Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
le to address this issue. It is recommended to upgrade the affected component. VDB-243058 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.243058 - https://vuldb.com/?ctiid.243058 - https://github.com/Godfather-onec/cve/blob/main/sql.md
CVE ID: CVE-2023-5683 State: PUBLISHED Published: 2023-10-21T05:00:06.020Z Last Updated: 2024-08-02T08:07:32.571Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Byzoro Products: Smart S85F Management Platform Problem Types: CWE-78 Description: A vulnerability was found in Byzoro Smart S85F Management Platform up to 20231010 and classified as critical. This issue affects some unknown processing of the file /sysmanage/importconf.php. The manipulation of the argument btn_file_renew leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-243059. NOTE: Th
as been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-243059. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.243059 - https://vuldb.com/?ctiid.243059 - https://vuldb.com/?submit.218590 - https://github.com/yaphetszz/cve/blob/main/upload.md
CVE ID: CVE-2023-5684 State: PUBLISHED Published: 2023-10-21T07:00:07.193Z Last Updated: 2024-09-12T14:34:39.119Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: Byzoro Products: Smart S85F Management Platform Problem Types: CWE-78 Description: A vulnerability was found in Byzoro Smart S85F Management Platform up to 20231012. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /importexport.php. The manipulation leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-243061 was assigned to this vulnerability. NOTE: The vendor was conta
to the public and may be used. The identifier VDB-243061 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.243061 - https://vuldb.com/?ctiid.243061 - https://vuldb.com/?submit.219836 - https://github.com/Chef003/cve/blob/main/rce.md
CVE ID: CVE-2023-5685 State: PUBLISHED Published: 2024-03-22T18:24:42.696Z Last Updated: 2025-11-07T20:35:23.047Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat build of Apache Camel 4.4.0 for Spring Boot, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7, Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7, Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8, Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9, Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7, Red Hat build of Apache Camel for Spring Boot 3, Red Hat build of Apa
oss Enterprise Application Platform 7.4 on RHEL 7, Red Hat build of Apache Camel for Spring Boot 3, Red Hat build of Apache Camel - HawtIO 4, Red Hat Build of Keycloak, Red Hat Data Grid 8, Red Hat Integration Camel K 1, Red Hat JBoss Data Grid 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat JBoss Fuse Service Works 6, Red Hat Process Automation 7, Red Hat Single Sign-On 7 Problem Types: CWE-400 Description: A flaw was found in XNIO. The XNIO NotifierState that can cause a Stack Overflow Exception when the chain of notifier states becomes problematically large can lead to uncontrolled resource management and a possible
n the chain of notifier states becomes problematically large can lead to uncontrolled resource management and a possible denial of service (DoS). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:7637 - https://access.redhat.com/errata/RHSA-2023:7638 - https://access.redhat.com/errata/RHSA-2023:7639 - https://access.redhat.com/errata/RHSA-2023:7641 - https://access.redhat.com/errata/RHSA-2024:10207 - https://access.redhat.com/errata/RHSA-2024:10208 - https://access.redhat.com/errata/RHSA-2024:2707 - https://access.redhat.com/security/cve/CVE-2023-5685 - https://bugzilla.redhat.com/show_bug.cgi?id=2241822
CVE ID: CVE-2023-5686 State: PUBLISHED Published: 2023-10-20T16:22:42.339Z Last Updated: 2025-02-13T17:25:42.996Z Severity: MEDIUM (CVSS 5.1 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: radareorg Products: radareorg/radare2 Problem Types: CWE-122 Description: Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.com/bounties/bbfe1f76-8fa1-4a8c-909d-65b16e970be0 - https://github.com/radareorg/radare2/commit/1bdda93e348c160c84e30da3637acef26d0348de - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/64KUV6OGEVQ75QOV35PUVVDOJTKSJHYN/ -
sts.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/64KUV6OGEVQ75QOV35PUVVDOJTKSJHYN/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SOZ6XCADVAPAIHMVSV3FUAN742BHXF55/
CVE ID: CVE-2023-5687 State: PUBLISHED Published: 2023-10-20T16:22:43.785Z Last Updated: 2024-09-11T18:35:46.329Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) Vendors: mosparo Products: mosparo/mosparo Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) in GitHub repository mosparo/mosparo prior to 1.0.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/33f95510-cdee-460e-8e61-107874962f2d - https://github.com/mosparo/mosparo/commit/fb3ac528b7548beb802182310967968a21c1354a
CVE ID: CVE-2023-5688 State: PUBLISHED Published: 2023-10-20T16:22:46.873Z Last Updated: 2024-09-11T18:34:05.877Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: modoboa Products: modoboa/modoboa Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - DOM in GitHub repository modoboa/modoboa prior to 2.2.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/0ceb10e4-952b-4ca4-baf8-5b6f12e3a8a7 - https://github.com/modoboa/modoboa/commit/d33d3cd2d11dbfebd8162c46e2c2a9873919a967
CVE ID: CVE-2023-5689 State: PUBLISHED Published: 2023-10-20T16:22:49.430Z Last Updated: 2024-09-11T18:33:08.457Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: modoboa Products: modoboa/modoboa Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - DOM in GitHub repository modoboa/modoboa prior to 2.2.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/24835833-3421-412b-bafb-1b7ea3cf60e6 - https://github.com/modoboa/modoboa/commit/d33d3cd2d11dbfebd8162c46e2c2a9873919a967
CVE ID: CVE-2023-5690 State: PUBLISHED Published: 2023-10-20T16:22:53.540Z Last Updated: 2024-09-11T18:32:26.708Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: modoboa Products: modoboa/modoboa Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.2.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/980c75a5-d978-4b0e-9bcc-2b2682c97e01 - https://github.com/modoboa/modoboa/commit/23e4c25511c66c0548da001236f47e19e3f9e4d9
CVE ID: CVE-2023-5691 State: PUBLISHED Published: 2024-01-11T08:33:04.545Z Last Updated: 2025-06-03T14:08:39.224Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: collectchat Products: Collect.chat Chatbot ⚡️ Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Chatbot for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in version 2.3.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will
henticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dfd67329-11b1-4f00-a422-bb4833a3181d?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3000724%40collectchat%2Ftrunk&old=2983408%40collectchat%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-5692 State: PUBLISHED Published: 2024-04-05T12:52:32.816Z Last Updated: 2024-08-02T08:07:32.642Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: WordPress Foundation Products: WordPress Problem Types: CWE-200 Information Exposure Description: WordPress Core is vulnerable to Sensitive Information Exposure in versions up to, and including, 6.4.3 via the redirect_guess_404_permalink function. This can allow unauthenticated attackers to expose the slug of a custom post whose 'publicly_queryable' post status has been set to 'false'. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com
se'. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6e6f993b-ce09-4050-84a1-cbe9953f36b1?source=cve - https://github.com/WordPress/wordpress-develop/blob/6.3/src/wp-includes/canonical.php#L763 - https://developer.wordpress.org/reference/functions/is_post_publicly_viewable/ - https://developer.wordpress.org/reference/functions/is_post_type_viewable/ - https://core.trac.wordpress.org/changeset/57645
CVE ID: CVE-2023-5693 State: PUBLISHED Published: 2023-10-22T22:00:07.605Z Last Updated: 2025-06-12T15:03:27.561Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: CodeAstro Products: Internet Banking System Problem Types: CWE-89 Description: A vulnerability was found in CodeAstro Internet Banking System 1.0 and classified as critical. This issue affects some unknown processing of the file pages_reset_pwd.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-243131. Additional Analyst Notes: - CVE Program Container
e used. The associated identifier of this vulnerability is VDB-243131. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.243131 - https://vuldb.com/?ctiid.243131 - https://github.com/E1CHO/cve_hub/blob/main/Internet%20Banking%20System/Internet%20Banking%20System%20-%20vuln%201.pdf
CVE ID: CVE-2023-5694 State: PUBLISHED Published: 2023-10-22T22:00:08.748Z Last Updated: 2024-08-02T08:07:32.437Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: CodeAstro Products: Internet Banking System Problem Types: CWE-79 Description: A vulnerability was found in CodeAstro Internet Banking System 1.0. It has been classified as problematic. Affected is an unknown function of the file pages_system_settings.php. The manipulation of the argument sys_name with the input <ScRiPt >alert(991)</ScRiPt> leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-2
ck remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-243132. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.243132 - https://vuldb.com/?ctiid.243132 - https://github.com/E1CHO/cve_hub/blob/main/Internet%20Banking%20System/Internet%20Banking%20System%20-%20vuln%202.pdf
CVE ID: CVE-2023-5695 State: PUBLISHED Published: 2023-10-22T22:31:04.837Z Last Updated: 2024-08-02T08:07:32.598Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: CodeAstro Products: Internet Banking System Problem Types: CWE-79 Description: A vulnerability was found in CodeAstro Internet Banking System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file pages_reset_pwd.php. The manipulation of the argument email with the input testing%40example.com'%26%25<ScRiPt%20>alert(9860)</ScRiPt> leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The ide
te scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-243133 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.243133 - https://vuldb.com/?ctiid.243133 - https://github.com/E1CHO/cve_hub/blob/main/Internet%20Banking%20System/Internet%20Banking%20System%20-%20vuln%203.pdf
CVE ID: CVE-2023-5696 State: PUBLISHED Published: 2023-10-22T22:31:05.970Z Last Updated: 2024-08-02T08:07:32.494Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: CodeAstro Products: Internet Banking System Problem Types: CWE-79 Description: A vulnerability was found in CodeAstro Internet Banking System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file pages_transfer_money.php. The manipulation of the argument account_number with the input 357146928--><ScRiPt%20>alert(9206)</ScRiPt><!-- leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-243134 is
pting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-243134 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.243134 - https://vuldb.com/?ctiid.243134 - https://github.com/E1CHO/cve_hub/blob/main/Internet%20Banking%20System/Internet%20Banking%20System%20-%20vuln%204.pdf
CVE ID: CVE-2023-5697 State: PUBLISHED Published: 2023-10-22T23:00:07.339Z Last Updated: 2024-08-02T08:07:32.573Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: CodeAstro Products: Internet Banking System Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in CodeAstro Internet Banking System 1.0. This affects an unknown part of the file pages_withdraw_money.php. The manipulation of the argument account_number with the input 287359614--><ScRiPt%20>alert(1234)</ScRiPt><!-- leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of t
itiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-243135. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.243135 - https://vuldb.com/?ctiid.243135 - https://github.com/E1CHO/cve_hub/blob/main/Internet%20Banking%20System/Internet%20Banking%20System%20-%20vuln%205.pdf
CVE ID: CVE-2023-5698 State: PUBLISHED Published: 2023-10-22T23:00:08.487Z Last Updated: 2024-08-02T08:07:32.631Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: CodeAstro Products: Internet Banking System Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in CodeAstro Internet Banking System 1.0. This vulnerability affects unknown code of the file pages_deposit_money.php. The manipulation of the argument account_number with the input 421873905--><ScRiPt%20>alert(9523)</ScRiPt><!-- leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerabilit
be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-243136. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.243136 - https://vuldb.com/?ctiid.243136 - https://github.com/E1CHO/cve_hub/blob/main/Internet%20Banking%20System/Internet%20Banking%20System%20-%20vuln%206.pdf
CVE ID: CVE-2023-5699 State: PUBLISHED Published: 2023-10-22T23:31:05.110Z Last Updated: 2025-06-12T15:01:58.808Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: CodeAstro Products: Internet Banking System Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in CodeAstro Internet Banking System 1.0. This issue affects some unknown processing of the file pages_view_client.php. The manipulation of the argument acc_name with the input Johnnie Reyes'"()&%<zzz><ScRiPt >alert(5646)</ScRiPt> leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VD
g. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-243137 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.243137 - https://vuldb.com/?ctiid.243137 - https://github.com/E1CHO/cve_hub/blob/main/Internet%20Banking%20System/Internet%20Banking%20System%20-%20vuln%207.pdf
CVE ID: CVE-2023-5700 State: PUBLISHED Published: 2023-10-22T23:31:06.212Z Last Updated: 2024-09-17T14:23:52.956Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Netentsec Products: NS-ASG Application Security Gateway Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected is an unknown function of the file /protocol/iscgwtunnel/uploadiscgwrouteconf.php. The manipulation of the argument GWLinkId leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-243138 is the identifier assigned to this vulnerability. Additional Analys
disclosed to the public and may be used. VDB-243138 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.243138 - https://vuldb.com/?ctiid.243138 - https://github.com/istlnight/cve/blob/main/NS-ASG-sql-uploadiscgwrouteconf.md
CVE ID: CVE-2023-5701 State: PUBLISHED Published: 2023-10-23T00:00:07.895Z Last Updated: 2024-09-12T18:08:43.825Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: vnotex Products: vnote Problem Types: CWE-79 Description: A vulnerability has been found in vnotex vnote up to 3.17.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Markdown File Handler. The manipulation with the input <xss onclick="alert(1)" style=display:block>Click here</xss> leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-2
. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-243139. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.243139 - https://vuldb.com/?ctiid.243139 - https://github.com/victorootnice/victorootnice.github.io/blob/main/2023/bbp-01.md
CVE ID: CVE-2023-5702 State: PUBLISHED Published: 2023-10-23T00:31:04.073Z Last Updated: 2024-08-02T08:07:32.427Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Viessmann Products: Vitogate 300 Problem Types: CWE-425 Description: A vulnerability was found in Viessmann Vitogate 300 up to 2.1.3.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /cgi-bin/. The manipulation leads to direct request. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-243140. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Anal
s VDB-243140. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.243140 - https://vuldb.com/?ctiid.243140 - https://github.com/GTA12138/vul/blob/main/Viessmann/Vitogate300_Document_Unauthorized_Access.md
CVE ID: CVE-2023-5703 State: PUBLISHED Published: 2023-11-07T11:31:06.511Z Last Updated: 2025-02-05T18:50:27.442Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: koanleeroy Products: Gift Up Gift Cards for WordPress and WooCommerce Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Gift Up Gift Cards for WordPress and WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'giftup' shortcode in all versions up to, and including, 2.20.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for
.20.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4e498706-3dbe-4c48-9c0d-0d90677aba0d?source=cve - https://plugins.trac.wordpress.org/browser/gift-up/tags/2.20.1/view/giftup-checkout.php#L46 - https://plugins.trac.wordpress.org/browser/gift-up/tags/2.20.1/view/giftup-checkout.php#L48 - https://plugins.trac.w
6 - https://plugins.trac.wordpress.org/browser/gift-up/tags/2.20.1/view/giftup-checkout.php#L48 - https://plugins.trac.wordpress.org/changeset/2989802/gift-up#file3
CVE ID: CVE-2023-5704 State: PUBLISHED Published: 2023-11-22T15:33:38.653Z Last Updated: 2024-08-02T08:07:32.635Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpchill Products: CPO Shortcodes Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The CPO Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject
d attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f8ba38c3-51d2-43a7-89ff-c72a8edc946b?source=cve - https://plugins.trac.wordpress.org/browser/cpo-shortcodes/trunk/shortcodes/shortcode-testimonial.php?rev=2413204#L38