Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-2428 State: PUBLISHED Published: 2023-04-30T00:00:00.000Z Last Updated: 2025-01-30T16:58:31.104Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: thorsten Products: thorsten/phpmyfaq Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.13. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/cee65b6d-b003-4e6a-9d14-89aa94bee43e - https://github.com/thorsten/phpmyfaq/commit/0a4980d870bac92df945f6d022726c4e3ed584ab
CVE ID: CVE-2023-2429 State: PUBLISHED Published: 2023-04-30T00:00:00.000Z Last Updated: 2025-01-30T16:57:49.760Z Severity: MEDIUM (CVSS 6.6 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L) Vendors: thorsten Products: thorsten/phpmyfaq Problem Types: CWE-284 Description: Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.13. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/20d3a0b3-2693-4bf1-b196-10741201a540 - https://github.com/thorsten/phpmyfaq/commit/07552f5577ff8b1e6f7cdefafcce9b2a744d3a24
CVE ID: CVE-2023-2430 State: PUBLISHED Published: 2023-07-23T00:00:00.000Z Last Updated: 2025-03-06T21:37:09.922Z Vendors: n/a Products: kernel Problem Types: CWE-413 Description: A vulnerability was found due to missing lock for IOPOLL flaw in io_cqring_event_overflow() in io_uring.c in Linux Kernel. This flaw allows a local attacker with user privilege to trigger a Denial of Service threat. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e12d7a46f65ae4b7d58a5e0c1cbfa825cf8 - https://www.debian.org/security/2023/dsa-5492
CVE ID: CVE-2023-2431 State: PUBLISHED Published: 2023-06-16T07:08:33.476Z Last Updated: 2025-02-13T16:44:13.942Z Severity: LOW (CVSS 3.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N) Vendors: Kubernetes Products: Kubernetes Problem Types: CWE-1287 Description: A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode. This bug affects Kubelet. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://
bug affects Kubelet. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://groups.google.com/g/kubernetes-security-announce/c/QHmx0HOQa10 - https://github.com/kubernetes/kubernetes/issues/118690 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBX4RL4UOC7JHWWYB2AJCKSUM7EG5Y5G/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/43HDSKBKPSW53OW647B5ETHRWFFNHSRQ/
CVE ID: CVE-2023-2433 State: PUBLISHED Published: 2023-07-18T08:37:09.177Z Last Updated: 2024-09-27T20:00:55.557Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: jeffparker Products: YARPP – Yet Another Related Posts Plugin Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The YARPP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'className' parameter in versions up to, and including, 5.30.3 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers to inject arbitrary web scripts in pages that will execute whene
This makes it possible for contributor-level attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/35bd7462-8dab-43b2-9941-fef6f826cfdc?source=cve - https://plugins.trac.wordpress.org/browser/yet-another-related-posts-plugin/tags/5.30.3/classes/YARPP_Core.php#L1623 - https://plugins.trac.wordpress.org/changeset/2939617/yet-another-related-posts-plugin/trunk/classes/YARPP_Core.php
CVE ID: CVE-2023-2434 State: PUBLISHED Published: 2023-05-31T03:36:10.899Z Last Updated: 2024-08-02T06:19:15.244Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L) Vendors: kylephillips Products: Nested Pages Problem Types: CWE-862 Missing Authorization Description: The Nested Pages plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'reset' function in versions up to, and including, 3.2.3. This makes it possible for authenticated attackers, with editor-level permissions and above, to reset plugin settings. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabil
ings. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8c3e61e9-3610-41b5-9820-28012dc657fd?source=cve - https://plugins.trac.wordpress.org/browser/wp-nested-pages/tags/3.2.3/app/Form/Listeners/ResetSettings.php#L12 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2919175%40wp-nested-pages&old=2814681%40wp-nested-pages&sfp_email=&sfph_mail=
CVE ID: CVE-2023-2435 State: PUBLISHED Published: 2023-05-31T02:40:21.694Z Last Updated: 2025-01-13T16:31:19.023Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: timhodson Products: Blog-in-Blog Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The Blog-in-Blog plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.1.1 via a shortcode attribute. This allows editor-level, and above, attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive
ver, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d53161ad-cc5f-4433-b288-a8095cdfd7db?source=cve - https://plugins.trac.wordpress.org/browser/blog-in-blog/tags/1.1.1/blog-in-blog.php#L153
CVE ID: CVE-2023-2436 State: PUBLISHED Published: 2023-05-31T02:40:20.038Z Last Updated: 2025-01-13T16:31:57.872Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: timhodson Products: Blog-in-Blog Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Blog-in-Blog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'blog_in_blog' shortcode in versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with editor-level and above permissions to inject arbitr
attributes. This makes it possible for authenticated attackers with editor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5c6a88c3-18b7-470f-8014-373ead66dcfa?source=cve - https://plugins.trac.wordpress.org/browser/blog-in-blog/tags/1.1.1/blog-in-blog.php#L257
