Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-5283 State: PUBLISHED Published: 2023-09-29T19:00:08.080Z Last Updated: 2024-08-02T07:52:08.574Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Engineers Online Portal Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been rated as critical. This issue affects some unknown processing of the file teacher_signup.php. The manipulation of the argument firstname/lastname leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240911. Additional Analyst Note
ed to the public and may be used. The associated identifier of this vulnerability is VDB-240911. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.240911 - https://vuldb.com/?ctiid.240911 - https://github.com/llixixi/Engineers-Online-Portal-System/blob/main/Engineers%20Online%20Portal%20System%20teacher_signup.php%20%20has%20Sqlinjection.pdf
CVE ID: CVE-2023-5284 State: PUBLISHED Published: 2023-09-29T19:31:04.095Z Last Updated: 2024-08-02T07:52:08.544Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Engineers Online Portal Problem Types: CWE-434 Description: A vulnerability classified as critical has been found in SourceCodester Engineers Online Portal 1.0. Affected is an unknown function of the file upload_save_student.php. The manipulation of the argument uploaded_file leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240912. Additional Analyst Notes: - CISA
sed to the public and may be used. The identifier of this vulnerability is VDB-240912. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.240912 - https://vuldb.com/?ctiid.240912 - https://github.com/llixixi/Engineers-Online-Portal-System/blob/main/Engineers%20Online%20Portal%20System%20upload_save_student.php%20has%20a%20file%20upload%20(RCE)%20vulnerability.pdf
CVE ID: CVE-2023-5285 State: PUBLISHED Published: 2023-09-29T19:31:05.300Z Last Updated: 2024-08-02T07:52:08.716Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Tongda Products: OA 2017 Problem Types: CWE-89 Description: A vulnerability classified as critical was found in Tongda OA 2017. Affected by this vulnerability is an unknown functionality of the file general/hr/recruit/recruitment/delete.php. The manipulation of the argument RECRUITMENT_ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. T
e used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-240913 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.240913 - https://vuldb.com/?ctiid.240913 - https://github.com/OliverWu23/cve/blob/main/sql.md
CVE ID: CVE-2023-5286 State: PUBLISHED Published: 2023-09-29T20:00:07.318Z Last Updated: 2024-09-23T16:21:42.321Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Expense Tracker App Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in SourceCodester Expense Tracker App v1. Affected by this issue is some unknown functionality of the file add_category.php of the component Category Handler. The manipulation of the argument category_name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-240914 is the identifier assigned to t
nched remotely. The exploit has been disclosed to the public and may be used. VDB-240914 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.240914 - https://vuldb.com/?ctiid.240914 - https://github.com/xcodeOn1/XSS-Stored-Expense-Tracker-App
CVE ID: CVE-2023-5287 State: PUBLISHED Published: 2023-09-29T20:00:08.695Z Last Updated: 2024-09-23T16:19:57.759Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: n/a Products: BEECMS Problem Types: CWE-79 Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as problematic, was found in BEECMS 4.0. This affects an unknown part of the file /admin/admin_content_tag.php?action=save_content. The manipulation of the argument tag leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240915. NOTE: This vulnerability o
to the public and may be used. The associated identifier of this vulnerability is VDB-240915. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.240915 - https://vuldb.com/?ctiid.240915 - https://github.com/zhenjiaqi/CVE/issues/1
CVE ID: CVE-2023-5288 State: PUBLISHED Published: 2023-09-29T11:37:56.571Z Last Updated: 2024-12-09T14:08:49.408Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SICK AG Products: SIM1012 Problem Types: CWE-284 Description: A remote unauthorized attacker may connect to the SIM1012, interact with the device and change configuration settings. The adversary may also reset the SIM and in the worst case upload a new firmware version to the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://sick.com/.well-known/csaf/white/2023/sca-2023-0008.pdf - https://sick.com/.well-known/csaf/whi
/sick.com/psirt - https://sick.com/.well-known/csaf/white/2023/sca-2023-0008.pdf - https://sick.com/.well-known/csaf/white/2023/sca-2023-0008.json
CVE ID: CVE-2023-5289 State: PUBLISHED Published: 2023-09-29T13:59:17.250Z Last Updated: 2024-09-23T17:13:06.116Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: ikus060 Products: ikus060/rdiffweb Problem Types: CWE-770 Description: Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.8.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/8d0e0804-d3fd-49fe-bfa4-7a91135767ce - https://github.com/ikus060/rdiffweb/commit/06f89b43469aae70e8833e55192721523f86c5a2
CVE ID: CVE-2023-5290 State: REJECTED Published: N/A Last Updated: 2023-10-02T14:16:30.992809Z Description: No description available.
CVE ID: CVE-2023-5291 State: PUBLISHED Published: 2023-10-04T01:52:39.859Z Last Updated: 2025-02-05T19:17:13.503Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: awordpresslife Products: Blog Filter – Advanced Post Filtering with Categories Or Tags, Post Portfolio Gallery, Blog Design Template, Post Layout Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Blog Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'AWL-BlogFilter' shortcode in versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping on user supplied attribute
rsions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b95c1bf7-bb05-44d3-a185-7e38e62b7201?source=cve - https://plugins.trac.wordpress.org/browser/blog-filter/tags/1.5.3/blog-filter-output.php#L128 - https://plugins.trac.wordpress.org/changeset/2974261/blog-filter#file54
CVE ID: CVE-2023-5292 State: PUBLISHED Published: 2023-10-20T07:29:35.924Z Last Updated: 2025-02-05T19:03:36.322Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: hwk-fr Products: Advanced Custom Fields: Extended Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'acfe_form' shortcode in versions up to, and including, 0.8.9.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-lev
and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dcbe0c72-d518-45d3-a220-896a51071b26?source=cve - https://plugins.trac.wordpress.org/browser/acf-extended/tags/0.8.9.3/includes/modules/form/module-form-front.php#L669 - https://plugins.trac.wordpress.org/browser/acf-extended/tags/0.8.9.4/includes/modules/form/module-form-front.php#L669 - https://plugins
.trac.wordpress.org/browser/acf-extended/tags/0.8.9.4/includes/modules/form/module-form-front.php#L669 - https://plugins.trac.wordpress.org/changeset/2972880/acf-extended#file4
CVE ID: CVE-2023-5293 State: PUBLISHED Published: 2023-09-29T20:31:04.683Z Last Updated: 2024-08-02T07:52:08.584Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: n/a Products: ECshop Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in ECshop 4.1.5. Affected is an unknown function of the file /admin/leancloud.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240924. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.240924 - https://v
is VDB-240924. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.240924 - https://vuldb.com/?ctiid.240924 - https://github.com/xhcccan/code/issues/1
CVE ID: CVE-2023-5294 State: PUBLISHED Published: 2023-09-29T21:00:08.582Z Last Updated: 2025-06-18T13:59:20.438Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: n/a Products: ECshop Problem Types: CWE-89 Description: A vulnerability has been found in ECshop 4.1.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/order.php. The manipulation of the argument goods_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240925 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Re
40925 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.240925 - https://vuldb.com/?ctiid.240925 - https://github.com/xhcccan/code/issues/2
CVE ID: CVE-2023-5295 State: PUBLISHED Published: 2023-09-30T02:33:28.888Z Last Updated: 2025-02-05T19:17:37.326Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: vivacityinfotechjaipur Products: Comments by Startbit Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Blog Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'vivafbcomment' shortcode in versions up to, and including, 1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissi
n user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/602b3b9c-76a7-4b0b-8aad-e554c2fd6910?source=cve - https://plugins.trac.wordpress.org/browser/facebook-comment-by-vivacity/tags/1.4/user-file.php#L172
CVE ID: CVE-2023-5296 State: PUBLISHED Published: 2023-09-29T21:31:04.441Z Last Updated: 2024-09-23T16:17:38.603Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Xinhu Products: RockOA Problem Types: CWE-640 Description: A vulnerability was found in Xinhu RockOA 1.1/2.3.2/15.X3amdi and classified as problematic. Affected by this issue is some unknown functionality of the file api.php?m=reimplat&a=index of the component Password Handler. The manipulation leads to weak password recovery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-240926 is the identifier assigned to this vulnerability. Additional Anal
en disclosed to the public and may be used. VDB-240926 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.240926 - https://vuldb.com/?ctiid.240926 - https://github.com/magicwave18/vuldb/issues/1
CVE ID: CVE-2023-5297 State: PUBLISHED Published: 2023-09-29T21:31:05.504Z Last Updated: 2024-09-20T16:53:23.484Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Xinhu Products: RockOA Problem Types: CWE-530 Description: A vulnerability was found in Xinhu RockOA 2.3.2. It has been classified as problematic. This affects the function start of the file task.php?m=sys|runt&a=beifen. The manipulation leads to exposure of backup file to an unauthorized control sphere. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The
ther high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240927. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.240927 - https://vuldb.com/?ctiid.240927 - https://github.com/magicwave18/vuldb/issues/2
CVE ID: CVE-2023-5298 State: PUBLISHED Published: 2023-09-30T05:31:04.178Z Last Updated: 2024-09-20T16:43:14.303Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Tongda Products: OA 2017 Problem Types: CWE-89 Description: A vulnerability was found in Tongda OA 2017. It has been rated as critical. Affected by this issue is some unknown functionality of the file general/hr/recruit/requirements/delete.php. The manipulation of the argument REQUIREMENTS_ID leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. VDB-240938 is
ading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. VDB-240938 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.240938 - https://vuldb.com/?ctiid.240938 - https://github.com/szh0105/cve/blob/main/sql.md
CVE ID: CVE-2023-5299 State: PUBLISHED Published: 2023-11-22T00:41:18.654Z Last Updated: 2024-09-04T18:39:16.616Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Fuji Electric Products: Tellus Lite V-Simulator Problem Types: CWE-284 Description: A user with a standard account in Fuji Electric Tellus Lite may overwrite files in the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-325-02 - https://felib.fujielectric.co.jp/en/M10009/M20034/document_detail/c27d5b69-68ef-4af5-90ee-b5dab118f71a
CVE ID: CVE-2023-5300 State: PUBLISHED Published: 2023-09-30T10:00:05.991Z Last Updated: 2024-08-02T07:52:08.546Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: TTSPlanning Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in TTSPlanning up to 20230925. This affects an unknown part. The manipulation of the argument uid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240939. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.240
939. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.240939 - https://vuldb.com/?ctiid.240939 - https://github.com/CV3TR4CK/CV3Cyb3R/blob/main/2023/TTSPlanning/TTSPlanning.md
CVE ID: CVE-2023-5301 State: PUBLISHED Published: 2023-09-30T10:31:04.312Z Last Updated: 2024-09-20T16:25:03.043Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: n/a Products: DedeCMS Problem Types: CWE-78 Description: A vulnerability classified as critical was found in DedeCMS 5.7.111. This vulnerability affects the function AddMyAddon of the file album_add.php. The manipulation of the argument albumUploadFiles leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240940. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
is vulnerability is VDB-240940. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.240940 - https://vuldb.com/?ctiid.240940 - https://github.com/Lamber-maybe/cve/blob/main/DedeCMS%20V5.7.111%20Remote%20Code%20Execution%20Vulnerability.md
CVE ID: CVE-2023-5302 State: PUBLISHED Published: 2023-09-30T12:00:07.117Z Last Updated: 2024-09-20T16:24:16.672Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Best Courier Management System Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in SourceCodester Best Courier Management System 1.0. This issue affects some unknown processing of the component Manage Account Page. The manipulation of the argument First Name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240941 was assigned to this vulnerabil
The exploit has been disclosed to the public and may be used. The identifier VDB-240941 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.240941 - https://vuldb.com/?ctiid.240941 - https://github.com/rohit0x5/poc/blob/main/cve_2
CVE ID: CVE-2023-5303 State: PUBLISHED Published: 2023-09-30T13:31:04.100Z Last Updated: 2024-08-02T07:52:08.551Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: n/a Products: Online Banquet Booking System Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in Online Banquet Booking System 1.0. Affected is an unknown function of the file /view-booking-detail.php of the component Account Detail Handler. The manipulation of the argument username leads to cross site scripting. It is possible to launch the attack remotely. VDB-240942 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE
y. VDB-240942 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.240942 - https://vuldb.com/?ctiid.240942
CVE ID: CVE-2023-5304 State: PUBLISHED Published: 2023-09-30T14:00:08.799Z Last Updated: 2024-08-02T07:52:08.629Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: n/a Products: Online Banquet Booking System Problem Types: CWE-79 Description: A vulnerability has been found in Online Banquet Booking System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /book-services.php of the component Service Booking. The manipulation of the argument message leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-240943. Additional Analyst Notes: - CISA ADP Vulnrichment: -
ly. The associated identifier of this vulnerability is VDB-240943. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.240943 - https://vuldb.com/?ctiid.240943
CVE ID: CVE-2023-5305 State: PUBLISHED Published: 2023-09-30T14:31:04.346Z Last Updated: 2024-08-02T07:52:08.533Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: n/a Products: Online Banquet Booking System Problem Types: CWE-79 Description: A vulnerability was found in Online Banquet Booking System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /mail.php of the component Contact Us Page. The manipulation of the argument message leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-240944. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Referenc
f this vulnerability is VDB-240944. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.240944 - https://vuldb.com/?ctiid.240944
CVE ID: CVE-2023-5306 State: REJECTED Published: 2023-10-31T21:21:13.541Z Last Updated: 2024-01-02T15:08:46.922Z Description: No description available.
CVE ID: CVE-2023-5307 State: PUBLISHED Published: 2023-10-31T13:54:43.166Z Last Updated: 2025-04-22T20:03:31.145Z Vendors: Unknown Products: Photos and Files Contest Gallery Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Photos and Files Contest Gallery WordPress plugin before 21.2.8.1 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks via certain headers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/6fac1e09-21ab-430d-b56d-195e7238c08c - https://research.cleantalk.org/cve-2023-5307-photos-and-files-contest-gallery-contact
1e09-21ab-430d-b56d-195e7238c08c - https://research.cleantalk.org/cve-2023-5307-photos-and-files-contest-gallery-contact-form-21-2-8-1-unauthenticated-stored-xss-via-http-headers
CVE ID: CVE-2023-5308 State: PUBLISHED Published: 2023-10-20T06:35:09.756Z Last Updated: 2025-02-05T19:11:21.012Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: secondlinethemes Products: Podcast Subscribe Buttons Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Podcast Subscribe Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'podcast_subscribe' shortcode in versions up to, and including, 1.4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level