Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-35062 State: PUBLISHED Published: 2024-02-14T13:38:09.923Z Last Updated: 2024-08-08T13:28:12.124Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) DSA software Problem Types: escalation of privilege, CWE-284 Description: Improper access control in some Intel(R) DSA software before version 23.4.33 may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00969.html
CVE ID: CVE-2023-35064 State: PUBLISHED Published: 2023-06-13T13:11:30.017Z Last Updated: 2025-01-02T21:23:30.389Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Satos Products: Satos Mobile Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Satos Satos Mobile allows SQL Injection through SOAP Parameter Tampering.This issue affects Satos Mobile: before 20230607. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://https://www.usom.gov.tr/bildirim/tr-23-0346
CVE ID: CVE-2023-35065 State: PUBLISHED Published: 2023-09-05T17:07:00.225Z Last Updated: 2024-09-27T13:30:26.059Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Osoft Products: Paint Production Management Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Osoft Paint Production Management allows SQL Injection.This issue affects Paint Production Management: before 2.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0490
CVE ID: CVE-2023-35066 State: PUBLISHED Published: 2023-07-25T06:08:45.438Z Last Updated: 2024-10-23T19:04:52.176Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Infodrom Software Products: E-Invoice Approval System Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Infodrom Software E-Invoice Approval System allows SQL Injection.This issue affects E-Invoice Approval System: before v.20230701. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0419
CVE ID: CVE-2023-35067 State: PUBLISHED Published: 2023-07-25T06:07:32.605Z Last Updated: 2024-10-23T19:05:42.242Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Infodrom Software Products: E-Invoice Approval System Problem Types: CWE-256 Description: Plaintext Storage of a Password vulnerability in Infodrom Software E-Invoice Approval System allows Read Sensitive Strings Within an Executable.This issue affects E-Invoice Approval System: before v.20230701. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0419
CVE ID: CVE-2023-35068 State: PUBLISHED Published: 2023-09-05T17:18:11.280Z Last Updated: 2024-09-27T13:30:01.172Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: BMA Products: Personnel Tracking System Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BMA Personnel Tracking System allows SQL Injection.This issue affects Personnel Tracking System: before 20230904. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0491
CVE ID: CVE-2023-35069 State: PUBLISHED Published: 2023-07-13T07:56:42.429Z Last Updated: 2024-10-30T16:06:29.847Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Bullwark Products: Bullwark Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bullwark allows Path Traversal.This issue affects Bullwark: before BLW-2016E-960H. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0401
CVE ID: CVE-2023-35070 State: PUBLISHED Published: 2023-07-13T13:23:26.561Z Last Updated: 2024-10-31T17:53:43.556Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: VegaGroup Products: Web Collection Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VegaGroup Web Collection allows SQL Injection.This issue affects Web Collection: before 31197. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0406
CVE ID: CVE-2023-35071 State: PUBLISHED Published: 2023-09-27T08:05:21.410Z Last Updated: 2024-09-23T20:14:10.572Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: MRV Tech Products: Logging Administration Panel Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MRV Tech Logging Administration Panel allows SQL Injection.This issue affects Logging Administration Panel: before 20230915 . Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0560
CVE ID: CVE-2023-35072 State: PUBLISHED Published: 2023-09-05T17:29:51.028Z Last Updated: 2024-09-27T13:29:32.525Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Coyav Travel Products: Proagent Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Coyav Travel Proagent allows SQL Injection.This issue affects Proagent: before 20230904 . Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0492
CVE ID: CVE-2023-35073 State: REJECTED Published: N/A Last Updated: 2023-07-02T21:50:53.775679Z Description: No description available.
CVE ID: CVE-2023-35074 State: PUBLISHED Published: 2023-09-26T20:12:05.743Z Last Updated: 2025-05-05T15:17:38.443Z Vendors: Apple Products: iOS and iPadOS, tvOS, Safari, macOS, watchOS Problem Types: Processing web content may lead to arbitrary code execution Description: The issue was addressed with improved memory handling. This issue is fixed in tvOS 17, Safari 17, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/HT213938 - https://support.apple.com/en-us/HT213936 - https://support.apple.com/en-us/HT213941
/support.apple.com/en-us/HT213938 - https://support.apple.com/en-us/HT213936 - https://support.apple.com/en-us/HT213941 - https://support.apple.com/en-us/HT213940 - https://support.apple.com/en-us/HT213937 - http://www.openwall.com/lists/oss-security/2023/09/28/3 - http://seclists.org/fulldisclosure/2023/Oct/2 - http://seclists.org/fulldisclosure/2023/Oct/10 - http://seclists.org/fulldisclosure/2023/Oct/8 - http://seclists.org/fulldisclosure/2023/Oct/9 - http://seclists.org/fulldisclosure/2023/Oct/3 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EEMDC5TQAANFH5D77QM34ZTUKXPFGVL/ - https://security.gentoo.org/glsa/202401-33
CVE ID: CVE-2023-35075 State: PUBLISHED Published: 2023-11-27T09:09:19.659Z Last Updated: 2025-06-03T14:01:04.187Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-74 Description: Mattermost fails to use innerText / textContent when setting the channel name in the webapp during autocomplete, allowing an attacker to inject HTML to a victim's page by create a channel name that is valid HTML. No XSS is possible though. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2023-35077 State: PUBLISHED Published: 2023-07-21T20:51:29.385Z Last Updated: 2024-10-24T15:55:30.239Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Endpoint Manager Description: An out-of-bounds write vulnerability on windows operating systems causes the Ivanti AntiVirus Product to crash. Update to Ivanti AV Product version 7.9.1.285 or above. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/SA-2023-07-19-CVE-2023-35077
CVE ID: CVE-2023-35078 State: PUBLISHED Published: 2023-07-25T06:08:38.441Z Last Updated: 2025-10-21T23:05:42.374Z Severity: CRITICAL (CVSS 10 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: Endpoint Manager Mobile Description: An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerability - https://forums.ivanti.com/s/article/KB-Remote-unauthenticated-API-access-vulner
authenticated-API-access-vulnerability - https://forums.ivanti.com/s/article/KB-Remote-unauthenticated-API-access-vulnerability-CVE-2023-35078 - https://www.cisa.gov/news-events/alerts/2023/07/24/ivanti-releases-security-updates-endpoint-manager-mobile-epmm-cve-2023-35078 - https://www.ivanti.com/blog/cve-2023-35078-new-ivanti-epmm-vulnerability
CVE ID: CVE-2023-35080 State: PUBLISHED Published: 2023-11-14T23:18:08.387Z Last Updated: 2025-01-07T18:56:18.735Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: Secure Access Client Description: A vulnerability has been identified in the Ivanti Secure Access Windows client, which could allow a locally authenticated attacker to exploit a vulnerable configuration, potentially leading to various security risks, including the escalation of privileges, denial of service, or information disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-fixes-included-i
Program Container: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-fixes-included-in-the-latest-Ivanti-Secure-Access-Client-Release
CVE ID: CVE-2023-35081 State: PUBLISHED Published: 2023-08-03T17:00:10.822Z Last Updated: 2025-10-21T23:05:41.576Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: EPMM Description: A path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) allows an authenticated administrator to write arbitrary files onto the appliance. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/CVE-2023-35081-Arbitrary-File-Write?language=en_US
CVE ID: CVE-2023-35082 State: PUBLISHED Published: 2023-08-15T15:11:56.545Z Last Updated: 2025-10-21T23:05:41.141Z Severity: CRITICAL (CVSS 10 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: EPMM Description: An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the application without proper authentication. This vulnerability is unique to CVE-2023-35078 announced earlier. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/CVE-2023-35082-Remote-Unauthenticated-API-Access-Vulnerability-in-MobileIron-Cor
: - https://forums.ivanti.com/s/article/CVE-2023-35082-Remote-Unauthenticated-API-Access-Vulnerability-in-MobileIron-Core-11-2-and-older?language=en_US
CVE ID: CVE-2023-35083 State: PUBLISHED Published: 2023-10-18T03:52:12.988Z Last Updated: 2024-09-13T14:55:27.624Z Vendors: Ivanti Products: Endpoint Manager Description: Allows an authenticated attacker with network access to read arbitrary files on Endpoint Manager recently discovered on 2022 SU3 and all previous versions potentially leading to the leakage of sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/SA-2023-06-20-CVE-2023-35083?language=en_US
CVE ID: CVE-2023-35084 State: PUBLISHED Published: 2023-10-18T03:52:06.581Z Last Updated: 2024-09-13T15:00:03.906Z Vendors: Ivanti Products: Endpoint Manager Description: Unsafe Deserialization of User Input could lead to Execution of Unauthorized Operations in Ivanti Endpoint Manager 2022 su3 and all previous versions, which could allow an attacker to execute commands remotely. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/SA-2023-08-08-CVE-2023-35084?language=en_US
CVE ID: CVE-2023-35085 State: PUBLISHED Published: 2023-08-10T18:58:17.222Z Last Updated: 2024-12-04T16:30:50.323Z Severity: CRITICAL (CVSS 9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Ubiquiti Inc Products: UniFi Access Points, UniFi Switches Description: An integer overflow vulnerability in all UniFi Access Points and Switches, excluding the Switch Flex Mini, with SNMP Monitoring and default settings enabled could allow a Remote Code Execution (RCE). Affected Products: All UniFi Access Points (Version 6.5.50 and earlier) All UniFi Switches (Version 6.5.32 and earlier) -USW Flex Mini excluded. Mitigation: Update UniFi Access Points to Version 6.5.62 or later. Update the UniFi Sw
earlier) -USW Flex Mini excluded. Mitigation: Update UniFi Access Points to Version 6.5.62 or later. Update the UniFi Switches to Version 6.5.59 or later. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://community.ui.com/releases/Security-Advisory-Bulletin-035-035/91107858-9884-44df-b1c6-63c6499f6e56
CVE ID: CVE-2023-35086 State: PUBLISHED Published: 2023-07-21T06:32:20.831Z Last Updated: 2024-10-24T14:20:09.783Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: ASUS Products: RT-AX56U V2, RT-AC86U Problem Types: CWE-134 Description: It is identified a format string vulnerability in ASUS RT-AX56U V2 & RT-AC86U. This vulnerability is caused by directly using input as a format string when calling syslog in logmessage_normal function, in the do_detwan_cgi module of httpd. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service. This issue affects RT-A
ility to perform remote arbitrary code execution, arbitrary system operation or disrupt service. This issue affects RT-AX56U V2: 3.0.0.4.386_50460; RT-AC86U: 3.0.0.4_386_51529. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7240-a5f96-1.html
CVE ID: CVE-2023-35087 State: PUBLISHED Published: 2023-07-21T07:11:03.792Z Last Updated: 2024-10-24T14:17:09.505Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ASUS Products: RT-AX56U V2, RT-AC86U Problem Types: CWE-134 Description: It is identified a format string vulnerability in ASUS RT-AX56U V2 & RT-AC86U. This vulnerability is caused by lacking validation for a specific value when calling cm_processChangedConfigMsg in ccm_processREQ_CHANGED_CONFIG function in AiMesh system. An unauthenticated remote attacker can exploit this vulnerability without privilege to perform remote arbitrary code execution, arbitrary system operation or disrupt service. Th
rability without privilege to perform remote arbitrary code execution, arbitrary system operation or disrupt service. This issue affects RT-AX56U V2: 3.0.0.4.386_50460; RT-AC86U: 3.0.0.4_386_51529. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7249-ab2d1-1.html
CVE ID: CVE-2023-35088 State: PUBLISHED Published: 2023-07-25T07:10:19.460Z Last Updated: 2025-02-13T16:55:46.689Z Vendors: Apache Software Foundation Products: Apache InLong Problem Types: CWE-89 Description: Improper Neutralization of Special Elements Used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0. In the toAuditCkSql method, the groupId, streamId, auditId, and dt are directly concatenated into the SQL query statement, which may lead to SQL injection attacks. Users are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/
rs are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/8198 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/os7b66x4n8dbtrdpb7c6x37bb1vjb0tk - http://seclists.org/fulldisclosure/2023/Jul/43 - http://www.openwall.com/lists/oss-security/2023/07/25/4
CVE ID: CVE-2023-35089 State: PUBLISHED Published: 2023-07-17T13:31:13.212Z Last Updated: 2024-10-07T15:13:18.587Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Really Simple Plugins Products: Recipe Maker For Your Food Blog from Zip Recipes Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Really Simple Plugins Recipe Maker For Your Food Blog from Zip Recipes plugin <= 8.0.7 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/zip-recipes/wordpress-recipe-maker-for-your-food-blog-from-zip-recipes-plugin-8-0-7-cross-site-request
ase/vulnerability/zip-recipes/wordpress-recipe-maker-for-your-food-blog-from-zip-recipes-plugin-8-0-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-35090 State: PUBLISHED Published: 2023-06-22T10:33:16.893Z Last Updated: 2024-08-02T16:23:59.271Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: StylemixThemes Products: MasterStudy LMS WordPress Plugin – for Online Courses and Education Problem Types: CWE-79 Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin <= 3.0.7 versions. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/masterstudy-lms-learning-management-system/wordpress-masterstudy-lms-plugin-3-0-7-c
atchstack.com/database/vulnerability/masterstudy-lms-learning-management-system/wordpress-masterstudy-lms-plugin-3-0-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-35091 State: PUBLISHED Published: 2023-07-11T12:45:57.409Z Last Updated: 2024-10-07T15:10:16.449Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: StoreApps Products: Stock Manager for WooCommerce Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in StoreApps Stock Manager for WooCommerce plugin <= 2.10.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/woocommerce-stock-manager/wordpress-stock-manager-for-woocommerce-plugin-2-10-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-35092 State: PUBLISHED Published: 2023-08-30T15:19:56.920Z Last Updated: 2024-09-24T19:08:50.973Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Abhay Yadav Products: Breadcrumb simple Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Abhay Yadav Breadcrumb simple plugin <= 1.3 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/breadcrumb-simple/wordpress-breadcrumb-simple-plugin-1-3-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-35093 State: PUBLISHED Published: 2023-06-22T11:07:21.020Z Last Updated: 2025-02-19T21:29:01.394Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: StylemixThemes Products: MasterStudy LMS WordPress Plugin – for Online Courses and Education Problem Types: CWE-862 Description: Broken Access Control vulnerability in StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin <= 3.0.8 versions allows any logged-in users, such as subscribers to view the "Orders" of the plugin and get the data related to the order like email, username, and more. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment
to the order like email, username, and more. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/masterstudy-lms-learning-management-system/wordpress-masterstudy-lms-plugin-3-0-7-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-35094 State: PUBLISHED Published: 2023-08-30T15:14:28.543Z Last Updated: 2025-02-19T21:25:22.993Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Julien Berthelot / MPEmbed Products: WP Matterport Shortcode Problem Types: CWE-79 Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Julien Berthelot / MPEmbed WP Matterport Shortcode plugin <= 2.1.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/shortcode-gallery-for-matterport-showcase/wordpress-wp-matterport-shortcode-plugin-2-1-4-cross-site-scripting-xss?_s_id=cv
ortcode-gallery-for-matterport-showcase/wordpress-wp-matterport-shortcode-plugin-2-1-4-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-35095 State: PUBLISHED Published: 2023-06-20T13:30:02.160Z Last Updated: 2024-10-10T18:13:51.201Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Flothemes Products: Flo Forms – Easy Drag & Drop Form Builder Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Flothemes Flo Forms – Easy Drag & Drop Form Builder plugin <= 1.0.40 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/flo-forms/wordpress-flo-forms-plugin-1-0-40-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-35096 State: PUBLISHED Published: 2023-07-17T13:35:21.634Z Last Updated: 2024-09-30T14:40:03.470Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: myCred Products: myCred Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in myCred plugin <= 2.5 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/mycred/wordpress-mycred-plugin-2-5-cross-site-request-forgery-csrf?_s_id=cve
CVE ID: CVE-2023-35097 State: PUBLISHED Published: 2023-06-20T09:05:03.297Z Last Updated: 2025-02-19T21:29:19.416Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Internet Marketing Dojo Products: WP Affiliate Links Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Internet Marketing Dojo WP Affiliate Links plugin <= 0.1.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-affiliate-links/wordpress-wp-affiliate-links-plugin-0-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve