Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
https://lists.debian.org/debian-lts-announce/2023/09/msg00015.html - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WHOLML7N2G5KCAZXFWC5IDFFHSQS5SDB/ - https://www.debian.org/security/2023/dsa-5498 - https://security.gentoo.org/glsa/202309-05 - https://lists.debian.org/debian-lts-announce/2023/09/msg00016.html - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/ - https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway/ - https://github.com/webmproject/libwebp/releases/tag/v1.3.2 - https://lists.debian.org/debian-lts-announce/2023/09/msg00017.html - https://lists.f
oject/libwebp/releases/tag/v1.3.2 - https://lists.debian.org/debian-lts-announce/2023/09/msg00017.html - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/ - http://www.openwall.com/lists/oss-security/2023/09/21/4 - https://blog.isosceles.com/the-webp-0day/ - http://www.openwall.com/lists/oss-security/2023/09/22/1 - http://www.openwall.com/lists/oss-security/2023/09/22/3 - http://www.openwall.com/lists/oss-security/2023/09/22/4 - http://www.openwall.com/lists/oss-security/2023/09/22/5 - http://www.openwall.com/lists/oss-security/2023/09/22/8 - http://www.openwall.com/lists/oss-security/2023/09/22/7 - http://www.ope
.openwall.com/lists/oss-security/2023/09/22/8 - http://www.openwall.com/lists/oss-security/2023/09/22/7 - http://www.openwall.com/lists/oss-security/2023/09/22/6 - http://www.openwall.com/lists/oss-security/2023/09/26/1 - http://www.openwall.com/lists/oss-security/2023/09/26/7 - http://www.openwall.com/lists/oss-security/2023/09/28/1 - http://www.openwall.com/lists/oss-security/2023/09/28/2 - http://www.openwall.com/lists/oss-security/2023/09/28/4 - https://security.netapp.com/advisory/ntap-20230929-0011/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/ - https://sethmlarson.dev/security-developer-in-residence-
s.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/ - https://sethmlarson.dev/security-developer-in-residence-weekly-report-16 - https://www.bentley.com/advisories/be-2023-0001/ - https://security.gentoo.org/glsa/202401-10
CVE ID: CVE-2023-4864 State: PUBLISHED Published: 2023-09-09T21:00:07.871Z Last Updated: 2024-08-02T07:38:00.767Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Take-Note App Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in SourceCodester Take-Note App 1.0. This affects an unknown part of the file index.php. The manipulation of the argument noteContent with the input <script>alert('xss')</script> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-239349 was assigned to this vulnerability. Additio
has been disclosed to the public and may be used. The identifier VDB-239349 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.239349 - https://vuldb.com/?ctiid.239349 - https://skypoc.wordpress.com/2023/09/05/sourcecodester-take-note-app-v1-0-has-multiple-vulnerabilities/
CVE ID: CVE-2023-4865 State: PUBLISHED Published: 2023-09-09T22:00:10.264Z Last Updated: 2024-08-02T07:38:00.743Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: SourceCodester Products: Take-Note App Problem Types: CWE-352 Description: A vulnerability has been found in SourceCodester Take-Note App 1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-239350 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://
o this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.239350 - https://vuldb.com/?ctiid.239350 - https://skypoc.wordpress.com/2023/09/05/sourcecodester-take-note-app-v1-0-has-multiple-vulnerabilities/
CVE ID: CVE-2023-4866 State: PUBLISHED Published: 2023-09-09T23:00:09.821Z Last Updated: 2024-08-02T07:38:00.855Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Tours & Travels Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0 and classified as critical. This issue affects the function exec of the file booking.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-239351. Additional Analyst Not
sed to the public and may be used. The associated identifier of this vulnerability is VDB-239351. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.239351 - https://vuldb.com/?ctiid.239351 - https://blog.csdn.net/weixin_43864034/article/details/132697070
CVE ID: CVE-2023-4867 State: PUBLISHED Published: 2023-09-10T00:00:16.942Z Last Updated: 2024-08-02T07:38:00.743Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Xintian Products: Smart Table Integrated Management System Problem Types: CWE-89 Description: A vulnerability was found in Xintian Smart Table Integrated Management System 5.6.9. It has been classified as critical. Affected is an unknown function of the file /SysManage/AddUpdateSites.aspx of the component Added Site Page. The manipulation of the argument TbxSiteName leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this v
le to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-239352. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.239352 - https://vuldb.com/?ctiid.239352 - https://github.com/fortunate888/cve/blob/main/sql_inject_1.md
CVE ID: CVE-2023-4868 State: PUBLISHED Published: 2023-09-10T00:31:05.346Z Last Updated: 2024-09-26T15:16:14.316Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: SourceCodester Products: Contact Manager App Problem Types: CWE-352 Description: A vulnerability was found in SourceCodester Contact Manager App 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file add.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-239353 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Conta
may be used. The identifier VDB-239353 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.239353 - https://vuldb.com/?ctiid.239353 - https://skypoc.wordpress.com/2023/09/05/vuln1/
CVE ID: CVE-2023-4869 State: PUBLISHED Published: 2023-09-10T01:00:08.632Z Last Updated: 2024-09-26T15:18:52.535Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: SourceCodester Products: Contact Manager App Problem Types: CWE-352 Description: A vulnerability was found in SourceCodester Contact Manager App 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file update.php. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-239354 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: -
used. VDB-239354 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.239354 - https://vuldb.com/?ctiid.239354 - https://skypoc.wordpress.com/2023/09/05/vuln1/
CVE ID: CVE-2023-4870 State: PUBLISHED Published: 2023-09-10T01:31:05.962Z Last Updated: 2025-06-25T13:46:55.941Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Contact Manager App Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in SourceCodester Contact Manager App 1.0. This affects an unknown part of the file index.php of the component Contact Information Handler. The manipulation of the argument contactID with the input "><sCrIpT>alert(1)</ScRiPt> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifi
e to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-239355. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.239355 - https://vuldb.com/?ctiid.239355 - https://skypoc.wordpress.com/2023/09/05/vuln1/
CVE ID: CVE-2023-4871 State: PUBLISHED Published: 2023-09-10T02:00:12.274Z Last Updated: 2024-09-26T15:19:37.428Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Contact Manager App Problem Types: CWE-89 Description: A vulnerability classified as critical was found in SourceCodester Contact Manager App 1.0. This vulnerability affects unknown code of the file delete.php. The manipulation of the argument contact/contactName leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-239356. Additional Analyst Notes: - CVE Program Container: - CISA AD
e used. The identifier of this vulnerability is VDB-239356. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.239356 - https://vuldb.com/?ctiid.239356 - https://skypoc.wordpress.com/2023/09/05/vuln1/
CVE ID: CVE-2023-4872 State: PUBLISHED Published: 2023-09-10T02:31:05.610Z Last Updated: 2024-09-26T15:20:27.296Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Contact Manager App Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in SourceCodester Contact Manager App 1.0. This issue affects some unknown processing of the file add.php. The manipulation of the argument contact/contactName leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-239357 was assigned to this vulnerability. Additional Analyst Notes: - CVE P
