Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
the public and may be used. The identifier of this vulnerability is VDB-214588. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.214588 - https://vuldb.com/?ctiid.214588 - https://github.com/lithonn/bug-report/tree/main/vendors/oretnom23/bsms_ci/broken-access-control
CVE ID: CVE-2022-4230 State: PUBLISHED Published: 2023-01-23T14:31:43.539Z Last Updated: 2025-04-02T15:35:05.010Z Vendors: Unknown Products: WP Statistics Problem Types: CWE-89 SQL Injection Description: The WP Statistics WordPress plugin before 13.2.9 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks. By default, the affected feature is available to users with the manage_options capability (admin+), however the plugin has a settings to allow low privilege users to access it as well. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a0e40cfd-b217-481c-8fc4-027a0a023312
CVE ID: CVE-2022-4231 State: PUBLISHED Published: 2022-11-30T00:00:00.000Z Last Updated: 2025-04-15T13:10:58.592Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Tribal Systems Products: Zenario CMS Problem Types: CWE-384 Description: A vulnerability, which was classified as problematic, has been found in Tribal Systems Zenario CMS 9.3.57595. This issue affects some unknown processing of the component Remember Me Handler. The manipulation leads to session fixiation. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-214589 was assigned to this vulnerability. Additional Analyst Notes: - CVE P
public and may be used. The identifier VDB-214589 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/lithonn/bug-report/tree/main/vendors/tribalsystems/zenario/session-fixation - https://vuldb.com/?id.214589
CVE ID: CVE-2022-4232 State: PUBLISHED Published: 2022-11-30T00:00:00 Last Updated: 2024-08-03T01:34:49.949Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Event Registration System Problem Types: CWE-266 Description: A vulnerability, which was classified as critical, was found in SourceCodester Event Registration System 1.0. Affected is an unknown function. The manipulation of the argument cmd leads to unrestricted upload. It is possible to launch the attack remotely. VDB-214590 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.214590
CVE ID: CVE-2022-4233 State: PUBLISHED Published: 2022-11-30T00:00:00.000Z Last Updated: 2025-04-15T13:10:49.613Z Severity: LOW (CVSS 2.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N) Vendors: SourceCodester Products: Event Registration System Problem Types: CWE-707 Description: A vulnerability has been found in SourceCodester Event Registration System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /event/admin/?page=user/list. The manipulation of the argument First Name/Last Name leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-214591. Additional Analyst Notes
attack can be launched remotely. The associated identifier of this vulnerability is VDB-214591. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.214591
CVE ID: CVE-2022-4234 State: PUBLISHED Published: 2022-11-30T00:00:00.000Z Last Updated: 2025-04-15T13:10:42.666Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: SourceCodester Products: Canteen Management System Problem Types: CWE-707 Description: A vulnerability was found in SourceCodester Canteen Management System. It has been rated as problematic. This issue affects the function builtin_echo of the file youthappam/brand.php. The manipulation of the argument brand_name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-214595
exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-214595. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jianshu.com/p/3efa724c789d?v=1669372054033 - https://vuldb.com/?id.214595
CVE ID: CVE-2022-4235 State: PUBLISHED Published: 2023-01-18T00:00:00.000Z Last Updated: 2025-04-03T19:28:19.566Z Vendors: n/a Products: RushBet Problem Types: Universal XSS Description: RushBet version 2022.23.1-b490616d allows a remote attacker to steal customer accounts via use of a malicious application. This is possible because the application exposes an activity and does not properly validate the data it receives. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/miller/
CVE ID: CVE-2022-4236 State: PUBLISHED Published: 2023-01-02T21:49:30.203Z Last Updated: 2025-04-10T18:47:32.231Z Vendors: Unknown Products: Welcart e-Commerce Problem Types: CWE-552 Files or Directories Accessible to External Parties Description: The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file via an AJAX action available to any authenticated users, which could allow users with a role as low as subscriber to read arbitrary files on the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/436d8894-dab8-41ea-8ed0-a3338aded635
CVE ID: CVE-2022-4237 State: PUBLISHED Published: 2023-01-02T21:49:40.901Z Last Updated: 2025-04-10T18:35:37.520Z Vendors: Unknown Products: Welcart e-Commerce Problem Types: CWE-502 Deserialization of Untrusted Data Description: The Welcart e-Commerce WordPress plugin before 2.8.6 does not validate user input before using it in file_exist() functions via various AJAX actions available to any authenticated users, which could allow users with a role as low as subscriber to perform PHAR deserialisation when they can upload a file and a suitable gadget chain is present on the blog Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulner
blog Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7a4b790c-49ae-46bc-9544-e188deae243f
CVE ID: CVE-2022-4239 State: PUBLISHED Published: 2022-12-26T12:28:20.678Z Last Updated: 2025-04-14T13:03:59.588Z Vendors: Unknown Products: Workreap Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The Workreap WordPress theme before 2.6.4 does not verify that an addon service belongs to the user issuing the request, or indeed that it is an addon service, when processing the workreap_addons_service_remove action, allowing any user to delete any post by knowing or guessing the id. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1c163987-fb53-43f7-bbff-1c2d8c0d694c
CVE ID: CVE-2022-4240 State: PUBLISHED Published: 2023-05-30T16:15:50.508Z Last Updated: 2025-01-09T21:27:24.395Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Honeywell Products: OneWireless Problem Types: CWE-306 Description: Missing Authentication for Critical Function vulnerability in Honeywell OneWireless allows Authentication Bypass. This issue affects OneWireless version 322.1 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://process.honeywell.com/
CVE ID: CVE-2022-4242 State: PUBLISHED Published: 2022-12-26T12:28:19.122Z Last Updated: 2025-04-14T13:26:04.172Z Vendors: Unknown Products: WP Google Review Slider Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Google Review Slider WordPress plugin before 11.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d7f89335-630c-47c6-bebf-92f556caa087
CVE ID: CVE-2022-4243 State: PUBLISHED Published: 2022-12-26T12:28:00.192Z Last Updated: 2025-04-11T23:22:25.024Z Vendors: Unknown Products: ImageInject Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The ImageInject WordPress plugin through 1.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/fc1fc057-97ee-4a10-909f-2f11eafa0bd0
CVE ID: CVE-2022-4244 State: PUBLISHED Published: 2023-09-25T19:20:04.703Z Last Updated: 2024-08-03T01:34:49.883Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: RHINT Camel-K-1.10.1, RHPAM 7.13.1 async, A-MQ Clients 2, Red Hat A-MQ Online, Red Hat build of Apache Camel for Spring Boot, Red Hat build of Quarkus, Red Hat Data Grid 8, Red Hat Decision Manager 7, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Integration Camel Quarkus, Red Hat Integration Change Data Capture, Red Hat Integration Service Registry, Red Hat JBoss A-MQ 7, Red Hat JBoss Data Grid 7, Red Hat JBoss Enterprise Application Pla
Integration Service Registry, Red Hat JBoss A-MQ 7, Red Hat JBoss Data Grid 7, Red Hat JBoss Enterprise Application Platform 6, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat JBoss Fuse 6, Red Hat JBoss Fuse 7, Red Hat JBoss Fuse Service Works 6, Red Hat JBoss Web Server 3, Red Hat JBoss Web Server 5, Red Hat OpenShift Application Runtimes, Red Hat Process Automation 7, Red Hat Single Sign-On 7, Red Hat Software Collections, Red Hat support for Spring Boot Problem Types: CWE-22 Description: A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directo
found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and their variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on the file system, including application source code, configuration, and other critical system files. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:2135 - https://access.redhat.com/errata/RHSA-2023:3906 - https://access.redhat.com/security/cve/CVE-2022-4244 - https://bu
35 - https://access.redhat.com/errata/RHSA-2023:3906 - https://access.redhat.com/security/cve/CVE-2022-4244 - https://bugzilla.redhat.com/show_bug.cgi?id=2149841
CVE ID: CVE-2022-4245 State: PUBLISHED Published: 2023-09-25T19:20:57.329Z Last Updated: 2024-08-03T01:34:49.896Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Red Hat Products: RHINT Camel-K-1.10.1, RHPAM 7.13.1 async, A-MQ Clients 2, Red Hat A-MQ Online, Red Hat build of Apache Camel for Spring Boot, Red Hat build of Quarkus, Red Hat Data Grid 8, Red Hat Decision Manager 7, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Integration Camel Quarkus, Red Hat Integration Change Data Capture, Red Hat Integration Service Registry, Red Hat JBoss A-MQ 7, Red Hat JBoss Data Grid 7, Red Hat JBoss Enterprise Application P
at Integration Service Registry, Red Hat JBoss A-MQ 7, Red Hat JBoss Data Grid 7, Red Hat JBoss Enterprise Application Platform 6, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat JBoss Fuse 6, Red Hat JBoss Fuse 7, Red Hat JBoss Fuse Service Works 6, Red Hat JBoss Web Server 3, Red Hat JBoss Web Server 5, Red Hat OpenShift Application Runtimes, Red Hat Process Automation 7, Red Hat Single Sign-On 7, Red Hat Software Collections, Red Hat support for Spring Boot Problem Types: CWE-91 Description: A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a
s found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:2135 - https://access.redhat.com/errata/RHSA-2023:3906 - https://access.redhat.com/security/cve/CVE-2022-4245 - https://bugzilla.redhat.com/show_bug.cgi?id=2149843
CVE ID: CVE-2022-4246 State: PUBLISHED Published: 2022-12-01T00:00:00.000Z Last Updated: 2025-04-15T13:10:35.075Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: Kakao Products: PotPlayer Problem Types: CWE-404 Description: A vulnerability classified as problematic has been found in Kakao PotPlayer. This affects an unknown part of the component MID File Handler. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-214623. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Referen
of this vulnerability is VDB-214623. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://seclists.org/fulldisclosure/2022/Nov/16 - https://seclists.org/fulldisclosure/2022/Nov/att-16/potplayer_7z.bin - https://vuldb.com/?id.214623
CVE ID: CVE-2022-4247 State: PUBLISHED Published: 2022-12-01T00:00:00.000Z Last Updated: 2025-04-15T13:10:28.222Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: unspecified Products: Movie Ticket Booking System Problem Types: CWE-707 Description: A vulnerability classified as critical was found in Movie Ticket Booking System. This vulnerability affects unknown code of the file booking.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-214624. Additional Analyst Notes: - CVE Program Container: - CISA AD
e used. The identifier of this vulnerability is VDB-214624. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/aman05382/movie_ticket_booking_system_php/issues/1 - https://vuldb.com/?id.214624
CVE ID: CVE-2022-4248 State: PUBLISHED Published: 2022-12-01T00:00:00.000Z Last Updated: 2025-04-15T13:10:21.643Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: unspecified Products: Movie Ticket Booking System Problem Types: CWE-707 Description: A vulnerability, which was classified as critical, has been found in Movie Ticket Booking System. This issue affects some unknown processing of the file editBooking.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-214625 was assigned to this vulnerability. Additional Analyst Notes: -
o the public and may be used. The identifier VDB-214625 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/aman05382/movie_ticket_booking_system_php/issues/3 - https://vuldb.com/?id.214625
CVE ID: CVE-2022-4249 State: PUBLISHED Published: 2022-12-01T00:00:00.000Z Last Updated: 2025-04-15T13:10:13.994Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: unspecified Products: Movie Ticket Booking System Problem Types: CWE-707 Description: A vulnerability, which was classified as problematic, was found in Movie Ticket Booking System. Affected is an unknown function of the component POST Request Handler. The manipulation of the argument ORDER_ID leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-214626 is the identifier assigned to this vulnerability. Additional A
been disclosed to the public and may be used. VDB-214626 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/aman05382/movie_ticket_booking_system_php/issues/5 - https://vuldb.com/?id.214626
CVE ID: CVE-2022-4250 State: PUBLISHED Published: 2022-12-01T00:00:00.000Z Last Updated: 2025-04-15T13:10:05.912Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: unspecified Products: Movie Ticket Booking System Problem Types: CWE-707 Description: A vulnerability has been found in Movie Ticket Booking System and classified as problematic. Affected by this vulnerability is an unknown functionality of the file booking.php. The manipulation of the argument id leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-214627. Additional Anal
disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-214627. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/aman05382/movie_ticket_booking_system_php/issues/2 - https://vuldb.com/?id.214627
CVE ID: CVE-2022-4251 State: PUBLISHED Published: 2022-12-01T00:00:00.000Z Last Updated: 2025-04-15T13:09:58.845Z Severity: LOW (CVSS 2.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N) Vendors: unspecified Products: Movie Ticket Booking System Problem Types: CWE-707 Description: A vulnerability was found in Movie Ticket Booking System and classified as problematic. Affected by this issue is some unknown functionality of the file editBooking.php. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-214628. Additional Analyst Notes: - CVE Program Container: -
nd may be used. The identifier of this vulnerability is VDB-214628. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/aman05382/movie_ticket_booking_system_php/issues/4 - https://vuldb.com/?id.214628
CVE ID: CVE-2022-4252 State: PUBLISHED Published: 2022-12-01T00:00:00.000Z Last Updated: 2025-04-15T13:09:52.538Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: SourceCodester Products: Canteen Management System Problem Types: CWE-707 Description: A vulnerability was found in SourceCodester Canteen Management System. It has been classified as problematic. This affects the function builtin_echo of the file categories.php. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-214629 was assigned to this vulnerability. Additional Analyst Note
sed to the public and may be used. The identifier VDB-214629 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.csdn.net/weixin_43864034/article/details/128127288 - https://vuldb.com/?id.214629
CVE ID: CVE-2022-4253 State: PUBLISHED Published: 2022-12-01T00:00:00.000Z Last Updated: 2025-04-15T13:09:46.024Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: SourceCodester Products: Canteen Management System Problem Types: CWE-707 Description: A vulnerability was found in SourceCodester Canteen Management System. It has been declared as problematic. This vulnerability affects the function builtin_echo of the file customer.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-214630 is the identifier assigned to this vulnerability. Additional Analyst Notes
sed to the public and may be used. VDB-214630 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.csdn.net/weixin_43864034/article/details/128127516 - https://vuldb.com/?id.214630
CVE ID: CVE-2022-4254 State: PUBLISHED Published: 2023-02-01T00:00:00.000Z Last Updated: 2025-03-27T14:42:34.058Z Vendors: n/a Products: SSSD Problem Types: CWE-90 Description: sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2149894 - https://github.com/SSSD/sssd/issues/5135 - https://github.com/SSSD/sssd/commit/a2b9a84460429181f2a4fa7e2bb5ab49fd561274 - https://access.redhat.com/security/cve/CVE-2022-4254 - https://lists.debian.org/debian-lts-announce/2023/05/msg00028.html
CVE ID: CVE-2022-4255 State: PUBLISHED Published: 2023-01-27T00:00:00.000Z Last Updated: 2025-03-27T20:17:04.693Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Information exposure in GitLab Description: An info leak issue was identified in all versions of GitLab EE from 13.7 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 which exposes user email id through webhook payload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/373819 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4255.json
CVE ID: CVE-2022-4256 State: PUBLISHED Published: 2023-01-02T21:49:35.921Z Last Updated: 2025-04-10T18:36:59.010Z Vendors: Unknown Products: All-in-One Addons for Elementor Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The All-in-One Addons for Elementor WordPress plugin before 2.4.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f5b17c68-c2b0-4d0d-bb7b-19dc30511a89
CVE ID: CVE-2022-4257 State: PUBLISHED Published: 2022-12-01T00:00:00.000Z Last Updated: 2025-04-15T13:09:39.323Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: C-DATA Products: Web Management System Problem Types: CWE-707 Description: A vulnerability was found in C-DATA Web Management System. It has been rated as critical. This issue affects some unknown processing of the file cgi-bin/jumpto.php of the component GET Parameter Handler. The manipulation of the argument hostname leads to argument injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB
ly. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-214631. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/siriuswhiter/VulnHub/blob/main/C-Data/rce1.md - https://vuldb.com/?id.214631