Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-1056 State: PUBLISHED Published: 2022-03-28T00:00:00 Last Updated: 2024-08-02T23:47:43.287Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: libtiff Products: libtiff Problem Types: Out-of-bounds read in libtiff Description: Out-of-bounds Read error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 46dc8fcd. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/libtiff/libtiff/-/issues/391 - https://gitlab.com/libtiff/libtiff/-/merge_requests/307 - https://gitlab.com/gitlab-org/cves/-/bl
libtiff/-/issues/391 - https://gitlab.com/libtiff/libtiff/-/merge_requests/307 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1056.json - https://security.gentoo.org/glsa/202210-10 - https://security.netapp.com/advisory/ntap-20221228-0008/
CVE ID: CVE-2022-1057 State: PUBLISHED Published: 2022-07-11T12:55:35 Last Updated: 2024-08-02T23:47:43.247Z Vendors: Unknown Products: Pricing Deals for WooCommerce Problem Types: CWE-89 Description: The Pricing Deals for WooCommerce WordPress plugin through 2.0.2.02 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/7c33ffc3-84d1-4a0f-a837-794cdc3ad243
CVE ID: CVE-2022-1058 State: PUBLISHED Published: 2022-03-24T14:15:12 Last Updated: 2024-08-02T23:47:43.285Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: go-gitea Products: go-gitea/gitea Problem Types: CWE-601 Description: Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/4fb42144-ac70-4f76-a5e1-ef6b5e55dc0d - https://github.com/go-gitea/gitea/commit/e3d8e92bdc67562783de9a76b5b7842b68daeb48
CVE ID: CVE-2022-1059 State: PUBLISHED Published: 2022-10-21T15:38:59.881Z Last Updated: 2025-04-17T15:47:54.921Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N) Vendors: Aethon Products: TUG Home Base Server Problem Types: The “Load” tab of the Fleet Management Console is vulnerable to reflected cross-site scripting attacks. Description: Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-102-05
CVE ID: CVE-2022-1061 State: PUBLISHED Published: 2022-03-24T09:20:10 Last Updated: 2024-08-02T23:47:43.308Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L) Vendors: radareorg Products: radareorg/radare2 Problem Types: CWE-122 Description: Heap Buffer Overflow in parseDragons in GitHub repository radareorg/radare2 prior to 5.6.8. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/a7546dae-01c5-4fb0-8a8e-c04ea4e9bac7 - https://github.com/radareorg/radare2/commit/d4ce40b516ffd70cf2e9e36832d8de139117d522
CVE ID: CVE-2022-1062 State: PUBLISHED Published: 2022-05-16T14:30:34 Last Updated: 2024-08-02T23:47:43.368Z Vendors: Unknown Products: th23 Social Problem Types: CWE-79 Description: The th23 Social WordPress plugin through 1.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e770ba87-95d2-40c9-89cc-5d7390e9cbb0
CVE ID: CVE-2022-1063 State: PUBLISHED Published: 2022-04-18T17:10:49 Last Updated: 2024-08-02T23:47:43.333Z Vendors: Unknown Products: Thank Me Later Problem Types: CWE-79 Description: The Thank Me Later WordPress plugin through 3.3.4 does not sanitise and escape the Message Subject field before outputting it in the Messages list, which could allow high privileges users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f90c528b-8c3a-4f9a-aa36-099c24abe082
CVE ID: CVE-2022-1064 State: PUBLISHED Published: 2022-03-25T11:35:10 Last Updated: 2024-08-02T23:47:43.248Z Severity: CRITICAL (CVSS 9 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: forkcms Products: forkcms/forkcms Problem Types: CWE-89 Description: SQL injection through marking blog comments on bulk as spam in GitHub repository forkcms/forkcms prior to 5.11.1. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/2f664985-c5fc-485b-b4fc-4c401be2cf40 - https://github.com/forkcms/forkcms/commit/6aca30e10b4181534f73f96d6e2ebeb45ec15069
CVE ID: CVE-2022-1065 State: PUBLISHED Published: 2022-04-19T07:50:10 Last Updated: 2024-08-02T23:47:43.377Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Abacus Research AG Products: Abacus ERP Problem Types: CWE-304 Description: A vulnerability within the authentication process of Abacus ERP allows a remote attacker to bypass the second authentication factor. This issue affects: Abacus ERP v2022 versions prior to R1 of 2022-01-15; v2021 versions prior to R4 of 2022-01-15; v2020 versions prior to R6 of 2022-01-15; v2019 versions later than R5 (service pack); v2018 versions later than R5 (service pack). This issue does not affect: Abacus ERP v2019 versions p
R5 (service pack); v2018 versions later than R5 (service pack). This issue does not affect: Abacus ERP v2019 versions prior to R5 of 2020-03-15; v2018 versions prior to R7 of 2020-04-15; v2017 version and prior versions and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://www.redguard.ch/advisories/abacus_mfa_bypass.txt
CVE ID: CVE-2022-1066 State: PUBLISHED Published: 2022-10-21T15:38:53.939Z Last Updated: 2025-04-17T15:48:17.171Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N) Vendors: Aethon Products: TUG Home Base Server Problem Types: An unauthenticated attacker can arbitrarily add new users with administrative privileges and delete or modify existing users. Description: Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-102-05
CVE ID: CVE-2022-1067 State: PUBLISHED Published: 2022-04-11T19:38:15.631Z Last Updated: 2025-04-16T16:31:04.569Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: LifePoint Informatics Products: Patient Portal Problem Types: CWE-288 Description: Navigating to a specific URL with a patient ID number will result in the server generating a PDF of a lab report without authentication and rate limiting. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsma-22-095-01
CVE ID: CVE-2022-1068 State: PUBLISHED Published: 2022-04-01T22:17:57.203Z Last Updated: 2025-04-16T16:32:12.588Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Modbus Tools Products: Modbus Slave Problem Types: CWE-121 Description: Modbus Tools Modbus Slave (versions 7.4.2 and prior) is vulnerable to a stack-based buffer overflow in the registration field. This may cause the program to crash when a long character string is used. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-088-04
CVE ID: CVE-2022-1069 State: PUBLISHED Published: 2022-08-17T20:17:11.000Z Last Updated: 2025-04-16T16:12:52.772Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Softing Products: Secure Integration Server Problem Types: CWE-125 Description: A crafted HTTP packet with a large content-length header can create a denial-of-service condition in Softing Secure Integration Server V1.22. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-4.html - https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-04
CVE ID: CVE-2022-1070 State: PUBLISHED Published: 2022-10-21T15:39:02.444Z Last Updated: 2025-04-17T15:47:47.753Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N) Vendors: Aethon Products: TUG Home Base Server Problem Types: An unauthenticated attacker can connect to the TUG Home Base Server websocket to take control of TUG robots. Description: Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-102-05
CVE ID: CVE-2022-1071 State: PUBLISHED Published: 2022-03-26T03:40:10 Last Updated: 2024-08-02T23:47:43.321Z Severity: HIGH (CVSS 7.7 CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: mruby Products: mruby/mruby Problem Types: CWE-416 Description: User after free in mrb_vm_exec in GitHub repository mruby/mruby prior to 3.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/6597ece9-07af-415b-809b-919ce0a17cf3 - https://github.com/mruby/mruby/commit/aaa28a508903041dd7399d4159a8ace9766b022f
CVE ID: CVE-2022-1072 State: REJECTED Published: 2022-03-29T05:50:32 Last Updated: 2022-03-29T05:50:32 Description: No description available.
CVE ID: CVE-2022-1073 State: PUBLISHED Published: 2022-03-29T05:50:34.000Z Last Updated: 2025-04-15T14:44:49.989Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: unspecified Products: Automatic Question Paper Generator Problem Types: CWE-640 Description: A vulnerability was found in Automatic Question Paper Generator 1.0. It has been declared as critical. An attack leads to privilege escalation. The attack can be launched remotely. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.194839
CVE ID: CVE-2022-1074 State: PUBLISHED Published: 2022-03-29T05:50:35.000Z Last Updated: 2025-04-15T14:44:41.769Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: TEM Products: FLEX-1085 Problem Types: CWE-74 Description: A vulnerability has been found in TEM FLEX-1085 1.6.0 and classified as problematic. Using the input <h1>HTML Injection</h1> in the WiFi settings of the dashboard leads to html injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.194845
CVE ID: CVE-2022-1075 State: PUBLISHED Published: 2022-03-29T05:50:36.000Z Last Updated: 2025-04-15T14:44:34.720Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: unspecified Products: College Website Management System Problem Types: CWE-79 Description: A vulnerability was found in College Website Management System 1.0 and classified as problematic. Affected by this issue is the file /cwms/classes/Master.php?f=save_contact of the component Contact Handler. The manipulation leads to persistent cross site scripting. The attack may be launched remotely and requires authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Reference
otely and requires authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php/15203/college-website-content-management-system-phpoop-free-source-code.ht - https://vuldb.com/?id.194846
CVE ID: CVE-2022-1076 State: PUBLISHED Published: 2022-03-29T05:50:38.000Z Last Updated: 2025-04-15T14:44:26.798Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: unspecified Products: Automatic Question Paper Generator System Problem Types: CWE-79 Description: A vulnerability was found in Automatic Question Paper Generator System 1.0. It has been classified as problematic. This affects the file /aqpg/users/login.php of the component My Account Page. The manipulation of the argument First Name/Middle Name/Last Name leads to cross site scripting. It is possible to initiate the attack remotely. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnr
ing. It is possible to initiate the attack remotely. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.194847
CVE ID: CVE-2022-1077 State: PUBLISHED Published: 2022-03-29T05:50:39.000Z Last Updated: 2025-04-15T14:44:17.399Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: TEM Products: FLEX-1080, FLEX-1085 Problem Types: CWE-200 Description: A vulnerability was found in TEM FLEX-1080 and FLEX-1085 1.6.0. It has been declared as problematic. This vulnerability log.cgi of the component Log Handler. A direct request leads to information disclosure of hardware information. The attack can be initiated remotely and does not require any form of authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.194
ion. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.194848
CVE ID: CVE-2022-1078 State: PUBLISHED Published: 2022-03-29T05:50:40.000Z Last Updated: 2025-04-15T14:44:09.637Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: College Website Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester College Website Management System 1.0. It has been classified as critical. Affected is the file /cwms/admin/?page=articles/view_article/. The manipulation of the argument id with the input ' and (select * from(select(sleep(10)))Avx) and 'abc' = 'abc with an unknown input leads to sql injection. It is possible to launch the attack remotely and without authentication.
c with an unknown input leads to sql injection. It is possible to launch the attack remotely and without authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.194856
CVE ID: CVE-2022-1079 State: PUBLISHED Published: 2022-03-29T05:50:42.000Z Last Updated: 2025-04-15T14:44:02.030Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: SourceCodester Products: One Church Management System Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in SourceCodester One Church Management System. Affected are multiple files and parameters which are prone to to cross site scripting. It is possible to launch the attack remotely. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.195426
CVE ID: CVE-2022-1080 State: PUBLISHED Published: 2022-03-29T05:50:43.000Z Last Updated: 2025-04-15T14:43:54.391Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: One Church Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester One Church Management System 1.0. It has been declared as critical. This vulnerability affects code of the file attendancy.php as the manipulation of the argument search2 leads to sql injection. The attack can be initiated remotely. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.195442
CVE ID: CVE-2022-1081 State: PUBLISHED Published: 2022-03-29T05:50:45.000Z Last Updated: 2025-04-15T14:43:46.920Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: SourceCodester Products: Microfinance Management System Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Microfinance Management System 1.0. It has been declared as problematic. This vulnerability affects the file /mims/app/addcustomerHandler.php. The manipulation of the argument first_name, middle_name, and surname leads to cross site scripting. The attack can be initiated remotely. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
ttack can be initiated remotely. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.195640
CVE ID: CVE-2022-1082 State: PUBLISHED Published: 2022-03-29T05:50:47.000Z Last Updated: 2025-04-15T14:43:37.985Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Microfinance Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Microfinance Management System 1.0. It has been rated as critical. This issue affects the file /mims/login.php of the Login Page. The manipulation of the argument username/password with the input '||1=1# leads to sql injection. The attack may be initiated remotely. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.c
ated remotely. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.195641
CVE ID: CVE-2022-1083 State: PUBLISHED Published: 2022-03-29T05:50:48.000Z Last Updated: 2025-04-15T14:43:30.836Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: unspecified Products: Microfinance Management System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in Microfinance Management System. The manipulation of arguments like customer_type_number/account_number/account_status_number/account_type_number with the input ' and (select * from(select(sleep(10)))Avx) and 'abc' = 'abc leads to sql injection in multiple files. It is possible to launch the attack remotely. Additional Analyst Notes: - CVE Program Container: -
on in multiple files. It is possible to launch the attack remotely. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.195642
CVE ID: CVE-2022-1084 State: PUBLISHED Published: 2022-03-29T05:50:50.000Z Last Updated: 2025-04-15T14:43:22.555Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: One Church Management System Problem Types: CWE-287 Description: A vulnerability classified as critical was found in SourceCodester One Church Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /one_church/userregister.php. The manipulation leads to authentication bypass. The attack can be launched remotely. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.195643
CVE ID: CVE-2022-1085 State: PUBLISHED Published: 2022-03-29T05:50:51.000Z Last Updated: 2025-04-15T14:42:57.663Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: unspecified Products: CLTPHP Problem Types: CWE-79 Description: A vulnerability was found in CLTPHP up to 6.0. It has been declared as problematic. Affected by this vulnerability is the POST Parameter Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.194857
CVE ID: CVE-2022-1086 State: PUBLISHED Published: 2022-03-29T05:50:53.000Z Last Updated: 2025-04-15T14:42:50.076Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: unspecified Products: DolphinPHP Problem Types: CWE-79 Description: A vulnerability was found in DolphinPHP up to 1.5.0 and classified as problematic. Affected by this issue is the User Management Page. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xiahao90/CVEproject/blob/main/DolphinPHPV1.5.0_x
am Container: - CISA ADP Vulnrichment: References: - https://github.com/xiahao90/CVEproject/blob/main/DolphinPHPV1.5.0_xss.md - https://vuldb.com/?id.195368
CVE ID: CVE-2022-1087 State: PUBLISHED Published: 2022-03-29T05:50:54.000Z Last Updated: 2025-04-15T14:42:39.435Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: unspecified Products: htmly Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in htmly 5.3 whis affects the component Edit Profile Module. The manipulation of the field Title with script tags leads to persistent cross site scripting. The attack may be initiated remotely and requires an authentication. A simple POC has been disclosed to the public and may be used. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
d to the public and may be used. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/liaojia-99/project/tree/main/htmly - https://github.com/liaojia-99/project/blob/main/htmly/1.md - https://vuldb.com/?id.195203
CVE ID: CVE-2022-1088 State: PUBLISHED Published: 2022-04-18T17:10:51 Last Updated: 2024-08-02T23:47:43.358Z Vendors: Unknown Products: Page Security & Membership Problem Types: CWE-79 Description: The Page Security & Membership WordPress plugin through 1.5.15 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e86d456d-7a54-43e8-acf1-0b6a0a8bb41b
CVE ID: CVE-2022-1089 State: PUBLISHED Published: 2022-05-16T14:30:36 Last Updated: 2024-08-02T23:47:43.398Z Vendors: Unknown Products: Bulk Edit and Create User Profiles – WP Sheet Editor Problem Types: CWE-79 Description: The Bulk Edit and Create User Profiles WordPress plugin before 1.5.14 does not sanitise and escape the Users Login, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/75a9fd23-7fa9-4cb1-a55b-ec5deae5d6fa
CVE ID: CVE-2022-1090 State: PUBLISHED Published: 2022-04-18T17:10:52 Last Updated: 2024-08-02T23:47:43.388Z Vendors: Unknown Products: Good & Bad comments Problem Types: CWE-79 Description: The Good & Bad Comments WordPress plugin through 1.0.0 does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/3993fa42-b4c3-462b-b568-0a08fe112c19
CVE ID: CVE-2022-1091 State: PUBLISHED Published: 2022-04-18T17:10:54 Last Updated: 2024-08-02T23:47:43.367Z Vendors: Unknown Products: Safe SVG Problem Types: CWE-79 Description: The sanitisation step of the Safe SVG WordPress plugin before 1.9.10 can be bypassed by spoofing the content-type in the POST request to upload a file. Exploiting this vulnerability, an attacker will be able to perform the kinds of attacks that this plugin should prevent (mainly XSS, but depending on further use of uploaded SVG files potentially other XML attacks). Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/4d12533e-bdb7-411f-bcdf-4c5046db13f3 - https://github.