Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-36847 State: PUBLISHED Published: 2025-07-12T09:24:28.215Z Last Updated: 2025-07-14T20:11:54.211Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: eemitch Products: Simple File List Problem Types: CWE-434 Description: The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploaded PHP code with a png extension to use a php extension. This allows unauthenticated attackers to execute code on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9e
ional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9eb835fd-6ebf-4162-856c-0366b663a07e?source=cve - https://plugins.trac.wordpress.org/changeset/2286920/simple-file-list - https://packetstormsecurity.com/files/160221/ - https://www.cybersecurity-help.cz/vdb/SB2020042711 - https://wpscan.com/vulnerability/365da9c5-a8d0-45f6-863c-1b1926ffd574/
CVE ID: CVE-2020-36848 State: PUBLISHED Published: 2025-07-12T11:23:39.932Z Last Updated: 2025-07-14T20:11:20.429Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: boldgrid Products: Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid Problem Types: CWE-200 Description: The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.14.9 via the env-info.php and restore-info.json files. This makes it possible for unauthenticated attackers to find the location of back-up files and subsequently download them. Additional
possible for unauthenticated attackers to find the location of back-up files and subsequently download them. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/86a5adaf-02b7-4b42-a048-8bc01f07656b?source=cve - https://wpscan.com/vulnerability/d35c19d9-8586-4c5b-9a01-44739cbeee19/ - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/scanner/http/wp_total_upkeep_downloader.rb - https://plugins.trac.wordpress.org/changeset/2439376/boldgrid-backup
CVE ID: CVE-2020-36849 State: PUBLISHED Published: 2025-07-12T11:23:40.285Z Last Updated: 2025-07-14T20:11:14.366Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: AIT Themes Products: AIT CSV import/export Problem Types: CWE-434 Description: The AIT CSV import/export plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the /wp-content/plugins/ait-csv-import-export/admin/upload-handler.php file in versions up to, and including, 3.0.3. This makes it possible for unauthorized attackers to upload arbitrary files on the affected sites server which may make remote code execution possible. Additional Analyst Notes: -
arbitrary files on the affected sites server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cece751c-400d-42b4-9438-950d5aca51fc?source=cve - https://www.ait-themes.club/wordpress-plugins/csv-import-export/ - https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-ait-themes-csv-import-export-arbitrary-file-upload-3-0-3/ - https://wpscan.com/vulnerability/36e699a4-91f2-426d-ba14-26036fbfeaea - https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/multi/http/wp_ait_csv_rce.rb - https://raw.githubusercontent.com/rapid7/metasploit-framework/mas
aster//modules/exploits/multi/http/wp_ait_csv_rce.rb - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/wp_ait_csv_rce.rb
CVE ID: CVE-2020-36850 State: PUBLISHED Published: 2025-07-25T15:54:04.348Z Last Updated: 2025-07-25T18:22:43.473Z Vendors: Sitecore Products: JSS React Sample Application Problem Types: CWE-200 Description: An information disclosure vulnerability exits in Sitecore JSS React Sample Application 11.0.0 - 14.0.1 that may cause page content intended for one user to be shown to another user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0750906 - https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1001612 - https://www.vulncheck.com/advisories/sitecore-jss-react-sample-application-info-disc
CVE ID: CVE-2020-36851 State: PUBLISHED Published: 2025-09-25T14:45:38.599Z Last Updated: 2025-09-26T00:54:59.828Z Vendors: Rob--W / cors-anywhere Products: Rob--W / cors-anywhere Problem Types: CWE-942, CWE-918 Description: Rob -- W / cors-anywhere instances configured as an open proxy allow unauthenticated external users to induce the server to make HTTP requests to arbitrary targets (SSRF). Because the proxy forwards requests and headers, an attacker can reach internal-only endpoints and link-local metadata services, retrieve instance role credentials or other sensitive metadata, and interact with internal APIs and services that are not intended to be internet-facing. The vulnerability is
metadata, and interact with internal APIs and services that are not intended to be internet-facing. The vulnerability is exploitable by sending crafted requests to the proxy with the target resource encoded in the URL; many cors-anywhere deployments forward arbitrary methods and headers (including PUT), which can permit exploitation of IMDSv2 workflows as well as access to internal management APIs. Successful exploitation can result in theft of cloud credentials, unauthorized access to internal services, remote code execution or privilege escalation (depending on reachable backends), data exfiltration, and full compromise of cloud resources. Mitigation includes: restricting the proxy to trus
backends), data exfiltration, and full compromise of cloud resources. Mitigation includes: restricting the proxy to trusted origins or authentication, whitelisting allowed target hosts, preventing access to link-local and internal IP ranges, removing support for unsafe HTTP methods/headers, enabling cloud provider mitigations, and deploying network-level protections. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Rob--W/cors-anywhere/issues/152 - https://github.com/Rob--W/cors-anywhere/issues/78 - https://www.certik.com/resources/blog/cors-anywhere-dangers-of-misconfigured-third-party-software - https://www.vulncheck.com/advisories/rob-w-cors-anywhere-mis
rs-anywhere-dangers-of-misconfigured-third-party-software - https://www.vulncheck.com/advisories/rob-w-cors-anywhere-misconfigured-cors-proxy-allows-ssrf - https://github.com/SocketDev/security-research/security/advisories/GHSA-9wmg-93pw-fc3g - https://github.com/Rob--W/cors-anywhere/issues/521
CVE ID: CVE-2020-36852 State: PUBLISHED Published: 2025-10-01T06:42:25.437Z Last Updated: 2025-10-01T13:17:53.788Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: ghazale Products: Custom Searchable Data Entry System Problem Types: CWE-862 Description: The Custom Searchable Data Entry System plugin for WordPress is vulnerable to unauthenticated database wiping in versions up to, and including 1.7.1, due to a missing capability check and lack of sufficient validation on the ghazale_sds_delete_entries_table_row() function. This makes it possible for unauthenticated attackers to completely wipe database tables such as wp_users. Additional Analyst Notes: - CIS
sible for unauthenticated attackers to completely wipe database tables such as wp_users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/245d89e5-52cc-44b1-a858-0ca0aacb4e26?source=cve - https://www.wordfence.com/blog/2020/03/active-attack-on-zero-day-in-custom-searchable-data-entry-system-plugin/
CVE ID: CVE-2020-36853 State: PUBLISHED Published: 2025-10-18T03:33:23.819Z Last Updated: 2025-10-20T18:40:17.068Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: 10web Products: 10Web Map Builder for Google Maps Problem Types: CWE-79 Description: The 10WebMapBuilder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Plugin Settings Change in versions up to, and including, 1.0.63 due to insufficient input sanitization and output escaping and a lack of capability checks. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst
o inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7c1c24cc-9388-4d91-8dc6-c67d3420cc94?source=cve - https://www.wordfence.com/blog/2020/02/site-takeover-campaign-exploits-multiple-zero-day-vulnerabilities/ - https://plugins.trac.wordpress.org/changeset/2251882/wd-google-maps
CVE ID: CVE-2020-36854 State: PUBLISHED Published: 2025-10-18T03:33:24.573Z Last Updated: 2025-10-20T16:32:19.047Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: cloughit Products: Async JavaScript Problem Types: CWE-79 Description: The Async JavaScript plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.19.07.14. This is due to missing authorization checks on the aj_steps AJAX aciton along with a lack on sanitization on the settings saved via the function. This makes it possible for authenticated attackers with subscriber level permissions and above to inject malicious web scripts into a page that execute w
ticated attackers with subscriber level permissions and above to inject malicious web scripts into a page that execute whenever a user accesses that page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b133888c-7673-4796-917c-486bff1b6b12?source=cve - https://www.wordfence.com/blog/2020/02/site-takeover-campaign-exploits-multiple-zero-day-vulnerabilities/
CVE ID: CVE-2020-36855 State: PUBLISHED Published: 2025-10-21T15:02:09.082Z Last Updated: 2025-10-21T15:23:26.003Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C) Vendors: n/a Products: DCMTK Problem Types: CWE-121, CWE-119 Description: A security vulnerability has been detected in DCMTK up to 3.6.5. The affected element is the function parseQuota of the component dcmqrscp. The manipulation of the argument StorageQuota leads to stack-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. Upgrading to version 3.6.6 is sufficient to fix this issue. The identifier of the patch is 0f
publicly and may be used. Upgrading to version 3.6.6 is sufficient to fix this issue. The identifier of the patch is 0fef9f02e. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.329028 - https://vuldb.com/?ctiid.329028 - https://vuldb.com/?submit.673137 - https://shimo.im/docs/rp3OMVMDPKtjn0km/
CVE ID: CVE-2020-36856 State: PUBLISHED Published: 2025-10-30T21:30:59.762Z Last Updated: 2025-11-17T18:21:39.407Z Vendors: Nagios Products: XI Problem Types: CWE-78 Description: Nagios XI versions prior to 5.6.14 contain an authenticated remote command execution vulnerability in the CCM command_test.php script. Insufficient validation of the `address` parameter allows an authenticated user with access to the Core Config Manager to inject shell metacharacters that are incorporated into backend command invocations. Successful exploitation enables arbitrary command execution with the privileges of the Nagios XI web application user and may be leveraged to execute commands on the underlying XI
with the privileges of the Nagios XI web application user and may be leveraged to execute commands on the underlying XI host, modify system configuration, or fully compromise the host. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/products/security/#nagios-xi - https://www.nagios.com/changelog/nagios-xi/ - https://www.vulncheck.com/advisories/nagios-xi-authenticated-rce-command-test-php-via-address
CVE ID: CVE-2020-36857 State: PUBLISHED Published: 2025-10-30T21:31:41.981Z Last Updated: 2025-11-24T20:28:28.611Z Vendors: Nagios Products: XI Problem Types: CWE-89 Description: Nagios XI versions prior to 5.6.14 contain a post-authentication SQL injection vulnerability in the SNMP Trap Interface page. Exploitation requires an account with administrative privileges to access the affected interface. A user with administrative access could supply crafted input that is not properly sanitized, allowing SQL injection that may lead to unauthorized disclosure or modification of application data or execution of arbitrary SQL commands against the backend database. Additional Analyst Notes: - CISA AD
pplication data or execution of arbitrary SQL commands against the backend database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/products/security/#nagios-xi - https://www.nagios.com/changelog/nagios-xi/ - https://www.vulncheck.com/advisories/nagios-xi-authenticated-sqli-via-snmp-trap-interface-page
CVE ID: CVE-2020-36858 State: PUBLISHED Published: 2025-10-30T21:26:38.984Z Last Updated: 2025-11-17T21:36:22.598Z Vendors: Nagios Products: Log Server Problem Types: CWE-79 Description: Nagios Log Server versions prior to 2.1.6 contain cross-site scripting (XSS) vulnerabilities via the web interface on the Create User, Edit User, and Manage Host Lists pages. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/changelog/nagios-log-server-2024r1/ - https://www.vulncheck.com/advisories/nagios-log-server
s: - https://www.nagios.com/changelog/nagios-log-server-2024r1/ - https://www.vulncheck.com/advisories/nagios-log-server-xss-via-create-user-edit-user-and-manage-host-lists-pages
CVE ID: CVE-2020-36859 State: PUBLISHED Published: 2025-10-30T21:33:40.529Z Last Updated: 2025-11-17T18:21:39.757Z Vendors: Nagios Products: XI Problem Types: CWE-89 Description: The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.0.7 / Nagios XI 5.7.4 contains multiple SQL injection vulnerabilities in the object edit pages. Unsanitized user-supplied input was incorporated into SQL queries used by configuration object editors, allowing authenticated users to inject SQL fragments. Successful exploitation could lead to unauthorized disclosure or modification of configuration and application data, and in some environments could allow further compromise of the application or backe
configuration and application data, and in some environments could allow further compromise of the application or backend database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/changelog/nagios-xi/ - https://www.vulncheck.com/advisories/nagios-xi-ccm-sqli-via-object-edit-pages
CVE ID: CVE-2020-36860 State: PUBLISHED Published: 2025-10-30T21:34:57.698Z Last Updated: 2025-11-17T18:21:39.921Z Vendors: Nagios Products: XI Problem Types: CWE-79 Description: The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.0.7 / Nagios XI 5.7.4 contains multiple cross-site scripting (XSS) vulnerabilities in the object edit pages. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/changelog/nagios-xi/ - https://www.vulncheck.com/advisories/nagios-xi-ccm-xss-via-object-edit-pages
CVE ID: CVE-2020-36861 State: PUBLISHED Published: 2025-10-30T21:35:47.361Z Last Updated: 2025-11-17T18:21:40.109Z Vendors: Nagios Products: XI Problem Types: CWE-79 Description: The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.0.8 / Nagios XI 5.7.5 contains multiple cross-site scripting (XSS) vulnerabilities in the overlay UI elements and the Notification/Check Period pages. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/changelog/nagios-xi/ - https://www.vulncheck.com/advisori
- CISA ADP Vulnrichment: References: - https://www.nagios.com/changelog/nagios-xi/ - https://www.vulncheck.com/advisories/nagios-xi-ccm-xss-via-overlay-rendering-and-notification-check-period-pages
CVE ID: CVE-2020-36862 State: PUBLISHED Published: 2025-10-30T21:46:37.314Z Last Updated: 2025-11-17T18:21:40.292Z Vendors: Nagios Products: XI Problem Types: CWE-79, CWE-918 Description: Nagios XI versions prior to 5.6.11 contain unauthenticated vulnerabilities in the Highcharts local exporting tool. Crafted export requests could (1) inject script into exported/returned content due to insufficient output encoding (XSS), and (2) cause the server to fetch attacker-specified URLs (SSRF), potentially accessing internal network resources. An unauthenticated remote attacker can leverage these issues to execute script in a user's browser when the exported content is viewed and to disclose sensitiv
leverage these issues to execute script in a user's browser when the exported content is viewed and to disclose sensitive information reachable from the export server via SSRF. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/changelog/nagios-xi/ - https://www.vulncheck.com/advisories/nagios-xi-unauthenticated-xss-and-ssrf-via-highcharts
CVE ID: CVE-2020-36863 State: PUBLISHED Published: 2025-10-30T21:46:58.792Z Last Updated: 2025-11-17T18:21:40.512Z Vendors: Nagios Products: XI Problem Types: CWE-434 Description: Nagios XI versions prior to 5.7.2 allow PHP files to be uploaded to the Audio Import directory and executed from that location. The upload handler did not properly restrict file types or enforce storage outside of the webroot, and the web server permitted execution within the upload directory. An authenticated attacker with access to the audio import feature could upload a crafted PHP file and then request it to achieve remote code execution with the privileges of the application service. Additional Analyst Notes:
n request it to achieve remote code execution with the privileges of the application service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/changelog/nagios-xi/ - https://www.vulncheck.com/advisories/nagios-xi-unrestricted-file-upload-via-audio-import-directory
