Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-1883 State: PUBLISHED Published: 2023-04-05T00:00:00.000Z Last Updated: 2025-02-10T19:49:15.168Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: thorsten Products: thorsten/phpmyfaq Problem Types: CWE-284 Description: Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/2f1e417d-cf64-4cfb-954b-3a9cb2f38191 - https://github.com/thorsten/phpmyfaq/commit/db77df888178766987398597d4f153831c62a503
CVE ID: CVE-2023-1884 State: PUBLISHED Published: 2023-04-05T00:00:00.000Z Last Updated: 2025-02-10T19:48:05.854Z Severity: MEDIUM (CVSS 4.7 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: thorsten Products: thorsten/phpmyfaq Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/dda73cb6-9344-4822-97a1-2e31efb6a73e - https://github.com/thorsten/phpmyfaq/commit/7f0f921de74c88038826c46bbd2a123518d9d611
CVE ID: CVE-2023-1885 State: PUBLISHED Published: 2023-04-05T00:00:00.000Z Last Updated: 2025-02-10T19:47:34.586Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: thorsten Products: thorsten/phpmyfaq Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/bce84c02-abb2-474f-a67b-1468c9dcabb8 - https://github.com/thorsten/phpmyfaq/commit/fecc803ab9c3e82718c4bcea7fe919d7a22ec024
CVE ID: CVE-2023-1886 State: PUBLISHED Published: 2023-04-05T00:00:00.000Z Last Updated: 2025-02-10T19:47:10.916Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: thorsten Products: thorsten/phpmyfaq Problem Types: CWE-294 Description: Authentication Bypass by Capture-replay in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/b7d244b7-5ac3-4964-81ee-8dbb5bb5e33a - https://github.com/thorsten/phpmyfaq/commit/27eaaae16850694634ac52416a0bd38b35d7330a
CVE ID: CVE-2023-1887 State: PUBLISHED Published: 2023-04-05T00:00:00.000Z Last Updated: 2025-02-10T19:46:42.239Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H) Vendors: thorsten Products: thorsten/phpmyfaq Problem Types: CWE-840 Description: Business Logic Errors in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/e4a58835-96b5-412c-a17e-3ceed30231e1 - https://github.com/thorsten/phpmyfaq/commit/400d9cd988d3287515c56b2ad6343026966f1a89
CVE ID: CVE-2023-1888 State: PUBLISHED Published: 2023-06-09T05:33:09.400Z Last Updated: 2024-12-23T16:20:04.483Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: wpwax Products: Directorist – WordPress Business Directory Plugin with Classified Ads Listings Problem Types: CWE-20 Improper Input Validation Description: The Directorist plugin for WordPress is vulnerable to an arbitrary user password reset in versions up to, and including, 7.5.4. This is due to a lack of validation checks within login.php. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to reset the password of an arbitrary user and gain elevated (e.
attackers, with subscriber-level permissions and above, to reset the password of an arbitrary user and gain elevated (e.g., administrator) privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/01943559-e05b-4dca-b322-d880b2729ee7?source=cve - https://plugins.trac.wordpress.org/changeset/2920100/directorist
CVE ID: CVE-2023-1889 State: PUBLISHED Published: 2023-06-09T05:33:29.454Z Last Updated: 2024-12-20T23:36:37.060Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: wpwax Products: Directorist – WordPress Business Directory Plugin with Classified Ads Listings Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The Directorist plugin for WordPress is vulnerable to an Insecure Direct Object Reference in versions up to, and including, 7.5.4. This is due to improper validation and authorization checks within the listing_task function. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to
sting_task function. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete arbitrary posts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b47edd57-cac7-463f-88cc-8922f1b34612?source=cve - https://plugins.trac.wordpress.org/changeset/2920100/directorist
CVE ID: CVE-2023-1890 State: PUBLISHED Published: 2023-05-15T12:15:41.481Z Last Updated: 2025-02-13T16:39:41.628Z Vendors: Unknown Products: Tablesome Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Tablesome WordPress plugin before 1.0.9 does not escape various generated URLs, before outputting them in attributes when some notices are displayed, leading to Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8ef64490-30cd-4e07-9b7c-64f551944f3d - http://packetstormsecurity.com/files/173727/WordPress-Tablesome-Cross-Site-Scripting.html
CVE ID: CVE-2023-1891 State: PUBLISHED Published: 2023-06-27T13:17:16.610Z Last Updated: 2024-11-27T19:37:59.710Z Vendors: Unknown Products: Accordion & FAQ Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Accordion & FAQ WordPress plugin before 1.9.9 does not escape various generated URLs, before outputting them in attributes when some notices are displayed, leading to Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/4e5d993f-cc20-4b5f-b4c8-c13004151828
CVE ID: CVE-2023-1892 State: PUBLISHED Published: 2023-04-05T00:00:00.000Z Last Updated: 2025-02-10T19:45:53.353Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L) Vendors: sidekiq Products: sidekiq/sidekiq Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Reflected in GitHub repository sidekiq/sidekiq prior to 7.0.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/e35e5653-c429-4fb8-94a3-cbc123ae4777 - https://github.com/sidekiq/sidekiq/commit/458fdf74176a9881478c48dc5cf0269107b22214
CVE ID: CVE-2023-1893 State: PUBLISHED Published: 2023-07-17T13:29:53.624Z Last Updated: 2025-02-13T16:39:42.172Z Vendors: Unknown Products: Login Configurator Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Login Configurator WordPress plugin through 2.1 does not properly escape a URL parameter before outputting it to the page, leading to a reflected cross-site scripting vulnerability targeting site administrators. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/dbe6cf09-971f-42e9-b744-9339454168c7 - http://packetstormsecurity.com/files/173723/WordPress-Login-Configurator-2.1-Cross-Site-Scripting.ht
b744-9339454168c7 - http://packetstormsecurity.com/files/173723/WordPress-Login-Configurator-2.1-Cross-Site-Scripting.html
CVE ID: CVE-2023-1894 State: PUBLISHED Published: 2023-05-04T22:13:02.556Z Last Updated: 2025-01-29T17:55:40.169Z Vendors: Puppet Products: Puppet Enterprise, Puppet Server Problem Types: CWE-1333 Inefficient Regular Expression Complexity Description: A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2 certificate validation. An issue related to specifically crafted certificate names significantly slowed down server operations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.puppet.com/security/cve/cve-2023-1894-puppet-server-redos
CVE ID: CVE-2023-1895 State: PUBLISHED Published: 2023-06-09T05:33:38.329Z Last Updated: 2024-12-03T16:37:42.850Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) Vendors: jetmonsters Products: Getwid – Gutenberg Blocks Problem Types: CWE-918 Server-Side Request Forgery (SSRF) Description: The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Server Side Request Forgery via the get_remote_content REST API endpoint in versions up to, and including, 1.8.3. This can allow authenticated attackers with subscriber-level permissions or above to make web requests to arbitrary locations originating from the web application and can be used to query and modify inform
make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e9c2a942-c14c-4b59-92a7-6946b2e4731b?source=cve - https://plugins.trac.wordpress.org/browser/getwid/tags/1.8.3/includes/rest-api.php
CVE ID: CVE-2023-1897 State: PUBLISHED Published: 2023-06-12T19:18:57.026Z Last Updated: 2025-01-06T16:01:51.285Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H) Vendors: Atlas Copco Products: Power Focus Problem Types: CWE-312 Cleartext Storage of Sensitive Information Description: Atlas Copco Power Focus 6000 web server does not sanitize the login information stored by the authenticated user’s browser, which could allow an attacker with access to the user’s computer to gain credential information of the controller. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-159-
E Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-159-01
CVE ID: CVE-2023-1898 State: PUBLISHED Published: 2023-06-12T19:16:40.510Z Last Updated: 2025-01-06T16:45:54.395Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H) Vendors: Atlas Copco Products: Power Focus Problem Types: CWE-334 Small Space of Random Values Description: Atlas Copco Power Focus 6000 web server uses a small amount of session ID numbers. An attacker could enter a session ID number to retrieve data for an active user’s session. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-159-01
CVE ID: CVE-2023-1899 State: PUBLISHED Published: 2023-06-12T19:13:51.889Z Last Updated: 2025-01-06T16:51:31.519Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H) Vendors: Atlas Copco Products: Power Focus Problem Types: CWE-319 Cleartext Transmission of Sensitive Information Description: Atlas Copco Power Focus 6000 web server is not a secure connection by default, which could allow an attacker to gain sensitive information by monitoring network traffic between user and controller. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-159-01
CVE ID: CVE-2023-1900 State: PUBLISHED Published: 2023-04-19T18:47:17.392Z Last Updated: 2025-02-05T14:48:09.140Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: AVIRA Products: Avira Antivirus Problem Types: CWE-190 Description: A vulnerability within the Avira network protection feature allowed an attacker with local execution rights to cause an overflow. This could corrupt the data on the heap and lead to a denial-of-service situation. Issue was fixed with Endpointprotection.exe version 1.0.2303.633 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.norton.com/sp/static/external/tools/security-advisorie
Container: - CISA ADP Vulnrichment: References: - https://support.norton.com/sp/static/external/tools/security-advisories.html
CVE ID: CVE-2023-1901 State: PUBLISHED Published: 2023-07-10T04:37:33.126Z Last Updated: 2024-11-07T15:19:24.502Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: zephyrproject-rtos Products: Zephyr Description: The bluetooth HCI host layer logic not clearing a global reference to a semaphore after synchronously sending HCI commands may allow a malicious HCI Controller to cause the use of a dangling reference in the host layer, leading to a crash (DoS) or potential RCE on the Host layer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-xvvm-8mcm-9cq3
CVE ID: CVE-2023-1902 State: PUBLISHED Published: 2023-07-10T04:30:14.243Z Last Updated: 2024-11-07T15:21:40.963Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: zephyrproject-rtos Products: Zephyr Description: The bluetooth HCI host layer logic not clearing a global reference to a state pointer after handling connection events may allow a malicious HCI Controller to cause the use of a dangling reference in the host layer, leading to a crash (DoS) or potential RCE on the Host layer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fx9g-8fr2-q899
CVE ID: CVE-2023-1903 State: PUBLISHED Published: 2023-04-11T02:31:13.493Z Last Updated: 2025-02-07T19:33:25.912Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP Products: HCM Fiori App My Forms (Fiori 2.0) Problem Types: CWE-862 Description: SAP HCM Fiori App My Forms (Fiori 2.0) - version 605, does not perform necessary authorization checks for an authenticated user exposing the restricted header data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3301457 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-1904 State: PUBLISHED Published: 2023-12-14T07:23:08.589Z Last Updated: 2024-09-18T07:09:21.166Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Octopus Deploy Products: Octopus Server Problem Types: OpenID client secret logged in plain text during configuration Description: In affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during the configuration of Octopus Server. Additional Analyst Notes: - CVE Program Container: References: - https://advisories.octopus.com/post/2023/sa2023-12/
CVE ID: CVE-2023-1905 State: PUBLISHED Published: 2023-05-08T13:58:00.447Z Last Updated: 2025-01-29T15:12:00.519Z Vendors: Unknown Products: WP Popups Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Popups WordPress plugin before 2.1.5.1 does not properly escape the href attribute of its spu-facebook-page shortcode before outputting it back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. This is due to an insufficient fix of CVE-2023-24003 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b6ac3e1
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b6ac3e15-6f39-4514-a50d-cca7b9457736
CVE ID: CVE-2023-1906 State: PUBLISHED Published: 2023-04-12T00:00:00.000Z Last Updated: 2025-02-10T16:36:39.126Z Vendors: n/a Products: ImageMagick Problem Types: CWE-122 Description: A heap-based buffer overflow issue was discovered in ImageMagick's ImportMultiSpectralQuantum() function in MagickCore/quantum-import.c. An attacker could pass specially crafted file to convert, triggering an out-of-bounds read error, allowing an application to crash, resulting in a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2185714 - https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-
tps://bugzilla.redhat.com/show_bug.cgi?id=2185714 - https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-35q2-86c7-9247 - https://github.com/ImageMagick/ImageMagick/commit/d7a8bdd7bb33cf8e58bc01b4a4f2ea5466f8c6b3 - https://github.com/ImageMagick/ImageMagick6/commit/e30c693b37c3b41723f1469d1226a2c814ca443d - https://access.redhat.com/security/cve/CVE-2023-1906 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6655G3GPS42WQM32DJHUCZALI2URQSCO/
CVE ID: CVE-2023-1907 State: PUBLISHED Published: 2025-01-09T07:26:48.686Z Last Updated: 2025-08-27T11:04:15.329Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) Problem Types: CWE-488 Description: A vulnerability was found in pgadmin. Users logging into pgAdmin running in server mode using LDAP authentication may be attached to another user's session if multiple connection attempts occur simultaneously. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-1907 - https://bugzilla.redhat.com/show_bug.cgi?id=2218384
CVE ID: CVE-2023-1908 State: PUBLISHED Published: 2023-04-06T12:31:03.499Z Last Updated: 2024-08-02T06:05:26.780Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Simple Mobile Comparison Website Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Simple Mobile Comparison Website 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/categories/view_category.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-225150 is the identifi
to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-225150 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.225150 - https://vuldb.com/?ctiid.225150 - https://github.com/Kerkong/bug_report/blob/main/SQLi-1.md
CVE ID: CVE-2023-1909 State: PUBLISHED Published: 2023-04-07T17:00:04.682Z Last Updated: 2024-08-02T06:05:26.850Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: PHPGurukul Products: BP Monitoring Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in PHPGurukul BP Monitoring Management System 1.0. Affected is an unknown function of the file profile.php of the component User Profile Update Handler. The manipulation of the argument name/mobno leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-225318 is the identifier assigned to this v
remotely. The exploit has been disclosed to the public and may be used. VDB-225318 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.225318 - https://vuldb.com/?ctiid.225318 - https://github.com/vsdwef/BP-Monitoring-Management-System/blob/main/report_English.pdf
CVE ID: CVE-2023-1910 State: PUBLISHED Published: 2023-06-09T05:33:20.298Z Last Updated: 2024-12-20T23:42:19.489Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: jetmonsters Products: Getwid – Gutenberg Blocks Problem Types: CWE-285 Improper Authorization Description: The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient capability check on the get_remote_templates function in versions up to, and including, 1.8.3. This makes it possible for authenticated attackers with subscriber-level permissions or above to flush the remote template cache. Cached template information can also be accesse
ubscriber-level permissions or above to flush the remote template cache. Cached template information can also be accessed via this endpoint but these are not considered sensitive as they are publicly accessible from the developer's site. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6cd64ab0-007b-4778-9d92-06e530638fad?source=cve - https://plugins.trac.wordpress.org/browser/getwid/tags/1.8.3/includes/rest-api.php
CVE ID: CVE-2023-1911 State: PUBLISHED Published: 2023-05-02T07:04:59.433Z Last Updated: 2025-01-30T14:29:36.680Z Vendors: Unknown Products: Blocksy Companion Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The Blocksy Companion WordPress plugin before 1.8.82 does not ensure that posts to be accessed via a shortcode are already public and can be viewed, allowing any authenticated users, such as subscriber to access draft posts for example Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e7c52af0-b210-4e7d-a5e0-ee0645ddc08c
CVE ID: CVE-2023-1912 State: PUBLISHED Published: 2023-04-06T14:37:58.264Z Last Updated: 2025-02-13T16:39:42.740Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: automattic Products: Limit Login Attempts Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Limit Login Attempts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its lock logging feature in versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an
makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator accesses the plugin's settings page. This only works when the plugin prioritizes use of the X-FORWARDED-FOR header, which can be configured in its settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cb8c80fc-3b51-4003-b221-6f02e74bead0?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=551920%40limit-login-attempts%2Ftags%2F1.7.1&new=2893850%40limit-login-attempts%2Ftags%2F1.7.2 - https://www.pluginvulnerabilities
imit-login-attempts%2Ftags%2F1.7.1&new=2893850%40limit-login-attempts%2Ftags%2F1.7.2 - https://www.pluginvulnerabilities.com/2018/03/09/one-of-the-ten-most-popular-wordpress-plugins-isnt-needed-and-introduces-a-vulnerability-on-some-websites-using-it/ - http://packetstormsecurity.com/files/171824/WordPress-Limit-Login-Attempts-1.7.1-Cross-Site-Scripting.html
CVE ID: CVE-2023-1913 State: PUBLISHED Published: 2023-04-06T14:51:26.262Z Last Updated: 2025-01-13T16:54:03.476Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: webfactory Products: Maps Widget for Google Maps Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Maps Widget for Google Maps for WordPress is vulnerable to Stored Cross-Site Scripting via widget settings in versions up to, and including, 4.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web s