Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-25683 State: PUBLISHED Published: 2023-06-15T00:59:47.051Z Last Updated: 2024-12-12T21:28:44.453Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: PowerVM Hypervisor Problem Types: CWE-200 Description: IBM PowerVM Hypervisor FW950.00 through FW950.71, FW1010.00 through FW1010.40, FW1020.00 through FW1020.20, and FW1030.00 through FW1030.11 could allow an attacker to obtain sensitive information if they gain service access to the HMC. IBM X-Force ID: 247592. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7002721 - https://exchange.xforce.ibmcloud.co
ISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7002721 - https://exchange.xforce.ibmcloud.com/vulnerabilities/247592
CVE ID: CVE-2023-25684 State: PUBLISHED Published: 2023-03-21T16:13:23.239Z Last Updated: 2025-02-26T16:43:18.573Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Security Key Lifecycle Manager Problem Types: CWE-89 Description: IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 247597. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node
al Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6962729 - https://exchange.xforce.ibmcloud.com/vulnerabilities/247597
CVE ID: CVE-2023-25686 State: PUBLISHED Published: 2023-03-21T15:55:53.821Z Last Updated: 2025-02-26T16:44:05.158Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Security Key Lifecycle Manager Problem Types: 256 Description: IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 247601. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6962729 - https://exchange.xforce.ibmcloud.com/vulnerabilities/247601
CVE ID: CVE-2023-25687 State: PUBLISHED Published: 2023-03-21T14:57:32.812Z Last Updated: 2025-02-25T19:57:39.074Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Security Key Lifecycle Manager Problem Types: CWE-209 Description: IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to obtain sensitive information from log files. IBM X-Force ID: 247602. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6962729 - https://exchange.xforce.ibmcloud.com/vulnerabilities/247602
CVE ID: CVE-2023-25688 State: PUBLISHED Published: 2023-03-21T15:01:07.193Z Last Updated: 2025-02-26T16:47:19.515Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Security Key Lifecycle Manager Problem Types: CWE-22 Description: IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 247606. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages
itional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6962729 - https://exchange.xforce.ibmcloud.com/vulnerabilities/247606
CVE ID: CVE-2023-25689 State: PUBLISHED Published: 2023-03-21T14:49:21.593Z Last Updated: 2025-02-25T21:04:24.800Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) Vendors: IBM Products: Security Key Lifecycle Manager Problem Types: CWE-22 Description: IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1 , and 4.1.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 247618. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/
tional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6962729 - https://exchange.xforce.ibmcloud.com/vulnerabilities/247618
CVE ID: CVE-2023-25690 State: PUBLISHED Published: 2023-03-07T15:09:03.080Z Last Updated: 2025-02-13T16:44:35.286Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: CWE-444 Description: Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific pattern matches some portion of the user-supplied request-target (URL) data and is then re-inserted into the proxied request-target using variable substitution. For example, something like: RewriteEngine on RewriteRule "^/here/(.*)
oxied request-target using variable substitution. For example, something like: RewriteEngine on RewriteRule "^/here/(.*)" "http://example.com:8080/elsewhere?$1"; [P] ProxyPassReverse /here/ http://example.com:8080/ Request splitting/smuggling could result in bypass of access controls in the proxy server, proxying unintended URLs to existing origin servers, and cache poisoning. Users are recommended to update to at least version 2.4.56 of Apache HTTP Server. Additional Analyst Notes: - CVE Program Container: References: - https://httpd.apache.org/security/vulnerabilities_24.html - https://lists.debian.org/debian-lts-announce/2023/04/msg00028.html - https://security.gentoo.org/glsa/202309-01 -
html - https://lists.debian.org/debian-lts-announce/2023/04/msg00028.html - https://security.gentoo.org/glsa/202309-01 - http://packetstormsecurity.com/files/176334/Apache-2.4.55-mod_proxy-HTTP-Request-Smuggling.html
CVE ID: CVE-2023-25691 State: PUBLISHED Published: 2023-02-24T11:35:49.091Z Last Updated: 2025-03-11T20:44:52.284Z Vendors: Apache Software Foundation Products: Apache Airflow Google Provider Problem Types: CWE-20 Description: Improper Input Validation vulnerability in the Apache Airflow Google Provider. This issue affects Apache Airflow Google Provider versions before 8.10.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/29497 - https://lists.apache.org/thread/zdr8ovfttbh7kj0lydgcw88tbt2nmkcy
CVE ID: CVE-2023-25692 State: PUBLISHED Published: 2023-02-24T11:48:00.202Z Last Updated: 2025-03-11T20:36:18.446Z Vendors: Apache Software Foundation Products: Apache Airflow Google Provider Problem Types: CWE-20 Description: Improper Input Validation vulnerability in the Apache Airflow Google Provider. This issue affects Apache Airflow Google Provider versions before 8.10.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/29499 - https://lists.apache.org/thread/ks4l78l5rwdpmvfn7y7yhs179nyxtlsh
CVE ID: CVE-2023-25693 State: PUBLISHED Published: 2023-02-24T11:48:11.397Z Last Updated: 2025-02-13T14:27:04.792Z Vendors: Apache Software Foundation Products: Apache Airflow Sqoop Provider Problem Types: CWE-20 Description: Improper Input Validation vulnerability in the Apache Airflow Sqoop Provider. This issue affects Apache Airflow Sqoop Provider versions before 3.1.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/29500 - https://lists.apache.org/thread/79qn8g5xbq036f8crb115obvr22l52q4
CVE ID: CVE-2023-25694 State: REJECTED Published: N/A Last Updated: 2023-03-01T00:00:00 Description: No description available.
CVE ID: CVE-2023-25695 State: PUBLISHED Published: 2023-03-15T09:37:11.437Z Last Updated: 2025-02-13T14:29:40.759Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: CWE-209 Description: Generation of Error Message Containing Sensitive Information vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: before 2.5.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/29501 - https://lists.apache.org/thread/z8w6ckzs61ql365tv4d19k82o67r15p2
CVE ID: CVE-2023-25696 State: PUBLISHED Published: 2023-02-24T11:48:21.189Z Last Updated: 2024-10-23T19:10:47.536Z Vendors: Apache Software Foundation Products: Apache Airflow Hive Provider Problem Types: CWE-20 Description: Improper Input Validation vulnerability in the Apache Airflow Hive Provider. This issue affects Apache Airflow Hive Provider versions before 5.1.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/29502 - https://lists.apache.org/thread/99g0qm56wmgdxmbtdsvhj4rdnxhpzpml
CVE ID: CVE-2023-25697 State: PUBLISHED Published: 2024-06-19T14:34:51.272Z Last Updated: 2024-08-02T11:32:11.192Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: GamiPress Products: GamiPress Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in GamiPress.This issue affects GamiPress: from n/a through 2.5.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/gamipress/wordpress-gamipress-plugin-2-5-6-csrf-leading-to-settings-change-vulnerability?_s_id=cve
CVE ID: CVE-2023-25698 State: PUBLISHED Published: 2023-05-18T10:45:15.968Z Last Updated: 2025-01-09T15:13:14.320Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Studio Wombat Products: Shoppable Images Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Studio Wombat Shoppable Images plugin <= 1.2.3 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/mabel-shoppable-images-lite/wordpress-shoppable-images-plugin-1-2-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-25699 State: PUBLISHED Published: 2024-04-03T12:22:14.850Z Last Updated: 2024-08-02T11:32:11.198Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: VideoWhisper.com Products: VideoWhisper Live Streaming Integration Problem Types: CWE-78 Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in VideoWhisper.Com VideoWhisper Live Streaming Integration allows OS Command Injection.This issue affects VideoWhisper Live Streaming Integration: from n/a through 5.5.15. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/v
itional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/videowhisper-live-streaming-integration/wordpress-broadcast-live-video-live-streaming-html5-webrtc-hls-rtsp-rtmp-plugin-5-5-15-remote-code-execution-rce?_s_id=cve
CVE ID: CVE-2023-25700 State: PUBLISHED Published: 2023-11-03T16:44:47.440Z Last Updated: 2024-09-05T18:44:50.270Z Vendors: Themeum Products: Tutor LMS Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS allows SQL Injection.This issue affects Tutor LMS: from n/a through 2.1.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/tutor/wordpress-tutor-lms-plugin-2-1-10-unauthenticated-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-25701 State: PUBLISHED Published: 2024-05-17T06:40:37.582Z Last Updated: 2024-08-02T11:32:11.183Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: WhatArmy Products: WatchTowerHQ Problem Types: CWE-269 Description: Improper Privilege Management vulnerability in WhatArmy WatchTowerHQ allows Privilege Escalation.This issue affects WatchTowerHQ: from n/a through 3.6.16. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/watchtowerhq/wordpress-watchtowerhq-plugin-3-6-16-privilege-escalation?_s_id=cve
CVE ID: CVE-2023-25702 State: PUBLISHED Published: 2023-04-07T12:39:15.119Z Last Updated: 2025-01-10T18:57:27.526Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Fullworks Products: Quick Paypal Payments Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-site Scripting (XSS) vulnerability in Fullworks Quick Paypal Payments plugin <= 5.7.25 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/quick-paypal-payments/wordpress-quick-paypal-payments-plugin-5-7-25-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-25703 State: PUBLISHED Published: 2024-12-09T11:31:31.050Z Last Updated: 2024-12-09T18:42:59.371Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: WP OnlineSupport, Essential Plugin Products: Meta slider and carousel with lightbox Problem Types: CWE-862 Description: Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Meta slider and carousel with lightbox allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta slider and carousel with lightbox: from n/a through 1.6.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/m
6.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/meta-slider-and-carousel-with-lightbox/vulnerability/wordpress-meta-slider-and-carousel-with-lightbox-plugin-1-6-2-broken-access-control?_s_id=cve
CVE ID: CVE-2023-25704 State: PUBLISHED Published: 2023-03-28T08:19:55.148Z Last Updated: 2025-01-10T19:15:06.649Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Mehjabin Orthi Products: Interactive SVG Image Map Builder Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mehjabin Orthi Interactive SVG Image Map Builder plugin <= 1.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/interactive-image-map-builder/wordpress-interactive-svg-image-map-builder-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-25705 State: PUBLISHED Published: 2023-04-07T12:33:48.818Z Last Updated: 2025-02-19T21:34:03.493Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Go Prayer Products: WP Prayer Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Go Prayer WP Prayer plugin <= 1.9.6 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-prayer/wordpress-wp-prayer-plugin-1-9-6-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-25706 State: PUBLISHED Published: 2023-07-11T12:19:11.417Z Last Updated: 2024-08-02T14:48:42.764Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Pagup Products: WordPress Robots.txt optimization Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Pagup WordPress Robots.Txt optimization plugin <= 1.4.5 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/better-robots-txt/wordpress-wordpress-robots-txt-optimization-xml-sitemap-website-traffic-seo-ranking-booster-plugin-1-4-5-cross-site-request-forgery-csrf-vulnerabi
-txt-optimization-xml-sitemap-website-traffic-seo-ranking-booster-plugin-1-4-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-25707 State: PUBLISHED Published: 2023-05-23T12:36:40.598Z Last Updated: 2025-01-08T22:06:10.376Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: E4J s.r.l. Products: VikBooking Hotel Booking Engine & PMS Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in E4J s.R.L. VikBooking Hotel Booking Engine & PMS plugin <= 1.5.12 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/vikbooking/wordpress-vikbooking-hotel-booking-engine-pms-plugin-1-5-12-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-25708 State: PUBLISHED Published: 2023-03-15T10:30:25.030Z Last Updated: 2025-01-13T15:51:59.975Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Rextheme Products: WP VR – 360 Panorama and Virtual Tour Builder For WordPress Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Rextheme WP VR – 360 Panorama and Virtual Tour Builder For WordPress plugin <= 8.2.7 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wpvr/wordpress-wp-vr-360-panorama-and-virtual-tour-builder-plugin-8-2-7-cross-site-request-forgery-csrf-vu
vulnerability/wpvr/wordpress-wp-vr-360-panorama-and-virtual-tour-builder-plugin-8-2-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-25709 State: PUBLISHED Published: 2023-03-15T10:25:14.062Z Last Updated: 2025-01-13T15:52:07.358Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Plainware Products: Locatoraid Store Locator Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Plainware Locatoraid Store Locator plugin <= 3.9.11 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/locatoraid/wordpress-locatoraid-store-locator-plugin-3-9-11-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-25710 State: PUBLISHED Published: 2023-04-25T11:34:01.217Z Last Updated: 2025-01-09T15:35:06.668Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: DIGITALBLUE Products: Click to Call or Chat Buttons Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in DIGITALBLUE Click to Call or Chat Buttons plugin <= 1.4.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/click-to-call-or-chat-buttons/wordpress-click-to-call-or-chat-buttons-plugin-1-4-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-25711 State: PUBLISHED Published: 2023-04-07T12:24:52.786Z Last Updated: 2025-01-10T18:57:39.860Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: WPGlobus Products: WPGlobus Translate Options Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPGlobus WPGlobus Translate Options plugin <= 2.1.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wpglobus-translate-options/wordpress-wpglobus-translate-options-plugin-2-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-25712 State: PUBLISHED Published: 2023-04-07T12:29:39.096Z Last Updated: 2025-02-19T21:34:17.818Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: WP-Buddy Products: Google Analytics Opt-Out Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP-Buddy Google Analytics Opt-Out plugin <= 2.3.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/google-analytics-opt-out/wordpress-opt-out-for-google-analytics-plugin-2-3-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-25713 State: PUBLISHED Published: 2023-04-07T12:54:32.032Z Last Updated: 2025-01-10T18:57:13.260Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Fullworks Products: Quick Paypal Payments Problem Types: CWE-79 Description: Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Paypal Payments plugin <= 5.7.25 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/quick-paypal-payments/wordpress-quick-paypal-payments-plugin-5-7-25-cross-site-scripting-xss-2?_s_id=cve
CVE ID: CVE-2023-25714 State: PUBLISHED Published: 2024-12-09T11:31:30.220Z Last Updated: 2024-12-09T18:43:05.596Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Fullworks Products: Quick Paypal Payments Problem Types: CWE-862 Description: Missing Authorization vulnerability in Fullworks Quick Paypal Payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Paypal Payments: from n/a through 5.7.25. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/quick-paypal-payments/vulnerability/wordpress-quick-paypal-payments-plugin-5-7-25-broken-access-control
wordpress/plugin/quick-paypal-payments/vulnerability/wordpress-quick-paypal-payments-plugin-5-7-25-broken-access-control?_s_id=cve
CVE ID: CVE-2023-25715 State: PUBLISHED Published: 2023-12-19T15:40:16.483Z Last Updated: 2024-09-16T18:36:36.426Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: GamiPress Products: GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress Problem Types: CWE-862 Description: Missing Authorization vulnerability in GamiPress GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress.This issue affects GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress: from n/a through 2.5.6. Additional Analyst Notes: - CVE Program Container: - CISA
evements, badges & ranks in WordPress: from n/a through 2.5.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/gamipress/wordpress-gamipress-plugin-2-5-6-missing-authorization-leading-to-points-manipulation-vulnerability?_s_id=cve
CVE ID: CVE-2023-25716 State: PUBLISHED Published: 2023-04-07T11:58:50.645Z Last Updated: 2024-08-02T13:44:46.359Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: gqevu6bsiz Products: Announce from the Dashboard Problem Types: CWE-79 Description: Auth (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gqevu6bsiz Announce from the Dashboard plugin <= 1.5.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/announce-from-the-dashboard/wordpress-announce-from-the-dashboard-plugin-1-5-1-cross-site-scripting-xss-vulnerability?_s_id=cve