Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-0036 State: PUBLISHED Published: 2023-01-09T02:24:08.067Z Last Updated: 2025-04-09T13:32:40.228Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-287 Description: platform_callback_stub in misc subsystem within OpenHarmony-v3.0.5 and prior versions has an authentication bypass vulnerability which allows an "SA relay attack".Local attackers can bypass authentication and attack other SAs with high privilege. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2023/2023-01.md
CVE ID: CVE-2023-0037 State: PUBLISHED Published: 2023-03-13T16:03:32.276Z Last Updated: 2025-02-27T20:19:24.314Z Vendors: Unknown Products: 10Web Map Builder for Google Maps Problem Types: CWE-89 SQL Injection Description: The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/33ab1fe2-6611-4f43-91ba-52c56f02ed56 - https://bulletin.iese.de/post/wd-google-maps_1-0-72_1
CVE ID: CVE-2023-0038 State: PUBLISHED Published: 2023-01-03T13:58:25.155Z Last Updated: 2025-01-13T17:15:14.721Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: ays-pro Products: Survey Maker – Best WordPress Survey Plugin Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The "Survey Maker – Best WordPress Survey Plugin" plugin for WordPress is vulnerable to Stored Cross-Site Scripting via survey answers in versions up to, and including, 3.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts when
itization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts when submitting quizzes that will execute whenever a user accesses the submissions page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a2a58fab-d4a3-4333-8495-e094ed85bb61 - https://plugins.trac.wordpress.org/browser/survey-maker/tags/3.1.4/public/partials/class-survey-maker-submissions-summary-shortcode.php?rev=2839688#L311
CVE ID: CVE-2023-0039 State: REJECTED Published: 2023-01-03T14:12:21.885Z Last Updated: 2023-04-12T20:22:12.163Z Description: No description available.
CVE ID: CVE-2023-0040 State: PUBLISHED Published: 2023-01-18T00:00:00.000Z Last Updated: 2025-04-03T19:28:55.800Z Vendors: Swift Project Products: Async HTTP Client Problem Types: CWE-93 Description: Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users are vulnerable if they pass untrusted data into HTTP header field values without prior sanitisation. Common use-cases here might be to place usernames from a database into HTTP header fields. This vulnerability allows attackers to inject new
might be to place usernames from a database into HTTP header fields. This vulnerability allows attackers to inject new HTTP header fields, or entirely new requests, into the data stream. This can cause requests to be understood very differently by the remote server than was intended. In general, this is unlikely to result in data disclosure, but it can result in a number of logical errors and other misbehaviours. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/swift-server/async-http-client/security/advisories/GHSA-v3r5-pjpm-mwgq
CVE ID: CVE-2023-0041 State: PUBLISHED Published: 2023-06-05T00:53:27.660Z Last Updated: 2025-01-08T16:44:22.758Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: IBM Products: Security Guardium Problem Types: CWE-613 Description: IBM Security Guardium 11.5 could allow a user to take over another user's session due to insufficient session expiration. IBM X-Force ID: 243657. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7000021 - https://exchange.xforce.ibmcloud.com/vulnerabilities/243657
CVE ID: CVE-2023-0042 State: PUBLISHED Published: 2023-01-12T00:00:00.000Z Last Updated: 2025-04-08T13:41:06.344Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Url redirection to untrusted site ('open redirect') in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.4 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2. GitLab Pages allows redirection to arbitrary protocols. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab-pages/-/issues/728 - https://gitlab.com/gitlab-org/cves
Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab-pages/-/issues/728 - https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0042.json
CVE ID: CVE-2023-0043 State: PUBLISHED Published: 2023-02-27T15:24:41.583Z Last Updated: 2025-03-10T18:16:21.957Z Vendors: Unknown Products: Custom Add User Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Custom Add User WordPress plugin through 2.0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e012f23a-7daf-4ef3-b116-d0e2ed5bd0a3
CVE ID: CVE-2023-0044 State: PUBLISHED Published: 2023-02-23T00:00:00.000Z Last Updated: 2025-03-12T14:32:14.395Z Vendors: n/a Products: quarkus-vertx-http Problem Types: cross-site attack Description: If the Quarkus Form Authentication session cookie Path attribute is set to `/` then a cross-site attack may be initiated which might lead to the Information Disclosure. This attack can be prevented with the Quarkus CSRF Prevention feature. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-0044 - https://bugzilla.redhat.com/show_bug.cgi?id=2158081
CVE ID: CVE-2023-0045 State: PUBLISHED Published: 2023-04-25T22:44:57.262Z Last Updated: 2025-02-13T16:38:41.984Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Linux Products: Linux Kernel Problem Types: CWE-610 Description: The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The ib_prctl_set function updates the Thread Information Flags (TIFs) for the task and updates the SPEC_CTRL MSR on the function __speculation_ctrl_update, but the IBPB is only issued on the next schedule, when the TIF bits are checked. This leaves the victim vulnerable to values already injected on the BTB, prior to the prctl syscall
IF bits are checked. This leaves the victim vulnerable to values already injected on the BTB, prior to the prctl syscall. The patch that added the support for the conditional mitigation via prctl (ib_prctl_set) dates back to the kernel 4.9.176. We recommend upgrading past commit a664ec9158eeddd75121d39c9a0758016097fa96 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/tip/a664ec9158eeddd75121d39c9a0758016097fa96 - https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html - https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html - https://security.netapp.com/advisory/ntap-20230714-0001/ - https://github.com/goo
n-lts-announce/2023/05/msg00006.html - https://security.netapp.com/advisory/ntap-20230714-0001/ - https://github.com/google/security-research/security/advisories/GHSA-9x5g-vmxf-4qj8
CVE ID: CVE-2023-0046 State: PUBLISHED Published: 2023-01-04T00:00:00.000Z Last Updated: 2025-04-09T15:31:33.690Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: lirantal Products: lirantal/daloradius Problem Types: CWE-641 Description: Improper Restriction of Names for Files and Other Resources in GitHub repository lirantal/daloradius prior to master-branch. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/2214dc41-f283-4342-95b1-34a2f4fea943 - https://github.com/lirantal/daloradius/commit/2013c2d1231e99dac918247b69b198ded1f30a1c
CVE ID: CVE-2023-0047 State: REJECTED Published: N/A Last Updated: 2023-01-27T00:00:00 Description: No description available.
CVE ID: CVE-2023-0048 State: PUBLISHED Published: 2023-01-04T00:00:00.000Z Last Updated: 2025-04-09T15:32:04.681Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: lirantal Products: lirantal/daloradius Problem Types: CWE-94 Description: Code Injection in GitHub repository lirantal/daloradius prior to master-branch. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/57abd666-4b9c-4f59-825d-1ec832153e79 - https://github.com/lirantal/daloradius/commit/3650eea7277a5c278063214a5b71dbd7d77fc5aa
CVE ID: CVE-2023-0049 State: PUBLISHED Published: 2023-01-04T00:00:00.000Z Last Updated: 2025-04-09T15:43:22.524Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-125 Description: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/5e6f325c-ba54-4bf0-b050-dca048fd3fd9 - https://github.com/vim/vim/commit/7b17eb4b063a234376c1ec909ee293e42cff290c - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3Y752EAVACVC5XY2TMGGOAIU25VQRPDW/ - https://lists.f
org/archives/list/package-announce%40lists.fedoraproject.org/message/3Y752EAVACVC5XY2TMGGOAIU25VQRPDW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T33LLWHLH63XDCO5OME7NWN63RA4U5HF/ - https://support.apple.com/kb/HT213670 - http://seclists.org/fulldisclosure/2023/Mar/17 - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2023-0050 State: PUBLISHED Published: 2023-03-09T00:00:00.000Z Last Updated: 2025-02-28T21:28:39.137Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab Description: An issue has been discovered in GitLab affecting all versions starting from 13.7 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. A specially crafted Kroki diagram could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims. Additional Anal
stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/387023 - https://hackerone.com/reports/1731349 - https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0050.json
CVE ID: CVE-2023-0051 State: PUBLISHED Published: 2023-01-04T00:00:00.000Z Last Updated: 2025-04-09T15:42:46.576Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-122 Description: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/1c8686db-baa6-42dc-ba45-aed322802de9 - https://github.com/vim/vim/commit/c32949b0779106ed5710ae3bffc5053e49083ab4 - https://support.apple.com/kb/HT213670 - http://seclists.org/fulldisclosure/2023/Mar/17 - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2023-0052 State: PUBLISHED Published: 2023-01-20T21:23:08.018Z Last Updated: 2025-01-16T21:59:17.430Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SAUTER Controls Products: Nova 220 (EYK220F001) DDC with BACnet connection, Nova 230 (EYK230F001) DDC with BACnet connection, Nova 106 (EYK300F001) BACnet communication card, moduNet300 (EY-AM300F001, EY-AM300F002) Problem Types: CWE-306 Description: SAUTER Controls Nova 200–220 Series with firmware version 3.3-006 and prior and BACnetstac version 4.2.1 and prior allows the execution of commands without credentials. As Telnet and file transfer protocol (FTP) are the only protocols available for de
tion of commands without credentials. As Telnet and file transfer protocol (FTP) are the only protocols available for device management, an unauthorized user could access the system and modify the device configuration, which could result in the unauthorized user executing unrestricted malicious commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-05
CVE ID: CVE-2023-0053 State: PUBLISHED Published: 2023-03-02T00:15:49.817Z Last Updated: 2025-01-16T21:55:31.611Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: SAUTER Controls Products: Nova 220 (EYK220F001) DDC with BACnet connection, Nova 230 (EYK230F001) DDC with BACnet connection, Nova 106 (EYK300F001) BACnet communication card, moduNet300 (EY-AM300F001, EY-AM300F002) Problem Types: CWE-319 Description: SAUTER Controls Nova 200–220 Series with firmware version 3.3-006 and prior and BACnetstac version 4.2.1 and prior have only FTP and Telnet available for device management. Any sensitive information communicated through these protocols, such as credential
lnet available for device management. Any sensitive information communicated through these protocols, such as credentials, is sent in cleartext. An attacker could obtain sensitive information such as user credentials to gain access to the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-05
CVE ID: CVE-2023-0054 State: PUBLISHED Published: 2023-01-04T00:00:00.000Z Last Updated: 2025-11-03T20:35:15.724Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-787 Description: Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/b289ee0f-fd16-4147-bd01-c6289c45e49d - https://github.com/vim/vim/commit/3ac1d97a1d9353490493d30088256360435f7731 - https://support.apple.com/kb/HT213670 - http://seclists.org/fulldisclosure/2023/Mar/17 - https://security.gentoo.org/glsa/202305-16 - https://lists
b/HT213670 - http://seclists.org/fulldisclosure/2023/Mar/17 - https://security.gentoo.org/glsa/202305-16 - https://lists.debian.org/debian-lts-announce/2023/06/msg00015.html
CVE ID: CVE-2023-0055 State: PUBLISHED Published: 2023-01-04T00:00:00.000Z Last Updated: 2025-04-09T15:32:47.320Z Severity: LOW (CVSS 3.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: pyload Products: pyload/pyload Problem Types: CWE-614 Description: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository pyload/pyload prior to 0.5.0b3.dev32. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/ed88e240-99ff-48a1-bf32-8e1ef5f13cce - https://github.com/pyload/pyload/commit/7b53b8d43c2c072b457dcd19c8a09bcfc3721703
CVE ID: CVE-2023-0056 State: PUBLISHED Published: 2023-03-23T00:00:00.000Z Last Updated: 2025-02-25T19:35:27.521Z Vendors: n/a Products: haproxy Problem Types: CWE-400 Description: An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service. This issue could allow an authenticated remote attacker to run a specially crafted malicious server in an OpenShift cluster. The biggest impact is to availability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-0056
CVE ID: CVE-2023-0057 State: PUBLISHED Published: 2023-01-05T00:00:00.000Z Last Updated: 2025-04-09T15:33:56.198Z Severity: LOW (CVSS 3.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: pyload Products: pyload/pyload Problem Types: CWE-1021 Description: Improper Restriction of Rendered UI Layers or Frames in GitHub repository pyload/pyload prior to 0.5.0b3.dev33. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/12b64f91-d048-490c-94b0-37514b6d694d - https://github.com/pyload/pyload/commit/bd2a31b7de54570b919aa1581d486e6ee18c0f64
CVE ID: CVE-2023-0058 State: PUBLISHED Published: 2023-08-16T11:03:23.680Z Last Updated: 2024-08-02T04:54:32.601Z Vendors: Unknown Products: Tiempo.com Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The Tiempo.com WordPress plugin through 0.1.2 does not have CSRF check when creating and editing its shortcode, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0e677df9-2c49-42f0-a8e2-dbcf85bfc1a2
CVE ID: CVE-2023-0059 State: PUBLISHED Published: 2023-02-21T08:51:00.517Z Last Updated: 2025-03-12T20:51:33.309Z Vendors: Unknown Products: Youzify Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Youzify WordPress plugin before 1.2.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5e26c485-9a5a-44a3-95b3-6c063a1c321c
CVE ID: CVE-2023-0060 State: PUBLISHED Published: 2023-02-13T14:32:06.427Z Last Updated: 2025-03-21T14:32:47.993Z Vendors: Unknown Products: Responsive Gallery Grid Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Responsive Gallery Grid WordPress plugin before 2.3.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/be2fc859-3158-4f06-861d-382381a7551b
CVE ID: CVE-2023-0061 State: PUBLISHED Published: 2023-02-13T14:32:15.138Z Last Updated: 2025-03-21T19:28:04.439Z Vendors: Unknown Products: Judge.me Product Reviews for WooCommerce Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Judge.me Product Reviews for WooCommerce WordPress plugin before 1.3.21 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a1d0d131-c773-
t Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a1d0d131-c773-487e-88f8-e3d63936fbbb
CVE ID: CVE-2023-0062 State: PUBLISHED Published: 2023-02-06T19:59:33.722Z Last Updated: 2025-03-25T18:09:07.360Z Vendors: Unknown Products: EAN for WooCommerce Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The EAN for WooCommerce WordPress plugin before 4.4.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/450f94a3-56b1-41c7-ac29-fbda1dc04794
CVE ID: CVE-2023-0063 State: PUBLISHED Published: 2023-03-06T13:34:02.007Z Last Updated: 2025-03-06T15:08:55.653Z Vendors: Unknown Products: WordPress Shortcodes Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WordPress Shortcodes WordPress plugin through 1.6.36 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2262f2fc-8122-46ed-8e67-8c34ee35fc97
CVE ID: CVE-2023-0064 State: PUBLISHED Published: 2023-03-06T13:34:06.078Z Last Updated: 2025-03-06T15:00:19.595Z Vendors: Unknown Products: eVision Responsive Column Layout Shortcodes Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The eVision Responsive Column Layout Shortcodes WordPress plugin through 2.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/97be5795-b
alyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/97be5795-b5b8-40c7-80bf-7da95da7705a
CVE ID: CVE-2023-0065 State: PUBLISHED Published: 2023-03-06T13:34:06.872Z Last Updated: 2025-03-06T14:57:42.361Z Vendors: Unknown Products: i2 Pros & Cons Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The i2 Pros & Cons WordPress plugin through 1.3.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/42c3ac68-4bbc-4d47-ad53-2c9ed48cd677
CVE ID: CVE-2023-0066 State: PUBLISHED Published: 2023-03-13T16:03:28.952Z Last Updated: 2025-02-27T20:26:54.146Z Vendors: Unknown Products: Companion Sitemap Generator Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Companion Sitemap Generator WordPress plugin through 4.5.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/545c9e2f-bacd-4f30-ae01-de1583e26d32