Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
e for unauthenticated attackers to change plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d38d41c7-8786-4145-9591-3e24eff3b79c?source=cve - https://plugins.trac.wordpress.org/browser/essential-blocks/tags/4.0.6/includes/Admin/Admin.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2900595%40essential-blocks%2Ftrunk&old=2900029%40essential-blocks%2Ftrunk&sfp_email=&sfph_mail=#file2
CVE ID: CVE-2023-2088 State: PUBLISHED Published: 2023-05-12T00:00:00.000Z Last Updated: 2025-11-04T16:09:57.798Z Vendors: n/a Products: OpenStack Problem Types: CWE-440 Description: A flaw was found in OpenStack due to an inconsistency between Cinder and Nova. This issue can be triggered intentionally or by accident. A remote, authenticated attacker could exploit this vulnerability by detaching one of their volumes from Cinder. The highest impact is to confidentiality. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.openstack.org/ossa/OSSA-2023-003.html - https://bugs.launchpad.net/bugs/2004555
CVE ID: CVE-2023-2089 State: PUBLISHED Published: 2023-04-15T07:07:52.123Z Last Updated: 2024-08-02T06:12:20.400Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Complaint Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Complaint Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/userprofile.php of the component GET Parameter Handler. The manipulation of the argument uid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226097 was assigned to this vul
motely. The exploit has been disclosed to the public and may be used. The identifier VDB-226097 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.226097 - https://vuldb.com/?ctiid.226097 - https://github.com/winkle175/bug_report/blob/main/SQLi-1.md
CVE ID: CVE-2023-2090 State: PUBLISHED Published: 2023-04-15T09:00:05.981Z Last Updated: 2024-08-02T06:12:20.204Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Employee and Visitor Gate Pass Logging System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. Affected is an unknown function of the file /admin/maintenance/view_designation.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-
ection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-226098 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.226098 - https://vuldb.com/?ctiid.226098 - https://github.com/4O4NtFd/bug_report/blob/main/SQLI1/SQLi-1.md
CVE ID: CVE-2023-2091 State: PUBLISHED Published: 2023-04-15T08:40:43.814Z Last Updated: 2024-11-22T16:06:11.276Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: KylinSoft Products: youker-assistant Problem Types: CWE-78 Description: A vulnerability classified as critical was found in KylinSoft youker-assistant on KylinOS. Affected by this vulnerability is the function adjust_cpufreq_scaling_governer. The manipulation leads to os command injection. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.4.13 is able to address this issue. It is recommended to upgrade the affe
blic and may be used. Upgrading to version 3.1.4.13 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-226099. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.226099 - https://vuldb.com/?ctiid.226099 - https://github.com/i900008/vulndb/blob/main/youker-assistant_vuln.md - https://kylinos.cn/support/loophole/patch/3375.html
CVE ID: CVE-2023-2092 State: PUBLISHED Published: 2023-04-15T09:31:03.458Z Last Updated: 2024-08-02T06:12:20.252Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Vehicle Service Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in SourceCodester Vehicle Service Management System 1.0. Affected by this issue is some unknown functionality of the file view_service.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-226100. Additional Ana
oit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-226100. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.226100 - https://vuldb.com/?ctiid.226100 - https://github.com/E1CHO/cve_hub/blob/main/Vehicle%20Service%20Management%20System/Vehicle%20Service%20Management%20System%20-%20vuln%201.pdf
CVE ID: CVE-2023-2093 State: PUBLISHED Published: 2023-04-15T10:00:06.190Z Last Updated: 2024-08-02T06:12:20.429Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Vehicle Service Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in SourceCodester Vehicle Service Management System 1.0. This affects an unknown part of the file /classes/Login.php. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226101 was assigned to this vulnerability. Additional Ana
en disclosed to the public and may be used. The identifier VDB-226101 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.226101 - https://vuldb.com/?ctiid.226101 - https://github.com/E1CHO/cve_hub/blob/main/Vehicle%20Service%20Management%20System/Vehicle%20Service%20Management%20System%20-%20vuln%202.pdf
CVE ID: CVE-2023-2094 State: PUBLISHED Published: 2023-04-15T10:31:04.007Z Last Updated: 2025-02-06T15:30:14.782Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Vehicle Service Management System Problem Types: CWE-89 Description: A vulnerability has been found in SourceCodester Vehicle Service Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/mechanics/manage_mechanic.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-226102 is the identifier assigned to this vulnerability. Addit
oit has been disclosed to the public and may be used. VDB-226102 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.226102 - https://vuldb.com/?ctiid.226102 - https://github.com/E1CHO/cve_hub/blob/main/Vehicle%20Service%20Management%20System/Vehicle%20Service%20Management%20System%20-%20vuln%203.pdf
CVE ID: CVE-2023-2095 State: PUBLISHED Published: 2023-04-15T10:31:05.041Z Last Updated: 2024-08-02T06:12:20.449Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Vehicle Service Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Vehicle Service Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/maintenance/manage_category.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226103. Add
oit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226103. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.226103 - https://vuldb.com/?ctiid.226103 - https://github.com/E1CHO/cve_hub/blob/main/Vehicle%20Service%20Management%20System/Vehicle%20Service%20Management%20System%20-%20vuln%204.pdf
CVE ID: CVE-2023-2096 State: PUBLISHED Published: 2023-04-15T11:00:07.751Z Last Updated: 2024-08-02T06:12:20.443Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Vehicle Service Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Vehicle Service Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/service_requests/manage_inventory.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-226104. Ad
ly. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-226104. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.226104 - https://vuldb.com/?ctiid.226104 - https://github.com/E1CHO/cve_hub/blob/main/Vehicle%20Service%20Management%20System/Vehicle%20Service%20Management%20System%20-%20vuln%205.pdf
CVE ID: CVE-2023-2097 State: PUBLISHED Published: 2023-04-15T11:00:08.918Z Last Updated: 2024-11-22T16:05:31.767Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Vehicle Service Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Vehicle Service Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /classes/Master.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226105 was assigned to this vulnerability. A
xploit has been disclosed to the public and may be used. The identifier VDB-226105 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.226105 - https://vuldb.com/?ctiid.226105 - https://github.com/E1CHO/cve_hub/blob/main/Vehicle%20Service%20Management%20System/Vehicle%20Service%20Management%20System%20-%20vuln%206.pdf
CVE ID: CVE-2023-2098 State: PUBLISHED Published: 2023-04-15T11:31:03.247Z Last Updated: 2024-08-02T06:12:20.383Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Vehicle Service Management System Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Vehicle Service Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /inc/topBarNav.php. The manipulation of the argument search leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-226106 is the identifier assigned to this vulnerability.