CVE ID: CVE-2023-2437 State: PUBLISHED Published: 2023-11-22T15:33:33.084Z Last Updated: 2025-02-13T16:44:14.449Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: UserPro - Community and User Profile WordPress Plugin Problem Types: CWE-288 Authentication Bypass Using an Alternate Path or Channel Description: The UserPro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.1. This is due to insufficient verification on the user being supplied during a Facebook login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administ
in. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email. An attacker can leverage CVE-2023-2448 and CVE-2023-2446 to get the user's email address to successfully exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b3cf9f38-c20e-40dc-a7a1-65b0c6ba7925?source=cve - https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681 - http://packetstormsecurity.com/files/175871/WordPress-UserPro-5.1.x-Password-Reset-Authentication-Bypass-Escalation.html
CVE ID: CVE-2023-2438 State: PUBLISHED Published: 2023-11-22T15:33:29.765Z Last Updated: 2024-08-02T06:19:15.256Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: n/a Products: UserPro - Community and User Profile WordPress Plugin Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.0. This is due to missing or incorrect nonce validation on the 'userpro_save_userdata' function. This makes it possible for unauthenticated attackers to update the user meta and inject malicious JavaScript via a forged request, granted they can trick
nticated attackers to update the user meta and inject malicious JavaScript via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7d30adc5-27a5-4549-84fc-b930f27f03e5?source=cve - https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681
CVE ID: CVE-2023-2439 State: PUBLISHED Published: 2024-01-31T02:35:10.486Z Last Updated: 2025-06-17T21:29:19.012Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: n/a Products: UserPro - Community and User Profile WordPress Plugin Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The UserPro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'userpro' shortcode in versions up to, and including, 5.1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and abov
escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/21cb424c-4efd-4c12-a08a-6d574f118c28?source=cve - https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681
CVE ID: CVE-2023-2440 State: PUBLISHED Published: 2023-11-22T15:33:27.961Z Last Updated: 2024-10-15T18:31:19.686Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: UserPro - Community and User Profile WordPress Plugin Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing nonce validation in the 'admin_page', 'userpro_verify_user' and 'verifyUnverifyAllUsers' functions. This makes it possible for unauthenticated attackers to modify the role of verified users to elevate verified user privileges t
kes it possible for unauthenticated attackers to modify the role of verified users to elevate verified user privileges to that of any user such as 'administrator' via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/73600498-f55c-4b8e-a625-4f292e58e0ee?source=cve - https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681
CVE ID: CVE-2023-2442 State: PUBLISHED Published: 2023-06-07T00:00:00 Last Updated: 2025-01-07T16:29:51.039Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A specially crafted merge request could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims. Additional Analyst Notes: - CVE Program Container: - CISA A
attackers to perform arbitrary actions on behalf of victims. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/409346 - https://hackerone.com/reports/1965750 - https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2442.json
CVE ID: CVE-2023-2443 State: PUBLISHED Published: 2023-05-11T18:08:08.060Z Last Updated: 2025-01-24T21:16:26.466Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Rockwell Automation Products: ThinManager Problem Types: Rockwell Automation ThinManager Software Utilizes Inadequate Encryption Strength Description: Rockwell Automation ThinManager product allows the use of medium strength ciphers. If the client requests an insecure cipher, a malicious actor could potentially decrypt traffic sent between the client and server API. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://rockwellautomation.custhelp.com/app/ans
t Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139442
CVE ID: CVE-2023-2444 State: PUBLISHED Published: 2023-05-11T18:12:13.730Z Last Updated: 2025-01-24T21:16:59.768Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H) Vendors: Rockwell Automation Products: FactoryTalk Vantagepoint Problem Types: Rockwell Automation FactoryTalk Vantagepoint Vulnerable To Cross Site Request Forgery Description: A cross site request forgery vulnerability exists in Rockwell Automation's FactoryTalk Vantagepoint. This vulnerability can be exploited in two ways. If an attacker sends a malicious link to a computer that is on the same domain as the FactoryTalk Vantagepoint server and a user clicks the link, the attacker could impersonate the legiti
same domain as the FactoryTalk Vantagepoint server and a user clicks the link, the attacker could impersonate the legitimate user and send requests to the affected product. Additionally, if an attacker sends an untrusted link to a computer that is not on the same domain as the server and a user opens the FactoryTalk Vantagepoint website, enters credentials for the FactoryTalk Vantagepoint server, and clicks on the malicious link a cross site request forgery attack would be successful as well. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139443
CVE ID: CVE-2023-2445 State: PUBLISHED Published: 2023-05-02T13:11:06.405Z Last Updated: 2025-01-30T16:10:20.896Z Vendors: Devolutions Products: Devolutions Server Description: Improper access control in Subscriptions Folder path filter in Devolutions Server 2023.1.1 and earlier allows attackers with administrator privileges to retrieve usage information on folders in user vaults via a specific folder name. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2023-0013/
CVE ID: CVE-2023-2446 State: PUBLISHED Published: 2023-11-22T07:32:12.130Z Last Updated: 2025-02-13T16:44:15.033Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: n/a Products: UserPro - Community and User Profile WordPress Plugin Problem Types: CWE-200 Information Exposure Description: The UserPro plugin for WordPress is vulnerable to sensitive information disclosure via the 'userpro' shortcode in versions up to, and including 5.1.1. This is due to insufficient restriction on sensitive user meta values that can be called via that shortcode. This makes it possible for authenticated attackers, with subscriber-level permissions, and above to retrieve sensitive
This makes it possible for authenticated attackers, with subscriber-level permissions, and above to retrieve sensitive user meta that can be used to gain access to a high privileged user account. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4072ba5f-6385-4fa3-85b6-89dac7b60a92?source=cve - https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681 - http://packetstormsecurity.com/files/175871/WordPress-UserPro-5.1.x-Password-Reset-Authentication-Bypass-Escalation.html
CVE ID: CVE-2023-2447 State: PUBLISHED Published: 2023-11-22T07:32:11.559Z Last Updated: 2024-10-11T18:06:17.681Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: n/a Products: UserPro - Community and User Profile WordPress Plugin Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing or incorrect nonce validation on the 'export_users' function. This makes it possible for unauthenticated attackers to export the users to a csv file, granted they can trick a site administrator into performing an action such
attackers to export the users to a csv file, granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0372efe4-b5be-4601-be43-5c12332ea1a5?source=cve - https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681
CVE ID: CVE-2023-2448 State: PUBLISHED Published: 2023-11-22T15:33:29.321Z Last Updated: 2025-02-13T16:44:16.151Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: n/a Products: UserPro - Community and User Profile WordPress Plugin Problem Types: CWE-862 Missing Authorization Description: The UserPro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'userpro_shortcode_template' function in versions up to, and including, 5.1.4. This makes it possible for unauthenticated attackers to arbitrary shortcode execution. An attacker can leverage CVE-2023-2446 to get sensitive information via shortcode. Additional
trary shortcode execution. An attacker can leverage CVE-2023-2446 to get sensitive information via shortcode. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7cbe9175-4a6f-4eb6-8d31-9a9fda9b4f40?source=cve - https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681 - http://packetstormsecurity.com/files/175871/WordPress-UserPro-5.1.x-Password-Reset-Authentication-Bypass-Escalation.html
CVE ID: CVE-2023-2449 State: PUBLISHED Published: 2023-11-22T15:33:36.801Z Last Updated: 2025-02-13T16:44:16.693Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: UserPro - Community and User Profile WordPress Plugin Problem Types: CWE-620 Unverified Password Change Description: The UserPro plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 5.1.1. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function (userpro_process_form). The function uses the plaintext value of a password reset key instead of a hashed value which means
erpro_process_form). The function uses the plaintext value of a password reset key instead of a hashed value which means it can easily be retrieved and subsequently used. An attacker can leverage CVE-2023-2448 and CVE-2023-2446, or another vulnerability like SQL Injection in another plugin or theme installed on the site to successfully exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/de9be7bc-4f8a-4393-8ebb-1b1f141b7585?source=cve - https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681 - http://packetstormsecurity.com/files/175871/WordPress-UserPro-5.1.x-Password-Reset-
profiles-with-social-login/5958681 - http://packetstormsecurity.com/files/175871/WordPress-UserPro-5.1.x-Password-Reset-Authentication-Bypass-Escalation.html
CVE ID: CVE-2023-2450 State: PUBLISHED Published: 2023-06-09T05:33:23.112Z Last Updated: 2024-11-23T13:18:22.051Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: damian-gora Products: FiboSearch – Ajax Search for WooCommerce Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The FiboSearch - AJAX Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.23.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions a
tization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/880573d8-6dad-4a1b-a5db-33e1dc243062?source=cve - https://plugins.trac.wordpress.org/browser/ajax-search-for-woocommerce/tags/1.23.0/includes/Helpers.php#L1229 - https://plugins.trac.wordpress.org/changeset?old_path=%2
search-for-woocommerce/tags/1.23.0/includes/Helpers.php#L1229 - https://plugins.trac.wordpress.org/changeset?old_path=%2Fajax-search-for-woocommerce%2Ftags%2F1.23.0&old=2917453&new_path=%2Fajax-search-for-woocommerce%2Ftags%2F1.24.0&new=2917453&sfp_email=&sfph_mail=
CVE ID: CVE-2023-2451 State: PUBLISHED Published: 2023-05-01T16:00:06.478Z Last Updated: 2024-08-02T06:26:08.427Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online DJ Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Online DJ Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/bookings/view_details.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerabili