: 2025-08-21T17:23:46.998Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: dcooney Products: Ajax Load More – Infinite Scroll Problem Types: CWE-502 Description: The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to deserialization of untrusted input via the 'alm_repeaters_export' parameter in versions up to, and including 5.5.3. This makes it possible for unauthenticated users to call files using a PHAR wrapper, granted they can trick a site administrator into performing an action such as clicking on a link, that will deserialize and call arbi
can trick a site administrator into performing an action such as clicking on a link, that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/040ae20d-93e3-4c65-ba74-4ff0b5c1afc7?source=cve - https://plugins.trac.wordpress.org/changeset/2772627/ajax-load-more/trunk/admin/admin.php - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2433 - https://gi
27/ajax-load-more/trunk/admin/admin.php - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2433 - https://github.com/dcooney/ajax-load-more/commit/b577b3257544bc74a5d2ad14f0a0f7df3eb843de
CVE ID: CVE-2022-2434 State: PUBLISHED Published: 2022-09-06T17:18:57.000Z Last Updated: 2025-05-05T16:19:45.840Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: instawp Products: String locator Problem Types: CWE-502 Deserialization of Untrusted Data Description: The String Locator plugin for WordPress is vulnerable to deserialization of untrusted input via the 'string-locator-path' parameter in versions up to, and including 2.5.0. This makes it possible for unauthenticated users to call files using a PHAR wrapper, granted they can trick a site administrator into performing an action such as clicking on a link, that will deserialize and call arbitrary PHP Obj
ite administrator into performing an action such as clicking on a link, that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/10a36e37-4188-403f-9b17-d7e79b8b8a6d?source=cve - https://plugins.trac.wordpress.org/browser/string-locator/trunk/editor.php#L59 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2759486%40string-loca
/editor.php#L59 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2759486%40string-locator&new=2759486%40string-locator&sfp_email=&sfph_mail= - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2434
CVE ID: CVE-2022-2435 State: PUBLISHED Published: 2022-07-18T16:13:27.000Z Last Updated: 2025-05-05T16:19:33.743Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: mbeltwski Products: AnyMind Widget Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The AnyMind Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.1. This is due to missing nonce protection on the createDOMStructure() function found in the ~/anymind-widget-id.php file. This makes it possible for unauthenticated attackers to inject malicious web scripts into the page, granted they can trick a site’s administrator into performi
ted attackers to inject malicious web scripts into the page, granted they can trick a site’s administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/174eae70-15d7-4772-8fcd-dc4c0fca5b7d?source=cve - https://plugins.trac.wordpress.org/browser/anymind-widget/trunk/anymind-widget-id.php - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2435
CVE ID: CVE-2022-2436 State: PUBLISHED Published: 2022-09-06T17:18:57.000Z Last Updated: 2025-05-05T16:19:22.839Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: codename065 Products: Download Manager Problem Types: CWE-502 Deserialization of Untrusted Data Description: The Download Manager plugin for WordPress is vulnerable to deserialization of untrusted input via the 'file[package_dir]' parameter in versions up to, and including 3.2.49. This makes it possible for authenticated attackers with contributor privileges and above to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety
sing a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/471957f6-54c1-4268-b2e1-8efa391dcaec?source=cve - https://plugins.trac.wordpress.org/browser/download-manager/trunk/src/Admin/Menu/Packages.php#L68 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2761422%40download-manager%2Ftrunk%2Fsrc%2FAd
//plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2761422%40download-manager%2Ftrunk%2Fsrc%2FAdmin%2FMenu%2FPackages.php&new=2761422%40download-manager%2Ftrunk%2Fsrc%2FAdmin%2FMenu%2FPackages.php - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2436
CVE ID: CVE-2022-2437 State: PUBLISHED Published: 2022-07-18T16:13:40.000Z Last Updated: 2025-05-05T16:19:11.701Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: slickremix Products: Feed Them Social – Page, Post, Video, and Photo Galleries Problem Types: CWE-502 Deserialization of Untrusted Data Description: The Feed Them Social – for Twitter feed, Youtube and more plugin for WordPress is vulnerable to deserialization of untrusted input via the 'fts_url' parameter in versions up to, and including 2.9.8.5. This makes it possible for unauthenticated attackers to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects th
henticated attackers to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/50bcea94-b12a-4b31-b0c1-bba834ea9bd0?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2754749%40feed-them-social&new=2754749%40feed-them-social&sfp_email=&sfph_mail= - https://www.wordfence.com/v
oname=&old=2754749%40feed-them-social&new=2754749%40feed-them-social&sfp_email=&sfph_mail= - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2437
CVE ID: CVE-2022-2438 State: PUBLISHED Published: 2022-09-06T17:18:57.000Z Last Updated: 2025-05-05T16:19:00.977Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: wpmudev Products: Broken Link Checker Problem Types: CWE-502 Deserialization of Untrusted Data Description: The Broken Link Checker plugin for WordPress is vulnerable to deserialization of untrusted input via the '$log_file' value in versions up to, and including 1.11.16. This makes it possible for authenticated attackers with administrative privileges and above to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of mal