Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
olute URL with leading whitespace. For example `\nhttps://whatever.com` which has a leading newline. According to the fetch specification, before a fetch is made the URL is normalized. "To normalize a byte sequence potentialValue, remove any leading and trailing HTTP whitespace bytes from potentialValue.". This means the final request will be normalized to `https://whatever.com` bypassing the check and nuxt-api-party will send a request outside of the whitelist. This could allow us to leak credentials or perform Server-Side Request Forgery (SSRF). This vulnerability has been addressed in version 0.22.1. Users are advised to upgrade. Users unable to upgrade should revert to the previous metho
n addressed in version 0.22.1. Users are advised to upgrade. Users unable to upgrade should revert to the previous method of detecting absolute URLs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/johannschopplich/nuxt-api-party/security/advisories/GHSA-3wfp-253j-5jxv - https://fetch.spec.whatwg.org/ - https://fetch.spec.whatwg.org/#http-whitespace-byte - https://github.com/johannschopplich/nuxt-api-party/blob/777462e1e3af1d9f8938aa33f230cd8cb6e0cc9a/src/runtime/server/handler.ts#L31 - https://infra.spec.whatwg.org/#byte-sequence
CVE ID: CVE-2023-49800 State: PUBLISHED Published: 2023-12-08T23:41:55.206Z Last Updated: 2024-08-02T22:01:26.234Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: johannschopplich Products: nuxt-api-party Problem Types: CWE-674, CWE-400 Description: `nuxt-api-party` is an open source module to proxy API requests. The library allows the user to send many options directly to `ofetch`. There is no filter on which options are available. We can abuse the retry logic to cause the server to crash from a stack overflow. fetchOptions are obtained directly from the request body. A malicious user can construct a URL known to not fetch successfully, then set the retry att
ctly from the request body. A malicious user can construct a URL known to not fetch successfully, then set the retry attempts to a high value, this will cause a stack overflow as ofetch error handling works recursively resulting in a denial of service. This issue has been addressed in version 0.22.1. Users are advised to upgrade. Users unable to upgrade should limit ofetch options. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/johannschopplich/nuxt-api-party/security/advisories/GHSA-q6hx-3m4p-749h
CVE ID: CVE-2023-49801 State: PUBLISHED Published: 2024-01-12T21:08:06.057Z Last Updated: 2024-11-14T15:36:05.151Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Lif-Platforms Products: Lif-Auth-Server Problem Types: CWE-22, CWE-23 Description: Lif Auth Server is a server for validating logins, managing information, and account recovery for Lif Accounts. The issue relates to the `get_pfp` and `get_banner` routes on Auth Server. The issue is that there is no check to ensure that the file that Auth Server is receiving through these URLs is correct. This could allow an attacker access to files they shouldn't have access to. This issue has been patched in versi
orrect. This could allow an attacker access to files they shouldn't have access to. This issue has been patched in version 1.4.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Lif-Platforms/Lif-Auth-Server/security/advisories/GHSA-3v77-pvqq-qg3f - https://github.com/Lif-Platforms/Lif-Auth-Server/commit/c235bcc2ee65e4a0dfb10284cf2cbc750213efeb
CVE ID: CVE-2023-49802 State: PUBLISHED Published: 2023-12-11T21:11:53.407Z Last Updated: 2024-08-28T15:12:57.432Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L) Vendors: mantisbt-plugins Products: LinkedCustomFields Problem Types: CWE-79 Description: The LinkedCustomFields plugin for MantisBT allows users to link values between two custom fields, creating linked drop-downs. Prior to version 2.0.1, cross-site scripting in the MantisBT LinkedCustomFields plugin allows Javascript execution, when a crafted Custom Field is linked via the plugin and displayed when reporting a new Issue or editing an existing one. This issue is fixed in version 2.0.1. As a workaround, one
played when reporting a new Issue or editing an existing one. This issue is fixed in version 2.0.1. As a workaround, one may utilize MantisBT's default Content Security Policy, which blocks script execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mantisbt-plugins/LinkedCustomFields/security/advisories/GHSA-2f37-9xpx-5hhw - https://github.com/mantisbt-plugins/LinkedCustomFields/issues/10 - https://github.com/mantisbt-plugins/LinkedCustomFields/pull/11 - https://github.com/mantisbt-plugins/LinkedCustomFields/commit/30e5ae751e40d7ae18bfd794fd48671477b3d286
CVE ID: CVE-2023-49803 State: PUBLISHED Published: 2023-12-11T22:42:17.547Z Last Updated: 2024-08-02T22:01:26.009Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N) Vendors: koajs Products: cors Problem Types: CWE-346 Description: @koa/cors npm provides Cross-Origin Resource Sharing (CORS) for koa, a web framework for Node.js. Prior to version 5.0.0, the middleware operates in a way that if an allowed origin is not provided, it will return an `Access-Control-Allow-Origin` header with the value of the origin from the request. This behavior completely disables one of the most crucial elements of browsers - the Same Origin Policy (SOP), this could cause a very serious secur
