Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-1366 State: PUBLISHED Published: 2022-05-02T18:01:09.000Z Last Updated: 2025-04-16T16:27:29.008Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DIAEnergie Problem Types: CWE-89 Description: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerChart.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01
CVE ID: CVE-2022-1367 State: PUBLISHED Published: 2022-05-02T18:02:31.000Z Last Updated: 2025-04-16T16:27:21.544Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DIAEnergie Problem Types: CWE-89 Description: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in Handler_TCV.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01
CVE ID: CVE-2022-1368 State: PUBLISHED Published: 2022-09-06T22:19:13.000Z Last Updated: 2025-04-16T16:10:43.133Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Cognex Products: 3D-A1000 Dimensioning System Problem Types: CWE-306 Description: The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 (3354) and prior is vulnerable to CWE-306: Missing Authentication for Critical Function, which allows unauthorized users to change the operator account password via webserver commands by monitoring web socket communications from an unauthenticated session. This could allow an attacker to escalate privileges to match those of the compromised account. Ad
authenticated session. This could allow an attacker to escalate privileges to match those of the compromised account. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-249-03
CVE ID: CVE-2022-1369 State: PUBLISHED Published: 2022-05-02T18:03:59.000Z Last Updated: 2025-04-16T16:27:13.375Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DIAEnergie Problem Types: CWE-89 Description: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in ReadRegIND. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01
CVE ID: CVE-2022-1370 State: PUBLISHED Published: 2022-05-02T18:05:34.000Z Last Updated: 2025-04-16T16:27:05.976Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DIAEnergie Problem Types: CWE-89 Description: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in ReadREGbyID. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01
CVE ID: CVE-2022-1371 State: PUBLISHED Published: 2022-05-02T18:06:30.000Z Last Updated: 2025-04-16T16:26:57.363Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DIAEnergie Problem Types: CWE-89 Description: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in ReadRegf. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01
CVE ID: CVE-2022-1372 State: PUBLISHED Published: 2022-05-02T18:08:06.000Z Last Updated: 2025-04-16T16:26:50.233Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DIAEnergie Problem Types: CWE-89 Description: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in dlSlog.aspx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01
CVE ID: CVE-2022-1373 State: PUBLISHED Published: 2022-08-17T20:10:24.000Z Last Updated: 2025-04-16T17:50:36.586Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Softing Products: Secure Integration Server Problem Types: CWE-23 Description: The “restore configuration” feature of Softing Secure Integration Server V1.22 is vulnerable to a directory traversal vulnerability when processing zip files. An attacker can craft a zip file to load an arbitrary dll and execute code. Using the "restore configuration" feature to upload a zip file containing a path traversal file may cause a file to be created and executed upon touching the disk. Additional Analyst Notes: -
g a path traversal file may cause a file to be created and executed upon touching the disk. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-04 - https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-5.html
CVE ID: CVE-2022-1374 State: PUBLISHED Published: 2022-05-02T18:08:51.000Z Last Updated: 2025-04-16T16:26:36.122Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DIAEnergie Problem Types: CWE-89 Description: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_unHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01
CVE ID: CVE-2022-1375 State: PUBLISHED Published: 2022-05-02T18:09:44.000Z Last Updated: 2025-04-16T16:26:26.442Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DIAEnergie Problem Types: CWE-89 Description: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_slogHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01
CVE ID: CVE-2022-1376 State: PUBLISHED Published: 2022-05-02T18:10:38.000Z Last Updated: 2025-04-16T16:26:16.352Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DIAEnergie Problem Types: CWE-89 Description: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_privgrpHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01
CVE ID: CVE-2022-1377 State: PUBLISHED Published: 2022-05-02T18:11:25.000Z Last Updated: 2025-04-16T16:26:05.775Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DIAEnergie Problem Types: CWE-89 Description: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_rltHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01
CVE ID: CVE-2022-1378 State: PUBLISHED Published: 2022-05-02T18:12:12.000Z Last Updated: 2025-04-16T16:25:55.979Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DIAEnergie Problem Types: CWE-89 Description: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_pgHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01
CVE ID: CVE-2022-1379 State: PUBLISHED Published: 2022-05-14T09:55:09 Last Updated: 2024-08-03T00:03:06.044Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: plantuml Products: plantuml/plantuml Problem Types: CWE-918 Description: URL Restriction Bypass in GitHub repository plantuml/plantuml prior to V1.2022.5. An attacker can abuse this to bypass URL restrictions that are imposed by the different security profiles and achieve server side request forgery (SSRF). This allows accessing restricted internal resources/servers or sending requests to third party servers. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/0d7375
third party servers. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/0d737527-86e1-41d1-9d37-b2de36bc063a - https://github.com/plantuml/plantuml/commit/93e5964e5f35914f3f7b89de620c596795550083 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHUE4G5CAJUD7L2QPJF6U4JYQTP7CNNL/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J4DP36G2VBOZUNQIUZ5LVJKZIVO4SDAI/
CVE ID: CVE-2022-1380 State: PUBLISHED Published: 2022-04-16T11:30:20 Last Updated: 2024-08-03T00:03:06.281Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: snipe Products: snipe/snipe-it Problem Types: CWE-79 Description: Stored Cross Site Scripting vulnerability in Item name parameter in GitHub repository snipe/snipe-it prior to v5.4.3. The vulnerability is capable of stolen the user Cookie. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/3d45cfca-3a72-4578-b735-98837b998a12 - https://github.com/snipe/snipe-it/commit/f211c11034baf4281aa62e7b5e0347248d995ee9
CVE ID: CVE-2022-1381 State: PUBLISHED Published: 2022-04-17T00:00:00 Last Updated: 2024-08-03T00:03:05.959Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-122 Description: global heap buffer overflow in skip_range in GitHub repository vim/vim prior to 8.2.4763. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/55f9c0e8-c221-48b6-a00e-bdcaebaba4a4 - https://github.com/vim/vim/commit/f50808ed135ab973296bca515ae4029b321afe47 - https://lists.fedoraproject.o
dcaebaba4a4 - https://github.com/vim/vim/commit/f50808ed135ab973296bca515ae4029b321afe47 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6E457NYOIRWBJHKB7ON44UY5AVTG4HU/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KVPZVE2CIE2NGCHZDMEHPBWN3LK2UQAA/ - https://security.gentoo.org/glsa/202208-32 - https://support.apple.com/kb/HT213488 - http://seclists.org/fulldisclosure/2022/Oct/41 - http://seclists.org/fulldisclosure/2022/Oct/28 - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2022-1382 State: PUBLISHED Published: 2022-04-16T22:45:18 Last Updated: 2024-08-03T00:03:06.103Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: radareorg Products: radareorg/radare2 Problem Types: CWE-476 Description: NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of making the radare2 crash, thus affecting the availability of the system. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/d8b6d239-6d7b-4783-b26b-5be848c01aa1 - https://github.com/radareorg/radare2/commit/48f0ea79f99174fb0a62cb2354e13496ce5b7c44
CVE ID: CVE-2022-1383 State: PUBLISHED Published: 2022-04-17T00:05:10 Last Updated: 2024-08-03T00:03:06.063Z Severity: MEDIUM (CVSS 4.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: radareorg Products: radareorg/radare2 Problem Types: CWE-122 Description: Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.8. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/02b4b563-b946-4343-9092-38d1c5cd60c9 - https://github.com/radareorg/radare
ner: References: - https://huntr.dev/bounties/02b4b563-b946-4343-9092-38d1c5cd60c9 - https://github.com/radareorg/radare2/commit/1dd65336f0f0c351d6ea853efcf73cf9c0030862
CVE ID: CVE-2022-1384 State: PUBLISHED Published: 2022-04-19T20:26:28 Last Updated: 2024-12-06T23:09:22.478Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-477 Description: Mattermost version 6.4.x and earlier fails to properly check the plugin version when a plugin is installed from the Marketplace, which allows an authenticated and an authorized user to install and exploit an old plugin version from the Marketplace which might have known vulnerabilities. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates/
CVE ID: CVE-2022-1385 State: PUBLISHED Published: 2022-04-19T20:26:27 Last Updated: 2024-12-06T23:09:33.235Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-664 Description: Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, which allows accidentally invited users to join the workspace and access information from the public teams and channels. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates/ - https://hackerone.com/reports/1486820
CVE ID: CVE-2022-1386 State: PUBLISHED Published: 2022-05-16T14:30:50 Last Updated: 2024-08-03T00:03:05.951Z Vendors: Unknown Products: Fusion Builder Problem Types: CWE-918 Description: The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. This could be used to interact with hosts on the server's local network bypassing firewalls and access control measures. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/bf7034ab-24c4-461f-a709-3f73988b536b - https://
- CVE Program Container: References: - https://wpscan.com/vulnerability/bf7034ab-24c4-461f-a709-3f73988b536b - https://www.rootshellsecurity.net/rootshell-discovered-a-critical-vulnerability-in-top-wordpress-theme/ - https://theme-fusion.com/version-7-6-2-security-update/
CVE ID: CVE-2022-1387 State: PUBLISHED Published: 2022-05-30T08:35:44 Last Updated: 2024-08-03T00:03:06.252Z Vendors: Unknown Products: No Future Posts Problem Types: CWE-79 Description: The No Future Posts WordPress plugin through 1.4 does not escape its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/48252ffb-f21c-4e2a-8f78-bdc7164e7347
CVE ID: CVE-2022-1388 State: PUBLISHED Published: 2022-05-05T16:18:04.472Z Last Updated: 2025-10-21T23:15:40.370Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: F5 Products: BIG-IP Problem Types: CWE-306 Description: On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://suppor
e not evaluated Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.f5.com/csp/article/K23605346 - http://packetstormsecurity.com/files/167007/F5-BIG-IP-Remote-Code-Execution.html - http://packetstormsecurity.com/files/167118/F5-BIG-IP-16.0.x-Remote-Code-Execution.html - http://packetstormsecurity.com/files/167150/F5-BIG-IP-iControl-Remote-Code-Execution.html - https://www.secpod.com/blog/critical-f5-big-ip-remote-code-execution-vulnerability-patch-now/
CVE ID: CVE-2022-1389 State: PUBLISHED Published: 2022-05-05T16:19:03.162448Z Last Updated: 2024-09-17T02:16:07.505Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: F5 Products: BIG-IP Problem Types: CWE-352 Description: On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP (fixed in 17.0.0), a cross-site request forgery (CSRF) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility. This vulnerability allows an attacker to run a limited set of commands: ping, traceroute, and WOM diagnostics. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Additional Analyst Notes:
. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K49905324
CVE ID: CVE-2022-1390 State: PUBLISHED Published: 2022-04-25T15:51:24 Last Updated: 2024-08-03T00:03:06.263Z Vendors: Unknown Products: Admin Word Count Column Problem Types: CWE-22 Description: The Admin Word Count Column WordPress plugin through 2.2 does not validate the path parameter given to readfile(), which could allow unauthenticated attackers to read arbitrary files on server running old version of PHP susceptible to the null byte technique. This could also lead to RCE by using a Phar Deserialization technique Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/6293b319-dc4f-4412-9d56-55744246c990 - https://packetstormsecurity.com/files/
rences: - https://wpscan.com/vulnerability/6293b319-dc4f-4412-9d56-55744246c990 - https://packetstormsecurity.com/files/166476/
CVE ID: CVE-2022-1391 State: PUBLISHED Published: 2022-04-25T15:51:26 Last Updated: 2024-08-03T00:03:06.087Z Vendors: Unknown Products: Cab fare calculator Problem Types: CWE-22 Description: The Cab fare calculator WordPress plugin before 1.0.4 does not validate the controller parameter before using it in require statements, which could lead to Local File Inclusion issues. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/680121fe-6668-4c1a-a30d-e70dd9be5aac - https://packetstormsecurity.com/files/166533/
CVE ID: CVE-2022-1392 State: PUBLISHED Published: 2022-04-25T15:51:27 Last Updated: 2024-08-03T00:03:06.297Z Vendors: Unknown Products: Videos sync PDF Problem Types: CWE-22 Description: The Videos sync PDF WordPress plugin through 1.7.4 does not validate the p parameter before using it in an include statement, which could lead to Local File Inclusion issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/fe3da8c1-ae21-4b70-b3f5-a7d014aa3815 - https://packetstormsecurity.com/files/166534/
CVE ID: CVE-2022-1393 State: PUBLISHED Published: 2022-05-16T14:30:51 Last Updated: 2024-08-03T00:03:06.053Z Vendors: Unknown Products: WP Subtitle Problem Types: CWE-79 Description: The WP Subtitle WordPress plugin before 3.4.1 adds a subtitle field and provides a shortcode to display it via [wp_subtitle]. The subtitle is stored as a custom post meta with the key: "wps_subtitle", which is sanitized upon post save/update, however is not sanitized when updating it directly from the post meta update button (via AJAX) - and this makes the XSS exploitable by authenticated users with a role as low as contributor. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/
with a role as low as contributor. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/3491b889-94dd-4507-9fed-58f48d8275cf
CVE ID: CVE-2022-1394 State: PUBLISHED Published: 2022-06-06T08:50:56 Last Updated: 2024-08-03T00:03:06.241Z Vendors: Unknown Products: Photo Gallery by 10Web – Mobile-Friendly Image Gallery Problem Types: CWE-79 Description: The Photo Gallery by 10Web WordPress plugin before 1.6.4 does not properly validate and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f7a0df37-3204-4926-84ec-2204a2f22de3
CVE ID: CVE-2022-1395 State: PUBLISHED Published: 2022-05-30T08:35:45 Last Updated: 2024-08-03T00:03:06.266Z Vendors: Unknown Products: Easy FAQ with Expanding Text Problem Types: CWE-79 Description: The Easy FAQ with Expanding Text WordPress plugin through 3.2.8.3.1 does not sanitise and escape its settings, allowing high privilege users to perform Cross-Site Scripting attacks when unfiltered_html is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e5c06b38-fab8-44af-84dc-df94eb72ce80
CVE ID: CVE-2022-1396 State: PUBLISHED Published: 2022-04-25T15:51:29 Last Updated: 2024-08-03T00:03:06.255Z Vendors: Unknown Products: Donorbox – Free Recurring Donation Form Problem Types: CWE-79 Description: The Donorbox WordPress plugin before 7.1.7 does not sanitise and escape its Campaign URL settings before outputting it in an attribute, leading to a Stored Cross-Site Scripting issue even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/721ddc3e-ab24-4834-bd47-4eb6700439a9 - https://packetstormsecurity.com/files/166531/
CVE ID: CVE-2022-1397 State: PUBLISHED Published: 2022-05-10T10:05:10 Last Updated: 2024-08-03T00:03:06.244Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: alextselegidis Products: alextselegidis/easyappointments Problem Types: CWE-269 Description: API Privilege Escalation in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Full system takeover. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/5f69e094-ab8c-47a3-b01d-8c12a3b14c61 - https://github.com/alextselegidis/easyappointments/commit/63dbb51decfcc1631c398ecd6d30e3a337845526