Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-23133 State: PUBLISHED Published: 2022-01-13T15:50:41.726Z Last Updated: 2025-11-03T21:45:51.560Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Zabbix Products: Frontend Problem Types: CWE-79 Description: An authenticated user can create a hosts group from the configuration with XSS payload, which will be available for other users. When XSS is stored by an authenticated malicious actor and other users try to search for groups during new host creation, the XSS payload will fire and the actor can steal session cookies and perform session hijacking to impersonate users or take over their accounts. Additional Analyst Notes: - CVE Program Conta
erform session hijacking to impersonate users or take over their accounts. Additional Analyst Notes: - CVE Program Container: References: - https://support.zabbix.com/browse/ZBX-20388 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6SZYHXINBKCY42ITFSNCYE7KCSF33VRA/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VB6W556GVXOKUYTASTDGL3AI7S3SJHX7/
CVE ID: CVE-2022-23134 State: PUBLISHED Published: 2022-01-13T15:50:42.946Z Last Updated: 2025-10-21T23:15:49.129Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Zabbix Products: Frontend Problem Types: CWE-284 Description: After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.zabbix.com/browse/ZBX-20384 - https://lists.fedoraproject.org/archives/list/package-announce
ferences: - https://support.zabbix.com/browse/ZBX-20384 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6SZYHXINBKCY42ITFSNCYE7KCSF33VRA/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VB6W556GVXOKUYTASTDGL3AI7S3SJHX7/ - https://lists.debian.org/debian-lts-announce/2022/02/msg00008.html
CVE ID: CVE-2022-23135 State: PUBLISHED Published: 2022-02-24T18:26:55 Last Updated: 2024-08-03T03:36:19.964Z Vendors: n/a Products: ZXHN F677, ZXHN F477 Problem Types: directory traversal Description: There is a directory traversal vulnerability in some home gateway products of ZTE. Due to the lack of verification of user modified destination path, an attacker with specific permissions could modify the FTP access path to access and modify the system path contents without authorization, which will cause information leak and affect device operation. Additional Analyst Notes: - CVE Program Container: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1023444
CVE ID: CVE-2022-23136 State: PUBLISHED Published: 2022-03-30T16:01:59 Last Updated: 2024-08-03T03:36:19.850Z Vendors: n/a Products: ZXHN F680 Problem Types: stored XSS Description: There is a stored XSS vulnerability in ZTE home gateway product. An attacker could modify the gateway name by inserting special characters and trigger an XSS attack when the user views the current topology of the device through the management page. Additional Analyst Notes: - CVE Program Container: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1024084
CVE ID: CVE-2022-23137 State: PUBLISHED Published: 2022-05-11T15:11:29 Last Updated: 2024-08-03T03:36:19.963Z Vendors: n/a Products: ZXCDN Problem Types: reflective XSS Description: ZTE's ZXCDN product has a reflective XSS vulnerability. The attacker could modify the parameters in the content clearing request url, and when a user clicks the url, an XSS attack will be triggered. Additional Analyst Notes: - CVE Program Container: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1024404
CVE ID: CVE-2022-23138 State: PUBLISHED Published: 2022-06-09T14:34:36 Last Updated: 2024-08-03T03:36:20.025Z Vendors: n/a Products: MF297D Problem Types: cryptographic issues Description: ZTE's MF297D product has cryptographic issues vulnerability. Due to the use of weak random values, the security of the device is reduced, and it may face the risk of attack. Additional Analyst Notes: - CVE Program Container: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1024624
CVE ID: CVE-2022-23139 State: PUBLISHED Published: 2022-05-12T19:26:38 Last Updated: 2024-08-03T03:36:20.000Z Vendors: n/a Products: ZXMP M721 Problem Types: permission and access control Description: ZTE's ZXMP M721 product has a permission and access control vulnerability. Since the folder permission viewed by sftp is 666, which is inconsistent with the actual permission. It’s easy for?users to?ignore the modification?of?the file permission configuration, so that low-authority accounts could actually obtain higher operating permissions on key files. Additional Analyst Notes: - CVE Program Container: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=102444
es: - CVE Program Container: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1024444
CVE ID: CVE-2022-23141 State: PUBLISHED Published: 2022-07-15T14:44:50 Last Updated: 2024-08-03T03:36:19.935Z Vendors: n/a Products: ZXMP M721 Problem Types: information leak Description: ZXMP M721 has an information leak vulnerability. Since the serial port authentication on the ZBOOT interface is not effective although it is enabled, an attacker could use this vulnerability to log in to the device to obtain sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1025264
CVE ID: CVE-2022-23142 State: PUBLISHED Published: 2022-07-18T14:47:32 Last Updated: 2024-08-03T03:36:20.010Z Vendors: n/a Products: ZXEN CG200 Problem Types: DoS Description: ZXEN CG200 has a DoS vulnerability. An attacker could construct and send a large number of HTTP GET requests in a short time, which can make the product management websites not accessible. Additional Analyst Notes: - CVE Program Container: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1025304
CVE ID: CVE-2022-23143 State: PUBLISHED Published: 2022-12-05T00:00:00.000Z Last Updated: 2025-04-23T20:12:00.961Z Vendors: n/a Products: OTCP Problem Types: permission and access control vulnerability Description: ZTE OTCP product is impacted by a permission and access control vulnerability. Due to improper permission settings, an attacker with high permissions could use this vulnerability to maliciously delete and modify files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1026164
CVE ID: CVE-2022-23144 State: PUBLISHED Published: 2022-09-23T14:11:59.000Z Last Updated: 2025-05-22T18:25:58.477Z Vendors: n/a Products: ZXvSTB Problem Types: access control vulnerability Description: There is a broken access control vulnerability in ZTE ZXvSTB product. Due to improper permission control, attackers could use this vulnerability to delete the default application type, which affects normal use of system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1026224
CVE ID: CVE-2022-23155 State: PUBLISHED Published: 2022-04-01T20:00:31.098206Z Last Updated: 2024-09-17T01:05:34.074Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Wyse Management Suite Problem Types: CWE-434 Description: Dell Wyse Management Suite versions 2.0 through 3.5.2 contain an unrestricted file upload vulnerability. A malicious user with admin privileges can exploit this vulnerability in order to execute arbitrary code on the system. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/000195918
CVE ID: CVE-2022-23156 State: PUBLISHED Published: 2022-04-01T20:00:32.496572Z Last Updated: 2024-09-16T18:34:23.852Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Dell Products: Dell Wyse Device Agent Problem Types: Other Description: Wyse Device Agent version 14.6.1.4 and below contain an Improper Authentication vulnerability. A malicious user could potentially exploit this vulnerability by providing invalid input in order to obtain a connection to WMS server. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/000196005
CVE ID: CVE-2022-23157 State: PUBLISHED Published: 2022-04-01T20:00:33.901358Z Last Updated: 2024-09-16T20:16:53.541Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Dell Products: Dell Wyse Device Agent Problem Types: CWE-200 Description: Wyse Device Agent version 14.6.1.4 and below contain a sensitive data exposure vulnerability. A authenticated malicious user could potentially exploit this vulnerability in order to view sensitive information from the WMS Server. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/000196005
CVE ID: CVE-2022-23158 State: PUBLISHED Published: 2022-04-01T20:00:35.187147Z Last Updated: 2024-09-16T19:30:12.465Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Dell Products: Dell Wyse Device Agent Problem Types: CWE-183 Description: Wyse Device Agent version 14.6.1.4 and below contain a sensitive data exposure vulnerability. A local authenticated user with standard privilege could potentially exploit this vulnerability and provide incorrect port information and get connected to valid WMS server Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/000196005
CVE ID: CVE-2022-23159 State: PUBLISHED Published: 2022-04-12T17:50:50.020232Z Last Updated: 2024-09-17T04:14:53.721Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-401 Description: Dell PowerScale OneFS, 8.2.2 - 9.3.0.x, contain a missing release of memory after effective lifetime vulnerability. An authenticated user with ISI_PRIV_LOGIN_SSH and/or ISI_PRIV_LOGIN_CONSOLE and ISI_PRIV_AUTH_PROVIDERS privileges could exploit this vulnerability, leading to a Denial-Of-Service. This can also impact a cluster in Compliance mode. Dell recommends to update at the earliest opportunity. Additional Analyst Notes: - C
mpact a cluster in Compliance mode. Dell recommends to update at the earliest opportunity. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/000196009
CVE ID: CVE-2022-23160 State: PUBLISHED Published: 2022-04-12T17:50:51.380495Z Last Updated: 2024-09-17T02:31:33.499Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-274 Description: Dell PowerScale OneFS, versions 8.2.0-9.3.0, contains an Improper Handling of Insufficient Permissions vulnerability. An remote malicious user could potentially exploit this vulnerability, leading to gaining write permissions on read-only files. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/000196009
CVE ID: CVE-2022-23161 State: PUBLISHED Published: 2022-04-12T17:50:52.871019Z Last Updated: 2024-09-16T19:26:03.465Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-755 Description: Dell PowerScale OneFS versions 8.2.x - 9.3.0.x contain a denial-of-service vulnerability in SmartConnect. An unprivileged network attacker may potentially exploit this vulnerability, leading to denial-of-service. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/000196009
CVE ID: CVE-2022-23162 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2022-23163 State: PUBLISHED Published: 2022-04-12T17:50:54.451707Z Last Updated: 2024-09-17T02:51:27.645Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-379 Description: Dell PowerScale OneFS, 8.2,x, 9.1.0.x, 9.2.1.x, and 9.3.0.x contain a denial of service vulnerability. A local malicious user could potentially exploit this vulnerability, leading to denial of service/data unavailability. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/000196009
CVE ID: CVE-2022-23164 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2022-23165 State: PUBLISHED Published: 2022-05-12T19:49:18.469085Z Last Updated: 2024-09-16T17:59:45.128Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L) Vendors: SysAid Products: Sysaid Problem Types: CWE-79 Description: Sysaid – Sysaid 14.2.0 Reflected Cross-Site Scripting (XSS) - The parameter "helpPageName" used by the page "/help/treecontent.jsp" suffers from a Reflected Cross-Site Scripting vulnerability. For an attacker to exploit this Cross-Site Scripting vulnerability, it's necessary for the affected product to expose the Offline Help Pages. An attacker may gain access to sensitive information or execute client-side code in the browser session of
e Help Pages. An attacker may gain access to sensitive information or execute client-side code in the browser session of the victim user. Furthermore, an attacker would require the victim to open a malicious link. An attacker may exploit this vulnerability in order to perform phishing attacks. The attacker can receive sensitive data like server details, usernames, workstations, etc. He can also perform actions such as uploading files, deleting calls from the system Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/departments/faq/cve_advisories
CVE ID: CVE-2022-23166 State: PUBLISHED Published: 2022-05-12T19:49:52.719777Z Last Updated: 2024-09-16T22:24:47.336Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L) Vendors: SysAid Products: Sysaid Problem Types: Local File Inclusion Description: Sysaid – Sysaid Local File Inclusion (LFI) – An unauthenticated attacker can access to the system by accessing to "/lib/tinymce/examples/index.html" path. in the "Insert/Edit Embedded Media" window Choose Type : iFrame and File/URL : [here is the LFI] Solution: Update to 22.2.20 cloud version, or to 22.1.64 on premise version. Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/departments
4 on premise version. Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/departments/faq/cve_advisories
CVE ID: CVE-2022-23167 State: PUBLISHED Published: 2022-06-13T16:11:55.489250Z Last Updated: 2024-09-16T19:46:32.481Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Amodat Products: Amodat Problem Types: Local File Inclusion Description: Attacker crafts a GET request to: /mobile/downloadfile.aspx? Filename =../.. /windows/boot.ini the LFI is UNAUTHENTICATED. Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/departments/faq/cve_advisories
CVE ID: CVE-2022-23168 State: PUBLISHED Published: 2022-06-13T16:12:36.414232Z Last Updated: 2024-09-16T19:55:53.065Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Amodat Products: Amodat Problem Types: CWE-89 Description: The attacker could get access to the database. The SQL injection is in the username parameter at the login panel: username: admin'-- Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/departments/faq/cve_advisories
CVE ID: CVE-2022-23169 State: PUBLISHED Published: 2022-06-13T16:13:31.959669Z Last Updated: 2024-09-17T01:30:44.389Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Amodat Products: Amodat Problem Types: CWE-89 Description: attacker needs to craft a SQL payload. the vulnerable parameter is "agentid" must be authenticated to the admin panel. Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/departments/faq/cve_advisories
CVE ID: CVE-2022-23170 State: PUBLISHED Published: 2022-06-24T15:00:10.798009Z Last Updated: 2024-09-16T19:24:37.500Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Sysaid Products: SysAid - Okta SSO integration Problem Types: CWE-611 Description: SysAid - Okta SSO integration - was found vulnerable to XML External Entity Injection vulnerability. Any SysAid environment that uses the Okta SSO integration might be vulnerable. An unauthenticated attacker could exploit the XXE vulnerability by sending a malformed POST request to the identity provider endpoint. An attacker can extract the identity provider endpoint by decoding the SAMLRequest parameter's value a
rovider endpoint. An attacker can extract the identity provider endpoint by decoding the SAMLRequest parameter's value and searching for the AssertionConsumerServiceURL parameter's value. It often allows an attacker to view files on the application server filesystem and interact with any back-end or external systems that the application can access. In some situations, an attacker can escalate an XXE attack to compromise the underlying server or other back-end infrastructure by leveraging the XXE vulnerability to perform server-side request forgery (SSRF) attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/departments/faq/cve_advisories
CVE ID: CVE-2022-23171 State: PUBLISHED Published: 2022-06-21T14:23:39.894529Z Last Updated: 2024-09-17T04:04:36.921Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: AtlasVPN Products: AtlasVPN Problem Types: Privilege Escalation Description: AtlasVPN - Privilege Escalation Lack of proper security controls on named pipe messages can allow an attacker with low privileges to send a malicious payload and gain SYSTEM permissions on a windows computer where the AtlasVPN client is installed. Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/departments/faq/cve_advisories
CVE ID: CVE-2022-23172 State: PUBLISHED Published: 2022-07-06T13:11:31.992137Z Last Updated: 2024-09-16T17:23:25.336Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Priority Products: Priority Problem Types: User Enumeration Description: An attacker can access to "Forgot my password" button, as soon as he puts users is valid in the system, the system would issue a message that a password reset email had been sent to user. This way you can verify which users are in the system and which are not. Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/departments/faq/cve_advisories
CVE ID: CVE-2022-23173 State: PUBLISHED Published: 2022-07-06T13:11:59.625047Z Last Updated: 2024-09-16T19:11:05.717Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Priority Products: Priority web Problem Types: Insecure direct object references (IDOR) Description: this vulnerability affect user that even not allowed to access via the web interface. First of all, the attacker needs to access the "Login menu - demo site" then he can see in this menu all the functionality of the application. If the attacker will try to click on one of the links, he will get an answer that he is not authorized because he needs to log in with credentials. after he performed log
nks, he will get an answer that he is not authorized because he needs to log in with credentials. after he performed log in to the system there are some functionalities that the specific user is not allowed to perform because he was configured with low privileges however all the attacker need to do in order to achieve his goals is to change the value of the prog step parameter from 0 to 1 or more and then the attacker could access to some of the functionality the web application that he couldn't perform it before the parameter changed. Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2022-23176 State: PUBLISHED Published: 2022-02-24T00:52:48.000Z Last Updated: 2025-10-21T23:15:45.629Z Vendors: n/a Products: n/a Problem Types: n/a Description: WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access. This vulnerability impacts Fireware OS before 12.7.2_U1, 12.x before 12.1.3_U3, and 12.2.x through 12.5.x before 12.5.7_U3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securityportal.watchguard.com - https://www.watchguard.com/support/release-notes/fireware/12/en-US/EN_ReleaseNotes_Fireware
urityportal.watchguard.com - https://www.watchguard.com/support/release-notes/fireware/12/en-US/EN_ReleaseNotes_Fireware_12_7/index.html#Fireware/en-US/resolved_issues.html - https://www.watchguard.com/support/release-notes/fireware/12/en-US/EN_ReleaseNotes_Fireware_12_7_2/index.html#Fireware/en-US/resolved_issues.html - https://www.watchguard.com/support/release-notes/fireware/12/en-US/EN_ReleaseNotes_Fireware_12_1_3_U7/index.html#Fireware/en-US/resolved_issues.html - https://arstechnica.com/information-technology/2022/04/watchguard-failed-to-disclose-critical-flaw-exploited-by-russian-hackers/
CVE ID: CVE-2022-23178 State: PUBLISHED Published: 2022-01-15T14:40:25 Last Updated: 2024-08-03T03:36:20.055Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices. When the administrative web interface of the HDMI switcher is accessed unauthenticated, user credentials are disclosed that are valid to authenticate to the web interface. Specifically, aj.html sends a JSON document with uname and upassword fields. Additional Analyst Notes: - CVE Program Container: References: - https://www.redteam-pentesting.de/advisories/rt-sa-2021-009
CVE ID: CVE-2022-23179 State: PUBLISHED Published: 2024-01-16T15:52:09.488Z Last Updated: 2025-05-09T16:01:44.712Z Vendors: Unknown Products: Contact Form & Lead Form Elementor Builder Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.7.0 does not escape some of its form fields before outputting them in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/90b8af99-e4a1-4076-99fa-efe805dd4be4/
CVE ID: CVE-2022-23180 State: PUBLISHED Published: 2024-01-16T15:52:09.047Z Last Updated: 2025-06-16T18:03:39.592Z Vendors: Unknown Products: Contact Form & Lead Form Elementor Builder Problem Types: CWE-862 Missing Authorization Description: The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.7.4 doesn't have authorisation and nonce checks, which could allow any authenticated users, such as subscriber to update and change various settings Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/da87358a-3a72-4cf7-a2af-a266dd9b4290/ - https://plugins.trac.wordpress.org/changeset/2670484