Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2012-0995 State: PUBLISHED Published: 2012-02-21T00:00:00 Last Updated: 2024-08-06T18:45:26.464Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in ZENphoto 1.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) msg parameter in an external action to zp-core/admin.php, (2) PATH_INTO to an unspecified URL, as demonstrated using /1/, (3) PATH_INFO to zp-core/admin.php, or (4) album parameter to zp-core/admin-edit.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.zenphoto.org/trac/changeset/8995 - http://www.zenphoto.org/trac/changeset/8994 - https://exchange.xforce
s: - http://www.zenphoto.org/trac/changeset/8995 - http://www.zenphoto.org/trac/changeset/8994 - https://exchange.xforce.ibmcloud.com/vulnerabilities/73083 - http://www.securityfocus.com/bid/51916 - http://secunia.com/advisories/47875 - https://www.htbridge.ch/advisory/HTB23070 - http://archives.neohapsis.com/archives/bugtraq/2012-02/0037.html - http://www.zenphoto.org/news/zenphoto-1.4.2.1
CVE ID: CVE-2012-0996 State: PUBLISHED Published: 2012-02-20T19:00:00Z Last Updated: 2024-09-16T20:36:18.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple directory traversal vulnerabilities in 11in1 1.2.1 stable 12-31-2011 allow remote attackers to read arbitrary files via a .. (dot dot) in the class parameter to (1) index.php or (2) admin/index.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.htbridge.ch/advisory/HTB23071
CVE ID: CVE-2012-0997 State: PUBLISHED Published: 2012-02-20T19:00:00Z Last Updated: 2024-09-17T01:10:49.548Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in admin/index.php in 11in1 1.2.1 stable 12-31-2011 allows remote attackers to hijack the authentication of administrators for requests that add new topics via an addTopic action. Additional Analyst Notes: - CVE Program Container: References: - https://www.htbridge.ch/advisory/HTB23071
CVE ID: CVE-2012-0998 State: PUBLISHED Published: 2012-02-20T19:00:00Z Last Updated: 2024-09-16T23:40:39.011Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in account/preferences.php in LEPTON before 1.1.4 allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the language parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.lepton-cms.org/media/changelog/changelog_1.1.4.txt - http://www.lepton-cms.org/posts/security-release-lepton-1.1.4-52.php - https://www.htbridge.ch/advisory/HTB23072
CVE ID: CVE-2012-0999 State: PUBLISHED Published: 2012-02-20T19:00:00Z Last Updated: 2024-09-16T22:19:45.196Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in modules/news/rss.php in LEPTON before 1.1.4 allows remote attackers to execute arbitrary SQL commands via the group_id parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.lepton-cms.org/media/changelog/changelog_1.1.4.txt - http://www.lepton-cms.org/posts/security-release-lepton-1.1.4-52.php - https://www.htbridge.ch/advisory/HTB23072
CVE ID: CVE-2012-10001 State: PUBLISHED Published: 2021-01-06T14:40:28 Last Updated: 2024-08-06T21:36:01.975Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Limit Login Attempts plugin before 1.7.1 for WordPress does not clear auth cookies upon a lockout, which might make it easier for remote attackers to conduct brute-force authentication attempts. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/limit-login-attempts/#developers
CVE ID: CVE-2012-10002 State: PUBLISHED Published: 2023-01-03T08:22:50.514Z Last Updated: 2025-05-28T13:39:08.692Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: ahmyi Products: RivetTracker Problem Types: CWE-79 Description: A vulnerability was found in ahmyi RivetTracker. It has been declared as problematic. Affected by this vulnerability is the function changeColor of the file css.php. The manipulation of the argument set_css leads to cross site scripting. The attack can be launched remotely. The patch is named 45a0f33876d58cb7e4a0f17da149e58fc893b858. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217267. Additiona
recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217267. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.217267 - https://vuldb.com/?ctiid.217267 - https://github.com/ahmyi/rivettracker/pull/1 - https://github.com/ahmyi/rivettracker/commit/45a0f33876d58cb7e4a0f17da149e58fc893b858
CVE ID: CVE-2012-10003 State: PUBLISHED Published: 2023-01-03T11:03:13.247Z Last Updated: 2024-08-06T21:36:02.353Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: ahmyi Products: RivetTracker Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in ahmyi RivetTracker. This issue affects some unknown processing. The manipulation of the argument $_SERVER['PHP_SELF'] leads to cross site scripting. The attack may be initiated remotely. The patch is named f053c5cc2bc44269b0496b5f275e349928a92ef9. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217271. Additional Analyst Notes:
pply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217271. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.217271 - https://vuldb.com/?ctiid.217271 - https://github.com/ahmyi/rivettracker/pull/1 - https://github.com/ahmyi/rivettracker/commit/f053c5cc2bc44269b0496b5f275e349928a92ef9
CVE ID: CVE-2012-10004 State: PUBLISHED Published: 2023-01-11T06:21:17.015Z Last Updated: 2024-08-06T21:36:02.285Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: backdrop-contrib Products: Basic Cart Problem Types: CWE-79 Description: A vulnerability was found in backdrop-contrib Basic Cart on Drupal. It has been classified as problematic. Affected is the function basic_cart_checkout_form_submit of the file basic_cart.cart.inc. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.x-1.1.1 is able to address this issue. The patch is identified as a10424ccd4b3b4b433cf33b73c1ad608b11890b4. It is recommended to upgrade th
address this issue. The patch is identified as a10424ccd4b3b4b433cf33b73c1ad608b11890b4. It is recommended to upgrade the affected component. VDB-217950 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.217950 - https://vuldb.com/?ctiid.217950 - https://github.com/backdrop-contrib/basic_cart/commit/a10424ccd4b3b4b433cf33b73c1ad608b11890b4 - https://github.com/backdrop-contrib/basic_cart/releases/tag/1.x-1.1.1
CVE ID: CVE-2012-10005 State: PUBLISHED Published: 2023-01-12T15:02:35.908Z Last Updated: 2024-08-06T21:36:02.184Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: manikandan170890 Products: php-form-builder-class Problem Types: CWE-79 Description: A vulnerability has been found in manikandan170890 php-form-builder-class and classified as problematic. Affected by this vulnerability is an unknown functionality of the file PFBC/Element/Textarea.php of the component Textarea Handler. The manipulation of the argument value leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The patch is named 74897993818d8265
be launched remotely. The exploit has been disclosed to the public and may be used. The patch is named 74897993818d826595fd5857038e6703456a594a. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218155. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.218155 - https://vuldb.com/?ctiid.218155 - https://code.google.com/archive/p/php-form-builder-class/issues/184 - https://github.com/manikandan170890/php-form-builder-class/commit/74897993818d826595fd5857038e6703456a594a
CVE ID: CVE-2012-10006 State: PUBLISHED Published: 2023-01-18T15:58:05.172Z Last Updated: 2025-04-03T18:02:22.839Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: ale7714 Products: sigeprosi Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in ale7714 sigeprosi. This affects an unknown part. The manipulation leads to sql injection. The identifier of the patch is 5291886f6c992316407c376145d331169c55f25b. It is recommended to apply a patch to fix this issue. The identifier VDB-218493 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.
vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.218493 - https://vuldb.com/?ctiid.218493 - https://github.com/ale7714/sigeprosi/commit/5291886f6c992316407c376145d331169c55f25b
CVE ID: CVE-2012-10007 State: PUBLISHED Published: 2023-02-19T15:31:03.592Z Last Updated: 2024-08-06T21:36:02.269Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: madgicweb Products: BuddyStream Plugin Problem Types: CWE-79 Description: A vulnerability was found in madgicweb BuddyStream Plugin up to 3.2.7 on WordPress. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file ShareBox.php. The manipulation of the argument content/link/shares leads to cross site scripting. The attack can be launched remotely. Upgrading to version 3.2.8 is able to address this issue. The patch is named 7d5b9a89a27711aad76fd55ab4cc4185b545a1d0. It is
ding to version 3.2.8 is able to address this issue. The patch is named 7d5b9a89a27711aad76fd55ab4cc4185b545a1d0. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-221479. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.221479 - https://vuldb.com/?ctiid.221479 - https://github.com/madgicweb/buddystream/commit/7d5b9a89a27711aad76fd55ab4cc4185b545a1d0 - https://github.com/madgicweb/buddystream/releases/tag/3.2.8
CVE ID: CVE-2012-10008 State: PUBLISHED Published: 2023-02-20T06:31:03.658Z Last Updated: 2025-03-12T19:55:37.012Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: uakfdotb Products: oneapp Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in uakfdotb oneapp. This issue affects some unknown processing. The manipulation leads to sql injection. The attack may be initiated remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named 5413ac804f1b09f9decc46a6c37b08352c49669c. It is recommended to apply a patch to fix this issue. The associated identi
ed 5413ac804f1b09f9decc46a6c37b08352c49669c. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-221483. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.221483 - https://vuldb.com/?ctiid.221483 - https://github.com/uakfdotb/oneapp/commit/5413ac804f1b09f9decc46a6c37b08352c49669c
CVE ID: CVE-2012-10009 State: PUBLISHED Published: 2023-03-20T23:31:03.758Z Last Updated: 2024-08-06T21:36:02.376Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: n/a Products: 404like Plugin Problem Types: CWE-89 Description: A vulnerability was found in 404like Plugin up to 1.0.2 on WordPress. It has been classified as critical. Affected is the function checkPage of the file 404Like.php. The manipulation of the argument searchWord leads to sql injection. It is possible to launch the attack remotely. Upgrading to version 1.0.2 is able to address this issue. The name of the patch is 2c4b589d27554910ab1fd104ddbec9331b540f7f. It is recommended to upgrade the affected component. Th
e name of the patch is 2c4b589d27554910ab1fd104ddbec9331b540f7f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-223404. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.223404 - https://vuldb.com/?ctiid.223404 - https://github.com/wp-plugins/404like/commit/2c4b589d27554910ab1fd104ddbec9331b540f7f - https://github.com/wp-plugins/404like/releases/tag/1.0.2
CVE ID: CVE-2012-10010 State: PUBLISHED Published: 2023-04-09T05:31:03.479Z Last Updated: 2024-08-06T21:36:02.040Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: BestWebSoft Products: Contact Form Problem Types: CWE-352 Description: A vulnerability was found in BestWebSoft Contact Form 3.21. It has been classified as problematic. This affects the function cntctfrm_settings_page of the file contact_form.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 3.22 is able to address this issue. The identifier of the patch is 8398d96ff0fe45ec9267d7259961c2ef89ed8005. It is recommended to upgrade the affected com
. The identifier of the patch is 8398d96ff0fe45ec9267d7259961c2ef89ed8005. It is recommended to upgrade the affected component. The identifier VDB-225321 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.225321 - https://vuldb.com/?ctiid.225321 - https://github.com/wp-plugins/contact-form-plugin/commit/8398d96ff0fe45ec9267d7259961c2ef89ed8005
CVE ID: CVE-2012-10011 State: PUBLISHED Published: 2023-04-09T22:00:04.725Z Last Updated: 2024-08-06T21:36:02.055Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: HD FLV PLayer Plugin Problem Types: CWE-89 Description: A vulnerability was found in HD FLV PLayer Plugin up to 1.7 on WordPress. It has been rated as critical. Affected by this issue is the function hd_add_media/hd_update_media of the file functions.php. The manipulation of the argument name leads to sql injection. The attack may be launched remotely. Upgrading to version 1.8 is able to address this issue. The patch is identified as 34d66b9f3231a0e2dc0e536a6fe615d736e863f7. It is recommended to upgrade t
address this issue. The patch is identified as 34d66b9f3231a0e2dc0e536a6fe615d736e863f7. It is recommended to upgrade the affected component. VDB-225350 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.225350 - https://vuldb.com/?ctiid.225350 - https://github.com/wp-plugins/contus-hd-flv-player/commit/34d66b9f3231a0e2dc0e536a6fe615d736e863f7
CVE ID: CVE-2012-10012 State: PUBLISHED Published: 2023-04-09T23:31:04.030Z Last Updated: 2024-08-06T21:36:02.286Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: BestWebSoft Products: Facebook Like Button Problem Types: CWE-352 Description: A vulnerability has been found in BestWebSoft Facebook Like Button up to 2.13 and classified as problematic. Affected by this vulnerability is the function fcbk_bttn_plgn_settings_page of the file facebook-button-plugin.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The patch is named 33144ae5a45ed07efe7fceca901d91365fdbf7cb. It is recommended to apply a patch to fix this issue. The associated i
s named 33144ae5a45ed07efe7fceca901d91365fdbf7cb. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-225355. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.225355 - https://vuldb.com/?ctiid.225355 - https://github.com/wp-plugins/facebook-button-plugin/commit/33144ae5a45ed07efe7fceca901d91365fdbf7cb
CVE ID: CVE-2012-10013 State: PUBLISHED Published: 2023-04-24T17:31:02.938Z Last Updated: 2024-08-06T21:36:02.352Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Kau-Boy Products: Backend Localization Plugin Problem Types: CWE-79 Description: A vulnerability was found in Kau-Boy Backend Localization Plugin up to 1.6.1 on WordPress. It has been rated as problematic. This issue affects some unknown processing of the file backend_localization.php. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 2.0 is able to address this issue. The patch is named 43dc96defd7944da12ff116476a6890acd7dd24b. It is recommended to upgrade the aff
to address this issue. The patch is named 43dc96defd7944da12ff116476a6890acd7dd24b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-227231. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.227231 - https://vuldb.com/?ctiid.227231 - https://github.com/wp-plugins/kau-boys-backend-localization/commit/43dc96defd7944da12ff116476a6890acd7dd24b - https://github.com/wp-plugins/kau-boys-backend-localization/releases/tag/2.0
CVE ID: CVE-2012-10014 State: PUBLISHED Published: 2023-04-24T17:31:03.965Z Last Updated: 2024-08-06T21:36:02.366Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Kau-Boy Products: Backend Localization Plugin Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in Kau-Boy Backend Localization Plugin 2.0 on WordPress. Affected is the function backend_localization_admin_settings/backend_localization_save_setting/backend_localization_login_form/localize_backend of the file backend_localization.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 2.0.1 is able to address this issu
ss site scripting. It is possible to launch the attack remotely. Upgrading to version 2.0.1 is able to address this issue. The name of the patch is 36f457ee16dd114e510fd91a3ea9fbb3c1f87184. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-227232. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.227232 - https://vuldb.com/?ctiid.227232 - https://github.com/wp-plugins/kau-boys-backend-localization/commit/36f457ee16dd114e510fd91a3ea9fbb3c1f87184 - https://github.com/wp-plugins/kau-boys-backend-localization/releases/tag/2.0.1
CVE ID: CVE-2012-10015 State: PUBLISHED Published: 2023-05-30T23:31:02.724Z Last Updated: 2024-08-06T21:36:02.356Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: BestWebSoft Products: Twitter Plugin Problem Types: CWE-352 Description: A vulnerability was found in BestWebSoft Twitter Plugin up to 2.14 on WordPress. It has been classified as problematic. Affected is the function twttr_settings_page of the file twitter.php of the component Settings Page. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. Upgrading to version 2.15 is able to address this issue. The patch is identified as a6d4659cbb2cbf18ccb0fb43549d5113d74e0146. It is
version 2.15 is able to address this issue. The patch is identified as a6d4659cbb2cbf18ccb0fb43549d5113d74e0146. It is recommended to upgrade the affected component. VDB-230154 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.230154 - https://vuldb.com/?ctiid.230154 - https://github.com/wp-plugins/twitter-plugin/commit/a6d4659cbb2cbf18ccb0fb43549d5113d74e0146
CVE ID: CVE-2012-10016 State: PUBLISHED Published: 2023-10-16T23:31:05.279Z Last Updated: 2024-09-16T15:36:23.383Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Halulu Products: simple-download-button-shortcode Plugin Problem Types: CWE-200 Description: A vulnerability classified as problematic has been found in Halulu simple-download-button-shortcode Plugin 1.0 on WordPress. Affected is an unknown function of the file simple-download-button_dl.php of the component Download Handler. The manipulation of the argument file leads to information disclosure. It is possible to launch the attack remotely. Upgrading to version 1.1 is able to address this issue. The
on disclosure. It is possible to launch the attack remotely. Upgrading to version 1.1 is able to address this issue. The patch is identified as e648a8706818297cf02a665ae0bae1c069dea5f1. It is recommended to upgrade the affected component. VDB-242190 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.242190 - https://vuldb.com/?ctiid.242190 - https://github.com/wp-plugins/simple-download-button-shortcode/commit/e648a8706818297cf02a665ae0bae1c069dea5f1
CVE ID: CVE-2012-10017 State: PUBLISHED Published: 2023-12-26T10:00:05.068Z Last Updated: 2024-11-21T14:14:12.931Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: BestWebSoft Products: Portfolio Plugin Problem Types: CWE-352 Description: A vulnerability was found in BestWebSoft Portfolio Plugin up to 2.04 on WordPress. It has been classified as problematic. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 2.06 is able to address this issue. The patch is named 68af950330c3202a706f0ae9bbb52ceaa17dda9d. It is recommended to upgrade the affected component. The associated identifier
8af950330c3202a706f0ae9bbb52ceaa17dda9d. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-248955. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.248955 - https://vuldb.com/?ctiid.248955 - https://github.com/wp-plugins/portfolio/commit/68af950330c3202a706f0ae9bbb52ceaa17dda9d
CVE ID: CVE-2012-10018 State: PUBLISHED Published: 2024-10-16T06:43:33.160Z Last Updated: 2024-10-16T18:05:36.335Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: sekler Products: Mapplic Lite, Mapplic - Custom Interactive Map WordPress Plugin Problem Types: CWE-918 Description: The Mapplic and Mapplic Lite plugins for WordPress are vulnerable to Server-Side Request Forgery in versions up to, and including 6.1, 1.0 respectively. This makes it possible for attackers to forgery requests coming from a vulnerable site's server and ultimately perform an XSS attack if requesting an SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://ww
orm an XSS attack if requesting an SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5aacabb5-94af-485a-af24-e84db3e3726f?source=cve - https://packetstormsecurity.com/files/161919/ - https://packetstormsecurity.com/files/161920/ - https://www.mapplic.com/docs/#changelog - https://plugins.trac.wordpress.org/changeset/2503447
CVE ID: CVE-2012-10019 State: PUBLISHED Published: 2025-07-19T09:23:52.758Z Last Updated: 2025-07-21T16:25:25.935Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: scribu Products: Front-end Editor Problem Types: CWE-434 Description: The Front End Editor plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the upload.php file in versions before 2.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulner