Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-48759 State: PUBLISHED Published: 2024-06-19T10:32:09.929Z Last Updated: 2024-08-02T21:37:54.962Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Crocoblock Products: JetElements For Elementor Problem Types: CWE-862 Description: Missing Authorization vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.13. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/jet-elements/wordpress-jetelements-for-elementor-plugin-2-6-13-unauthenticated-arbitrary-attachment-download-vulnerability?_s_id=cve
CVE ID: CVE-2023-48760 State: PUBLISHED Published: 2024-06-19T10:21:33.025Z Last Updated: 2024-08-02T21:37:54.906Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) Vendors: Crocoblock Products: JetElements For Elementor Problem Types: CWE-862 Description: Missing Authorization vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.13. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/jet-elements/wordpress-jetelements-for-elementor-plugin-2-6-13-unauthenticated-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-48761 State: PUBLISHED Published: 2024-06-19T10:20:17.368Z Last Updated: 2024-08-02T21:37:54.913Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Crocoblock Products: JetElements For Elementor Problem Types: CWE-862 Description: Missing Authorization vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.13. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/jet-elements/wordpress-jetelements-for-elementor-plugin-2-6-13-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-48762 State: PUBLISHED Published: 2023-12-18T16:16:41.450Z Last Updated: 2024-11-20T20:43:26.848Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Crocoblock Products: JetElements For Elementor Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.13. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/jet-elements/wordpress-jetelements-for-elementor-plugin-2-6-13-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-48763 State: PUBLISHED Published: 2024-04-24T16:01:25.091Z Last Updated: 2024-08-02T21:37:54.980Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Crocoblock Products: JetFormBuilder Problem Types: CWE-80 Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS vulnerability in Crocoblock JetFormBuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/jetformbuilder/wordpress-jetformbuilder-plugin-3-1-4-content-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-48764 State: PUBLISHED Published: 2023-12-19T20:39:30.111Z Last Updated: 2024-08-02T21:37:55.070Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: GuardGiant Brute Force Protection Products: WordPress Brute Force Protection – Stop Brute Force Attacks Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GuardGiant Brute Force Protection WordPress Brute Force Protection – Stop Brute Force Attacks.This issue affects WordPress Brute Force Protection – Stop Brute Force Attacks: from n/a through 2.2.5. Additional Analyst Notes: - CVE Program Container: References: - h
n – Stop Brute Force Attacks: from n/a through 2.2.5. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/guardgiant/wordpress-wordpress-brute-force-protection-stop-brute-force-attacks-plugin-2-2-5-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-48765 State: PUBLISHED Published: 2023-12-15T13:56:57.959Z Last Updated: 2024-08-02T21:37:54.974Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Till Krüss Products: Email Address Encoder Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Till Krüss Email Address Encoder allows Stored XSS.This issue affects Email Address Encoder: from n/a through 1.0.22. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/email-address-encoder/wordpress-email-address-encoder-plugin-1-0-22-cross-site-scripting-xss-v
om/database/vulnerability/email-address-encoder/wordpress-email-address-encoder-plugin-1-0-22-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-48766 State: PUBLISHED Published: 2023-12-18T16:30:03.240Z Last Updated: 2024-08-02T21:37:54.992Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: SVGator Products: SVGator – Add Animated SVG Easily Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in SVGator SVGator – Add Animated SVG Easily.This issue affects SVGator – Add Animated SVG Easily: from n/a through 1.2.4. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/svgator/wordpress-svgator-add-animated-svg-easily-plugin-1-2-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-48767 State: PUBLISHED Published: 2023-12-14T16:43:05.815Z Last Updated: 2024-08-02T21:37:54.936Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Raghu Goriya Products: MyTube PlayList Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Raghu Goriya MyTube PlayList allows Reflected XSS.This issue affects MyTube PlayList: from n/a through 2.0.3. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/mytube/wordpress-mytube-playlist-plugin-2-0-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-48768 State: PUBLISHED Published: 2023-12-18T21:55:05.242Z Last Updated: 2024-08-02T21:37:55.076Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: CodeAstrology Team Products: Quantity Plus Minus Button for WooCommerce by CodeAstrology Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in CodeAstrology Team Quantity Plus Minus Button for WooCommerce by CodeAstrology.This issue affects Quantity Plus Minus Button for WooCommerce by CodeAstrology: from n/a through 1.1.9. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wc-quantity-plus-minus-button/wor
: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wc-quantity-plus-minus-button/wordpress-quantity-plus-minus-button-for-woocommerce-by-codeastrology-plugin-1-1-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-48769 State: PUBLISHED Published: 2023-12-18T21:57:08.367Z Last Updated: 2025-05-07T20:30:49.977Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Blue Coral Products: Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Blue Coral Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back.This issue affects Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back: from n/a through 2.3. Additional Analyst Notes: - CVE Program Containe
ns, Messages, Telegram, Email, SMS, Call me back: from n/a through 2.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/chat-bubble/wordpress-chat-bubble-plugin-2-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-48770 State: PUBLISHED Published: 2023-12-14T16:51:54.705Z Last Updated: 2025-05-21T14:32:10.757Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Nima Saberi Products: Aparat Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nima Saberi Aparat allows Stored XSS.This issue affects Aparat: from n/a through 1.7.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/aparat/wordpress-aparat-plugin-1-7-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-48771 State: PUBLISHED Published: 2023-12-14T16:54:41.535Z Last Updated: 2024-08-02T21:37:55.108Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Bruno "Aesqe" Babic Products: File Gallery Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bruno "Aesqe" Babic File Gallery allows Reflected XSS.This issue affects File Gallery: from n/a through 1.8.5.4. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/file-gallery/wordpress-file-gallery-plugin-1-8-5-4-reflected-cross-site-scripting-xss-vulnerability?_
base/vulnerability/file-gallery/wordpress-file-gallery-plugin-1-8-5-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-48772 State: PUBLISHED Published: 2023-12-18T21:59:07.248Z Last Updated: 2024-08-02T21:37:54.954Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Arul Prasad J Products: Prevent Landscape Rotation Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Arul Prasad J Prevent Landscape Rotation.This issue affects Prevent Landscape Rotation: from n/a through 2.0. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/prevent-landscape-rotation/wordpress-prevent-landscape-rotation-plugin-2-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-48773 State: PUBLISHED Published: 2023-12-18T22:01:20.971Z Last Updated: 2024-08-02T21:37:54.982Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: WP Doctor Products: WooCommerce Login Redirect Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in WP Doctor WooCommerce Login Redirect.This issue affects WooCommerce Login Redirect: from n/a through 2.2.4. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/woo-login-redirect/wordpress-woo-login-redirect-plugin-2-2-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-48774 State: PUBLISHED Published: 2024-12-09T11:30:25.667Z Last Updated: 2024-12-09T15:53:30.967Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Martin Gibson Products: IdeaPush Problem Types: CWE-862 Description: Missing Authorization vulnerability in Martin Gibson IdeaPush allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IdeaPush: from n/a through n/a. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ideapush/vulnerability/wordpress-ideapush-plugin-8-53-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-48775 State: PUBLISHED Published: 2024-12-31T12:47:06.401Z Last Updated: 2024-12-31T18:10:19.535Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Gfazioli Products: WP Cleanfix Problem Types: CWE-862 Description: Missing Authorization vulnerability in Gfazioli WP Cleanfix allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cleanfix: from n/a through 5.6.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-cleanfix/vulnerability/wordpress-wp-cleanfix-plugin-5-5-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-48776 State: PUBLISHED Published: 2024-12-09T11:30:24.577Z Last Updated: 2024-12-09T16:13:28.185Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Thomas Scholl Products: canvasio3D Light Problem Types: CWE-862 Description: Missing Authorization vulnerability in Thomas Scholl canvasio3D Light allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects canvasio3D Light: from n/a through 2.5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/canvasio3d-light/vulnerability/wordpress-canvasio3d-light-plugin-2-4-6-broken-access-control-vulnerability?_s
ess/plugin/canvasio3d-light/vulnerability/wordpress-canvasio3d-light-plugin-2-4-6-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-48777 State: PUBLISHED Published: 2024-03-26T20:49:39.328Z Last Updated: 2024-08-07T18:01:35.896Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Elementor.com Products: Elementor Website Builder Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Elementor.Com Elementor Website Builder.This issue affects Elementor Website Builder: from 3.3.0 through 3.18.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/elementor/wordpress-elementor-plugin-3-18-0-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2023-48778 State: PUBLISHED Published: 2023-12-18T22:03:38.070Z Last Updated: 2024-11-20T20:33:56.571Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: VillaTheme Products: Product Size Chart For WooCommerce Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme Product Size Chart For WooCommerce.This issue affects Product Size Chart For WooCommerce: from n/a through 1.1.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/product-size-chart-for-woo/wordpress-product-size-chart-for-woocommerce-plugin-1-1-5-cross-site-req
tabase/vulnerability/product-size-chart-for-woo/wordpress-product-size-chart-for-woocommerce-plugin-1-1-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-48779 State: PUBLISHED Published: 2024-12-09T11:30:23.606Z Last Updated: 2024-12-09T16:18:56.094Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: 360 Javascript Viewer Products: 360 Javascript Viewer Problem Types: CWE-862 Description: Missing Authorization vulnerability in 360 Javascript Viewer 360 Javascript Viewer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 360 Javascript Viewer: from n/a through 1.7.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/360deg-javascript-viewer/vulnerability/wordpress-360-javascript-viewer-plugin
//patchstack.com/database/wordpress/plugin/360deg-javascript-viewer/vulnerability/wordpress-360-javascript-viewer-plugin-1-7-11-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-48780 State: PUBLISHED Published: 2023-12-14T16:57:13.066Z Last Updated: 2024-08-02T21:37:54.980Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: EnigmaWeb Products: WP Catalogue Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EnigmaWeb WP Catalogue allows Stored XSS.This issue affects WP Catalogue: from n/a through 1.7.6. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-catalogue/wordpress-wp-catalogue-plugin-1-7-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-48781 State: PUBLISHED Published: 2023-12-18T22:05:43.614Z Last Updated: 2024-08-02T21:37:54.978Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Marketing Rapel Products: MkRapel Regiones y Ciudades de Chile para WC Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Marketing Rapel MkRapel Regiones y Ciudades de Chile para WC.This issue affects MkRapel Regiones y Ciudades de Chile para WC: from n/a through 4.3.0. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wc-ciudades-y-regiones-de-chile/wordpress-mkrapel-regiones-y-ciudades-de-chile-para-
tchstack.com/database/vulnerability/wc-ciudades-y-regiones-de-chile/wordpress-mkrapel-regiones-y-ciudades-de-chile-para-wc-plugin-4-3-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-48782 State: PUBLISHED Published: 2023-12-13T06:37:42.217Z Last Updated: 2024-08-02T21:37:55.001Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:X) Vendors: Fortinet Products: FortiWLM Problem Types: CWE-78 Description: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 allows attacker to execute unauthorized code or commands via specifically crafted http get request parameters Additional Analyst Notes: - CVE Program Container: References: - https://fortiguard.com/psirt/FG-IR-23-450
CVE ID: CVE-2023-48783 State: PUBLISHED Published: 2024-01-10T17:51:38.440Z Last Updated: 2025-06-17T20:59:15.845Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:P/RL:X/RC:R) Vendors: Fortinet Products: FortiPortal Problem Types: CWE-639 Description: An Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] affecting PortiPortal version 7.2.1 and below, version 7.0.6 and below, version 6.0.14 and below, version 5.3.8 and below may allow a remote authenticated user with at least read-only permissions to access to other organization endpoints via crafted GET requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refere
n endpoints via crafted GET requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-408
CVE ID: CVE-2023-48784 State: PUBLISHED Published: 2024-04-09T14:24:24.971Z Last Updated: 2024-08-02T21:37:54.987Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R) Vendors: Fortinet Products: FortiOS Problem Types: CWE-134 Description: A use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.1 and below, version 7.2.7 and below, 7.0 all versions, 6.4 all versions command line interface may allow a local privileged attacker with super-admin profile and CLI access to execute arbitrary code or commands via specially crafted requests. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: -
a specially crafted requests. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fortiguard.com/psirt/FG-IR-23-413
CVE ID: CVE-2023-48785 State: PUBLISHED Published: 2025-03-14T15:46:57.799Z Last Updated: 2025-03-14T17:17:09.570Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:X/RC:X) Vendors: Fortinet Products: FortiNAC-F Problem Types: CWE-295 Description: An improper certificate validation vulnerability [CWE-295] in FortiNAC-F version 7.2.4 and below may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the HTTPS communication channel between the FortiOS device, an inventory, and FortiNAC-F. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-288
CVE ID: CVE-2023-48786 State: PUBLISHED Published: 2025-06-10T16:36:19.062Z Last Updated: 2025-06-11T14:43:41.910Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiClientEMS Problem Types: CWE-918 Description: A server-side request forgery vulnerability [CWE-918] in Fortinet FortiClientEMS version 7.4.0 through 7.4.2 and before 7.2.6 may allow an authenticated attacker to perform internal requests via crafted HTTP or HTTPS requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-23-342
CVE ID: CVE-2023-48788 State: PUBLISHED Published: 2024-03-12T15:09:18.527Z Last Updated: 2025-10-21T23:05:23.092Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiClientEMS Problem Types: CWE-89 Description: A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS 7.0.1 through 7.0.10 allows attacker to execute unauthorized code or commands via specially crafted packets. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fortiguard.com/psirt/FG-IR-24-007
CVE ID: CVE-2023-48789 State: PUBLISHED Published: 2024-06-03T07:57:22.756Z Last Updated: 2024-08-02T21:37:55.014Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:X) Vendors: Fortinet Products: FortiPortal Problem Types: CWE-602 Description: A client-side enforcement of server-side security in Fortinet FortiPortal version 6.0.0 through 6.0.14 allows attacker to improper access control via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fortiguard.fortinet.com/psirt/FG-IR-23-406
CVE ID: CVE-2023-48790 State: PUBLISHED Published: 2025-03-11T14:54:31.599Z Last Updated: 2025-03-11T16:05:58.718Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:X/RC:X) Vendors: Fortinet Products: FortiNDR Problem Types: CWE-352 Description: A cross site request forgery vulnerability [CWE-352] in Fortinet FortiNDR version 7.4.0, 7.2.0 through 7.2.1 and 7.1.0 through 7.1.1 and before 7.0.5 may allow a remote unauthenticated attacker to execute unauthorized actions via crafted HTTP GET requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-23-353
CVE ID: CVE-2023-48791 State: PUBLISHED Published: 2023-12-13T06:45:22.196Z Last Updated: 2024-12-02T14:29:38.033Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Fortinet Products: FortiPortal Problem Types: CWE-77 Description: An improper neutralization of special elements used in a command ('Command Injection') vulnerability [CWE-77] in FortiPortal version 7.2.0, version 7.0.6 and below may allow a remote authenticated attacker with at least R/W permission to execute unauthorized commands via specifically crafted arguments in the Schedule System Backup page field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refe
the Schedule System Backup page field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-425