exploit has been disclosed to the public and may be used. VDB-226106 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.226106 - https://vuldb.com/?ctiid.226106 - https://github.com/E1CHO/cve_hub/blob/main/Vehicle%20Service%20Management%20System/Vehicle%20Service%20Management%20System%20-%20vuln%207.pdf
CVE ID: CVE-2023-2099 State: PUBLISHED Published: 2023-04-15T12:00:06.750Z Last Updated: 2025-02-05T16:29:16.810Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Vehicle Service Management System Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in SourceCodester Vehicle Service Management System 1.0. This affects an unknown part of the file /classes/Users.php. The manipulation of the argument id leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226107. Additional Analyst
sclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226107. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.226107 - https://vuldb.com/?ctiid.226107 - https://github.com/E1CHO/cve_hub/blob/main/Vehicle%20Service%20Management%20System/Vehicle%20Service%20Management%20System%20-%20vuln%208.pdf
CVE ID: CVE-2023-2100 State: PUBLISHED Published: 2023-04-15T12:31:02.994Z Last Updated: 2024-08-02T06:12:19.984Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Vehicle Service Management System Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in SourceCodester Vehicle Service Management System 1.0. This vulnerability affects unknown code of the file /admin/report/index.php. The manipulation of the argument date_end leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-226108. Additional Analyst Not
been disclosed to the public and may be used. The identifier of this vulnerability is VDB-226108. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.226108 - https://vuldb.com/?ctiid.226108 - https://github.com/E1CHO/cve_hub/blob/main/Vehicle%20Service%20Management%20System/Vehicle%20Service%20Management%20System%20-%20vuln%209.pdf
CVE ID: CVE-2023-2101 State: PUBLISHED Published: 2023-04-15T12:31:03.981Z Last Updated: 2024-08-02T06:12:20.312Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: moxi624 Products: Mogu Blog v2 Problem Types: CWE-36 Description: A vulnerability, which was classified as problematic, has been found in moxi624 Mogu Blog v2 up to 5.2. This issue affects the function uploadPictureByUrl of the file /mogu-picture/file/uploadPicsByUrl. The manipulation of the argument urlList leads to absolute path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226109 was assigned to this vulnerability
e exploit has been disclosed to the public and may be used. The identifier VDB-226109 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.226109 - https://vuldb.com/?ctiid.226109 - https://github.com/c3p0ooo-Yiqiyin/mogu_blog_v2/blob/main/README.md - https://github.com/moxi624/mogu_blog_v2/issues/97
CVE ID: CVE-2023-2102 State: PUBLISHED Published: 2023-04-15T00:00:00.000Z Last Updated: 2025-02-06T15:45:36.965Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:H) Vendors: alextselegidis Products: alextselegidis/easyappointments Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/dd7c04a7-a984-4387-9ac4-24596e7ece44 - https://github.com/alextselegidis/easyappointments/commit/bddc5cbeb7ff237a72943b304dcb01c653781767
CVE ID: CVE-2023-2103 State: PUBLISHED Published: 2023-04-15T00:00:00.000Z Last Updated: 2025-02-06T15:42:47.254Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: alextselegidis Products: alextselegidis/easyappointments Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/1df09505-9923-43b9-82ef-15d94bc3f9dc - https://github.com/alextselegidis/easyappointments/commit/46a865300e94c7031cc0e315d95d3e3e56768498
CVE ID: CVE-2023-2104 State: PUBLISHED Published: 2023-04-15T00:00:00.000Z Last Updated: 2025-02-06T15:40:00.832Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: alextselegidis Products: alextselegidis/easyappointments Problem Types: CWE-284 Description: Improper Access Control in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/3099b8d1-c49c-41b8-a929-73ccded6fc7c - https://github.com/alextselegidis/easyappointments/commit/75b24735767868344193fb2cc56e17ee4b9ac4be
CVE ID: CVE-2023-2105 State: PUBLISHED Published: 2023-04-15T00:00:00.000Z Last Updated: 2025-02-06T15:37:15.827Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: alextselegidis Products: alextselegidis/easyappointments Problem Types: CWE-384 Description: Session Fixation in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/de213e0b-a227-4fc3-bbe7-0b33fbf308e1 - https://github.com/alextselegidis/easyappointments/commit/7f37350fab9d729a9350d96369ff0f453cf7b840
CVE ID: CVE-2023-2106 State: PUBLISHED Published: 2023-04-15T00:00:00.000Z Last Updated: 2025-02-06T15:33:47.636Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: janeczku Products: janeczku/calibre-web Problem Types: CWE-521 Description: Weak Password Requirements in GitHub repository janeczku/calibre-web prior to 0.6.20. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/janeczku/calibre-web/commit/49e4f540c9b204c7e39b3c27ceadecd83ed60e7e - https://huntr.dev/bounties/c3d5c647-7557-40a9-aee4-24dc14882781
CVE ID: CVE-2023-2107 State: PUBLISHED Published: 2023-04-15T14:00:06.289Z Last Updated: 2025-02-06T19:59:10.056Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: IBOS Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in IBOS 4.5.5. Affected is an unknown function of the file file/personal/del&op=recycle. The manipulation of the argument fids leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-226110 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
signed to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.226110 - https://vuldb.com/?ctiid.226110 - https://github.com/MuRKuo/cve/blob/main/ibos%20oa%20sql.md
CVE ID: CVE-2023-2108 State: PUBLISHED Published: 2023-04-16T07:31:03.904Z Last Updated: 2024-08-02T06:12:20.446Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Judging Management System Problem Types: CWE-89 Description: A vulnerability has been found in SourceCodester Judging Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file edit_contestant.php. The manipulation of the argument contestant_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226147. Additio
has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226147. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.226147 - https://vuldb.com/?ctiid.226147 - https://github.com/hackerzyq/mycve/blob/main/vendors/oretnom23/judging-management-system/SQLi-1.md
CVE ID: CVE-2023-2109 State: PUBLISHED Published: 2023-04-17T00:00:00.000Z Last Updated: 2025-02-05T21:23:18.784Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: chatwoot Products: chatwoot/chatwoot Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.14.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/fd5999fd-b1fd-44b4-ae2e-8f95b5c3d1b6 - https://github.com/chatwoot/chatwoot/commit/a06a5a574ad908b0ef2db7b47d05c3774eeb493d
CVE ID: CVE-2023-2110 State: PUBLISHED Published: 2023-08-19T05:31:48.974Z Last Updated: 2024-10-07T20:02:00.230Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: Obsidian Products: Obsidian Problem Types: CWE-22 Description: Improper path handling in Obsidian desktop before 1.2.8 on Windows, Linux and macOS allows a crafted webpage to access local files and exfiltrate them to remote web servers via "app://local/<absolute-path>". This vulnerability can be exploited if a user opens a malicious markdown file in Obsidian, or copies text from a malicious webpage and paste it into Obsidian. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
licious webpage and paste it into Obsidian. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://obsidian.md/changelog/2023-05-03-desktop-v1.2.8/ - https://starlabs.sg/advisories/23/23-2110/
CVE ID: CVE-2023-2111 State: PUBLISHED Published: 2023-05-30T07:49:22.658Z Last Updated: 2025-01-10T16:13:26.994Z Vendors: Unknown Products: Fast & Effective Popups & Lead-Generation for WordPress Problem Types: CWE-89 SQL Injection Description: The Fast & Effective Popups & Lead-Generation for WordPress plugin before 2.1.4 concatenates user input into an SQL query without escaping it first in the plugin's report API endpoint, which could allow administrators in multi-site configuration to leak sensitive information from the site's database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7a0bdd47-c339-489d-9443-f173a
Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7a0bdd47-c339-489d-9443-f173a83447f2
CVE ID: CVE-2023-2112 State: PUBLISHED Published: 2023-04-20T08:05:52.085Z Last Updated: 2024-08-28T19:27:53.050Z Severity: LOW (CVSS 3.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: M-Files Products: M-Files Desktop Problem Types: CWE-284 Description: Desktop component service allows lateral movement between sessions in M-Files before 23.4.12455.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://product.m-files.com/security-advisories/cve-2023-2112/
CVE ID: CVE-2023-2113 State: PUBLISHED Published: 2023-05-30T07:49:13.137Z Last Updated: 2025-01-10T21:05:32.641Z Vendors: Unknown Products: Autoptimize Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Autoptimize WordPress plugin before 3.1.7 does not sanitise and escape the settings imported from a previous export, allowing high privileged users (such as an administrator) to inject arbitrary javascript into the admin panel, even when the unfiltered_html capability is disabled, such as in a multisite setup. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ddb4c95d-bbee-4095-aed6-25f6b8e63011