Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-39848 State: REJECTED Published: N/A Last Updated: 2023-08-17T19:22:29.116201 Description: No description available.
CVE ID: CVE-2023-39849 State: REJECTED Published: N/A Last Updated: 2023-08-17T19:23:04.342127 Description: No description available.
CVE ID: CVE-2023-39850 State: PUBLISHED Published: 2023-08-15T00:00:00 Last Updated: 2024-10-08T20:09:57.074Z Vendors: n/a Products: n/a Problem Types: n/a Description: Schoolmate v1.3 was discovered to contain multiple SQL injection vulnerabilities via the $courseid and $teacherid parameters at DeleteFunctions.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sourceforge.net/projects/schoolmate - https://github.com/KLSEHB/vulnerability-report/blob/main/Schoolmate_CVE-2023-39850
CVE ID: CVE-2023-39851 State: PUBLISHED Published: 2023-08-15T00:00:00.000Z Last Updated: 2025-07-03T14:12:22.688Z Vendors: n/a Products: n/a Problem Types: n/a Description: webchess v1.0 was discovered to contain a SQL injection vulnerability via the $playerID parameter at mainmenu.php. NOTE: this is disputed by a third party who indicates that the playerID is a session variable controlled by the server, and thus cannot be used for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sourceforge.net/projects/webchess - https://github.com/KLSEHB/vulnerability-report/blob/main/webchess_CVE-2023-39851
CVE ID: CVE-2023-39852 State: PUBLISHED Published: 2023-08-15T00:00:00 Last Updated: 2024-08-02T18:18:10.003Z Vendors: n/a Products: n/a Problem Types: n/a Description: Doctormms v1.0 was discovered to contain a SQL injection vulnerability via the $userid parameter at myAppoinment.php. NOTE: this is disputed by a third party who claims that the userid is a session variable controlled by the server, and thus cannot be used for exploitation. The original reporter counterclaims that this originates from $_SESSION["userid"]=$_POST["userid"] at line 68 in doctors\doctorlogin.php, where userid under POST is not a session variable controlled by the server. Additional Analyst Notes: - CISA ADP Vulnr
, where userid under POST is not a session variable controlled by the server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.sourcecodester.com/php/14182/doctor-appointment-system.html - https://github.com/KLSEHB/vulnerability-report/blob/main/Doctormms_CVE-2023-39852
CVE ID: CVE-2023-39853 State: PUBLISHED Published: 2024-01-06T00:00:00.000Z Last Updated: 2025-06-16T18:31:43.228Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in Dzzoffice version 2.01, allows remote attackers to obtain sensitive information via the doobj and doevent parameters in the Network Disk backend module. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/EternalGemini/dzz
CVE ID: CVE-2023-39854 State: PUBLISHED Published: 2023-10-09T00:00:00 Last Updated: 2024-09-19T15:56:29.839Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web interface of ATX Ucrypt through 3.5 allows authenticated users (or attackers using default credentials for the admin, master, or user account) to include files via a URL in the /hydra/view/get_cc_url url parameter. There can be resultant SSRF. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wiki.notveg.ninja/blog/CVE-2023-39854/
CVE ID: CVE-2023-39902 State: PUBLISHED Published: 2023-10-17T00:00:00 Last Updated: 2024-09-16T15:15:58.802Z Severity: HIGH (CVSS 7 CVSS:3.1/AC:H/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: A software vulnerability has been identified in the U-Boot Secondary Program Loader (SPL) before 2023.07 on select NXP i.MX 8M family processors. Under certain conditions, a crafted Flattened Image Tree (FIT) format structure can be used to overwrite SPL memory, allowing unauthenticated software to execute on the target, leading to privilege escalation. This affects i.MX 8M, i.MX 8M Mini, i.MX 8M Nano, and i.MX 8M Plus. Additional Analyst Notes: - CVE Progra
e escalation. This affects i.MX 8M, i.MX 8M Mini, i.MX 8M Nano, and i.MX 8M Plus. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nxp.com - https://community.nxp.com/t5/i-MX-Security/U-Boot-Secondary-Program-Loader-Authentication-Vulnerability-CVE/ta-p/1736196
CVE ID: CVE-2023-39903 State: PUBLISHED Published: 2023-08-07T00:00:00 Last Updated: 2024-10-15T20:14:30.482Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AC:L/AV:L/A:N/C:H/I:N/PR:L/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Fujitsu Software Infrastructure Manager (ISM) before 2.8.0.061. The ismsnap component (in this specific case at /var/log/fujitsu/ServerViewSuite/ism/FirmwareManagement/FirmwareManagement.log) allows insecure collection and storage of authorization credentials in cleartext. That occurs when users perform any ISM Firmware Repository Address setup test (Test the Connection), or regularly authorize against an already configured rem
M Firmware Repository Address setup test (Test the Connection), or regularly authorize against an already configured remote firmware repository site, as set up in ISM Firmware Repository Address. A privileged attacker is therefore able to potentially gather the associated ismsnap maintenance data, in the same manner as a trusted party allowed to export ismsnap data from ISM. The preconditions for an ISM installation to be generally vulnerable are that the Download Firmware (Firmware Repository Server) function is enabled and configured, and that the character \ (backslash) is used in a user credential (i.e., user/ID or password) of the remote proxy host / firmware repository server. NOTE: th
is used in a user credential (i.e., user/ID or password) of the remote proxy host / firmware repository server. NOTE: this may overlap CVE-2023-39379. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.ts.fujitsu.com/ProductSecurity/content/Fujitsu-PSIRT-ISS-IS-2023-071410-Security-Notice.pdf - https://security.ts.fujitsu.com/IndexDownload.asp?SoftwareGuid=a0131919-6d84-43b4-800e-d7f78200a70f
CVE ID: CVE-2023-39908 State: PUBLISHED Published: 2023-08-14T00:00:00 Last Updated: 2024-10-09T15:05:26.740Z Vendors: n/a Products: n/a Problem Types: n/a Description: The PKCS11 module of the YubiHSM 2 SDK through 2023.01 does not properly validate the length of specific read operations on object metadata. This may lead to disclosure of uninitialized and previously used memory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.yubico.com/support/security-advisories/ysa-2023-01/ - https://blog.inhq.net/posts/yubico-yubihsm-pkcs-vuln/
CVE ID: CVE-2023-39909 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-08-02T18:18:09.874Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ericsson Network Manager before 23.2 mishandles Access Control and thus unauthenticated low-privilege users can access the NCM application. Additional Analyst Notes: - CVE Program Container: References: - https://www.gruppotim.it/it/footer/red-team.html
CVE ID: CVE-2023-39910 State: PUBLISHED Published: 2023-08-09T00:00:00 Last Updated: 2024-10-10T18:10:09.061Z Vendors: n/a Products: n/a Problem Types: n/a Description: The cryptocurrency wallet entropy seeding mechanism used in Libbitcoin Explorer 3.0.0 through 3.6.0 is weak, aka the Milk Sad issue. The use of an mt19937 Mersenne Twister PRNG restricts the internal entropy to 32 bits regardless of settings. This allows remote attackers to recover any wallet private keys generated from "bx seed" entropy output and steal funds. (Affected users need to move funds to a secure new cryptocurrency wallet.) NOTE: the vendor's position is that there was sufficient documentation advising against "bx
new cryptocurrency wallet.) NOTE: the vendor's position is that there was sufficient documentation advising against "bx seed" but others disagree. NOTE: this was exploited in the wild in June and July 2023. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/libbitcoin/libbitcoin-explorer/blob/20eba4db9a8a3476949d6fd08a589abda7fde3e3/src/commands/seed.cpp#L44 - https://github.com/libbitcoin/libbitcoin-explorer/blob/20eba4db9a8a3476949d6fd08a589abda7fde3e3/src/utility.cpp#L78 - https://github.com/libbitcoin/libbitcoin-system/blob/a1b777fc51d9c04e0c7a1dec5cc746b82a6afe64/src/crypto/pseudo_random.cpp#L66C12-L78 - https://milksad.info/disc
system/blob/a1b777fc51d9c04e0c7a1dec5cc746b82a6afe64/src/crypto/pseudo_random.cpp#L66C12-L78 - https://milksad.info/disclosure.html - https://news.ycombinator.com/item?id=37054862 - https://github.com/libbitcoin/libbitcoin-explorer/wiki/CVE-2023-39910
