Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
or WordPress are vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with the edit_posts capability, such as contributors and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1ab05954-9999-43ff-8e3c-a987e2da1956?source=cve - https://plugins.trac.wordpress.org/browser/event-registration-calendar-by-vcita/trunk/system/parse_v
da1956?source=cve - https://plugins.trac.wordpress.org/browser/event-registration-calendar-by-vcita/trunk/system/parse_vcita_callback.php#L55 - https://plugins.trac.wordpress.org/browser/paypal-payment-button-by-vcita/trunk/system/parse_vcita_callback.php - https://blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcita
CVE ID: CVE-2023-2407 State: PUBLISHED Published: 2023-06-03T04:35:13.332Z Last Updated: 2024-12-20T23:58:05.889Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: vcita Products: Event Registration Calendar By vcita, Online Payments – Get Paid with PayPal, Square & Stripe Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Event Registration Calendar By vcita plugin, versions up to and including 3.9.1, and Online Payments – Get Paid with PayPal, Square & Stripe plugin, for WordPress are vulnerable to Cross-Site Request Forgery. This is due to missing nonce validation in the ls_parse_vcita_callback() function. This makes it possible for u
Forgery. This is due to missing nonce validation in the ls_parse_vcita_callback() function. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/207b40fa-2062-48d6-990b-f05cbbf8fb8e?source=cve - https://plugins.trac.wordpress.org/browser/event-registration-calendar-by-vcita/trunk/system/parse_vcita_callback.php#L55 - https://plugins.trac.wordpress.org/browser/paypal-
tration-calendar-by-vcita/trunk/system/parse_vcita_callback.php#L55 - https://plugins.trac.wordpress.org/browser/paypal-payment-button-by-vcita/trunk/system/parse_vcita_callback.php - https://blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcita
CVE ID: CVE-2023-2408 State: PUBLISHED Published: 2023-04-28T22:31:04.313Z Last Updated: 2024-08-02T06:19:15.099Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: AC Repair and Services System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in SourceCodester AC Repair and Services System 1.0. Affected by this issue is some unknown functionality of the file services/view.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-227702 is the identifier assigned to this vulnerability. Additional A
been disclosed to the public and may be used. VDB-227702 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.227702 - https://vuldb.com/?ctiid.227702 - https://github.com/Yp1oneer/cve_hub/blob/main/AC%20Repair%20and%20Services%20System/SQL-Injection-1.pdf
CVE ID: CVE-2023-2409 State: PUBLISHED Published: 2023-04-28T22:31:05.443Z Last Updated: 2024-11-22T16:01:33.384Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: AC Repair and Services System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in SourceCodester AC Repair and Services System 1.0. This affects an unknown part of the file /admin/services/view_service.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227703. Additional An
en disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227703. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.227703 - https://vuldb.com/?ctiid.227703 - https://github.com/Yp1oneer/cve_hub/blob/main/AC%20Repair%20and%20Services%20System/SQL-Injection-2.pdf
CVE ID: CVE-2023-2410 State: PUBLISHED Published: 2023-04-28T23:00:04.960Z Last Updated: 2025-01-30T18:22:20.497Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: AC Repair and Services System Problem Types: CWE-89 Description: A vulnerability has been found in SourceCodester AC Repair and Services System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/bookings/view_booking.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227704. Additional Analyst Notes:
disclosed to the public and may be used. The identifier of this vulnerability is VDB-227704. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.227704 - https://vuldb.com/?ctiid.227704 - https://github.com/Yp1oneer/cve_hub/blob/main/AC%20Repair%20and%20Services%20System/SQL-Injection-3.pdf
CVE ID: CVE-2023-2411 State: PUBLISHED Published: 2023-04-28T23:00:06.229Z Last Updated: 2024-08-02T06:19:15.146Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: AC Repair and Services System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester AC Repair and Services System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/inquiries/view_inquiry.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227705 was assigned to this vulnerability. Additional Analys
disclosed to the public and may be used. The identifier VDB-227705 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.227705 - https://vuldb.com/?ctiid.227705 - https://github.com/Yp1oneer/cve_hub/blob/main/AC%20Repair%20and%20Services%20System/SQL-Injection-4.pdf
CVE ID: CVE-2023-2412 State: PUBLISHED Published: 2023-04-28T23:31:03.979Z Last Updated: 2024-08-02T06:19:14.955Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: AC Repair and Services System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester AC Repair and Services System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/user/manage_user.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-227706 is the identifier assigned to this vulnerability. Additional Analyst
disclosed to the public and may be used. VDB-227706 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.227706 - https://vuldb.com/?ctiid.227706 - https://github.com/Yp1oneer/cve_hub/blob/main/AC%20Repair%20and%20Services%20System/SQL-Injection-5.pdf
CVE ID: CVE-2023-2413 State: PUBLISHED Published: 2023-04-29T00:00:05.239Z Last Updated: 2024-08-02T06:19:15.000Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: AC Repair and Services System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester AC Repair and Services System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/bookings/manage_booking.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-2
. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227707. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.227707 - https://vuldb.com/?ctiid.227707 - https://github.com/Yp1oneer/cve_hub/blob/main/AC%20Repair%20and%20Services%20System/SQL-Injection-6.pdf
CVE ID: CVE-2023-2414 State: PUBLISHED Published: 2023-06-09T05:33:14.568Z Last Updated: 2024-08-28T20:28:16.688Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: vcita Products: Online Booking & Scheduling Calendar for WordPress by vcita Problem Types: CWE-862 Description: The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_save_settings_callback function in versions up to, and including, 4.4.6. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to modify the plugins settings, uploa
ssible for authenticated attackers with minimal permissions, such as a subscriber, to modify the plugins settings, upload arbitrary files, and inject malicious JavaScript (before 4.3.2). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3c99aab5-a995-44ae-bc14-09f73e6b22c5?source=cve - https://plugins.trac.wordpress.org/browser/meeting-scheduler-by-vcita/trunk/vcita-ajax-function.php#L88 - https://blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcita - https://plugins.trac.wordpress.org/changeset/2933915/meeting-scheduler-by-vcita/trunk/vcita-ajax-function.php?contextall=1&old
//plugins.trac.wordpress.org/changeset/2933915/meeting-scheduler-by-vcita/trunk/vcita-ajax-function.php?contextall=1&old=2924763&old_path=%2Fmeeting-scheduler-by-vcita%2Ftrunk%2Fvcita-ajax-function.php
CVE ID: CVE-2023-2415 State: PUBLISHED Published: 2023-06-03T04:35:15.529Z Last Updated: 2024-12-20T23:57:27.066Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: vcita Products: Online Booking & Scheduling Calendar for WordPress by vcita Problem Types: CWE-862 Missing Authorization Description: The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_logout_callback function in versions up to, and including, 4.2.10. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to logout a vctia con
This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to logout a vctia connected account which would cause a denial of service on the appointment scheduler. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/731cbeed-d4aa-448f-878a-8c51a3da4e18?source=cve - https://plugins.trac.wordpress.org/browser/meeting-scheduler-by-vcita/trunk/vcita-ajax-function.php#L55 - https://blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcita
CVE ID: CVE-2023-2416 State: PUBLISHED Published: 2023-06-03T04:35:16.752Z Last Updated: 2024-12-20T23:57:05.867Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: vcita Products: Online Booking & Scheduling Calendar for WordPress by vcita Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the vcita_logout_callback function in versions up to, and including, 4.2.10. This makes it possible for unauthenticated to logout a vctia connected account which would cause a denial of service on
This makes it possible for unauthenticated to logout a vctia connected account which would cause a denial of service on the appointment scheduler, via a forged request granted they can trick a site user into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f434585c-8533-4788-b0bc-5650390c29a8?source=cve - https://plugins.trac.wordpress.org/browser/meeting-scheduler-by-vcita/trunk/vcita-ajax-function.php#L55 - https://blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcita
CVE ID: CVE-2023-2417 State: PUBLISHED Published: 2023-04-29T00:31:03.814Z Last Updated: 2025-01-30T18:21:40.219Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: ks-soft Products: Advanced Host Monitor Problem Types: CWE-428 Description: A vulnerability was found in ks-soft Advanced Host Monitor up to 12.56 and classified as problematic. Affected by this issue is some unknown functionality of the file C:\Program Files (x86)\HostMonitor\RMA-Win\rma_active.exe. The manipulation leads to unquoted search path. It is possible to launch the attack on the local host. Upgrading to version 12.60 is able to address this issue. It is recommended to upgrade the affected
k on the local host. Upgrading to version 12.60 is able to address this issue. It is recommended to upgrade the affected component. VDB-227714 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.227714 - https://vuldb.com/?ctiid.227714 - http://packetstormsecurity.com/files/172105/Advanced-Host-Monitor-12.56-Unquoted-Service-Path.html
CVE ID: CVE-2023-2418 State: PUBLISHED Published: 2023-04-29T00:31:04.842Z Last Updated: 2024-08-02T06:19:15.079Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: Konga Problem Types: CWE-330 Description: A vulnerability was found in Konga 2.8.3 on Kong. It has been classified as problematic. This affects an unknown part of the component Login API. The manipulation leads to insufficiently random values. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. The associated identifier of this vulnerabi
lic and may be used. It is recommended to change the configuration settings. The associated identifier of this vulnerability is VDB-227715. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.227715 - https://vuldb.com/?ctiid.227715 - https://www.cnblogs.com/andao/p/17330864.html
CVE ID: CVE-2023-2419 State: PUBLISHED Published: 2023-04-29T01:00:06.164Z Last Updated: 2024-08-02T06:19:14.983Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: Zhong Bang Products: CRMEB Problem Types: CWE-434 Description: A vulnerability was found in Zhong Bang CRMEB 4.6.0. It has been declared as critical. This vulnerability affects the function videoUpload of the file \crmeb\app\services\system\attachment\SystemAttachmentServices.php. The manipulation of the argument filename leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227716. Additional Analyst
as been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227716. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.227716 - https://vuldb.com/?ctiid.227716 - https://github.com/crmeb/CRMEB/issues/77
CVE ID: CVE-2023-2420 State: PUBLISHED Published: 2023-04-29T01:31:03.540Z Last Updated: 2025-01-30T18:17:15.876Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: MLECMS Problem Types: CWE-89 Description: A vulnerability was found in MLECMS 3.0. It has been rated as critical. This issue affects the function get_url in the library /upload/inc/lib/admin of the file upload\inc\include\common.func.php. The manipulation of the argument $_SERVER['REQUEST_URI'] leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227717 was assigned to this vulnerability. Additional Analyst Notes: - C
the public and may be used. The identifier VDB-227717 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.227717 - https://vuldb.com/?ctiid.227717 - https://github.com/VG00000/elecms/blob/main/README.md
CVE ID: CVE-2023-2421 State: PUBLISHED Published: 2023-04-29T01:31:04.560Z Last Updated: 2025-01-14T16:47:04.281Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Control iD Products: RHiD Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in Control iD RHiD 23.3.19.0. Affected is an unknown function of the file /v2/#/add/department. The manipulation of the argument Name leads to cross site scripting. It is possible to launch the attack remotely. VDB-227718 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Contai
was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.227718 - https://vuldb.com/?ctiid.227718 - https://youtu.be/4JOLhAuoizE
CVE ID: CVE-2023-2422 State: PUBLISHED Published: 2023-10-04T10:59:30.818Z Last Updated: 2024-08-02T06:19:15.138Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N) Vendors: Red Hat Products: Red Hat Single Sign-On 7, Red Hat Single Sign-On 7.6 for RHEL 7, Red Hat Single Sign-On 7.6 for RHEL 8, Red Hat Single Sign-On 7.6 for RHEL 9, RHEL-8 based Middleware Containers Problem Types: CWE-295 Description: A flaw was found in Keycloak. A Keycloak server configured to support mTLS authentication for OAuth/OpenID clients does not properly verify the client certificate chain. A client that possesses a proper certificate can authorize itself as any other client, therefore, acce
ertificate chain. A client that possesses a proper certificate can authorize itself as any other client, therefore, access data that belongs to other clients. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:3883 - https://access.redhat.com/errata/RHSA-2023:3884 - https://access.redhat.com/errata/RHSA-2023:3885 - https://access.redhat.com/errata/RHSA-2023:3888 - https://access.redhat.com/errata/RHSA-2023:3892 - https://access.redhat.com/security/cve/CVE-2023-2422 - https://bugzilla.redhat.com/show_bug.cgi?id=2191668
CVE ID: CVE-2023-2423 State: PUBLISHED Published: 2023-08-08T14:24:26.886Z Last Updated: 2024-10-11T22:02:11.892Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Rockwell Automation Products: Armor PowerFlex Problem Types: CWE-682 Description: A vulnerability was discovered in the Rockwell Automation Armor PowerFlex device when the product sends communications to the local event log. Threat actors could exploit this vulnerability by sending an influx of network commands, causing the product to generate an influx of event log traffic at a high rate. If exploited, the product would stop normal operations and self-reset creating a denial-of-service condition. The
rate. If exploited, the product would stop normal operations and self-reset creating a denial-of-service condition. The error code would need to be cleared prior to resuming normal operations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1140371
CVE ID: CVE-2023-2424 State: PUBLISHED Published: 2023-04-29T07:31:03.339Z Last Updated: 2024-08-02T06:19:15.145Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: DedeCMS Problem Types: CWE-434 Description: A vulnerability was found in DedeCMS 5.7.106 and classified as critical. Affected by this issue is the function UpDateMemberModCache of the file uploads/dede/config.php. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-227750 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.227
signed to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.227750 - https://vuldb.com/?ctiid.227750 - https://gitee.com/xieqiangweb/cve/blob/master/dede/dedecms%20rce.md
CVE ID: CVE-2023-2425 State: PUBLISHED Published: 2023-04-29T07:31:04.412Z Last Updated: 2024-08-02T06:19:15.154Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: SourceCodester Products: Simple Student Information System Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Simple Student Information System 1.0. It has been classified as problematic. This affects an unknown part of the file /classes/Master.php?f=save_course of the component Add New Course. The manipulation of the argument name with the input <script>alert(document.cookie)</script> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclose
e)</script> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227751. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.227751 - https://vuldb.com/?ctiid.227751 - https://github.com/sssddc11/bug_report/blob/master/XSS-1.md
CVE ID: CVE-2023-2426 State: PUBLISHED Published: 2023-04-29T00:00:00 Last Updated: 2024-10-15T16:28:36.516Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: vim Products: vim/vim Problem Types: CWE-823 Description: Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/3451be4c-91c8-4d08-926b-cbff7396f425 - https://github.com/vim/vim/commit/caf642c25de526229264cab9425e7c9979f3509b - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LOJP6M7ZTKZQYOGVOOAY6TIE6ACBJL55/ - ht
edoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LOJP6M7ZTKZQYOGVOOAY6TIE6ACBJL55/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PCLJN4QINITA3ZASKLEJ64C5TFNKELMO/ - https://support.apple.com/kb/HT213844 - https://support.apple.com/kb/HT213845
CVE ID: CVE-2023-2427 State: PUBLISHED Published: 2023-05-05T00:00:00.000Z Last Updated: 2025-01-29T17:53:14.630Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: thorsten Products: thorsten/phpmyfaq Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.13. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/89005a6d-d019-4cb7-ae88-486d2d44190d - https://github.com/thorsten/phpmyfaq/commit/514f4df2ad918e69575028d58b2e33aaf536e59b