Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-6750 State: PUBLISHED Published: 2024-01-08T19:00:37.762Z Last Updated: 2024-09-04T15:35:56.603Z Vendors: Unknown Products: Clone Problem Types: CWE-200 Information Exposure Description: The Clone WordPress plugin before 2.4.3 uses buffer files to store in-progress backup informations, which is stored at a publicly accessible, statically defined file path. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/fad9eefe-4552-4d20-a1fd-bb2e172ec8d7
CVE ID: CVE-2023-6751 State: PUBLISHED Published: 2024-01-11T08:33:02.388Z Last Updated: 2025-06-17T21:09:14.044Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: hostinger Products: Hostinger Problem Types: CWE-862 Missing Authorization Description: The Hostinger plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the function publish_website in all versions up to, and including, 1.9.7. This makes it possible for unauthenticated attackers to enable and disable maintenance mode. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-int
onal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d89cf759-5e5f-43e2-90a9-a8e554653ee1?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3010008%40hostinger%2Ftrunk&old=3010004%40hostinger%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6752 State: REJECTED Published: N/A Last Updated: 2024-01-02T19:15:58.809Z Description: No description available.
CVE ID: CVE-2023-6753 State: PUBLISHED Published: 2023-12-13T00:00:31.196Z Last Updated: 2024-10-08T14:30:30.548Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: mlflow Products: mlflow/mlflow Problem Types: CWE-22 Description: Path Traversal in GitHub repository mlflow/mlflow prior to 2.9.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/b397b83a-527a-47e7-b912-a12a17a6cfb4 - https://github.com/mlflow/mlflow/commit/1c6309f884798fbf56017a3cc808016869ee8de4
CVE ID: CVE-2023-6755 State: PUBLISHED Published: 2023-12-13T13:00:05.067Z Last Updated: 2024-08-02T08:42:07.163Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: n/a Products: DedeBIZ Problem Types: CWE-89 Description: A vulnerability was found in DedeBIZ 6.2 and classified as critical. This issue affects some unknown processing of the file /src/admin/content_batchup_action.php. The manipulation of the argument endid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-247883. NOTE: The vendor was contacted early about this disclosure but did not respond
ier of this vulnerability is VDB-247883. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.247883 - https://vuldb.com/?ctiid.247883 - https://github.com/ycwxy/test/issues/1
CVE ID: CVE-2023-6756 State: PUBLISHED Published: 2023-12-13T13:31:03.944Z Last Updated: 2024-08-02T08:42:07.179Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Thecosy Products: IceCMS Problem Types: CWE-307 Description: A vulnerability was found in Thecosy IceCMS 2.0.1. It has been classified as problematic. Affected is an unknown function of the file /login of the component Captcha Handler. The manipulation leads to improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-247884. Additional Analyst Note
een disclosed to the public and may be used. The identifier of this vulnerability is VDB-247884. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.247884 - https://vuldb.com/?ctiid.247884 - http://124.71.147.32:8082/IceCMS2.html
CVE ID: CVE-2023-6757 State: PUBLISHED Published: 2023-12-13T14:00:05.225Z Last Updated: 2025-05-22T18:14:27.705Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Thecosy Products: IceCMS Problem Types: CWE-200 Description: A vulnerability was found in Thecosy IceCMS 2.0.1. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /adplanet/PlanetUser of the component API. The manipulation leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247885 was assigned to this vulnerability. Additional Analyst Notes: - CV
the public and may be used. The identifier VDB-247885 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.247885 - https://vuldb.com/?ctiid.247885 - http://124.71.147.32:8082/IceCMS3.html
CVE ID: CVE-2023-6758 State: PUBLISHED Published: 2023-12-13T14:31:04.187Z Last Updated: 2024-08-02T08:42:07.451Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Thecosy Products: IceCMS Problem Types: CWE-284 Description: A vulnerability was found in Thecosy IceCMS 2.0.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file /adplanet/PlanetCommentList of the component API. The manipulation leads to improper access controls. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-247886 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Pr
public and may be used. VDB-247886 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.247886 - https://vuldb.com/?ctiid.247886 - http://124.71.147.32:8082/IceCMS4.html
CVE ID: CVE-2023-6759 State: PUBLISHED Published: 2023-12-13T15:00:05.420Z Last Updated: 2024-10-08T14:28:28.389Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Thecosy Products: IceCMS Problem Types: CWE-837 Description: A vulnerability classified as problematic has been found in Thecosy IceCMS 2.0.1. This affects an unknown part of the file /WebResource/resource of the component Love Handler. The manipulation leads to improper enforcement of a single, unique action. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-247887. Additional Analyst
closed to the public and may be used. The associated identifier of this vulnerability is VDB-247887. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.247887 - https://vuldb.com/?ctiid.247887 - http://39.106.130.187/Icecms.html
CVE ID: CVE-2023-6760 State: PUBLISHED Published: 2023-12-13T15:31:03.924Z Last Updated: 2024-08-02T08:42:07.437Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Thecosy Products: IceCMS Problem Types: CWE-1018 Description: A vulnerability classified as critical was found in Thecosy IceCMS up to 2.0.1. This vulnerability affects unknown code. The manipulation leads to manage user sessions. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-247888. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.247888 - https://vuldb.com/?ctiid.247888 - http://39.10