CVE ID: CVE-2023-39912 State: PUBLISHED Published: 2023-08-31T00:00:00.000Z Last Updated: 2025-06-26T14:24:51.022Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADManager Plus before 7203 allows Help Desk Technician users to read arbitrary files on the machine where this product is installed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://manageengine.com - https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2023-39912.html
CVE ID: CVE-2023-39913 State: PUBLISHED Published: 2023-11-08T08:04:23.911Z Last Updated: 2025-02-13T17:03:15.196Z Vendors: Apache Software Foundation Products: Apache UIMA Java SDK Core, Apache UIMA Java SDK CPE, Apache UIMA Java SDK Vinci adapter, Apache UIMA Java SDK tools Problem Types: CWE-502, CWE-20 Description: Deserialization of Untrusted Data, Improper Input Validation vulnerability in Apache UIMA Java SDK, Apache UIMA Java SDK, Apache UIMA Java SDK, Apache UIMA Java SDK.This issue affects Apache UIMA Java SDK: before 3.5.0. Users are recommended to upgrade to version 3.5.0, which fixes the issue. There are several locations in the code where serialized Java objects are deserialize
sion 3.5.0, which fixes the issue. There are several locations in the code where serialized Java objects are deserialized without verifying the data. This affects in particular: * the deserialization of a Java-serialized CAS, but also other binary CAS formats that include TSI information using the CasIOUtils class; * the CAS Editor Eclipse plugin which uses the the CasIOUtils class to load data; * the deserialization of a Java-serialized CAS of the Vinci Analysis Engine service which can receive using Java-serialized CAS objects over network connections; * the CasAnnotationViewerApplet and the CasTreeViewerApplet; * the checkpointing feature of the CPE module. Note that the UIMA framework by
ViewerApplet and the CasTreeViewerApplet; * the checkpointing feature of the CPE module. Note that the UIMA framework by default does not start any remotely accessible services (i.e. Vinci) that would be vulnerable to this issue. A user or developer would need to make an active choice to start such a service. However, users or developers may use the CasIOUtils in their own applications and services to parse serialized CAS data. They are affected by this issue unless they ensure that the data passed to CasIOUtils is not a serialized Java object. When using Vinci or using CasIOUtils in own services/applications, the unrestricted deserialization of Java-serialized CAS files may allow arbitrary
IOUtils in own services/applications, the unrestricted deserialization of Java-serialized CAS files may allow arbitrary (remote) code execution. As a remedy, it is possible to set up a global or context-specific ObjectInputFilter (cf. https://openjdk.org/jeps/290 and https://openjdk.org/jeps/415 ) if running UIMA on a Java version that supports it. Note that Java 1.8 does not support the ObjectInputFilter, so there is no remedy when running on this out-of-support platform. An upgrade to a recent Java version is strongly recommended if you need to secure an UIMA version that is affected by this issue. To mitigate the issue on a Java 9+ platform, you can configure a filter pattern through the
is affected by this issue. To mitigate the issue on a Java 9+ platform, you can configure a filter pattern through the "jdk.serialFilter" system property using a semicolon as a separator: To allow deserializing Java-serialized binary CASes, add the classes: * org.apache.uima.cas.impl.CASCompleteSerializer * org.apache.uima.cas.impl.CASMgrSerializer * org.apache.uima.cas.impl.CASSerializer * java.lang.String To allow deserializing CPE Checkpoint data, add the following classes (and any custom classes your application uses to store its checkpoints): * org.apache.uima.collection.impl.cpm.CheckpointData * org.apache.uima.util.ProcessTrace * org.apache.uima.util.impl.ProcessTrace_impl * org.apac