CVE ID: CVE-2020-36864 State: PUBLISHED Published: 2025-10-30T21:51:46.256Z Last Updated: 2025-11-17T18:21:40.687Z Vendors: Nagios Products: XI Problem Types: CWE-79 Description: Nagios XI versions prior to 5.7.2 are vulnerable to cross-site scripting (XSS) via the background color settings in Dashboards. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/changelog/nagios-xi/ - https://www.vulncheck.com/advisories/nagios-xi-xss-via-dashboard-background-color-setting
CVE ID: CVE-2020-36865 State: PUBLISHED Published: 2025-10-30T21:50:14.113Z Last Updated: 2025-11-17T18:21:40.923Z Vendors: Nagios Products: XI Problem Types: CWE-79 Description: Nagios XI versions prior to 5.7.2 are vulnerable to cross-site scripting (XSS) via the BPI (Business Process Intelligence) component’s Config Management and Edit Config page. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/changelog/nagios-xi/ - https://www.vulncheck.com/advisories/nagios-xi-xss-via-bpi-config-management
CVE ID: CVE-2020-36866 State: PUBLISHED Published: 2025-10-30T21:53:41.720Z Last Updated: 2025-11-17T18:21:41.113Z Vendors: Nagios Products: XI Problem Types: CWE-79 Description: Nagios XI versions prior to 5.7.3 are vulnerable to cross-site scripting (XSS) via the Manage Users page of the Admin interface. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/changelog/nagios-xi/ - https://www.vulncheck.com/advisories/nagios-xi-xss-via-manage-users-in-admin-interface
CVE ID: CVE-2020-36867 State: PUBLISHED Published: 2025-10-30T21:37:09.717Z Last Updated: 2025-11-17T18:21:41.306Z Vendors: Nagios Products: XI Problem Types: CWE-78 Description: Nagios XI versions prior to 5.7.3 contain a command injection vulnerability in the report PDF download/export functionality. User-supplied values used in the PDF generation pipeline or the wrapper that invokes offline/pdf helper utilities were insufficiently validated or improperly escaped, allowing an authenticated attacker who can trigger PDF exports to inject shell metacharacters or arguments. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/changelog/nagios-xi/ - https://ww
dditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/changelog/nagios-xi/ - https://www.vulncheck.com/advisories/nagios-xi-command-injection-in-report-pdf-download
CVE ID: CVE-2020-36868 State: PUBLISHED Published: 2025-10-30T21:40:03.387Z Last Updated: 2025-11-17T18:21:41.468Z Vendors: Nagios Products: XI Problem Types: CWE-73, CWE-250 Description: Nagios XI versions prior to 5.7.3 contain a privilege escalation vulnerability in the getprofile.sh helper script. The script performed profile retrieval and initialization routines using insecure file/command handling and insufficient validation of attacker-controlled inputs, and in some deployments executed with elevated privileges. A local attacker with low-level access could exploit these weaknesses to cause the script to execute arbitrary commands or modify privileged files, resulting in privilege esca
ese weaknesses to cause the script to execute arbitrary commands or modify privileged files, resulting in privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/changelog/nagios-xi/ - https://www.vulncheck.com/advisories/nagios-xi-privilege-escalation-via-insecure-getprofile-script
CVE ID: CVE-2020-36869 State: PUBLISHED Published: 2025-10-30T21:45:10.468Z Last Updated: 2025-11-17T18:21:41.647Z Vendors: Nagios Products: XI Problem Types: CWE-89 Description: Nagios XI versions prior to 5.7.5 contain a SQL injection vulnerability in the SNMP Trap Interface edit page. Exploitation requires an account with administrative privileges to access the affected interface. A user with administrative access could supply crafted input that is not properly sanitized, allowing SQL injection that may lead to unauthorized disclosure or modification of application data or execution of arbitrary SQL commands against the backend database. Additional Analyst Notes: - CISA ADP Vulnrichment:
or execution of arbitrary SQL commands against the backend database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/changelog/nagios-xi/ - https://www.vulncheck.com/advisories/nagios-xi-sqli-via-snmp-trap-interface-edit-page