Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-5483 State: PUBLISHED Published: 2023-10-11T22:28:52.559Z Last Updated: 2025-02-13T17:25:36.236Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Intents in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html - https://crbug.com/1425355 - https://www.debian.org/security/2023/dsa-5526 - https://security.gentoo.org/glsa/202311-11 - https://security.g
425355 - https://www.debian.org/security/2023/dsa-5526 - https://security.gentoo.org/glsa/202311-11 - https://security.gentoo.org/glsa/202312-07 - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-5484 State: PUBLISHED Published: 2023-10-11T22:28:52.198Z Last Updated: 2025-02-13T17:25:36.765Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Navigation in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html - https://crbug.com/1414936 - https://www.debian.org/security/2023/dsa-5526 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedo
ttps://www.debian.org/security/2023/dsa-5526 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F5QCMP6KKWPDZZLFU7YXSZDHEKOE7BXO/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4GHJ3FK5NPHDRUR4OJOI4UU6FKSOOGG/ - https://security.gentoo.org/glsa/202311-11 - https://security.gentoo.org/glsa/202312-07 - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-5485 State: PUBLISHED Published: 2023-10-11T22:28:53.651Z Last Updated: 2025-06-16T16:55:22.364Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Autofill in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to bypass autofill restrictions via a crafted HTML page. (Chromium security severity: Low) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html - https://crbug.com/1395164 - https://www.debian.org/security/2023/dsa-5526 - https://security.gentoo.org/glsa/202311-11
- https://crbug.com/1395164 - https://www.debian.org/security/2023/dsa-5526 - https://security.gentoo.org/glsa/202311-11 - https://security.gentoo.org/glsa/202312-07 - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-5486 State: PUBLISHED Published: 2023-10-11T22:28:54.163Z Last Updated: 2025-02-13T17:25:37.937Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Input in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Low) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html - https://crbug.com/1357442 - https://www.debian.org/security/2023/dsa-5526 - https://security.gentoo.org/glsa/202311-11 - https://sec
g.com/1357442 - https://www.debian.org/security/2023/dsa-5526 - https://security.gentoo.org/glsa/202311-11 - https://security.gentoo.org/glsa/202312-07 - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-5487 State: PUBLISHED Published: 2023-10-11T22:28:51.928Z Last Updated: 2025-02-13T17:25:38.461Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Fullscreen in Google Chrome prior to 118.0.5993.70 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html - https://crbug.com/1062251 - https://www.debian.org/security/2023/dsa-5526 - https
e-channel-update-for-desktop_10.html - https://crbug.com/1062251 - https://www.debian.org/security/2023/dsa-5526 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F5QCMP6KKWPDZZLFU7YXSZDHEKOE7BXO/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4GHJ3FK5NPHDRUR4OJOI4UU6FKSOOGG/ - https://security.gentoo.org/glsa/202311-11 - https://security.gentoo.org/glsa/202312-07 - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-5488 State: PUBLISHED Published: 2023-10-10T14:00:07.199Z Last Updated: 2024-08-02T07:59:44.759Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Byzoro Products: Smart S45F Multi-Service Secure Gateway Intelligent Management Platform Problem Types: CWE-434 Description: A vulnerability was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928. It has been rated as critical. Affected by this issue is some unknown functionality of the file /sysmanage/updatelib.php. The manipulation of the argument file_upload leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the publ
ile_upload leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-241640. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.241640 - https://vuldb.com/?ctiid.241640 - https://vuldb.com/?submit.213945 - https://github.com/llixixi/cve/blob/main/s45_upload_%20updatelib.md
CVE ID: CVE-2023-5489 State: PUBLISHED Published: 2023-10-10T14:31:05.075Z Last Updated: 2024-08-29T19:30:03.119Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Byzoro Products: Smart S45F Multi-Service Secure Gateway Intelligent Management Platform Problem Types: CWE-434 Description: A vulnerability classified as critical has been found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928. This affects an unknown part of the file /Tool/uploadfile.php. The manipulation of the argument file_upload leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
d upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-241641 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.241641 - https://vuldb.com/?ctiid.241641 - https://vuldb.com/?submit.213946 - https://github.com/llixixi/cve/blob/main/s45_upload_%20uploadfile.md
CVE ID: CVE-2023-5490 State: PUBLISHED Published: 2023-10-10T15:00:06.541Z Last Updated: 2024-08-02T07:59:44.821Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Byzoro Products: Smart S45F Multi-Service Secure Gateway Intelligent Management Platform Problem Types: CWE-434 Description: A vulnerability classified as critical was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928. This vulnerability affects unknown code of the file /useratte/userattestation.php. The manipulation of the argument web_img leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-241642 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.241642 - https://vuldb.com/?ctiid.241642 - https://vuldb.com/?submit.213947 - https://github.com/llixixi/cve/blob/main/s45_upload_%20userattestation.md
CVE ID: CVE-2023-5491 State: PUBLISHED Published: 2023-10-10T15:00:08.080Z Last Updated: 2025-06-16T17:03:09.621Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Byzoro Products: Smart S45F Multi-Service Secure Gateway Intelligent Management Platform Problem Types: CWE-434 Description: A vulnerability, which was classified as critical, has been found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928. This issue affects some unknown processing of the file /sysmanage/updatelib.php. The manipulation of the argument file_upload leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the publ
le_upload leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-241643. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.241643 - https://vuldb.com/?ctiid.241643 - https://vuldb.com/?submit.213948 - https://github.com/llixixi/cve/blob/main/s45_upload_changelogo.md
CVE ID: CVE-2023-5492 State: PUBLISHED Published: 2023-10-10T15:31:05.108Z Last Updated: 2024-08-02T07:59:44.759Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Byzoro Products: Smart S45F Multi-Service Secure Gateway Intelligent Management Platform Problem Types: CWE-434 Description: A vulnerability, which was classified as critical, was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928. Affected is an unknown function of the file /sysmanage/licence.php. The manipulation of the argument file_upload leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may
unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-241644. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.241644 - https://vuldb.com/?ctiid.241644 - https://vuldb.com/?submit.213949 - https://github.com/llixixi/cve/blob/main/s45_upload_licence.md
CVE ID: CVE-2023-5493 State: PUBLISHED Published: 2023-10-10T16:00:07.713Z Last Updated: 2024-08-02T07:59:44.766Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Byzoro Products: Smart S45F Multi-Service Secure Gateway Intelligent Management Platform Problem Types: CWE-434 Description: A vulnerability has been found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /useratte/web.php. The manipulation of the argument file_upload leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the publ
ile_upload leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-241645 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.241645 - https://vuldb.com/?ctiid.241645 - https://vuldb.com/?submit.213951 - https://github.com/llixixi/cve/blob/main/s45_upload_web.md
CVE ID: CVE-2023-5494 State: PUBLISHED Published: 2023-10-10T16:00:09.066Z Last Updated: 2024-08-02T07:59:44.893Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Byzoro Products: Smart S45F Multi-Service Secure Gateway Intelligent Management Platform Problem Types: CWE-78 Description: A vulnerability was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928 and classified as critical. Affected by this issue is some unknown functionality of the file /log/download.php. The manipulation of the argument file leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used
os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-241646 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.241646 - https://vuldb.com/?ctiid.241646 - https://vuldb.com/?submit.215382 - https://github.com/7332all/cve/blob/main/rce_1.md
CVE ID: CVE-2023-5495 State: PUBLISHED Published: 2023-10-10T16:31:04.696Z Last Updated: 2025-02-13T17:25:39.033Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: QDocs Products: Smart School Problem Types: CWE-89 Description: A vulnerability was found in QDocs Smart School 6.4.1. It has been classified as critical. This affects an unknown part of the file /course/filterRecords/ of the component HTTP POST Request Handler. The manipulation of the argument searchdata[0][title]/searchdata[0][searchfield]/searchdata[0][searchvalue] leads to sql injection. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-241647. NOTE: The vendor wa
ible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-241647. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.241647 - https://vuldb.com/?ctiid.241647 - http://packetstormsecurity.com/files/175071/Smart-School-6.4.1-SQL-Injection.html
CVE ID: CVE-2023-5496 State: PUBLISHED Published: 2023-10-10T17:00:06.617Z Last Updated: 2025-06-16T17:02:13.765Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Translator Products: PoqDev Add-On Problem Types: CWE-79 Description: A vulnerability was found in Translator PoqDev Add-On 1.0.11 on Firefox. It has been rated as problematic. This issue affects some unknown processing of the component Select Text Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The identifier
The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-241649 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.241649 - https://vuldb.com/?ctiid.241649 - https://fastupload.io/en/G5tO8X1vM8ge4qJ/file
CVE ID: CVE-2023-5497 State: PUBLISHED Published: 2023-10-10T17:31:05.431Z Last Updated: 2024-09-18T18:48:46.795Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Tongda Products: OA 2017 Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in Tongda OA 2017 11.10. Affected is an unknown function of the file general/hr/salary/welfare_manage/delete.php. The manipulation of the argument WELFARE_ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-241650 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA AD
DB-241650 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.241650 - https://vuldb.com/?ctiid.241650 - https://github.com/RCEraser/cve/blob/main/sql_inject_4.md
CVE ID: CVE-2023-5498 State: PUBLISHED Published: 2023-10-10T09:08:52.815Z Last Updated: 2024-09-18T19:06:42.345Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: chiefonboarding Products: chiefonboarding/chiefonboarding Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) in GitHub repository chiefonboarding/chiefonboarding prior to v2.0.47. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/ec367b1d-5ec4-4ab2-881a-caf82e4877d9 - https://github.com/chiefonboarding/chiefonboarding/commit/7de93f5fcc21e8f16fa0a64d38461c1b48ff3ee7
CVE ID: CVE-2023-5499 State: PUBLISHED Published: 2023-10-10T13:21:59.698Z Last Updated: 2024-08-02T07:59:44.903Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: SHENZHEN REACHFAR TECHNOLOGY COMPANY LIMITED Products: Shenzhen Reachfar v28 Problem Types: CWE-532 Description: Information exposure vulnerability in Shenzhen Reachfar v28, the exploitation of which could allow a remote attacker to retrieve all the week's logs stored in the 'log2' directory. An attacker could retrieve sensitive information such as remembered wifi networks, sent messages, SOS device locations and device configurations. Additional Analyst Notes: - CVE Program Container: References: - h
ages, SOS device locations and device configurations. Additional Analyst Notes: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/shenzhen-reachfar-v28-information-exposure
CVE ID: CVE-2023-5500 State: PUBLISHED Published: 2023-12-11T07:13:51.308Z Last Updated: 2024-08-02T07:59:44.783Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Frauscher Products: FDS102 for FAdC/FAdCi Problem Types: CWE-94 Description: This vulnerability allows an remote attacker with low privileges to misuse Improper Control of Generation of Code ('Code Injection') to gain full control of the affected device. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/en/advisories/VDE-2023-049/
CVE ID: CVE-2023-5504 State: PUBLISHED Published: 2024-01-11T08:33:06.702Z Last Updated: 2024-11-06T18:28:02.196Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H) Vendors: wp_media Products: BackWPup – WordPress Backup Plugin Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The BackWPup plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.0.1 via the Log File Folder. This allows authenticated attackers to store backups in arbitrary folders on the server provided they can be written to by the server. Additionally, default settings will place an index.php and a .htacc
erver provided they can be written to by the server. Additionally, default settings will place an index.php and a .htaccess file into the chosen directory (unless already present) when the first backup job is run that are intended to prevent directory listing and file access. This means that an attacker could set the backup directory to the root of another site in a shared environment and thus disable that site. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e830fe1e-1171-46da-8ee7-0a6654153f18?source=cve - https://plugins.trac.wordpress.org/browser/backwpup/trunk/inc/class-page-settings.php?
da-8ee7-0a6654153f18?source=cve - https://plugins.trac.wordpress.org/browser/backwpup/trunk/inc/class-page-settings.php?rev=2818974#L457 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3000176%40backwpup%2Ftrunk&old=2980789%40backwpup%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-5505 State: PUBLISHED Published: 2024-08-17T08:37:24.102Z Last Updated: 2024-08-19T13:46:27.129Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H) Vendors: wp_media Products: BackWPup – WordPress Backup & Restore Plugin Problem Types: CWE-22 Description: The BackWPup plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.0.1 via the job-specific backup folder. This allows authenticated attackers to store backups in arbitrary folders on the server provided they can be written to by the server. Additionally, default settings will place an index.php and a .htaccess file into the chosen directory (unless already prese
itionally, default settings will place an index.php and a .htaccess file into the chosen directory (unless already present) when the first backup job is run that are intended to prevent directory listing and file access. This means that an attacker could set the backup directory to the root of another site in a shared environment and thus disable that site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/98085a23-0cb6-442a-a28a-cb5c2890b60d?source=cve - https://plugins.trac.wordpress.org/browser/backwpup/trunk/inc/class-page-editjob.php?rev=2818974#L29 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mai
wpup/trunk/inc/class-page-editjob.php?rev=2818974#L29 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2980789%40backwpup%2Ftrunk&old=2954541%40backwpup%2Ftrunk&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset/3000176/backwpup/trunk/inc/class-destination-folder.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3000176%40backwpup&new=3000176%40backwpup&sfp_email=&sfph_mail=
CVE ID: CVE-2023-5506 State: PUBLISHED Published: 2023-11-07T11:01:44.102Z Last Updated: 2025-02-05T18:51:13.939Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: spikefinned Products: ImageMapper Problem Types: CWE-862 Missing Authorization Description: The ImageMapper plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'imgmap_delete_area_ajax' function in versions up to, and including, 1.2.6. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete arbitrary posts and pages. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refer
, to delete arbitrary posts and pages. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/31dff395-c3ce-4ebe-8d38-5243fc4510d6?source=cve - https://plugins.trac.wordpress.org/browser/imagemapper/tags/1.2.6/imagemapper.php#L748
CVE ID: CVE-2023-5507 State: PUBLISHED Published: 2023-11-07T11:01:45.640Z Last Updated: 2025-02-05T18:50:52.411Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: spikefinned Products: ImageMapper Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The ImageMapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'imagemap' shortcode in versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary