Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-2010 State: PUBLISHED Published: 2023-07-04T07:23:26.428Z Last Updated: 2024-11-22T16:40:36.421Z Vendors: Unknown Products: Forminator Problem Types: CWE-362 Race Condition (Concurrent Execution using Shared Resource with Improper Synchronization) Description: The Forminator WordPress plugin before 1.24.1 does not use an atomic operation to check whether a user has already voted, and then update that information. This leads to a Race Condition that may allow a single user to vote multiple times on a poll. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d0da4c0d-622f-4310-a867-6bfdb474073a
CVE ID: CVE-2023-2013 State: PUBLISHED Published: 2023-06-07T00:00:00 Last Updated: 2025-01-07T16:50:56.690Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Vulnerability in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 1.2 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An issue was found that allows someone to abuse a discrepancy between the Web application display and the git command line interface to social engineer victims into cloning non-trusted code. Additional Analyst Notes: - CVE Program Contain
line interface to social engineer victims into cloning non-trusted code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/406844 - https://hackerone.com/reports/1940441 - https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2013.json
CVE ID: CVE-2023-2014 State: PUBLISHED Published: 2023-04-13T00:00:00.000Z Last Updated: 2025-02-06T21:39:55.887Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:L) Vendors: microweber Products: microweber/microweber Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Generic in GitHub repository microweber/microweber prior to 1.3.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/a77bf7ed-6b61-452e-b5ee-e20017e28d1a - https://github.com/microweber/microweber/commit/1a9b904722b35b00653c6ae72dca2969149159b3
CVE ID: CVE-2023-2015 State: PUBLISHED Published: 2023-06-07T00:00:00 Last Updated: 2025-01-07T16:48:03.485Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.8 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A reflected XSS was possible when creating new abuse reports which allows attackers to perform arbitrary actions on behalf of victims. Additional Analyst Notes: -
new abuse reports which allows attackers to perform arbitrary actions on behalf of victims. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/407137 - https://hackerone.com/reports/1941091 - https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2015.json
CVE ID: CVE-2023-2017 State: PUBLISHED Published: 2023-04-17T10:18:27.543Z Last Updated: 2025-02-05T20:46:43.936Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Shopware AG Products: Shopware 6 Problem Types: CWE-184, CWE-1336 Description: Server-side Template Injection (SSTI) in Shopware 6 (<= v6.4.20.0, v6.5.0.0-rc1 <= v6.5.0.0-rc4), affecting both shopware/core and shopware/platform GitHub repositories, allows remote attackers with access to a Twig environment without the Sandbox extension to bypass the validation checks in `Shopware\Core\Framework\Adapter\Twig\SecurityExtension` and call any arbitrary PHP function and thus execute arbitrary code/commands
\Framework\Adapter\Twig\SecurityExtension` and call any arbitrary PHP function and thus execute arbitrary code/commands via usage of fully-qualified names, supplied as array of strings, when referencing callables. Users are advised to upgrade to v6.4.20.1 to resolve this issue. This is a bypass of CVE-2023-22731. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2023 - https://github.com/shopware/platform/security/advisories/GHSA-7v2v-9rm4-7m8f - https://starlabs.sg/advisories/23/23-2017/
CVE ID: CVE-2023-2019 State: PUBLISHED Published: 2023-04-24T00:00:00.000Z Last Updated: 2025-03-18T19:17:56.031Z Vendors: n/a Products: Linux kernel's netdevsim device driver Problem Types: CWE-911 Description: A flaw was found in the Linux kernel's netdevsim device driver, within the scheduling of events. This issue results from the improper management of a reference count. This may allow an attacker to create a denial of service condition on the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2189137 - https://www.zerodayinitiative.com/advisories/ZDI-CAN-17811/ - https://github.com/torvalds/linux
how_bug.cgi?id=2189137 - https://www.zerodayinitiative.com/advisories/ZDI-CAN-17811/ - https://github.com/torvalds/linux/commit/180a6a3ee60a
CVE ID: CVE-2023-2020 State: PUBLISHED Published: 2023-04-18T11:09:09.107Z Last Updated: 2025-02-05T15:48:19.218Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Tribe29 Products: Checkmk Problem Types: CWE-280 Description: Insufficient permission checks in the REST API in Tribe29 Checkmk <= 2.1.0p27 and <= 2.2.0b4 (beta) allow unauthorized users to schedule downtimes for any host. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://checkmk.com/werk/13981
CVE ID: CVE-2023-2021 State: PUBLISHED Published: 2023-04-13T00:00:00.000Z Last Updated: 2025-02-06T21:31:37.019Z Severity: MEDIUM (CVSS 5.8 CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L) Vendors: nilsteampassnet Products: nilsteampassnet/teampass Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/2e31082d-7aeb-46ff-84d6-9561758e3bf0 - https://github.com/nilsteampassnet/teampass/commit/77c541a0151841d1f4ceb0a84ca391e1b526d58d
CVE ID: CVE-2023-2022 State: PUBLISHED Published: 2023-08-02T08:30:58.187Z Last Updated: 2025-11-20T04:06:33.293Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-262 Description: An issue has been discovered in GitLab CE/EE affecting all versions starting before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2, which leads to developers being able to create pipeline schedules on protected branches even if they don't have access to merge Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/i
Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/407166 - https://hackerone.com/reports/1936572
CVE ID: CVE-2023-2023 State: PUBLISHED Published: 2023-05-30T07:49:21.025Z Last Updated: 2025-01-09T18:53:08.268Z Vendors: Unknown Products: Custom 404 Pro Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Custom 404 Pro WordPress plugin before 3.7.3 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8859843a-a8c2-4f7a-8372-67049d6ea317
CVE ID: CVE-2023-2024 State: PUBLISHED Published: 2023-05-18T20:45:01.376Z Last Updated: 2025-02-12T16:27:08.247Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: Johnson Controls Products: OpenBlue Enterprise Manager Data Collector Problem Types: CWE-287 Description: Improper authentication in OpenBlue Enterprise Manager Data Collector versions prior to 3.2.5.75 allow access to an unauthorized user under certain circumstances. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.johnsoncontrols.com/cyber-solutions/security-advisories - https://www.cisa.gov/news-events/ics-advisories/icsa-23-138-04
CVE ID: CVE-2023-2025 State: PUBLISHED Published: 2023-05-18T20:50:36.726Z Last Updated: 2025-02-12T16:27:48.194Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: Johnson Controls Products: OpenBlue Enterprise Manager Data Collector Problem Types: CWE-200 Description: OpenBlue Enterprise Manager Data Collector versions prior to 3.2.5.75 may expose sensitive information to an unauthorized user under certain circumstances. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.johnsoncontrols.com/cyber-solutions/security-advisories - https://www.cisa.gov/news-events/ics-advisories/icsa-23-138-04
CVE ID: CVE-2023-2026 State: PUBLISHED Published: 2023-07-10T12:40:26.105Z Last Updated: 2024-08-02T06:12:19.742Z Vendors: Unknown Products: Image Protector Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Image Protector WordPress plugin through 1.1 does not properly sanitize some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/2b59f640-5568-42bb-87b7-36eb448db5be
CVE ID: CVE-2023-2027 State: PUBLISHED Published: 2023-04-15T07:42:23.833Z Last Updated: 2025-01-13T16:51:29.874Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: zanematthew Products: ZM Ajax Login & Register Problem Types: CWE-288 Authentication Bypass Using an Alternate Path or Channel Description: The ZM Ajax Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.2. This is due to insufficient verification on the user being supplied during a Facebook login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrato
This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b10d01ec-54ef-456b-9410-ed013343a962?source=cve - https://plugins.trac.wordpress.org/browser/zm-ajax-login-register/trunk/src/ALRSocial/ALRSocialFacebook.php#L58
CVE ID: CVE-2023-2028 State: PUBLISHED Published: 2023-07-10T12:40:57.309Z Last Updated: 2024-08-02T06:12:19.552Z Vendors: Unknown Products: Call Now Accessibility Button Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Call Now Accessibility Button WordPress plugin before 1.1 does not properly sanitize some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0f1c1f1c-acdd-4c8a-bd5e-a21f4915e69f
CVE ID: CVE-2023-2029 State: PUBLISHED Published: 2023-07-10T12:41:01.067Z Last Updated: 2025-02-13T16:39:46.178Z Vendors: Unknown Products: PrePost SEO Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The PrePost SEO WordPress plugin through 3.0 does not properly sanitize some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/4889ad5a-c8c4-4958-b176-64560490497b - http://packetstormsecurity.com/files/173729/WordPress-PrePost-SEO-3.0-Cros
bility/4889ad5a-c8c4-4958-b176-64560490497b - http://packetstormsecurity.com/files/173729/WordPress-PrePost-SEO-3.0-Cross-Site-Scripting.html
CVE ID: CVE-2023-2030 State: PUBLISHED Published: 2024-01-12T13:57:06.694Z Last Updated: 2025-11-20T04:06:38.255Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-347 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 12.2 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which an attacker could potentially modify the metadata of signed commits. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/407252 - https://hackerone.com/reports/1929929
CVE ID: CVE-2023-2031 State: PUBLISHED Published: 2023-06-09T05:33:35.642Z Last Updated: 2024-11-23T13:18:21.397Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: plainware Products: Locatoraid Store Locator Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Locatoraid Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 3.9.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above p
aping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dba0a90b-f13c-4914-b6b7-278227ffc122?source=cve - https://plugins.trac.wordpress.org/browser/locatoraid/trunk/modules/front/view_shortcode.php#L4 - https://plugins.trac.wordpress.org/changeset/2900106/locatoraid
CVE ID: CVE-2023-2032 State: PUBLISHED Published: 2023-06-27T13:17:14.009Z Last Updated: 2024-11-27T19:39:19.913Z Vendors: Unknown Products: Custom 404 Pro Problem Types: CWE-89 SQL Injection Description: The Custom 404 Pro WordPress plugin before 3.8.1 does not properly sanitize database inputs, leading to multiple SQL Injection vulnerabilities. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/17acde5d-44ea-4e77-8670-260d22e28ffe
CVE ID: CVE-2023-2033 State: PUBLISHED Published: 2023-04-14T18:10:15.157Z Last Updated: 2025-10-21T23:05:48.998Z Vendors: Google Products: Chrome Problem Types: Type Confusion Description: Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop_14.html - https://crbug.com/1432210 - https://www.couchbase.com/alerts/ - https://www.debian.org/security/2023/dsa-5390 - https://lists.fedoraproject.org
10 - https://www.couchbase.com/alerts/ - https://www.debian.org/security/2023/dsa-5390 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FEJZMAUB4XP44HSHEBDWEKFGA7DUHY42/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4AOSGAOPXLBK4A5ZRTVZ4M6QKVLSWMWG/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJQI63HWZFL6M26Q6UOHKDY6LD2PFC5Z/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHHD6KNH4WLUE6JG6HRQZWNAJMHJ32X7/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/
D6KNH4WLUE6JG6HRQZWNAJMHJ32X7/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SLO7BL2MHZYPY6O3OAEAQL3SKYMGGO6M/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ES2CDRHR2Y4WY6DNDIAPYZFXJU3ZBFAV/ - https://security.gentoo.org/glsa/202309-17
CVE ID: CVE-2023-2034 State: PUBLISHED Published: 2023-04-14T00:00:00.000Z Last Updated: 2025-02-06T21:01:27.259Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: froxlor Products: froxlor/froxlor Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type in GitHub repository froxlor/froxlor prior to 2.0.14. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/aba6beaa-570e-4523-8128-da4d8e374ef6 - https://github.com/froxlor/froxlor/commit/f36bc61fc74c85a21c8d31448198b11f96eb3bc6
CVE ID: CVE-2023-2035 State: PUBLISHED Published: 2023-04-14T06:31:03.450Z Last Updated: 2024-08-02T06:12:20.062Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Campcodes Products: Video Sharing Website Problem Types: CWE-89 Description: A vulnerability has been found in Campcodes Video Sharing Website 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file signup.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-225913 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Contai
ay be used. The identifier VDB-225913 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.225913 - https://vuldb.com/?ctiid.225913 - https://github.com/E1CHO/cve_hub/blob/main/Video%20Sharing%20Website/Video%20Sharing%20Website%20vuln%203.pdf
CVE ID: CVE-2023-2036 State: PUBLISHED Published: 2023-04-14T07:00:07.188Z Last Updated: 2024-08-02T06:12:19.896Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Campcodes Products: Video Sharing Website Problem Types: CWE-89 Description: A vulnerability was found in Campcodes Video Sharing Website 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file upload.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-225914 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: Referen
VDB-225914 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.225914 - https://vuldb.com/?ctiid.225914 - https://github.com/E1CHO/cve_hub/blob/main/Video%20Sharing%20Website/Video%20Sharing%20Website%20vuln%204.pdf
CVE ID: CVE-2023-2037 State: PUBLISHED Published: 2023-04-14T07:31:03.421Z Last Updated: 2024-11-22T16:19:07.302Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Campcodes Products: Video Sharing Website Problem Types: CWE-89 Description: A vulnerability was found in Campcodes Video Sharing Website 1.0. It has been classified as critical. This affects an unknown part of the file watch.php. The manipulation of the argument code leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-225915. Additional Analyst Notes: - CVE Program Container: - CISA A
e associated identifier of this vulnerability is VDB-225915. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.225915 - https://vuldb.com/?ctiid.225915 - https://github.com/E1CHO/cve_hub/blob/main/Video%20Sharing%20Website/Video%20Sharing%20Website%20vuln%201.pdf
CVE ID: CVE-2023-2038 State: PUBLISHED Published: 2023-04-14T07:31:04.480Z Last Updated: 2024-08-02T06:12:19.876Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Campcodes Products: Video Sharing Website Problem Types: CWE-89 Description: A vulnerability was found in Campcodes Video Sharing Website 1.0. It has been declared as critical. This vulnerability affects unknown code of the file admin_class.php. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-225916. Additional Analyst Notes: - CVE Program Container: References: -
ed. The identifier of this vulnerability is VDB-225916. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.225916 - https://vuldb.com/?ctiid.225916 - https://github.com/E1CHO/cve_hub/blob/main/Video%20Sharing%20Website/Video%20Sharing%20Website%20vuln%202.pdf
CVE ID: CVE-2023-2039 State: PUBLISHED Published: 2023-04-14T08:00:05.391Z Last Updated: 2025-02-06T20:01:23.919Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: novel-plus Problem Types: CWE-89 Description: A vulnerability was found in novel-plus 3.6.2. It has been rated as critical. This issue affects some unknown processing of the file /author/list?limit=10&offset=0&order=desc. The manipulation of the argument sort leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-225917 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but di
ntifier VDB-225917 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.225917 - https://vuldb.com/?ctiid.225917 - https://github.com/yece688/yece/blob/main/Novel-Plus%20Code%20audit2.0.pdf
CVE ID: CVE-2023-2040 State: PUBLISHED Published: 2023-04-14T08:31:03.374Z Last Updated: 2024-08-02T06:12:19.947Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: novel-plus Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in novel-plus 3.6.2. Affected is an unknown function of the file /news/list?limit=10&offset=0&order=desc. The manipulation of the argument sort leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-225918 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not res
he identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.225918 - https://vuldb.com/?ctiid.225918 - https://github.com/morty-py/morty/blob/main/Novel-Plus3.6.2%20sqli.pdf
CVE ID: CVE-2023-2041 State: PUBLISHED Published: 2023-04-14T09:00:06.961Z Last Updated: 2025-02-06T19:52:45.149Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: novel-plus Problem Types: CWE-89 Description: A vulnerability classified as critical was found in novel-plus 3.6.2. Affected by this vulnerability is an unknown functionality of the file /category/list?limit=10&offset=0&order=desc. The manipulation of the argument sort leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-225919. NOTE: The vendor was contacted early about this disclos