Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-47522 State: PUBLISHED Published: 2023-04-15T00:00:00.000Z Last Updated: 2025-02-06T15:54:53.804Z Vendors: n/a Products: n/a Problem Types: n/a Description: The IEEE 802.11 specifications through 802.11ax allow physically proximate attackers to intercept (possibly cleartext) target-destined frames by spoofing a target's MAC address, sending Power Save frames to the access point, and then sending other frames to the access point (such as authentication frames or re-association frames) to remove the target's original security context. This behavior occurs because the specifications do not require an access point to purge its transmit queue before removing a client's pairwise e
ause the specifications do not require an access point to purge its transmit queue before removing a client's pairwise encryption key. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wi-fi.org/discover-wi-fi/passpoint - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0006 - https://papers.mathyvanhoef.com/usenix2023-wifi.pdf - https://www.freebsd.org/security/advisories/FreeBSD-SA-23:11.wifi.asc
CVE ID: CVE-2022-47523 State: PUBLISHED Published: 2023-01-05T00:00:00.000Z Last Updated: 2025-04-09T20:47:59.248Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Access Manager Plus before 4309, Password Manager Pro before 12210, and PAM360 before 5801 are vulnerable to SQL Injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/privileged-session-management/advisory/cve-2022-47523.html
CVE ID: CVE-2022-47524 State: PUBLISHED Published: 2022-12-23T00:00:00.000Z Last Updated: 2025-04-15T03:26:42.162Z Vendors: n/a Products: n/a Problem Types: n/a Description: F-Secure SAFE Browser 19.1 before 19.2 for Android allows an IDN homograph attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.f-secure.com/en/home/support/security-advisories/cve-2022-47524
CVE ID: CVE-2022-47525 State: PUBLISHED Published: 2023-05-30T00:00:00 Last Updated: 2025-01-14T17:05:46.876Z Vendors: n/a Products: n/a Problem Types: n/a Description: Fox-IT DataDiode (aka Fox DataDiode) 3.4.3 suffers from a Divide-by-Zero vulnerability in the packet parser. A remote attacker could leverage this vulnerability to cause a denial-of-service. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.fox-it.com/nl-en/fox-crypto/fox-datadiode/ - https://www.fox-it.com/nl-en/software-vulnerability-report/
CVE ID: CVE-2022-47526 State: PUBLISHED Published: 2023-05-30T00:00:00 Last Updated: 2025-01-14T16:55:56.879Z Vendors: n/a Products: n/a Problem Types: n/a Description: Fox-IT DataDiode (aka Fox DataDiode) 3.4.3 suffers from a path traversal vulnerability with resultant arbitrary writing of files. A remote attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the downstream node user. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.fox-it.com/nl-en/fox-crypto/fox-datadiode/ - https://www.fox-it.com/nl-en/software-vulnerability-report/
CVE ID: CVE-2022-47529 State: PUBLISHED Published: 2023-03-28T00:00:00 Last Updated: 2024-08-03T14:55:08.330Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure Win32 memory objects in Endpoint Windows Agents in RSA NetWitness Platform before 12.2 allow local and admin Windows user accounts to modify the endpoint agent service configuration: to either disable it completely or run user-supplied code or commands, thereby bypassing tamper-protection features via ACL modification. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/hyp3rlinx/status/1639335477839790105 - https://hyp3rlinx.altervista.org/advisories/RSA_NETWITNESS_EDR_AGENT_INCORREC
com/hyp3rlinx/status/1639335477839790105 - https://hyp3rlinx.altervista.org/advisories/RSA_NETWITNESS_EDR_AGENT_INCORRECT_ACCESS_CONTROL_CVE-2022-47529.txt - https://packetstormsecurity.com/files/171476/RSA-NetWitness-Endpoint-EDR-Agent-12.x-Incorrect-Access-Control-Code-Execution.html - https://seclists.org/fulldisclosure/2023/Mar/16 - https://community.netwitness.com/t5/netwitness-platform-security/nw-2023-04-netwitness-platform-security-advisory-cve-2022-47529/ta-p/696935 - http://seclists.org/fulldisclosure/2023/Mar/26 - https://github.com/hyp3rlinx/CVE-2022-47529 - http://seclists.org/fulldisclosure/2024/Apr/17
CVE ID: CVE-2022-47531 State: PUBLISHED Published: 2023-12-05T00:00:00 Last Updated: 2024-08-03T14:55:08.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Ericsson Evolved Packet Gateway (EPG) versions 3.x before 3.25 and 2.x before 2.16, allows authenticated users to bypass system CLI and execute commands they are authorized to execute directly in the UNIX shell. Additional Analyst Notes: - CVE Program Container: References: - https://www.gruppotim.it/it/footer/red-team.html
CVE ID: CVE-2022-47532 State: PUBLISHED Published: 2023-12-22T00:00:00 Last Updated: 2024-08-03T14:55:08.181Z Vendors: n/a Products: n/a Problem Types: n/a Description: FileRun 20220519 allows SQL Injection via the "dir" parameter in a /?module=users&section=cpanel&page=list request. Additional Analyst Notes: - CVE Program Container: References: - https://herolab.usd.de/security-advisories/usd-2022-0064/
CVE ID: CVE-2022-47542 State: PUBLISHED Published: 2023-03-30T00:00:00.000Z Last Updated: 2025-02-18T19:07:50.660Z Vendors: n/a Products: n/a Problem Types: n/a Description: Red Gate SQL Monitor 11.0.14 through 12.1.46 has Incorrect Access Control, exploitable remotely for Escalation of Privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://red-gate.com - https://www.red-gate.com/privacy-and-security/vulnerabilities/2023-01-31-sql-monitor
CVE ID: CVE-2022-47543 State: PUBLISHED Published: 2023-01-05T00:00:00.000Z Last Updated: 2025-04-10T14:35:51.694Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Siren Investigate before 12.1.7. There is an ACL bypass on global objects. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.support.siren.io/siren-platform-user-guide/12.1/release-notes.html - https://docs.support.siren.io/siren-platform-user-guide/13.0/release-notes.html
CVE ID: CVE-2022-47544 State: PUBLISHED Published: 2023-01-05T00:00:00.000Z Last Updated: 2025-04-10T14:32:58.178Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Siren Investigate before 12.1.7. Script variable whitelisting is insufficiently sandboxed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.support.siren.io/siren-platform-user-guide/12.1/release-notes.html - https://docs.support.siren.io/siren-platform-user-guide/13.0/release-notes.html
CVE ID: CVE-2022-47547 State: PUBLISHED Published: 2022-12-19T00:00:00.000Z Last Updated: 2025-04-17T14:05:53.729Z Vendors: n/a Products: n/a Problem Types: n/a Description: GossipSub 1.1, as used for Ethereum 2.0, allows a peer to maintain a positive score (and thus not be pruned from the network) even though it continuously misbehaves by never forwarding topic messages. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://arxiv.org/pdf/2212.05197.pdf
CVE ID: CVE-2022-47549 State: PUBLISHED Published: 2022-12-19T00:00:00.000Z Last Updated: 2025-04-17T14:02:55.292Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unprotected memory-access operation in optee_os in TrustedFirmware Open Portable Trusted Execution Environment (OP-TEE) before 3.20 allows a physically proximate adversary to bypass signature verification and install malicious trusted applications via electromagnetic fault injections. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OP-TEE/optee_os/security/advisories/GHSA-r64m-h886-hw6g - https://people.linaro.org/~joakim.bech/reports/Breaking_cross-world_is
ptee_os/security/advisories/GHSA-r64m-h886-hw6g - https://people.linaro.org/~joakim.bech/reports/Breaking_cross-world_isolation_on_ARM_TrustZone_through_EM_faults_coredumps_and_UUID_confusion.pdf
CVE ID: CVE-2022-47551 State: PUBLISHED Published: 2022-12-19T00:00:00.000Z Last Updated: 2025-04-17T14:24:12.467Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apiman 1.5.7 through 2.2.3.Final has insufficient checks for read permissions within the Apiman Manager REST API. The root cause of the issue is the Apiman project's accidental acceptance of a large contribution that was not fully compatible with the security model of Apiman versions before 3.0.0.Final. Because of this, 3.0.0.Final is not affected by the vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.github.com/apiman/apiman - https://www.apiman.io/blo
ogram Container: - CISA ADP Vulnrichment: References: - https://www.github.com/apiman/apiman - https://www.apiman.io/blog/permissions-bypass-disclosure/
CVE ID: CVE-2022-47553 State: PUBLISHED Published: 2023-09-19T12:30:05.573Z Last Updated: 2024-08-29T20:12:45.964Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Ormazabal Products: ekorCCP, ekorRCI Problem Types: CWE-285 Description: Incorrect authorisation in ekorCCP and ekorRCI, which could allow a remote attacker to obtain resources with sensitive information for the organisation, without being authenticated within the web server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-ormazabal-products
CVE ID: CVE-2022-47554 State: PUBLISHED Published: 2023-09-19T12:35:56.087Z Last Updated: 2024-08-03T14:55:08.187Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Ormazabal Products: ekorCCP, ekorRCI Problem Types: CWE-200 Description: Exposure of sensitive information in ekorCCP and ekorRCI, potentially allowing a remote attacker to obtain critical information from various .xml files, including .xml files containing credentials, without being authenticated within the web server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-ormazabal-pro
m Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-ormazabal-products
CVE ID: CVE-2022-47555 State: PUBLISHED Published: 2023-09-19T12:47:13.368Z Last Updated: 2024-08-03T14:55:08.185Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N) Vendors: Ormazabal Products: ekorCCP, ekorRCI Problem Types: CWE-78 Description: Operating system command injection in ekorCCP and ekorRCI, which could allow an authenticated attacker to execute commands, create new users with elevated privileges or set up a backdoor. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-ormazabal-products
CVE ID: CVE-2022-47556 State: PUBLISHED Published: 2023-09-19T12:51:19.837Z Last Updated: 2024-08-03T14:55:08.319Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Ormazabal Products: ekorRCI Problem Types: CWE-400 Description: Uncontrolled resource consumption in ekorRCI, allowing an attacker with low-privileged access to the web server to send continuous legitimate web requests to a functionality that is not properly validated, in order to cause a denial of service (DoS) on the device. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-orma
VE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-ormazabal-products
CVE ID: CVE-2022-47557 State: PUBLISHED Published: 2023-09-19T12:54:52.788Z Last Updated: 2024-08-03T14:55:08.383Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: Ormazabal Products: ekorCCP, ekorRCI Problem Types: CWE-916 Description: Vulnerability in ekorCCP and ekorRCI that could allow an attacker with access to the network where the device is located to decrypt the credentials of privileged users, and subsequently gain access to the system to perform malicious actions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-ormazabal-products
CVE ID: CVE-2022-47558 State: PUBLISHED Published: 2023-09-19T12:58:48.452Z Last Updated: 2024-08-03T14:55:08.506Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: Ormazabal Products: ekorCCP, ekorRCI Problem Types: CWE-284 Description: Devices ekorCCP and ekorRCI are vulnerable due to access to the FTP service using default credentials. Exploitation of this vulnerability can allow an attacker to modify critical files that could allow the creation of new users, delete or modify existing users, modify configuration files, install rootkits or backdoors. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incib
r backdoors. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-ormazabal-products
CVE ID: CVE-2022-47559 State: PUBLISHED Published: 2023-09-19T13:00:59.770Z Last Updated: 2024-08-03T14:55:08.191Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: Ormazabal Products: ekorCCP, ekorRCI Problem Types: CWE-352 Description: Lack of device control over web requests in ekorCCP and ekorRCI, allowing an attacker to create customised requests to execute malicious actions when a user is logged in, affecting availability, privacy and integrity. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-ormazabal-products
CVE ID: CVE-2022-47560 State: PUBLISHED Published: 2023-09-20T07:52:33.173Z Last Updated: 2025-06-18T14:27:40.985Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Ormazabal Products: ekorCCP, ekorRCI Problem Types: CWE-319 Description: The lack of web request control on ekorCCP and ekorRCI devices allows a potential attacker to create custom requests to execute malicious actions when a user is logged in. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-ormazabal-products
CVE ID: CVE-2022-47561 State: PUBLISHED Published: 2023-09-20T07:54:53.890Z Last Updated: 2024-09-24T18:06:23.610Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: Ormazabal Products: ekorCCP, ekorRCI Problem Types: CWE-256 Description: The web application stores credentials in clear text in the "admin.xml" file, which can be accessed without logging into the website, which could allow an attacker to obtain credentials related to all users, including admin users, in clear text, and use them to subsequently execute malicious actions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/not
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-ormazabal-products
CVE ID: CVE-2022-47562 State: PUBLISHED Published: 2023-09-20T07:56:29.612Z Last Updated: 2024-09-24T19:14:56.262Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Ormazabal Products: ekorCCP, ekorRCI Problem Types: CWE-770 Description: Vulnerability in the RCPbind service running on UDP port (111), allowing a remote attacker to create a denial of service (DoS) condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-ormazabal-products
CVE ID: CVE-2022-47577 State: PUBLISHED Published: 2022-12-20T00:00:00 Last Updated: 2024-08-03T14:55:08.395Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AC:L/AV:L/A:N/C:H/I:H/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. Despite configuring complete restrictions on USB pendrives, USB HDD devices, memory cards, USB connections to mobile devices, etc., it is still possible to bypass the USB restrictions by making use of a virtual machine (VM). This allows a file to be exchanged outside the laptop/system. VMs can be created by any user (even without admin rights). T
s allows a file to be exchanged outside the laptop/system. VMs can be created by any user (even without admin rights). The data exfiltration can occur without any record in the audit trail of Windows events on the host machine. NOTE: the vendor's position is "it's not a vulnerability in our product." Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://medium.com/nestedif/vulnerability-disclosure-business-logic-unauthorized-data-exfiltration-bypassing-dlp-zoho-cc51465ba84a - https://www.manageengine.com/device-control/how-to/device-control.html
CVE ID: CVE-2022-47578 State: PUBLISHED Published: 2022-12-20T00:00:00 Last Updated: 2024-08-03T14:55:08.365Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AC:L/AV:L/A:N/C:H/I:H/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. Despite configuring complete restrictions on USB pendrives, USB HDD devices, memory cards, USB connections to mobile devices, etc., it is still possible to bypass the USB restrictions by booting into Safe Mode. This allows a file to be exchanged outside the laptop/system. Safe Mode can be launched by any user (even without admin rights). Data exf
e to be exchanged outside the laptop/system. Safe Mode can be launched by any user (even without admin rights). Data exfiltration can occur, and also malware might be introduced onto the system. NOTE: the vendor's position is "it's not a vulnerability in our product." Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://medium.com/nestedif/vulnerability-disclosure-business-logic-unauthorized-data-exfiltration-bypassing-dlp-zoho-cc51465ba84a - https://www.manageengine.com/device-control/how-to/device-control.html
CVE ID: CVE-2022-47581 State: PUBLISHED Published: 2022-12-21T00:00:00.000Z Last Updated: 2025-04-16T17:34:57.323Z Vendors: n/a Products: n/a Problem Types: n/a Description: Isode M-Vault 16.0v0 through 17.x before 17.0v24 can crash upon an LDAP v1 bind request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.isode.com/support/security/advisory/m-vault-denial-of-service-21-12-2022.html
CVE ID: CVE-2022-47583 State: PUBLISHED Published: 2023-10-19T00:00:00 Last Updated: 2024-09-12T20:48:32.197Z Vendors: n/a Products: n/a Problem Types: n/a Description: Terminal character injection in Mintty before 3.6.3 allows code execution via unescaped output to the terminal. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mintty/mintty/releases/tag/3.6.3 - https://dgl.cx/2023/09/ansi-terminal-security#mintty
CVE ID: CVE-2022-47586 State: PUBLISHED Published: 2023-06-19T11:58:10.394Z Last Updated: 2024-10-18T14:31:44.716Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:L) Vendors: Themefic Products: Ultimate Addons for Contact Form 7 Problem Types: CWE-89 Description: Unauth. SQL Injection (SQLi) vulnerability in Themefic Ultimate Addons for Contact Form 7 plugin <= 3.1.23 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/ultimate-addons-for-contact-form-7/wordpress-ultimate-addons-for-contact-form-7-plugin-3-1-23-sql-injection?_s_id=cve
CVE ID: CVE-2022-47587 State: PUBLISHED Published: 2023-05-10T10:59:47.514Z Last Updated: 2025-02-19T21:30:39.003Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Cornel Raiu Products: WP Search Analytics Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Cornel Raiu WP Search Analytics plugin <= 1.4.5 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/search-analytics/wordpress-wp-search-analytics-plugin-1-4-5-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2022-47588 State: PUBLISHED Published: 2023-11-03T11:14:44.358Z Last Updated: 2024-09-05T15:25:40.681Z Vendors: Tips and Tricks HQ, Peter Petreski Products: Simple Photo Gallery Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tips and Tricks HQ, Peter Petreski Simple Photo Gallery simple-photo-gallery allows SQL Injection.This issue affects Simple Photo Gallery: from n/a through v1.8.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/simple-photo-gallery/wordpress-simple-photo-gallery-plugin-v1-8-1-sql-inj
https://patchstack.com/database/vulnerability/simple-photo-gallery/wordpress-simple-photo-gallery-plugin-v1-8-1-sql-injection?_s_id=cve
CVE ID: CVE-2022-47589 State: PUBLISHED Published: 2023-03-23T14:48:01.362Z Last Updated: 2025-01-10T19:16:54.470Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: this.functional Products: CTT Expresso para WooCommerce Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in this.Functional CTT Expresso para WooCommerce plugin <= 3.2.11 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/ctt-expresso-para-woocommerce/wordpress-ctt-expresso-para-woocommerce-plugin-3-2-11-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2022-47590 State: PUBLISHED Published: 2023-05-10T10:54:34.533Z Last Updated: 2025-01-09T15:18:01.479Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Fugu Products: Maintenance Switch Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Fugu Maintenance Switch plugin <= 1.5.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/maintenance-switch/wordpress-maintenance-switch-plugin-1-5-2-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2022-47591 State: PUBLISHED Published: 2023-03-20T12:06:40.484Z Last Updated: 2025-01-10T19:18:57.537Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Mickael Austoni Products: Map Multi Marker Problem Types: CWE-79 Description: Reflected Cross-Site Scripting (XSS) vulnerability in Mickael Austoni Map Multi Marker plugin <= 3.2.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/map-multi-marker/wordpress-map-multi-marker-plugin-3-2-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve