Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-5385 State: PUBLISHED Published: 2023-11-22T15:33:37.255Z Last Updated: 2024-08-02T07:59:43.668Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: funnelforms Products: Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free Problem Types: CWE-862 Missing Authorization Description: The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_copy_posts function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to create copies of arbitrary pos
it possible for authenticated attackers, with subscriber-level permissions and above, to create copies of arbitrary posts. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e2719afc-e52c-4fcc-b030-2f6aaddb5ab9?source=cve - https://plugins.trac.wordpress.org/changeset/2986938/funnelforms-free
CVE ID: CVE-2023-5386 State: PUBLISHED Published: 2023-11-22T15:33:23.381Z Last Updated: 2024-11-20T18:50:29.388Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: funnelforms Products: Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free Problem Types: CWE-862 Missing Authorization Description: The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_delete_posts function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete arbitrary posts, incl
es it possible for authenticated attackers, with subscriber-level permissions and above, to delete arbitrary posts, including administrator posts, and posts not related to the Funnelforms Free plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/400fe58b-8203-4fd5-a3d3-d30eb1b8cd85?source=cve - https://plugins.trac.wordpress.org/changeset/2986938/funnelforms-free
CVE ID: CVE-2023-5387 State: PUBLISHED Published: 2023-11-22T15:33:34.930Z Last Updated: 2024-08-02T07:59:44.308Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: funnelforms Products: Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free Problem Types: CWE-862 Missing Authorization Description: The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_trigger_dark_mode function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to enable or disable t
This makes it possible for authenticated attackers, with subscriber-level permissions and above, to enable or disable the dark mode plugin setting. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ccb34b44-9fa4-4ebe-b217-b2a42920247f?source=cve - https://plugins.trac.wordpress.org/changeset/2986938/funnelforms-free
CVE ID: CVE-2023-5388 State: PUBLISHED Published: 2024-03-19T12:02:54.004Z Last Updated: 2025-11-04T18:21:52.553Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: NSS susceptible to timing attack against RSA decryption Description: NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow an attacker to recover the private data. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1780432 - https://www.mozilla.org/security/advisories/mfs
er: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1780432 - https://www.mozilla.org/security/advisories/mfsa2024-12/ - https://www.mozilla.org/security/advisories/mfsa2024-13/ - https://www.mozilla.org/security/advisories/mfsa2024-14/ - https://lists.debian.org/debian-lts-announce/2024/03/msg00022.html - https://lists.debian.org/debian-lts-announce/2024/03/msg00028.html
CVE ID: CVE-2023-5389 State: PUBLISHED Published: 2024-01-30T20:00:50.382Z Last Updated: 2025-06-17T21:29:17.826Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: Honeywell Products: ControlEdge UOC Problem Types: CWE-749 Description: An attacker could potentially exploit this vulnerability, leading to the ability to modify files on Honeywell Experion ControlEdge VirtualUOC and ControlEdge UOC . This exploit could be used to write a file that may result in unexpected behavior based on configuration changes or updating of files that could result in subsequent execution of a malicious application if triggered. Honeywell recommends updating to the most recent
esult in subsequent execution of a malicious application if triggered. Honeywell recommends updating to the most recent version of the product. See Honeywell Security Notification for recommendations on upgrading and versioning. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://process.honeywell.com - https://www.honeywell.com/us/en/product-security
CVE ID: CVE-2023-5390 State: PUBLISHED Published: 2024-01-31T17:46:39.809Z Last Updated: 2025-05-29T15:03:38.086Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Honeywell Products: ControlEdge UOC Problem Types: CWE-36 Description: An attacker could potentially exploit this vulnerability, leading to files being read from the Honeywell Experion ControlEdge VirtualUOC and ControlEdge UOC. This exploit could be used to read files from the controller that may expose limited information from the device. Honeywell recommends updating to the most recent version of the product. See Honeywell Security Notification for recommendations on upgrading and versioning. Add
recent version of the product. See Honeywell Security Notification for recommendations on upgrading and versioning. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://process.honeywell.com - https://www.honeywell.com/us/en/product-security
CVE ID: CVE-2023-5391 State: PUBLISHED Published: 2023-10-04T18:13:00.746Z Last Updated: 2025-02-27T20:46:31.823Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: EcoStruxure Power Monitoring Expert, EcoStruxure Power Operation (EPO) with Advanced Reports, EcoStruxure Power SCADA Operation with Advanced Reports Problem Types: CWE-502 Description: A CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker to execute arbitrary code on the targeted system by sending a specifically crafted packet to the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refere
ly crafted packet to the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-283-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-283-02.pdf
CVE ID: CVE-2023-5392 State: PUBLISHED Published: 2024-04-11T19:19:19.070Z Last Updated: 2024-08-02T07:59:44.280Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Honeywell Products: C300 Problem Types: CWE-1295 Description: C300 information leak due to an analysis feature which allows extracting more memory over the network than required by the function. Honeywell recommends updating to the most recent version of the product. See Honeywell Security Notification for recommendations on upgrading and versioning. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://process.honeywell.com
CVE ID: CVE-2023-5393 State: PUBLISHED Published: 2024-04-11T19:20:20.553Z Last Updated: 2024-08-02T07:59:44.301Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: Honeywell Products: Experion Server Problem Types: CWE-130 Description: Server receiving a malformed message that causes a disconnect to a hostname may causing a stack overflow resulting in possible remote code execution. Honeywell recommends updating to the most recent version of the product. See Honeywell Security Notification for recommendations on upgrading and versioning. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://process.honeywell.com
CVE ID: CVE-2023-5394 State: PUBLISHED Published: 2024-04-11T19:21:52.796Z Last Updated: 2024-08-09T20:13:47.066Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: Honeywell Products: Experion Server Problem Types: CWE-119 Description: Server receiving a malformed message that where the GCL message hostname may be too large which may cause a stack overflow; resulting in possible remote code execution. Honeywell recommends updating to the most recent version of the product. See Honeywell Security Notification for recommendations on upgrading and versioning. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://process.h
versioning. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://process.honeywell.com
CVE ID: CVE-2023-5395 State: PUBLISHED Published: 2024-04-17T16:37:00.868Z Last Updated: 2024-08-02T07:59:44.353Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Honeywell Products: Experion Server Problem Types: CWE-121 Description: Server receiving a malformed message that uses the hostname in an internal table may cause a stack overflow resulting in possible remote code execution. See Honeywell Security Notification for recommendations on upgrading and versioning. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://process.honeywell.com
CVE ID: CVE-2023-5396 State: PUBLISHED Published: 2024-04-17T16:37:41.106Z Last Updated: 2024-08-02T07:59:44.711Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: Honeywell Products: Experion Server Problem Types: CWE-805 Description: Server receiving a malformed message creates connection for a hostname that may cause a stack overflow resulting in possible remote code execution. See Honeywell Security Notification for recommendations on upgrading and versioning. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://process.honeywell.com
CVE ID: CVE-2023-5397 State: PUBLISHED Published: 2024-04-17T16:38:21.534Z Last Updated: 2024-08-08T15:58:57.657Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Honeywell Products: Experion Server Problem Types: CWE-20 Description: Server receiving a malformed message to create a new connection could lead to an attacker performing remote code execution or causing a failure. See Honeywell Security Notification for recommendations on upgrading and versioning. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Server receiving a malformed message to create a new connection could lead to an attacker performing remote code execution or cau
ceiving a malformed message to create a new connection could lead to an attacker performing remote code execution or causing a failure. See Honeywell Security Notification for recommendations on upgrading and versioning. References: - https://process.honeywell.com
CVE ID: CVE-2023-5398 State: PUBLISHED Published: 2024-04-17T16:40:10.248Z Last Updated: 2024-08-02T07:59:44.650Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Honeywell Products: Experion Server Problem Types: CWE-1327 Description: Server receiving a malformed message based on a list of IPs resulting in heap corruption causing a denial of service. See Honeywell Security Notification for recommendations on upgrading and versioning. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://process.honeywell.com
CVE ID: CVE-2023-5399 State: PUBLISHED Published: 2023-10-04T18:07:29.571Z Last Updated: 2025-02-27T20:46:38.228Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: C-Bus Toolkit Problem Types: CWE-22 Description: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause tampering of files on the personal computer running C-Bus when using the File Command. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-283-01&p_enDocType=Security+and+Safety+Notice&p_File_N
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-283-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-283-01.pdf
CVE ID: CVE-2023-5400 State: PUBLISHED Published: 2024-04-17T16:41:10.932Z Last Updated: 2024-08-02T07:59:44.742Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Honeywell Products: Experion Server Problem Types: CWE-122 Description: Server receiving a malformed message based on a using the specified key values can cause a heap overflow vulnerability which could lead to an attacker performing remote code execution or causing a failure. See Honeywell Security Notification for recommendations on upgrading and versioning. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://process.honeywell.com
CVE ID: CVE-2023-5401 State: PUBLISHED Published: 2024-04-17T16:42:00.403Z Last Updated: 2024-08-02T07:59:44.782Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Honeywell Products: Experion Server Problem Types: CWE-121 Description: Server receiving a malformed message based on a using the specified key values can cause a stack overflow vulnerability which could lead to an attacker performing remote code execution or causing a failure. See Honeywell Security Notification for recommendations on upgrading and versioning. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://process.honeywell.com
CVE ID: CVE-2023-5402 State: PUBLISHED Published: 2023-10-04T17:59:59.273Z Last Updated: 2025-02-27T20:46:53.296Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: C-Bus Toolkit Problem Types: CWE-269 Description: A CWE-269: Improper Privilege Management vulnerability exists that could cause a remote code execution when the transfer command is used over the network. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-283-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-283-01.pdf
CVE ID: CVE-2023-5403 State: PUBLISHED Published: 2024-04-17T16:43:54.036Z Last Updated: 2024-08-29T19:38:53.821Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Honeywell Products: Experion Server Problem Types: CWE-121 Description: Server hostname translation to IP address manipulation which could lead to an attacker performing remote code execution or causing a failure. See Honeywell Security Notification for recommendations on upgrading and versioning. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://process.honeywell.com
CVE ID: CVE-2023-5404 State: PUBLISHED Published: 2024-04-17T16:44:37.703Z Last Updated: 2024-08-02T07:59:44.850Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Honeywell Products: Experion Server Problem Types: CWE-122 Description: Server receiving a malformed message can cause a pointer to be overwritten which can result in a remote code execution or failure. See Honeywell Security Notification for recommendations on upgrading and versioning. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://process.honeywell.com
CVE ID: CVE-2023-5405 State: PUBLISHED Published: 2024-04-17T16:46:29.950Z Last Updated: 2025-02-06T16:54:27.235Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Honeywell Products: Experion Server Problem Types: CWE-787 Description: Server information leak for the CDA Server process memory can occur when an error is generated in response to a specially crafted message. See Honeywell Security Notification for recommendations on upgrading and versioning. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://process.honeywell.com
CVE ID: CVE-2023-5406 State: PUBLISHED Published: 2024-04-17T16:47:50.336Z Last Updated: 2024-08-02T07:59:44.668Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Honeywell Products: Experion Server Problem Types: CWE-787 Description: Server communication with a controller can lead to remote code execution using a specially crafted message from the controller. See Honeywell Security Notification for recommendations on upgrading and versioning. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://process.honeywell.com
CVE ID: CVE-2023-5407 State: PUBLISHED Published: 2024-04-17T16:49:16.900Z Last Updated: 2024-08-08T15:49:07.567Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Honeywell Products: C300 Problem Types: CWE-121 Description: Controller denial of service due to improper handling of a specially crafted message received by the controller. See Honeywell Security Notification for recommendations on upgrading and versioning. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://process.honeywell.com
CVE ID: CVE-2023-5408 State: PUBLISHED Published: 2023-11-02T02:55:58.195Z Last Updated: 2025-11-07T09:40:46.275Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat OpenShift Container Platform 4.11, Red Hat OpenShift Container Platform 4.12, Red Hat OpenShift Container Platform 4.13, Red Hat OpenShift Container Platform 4.14 Problem Types: CWE-269 Description: A privilege escalation flaw was found in the node restriction admission plugin of the kubernetes api server of OpenShift. A remote attacker who modifies the node role label could steer workloads from the control plane and etcd nodes onto different worker nodes and gain broader acc
role label could steer workloads from the control plane and etcd nodes onto different worker nodes and gain broader access to the cluster. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2023:5006 - https://access.redhat.com/errata/RHSA-2023:6130 - https://access.redhat.com/errata/RHSA-2023:6842 - https://access.redhat.com/errata/RHSA-2023:7479 - https://access.redhat.com/security/cve/CVE-2023-5408 - https://bugzilla.redhat.com/show_bug.cgi?id=2242173 - https://github.com/openshift/kubernetes/pull/1736
CVE ID: CVE-2023-5409 State: PUBLISHED Published: 2023-10-13T16:15:34.743Z Last Updated: 2024-08-02T07:59:44.712Z Vendors: HP Inc. Products: HP t430 and t638 Thin Clients Description: HP is aware of a potential security vulnerability in HP t430 and t638 Thin Client PCs. These models may be susceptible to a physical attack, allowing an untrusted source to tamper with the system firmware using a publicly disclosed private key. HP is providing recommended guidance for customers to reduce exposure to the potential vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/ish_9441200-9441233-16
CVE ID: CVE-2023-5410 State: PUBLISHED Published: 2024-03-12T20:01:46.531Z Last Updated: 2024-11-12T20:34:15.291Z Vendors: HP Inc. Products: HP PC BIOS Description: A potential security vulnerability has been reported in the system BIOS of certain HP PC products, which might allow memory tampering. HP is releasing mitigation for the potential vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.hp.com/us-en/document/ish_10290255-10290279-16/hpsbhf03924
CVE ID: CVE-2023-5411 State: PUBLISHED Published: 2023-11-22T15:33:30.215Z Last Updated: 2024-08-02T07:59:44.690Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: funnelforms Products: Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free Problem Types: CWE-862 Missing Authorization Description: The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_save_post function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to modify certain post values.
kes it possible for authenticated attackers, with subscriber-level permissions and above, to modify certain post values. Note that the extent of modification is limited due to fixed values passed to the wp_update_post function. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/816f5fc1-e4e6-4c0d-b222-fe733f026e33?source=cve - https://plugins.trac.wordpress.org/changeset/2986938/funnelforms-free
CVE ID: CVE-2023-5412 State: PUBLISHED Published: 2023-10-31T08:32:48.974Z Last Updated: 2025-02-05T18:54:16.428Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: gopiplus Products: Image horizontal reel scroll slideshow Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Image horizontal reel scroll slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 13.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated atta
ed parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/08fb698f-c87c-4200-85fe-3fe72745633e?source=cve - https://plugins.trac.wordpress.org/browser/image-horizontal-reel-scroll-slideshow/trunk/image-horizontal-reel-scroll-slideshow.php?rev=2827121#L176 - https://plugins.trac.wordpress.org/changeset/29853
w/trunk/image-horizontal-reel-scroll-slideshow.php?rev=2827121#L176 - https://plugins.trac.wordpress.org/changeset/2985331/image-horizontal-reel-scroll-slideshow#file1
CVE ID: CVE-2023-5413 State: PUBLISHED Published: 2023-12-19T03:09:40.040Z Last Updated: 2024-08-02T07:59:44.546Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: gopiplus Products: Image horizontal reel scroll slideshow Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Image horizontal reel scroll slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'ihrss-gallery' shortcode in versions up to, and including, 13.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with cont