Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-4994 State: PUBLISHED Published: 2023-09-16T01:52:17.856Z Last Updated: 2025-02-05T19:28:04.095Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: hit-reach Products: Allow PHP in Posts and Pages Problem Types: CWE-94 Improper Control of Generation of Code ('Code Injection') Description: The Allow PHP in Posts and Pages plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.0.4 via the 'php' shortcode. This allows authenticated attackers with subscriber-level permissions or above, to execute code on the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - h
execute code on the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3d8b4bb6-3715-40c1-8140-7fcf874ccec3?source=cve - https://plugins.trac.wordpress.org/browser/allow-php-in-posts-and-pages/trunk/allowphp.php#L373
CVE ID: CVE-2023-4995 State: PUBLISHED Published: 2023-10-13T12:44:49.343Z Last Updated: 2025-02-05T19:16:25.305Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: turn2honey Products: Embed Calendly Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Embed Calendly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'calendly' shortcode in versions up to, and including, 3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitr
ibutes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d1bf83df-7a1f-4572-9c8d-1013750d51d7?source=cve - https://plugins.trac.wordpress.org/browser/embed-calendly-scheduling/tags/3.6/includes/embed.php#L140
CVE ID: CVE-2023-4996 State: PUBLISHED Published: 2023-11-06T10:16:06.626Z Last Updated: 2024-09-05T15:19:00.692Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: Netskope Products: Netskope Client Problem Types: CWE-281 Description: Netskope was made aware of a security vulnerability in its NSClient product for version 100 & prior where a malicious non-admin user can disable the Netskope client by using a specially-crafted package. The root cause of the problem was a user control code when called by a Windows ServiceController did not validate the permissions associated with the user before executing the user control code. This user control code had permissi
ate the permissions associated with the user before executing the user control code. This user control code had permissions to terminate the NSClient service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.netskope.com/company/security-compliance-and-assurance/security-advisories-and-disclosures/netskope-security-advisory-nskpsa-2023-003
CVE ID: CVE-2023-4997 State: PUBLISHED Published: 2023-10-04T10:54:27.047Z Last Updated: 2025-03-03T17:06:01.848Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ProIntegra S.A. Products: UptimeDC Problem Types: CWE-863 Description: Improper authorisation of regular users in ProIntegra Uptime DC software (versions below 2.0.0.33940) allows them to change passwords of all other users including administrators leading to a privilege escalation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.pl/posts/2023/10/CVE-2023-4997/ - https://cert.pl/en/posts/2023/10/CVE-2023-4997/
CVE ID: CVE-2023-4998 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:06:16.784Z Description: No description available.
CVE ID: CVE-2023-4999 State: PUBLISHED Published: 2023-10-20T07:29:29.706Z Last Updated: 2025-02-05T19:04:26.116Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: gopiplus Products: Horizontal scrolling announcement Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Horizontal scrolling announcement plugin for WordPress is vulnerable to SQL Injection via the plugin's [horizontal-scrolling] shortcode in versions up to, and including, 9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authen
user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bf50922a-58a6-4ca4-80b7-cafb37b87216?source=cve - https://plugins.trac.wordpress.org/browser/horizontal-scrolling-announcement/trunk/horizontal-scrolling-announcement.php#L79
CVE ID: CVE-2023-50000 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-08-02T22:09:49.646Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formResetMeshNode. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GD008/TENDA/blob/main/w30e/tenda_w30e_resetMesh/w30e_resetMesh.md
CVE ID: CVE-2023-50001 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-08-02T22:09:49.609Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formUpgradeMeshOnline. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GD008/TENDA/blob/main/w30e/tenda_w30e_upgradeMeshOnline/w30e_upgradeMeshOnline.md
CVE ID: CVE-2023-50002 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-08-02T22:09:49.570Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formRebootMeshNode. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GD008/TENDA/blob/main/w30e/tenda_w30e_rebootMesh/w30e_rebootMesh.md
CVE ID: CVE-2023-50007 State: PUBLISHED Published: 2024-04-19T00:00:00.000Z Last Updated: 2025-06-06T12:48:42.760Z Vendors: n/a Products: n/a Problem Types: n/a Description: FFmpeg v.n6.1-3-g466799d4f5 allows an attacker to trigger use of a parameter of negative size in the av_samples_set_silence function in thelibavutil/samplefmt.c:260:9 component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/FFmpeg/FFmpeg/commit/b1942734c7cbcdc9034034373abcc9ecb9644c47 - https://trac.ffmpeg.org/ticket/10700 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/ - https
doraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/
CVE ID: CVE-2023-50008 State: PUBLISHED Published: 2024-04-19T00:00:00.000Z Last Updated: 2025-06-10T13:26:02.428Z Vendors: n/a Products: n/a Problem Types: n/a Description: FFmpeg v.n6.1-3-g466799d4f5 allows memory consumption when using the colorcorrect filter, in the av_malloc function in libavutil/mem.c:105:9 component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/FFmpeg/FFmpeg/commit/5f87a68cf70dafeab2fb89b42e41a4c29053b89b - https://trac.ffmpeg.org/ticket/10701 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/ - https://lists.fedoraproject.org
ist/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/
CVE ID: CVE-2023-50009 State: PUBLISHED Published: 2024-04-19T00:00:00.000Z Last Updated: 2025-06-09T15:32:00.878Z Vendors: n/a Products: n/a Problem Types: n/a Description: FFmpeg v.n6.1-3-g466799d4f5 allows a heap-based buffer overflow via the ff_gaussian_blur_8 function in libavfilter/edge_template.c:116:5 component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/FFmpeg/FFmpeg - https://trac.ffmpeg.org/ticket/10699 - https://ffmpeg.org/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/ - https://lists.fedoraproject.org/archives/list/package-announc
oraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/ - https://github.com/FFmpeg/FFmpeg/commit/162b4c60c8f72be2e93b759f3b1e14652b70b3ba - https://github.com/FFmpeg/FFmpeg/commit/c443658d26d2b8e19901f9507a890e0efca79056
CVE ID: CVE-2023-50010 State: PUBLISHED Published: 2024-04-19T00:00:00.000Z Last Updated: 2025-06-09T15:22:31.761Z Vendors: n/a Products: n/a Problem Types: n/a Description: FFmpeg v.n6.1-3-g466799d4f5 allows a buffer over-read at ff_gradfun_blur_line_movdqa_sse2, as demonstrated by a call to the set_encoder_id function in /fftools/ffmpeg_enc.c component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://ffmpeg.org/ - https://trac.ffmpeg.org/ticket/10702 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/ - https://lists.fedoraproject.org/archives/list/package-announ
doraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/ - https://github.com/FFmpeg/FFmpeg/commit/e809c23786fe297797198a7b9f5d3392d581daf1 - https://github.com/FFmpeg/FFmpeg/commit/e4d2666bdc3dbd177a81bbf428654a5f2fa3787a - https://git.ffmpeg.org/gitweb/ffmpeg.git/blobdiff/ab0fdaedd1e7224f7e84ea22fcbfaa4ca75a6c06..e4d2666bdc3dbd177a81bbf428654a5f2fa3787a:/libavfilter/vf_gradfun.c
CVE ID: CVE-2023-50011 State: PUBLISHED Published: 2023-12-14T00:00:00 Last Updated: 2024-08-02T22:09:49.635Z Vendors: n/a Products: n/a Problem Types: n/a Description: PopojiCMS version 2.0.1 is vulnerable to remote command execution in the Meta Social field. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/175924/PopojiCMS-2.0.1-Remote-Command-Execution.html
CVE ID: CVE-2023-50015 State: PUBLISHED Published: 2024-03-09T00:00:00 Last Updated: 2024-08-26T14:29:42.037Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Grandstream GXP14XX 1.0.8.9 and GXP16XX 1.0.7.13, allows remote attackers to escalate privileges via incorrect access control using an end-user session-identity token. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/n0obit4/Vulnerability_Disclosure/tree/main/CVE-2023-50015
CVE ID: CVE-2023-50017 State: PUBLISHED Published: 2023-12-14T00:00:00 Last Updated: 2024-08-02T22:09:49.748Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/database/backup Additional Analyst Notes: - CVE Program Container: References: - https://github.com/849200701/cms/blob/main/CSRF%20exists%20in%20the%20backup%20and%20restore%20location.md
CVE ID: CVE-2023-50019 State: PUBLISHED Published: 2024-01-02T00:00:00.000Z Last Updated: 2025-04-17T18:45:06.320Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in open5gs v2.6.6. InitialUEMessage, Registration request sent at a specific time can crash AMF due to incorrect error handling of Nudm_UECM_Registration response. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/open5gs/open5gs/issues/2733 - https://github.com/open5gs/open5gs/commit/7278714133422cee46c32c7523f81ec2cecad9e2
CVE ID: CVE-2023-50020 State: PUBLISHED Published: 2024-01-02T00:00:00.000Z Last Updated: 2025-06-18T15:07:02.651Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in open5gs v2.6.6. SIGPIPE can be used to crash AMF. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/open5gs/open5gs/issues/2734 - https://github.com/open5gs/open5gs/commit/1aba814938e3a1b2eec7014bf6ce132d34622e08
CVE ID: CVE-2023-50026 State: PUBLISHED Published: 2024-02-09T00:00:00.000Z Last Updated: 2025-05-15T19:40:23.117Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Presta Monster "Multi Accessories Pro" (hsmultiaccessoriespro) module for PrestaShop versions 5.1.1 and before, allows remote attackers to escalate privileges and obtain sensitive information via the method HsAccessoriesGroupProductAbstract::getAccessoriesByIdProducts(). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.friendsofpresta.org/modules/2024/02/08/hsmultiaccessoriespro.html
CVE ID: CVE-2023-50027 State: PUBLISHED Published: 2024-01-05T00:00:00.000Z Last Updated: 2025-06-03T14:41:35.841Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in Buy Addons baproductzoommagnifier module for PrestaShop versions 1.0.16 and before, allows remote attackers to escalate privileges and gain sensitive information via BaproductzoommagnifierZoomModuleFrontController::run() method. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.friendsofpresta.org/modules/2023/12/19/baproductzoommagnifier.html
CVE ID: CVE-2023-50028 State: PUBLISHED Published: 2024-01-19T00:00:00.000Z Last Updated: 2025-06-02T15:02:55.938Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the module "Sliding cart block" (blockslidingcart) up to version 2.3.8 from PrestashopModules.eu for PrestaShop, a guest can perform SQL injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://addons.prestashop.com/en/express-checkout-process/3321-block-sliding-cart.html - https://security.friendsofpresta.org/modules/2024/01/16/blockslidingcart.html
CVE ID: CVE-2023-50029 State: PUBLISHED Published: 2024-06-24T00:00:00 Last Updated: 2024-08-02T22:09:49.791Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Injection vulnerability in the module "M4 PDF Extensions" (m4pdf) up to version 3.3.2 from PrestaAddons for PrestaShop allows attackers to run arbitrary code via the M4PDF::saveTemplate() method. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.friendsofpresta.org/modules/2024/06/20/m4pdf.html
CVE ID: CVE-2023-50030 State: PUBLISHED Published: 2024-01-19T00:00:00.000Z Last Updated: 2025-06-17T16:03:52.058Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the module "Jms Setting" (jmssetting) from Joommasters for PrestaShop, a guest can perform SQL injection in versions <= 1.1.0. The method `JmsSetting::getSecondImgs()` has a sensitive SQL call that can be executed with a trivial http call and exploited to forge a blind SQL injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.joommasters.com/ - https://security.friendsofpresta.org/modules/2024/01/16/jmssetting.html
CVE ID: CVE-2023-50035 State: PUBLISHED Published: 2023-12-29T00:00:00 Last Updated: 2024-08-02T22:09:49.706Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection on the Users login panel because of "password" parameter is directly used in the SQL query without any sanitization and the SQL Injection payload being executed. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hackerhijeck/Exploited/blob/main/Small_CRM/SQL-Injection.md
CVE ID: CVE-2023-50038 State: PUBLISHED Published: 2023-12-28T00:00:00 Last Updated: 2024-11-26T14:48:45.476Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an arbitrary file upload vulnerability in the background of textpattern cms v4.8.8, which leads to the loss of server permissions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cnblogs.com/fengzun/articles/17862578.html - https://gist.github.com/LeopoldSkell/7e18bf09005c327a045abbfe39b1e676
CVE ID: CVE-2023-50044 State: PUBLISHED Published: 2023-12-20T00:00:00 Last Updated: 2024-08-02T22:09:49.625Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cesanta MJS 2.20.0 has a getprop_builtin_foreign out-of-bounds read if a Built-in API name occurs in a substring of an input string. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cesanta/mjs/issues/254 - https://github.com/cesanta/mjs/pull/255
CVE ID: CVE-2023-50053 State: PUBLISHED Published: 2024-04-30T00:00:00 Last Updated: 2024-08-02T22:09:49.776Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Foundation.app Foundation platform 1.0 allows a remote attacker to obtain sensitive information via the Web3 authentication process of Foundation, the signed message lacks a nonce (random number) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/d0scoo1/Web3AuthRA
CVE ID: CVE-2023-50059 State: PUBLISHED Published: 2024-04-30T00:00:00 Last Updated: 2024-11-04T19:34:16.385Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue ingalxe.com Galxe platform 1.0 allows a remote attacker to obtain sensitive information via the Web3 authentication process of Galxe, the signed message lacks a nonce (random number) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://galxe.com/
CVE ID: CVE-2023-50061 State: PUBLISHED Published: 2024-02-08T00:00:00 Last Updated: 2024-08-22T18:56:31.708Z Vendors: n/a Products: n/a Problem Types: n/a Description: PrestaShop Op'art Easy Redirect >= 1.3.8 and <= 1.3.12 is vulnerable to SQL Injection via Oparteasyredirect::hookActionDispatcher(). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.store-opart.fr/p/39-module-redirection-prestashop.html - https://security.friendsofpresta.org/modules/2024/02/08/oparteasyredirect.html
CVE ID: CVE-2023-50069 State: PUBLISHED Published: 2023-12-29T00:00:00 Last Updated: 2024-08-02T22:09:49.603Z Vendors: n/a Products: n/a Problem Types: n/a Description: WireMock with GUI versions 3.2.0.0 through 3.0.4.0 are vulnerable to stored cross-site scripting (SXSS) through the recording feature. An attacker can host a malicious payload and perform a test mapping pointing to the attacker's file, and the result will render on the Matched page in the Body area, resulting in the execution of the payload. This occurs because the response body is not validated or sanitized. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/holomekc/wiremock/issues/51
CVE ID: CVE-2023-50070 State: PUBLISHED Published: 2023-12-29T00:00:00 Last Updated: 2024-08-02T22:09:49.622Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Customer Support System 1.0 has multiple SQL injection vulnerabilities in /customer_support/ajax.php?action=save_ticket via department_id, customer_id, and subject. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/geraldoalcantara/CVE-2023-50070 - https://medium.com/%40geraldoalcantarapro/cve-2023-50070-1f58c2a64b1c
CVE ID: CVE-2023-50071 State: PUBLISHED Published: 2023-12-29T00:00:00 Last Updated: 2024-09-03T19:54:34.593Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Customer Support System 1.0 has multiple SQL injection vulnerabilities in /customer_support/ajax.php?action=save_department via id or name. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/geraldoalcantara/CVE-2023-50071 - https://medium.com/%40geraldoalcantarapro/cve-2023-50071-a20767cb3c7b
CVE ID: CVE-2023-50072 State: PUBLISHED Published: 2024-01-13T00:00:00.000Z Last Updated: 2025-06-03T14:03:27.783Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-Site Scripting (XSS) vulnerability exists in OpenKM version 7.1.40 (dbb6e88) With Professional Extension that allows an authenticated user to upload a note on a file which acts as a stored XSS payload. Any user who opens the note of a document file will trigger the XSS. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ahrixia/CVE-2023-50072
CVE ID: CVE-2023-50073 State: PUBLISHED Published: 2023-12-14T00:00:00 Last Updated: 2024-08-02T22:09:49.632Z Vendors: n/a Products: n/a Problem Types: n/a Description: EmpireCMS v7.5 was discovered to contain a SQL injection vulnerability via the ftppassword parameter at SetEnews.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/leadscloud/EmpireCMS/issues/7
CVE ID: CVE-2023-50082 State: PUBLISHED Published: 2024-01-04T00:00:00.000Z Last Updated: 2025-06-09T17:23:13.248Z Vendors: n/a Products: n/a Problem Types: n/a Description: Aoyun Technology pbootcms V3.1.2 is vulnerable to Incorrect Access Control, allows remote attackers to gain sensitive information via session leakage allows a user to avoid logging into the backend management platform. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/juraorab/cve/blob/master/CVE/README.md - https://github.com/juraorab/cve/issues/2
CVE ID: CVE-2023-50089 State: PUBLISHED Published: 2023-12-15T00:00:00 Last Updated: 2024-11-26T15:05:22.907Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Command Injection vulnerability exists in NETGEAR WNR2000v4 version 1.0.0.70. When using HTTP for SOAP authentication, command execution occurs during the process after successful authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.netgear.com/about/security/ - https://github.com/NoneShell/Vulnerabilities/blob/main/NETGEAR/WNR2000v4-1.0.0.70-Authorized-Command-Injection.md
CVE ID: CVE-2023-50090 State: PUBLISHED Published: 2024-01-03T00:00:00.000Z Last Updated: 2025-06-03T14:44:34.030Z Vendors: n/a Products: n/a Problem Types: n/a Description: Arbitrary File Write vulnerability in the saveReportFile method of ureport2 2.2.9 and before allows attackers to write arbitrary files and run arbitrary commands via crafted POST request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lemono.fun/thoughts/UReport2-RCE.html