Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-4080 State: REJECTED Published: N/A Last Updated: 2022-11-20T00:00:00 Description: No description available.
CVE ID: CVE-2022-4081 State: REJECTED Published: N/A Last Updated: 2022-11-20T00:00:00 Description: No description available.
CVE ID: CVE-2022-4082 State: REJECTED Published: N/A Last Updated: 2022-11-20T00:00:00 Description: No description available.
CVE ID: CVE-2022-4083 State: REJECTED Published: N/A Last Updated: 2022-11-20T00:00:00 Description: No description available.
CVE ID: CVE-2022-4084 State: REJECTED Published: N/A Last Updated: 2022-11-20T00:00:00 Description: No description available.
CVE ID: CVE-2022-4085 State: REJECTED Published: N/A Last Updated: 2022-11-20T00:00:00 Description: No description available.
CVE ID: CVE-2022-4086 State: REJECTED Published: N/A Last Updated: 2022-11-20T00:00:00 Description: No description available.
CVE ID: CVE-2022-4087 State: PUBLISHED Published: 2022-11-21T00:00:00.000Z Last Updated: 2025-04-15T13:12:13.009Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: unspecified Products: iPXE Problem Types: CWE-284 Description: A vulnerability was found in iPXE. It has been declared as problematic. This vulnerability affects the function tls_new_ciphertext of the file src/net/tls.c of the component TLS. The manipulation of the argument pad_len leads to information exposure through discrepancy. The name of the patch is 186306d6199096b7a7c4b4574d4be8cdb8426729. It is recommended to apply a patch to fix this issue. VDB-214054 is the identifier assigned to this vulner
e8cdb8426729. It is recommended to apply a patch to fix this issue. VDB-214054 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ipxe/ipxe/commit/186306d6199096b7a7c4b4574d4be8cdb8426729 - https://vuldb.com/?id.214054
CVE ID: CVE-2022-4088 State: PUBLISHED Published: 2022-11-24T00:00:00.000Z Last Updated: 2025-04-14T15:55:40.339Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: rickxy Products: Stock Management System Problem Types: CWE-707 Description: A vulnerability was found in rickxy Stock Management System and classified as critical. Affected by this issue is some unknown functionality of the file /pages/processlogin.php. The manipulation of the argument user/password leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-214322 is the identifier assigned to this vulnerability. Additional Analyst N
sclosed to the public and may be used. VDB-214322 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/rickxy/Stock-Management-System/issues/2 - https://vuldb.com/?id.214322
CVE ID: CVE-2022-4089 State: PUBLISHED Published: 2022-11-24T00:00:00.000Z Last Updated: 2025-04-15T13:12:03.888Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: rickxy Products: Stock Management System Problem Types: CWE-707 Description: A vulnerability was found in rickxy Stock Management System. It has been declared as problematic. This vulnerability affects unknown code of the file /pages/processlogin.php. The manipulation of the argument user leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-214324. Additional Analyst Notes: - CVE
losed to the public and may be used. The identifier of this vulnerability is VDB-214324. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/rickxy/Stock-Management-System/issues/3 - https://vuldb.com/?id.214324
CVE ID: CVE-2022-4090 State: PUBLISHED Published: 2022-11-24T00:00:00.000Z Last Updated: 2025-04-15T13:11:53.318Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: rickxy Products: Stock Management System Problem Types: CWE-863 Description: A vulnerability was found in rickxy Stock Management System and classified as problematic. This issue affects some unknown processing of the file us_transac.php?action=add. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-214331. Additional Analyst Notes: - CVE Progr
ic and may be used. The associated identifier of this vulnerability is VDB-214331. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/rickxy/Stock-Management-System/issues/4 - https://vuldb.com/?id.214331
CVE ID: CVE-2022-4091 State: PUBLISHED Published: 2022-11-25T00:00:00.000Z Last Updated: 2025-04-15T13:11:44.761Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: SourceCodester Products: Canteen Management System Problem Types: CWE-707 Description: A vulnerability was found in SourceCodester Canteen Management System. It has been classified as problematic. This affects the function query of the file food.php. The manipulation of the argument product_name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-214359. Additi
has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-214359. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jianshu.com/p/e977cda45d3c?v=1669360616628 - https://vuldb.com/?id.214359
CVE ID: CVE-2022-4092 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-01T17:36:33.623Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper enforcement of message or data structure in GitLab Description: An issue has been discovered in GitLab EE affecting all versions starting from 15.6 before 15.6.1. It was possible to create a malicious README page due to improper neutralisation of user supplied input. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/383208 - https://hackerone.com/reports/1777934 - htt
chment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/383208 - https://hackerone.com/reports/1777934 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4092.json
CVE ID: CVE-2022-4093 State: PUBLISHED Published: 2022-11-21T00:00:00.000Z Last Updated: 2025-04-14T18:16:35.525Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: dolibarr Products: dolibarr/dolibarr Problem Types: CWE-89 Description: SQL injection attacks can result in unauthorized access to sensitive data, such as passwords, credit card details, or personal user information. Many high-profile data breaches in recent years have been the result of SQL injection attacks, leading to reputational damage and regulatory fines. In some cases, an attacker can obtain a persistent backdoor into an organization's systems, leading to a long-term compromise that can go unn
acker can obtain a persistent backdoor into an organization's systems, leading to a long-term compromise that can go unnoticed for an extended period. This affect 16.0.1 and 16.0.2 only. 16.0.0 or lower, and 16.0.3 or higher are not affected Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/677ca8ee-ffbc-4b39-b294-2ce81bd56788 - https://github.com/dolibarr/dolibarr/commit/7c1eac9774bd1fed0b7b4594159f2ac2d12a4011
CVE ID: CVE-2022-4095 State: PUBLISHED Published: 2023-03-22T00:00:00.000Z Last Updated: 2025-02-26T16:10:49.660Z Vendors: n/a Products: Kernel Problem Types: CWE-416 Description: A use-after-free flaw was found in Linux kernel before 5.19.2. This issue occurs in cmd_hdl_filter in drivers/staging/rtl8712/rtl8712_cmd.c, allowing an attacker to launch a local denial of service attack and gain escalation of privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c53b3dcb9942b8ed7f81ee3921c4085d87070c73 - https://security.netapp.com/advisory/ntap-20230420-0005/
CVE ID: CVE-2022-4096 State: PUBLISHED Published: 2022-11-21T00:00:00.000Z Last Updated: 2025-04-14T18:16:48.161Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: appsmithorg Products: appsmithorg/appsmith Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) in GitHub repository appsmithorg/appsmith prior to 1.8.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/7969e834-5982-456e-9683-861a7a5e2d22 - https://github.com/appsmithorg/appsmith/commit/769719ccfe667f059fe0b107a19ec9feb90f2e40
CVE ID: CVE-2022-4097 State: PUBLISHED Published: 2022-12-12T17:54:35.126Z Last Updated: 2025-04-14T18:38:47.786Z Vendors: Unknown Products: All-In-One Security (AIOS) Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The All-In-One Security (AIOS) WordPress plugin before 5.0.8 is susceptible to IP Spoofing attacks, which can lead to bypassed security features (like IP blocks, rate limiting, brute force protection, and more). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/15819d33-7497-4f7d-bbb8-b3ab147806c4
CVE ID: CVE-2022-4098 State: PUBLISHED Published: 2022-12-13T07:26:17.752Z Last Updated: 2025-04-14T18:12:33.668Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Wiesemann & Theis Products: Com-Server ++, Com-Server 20mA, Com-Server Highspeed 100BaseFX, Com-Server Highspeed 100BaseLX, Com-Server Highspeed 19" 1Port, Com-Server Highspeed 19" 4Port, Com-Server Highspeed Compact, Com-Server Highspeed Industry, Com-Server Highspeed Isolated, Com-Server Highspeed OEM, Com-Server Highspeed Office 1 Port, Com-Server Highspeed Office 4 Port, Com-Server Highspeed PoE, Com-Server LC, Com-Server PoE 3 x Isolated, Com-Server UL Problem Types: CWE-290 Description: Multiple W
Highspeed PoE, Com-Server LC, Com-Server PoE 3 x Isolated, Com-Server UL Problem Types: CWE-290 Description: Multiple Wiesemann&Theis products of the ComServer Series are prone to an authentication bypass through IP spoofing. After a user logged in to the WBM of the Com-Server an unauthenticated attacker in the same subnet can obtain the session ID and through IP spoofing change arbitrary settings by crafting modified HTTP Get requests. This may result in a complete takeover of the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2022-057/
CVE ID: CVE-2022-4099 State: PUBLISHED Published: 2023-01-02T21:49:32.669Z Last Updated: 2025-04-10T18:39:36.591Z Vendors: Unknown Products: Joy Of Text Lite Problem Types: CWE-89 SQL Injection Description: The Joy Of Text Lite WordPress plugin before 2.3.1 does not properly sanitise and escape some parameters before using them in SQL statements accessible to unauthenticated users, leading to unauthenticated SQL injection Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a282dd39-926d-406b-b8f5-e4c6e0c2c028
CVE ID: CVE-2022-4100 State: PUBLISHED Published: 2024-08-31T08:35:05.543Z Last Updated: 2024-09-03T14:25:08.791Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: gioni Products: WP Cerber Security, Anti-spam & Malware Scan Problem Types: CWE-693 Description: The WP Cerber Security plugin for WordPress is vulnerable to IP Protection bypass in versions up to, and including 9.4 due to the plugin improperly checking for a visitor's IP address. This makes it possible for an attacker whose IP address has been blocked to bypass this control by setting the X-Forwarded-For: HTTP header to an IP Address that hasn't been blocked. Additional Analyst Notes: - CISA ADP Vu
ting the X-Forwarded-For: HTTP header to an IP Address that hasn't been blocked. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/03ccd474-42f4-4cbb-823e-93fe4db1bf80?source=cve - https://plugins.trac.wordpress.org/changeset/2865322/wp-cerber/trunk/cerber-common.php
CVE ID: CVE-2022-4101 State: PUBLISHED Published: 2023-01-16T15:37:49.606Z Last Updated: 2025-04-04T18:24:43.550Z Vendors: Unknown Products: Images Optimize and Upload CF7 Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The Images Optimize and Upload CF7 WordPress plugin through 2.1.4 does not validate the file to be deleted via an AJAX action available to unauthenticated users, which could allow them to delete arbitrary files on the server via path traversal attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2ce4c837-c62c-41ac-95ca-54bb1a6d1eeb
CVE ID: CVE-2022-4102 State: PUBLISHED Published: 2023-01-09T22:13:40.870Z Last Updated: 2025-04-09T18:45:38.670Z Vendors: Unknown Products: Royal Elementor Addons (Elementor Templates, Post Grid, Mega Menu & Header Footer Builder, WooCommerce Builder, Product Grid, Slider, Parallax Image & other Free Elementor Widgets) Problem Types: CWE-862 Missing Authorization, CWE-352 Cross-Site Request Forgery (CSRF) Description: The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorization and CSRF checks when deleting a template and does not ensure that the post to be deleted is a template. This could allow any authenticated users, such as subscribers, to delete arbitrary post
ost to be deleted is a template. This could allow any authenticated users, such as subscribers, to delete arbitrary posts assuming they know the related slug. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c177f763-0bb5-4734-ba2e-7ba816578937
CVE ID: CVE-2022-4103 State: PUBLISHED Published: 2023-01-09T22:13:38.512Z Last Updated: 2025-04-09T14:05:43.792Z Vendors: Unknown Products: Royal Elementor Addons (Elementor Templates, Post Grid, Mega Menu & Header Footer Builder, WooCommerce Builder, Product Grid, Slider, Parallax Image & other Free Elementor Widgets) Problem Types: CWE-862 Missing Authorization, CWE-352 Cross-Site Request Forgery (CSRF) Description: The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorisation and CSRF checks when creating a template, and does not ensure that the post created is a template. This could allow any authenticated users, such as subscriber to create a post (as well as an
post created is a template. This could allow any authenticated users, such as subscriber to create a post (as well as any post type) with an arbitrary title Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5e1244f7-39b5-4f37-8fef-e3f35fc388f1
CVE ID: CVE-2022-4104 State: PUBLISHED Published: 2022-11-28T00:00:00.000Z Last Updated: 2025-04-14T18:08:13.209Z Vendors: n/a Products: Dropbox Lepton Problem Types: Loop with Unreachable Exit Condition ('Infinite Loop') Description: A loop with an unreachable exit condition can be triggered by passing a crafted JPEG file to the Lepton image compression tool, resulting in a denial-of-service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tenable.com/security/research/TRA-2022-35
CVE ID: CVE-2022-4105 State: PUBLISHED Published: 2022-11-21T00:00:00.000Z Last Updated: 2025-04-14T18:07:53.890Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: kiwitcms Products: kiwitcms/kiwi Problem Types: CWE-79 Description: A stored XSS in a kiwi Test Plan can run malicious javascript which could be chained with an HTML injection to perform a UI redressing attack (clickjacking) and an HTML injection which disables the use of the history page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/386417e9-0cd5-4d80-8137-b0fd5c30b8f8 - https://github.com/kiwitcms/kiwi/commit/a2b169ffdef1d7c1755
://huntr.dev/bounties/386417e9-0cd5-4d80-8137-b0fd5c30b8f8 - https://github.com/kiwitcms/kiwi/commit/a2b169ffdef1d7c1755bade8138578423b35011b
CVE ID: CVE-2022-4106 State: PUBLISHED Published: 2022-12-19T13:41:50.942Z Last Updated: 2025-04-14T18:14:40.947Z Vendors: Unknown Products: Wholesale Market for WooCommerce Problem Types: CWE-552 Files or Directories Accessible to External Parties Description: The Wholesale Market for WooCommerce WordPress plugin before 1.0.7 does not have authorisation check, as well as does not validate user input used to generate system path, allowing unauthenticated attackers to download arbitrary file from the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b60a0d3d-148f-4e9b-baee-7332890804ed
CVE ID: CVE-2022-4107 State: PUBLISHED Published: 2022-12-19T13:41:49.352Z Last Updated: 2025-04-14T18:14:21.307Z Vendors: Unknown Products: SMSA Shipping for WooCommerce Problem Types: CWE-552 Files or Directories Accessible to External Parties, CWE-352 Cross-Site Request Forgery (CSRF) Description: The SMSA Shipping for WooCommerce WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks, as well as does not validate the file to be downloaded, allowing any authenticated users, such as subscriber to download arbitrary file from the server Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0b43285
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0b432858-722c-4bda-aa95-ad48e2097302
CVE ID: CVE-2022-4108 State: PUBLISHED Published: 2022-12-19T13:41:44.715Z Last Updated: 2025-04-14T18:13:40.570Z Vendors: Unknown Products: Wholesale Market for WooCommerce Problem Types: CWE-552 Files or Directories Accessible to External Parties Description: The Wholesale Market for WooCommerce WordPress plugin before 1.0.8 does not validate user input used to generate system path, allowing high privilege users such as admin to download arbitrary file from the server even when they should not be able to (for example in multisite) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/9d1770df-91f0-41e3-af0d-522ae4e62470
CVE ID: CVE-2022-4109 State: PUBLISHED Published: 2023-01-02T21:49:31.099Z Last Updated: 2025-04-10T18:45:55.816Z Vendors: Unknown Products: Wholesale Market for WooCommerce Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The Wholesale Market for WooCommerce WordPress plugin before 2.0.0 does not validate user input against path traversal attacks, allowing high privilege users such as admin to download arbitrary logs from the server even when they should not be able to (for example in multisite) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/51e023de-1
alyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/51e023de-189d-4557-9655-23f7ba58b670
CVE ID: CVE-2022-4110 State: PUBLISHED Published: 2022-12-26T12:28:12.124Z Last Updated: 2025-04-14T14:07:52.301Z Vendors: Unknown Products: Eventify™ Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Eventify™ WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/037a81b2-8fd8-4898-bb5b-d15d9a38778c
CVE ID: CVE-2022-4111 State: PUBLISHED Published: 2022-11-22T00:00:00.000Z Last Updated: 2025-04-24T20:07:23.860Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: tooljet Products: tooljet/tooljet Problem Types: CWE-1284 Description: Unrestricted file size limit can lead to DoS in tooljet/tooljet <1.27 by allowing a logged in attacker to upload profile pictures over 2MB. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/5596d072-66d2-4361-8cac-101c9c781c3d - https://github.com/tooljet/tooljet/commit/01cd3f0464747973ec329e9fb1ea12743d3235cc
CVE ID: CVE-2022-4112 State: PUBLISHED Published: 2022-12-19T13:41:46.228Z Last Updated: 2025-04-17T13:44:31.787Z Vendors: Unknown Products: Quizlord Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Quizlord WordPress plugin through 2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/4cbce79d-9b7a-41f5-9c52-08933ea7c28e
CVE ID: CVE-2022-4114 State: PUBLISHED Published: 2023-01-02T21:49:27.563Z Last Updated: 2025-04-10T18:51:03.437Z Vendors: Unknown Products: Superio Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Superio WordPress theme does not sanitise and escape some parameters, which could allow users with a role as low as a subscriber to perform Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7569f4ac-05c9-43c9-95e0-5cc360524bbd - https://themeforest.net/item/superio-job-board-wordpress-theme/32180231
CVE ID: CVE-2022-4115 State: PUBLISHED Published: 2023-06-27T13:17:14.954Z Last Updated: 2024-11-27T19:38:53.182Z Vendors: Unknown Products: Editorial Calendar Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Editorial Calendar WordPress plugin before 3.8.3 does not sanitise and escape its settings, allowing users with roles as low as contributor to inject arbitrary web scripts in the plugin admin panel, enabling a Stored Cross-Site Scripting vulnerability targeting higher privileged users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2b5071e1-9532-4a6c-9da4-d07932474ca4
CVE ID: CVE-2022-4116 State: PUBLISHED Published: 2022-11-22T00:00:00.000Z Last Updated: 2025-04-29T16:18:16.345Z Vendors: n/a Products: quarkus Problem Types: Remote COde Execution Description: A vulnerability was found in quarkus. This security flaw happens in Dev UI Config Editor which is vulnerable to drive-by localhost attacks leading to remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2022-4116
CVE ID: CVE-2022-4117 State: PUBLISHED Published: 2022-12-26T12:28:08.263Z Last Updated: 2025-04-14T14:15:32.858Z Vendors: Unknown Products: IWS Problem Types: CWE-89 SQL Injection Description: The IWS WordPress plugin through 1.0 does not properly escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1fac3eb4-13c0-442d-b27c-7b7736208193