es: - CVE Program Container: References: - https://vuldb.com/?id.247888 - https://vuldb.com/?ctiid.247888 - http://39.106.130.187/yue/yue.html
CVE ID: CVE-2023-6761 State: PUBLISHED Published: 2023-12-13T16:00:05.256Z Last Updated: 2024-08-02T08:42:07.439Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Thecosy Products: IceCMS Problem Types: CWE-284 Description: A vulnerability, which was classified as problematic, has been found in Thecosy IceCMS up to 2.0.1. This issue affects some unknown processing of the component User Data Handler. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247889 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container:
e used. The identifier VDB-247889 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.247889 - https://vuldb.com/?ctiid.247889 - http://39.106.130.187/chui/1.html
CVE ID: CVE-2023-6762 State: PUBLISHED Published: 2023-12-13T16:00:06.321Z Last Updated: 2024-08-02T08:42:07.398Z Severity: N/A (CVSS 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P) Vendors: Thecosy Products: IceCMS Problem Types: CWE-275 Description: A vulnerability, which was classified as critical, was found in Thecosy IceCMS 2.0.1. Affected is an unknown function of the file /article/DelectArticleById/ of the component Article Handler. The manipulation leads to permission issues. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-247890 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: Referen
VDB-247890 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.247890 - https://vuldb.com/?ctiid.247890 - http://39.106.130.187/jwt/wen/1.html
CVE ID: CVE-2023-6764 State: PUBLISHED Published: 2024-02-20T02:14:09.814Z Last Updated: 2024-08-02T08:42:07.430Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Zyxel Products: ATP series firmware, USG FLEX series firmware, USG FLEX 50(W) series firmware, USG20(W)-VPN series firmware Problem Types: CWE-134 Description: A format string vulnerability in a function of the IPSec VPN feature in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, and USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patc
firmware versions from 4.16 through 5.37 Patch 1, and USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1 could allow an attacker to achieve unauthorized remote code execution by sending a sequence of specially crafted payloads containing an invalid pointer; however, such an attack would require detailed knowledge of an affected device’s memory layout and configuration. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps-02-20-2024
CVE ID: CVE-2023-6765 State: PUBLISHED Published: 2023-12-13T17:31:04.162Z Last Updated: 2024-08-02T08:42:07.394Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Online Tours & Travels Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been rated as critical. This issue affects the function prepare of the file email_setup.php. The manipulation of the argument name leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-247895. Additional Analyst Notes:
to the public and may be used. The associated identifier of this vulnerability is VDB-247895. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.247895 - https://vuldb.com/?ctiid.247895 - https://blog.csdn.net/xitanging/article/details/134903112
CVE ID: CVE-2023-6766 State: PUBLISHED Published: 2023-12-13T17:31:05.176Z Last Updated: 2024-10-08T14:26:33.964Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: PHPGurukul Products: Teacher Subject Allocation Management System Problem Types: CWE-352 Description: A vulnerability classified as problematic has been found in PHPGurukul Teacher Subject Allocation Management System 1.0. Affected is an unknown function of the file /admin/course.php of the component Delete Course Handler. The manipulation of the argument delid leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of
possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-247896. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.247896 - https://vuldb.com/?ctiid.247896 - https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/csrf_delete_course.md
CVE ID: CVE-2023-6767 State: PUBLISHED Published: 2023-12-13T18:00:05.248Z Last Updated: 2024-11-21T14:43:26.735Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: SourceCodester Products: Wedding Guest e-Book Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in SourceCodester Wedding Guest e-Book 1.0. This affects an unknown part of the file /endpoint/add-guest.php. The manipulation of the argument name leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-247899. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - ht
ulnerability is VDB-247899. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.247899 - https://vuldb.com/?ctiid.247899
CVE ID: CVE-2023-6768 State: PUBLISHED Published: 2023-12-20T09:49:36.723Z Last Updated: 2024-09-16T18:26:36.763Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: Amazing Little poll Products: Amazing Little poll Problem Types: CWE-287 Description: Authentication bypass vulnerability in Amazing Little Poll affecting versions 1.3 and 1.4. This vulnerability could allow an unauthenticated user to access the admin panel without providing any credentials by simply accessing the "lp_admin.php?adminstep=" parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple
VE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amazing-little-poll
CVE ID: CVE-2023-6769 State: PUBLISHED Published: 2023-12-20T09:50:44.480Z Last Updated: 2024-11-21T19:37:10.512Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Amazing Little poll Products: Amazing Little poll Problem Types: CWE-79 Description: Stored XSS vulnerability in Amazing Little Poll, affecting versions 1.3 and 1.4. This vulnerability allows a remote attacker to store a malicious JavaScript payload in the "lp_admin.php" file in the "question" and "item" parameters. This vulnerability could lead to malicious JavaScript execution while the page is loading. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https
ile the page is loading. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amazing-little-poll
CVE ID: CVE-2023-6770 State: REJECTED Published: N/A Last Updated: 2025-07-05T22:16:32.135Z Description: No description available.
CVE ID: CVE-2023-6771 State: PUBLISHED Published: 2023-12-13T18:31:03.593Z Last Updated: 2024-08-28T14:29:16.939Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Simple Student Attendance System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in SourceCodester Simple Student Attendance System 1.0. This issue affects the function save_attendance of the file actions.class.php. The manipulation of the argument sid leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-247907. Additional Analyst Notes
d to the public and may be used. The associated identifier of this vulnerability is VDB-247907. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.247907 - https://vuldb.com/?ctiid.247907 - https://github.com/Glunko/Simple-Student-Attendance-System_vulnerability/blob/main/README.md
CVE ID: CVE-2023-6772 State: PUBLISHED Published: 2023-12-13T19:00:06.215Z Last Updated: 2025-05-22T18:05:37.845Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: n/a Products: OTCMS Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in OTCMS 7.01. Affected is an unknown function of the file /admin/ind_backstage.php. The manipulation of the argument sqlContent leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-247908. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:
rability is VDB-247908. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.247908 - https://vuldb.com/?ctiid.247908 - https://github.com/Num-Nine/CVE/issues/8
CVE ID: CVE-2023-6773 State: PUBLISHED Published: 2023-12-13T19:31:04.385Z Last Updated: 2024-08-02T08:42:07.455Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: CodeAstro Products: POS and Inventory Management System Problem Types: CWE-284 Description: A vulnerability has been found in CodeAstro POS and Inventory Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /accounts_con/register_account of the component User Creation Handler. The manipulation of the argument account_type with the input Admin leads to improper access controls. The attack can be launched remotely. The exploit has
count_type with the input Admin leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247909 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.247909 - https://vuldb.com/?ctiid.247909 - https://drive.google.com/drive/folders/1yuc1n6tr57wD8qsT0HAFDVAuii7iibDM?usp=sharing
CVE ID: CVE-2023-6774 State: PUBLISHED Published: 2023-12-13T20:00:05.543Z Last Updated: 2024-08-02T08:42:07.642Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: CodeAstro Products: POS and Inventory Management System Problem Types: CWE-79 Description: A vulnerability was found in CodeAstro POS and Inventory Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /accounts_con/register_account. The manipulation of the argument Username with the input <script>alert(document.cookie)</script> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VD
ss site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-247910 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.247910 - https://vuldb.com/?ctiid.247910 - https://drive.google.com/drive/folders/1wnrdIuBhZh5ia9Q61b_V_72eIaHsX-B1?usp=sharing
CVE ID: CVE-2023-6775 State: PUBLISHED Published: 2023-12-13T20:31:03.914Z Last Updated: 2024-08-02T08:42:08.198Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: CodeAstro Products: POS and Inventory Management System Problem Types: CWE-79 Description: A vulnerability was found in CodeAstro POS and Inventory Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /item/item_con. The manipulation of the argument item_name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-247911. Additional An
en disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-247911. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.247911 - https://vuldb.com/?ctiid.247911 - https://drive.google.com/drive/folders/12llrfm5nmsbNexeyAroB6nL5yjqAYL8T?usp=sharing
CVE ID: CVE-2023-6776 State: PUBLISHED Published: 2024-01-11T08:32:34.765Z Last Updated: 2024-11-14T15:52:00.592Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: iberezansky Products: 3D FlipBook – PDF Flipbook WordPress Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The 3D FlipBook plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Ready Function’ field in all versions up to, and including, 1.15.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbi
ut escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/500fd8aa-9ad1-41ee-bbeb-cda9c80c4fcb?source=cve - https://plugins.trac.wordpress.org/changeset/3014013/interactive-3d-flipbook-powered-physics-engine
CVE ID: CVE-2023-6777 State: PUBLISHED Published: 2024-04-09T18:58:47.883Z Last Updated: 2024-08-08T18:30:09.163Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: wpgmaps Products: WP Go Maps (formerly WP Google Maps) Problem Types: CWE-200 Information Exposure Description: The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including, 9.0.34 due to the plugin adding the API key to several plugin files. This makes it possible for unauthenticated attackers to obtain the developer's Google API key. While this does not affect the security of sites using this plugin, it allows un
obtain the developer's Google API key. While this does not affect the security of sites using this plugin, it allows unauthenticated attackers to make requests using this API key with the potential of exhausting requests resulting in an inability to use the map functionality offered by the plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/509cccbd-3aa0-45f1-84a0-387d678ebf65?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3058300%40wp-google-maps&new=3058300%40wp-google-maps&sfp_email=&sfph_mail=#file673