ion.impl.cpm.CheckpointData * org.apache.uima.util.ProcessTrace * org.apache.uima.util.impl.ProcessTrace_impl * org.apache.uima.collection.base_cpm.SynchPoint Make sure to use "!*" as the final component to the filter pattern to disallow deserialization of any classes not listed in the pattern. Apache UIMA 3.5.0 uses tightly scoped ObjectInputFilters when reading Java-serialized data depending on the type of data being expected. Configuring a global filter is not necessary with this version. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/lw30f4qlq3mhkhpljj16qw4fot3rg7v4 - http://www.openwall.com/lists/oss-security/202
ces: - https://lists.apache.org/thread/lw30f4qlq3mhkhpljj16qw4fot3rg7v4 - http://www.openwall.com/lists/oss-security/2023/11/08/1
CVE ID: CVE-2023-39914 State: PUBLISHED Published: 2023-09-13T14:17:49.204Z Last Updated: 2024-09-12T13:22:36.893Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: NLnet Labs Products: bcder Problem Types: CWE-232, CWE-240 Description: NLnet Labs' bcder library up to and including version 0.7.2 panics while decoding certain invalid input data rather than rejecting the data with an error. This can affect both the actual decoding stage as well as accessing content of types that utilized delayed decoding. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nlnetlabs.nl/downloads/bcder/CVE-2023-39914.txt
CVE ID: CVE-2023-39915 State: PUBLISHED Published: 2023-09-13T14:20:59.967Z Last Updated: 2024-09-12T13:22:03.133Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: NLnet Labs Products: Routinator Problem Types: CWE-232, CWE-240 Description: NLnet Labs' Routinator up to and including version 0.12.1 may crash when trying to parse certain malformed RPKI objects. This is due to insufficient input checking in the bcder library covered by CVE-2023-39914. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nlnetlabs.nl/downloads/routinator/CVE-2023-39915.txt
CVE ID: CVE-2023-39916 State: PUBLISHED Published: 2023-09-13T14:24:08.907Z Last Updated: 2025-10-03T09:51:46.994Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H) Vendors: NLnet Labs Products: Routinator Problem Types: CWE-35 Description: NLnet Labs’ Routinator 0.9.0 up to and including 0.12.1 as well as 0.14.0 up to and including 0.14.2 contains a possible path traversal vulnerability in the optional, off-by-default keep-rrdp-responses feature that allows users to store the content of responses received for RRDP requests. The location of these stored responses is constructed from the URL of the request. Due to insufficient sanitation of the URL, it is possible for
ored responses is constructed from the URL of the request. Due to insufficient sanitation of the URL, it is possible for an attacker to craft a URL that results in the response being stored outside of the directory specified for it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nlnetlabs.nl/downloads/routinator/CVE-2023-39916.txt
CVE ID: CVE-2023-39917 State: PUBLISHED Published: 2023-10-03T11:14:28.631Z Last Updated: 2024-09-19T20:45:25.708Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Photo Gallery Team Products: Photo Gallery by Ays – Responsive Image Gallery Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Photo Gallery Team Photo Gallery by Ays – Responsive Image Gallery plugin <= 5.2.6 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/gallery-photo-gallery/wordpress-photo-gallery-by-ays-responsive-image-gallery-plugin-5-2-6-cross-site-request-
erability/gallery-photo-gallery/wordpress-photo-gallery-by-ays-responsive-image-gallery-plugin-5-2-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-39918 State: PUBLISHED Published: 2023-09-04T10:05:47.965Z Last Updated: 2024-09-24T18:52:26.618Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: SAASPROJECT Booking Package Products: Booking Package Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in SAASPROJECT Booking Package Booking Package plugin <= 1.6.01 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/booking-package/wordpress-booking-package-plugin-1-6-01-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-39919 State: PUBLISHED Published: 2023-09-04T10:01:33.412Z Last Updated: 2024-09-24T18:52:46.021Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: maennchen1.de Products: wpShopGermany – Protected Shops Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in maennchen1.De wpShopGermany – Protected Shops plugin <= 2.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wpshopgermany-protectedshops/wordpress-wpshopgermany-protected-shops-plugin-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-39920 State: PUBLISHED Published: 2024-12-13T14:23:58.879Z Last Updated: 2024-12-13T18:22:22.336Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Themeisle Products: Redirection for Contact Form 7 Problem Types: CWE-862 Description: Missing Authorization vulnerability in Themeisle Redirection for Contact Form 7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Redirection for Contact Form 7: from n/a through 2.9.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wpcf7-redirect/vulnerability/wordpress-redirection-for-contact-form-7-plugin-
//patchstack.com/database/wordpress/plugin/wpcf7-redirect/vulnerability/wordpress-redirection-for-contact-form-7-plugin-2-9-2-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-39921 State: PUBLISHED Published: 2023-11-30T15:47:35.524Z Last Updated: 2024-08-02T18:18:10.096Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Molongui Products: Author Box, Guest Author and Co-Authors for Your Posts – Molongui Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Molongui Author Box, Guest Author and Co-Authors for Your Posts – Molongui allows Stored XSS.This issue affects Author Box, Guest Author and Co-Authors for Your Posts – Molongui: from n/a through 4.6.19. Additional Analyst Notes: - CVE Program Container: References: - https://patc
Posts – Molongui: from n/a through 4.6.19. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/molongui-authorship/wordpress-author-box-for-authors-co-authors-multiple-authors-and-guest-authors-molongui-plugin-4-6-19-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-39922 State: PUBLISHED Published: 2024-06-19T12:17:04.953Z Last Updated: 2024-08-09T18:47:54.104Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: ThemeFusion Products: Avada Problem Types: CWE-862 Description: Missing Authorization vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/avada/wordpress-avada-theme-7-11-1-authenticated-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-39923 State: PUBLISHED Published: 2023-10-03T11:05:28.232Z Last Updated: 2024-09-19T20:46:25.970Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: RadiusTheme Products: The Post Grid Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in RadiusTheme The Post Grid plugin <= 7.2.7 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/the-post-grid/wordpress-the-post-grid-plugin-7-2-7-cross-site-request-forgery-csrf-leading-to-css-change-vulnerability?_s_id=cve
CVE ID: CVE-2023-39924 State: PUBLISHED Published: 2023-10-24T11:51:07.312Z Last Updated: 2024-09-09T14:45:02.631Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Mitchell Bennis Products: Simple File List Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mitchell Bennis Simple File List plugin <= 6.1.9 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/simple-file-list/wordpress-simple-file-list-plugin-6-1-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-39925 State: PUBLISHED Published: 2023-11-22T18:44:39.756Z Last Updated: 2024-10-01T15:49:19.985Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: PeepSo Products: Download Community by PeepSo Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Download Community by PeepSo plugin <= 6.1.6.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/peepso-core/wordpress-peepso-plugin-6-1-6-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-39926 State: PUBLISHED Published: 2023-11-16T19:24:13.164Z Last Updated: 2024-09-04T20:28:38.399Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Acurax Products: Under Construction / Maintenance Mode from Acurax Problem Types: CWE-79 Description: Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Acurax Under Construction / Maintenance Mode from Acurax plugin <= 2.6 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/coming-soon-maintenance-mode-from-acurax/wordpress-under-construction-maintenance-mode-from-acurax-plugin-2-6-cross-site-script
soon-maintenance-mode-from-acurax/wordpress-under-construction-maintenance-mode-from-acurax-plugin-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve