Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-0468 State: PUBLISHED Published: 2023-01-25T00:00:00.000Z Last Updated: 2025-04-01T15:06:39.092Z Vendors: n/a Products: Kernel Problem Types: Kernel 6.1 RC7 Description: A use-after-free flaw was found in io_uring/poll.c in io_poll_check_events in the io_uring subcomponent in the Linux Kernel due to a race condition of poll_refs. This flaw may cause a NULL pointer dereference. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2164024
CVE ID: CVE-2023-0469 State: PUBLISHED Published: 2023-01-25T00:00:00.000Z Last Updated: 2025-04-01T14:59:46.892Z Vendors: n/a Products: Kernel Problem Types: CWE-191 Description: A use-after-free flaw was found in io_uring/filetable.c in io_install_fixed_file in the io_uring subcomponent in the Linux Kernel during call cleanup. This flaw may lead to a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2163723
CVE ID: CVE-2023-0470 State: PUBLISHED Published: 2023-01-26T00:00:00.000Z Last Updated: 2025-03-31T16:47:34.042Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: modoboa Products: modoboa/modoboa Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository modoboa/modoboa prior to 2.0.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/baae3180-b63b-4880-b2af-1a3f30056c2b - https://github.com/modoboa/modoboa/commit/354ab6884019009249097a7f3a1881d81ecd2fd2
CVE ID: CVE-2023-0471 State: PUBLISHED Published: 2023-01-24T00:00:00 Last Updated: 2024-10-22T15:33:07.710Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in WebTransport in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop_24.html - https://crbug.com/1376354
CVE ID: CVE-2023-0472 State: PUBLISHED Published: 2023-01-24T00:00:00 Last Updated: 2024-10-17T18:00:56.488Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in WebRTC in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop_24.html - https://crbug.com/1405256
CVE ID: CVE-2023-0473 State: PUBLISHED Published: 2023-01-24T00:00:00 Last Updated: 2024-10-17T18:10:08.808Z Vendors: Google Products: Chrome Problem Types: Type Confusion Description: Type Confusion in ServiceWorker API in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop_24.html - https://crbug.com/1404639
CVE ID: CVE-2023-0474 State: PUBLISHED Published: 2023-01-24T00:00:00 Last Updated: 2024-10-17T18:12:19.290Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in GuestView in Google Chrome prior to 109.0.5414.119 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a Chrome web app. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop_24.html - https://crbug.com/1400841
CVE ID: CVE-2023-0475 State: PUBLISHED Published: 2023-02-16T18:35:37.518Z Last Updated: 2025-03-18T14:39:33.175Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H) Vendors: HashiCorp Products: go-getter Problem Types: CWE-409 Description: HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2023-4-go-getter-vulnerable-to-denial-of-service-via-malicious-compressed-archive/50125
CVE ID: CVE-2023-0476 State: PUBLISHED Published: 2023-01-25T00:00:00.000Z Last Updated: 2025-04-01T14:58:52.164Z Vendors: n/a Products: Tenable.sc Problem Types: LDAP Injection Description: A LDAP injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated attacker could generate data in Active Directory using the application account through blind LDAP injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/tns-2023-03
CVE ID: CVE-2023-0477 State: PUBLISHED Published: 2023-03-13T16:03:28.116Z Last Updated: 2025-02-27T20:19:02.028Z Vendors: Unknown Products: Auto Featured Image (Auto Post Thumbnail) Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The Auto Featured Image (Auto Post Thumbnail) WordPress plugin before 3.9.16 includes an AJAX endpoint that allows any user with at least Author privileges to upload arbitrary files, such as PHP files. This is caused by incorrect file extension validation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e5ef74a2-e04a-4a14-bd0e-d6910cd1c4b4
CVE ID: CVE-2023-0479 State: PUBLISHED Published: 2024-01-16T15:55:08.499Z Last Updated: 2025-06-20T16:59:19.436Z Vendors: Unknown Products: Print Invoice & Delivery Notes for WooCommerce Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Print Invoice & Delivery Notes for WooCommerce WordPress plugin before 4.7.2 is vulnerable to reflected XSS by echoing a GET value in an admin note within the WooCommerce orders page. This means that this vulnerability can be exploited for users with the edit_others_shop_orders capability. WooCommerce must be installed and active. This vulnerability is caused by a urldecode() after cleanup with esc_url_raw(), allowing double encoding. Additio
ctive. This vulnerability is caused by a urldecode() after cleanup with esc_url_raw(), allowing double encoding. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/50963747-ae8e-42b4-bb42-cc848be7b92e/
CVE ID: CVE-2023-0480 State: PUBLISHED Published: 2023-04-04T00:00:00.000Z Last Updated: 2025-02-13T16:17:43.747Z Vendors: n/a Products: VitalPBX Problem Types: Cross-site request forgery Description: VitalPBX version 3.2.3-8 allows an unauthenticated external attacker to obtain the instance administrator's account. This is possible because the application is vulnerable to CSRF. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/sharp/ - https://vitalpbx.com/
CVE ID: CVE-2023-0481 State: PUBLISHED Published: 2023-02-24T00:00:00.000Z Last Updated: 2025-03-12T15:29:16.755Z Vendors: n/a Products: Quarkus Problem Types: CWE-378 Description: In RestEasy Reactive implementation of Quarkus the insecure File.createTempFile() is used in the FileBodyHandler class which creates temp files with insecure permissions that could be read by a local user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/quarkusio/quarkus/pull/30694
CVE ID: CVE-2023-0482 State: PUBLISHED Published: 2023-02-17T00:00:00.000Z Last Updated: 2025-03-18T16:02:42.237Z Vendors: n/a Products: RESTEasy Problem Types: CWE-378 Description: In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/resteasy/resteasy/pull/3409/commits/807d7456f2137cde8ef7c316707211bf4e542d56 - https://security.netapp.com/advisory/ntap-20230427-0001/
CVE ID: CVE-2023-0483 State: PUBLISHED Published: 2023-03-09T00:00:00.000Z Last Updated: 2025-02-28T21:31:41.989Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Information exposure through an error message in GitLab Description: An issue has been discovered in GitLab affecting all versions starting from 12.1 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. It was possible for a project maintainer to extract a Datadog integration API key by modifying the site. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git
odifying the site. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/389188 - https://hackerone.com/reports/1836466 - https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0483.json
CVE ID: CVE-2023-0484 State: PUBLISHED Published: 2023-03-27T15:37:28.083Z Last Updated: 2025-02-19T20:08:19.407Z Vendors: Unknown Products: Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks WordPress plugin before 1.1.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e61fb245-0d7f-42b0-9b96-c17a
Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e61fb245-0d7f-42b0-9b96-c17ade8c04c5
CVE ID: CVE-2023-0485 State: PUBLISHED Published: 2023-05-03T00:00:00.000Z Last Updated: 2025-02-12T16:07:11.683Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Information exposure in GitLab Description: An issue has been discovered in GitLab affecting all versions starting from 13.11 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible that a project member demoted to a user role to read project updates by doing a diff with a pre-existing fork. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git
pre-existing fork. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/389191 - https://hackerone.com/reports/1837937 - https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0485.json
CVE ID: CVE-2023-0486 State: PUBLISHED Published: 2023-04-04T00:00:00.000Z Last Updated: 2025-02-13T16:15:52.505Z Vendors: n/a Products: VitalPBX Problem Types: Reflected cross-site scripting (XSS) Description: VitalPBX version 3.2.3-8 allows an unauthenticated external attacker to obtain the instance's administrator account via a malicious link. This is possible because the application is vulnerable to XSS. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vitalpbx.com/ - https://fluidattacks.com/advisories/smith/
CVE ID: CVE-2023-0487 State: PUBLISHED Published: 2023-02-27T15:24:39.913Z Last Updated: 2025-03-10T13:42:09.093Z Vendors: Unknown Products: All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs Problem Types: CWE-89 SQL Injection Description: The My Sticky Elements WordPress plugin before 2.0.9 does not properly sanitise and escape a parameter before using it in a SQL statement when deleting messages, leading to a SQL injection exploitable by high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0e874a1d-c866-45fa-b456-c8012dca32af
CVE ID: CVE-2023-0488 State: PUBLISHED Published: 2023-01-26T00:00:00.000Z Last Updated: 2025-03-31T16:47:00.638Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: pyload Products: pyload/pyload Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository pyload/pyload prior to 0.5.0b3.dev42. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/4311d8d7-682c-4f2a-b92c-3f9f1a36255a - https://github.com/pyload/pyload/commit/46d75a3087f3237d06530d55998938e2e2bda6bd
CVE ID: CVE-2023-0489 State: PUBLISHED Published: 2023-06-19T10:52:49.912Z Last Updated: 2024-12-11T21:19:55.627Z Vendors: Unknown Products: SlideOnline Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The SlideOnline WordPress plugin through 1.2.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/238842ee-6392-4eb2-96cb-08e4ece6fca1
CVE ID: CVE-2023-0490 State: PUBLISHED Published: 2023-05-15T12:15:39.964Z Last Updated: 2025-01-14T19:35:00.208Z Vendors: Unknown Products: f(x) TOC Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The f(x) TOC WordPress plugin through 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/9b497d21-f075-41a9-afec-3e24034c8c63
CVE ID: CVE-2023-0491 State: PUBLISHED Published: 2023-03-27T15:37:32.778Z Last Updated: 2025-02-19T19:35:13.181Z Vendors: Unknown Products: Schedulicity Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Schedulicity WordPress plugin through 2.21 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b1a7e8fc-ffcf-493b-9f2d-ffa5d2348b60
CVE ID: CVE-2023-0492 State: PUBLISHED Published: 2023-02-21T08:50:47.672Z Last Updated: 2025-03-14T14:43:47.590Z Vendors: Unknown Products: GS Products Slider for WooCommerce Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The GS Products Slider for WooCommerce WordPress plugin before 1.5.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ea3b129d-32d8-40e3-b1af-8b92
Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ea3b129d-32d8-40e3-b1af-8b92a760db23
CVE ID: CVE-2023-0493 State: PUBLISHED Published: 2023-01-26T00:00:00.000Z Last Updated: 2025-03-31T16:46:03.476Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: btcpayserver Products: btcpayserver/btcpayserver Problem Types: CWE-76 Description: Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/3a73b45c-6f3e-4536-a327-cdfdbc59896f - https://github.com/btcpayserver/btcpayserver/pull/4545/commits/02070d65836cd24627929b3403efbae8de56039a - http://packetstormsecurity.com/files/171
erver/btcpayserver/pull/4545/commits/02070d65836cd24627929b3403efbae8de56039a - http://packetstormsecurity.com/files/171732/BTCPay-Server-1.7.4-HTML-Injection.html
CVE ID: CVE-2023-0494 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-02-24T17:43:00.816Z Vendors: n/a Products: xorg-x11-server Problem Types: CWE-416 Description: A vulnerability was found in X.Org. This issue occurs due to a dangling pointer in DeepCopyPointerClasses that can be exploited by ProcXkbSetDeviceInfo() and ProcXkbGetDeviceInfo() to read and write into freed memory. This can lead to local privilege elevation on systems where the X server runs privileged and remote code execution for ssh X forwarding sessions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2165995 - htt
CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2165995 - https://lists.x.org/archives/xorg-announce/2023-February/003320.html - https://gitlab.freedesktop.org/xorg/xserver/-/commit/0ba6d8c37071131a49790243cdac55392ecf71ec - https://security.gentoo.org/glsa/202305-30
CVE ID: CVE-2023-0495 State: PUBLISHED Published: 2023-03-27T15:37:24.661Z Last Updated: 2025-02-19T20:10:59.186Z Vendors: Unknown Products: HT Slider For Elementor Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The HT Slider For Elementor WordPress plugin before 1.4.0 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2e3af480-b1a4-404c-b0fc-2b7b6a6b9c27
CVE ID: CVE-2023-0496 State: PUBLISHED Published: 2023-03-27T15:37:37.404Z Last Updated: 2025-02-14T16:03:20.951Z Vendors: Unknown Products: HT Event Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The HT Event WordPress plugin before 1.4.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/451b47d5-7bd2-4a82-9c8e-fe6601bcd2ab
CVE ID: CVE-2023-0497 State: PUBLISHED Published: 2023-03-27T15:37:43.632Z Last Updated: 2025-02-26T19:06:56.409Z Vendors: Unknown Products: HT Portfolio Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The HT Portfolio WordPress plugin before 1.1.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ae5b7776-9d0d-4db8-81c3-237b16cd9c62
CVE ID: CVE-2023-0498 State: PUBLISHED Published: 2023-03-27T15:37:18.168Z Last Updated: 2025-02-19T20:22:35.370Z Vendors: Unknown Products: WP Education Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP Education WordPress plugin before 1.2.7 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8fa051ad-5b35-46d8-be95-0ac4e73d5eff
CVE ID: CVE-2023-0499 State: PUBLISHED Published: 2023-03-27T15:37:22.175Z Last Updated: 2025-02-19T20:18:10.384Z Vendors: Unknown Products: QuickSwish Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The QuickSwish WordPress plugin before 1.1.0 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/9342470a-a0ad-4f0b-b95f-7daa39a6362b
CVE ID: CVE-2023-0500 State: PUBLISHED Published: 2023-03-27T15:37:31.919Z Last Updated: 2025-02-19T19:47:25.481Z Vendors: Unknown Products: WP Film Studio Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP Film Studio WordPress plugin before 1.3.5 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/95a6a11e-da5d-4fac-aff6-a3f7624682b7
CVE ID: CVE-2023-0501 State: PUBLISHED Published: 2023-03-27T15:37:33.856Z Last Updated: 2025-02-19T19:31:10.918Z Vendors: Unknown Products: WP Insurance Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP Insurance WordPress plugin before 2.1.4 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/36fd6c0d-3f0c-4f7d-aa17-5b2d084ab94c
CVE ID: CVE-2023-0502 State: PUBLISHED Published: 2023-03-27T15:37:29.087Z Last Updated: 2025-02-19T20:07:07.974Z Vendors: Unknown Products: WP News Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP News WordPress plugin through 1.1.9 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c959f4ce-b6ea-4aee-9a98-aa98d2a62138
CVE ID: CVE-2023-0503 State: PUBLISHED Published: 2023-03-27T15:37:31.086Z Last Updated: 2025-02-19T20:00:42.084Z Vendors: Unknown Products: Free WooCommerce Theme 99fy Extension Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Free WooCommerce Theme 99fy Extension WordPress plugin before 1.2.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/3cb148fb-1f30-4316-a421-10da51d849f3
CVE ID: CVE-2023-0504 State: PUBLISHED Published: 2023-03-27T15:37:15.425Z Last Updated: 2025-02-19T16:56:46.649Z Vendors: Unknown Products: HT Politic Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The HT Politic WordPress plugin before 2.3.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b427841d-a3ad-4e3a-8964-baad90a9aedb