Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-4208 State: PUBLISHED Published: 2022-12-02T20:25:37.319Z Last Updated: 2025-01-31T18:20:14.991Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/A:N/I:L/C:L/S:C/UI:R/PR:N/AC:L/AV:N) Vendors: prasunsen Products: Chained Quiz Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'datef' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute i
t escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2824193%40chained-quiz&new=2824193%40chained-quiz&sfp_email=&sfph_mail= - https://gist.github.com/Xib3rR4dAr/417a11bcb9b8da28cfe5ba1c17c44d0e - https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4208
CVE ID: CVE-2022-4209 State: PUBLISHED Published: 2022-12-02T20:25:57.704Z Last Updated: 2025-01-31T18:19:54.477Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/A:N/I:L/C:L/S:C/UI:R/PR:N/AC:L/AV:N) Vendors: prasunsen Products: Chained Quiz Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'pointsf' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute
put escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2824193%40chained-quiz&new=2824193%40chained-quiz&sfp_email=&sfph_mail= - https://gist.github.com/Xib3rR4dAr/417a11bcb9b8da28cfe5ba1c17c44d0e - https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4209
CVE ID: CVE-2022-4210 State: PUBLISHED Published: 2022-12-02T20:26:45.548Z Last Updated: 2025-01-31T18:19:36.068Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/A:N/I:L/C:L/S:C/UI:R/PR:N/AC:L/AV:N) Vendors: prasunsen Products: Chained Quiz Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dnf' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if
escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2824193%40chained-quiz&new=2824193%40chained-quiz&sfp_email=&sfph_mail= - https://gist.github.com/Xib3rR4dAr/417a11bcb9b8da28cfe5ba1c17c44d0e - https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4210
CVE ID: CVE-2022-4211 State: PUBLISHED Published: 2022-12-02T20:27:55.674Z Last Updated: 2025-01-31T18:16:58.683Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/A:N/I:L/C:L/S:C/UI:R/PR:N/AC:L/AV:N) Vendors: prasunsen Products: Chained Quiz Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'emailf' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute
ut escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2824193%40chained-quiz&new=2824193%40chained-quiz&sfp_email=&sfph_mail= - https://gist.github.com/Xib3rR4dAr/417a11bcb9b8da28cfe5ba1c17c44d0e - https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4211
CVE ID: CVE-2022-4212 State: PUBLISHED Published: 2022-12-02T20:29:12.966Z Last Updated: 2025-01-31T17:24:54.998Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/A:N/I:L/C:L/S:C/UI:R/PR:N/AC:L/AV:N) Vendors: prasunsen Products: Chained Quiz Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ipf' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if
escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2824193%40chained-quiz&new=2824193%40chained-quiz&sfp_email=&sfph_mail= - https://gist.github.com/Xib3rR4dAr/417a11bcb9b8da28cfe5ba1c17c44d0e - https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4212
CVE ID: CVE-2022-4213 State: PUBLISHED Published: 2022-12-02T20:19:08.928Z Last Updated: 2025-01-31T18:20:42.935Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/A:N/I:L/C:L/S:C/UI:R/PR:N/AC:L/AV:N) Vendors: prasunsen Products: Chained Quiz Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dn' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if
escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2825368%40chained-quiz&new=2825368%40chained-quiz&sfp_email=&sfph_mail= - https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4213
CVE ID: CVE-2022-4214 State: PUBLISHED Published: 2022-12-02T20:17:20.632Z Last Updated: 2025-01-31T18:21:15.265Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/A:N/I:L/C:L/S:C/UI:R/PR:N/AC:L/AV:N) Vendors: prasunsen Products: Chained Quiz Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ip' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if
escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2826500%40chained-quiz&new=2826500%40chained-quiz&sfp_email=&sfph_mail= - https://gist.github.com/Xib3rR4dAr/417a11bcb9b8da28cfe5ba1c17c44d0e - https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4214
CVE ID: CVE-2022-4215 State: PUBLISHED Published: 2022-12-02T20:15:45.531Z Last Updated: 2025-01-31T18:46:28.941Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/A:N/I:L/C:L/S:C/UI:R/PR:N/AC:L/AV:N) Vendors: prasunsen Products: Chained Quiz Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'date' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute
ut escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2826500%40chained-quiz&new=2826500%40chained-quiz&sfp_email=&sfph_mail= - https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4215 - https://gist.github.com/Xib3rR4dAr/417a11bcb9b8da28cfe5ba1c17c44d0e
CVE ID: CVE-2022-4216 State: PUBLISHED Published: 2022-12-02T20:58:39.550Z Last Updated: 2025-01-23T20:33:39.360Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/A:N/I:L/C:L/S:C/UI:N/PR:H/AC:L/AV:N) Vendors: prasunsen Products: Chained Quiz Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Chained Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'facebook_appid' parameter in versions up to, and including, 1.3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative privileges to inject arbitrary web scripts in pages that wil
it possible for authenticated attackers with administrative privileges to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2825368%40chained-quiz&new=2825368%40chained-quiz&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2825114%40chained-quiz&new=2825114%40chained-quiz&sfp_email=&sfph_mail= - https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4216 - https://gist.github.com/Xib3rR4dAr/417a11bcb9b8da
/www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4216 - https://gist.github.com/Xib3rR4dAr/417a11bcb9b8da28cfe5ba1c17c44d0e
CVE ID: CVE-2022-4217 State: PUBLISHED Published: 2022-12-02T20:58:25.221Z Last Updated: 2025-01-24T16:16:59.468Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/A:N/I:L/C:L/S:C/UI:N/PR:H/AC:L/AV:N) Vendors: prasunsen Products: Chained Quiz Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Chained Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'api_key' parameter in versions up to, and including, 1.3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative privileges to inject arbitrary web scripts in pages that will execu
ible for authenticated attackers with administrative privileges to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/changeset/2824193 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2825368%40chained-quiz&new=2825368%40chained-quiz&sfp_email=&sfph_mail= - https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4217 - https://gist.github.com/Xib3rR4dAr/417a11bcb9b8da28cfe5ba1c17c44d0e
CVE ID: CVE-2022-4218 State: PUBLISHED Published: 2022-12-02T20:10:04.021Z Last Updated: 2025-01-23T20:48:14.444Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/A:L/I:L/C:N/S:U/UI:R/PR:N/AC:L/AV:N) Vendors: prasunsen Products: Chained Quiz Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce validation on the list_quizzes() function. This makes it possible for unauthenticated attackers to delete quizzes and copy quizzes via a forged request granted they can trick a site administrator into performing an action such as clicking on a lin
zes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2826623%40chained-quiz&new=2826623%40chained-quiz&sfp_email=&sfph_mail= - https://gist.github.com/Xib3rR4dAr/417a11bcb9b8da28cfe5ba1c17c44d0e - https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4218
CVE ID: CVE-2022-4219 State: PUBLISHED Published: 2022-12-02T20:10:31.387Z Last Updated: 2025-01-23T20:47:09.152Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/A:L/I:L/C:N/S:U/UI:R/PR:N/AC:L/AV:N) Vendors: prasunsen Products: Chained Quiz Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce validation on the manage() function. This makes it possible for unauthenticated attackers to delete submitted quiz responses via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Add
a a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2826623%40chained-quiz&new=2826623%40chained-quiz&sfp_email=&sfph_mail= - https://gist.github.com/Xib3rR4dAr/417a11bcb9b8da28cfe5ba1c17c44d0e - https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4219
CVE ID: CVE-2022-4220 State: PUBLISHED Published: 2022-12-02T20:11:13.243Z Last Updated: 2025-01-23T20:45:59.188Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/A:L/I:L/C:N/S:U/UI:R/PR:N/AC:L/AV:N) Vendors: prasunsen Products: Chained Quiz Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce validation on the list_questions() function. This makes it possible for unauthenticated attackers to delete questions from quizzes via a forged request granted they can trick a site administrator into performing an action such as clicking on a lin
zes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/browser/chained-quiz/trunk/controllers/questions.php#L73 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2826623%40chained-quiz&new=2826623%40chained-quiz&sfp_email=&sfph_mail= - https://gist.github.com/Xib3rR4dAr/417a11bcb9b8da28cfe5ba1c17c44d0e - https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4220
CVE ID: CVE-2022-4221 State: PUBLISHED Published: 2022-12-01T09:26:48.459Z Last Updated: 2025-04-14T17:51:37.058Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Asus Products: NAS-M25 Problem Types: CWE-78 Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Asus NAS-M25 allows an unauthenticated attacker to inject arbitrary OS commands via unsanitized cookie values.This issue affects NAS-M25: through 1.0.1.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://onekey.com/blog/security-advisory-asus-m25-nas-vulnerability/
CVE ID: CVE-2022-4222 State: PUBLISHED Published: 2022-11-30T00:00:00.000Z Last Updated: 2025-04-15T13:11:16.188Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Canteen Management System Problem Types: CWE-707 Description: A vulnerability was found in SourceCodester Canteen Management System. It has been rated as critical. This issue affects the function query of the file ajax_invoice.php of the component POST Request Handler. The manipulation of the argument search leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability
remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-214523. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jianshu.com/p/bda61089bf1d - https://vuldb.com/?id.214523
CVE ID: CVE-2022-4223 State: PUBLISHED Published: 2022-12-13T00:00:00.000Z Last Updated: 2025-04-14T18:12:15.226Z Vendors: n/a Products: pgadmin4 Problem Types: CWE-94 Description: The pgAdmin server includes an HTTP API that is intended to be used to validate the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. The utility is executed by the server to determine what PostgreSQL version it is from. Versions of pgAdmin prior to 6.17 failed to properly secure this API, which could allow an unauthenticated user to call it with a path of their choosing, such as a UNC path to a server they control on a Windows machine. This would cause an appropriately named exe
choosing, such as a UNC path to a server they control on a Windows machine. This would cause an appropriately named executable in the target path to be executed by the pgAdmin server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pgadmin-org/pgadmin4/issues/5593 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5EYTPKHVFSDCETBJI7LBZE4EYHBPN2Q/
CVE ID: CVE-2022-4224 State: PUBLISHED Published: 2023-03-23T11:15:37.014Z Last Updated: 2024-08-03T01:34:49.591Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: CODESYS Products: Control RTE (SL) , Control RTE (for Beckhoff CX) SL, Control Win (SL), Runtime Toolkit , Safety SIL2 Runtime Toolkit, Safety SIL2 PSP, HMI (SL) , Development System V3, Control for BeagleBone SL , Control for emPC-A/iMX6 SL, Control for IOT2000 SL, Control for Linux SL, Control for PFC100 SL, Control for PFC200 SL, Control for PLCnext SL, Control for Raspberry Pi SL, Control for WAGO Touch Panels 600 SL Problem Types: CWE-1188 Description: In multiple products of CODESYS v3 in multip
, Control for WAGO Touch Panels 600 SL Problem Types: CWE-1188 Description: In multiple products of CODESYS v3 in multiple versions a remote low privileged user could utilize this vulnerability to read and modify system files and OS resources or DoS the device. Additional Analyst Notes: - CVE Program Container: References: - https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17553&token=cf49757d232ea8021f0c0dd6c65e71ea5942b12d&download=
CVE ID: CVE-2022-4226 State: PUBLISHED Published: 2022-12-26T12:28:12.904Z Last Updated: 2025-04-14T14:06:11.104Z Vendors: Unknown Products: Simple Basic Contact Form Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Simple Basic Contact Form WordPress plugin before 20221201 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c5ca22e0-b7a5-468d-8366-1855ff33851b
CVE ID: CVE-2022-4227 State: PUBLISHED Published: 2022-12-26T12:28:11.362Z Last Updated: 2025-04-14T14:08:53.277Z Vendors: Unknown Products: Booster for WooCommerce, Booster Plus for WooCommerce, Booster Elite for WooCommerce Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Booster for WooCommerce WordPress plugin before 5.6.3, Booster Plus for WooCommerce WordPress plugin before 6.0.0, Booster Elite for WooCommerce WordPress plugin before 6.0.0 do not escape some URLs and parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/
Scripting Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/90d3022c-5d35-4ef2-ab87-6919268db890
CVE ID: CVE-2022-4228 State: PUBLISHED Published: 2022-11-30T00:00:00 Last Updated: 2024-11-19T20:36:26.733Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SourceCodester Products: Book Store Management System Problem Types: CWE-200 Description: A vulnerability classified as problematic has been found in SourceCodester Book Store Management System 1.0. This affects an unknown part of the file /bsms_ci/index.php/user/edit_user/. The manipulation of the argument password leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability
remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-214587. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.214587 - https://vuldb.com/?ctiid.214587 - https://github.com/lithonn/bug-report/tree/main/vendors/oretnom23/bsms_ci/passwd-hash
CVE ID: CVE-2022-4229 State: PUBLISHED Published: 2022-11-30T00:00:00.000Z Last Updated: 2025-04-14T15:55:30.806Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Book Store Management System Problem Types: CWE-284 Description: A vulnerability classified as critical was found in SourceCodester Book Store Management System 1.0. This vulnerability affects unknown code of the file /bsms_ci/index.php. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-214588. Additional Analyst Notes: - CVE Program