Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-1856 State: PUBLISHED Published: 2023-04-05T07:40:18.066Z Last Updated: 2024-08-02T06:05:26.762Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Air Cargo Management System Problem Types: CWE-89 Description: A vulnerability has been found in SourceCodester Air Cargo Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/transactions/track_shipment.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated iden
. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224995. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.224995 - https://vuldb.com/?ctiid.224995 - https://github.com/Hackergrave/bug_report/blob/main/SQLi-1.md
CVE ID: CVE-2023-1857 State: PUBLISHED Published: 2023-04-05T07:40:20.707Z Last Updated: 2024-08-02T06:05:26.815Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: SourceCodester Products: Online Computer and Laptop Store Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Online Computer and Laptop Store 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/?page=product/manage_product&id=2. The manipulation of the argument Product Name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability
e launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224996. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.224996 - https://vuldb.com/?ctiid.224996 - https://github.com/v2ish1yan/mycve/blob/main/ocls.md
CVE ID: CVE-2023-1858 State: PUBLISHED Published: 2023-04-05T08:00:08.756Z Last Updated: 2024-08-02T06:05:26.698Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SourceCodester Products: Earnings and Expense Tracker App Problem Types: CWE-200 Description: A vulnerability was found in SourceCodester Earnings and Expense Tracker App 1.0. It has been classified as problematic. This affects an unknown part of the file index.php. The manipulation of the argument page leads to information disclosure. It is possible to initiate the attack remotely. The identifier VDB-224997 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: Refer
. The identifier VDB-224997 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.224997 - https://vuldb.com/?ctiid.224997
CVE ID: CVE-2023-1859 State: PUBLISHED Published: 2023-05-17T00:00:00.000Z Last Updated: 2025-03-18T18:57:06.990Z Vendors: n/a Products: Kernel Problem Types: CWE-416 Description: A use-after-free flaw was found in xen_9pfs_front_removet in net/9p/trans_xen.c in Xen transport for 9pfs in the Linux Kernel. This flaw could allow a local attacker to crash the system due to a race problem, possibly leading to a kernel information leak. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lore.kernel.org/all/20230313090002.3308025-1-zyytlz.wz%40163.com/
CVE ID: CVE-2023-1860 State: PUBLISHED Published: 2023-04-05T08:31:03.746Z Last Updated: 2024-08-02T06:05:26.758Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Keysight Products: IXIA Hawkeye Problem Types: CWE-79 Description: A vulnerability was found in Keysight IXIA Hawkeye 3.3.16.28. It has been declared as problematic. This vulnerability affects unknown code of the file /licenses. The manipulation of the argument view with the input teste"><script>alert(%27c4ng4c3ir0%27)</script> leads to cross site scripting. The attack can be initiated remotely. VDB-224998 is the identifier assigned to this vulnerability. NOTE: Vendor did not respond if and how they may handle this issue.
98 is the identifier assigned to this vulnerability. NOTE: Vendor did not respond if and how they may handle this issue. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.224998 - https://vuldb.com/?ctiid.224998
CVE ID: CVE-2023-1861 State: PUBLISHED Published: 2023-05-02T07:04:50.246Z Last Updated: 2025-01-30T15:01:03.113Z Vendors: Unknown Products: Limit Login Attempts Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Limit Login Attempts WordPress plugin through 1.7.2 does not sanitize and escape usernames when outputting them back in the logs dashboard, which could allow any authenticated users, such as subscriber to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/461cbcca-aed7-4c92-ba35-ebabf4fcd810
CVE ID: CVE-2023-1862 State: PUBLISHED Published: 2023-06-20T08:28:12.578Z Last Updated: 2024-12-09T18:31:09.155Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Cloudflare Products: WARP Client Problem Types: CWE-284 Description: Cloudflare WARP client for Windows (up to v2023.3.381.0) allowed a malicious actor to remotely access the warp-svc.exe binary due to an insufficient access control policy on an IPC Named Pipe. This would have enabled an attacker to trigger WARP connect and disconnect commands, as well as obtaining network diagnostics and application configuration from the target's device. It is important to note that in order to exploit this, a set o
s and application configuration from the target's device. It is important to note that in order to exploit this, a set of requirements would need to be met, such as the target's device must've been reachable on port 445, allowed authentication with NULL sessions or otherwise having knowledge of the target's credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://developers.cloudflare.com/warp-client/get-started/windows/ - https://install.appcenter.ms/orgs/cloudflare/apps/1.1.1.1-windows-1/distribution_groups/release - https://github.com/cloudflare/advisories/security/advisories/GHSA-q55r-53c8-5642
CVE ID: CVE-2023-1863 State: PUBLISHED Published: 2023-04-14T08:14:06.058Z Last Updated: 2025-02-06T19:53:28.453Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Eskom Products: Water Metering Software Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eskom Water Metering Software allows Command Line Execution through SQL Injection.This issue affects Water Metering Software: before 23.04.06. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0225
CVE ID: CVE-2023-1864 State: PUBLISHED Published: 2023-06-07T20:43:17.256Z Last Updated: 2025-01-06T21:23:18.779Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: FANUC Products: ROBOGUIDE-HandlingPRO Problem Types: CWE-22 Description: FANUC ROBOGUIDE-HandlingPRO Versions 9 Rev.ZD and prior is vulnerable to a path traversal, which could allow an attacker to remotely read files on the system running the affected software. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-101-01
CVE ID: CVE-2023-1865 State: PUBLISHED Published: 2023-04-05T13:22:37.549Z Last Updated: 2025-01-13T16:56:29.804Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: pluginbuilders Products: YourChannel: Everything you want in a YouTube plugin. Problem Types: CWE-862 Missing Authorization Description: The YourChannel plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check when resetting plugin settings via the yrc_nuke GET parameter in versions up to, and including, 1.2.3. This makes it possible for unauthenticated attackers to delete YouTube channels from the plugin. Additional Analyst Notes: - CVE Program Container: -
uthenticated attackers to delete YouTube channels from the plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/34817e32-d5a3-403a-85f0-1d60af8945de?source=cve - https://plugins.trac.wordpress.org/browser/yourchannel/trunk/YourChannel.php?rev=2844975#L772 - https://wordpress.org/plugins/yourchannel/
CVE ID: CVE-2023-1866 State: PUBLISHED Published: 2023-04-05T13:23:11.929Z Last Updated: 2025-01-13T16:56:19.158Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: pluginbuilders Products: YourChannel: Everything you want in a YouTube plugin. Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The YourChannel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.3. This is due to missing or incorrect nonce validation on the clearKeys function. This makes it possible for unauthenticated attackers to reset the plugin's channel settings via a forged request granted they can trick a site administra
enticated attackers to reset the plugin's channel settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/45851efe-2584-4b5e-8e4c-24f289d3bc32?source=cve - https://plugins.trac.wordpress.org/browser/yourchannel/trunk/YourChannel.php?rev=2844975#L107
CVE ID: CVE-2023-1867 State: PUBLISHED Published: 2023-04-05T13:23:35.413Z Last Updated: 2025-01-13T16:56:10.361Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: pluginbuilders Products: YourChannel: Everything you want in a YouTube plugin. Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The YourChannel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.3. This is due to missing or incorrect nonce validation on the save function. This makes it possible for unauthenticated attackers to change the plugin's settings via a forged request granted they can trick a site administrator into per
ated attackers to change the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4c20db2d-f73d-4e52-a275-ab1975ae4b17?source=cve - https://plugins.trac.wordpress.org/browser/yourchannel/trunk/YourChannel.php?rev=2844975#L426 - https://wordpress.org/plugins/yourchannel/
CVE ID: CVE-2023-1868 State: PUBLISHED Published: 2023-04-05T13:23:54.922Z Last Updated: 2025-01-13T16:55:59.276Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: pluginbuilders Products: YourChannel: Everything you want in a YouTube plugin. Problem Types: CWE-862 Missing Authorization Description: The YourChannel plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check when clearing the plugin cache via the yrc_clear_cache GET parameter in versions up to, and including, 1.2.3. This makes it possible for unauthenticated attackers to clear the plugin's cache. Additional Analyst Notes: - CVE Program Container: - CISA ADP
for unauthenticated attackers to clear the plugin's cache. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/541d202b-f3ed-44d8-93a6-e158209db885?source=cve - https://plugins.trac.wordpress.org/browser/yourchannel/trunk/YourChannel.php?rev=2844975#L768 - https://wordpress.org/plugins/yourchannel/
CVE ID: CVE-2023-1869 State: PUBLISHED Published: 2023-04-05T13:24:22.502Z Last Updated: 2025-01-13T16:55:50.066Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L) Vendors: pluginbuilders Products: YourChannel: Everything you want in a YouTube plugin. Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The YourChannel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrative-level permissions and above, to
utput escaping. This makes it possible for authenticated attackers, with administrative-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a81d5615-0b96-4d89-a525-7e80a10a9317?source=cve - https://wordpress.org/plugins/yourchannel/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2899732%40yourchannel&new=2899732%40yourchannel&sfp_ema
trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2899732%40yourchannel&new=2899732%40yourchannel&sfp_email=&sfph_mail=
CVE ID: CVE-2023-1870 State: PUBLISHED Published: 2023-04-05T13:24:49.539Z Last Updated: 2025-01-13T16:55:40.540Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: pluginbuilders Products: YourChannel: Everything you want in a YouTube plugin. Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The YourChannel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.3. This is due to missing or incorrect nonce validation on the saveLang function. This makes it possible for unauthenticated attackers to change the plugin's quick language translation settings via a forged request granted they can tric
nticated attackers to change the plugin's quick language translation settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c1cec0b1-b77c-4d21-a3d2-c79fd3250bb0?source=cve - https://plugins.trac.wordpress.org/browser/yourchannel/trunk/YourChannel.php?rev=2844975#L498 - https://wordpress.org/plugins/yourchannel/
CVE ID: CVE-2023-1871 State: PUBLISHED Published: 2023-04-05T13:25:27.638Z Last Updated: 2025-01-13T16:55:30.538Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: pluginbuilders Products: YourChannel: Everything you want in a YouTube plugin. Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The YourChannel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.3. This is due to missing or incorrect nonce validation on the deleteLang function. This makes it possible for unauthenticated attackers to reset the plugin's quick language translation settings via a forged request granted they can tri
henticated attackers to reset the plugin's quick language translation settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f7ae863c-4638-49ab-bb1f-52346884c3aa?source=cve - https://plugins.trac.wordpress.org/browser/yourchannel/trunk/YourChannel.php?rev=2844975#L505 - https://wordpress.org/plugins/yourchannel/
CVE ID: CVE-2023-1872 State: PUBLISHED Published: 2023-04-12T15:40:42.386Z Last Updated: 2025-02-13T16:39:40.499Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Linux Products: Linux Kernel Problem Types: CWE-416 Description: A use-after-free vulnerability in the Linux Kernel io_uring system can be exploited to achieve local privilege escalation. The io_file_get_fixed function lacks the presence of ctx->uring_lock which can lead to a Use-After-Free vulnerability due a race condition with fixed files getting unregistered. We recommend upgrading past commit da24142b1ef9fd5d36b76e36bab328a5b27523e8. Additional Analyst Notes: - CVE Program Container: References:
ng past commit da24142b1ef9fd5d36b76e36bab328a5b27523e8. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-5.10.y&id=08681391b84da27133deefaaddefd0acfa90c2be - https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-5.10.y&id=da24142b1ef9fd5d36b76e36bab328a5b27523e8 - https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html - https://security.netapp.com/advisory/ntap-20230601-0002/ - http://packetstormsecurity.com/files/173087/Kernel-Live-Patch-Security-Notice-LSN-0095-1.html
CVE ID: CVE-2023-1873 State: PUBLISHED Published: 2023-04-17T13:06:28.532Z Last Updated: 2025-02-05T20:45:21.533Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Faturamatik Products: Bircard Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Faturamatik Bircard allows SQL Injection.This issue affects Bircard: before 23.04.05. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0231 - https://www.faturamatik.com.tr/tr/hizmetlerimiz/bircard
CVE ID: CVE-2023-1874 State: PUBLISHED Published: 2023-04-12T13:30:09.163Z Last Updated: 2025-02-13T16:39:41.089Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: peterschulznl Products: WP Data Access Problem Types: CWE-266 Incorrect Privilege Assignment Description: The WP Data Access plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.3.7. This is due to a lack of authorization checks on the multiple_roles_update function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'wpda_role[]' parameter during a profile update. This
such as a subscriber, to modify their user role by supplying the 'wpda_role[]' parameter during a profile update. This requires the 'Enable role management' setting to be enabled for the site. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8f562e33-2aef-46f0-8a65-691155ede9e7?source=cve - https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.3.7/WPDataRoles/WPDA_Roles.php#L50 - https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.3.8/WPDataRoles/WPDA_Roles.php#L50 - https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.3.8/WPDataRoles/WPDA_Roles.php#L23 - ht
Roles.php#L50 - https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.3.8/WPDataRoles/WPDA_Roles.php#L23 - http://packetstormsecurity.com/files/171825/WordPress-WP-Data-Access-5.3.7-Privilege-Escalation.html
CVE ID: CVE-2023-1875 State: PUBLISHED Published: 2023-04-22T00:00:00.000Z Last Updated: 2025-02-04T19:36:45.373Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: thorsten Products: thorsten/phpmyfaq Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/39715aaf-e798-4c60-97c4-45f4f2cd5c61 - https://github.com/thorsten/phpmyfaq/commit/dcf7dd43a3412aa951d7087b86a8b917fae2133a
CVE ID: CVE-2023-1876 State: REJECTED Published: N/A Last Updated: 2023-04-10T00:00:00 Description: No description available.
CVE ID: CVE-2023-1877 State: PUBLISHED Published: 2023-04-05T00:00:00.000Z Last Updated: 2025-02-10T20:41:04.971Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L) Vendors: microweber Products: microweber/microweber Problem Types: CWE-77 Description: Command Injection in GitHub repository microweber/microweber prior to 1.3.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/71fe4b3b-20ac-448c-8191-7b99d7ffaf55 - https://github.com/microweber/microweber/commit/93a906d0bf096c3ab1674012a90c88d101e76c8d
CVE ID: CVE-2023-1878 State: PUBLISHED Published: 2023-04-05T00:00:00.000Z Last Updated: 2025-02-10T20:40:33.052Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L) Vendors: thorsten Products: thorsten/phpmyfaq Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/93f981a3-231d-460d-a239-bb960e8c2fdc - https://github.com/thorsten/phpmyfaq/commit/e018823f8e3bca103c11e5a98b0dd469e41ed417
CVE ID: CVE-2023-1879 State: PUBLISHED Published: 2023-04-05T00:00:00.000Z Last Updated: 2025-02-10T20:39:58.404Z Severity: MEDIUM (CVSS 4.7 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: thorsten Products: thorsten/phpmyfaq Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/1dc7f818-c8ea-4f80-b000-31b48a426334 - https://github.com/thorsten/phpmyfaq/commit/0dc8e527c375007cd4b8dbf61f7167393a6f6e91
CVE ID: CVE-2023-1880 State: PUBLISHED Published: 2023-04-05T00:00:00.000Z Last Updated: 2025-02-10T19:50:34.904Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L) Vendors: thorsten Products: thorsten/phpmyfaq Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/ece5f051-674e-4919-b998-594714910f9e - https://github.com/thorsten/phpmyfaq/commit/bbc5d4aa4a4375c14e34dd9fcad2042066fe476d
CVE ID: CVE-2023-1881 State: PUBLISHED Published: 2023-04-05T00:00:00.000Z Last Updated: 2025-02-10T19:50:03.915Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: microweber Products: microweber/microweber Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/d5ebc2bd-8638-41c4-bf72-7c906c601344 - https://github.com/microweber/microweber/commit/8d039de2d615956f6df8df0bb1045ff3be88f183
CVE ID: CVE-2023-1882 State: PUBLISHED Published: 2023-04-05T00:00:00.000Z Last Updated: 2025-02-10T19:49:42.117Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N) Vendors: thorsten Products: thorsten/phpmyfaq Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/8ab09a1c-cfd5-4ce0-aae3-d33c93318957 - https://github.com/thorsten/phpmyfaq/commit/49db615c300ae0f87795f20570f6f5bdccb1d2f2