Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-39547 State: PUBLISHED Published: 2023-11-17T05:31:27.701Z Last Updated: 2024-12-02T18:52:58.983Z Vendors: NEC Corporation Products: CLUSTERPRO X (EXPRESSCLUSTER X), CLUSTERPRO X SingleServerSafe (EXPRESSCLUSTER X SingleServerSafe) Problem Types: CWE-294 Description: CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows a attacker to log in to the product may execute an arbitrary command. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jpn.nec.com/security-info/secinfo/nv23-009_en.html
CVE ID: CVE-2023-39548 State: PUBLISHED Published: 2023-11-17T05:31:40.336Z Last Updated: 2024-12-02T18:52:37.254Z Vendors: NEC Corporation Products: CLUSTERPRO X (EXPRESSCLUSTER X), CLUSTERPRO X SingleServerSafe (EXPRESSCLUSTER X SingleServerSafe) Problem Types: CWE-434 Description: CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows a attacker to log in to the product may execute an arbitrary command. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jpn.nec.com/security-info/secinfo/nv23-009_en.html
CVE ID: CVE-2023-39549 State: PUBLISHED Published: 2023-08-08T09:21:01.403Z Last Updated: 2024-10-11T22:08:18.218Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:T/RC:C) Vendors: Siemens Products: Solid Edge SE2023 Problem Types: CWE-416 Description: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 2). The affected application contains a use-after-free vulnerability that could be triggered while parsing specially crafted DWG file. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-19562) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refe
of the current process. (ZDI-CAN-19562) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-932528.pdf
CVE ID: CVE-2023-39550 State: PUBLISHED Published: 2023-08-07T00:00:00 Last Updated: 2024-10-17T14:24:59.568Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netgear JWNR2000v2 v1.0.0.11, XWN5001 v0.4.1.1, and XAVN2001v2 v0.4.0.7 were discovered to contain multiple buffer overflows via the http_passwd and http_username parameters in the check_auth function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.netgear.com/about/security/ - https://github.com/FirmRec/IoT-Vulns/blob/main/netgear/http_passwd_auth/README.md
CVE ID: CVE-2023-39551 State: PUBLISHED Published: 2023-08-04T00:00:00 Last Updated: 2024-10-17T15:01:39.248Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPGurukul Online Security Guards Hiring System v.1.0 is vulnerable to SQL Injection via osghs/admin/search.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Trinity-SYT-SECURITY/XSS_vuln_issue/blob/main/Online%20Security%20Guards%20Hiring%20System%201.0.md - https://nvd.nist.gov/vuln/detail/CVE-2023-39551 - https://www.chtsecurity.com/news/0dbe8e1d-0a6c-4604-9cf1-778ddc86a8c1 - https://www.chtsecurity.com/news/285b9375-ba65-4f61-a02a-a575337dc86c
CVE ID: CVE-2023-39552 State: REJECTED Published: 2023-08-04T18:59:52.898Z Last Updated: 2025-02-13T15:46:48.699Z Description: No description available.
CVE ID: CVE-2023-39553 State: PUBLISHED Published: 2023-08-11T07:18:14.202Z Last Updated: 2025-02-13T17:03:14.052Z Vendors: Apache Software Foundation Products: Apache Airflow Drill Provider Problem Types: CWE-20 Description: Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider. Apache Airflow Drill Provider is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing a connection with DrillHook giving an opportunity to read files on the Airflow server. This issue affects Apache Airflow Drill Provider: before 2.4.3. It is recommended to upgrade to a version that is not affected. Additional Analyst Note
ow Drill Provider: before 2.4.3. It is recommended to upgrade to a version that is not affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/33074 - https://lists.apache.org/thread/ozpl0opmob49rkcz8svo8wkxyw1395sf - http://www.openwall.com/lists/oss-security/2023/08/11/1
CVE ID: CVE-2023-39558 State: PUBLISHED Published: 2023-08-29T00:00:00 Last Updated: 2024-10-02T13:27:50.514Z Vendors: n/a Products: n/a Problem Types: n/a Description: AudimexEE v15.0 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities via the Show Kai Data component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://en.web-audimex.com/ - https://github.com/CapgeminiCisRedTeam/Disclosure/blob/main/CVE%20PoC/CVE-2023-39558.md
CVE ID: CVE-2023-39559 State: PUBLISHED Published: 2023-08-29T00:00:00 Last Updated: 2024-10-02T13:26:18.867Z Vendors: n/a Products: n/a Problem Types: n/a Description: AudimexEE 15.0 was discovered to contain a full path disclosure vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://en.web-audimex.com/ - https://github.com/CapgeminiCisRedTeam/Disclosure/blob/main/CVE%20PoC/CVE-2023-39559.md
CVE ID: CVE-2023-39560 State: PUBLISHED Published: 2023-08-28T00:00:00 Last Updated: 2024-10-02T16:26:51.890Z Vendors: n/a Products: n/a Problem Types: n/a Description: ECTouch v2 was discovered to contain a SQL injection vulnerability via the $arr['id'] parameter at \default\helpers\insert.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Luci4n555/cve_ectouch
CVE ID: CVE-2023-39562 State: PUBLISHED Published: 2023-08-28T00:00:00 Last Updated: 2024-10-02T14:11:18.520Z Vendors: n/a Products: n/a Problem Types: n/a Description: GPAC v2.3-DEV-rev449-g5948e4f70-master was discovered to contain a heap-use-after-free via the gf_bs_align function at bitstream.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gpac/gpac/issues/2537 - https://github.com/ChanStormstout/Pocs/blob/master/gpac_POC/id%3A000000%2Csig%3A06%2Csrc%3A003771%2Ctime%3A328254%2Cexecs%3A120473%2Cop%3Ahavoc%2Crep%3A8
CVE ID: CVE-2023-39575 State: PUBLISHED Published: 2023-09-19T00:00:00 Last Updated: 2024-09-25T15:34:56.130Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability in the url_str URL parameter of ISL ARP Guard v4.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://evait.medium.com/discovery-of-a-reflective-xss-vulnerability-in-arp-guard-software-1734b5113e1c
CVE ID: CVE-2023-39578 State: PUBLISHED Published: 2023-08-28T00:00:00 Last Updated: 2024-10-02T14:10:07.068Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the Create function of Zenario CMS v9.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Menu navigation text field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/anh91/Zenario-xss/issues/1 - https://panda002.hashnode.dev/a-stored-cross-site-scripting-xss-vulnerability-in-the-create-the-function-of-zenario-cms-v94
CVE ID: CVE-2023-39582 State: PUBLISHED Published: 2023-09-01T00:00:00 Last Updated: 2024-10-01T13:19:08.993Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in Chamilo LMS v.1.11 thru v.1.11.20 allows a remote privileged attacker to obtain sensitive information via the import sessions functions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.chamilo.org/projects/chamilo-18/wiki/Security_issues#Issue-126-2023-07-18-High-impact-Low-risk-SQL-injection-by-admin-users
CVE ID: CVE-2023-39583 State: REJECTED Published: N/A Last Updated: 2023-08-23T16:49:41.519386 Description: No description available.
CVE ID: CVE-2023-39584 State: PUBLISHED Published: 2023-09-08T00:00:00 Last Updated: 2024-09-26T18:04:20.237Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hexo up to v7.0.0 (RC2) was discovered to contain an arbitrary file read vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/hexojs/hexo/blob/a3e68e7576d279db22bd7481914286104e867834/lib/plugins/tag/include_code.js#L49 - https://github.com/hexojs/hexo/issues/5250 - https://www.gem-love.com/2023/07/25/hexo%E5%8D%9A%E5%AE%A2%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E5%92%8C%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E/#undefined
CVE ID: CVE-2023-39593 State: PUBLISHED Published: 2024-10-17T00:00:00 Last Updated: 2024-10-20T23:41:10.199321 Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure permissions in the sys_exec function of MariaDB v10.5 allows authenticated attackers to execute arbitrary commands with elevated privileges. NOTE: this is disputed by the MariaDB Foundation because no privilege boundary is crossed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Ant1sec-ops/CVE-2023-39593 - https://seclists.org/fulldisclosure/2012/Dec/39
CVE ID: CVE-2023-39598 State: PUBLISHED Published: 2023-09-05T00:00:00 Last Updated: 2024-09-30T18:21:44.456Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in IceWarp Corporation WebClient v.10.2.1 allows a remote attacker to execute arbitrary code via a crafted payload to the mid parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://medium.com/%40muthumohanprasath.r/reflected-cross-site-scripting-on-icewarp-webclient-product-cve-2023-39598-9598b92da49c
CVE ID: CVE-2023-39599 State: PUBLISHED Published: 2023-08-22T00:00:00 Last Updated: 2024-12-12T19:43:04.008475Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Scripting (XSS) vulnerability in CSZ CMS v.1.3.0 allows attackers to execute arbitrary code via a crafted payload to the Social Settings parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/desencrypt/CVE/blob/main/CVE-2023-39599/Readme.md
CVE ID: CVE-2023-39600 State: PUBLISHED Published: 2023-08-25T00:00:00 Last Updated: 2024-10-02T17:47:27.789Z Vendors: n/a Products: n/a Problem Types: n/a Description: IceWarp 11.4.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the color parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://medium.com/%40katikitala.sushmitha078/cross-site-scripting-reflected-xss-in-icewarp-server-cve-2023-39600-310a7e1c8817 - https://icewarp.com
CVE ID: CVE-2023-39610 State: PUBLISHED Published: 2023-10-31T00:00:00 Last Updated: 2024-09-12T14:03:12.770Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in TP-Link Tapo C100 v1.1.15 Build 211130 Rel.15378n(4555) and before allows attackers to cause a Denial of Service (DoS) via supplying a crafted web request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zn9988/publications/tree/main/1.TP-Link%20Tapo%20C100%20-%20HTTP%20Denial-Of-Service
CVE ID: CVE-2023-39611 State: PUBLISHED Published: 2024-02-02T00:00:00.000Z Last Updated: 2025-06-16T18:30:49.633Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Software FX Chart FX 7 version 7.0.4962.20829 allows attackers to enumerate and read files from the local filesystem by sending crafted web requests. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://medium.com/%40arielbreisacher/my-chart-fx-7-software-investigation-journey-leading-to-a-directory-traversal-vulnerability-067cdcd3f2e9
CVE ID: CVE-2023-39612 State: PUBLISHED Published: 2023-09-16T00:00:00 Last Updated: 2024-09-25T15:53:08.278Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated attacker to escalate privileges to Administrator via user interaction with a crafted HTML file or URL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/filebrowser/filebrowser/issues/2570 - https://github.com/filebrowser/filebrowser/commit/b508ac3d4f7f0f75d6b49c99bdc661a6d2173f30 - https://febin0x4e4a.wordpress.com/2023/09/15/xss-in-filebrowser-leads-to-admin-account-take
75d6b49c99bdc661a6d2173f30 - https://febin0x4e4a.wordpress.com/2023/09/15/xss-in-filebrowser-leads-to-admin-account-takeover-in-filebrowser/
CVE ID: CVE-2023-39615 State: PUBLISHED Published: 2023-08-29T00:00:00.000Z Last Updated: 2025-11-03T20:35:48.107Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. NOTE: the vendor's position is that the product does not support the legacy SAX1 interface with custom callbacks; there is a crash even without crafted input. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.gnome.org/GNOME/libxml2/-/
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.gnome.org/GNOME/libxml2/-/issues/535
CVE ID: CVE-2023-39616 State: PUBLISHED Published: 2023-08-29T00:00:00 Last Updated: 2024-10-02T13:25:00.253Z Vendors: n/a Products: n/a Problem Types: n/a Description: AOMedia v3.0.0 to v3.5.0 was discovered to contain an invalid read memory access via the component assign_frame_buffer_p in av1/common/av1_common_int.h. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugs.chromium.org/p/aomedia/issues/detail?id=3372#c3
CVE ID: CVE-2023-39617 State: PUBLISHED Published: 2023-08-21T00:00:00 Last Updated: 2024-10-07T16:57:20.022Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK X5000R_V9.1.0cu.2089_B20211224 and X5000R_V9.1.0cu.2350_B20230313 were discovered to contain a remote code execution (RCE) vulnerability via the lang parameter in the setLanguageCfg function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sedate-class-393.notion.site/TOTOlink-ee7eb0d4cd5d43e9983296200371eff1?pvs=4
CVE ID: CVE-2023-39618 State: PUBLISHED Published: 2023-08-21T00:00:00 Last Updated: 2024-10-07T16:51:48.230Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK X5000R B20210419 was discovered to contain a remote code execution (RCE) vulnerability via the setTracerouteCfg interface. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sedate-class-393.notion.site/TOTOlink-3567fd9f93d84afab0d81cd8c063f9a1?pvs=4
CVE ID: CVE-2023-39619 State: PUBLISHED Published: 2023-10-24T00:00:00 Last Updated: 2024-09-11T18:35:32.631Z Vendors: n/a Products: n/a Problem Types: n/a Description: ReDos in NPMJS Node Email Check v.1.0.4 allows an attacker to cause a denial of service via a crafted string to the scpSyntax component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/teomantuncer/node-email-check/blob/main/main.js%2C - https://www.npmjs.com/package/node-email-check - https://gist.github.com/6en6ar/712a4c1eab0324f15e09232c77ea08f8
CVE ID: CVE-2023-39620 State: PUBLISHED Published: 2023-09-08T00:00:00 Last Updated: 2024-09-26T18:02:06.848Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Issue in Buffalo America, Inc. TeraStation NAS TS5410R v.5.00 thru v.0.07 allows a remote attacker to obtain sensitive information via the guest account function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/bcross520/bcross520.github.io/wiki/Buffalo-Terastation-NAS-Disabled-guest-built%E2%80%90in-account-allows-for-SMB%5CRPC-device-enumeration.
CVE ID: CVE-2023-39631 State: PUBLISHED Published: 2023-09-01T00:00:00 Last Updated: 2024-10-01T13:18:38.891Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in LanChain-ai Langchain v.0.0.245 allows a remote attacker to execute arbitrary code via the evaluate function in the numexpr library. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/langchain-ai/langchain/issues/8363 - https://github.com/pydata/numexpr/issues/442
CVE ID: CVE-2023-39637 State: PUBLISHED Published: 2023-09-12T00:00:00 Last Updated: 2024-09-26T16:08:35.329Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-816 A2 1.10 B05 was discovered to contain a command injection vulnerability via the component /goform/Diagnosis. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://d-link.com - https://www.dlink.com/en/security-bulletin/ - http://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DIR-816 - https://github.com/mmmmmx1/dlink/blob/main/DIR-816/readme.md
CVE ID: CVE-2023-39638 State: PUBLISHED Published: 2023-09-14T00:00:00 Last Updated: 2024-09-26T13:11:26.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-LINK DIR-859 A1 1.05 and A1 1.06B01 Beta01 was discovered to contain a command injection vulnerability via the lxmldbc_system function at /htdocs/cgibin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - http://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DIR-859 - https://github.com/mmmmmx1/dlink/blob/main/dir-859/readme.md
CVE ID: CVE-2023-39639 State: PUBLISHED Published: 2023-09-14T00:00:00 Last Updated: 2024-09-25T19:55:21.608Z Vendors: n/a Products: n/a Problem Types: n/a Description: LeoTheme leoblog up to v3.1.2 was discovered to contain a SQL injection vulnerability via the component LeoBlogBlog::getListBlogs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://addons.prestashop.com/fr/2_community-developer?contributor=190902&id_category=3 - https://security.friendsofpresta.org/modules/2023/08/31/leoblog.html
CVE ID: CVE-2023-39640 State: PUBLISHED Published: 2023-09-25T00:00:00 Last Updated: 2024-09-24T17:36:23.391Z Vendors: n/a Products: n/a Problem Types: n/a Description: UpLight cookiebanner before 1.5.1 was discovered to contain a SQL injection vulnerability via the component Hook::getHookModuleExecList(). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.friendsofpresta.org/modules/2023/09/21/cookiebanner.html
CVE ID: CVE-2023-39641 State: PUBLISHED Published: 2023-09-14T00:00:00 Last Updated: 2024-09-25T19:52:40.272Z Vendors: n/a Products: n/a Problem Types: n/a Description: Active Design psaffiliate before v1.9.8 was discovered to contain a SQL injection vulnerability via the component PsaffiliateGetaffiliatesdetailsModuleFrontController::initContent(). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://addons.prestashop.com/fr/referencement-payant-affiliation/26226-full-affiliates.html - https://security.friendsofpresta.org/modules/2023/08/31/psaffiliate.html
CVE ID: CVE-2023-39642 State: PUBLISHED Published: 2023-09-14T00:00:00 Last Updated: 2024-09-25T19:50:59.570Z Vendors: n/a Products: n/a Problem Types: n/a Description: Carts Guru cartsguru up to v2.4.2 was discovered to contain a SQL injection vulnerability via the component CartsGuruCatalogModuleFrontController::display(). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://addons.prestashop.com/fr/remarketing-paniers-abandonnes/22077-carts-guru-marketing-automation-multicanal.html - https://security.friendsofpresta.org/modules/2023/08/29/cartsguru.html
CVE ID: CVE-2023-39643 State: PUBLISHED Published: 2023-09-15T00:00:00 Last Updated: 2024-09-25T19:39:00.234Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bl Modules xmlfeeds before v3.9.8 was discovered to contain a SQL injection vulnerability via the component SearchApiXml::Xmlfeeds(). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://addons.prestashop.com/en/data-import-export/5732-xml-feeds-pro.html - https://security.friendsofpresta.org/modules/2023/08/29/xmlfeeds.html
CVE ID: CVE-2023-39645 State: PUBLISHED Published: 2023-10-03T00:00:00 Last Updated: 2024-09-25T15:55:57.260Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper neutralization of SQL parameter in Theme Volty CMS Payment Icon module for PrestaShop. In the module “Theme Volty CMS Payment Icon” (tvcmspaymenticon) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.friendsofpresta.org/modules/2023/09/26/tvcmspaymenticon.html
CVE ID: CVE-2023-39646 State: PUBLISHED Published: 2023-10-03T00:00:00 Last Updated: 2024-09-20T16:33:41.782Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper neutralization of SQL parameter in Theme Volty CMS Category Chain Slider module for PrestaShop. In the module “Theme Volty CMS Category Chain Slide"(tvcmscategorychainslider) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.friendsofpresta.org/modules/2023/09/26/tvcmscategorychainslider.html
CVE ID: CVE-2023-39647 State: PUBLISHED Published: 2023-10-03T00:00:00 Last Updated: 2024-09-20T16:30:03.089Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper neutralization of SQL parameter in Theme Volty CMS Category Product module for PrestaShop. In the module “Theme Volty CMS Category Product” (tvcmscategoryproduct) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.friendsofpresta.org/modules/2023/09/26/tvcmscategoryproduct.html
CVE ID: CVE-2023-39648 State: PUBLISHED Published: 2023-10-03T00:00:00 Last Updated: 2024-09-20T16:28:22.568Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper neutralization of SQL parameter in Theme Volty CMS Testimonial module for PrestaShop. In the module “Theme Volty CMS Testimonial” (tvcmstestimonial) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.friendsofpresta.org/modules/2023/09/26/tvcmstestimonial.html