ables one of the most crucial elements of browsers - the Same Origin Policy (SOP), this could cause a very serious security threat to the users of this middleware. If such behavior is expected, for instance, when middleware is used exclusively for prototypes and not for production applications, it should be heavily emphasized in the documentation along with an indication of the risks associated with such behavior, as many users may not be aware of it. Version 5.0.0 fixes this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/koajs/cors/security/advisories/GHSA-qxrj-hx23-xp82 - https://github.com/koajs/cors/commit/f31dac99f5355c41e7d4dd3c4a80c5
koajs/cors/security/advisories/GHSA-qxrj-hx23-xp82 - https://github.com/koajs/cors/commit/f31dac99f5355c41e7d4dd3c4a80c5f154941a11
CVE ID: CVE-2023-49804 State: PUBLISHED Published: 2023-12-11T22:32:32.869Z Last Updated: 2024-10-09T13:32:12.655Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: louislam Products: uptime-kuma Problem Types: CWE-384 Description: Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, when a user changes their login password in Uptime Kuma, a previously logged-in user retains access without being logged out. This behavior persists consistently, even after system restarts or browser restarts. This vulnerability allows unauthorized access to user accounts, compromising the security of sensitive information. The same vulnerability wa
lows unauthorized access to user accounts, compromising the security of sensitive information. The same vulnerability was partially fixed in CVE-2023-44400, but logging existing users out of their accounts was forgotten. To mitigate the risks associated with this vulnerability, the maintainers made the server emit a `refresh` event (clients handle this by reloading) and then disconnecting all clients except the one initiating the password change. It is recommended to update Uptime Kuma to version 1.23.9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/louislam/uptime-kuma/security/advisories/GHSA-88j4-pcx8-q4q3 - https://github.com
ment: References: - https://github.com/louislam/uptime-kuma/security/advisories/GHSA-88j4-pcx8-q4q3 - https://github.com/louislam/uptime-kuma/security/advisories/GHSA-g9v2-wqcj-j99g - https://github.com/louislam/uptime-kuma/commit/482049c72b3a650c7bc5c26c2f4d57a21c0e0aa0
CVE ID: CVE-2023-49805 State: PUBLISHED Published: 2023-12-11T22:37:04.802Z Last Updated: 2024-08-02T22:01:26.032Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L) Vendors: louislam Products: uptime-kuma Problem Types: CWE-1385 Description: Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, the application uses WebSocket (with Socket.io), but it does not verify that the source of communication is valid. This allows third-party website to access the application on behalf of their client. When connecting to the server using Socket.IO, the server does not validate the `Origin` header leading to other site being able to open connections to t
ng Socket.IO, the server does not validate the `Origin` header leading to other site being able to open connections to the server and communicate with it. Other websites still need to authenticate to access most features, however this can be used to circumvent firewall protections made in place by people deploying the application. Without origin validation, Javascript executed from another origin would be allowed to connect to the application without any user interaction. Without login credentials, such a connection is unable to access protected endpoints containing sensitive data of the application. However, such a connection may allow attacker to further exploit unseen vulnerabilities of t
ve data of the application. However, such a connection may allow attacker to further exploit unseen vulnerabilities of the application. Users with "No-auth" mode configured who are relying on a reverse proxy or firewall to provide protection to the application would be especially vulnerable as it would grant the attacker full access to the application. In version 1.23.9, additional verification of the HTTP Origin header has been added to the socket.io connection handler. By default, if the `Origin` header is present, it would be checked against the Host header. Connection would be denied if the hostnames do not match, which would indicate that the request is cross-origin. Connection would be
ould be denied if the hostnames do not match, which would indicate that the request is cross-origin. Connection would be allowed if the `Origin` header is not present. Users can override this behavior by setting environment variable `UPTIME_KUMA_WS_ORIGIN_CHECK=bypass`. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/louislam/uptime-kuma/security/advisories/GHSA-mj22-23ff-2hrr - https://github.com/louislam/uptime-kuma/commit/2815cc73cfd9d8ced889e00e72899708220d184f
CVE ID: CVE-2023-49807 State: PUBLISHED Published: 2023-12-26T07:21:11.658Z Last Updated: 2024-08-02T22:01:26.024Z Vendors: WESEEK, Inc. Products: GROWI Problem Types: Cross-site scripting (XSS) Description: Stored cross-site scripting vulnerability when processing the MathJax exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product. Additional Analyst Notes: - CVE Program Container: References: - https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/ - https://jvn.jp/en/jp/JVN18715935/
CVE ID: CVE-2023-49809 State: PUBLISHED Published: 2023-12-12T08:20:08.321Z Last Updated: 2024-08-02T22:01:26.051Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-400 Description: Mattermost fails to handle a null request body in the /add endpoint, allowing a simple member to send a request with null request body to that endpoint and make it crash. After a few repetitions, the plugin is disabled. Additional Analyst Notes: - CVE Program Container: References: - https://mattermost.com/security-updates
CVE ID: CVE-2023-49810 State: PUBLISHED Published: 2024-01-10T15:48:08.090Z Last Updated: 2025-11-04T18:19:47.767Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: WWBN Products: AVideo Problem Types: CWE-307 Description: A login attempt restriction bypass vulnerability exists in the checkLoginAttempts functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to captcha bypass, which can be abused by an attacker to brute force user credentials. An attacker can send a series of HTTP requests to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://t
this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1898
CVE ID: CVE-2023-49811 State: REJECTED Published: N/A Last Updated: 2025-02-13T17:18:56.411Z Description: No description available.
CVE ID: CVE-2023-49812 State: PUBLISHED Published: 2023-12-19T20:55:34.805Z Last Updated: 2024-09-16T18:29:00.263Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: J.N. Breetvelt a.k.a. OpaJaap Products: WP Photo Album Plus Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus.This issue affects WP Photo Album Plus: from n/a through 8.5.02.005. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-photo-album-plus/wordpress-wp-photo-album-plus-plugin-8-5-02-005-insecure-direct-ob
hstack.com/database/vulnerability/wp-photo-album-plus/wordpress-wp-photo-album-plus-plugin-8-5-02-005-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE ID: CVE-2023-49813 State: PUBLISHED Published: 2023-12-14T15:51:02.542Z Last Updated: 2024-08-02T22:01:26.026Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: J.N. Breetvelt a.k.a. OpaJaap Products: WP Photo Album Plus Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus allows Stored XSS.This issue affects WP Photo Album Plus: from n/a through 8.5.02.005. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-photo-album-plus/wordpress-wp-photo-album-plus-plugin-8-5
References: - https://patchstack.com/database/vulnerability/wp-photo-album-plus/wordpress-wp-photo-album-plus-plugin-8-5-02-005-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-49814 State: PUBLISHED Published: 2023-12-20T18:26:20.872Z Last Updated: 2024-11-20T20:21:23.857Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Symbiostock Products: Symbiostock Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Symbiostock symbiostock.This issue affects Symbiostock: from n/a through 6.0.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/symbiostock/wordpress-symbiostock-lite-plugin-6-0-0-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2023-49815 State: PUBLISHED Published: 2024-03-27T05:31:16.355Z Last Updated: 2024-08-06T15:47:23.995Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: WappPress Team Products: WappPress Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in WappPress Team WappPress.This issue affects WappPress: from n/a through 5.0.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wapppress-builds-android-app-for-website/wordpress-wapppress-plugin-5-0-3-unauthenticated-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2023-49816 State: PUBLISHED Published: 2023-12-17T10:28:50.478Z Last Updated: 2024-08-02T22:01:26.241Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Innovative Solutions Products: Fix My Feed RSS Repair Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Innovative Solutions Fix My Feed RSS Repair.This issue affects Fix My Feed RSS Repair: from n/a through 1.4. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/fix-my-feed-rss-repair/wordpress-fix-my-feed-rss-repair-plugin-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-49817 State: PUBLISHED Published: 2024-12-09T11:30:11.832Z Last Updated: 2024-12-09T16:42:25.314Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) Vendors: heoLixfy Products: Flexible Woocommerce Checkout Field Editor Problem Types: CWE-862 Description: Missing Authorization vulnerability in heoLixfy Flexible Woocommerce Checkout Field Editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Woocommerce Checkout Field Editor: from n/a through 2.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/flexible-woocommerce-checkout-field-editor/
Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/flexible-woocommerce-checkout-field-editor/vulnerability/wordpress-flexible-woocommerce-checkout-field-editor-plugin-2-0-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-49818 State: PUBLISHED Published: 2024-12-09T11:30:11.004Z Last Updated: 2024-12-10T16:48:31.179Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Webflow Products: Webflow Pages Problem Types: CWE-862 Description: Missing Authorization vulnerability in Webflow Webflow Pages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webflow Pages: from n/a through 1.0.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/webflow-pages/vulnerability/wordpress-webflow-pages-plugin-1-0-8-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-49819 State: PUBLISHED Published: 2023-12-18T23:35:58.076Z Last Updated: 2024-08-02T22:01:26.105Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Gordon Böhme, Antonio Leutsch Products: Structured Content (JSON-LD) #wpsc Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Gordon Böhme, Antonio Leutsch Structured Content (JSON-LD) #wpsc.This issue affects Structured Content (JSON-LD) #wpsc: from n/a through 1.5.3. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/structured-content/wordpress-structured-content-json-ld-wpsc-plugin-1-5-3-php-object-inj
tack.com/database/vulnerability/structured-content/wordpress-structured-content-json-ld-wpsc-plugin-1-5-3-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-49820 State: PUBLISHED Published: 2023-12-14T15:53:36.806Z Last Updated: 2024-08-02T22:01:26.047Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Gordon Böhme, Antonio Leutsch Products: Structured Content (JSON-LD) #wpsc Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gordon Böhme, Antonio Leutsch Structured Content (JSON-LD) #wpsc allows Stored XSS.This issue affects Structured Content (JSON-LD) #wpsc: from n/a through 1.5.3. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/structured-content
l Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/structured-content/wordpress-structured-content-json-ld-wpsc-plugin-1-5-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-49821 State: PUBLISHED Published: 2023-12-18T22:31:09.739Z Last Updated: 2024-09-30T18:50:33.396Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: LiveChat Products: LiveChat – WP live chat plugin for WordPress Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in LiveChat LiveChat – WP live chat plugin for WordPress.This issue affects LiveChat – WP live chat plugin for WordPress: from n/a through 4.5.15. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-live-chat-software-for-wordpress/wordpress-livechat-plugin-4-5-15-cro
- https://patchstack.com/database/vulnerability/wp-live-chat-software-for-wordpress/wordpress-livechat-plugin-4-5-15-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-49822 State: PUBLISHED Published: 2024-06-04T11:24:43.815Z Last Updated: 2024-08-02T22:01:25.936Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: David Vongries Products: Ultimate Dashboard Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in David Vongries Ultimate Dashboard allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Ultimate Dashboard: from n/a through 3.7.10. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/ultimate-dashboard/wordpress-ultimate-dashboard-plug
tainer: References: - https://patchstack.com/database/vulnerability/ultimate-dashboard/wordpress-ultimate-dashboard-plugin-3-7-10-secret-login-page-location-disclosure-on-multisites-vulnerability?_s_id=cve
CVE ID: CVE-2023-49823 State: PUBLISHED Published: 2023-12-15T15:27:51.918Z Last Updated: 2024-08-02T22:01:26.151Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: BoldThemes Products: Bold Page Builder Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldThemes Bold Page Builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through 4.6.1. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/bold-page-builder/wordpress-bold-page-builder-plugin-4-6-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-49824 State: PUBLISHED Published: 2023-12-17T10:35:19.743Z Last Updated: 2024-08-02T22:01:26.014Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: PixelYourSite Products: Product Catalog Feed by PixelYourSite Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in PixelYourSite Product Catalog Feed by PixelYourSite.This issue affects Product Catalog Feed by PixelYourSite: from n/a through 2.1.1. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/product-catalog-feed/wordpress-product-catalog-feed-by-pixelyoursite-plugin-2-1-1-cross-site-request-forgery-
nerability/product-catalog-feed/wordpress-product-catalog-feed-by-pixelyoursite-plugin-2-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-49825 State: PUBLISHED Published: 2023-12-20T15:38:27.276Z Last Updated: 2024-08-02T22:01:26.085Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: PenciDesign Products: Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PenciDesign Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme.This issue affects Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme: from n/a through 8.4.1. Additional Analyst Notes: - CVE Program Container: References: - https://patchst
ordPress Theme: from n/a through 8.4.1. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/soledad/wordpress-soledad-theme-8-4-1-contributor-sql-injection-vulnerability?_s_id=cve