public and may be used. The identifier VDB-239357 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.239357 - https://vuldb.com/?ctiid.239357 - https://skypoc.wordpress.com/2023/09/05/vuln1/
CVE ID: CVE-2023-4873 State: PUBLISHED Published: 2023-09-10T03:00:07.290Z Last Updated: 2025-06-25T13:45:14.374Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Byzoro Products: Smart S45F Multi-Service Secure Gateway Intelligent Management Platform Problem Types: CWE-78 Description: A vulnerability, which was classified as critical, was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230906. Affected is an unknown function of the file /importexport.php. The manipulation of the argument sql leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB
jection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-239358 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.239358 - https://vuldb.com/?ctiid.239358 - https://vuldb.com/?submit.204279 - https://github.com/cugerQDHJ/cve/blob/main/rce.md
CVE ID: CVE-2023-4874 State: PUBLISHED Published: 2023-09-09T14:30:29.741Z Last Updated: 2024-08-30T15:16:17.679Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: Mutt Products: Mutt Problem Types: CWE-475 Description: Null pointer dereference when viewing a specially crafted email in Mutt >1.5.2 <2.2.12 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/muttmua/mutt/-/commit/452ee330e094bfc7c9a68555e5152b1826534555.patch - https://gitlab.com/muttmua/mutt/-/commit/a4752eb0ae0a521eec02e59e51ae5daedf74fda0.patch
CVE ID: CVE-2023-4875 State: PUBLISHED Published: 2023-09-09T14:30:24.864Z Last Updated: 2024-08-30T15:14:47.158Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: Mutt Products: Mutt Problem Types: CWE-475 Description: Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/muttmua/mutt/-/commit/452ee330e094bfc7c9a68555e5152b1826534555.patch - https://gitlab.com/muttmua/mutt/-/commit/4cc3128abdf52c615911589394a03271fddeefc6.patch
CVE ID: CVE-2023-4876 State: PUBLISHED Published: 2023-09-10T00:00:19.240Z Last Updated: 2024-09-26T16:00:35.540Z Severity: HIGH (CVSS 7.9 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N) Vendors: hamza417 Products: hamza417/inure Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository hamza417/inure prior to build92. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/f729d2c8-a62e-4f30-ac24-e187b0a7892a - https://github.com/hamza417/inure/commit/7db5511753089c3cf477475f1f3b62a6e6ede4a8
CVE ID: CVE-2023-4877 State: PUBLISHED Published: 2023-09-10T00:00:42.399Z Last Updated: 2024-09-26T15:12:44.643Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: hamza417 Products: hamza417/inure Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository hamza417/inure prior to build92. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/168e9299-f8ff-40d6-9def-d097b38bad84 - https://github.com/hamza417/inure/commit/09762e8c059be5983ca55e6424b2b5992fa740e7
CVE ID: CVE-2023-4878 State: PUBLISHED Published: 2023-09-10T17:49:08.351Z Last Updated: 2024-09-26T15:25:50.573Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: instantsoft Products: instantsoft/icms2 Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) in GitHub repository instantsoft/icms2 prior to 2.16.1-git. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/655c4f77-04b2-4220-bfaf-a4d99fe86703 - https://github.com/instantsoft/icms2/commit/d0aeeaf5979fbdbf80dc3a3227d6c58442ab7487
CVE ID: CVE-2023-4879 State: PUBLISHED Published: 2023-09-10T17:53:35.787Z Last Updated: 2024-09-26T15:32:29.131Z Severity: LOW (CVSS 3.5 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:L) Vendors: instantsoft Products: instantsoft/icms2 Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1.-git. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/7df6b167-3c39-4563-9b8a-33613e25cf27 - https://github.com/instantsoft/icms2/commit/d0aeeaf5979fbdbf80dc3a3227d6c58442ab7487
CVE ID: CVE-2023-4881 State: REJECTED Published: 2023-09-11T16:35:56.435Z Last Updated: 2023-09-20T17:36:50.978Z Description: No description available.
CVE ID: CVE-2023-4882 State: PUBLISHED Published: 2023-10-03T14:39:42.309Z Last Updated: 2024-09-19T19:57:12.564Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Open5GS Products: Open5GS Problem Types: CWE-404 Description: DOS vulnerability that could allow an attacker to register a new VNF (Virtual Network Function) value. This action could trigger the args_assets() function defined in the arg-log.php file, which would then execute the args-abort.c file, causing the service to crash. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-open5gs
CVE ID: CVE-2023-4883 State: PUBLISHED Published: 2023-10-03T14:42:39.673Z Last Updated: 2024-09-19T19:56:28.473Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Open5GS Products: Open5GS Problem Types: CWE-763 Description: Invalid pointer release vulnerability. Exploitation of this vulnerability could allow an attacker to interrupt the correct operation of the service by sending a specially crafted json string to the VNF (Virtual Network Function), and triggering the ogs_sbi_message_free function, which could cause a service outage. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/n
al Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-open5gs
CVE ID: CVE-2023-4884 State: PUBLISHED Published: 2023-10-03T14:46:57.814Z Last Updated: 2024-09-19T19:55:50.558Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: Open5GS Products: Open5GS Problem Types: CWE-306 Description: An attacker could send an HTTP request to an Open5GS endpoint and retrieve the information stored on the device due to the lack of Authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-open5gs
CVE ID: CVE-2023-4885 State: PUBLISHED Published: 2023-10-03T14:50:46.450Z Last Updated: 2024-09-19T19:55:13.495Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Open5GS Products: Open5GS Problem Types: CWE-300 Description: Man in the Middle vulnerability, which could allow an attacker to intercept VNF (Virtual Network Function) communications resulting in the exposure of sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-open5gs
CVE ID: CVE-2023-4886 State: PUBLISHED Published: 2023-10-03T14:24:56.342Z Last Updated: 2025-11-20T17:56:04.968Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Satellite 6.13 for RHEL 8, Red Hat Satellite 6.14 for RHEL 8 Problem Types: CWE-200 Description: A sensitive information exposure vulnerability was found in foreman. Contents of tomcat's server.xml file, which contain passwords to candlepin's keystore and truststore, were found to be world readable. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2023:7851 - https://access.redhat.com/errata/RHSA
ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2023:7851 - https://access.redhat.com/errata/RHSA-2024:1061 - https://access.redhat.com/security/cve/CVE-2023-4886 - https://bugzilla.redhat.com/show_bug.cgi?id=2230135
CVE ID: CVE-2023-4887 State: PUBLISHED Published: 2023-09-12T01:52:13.896Z Last Updated: 2025-02-05T19:29:44.898Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themeisle Products: Google Maps Plugin by Intergeo Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Google Maps Plugin by Intergeo for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'intergeo' shortcode in versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contribut
ation and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cb6d11ad-0983-4a4b-b52b-824eae8b8e3c?source=cve - https://plugins.trac.wordpress.org/browser/intergeo-maps/tags/2.3.2/index.php#L1146
CVE ID: CVE-2023-4888 State: PUBLISHED Published: 2023-11-07T11:31:09.768Z Last Updated: 2025-02-05T18:48:48.396Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: fornyhucker Products: Simple Like Page Plugin Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Simple Like Page Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sfp-page-plugin' shortcode in versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above
caping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f81df26f-4390-4626-8539-367a52f8a027?source=cve - https://plugins.trac.wordpress.org/browser/simple-facebook-plugin/trunk/views/view-page-plugin.php?rev=2083359#L37 - https://plugins.trac.wordpress.org/browser/simple-facebook-plugin/trunk/views/view-page-plugin.php?rev=2083359#L38 - https://plugins.trac.wordpress.org
org/browser/simple-facebook-plugin/trunk/views/view-page-plugin.php?rev=2083359#L38 - https://plugins.trac.wordpress.org/browser/simple-facebook-plugin/trunk/views/view-page-plugin.php?rev=2083359#L39 - https://plugins.trac.wordpress.org/changeset/2988694/simple-facebook-plugin#file17
CVE ID: CVE-2023-4889 State: PUBLISHED Published: 2023-11-15T06:40:47.202Z Last Updated: 2024-08-02T07:38:00.854Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: shareaholic Products: Professional Social Sharing Buttons, Icons & Related Posts – Shareaholic Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Shareaholic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'shareaholic' shortcode in versions up to, and including, 9.7.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers
input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ff6932c6-f3ec-46a8-a03b-95512eee5bf1?source=cve - https://plugins.trac.wordpress.org/changeset/2995413/shareaholic#file51