Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
subishi Electric CNC M800 Series M800W, Mitsubishi Electric CNC M800 Series M800S, Mitsubishi Electric CNC M80 Series M80, Mitsubishi Electric CNC M80 Series M80W, Mitsubishi Electric CNC E80 Series E80, Mitsubishi Electric CNC M700V Series M720VW, Mitsubishi Electric CNC M700V Series M730VW, Mitsubishi Electric CNC M700V Series M750VW, Mitsubishi Electric CNC M700V Series M720VS, Mitsubishi Electric CNC M700V Series M730VS, Mitsubishi Electric CNC M700V Series M750VS, Mitsubishi Electric CNC M70V Series M70V, Mitsubishi Electric CNC E70 Series E70 Problem Types: CWE-306 Description: Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation MELSEC-F Series
scription: Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation MELSEC-F Series CPU modules, MELSEC iQ-F Series, MELSEC iQ-R series CPU modules, MELSEC iQ-R series, MELSEC iQ-L series, MELSEC Q series, MELSEC-L series, Mitsubishi Electric CNC M800V/M80V series, Mitsubishi Electric CNC M800/M80/E80 series and Mitsubishi Electric CNC M700V/M70V/E70 series allows a remote unauthenticated attacker to execute arbitrary commands by sending specific packets to the affected products. This could lead to disclose or tamper with information by reading or writing control programs, or cause a denial-of-service (DoS) condition on the products by resetting the memor
reading or writing control programs, or cause a denial-of-service (DoS) condition on the products by resetting the memory contents of the products to factory settings or resetting the products remotely. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-013_en.pdf - https://jvn.jp/vu/JVNVU94620134/ - https://www.cisa.gov/news-events/ics-advisories/icsa-23-306-03
CVE ID: CVE-2023-4700 State: PUBLISHED Published: 2023-11-06T17:30:35.198Z Last Updated: 2025-11-20T04:09:53.262Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-862 Description: An authorization issue affecting GitLab EE affecting all versions from 14.7 prior to 16.3.6, 16.4 prior to 16.4.2, and 16.5 prior to 16.5.1, allowed a user to run jobs in protected environments, bypassing any required approvals. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/421937 - https://hackerone.com/reports/2129826
CVE ID: CVE-2023-4701 State: REJECTED Published: 2023-09-13T13:20:16.033Z Last Updated: 2023-11-01T06:25:34.565Z Description: No description available.
CVE ID: CVE-2023-4702 State: PUBLISHED Published: 2023-09-14T19:01:26.533Z Last Updated: 2025-06-25T13:28:24.508Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Yepas Products: Digital Yepas Problem Types: CWE-288 Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in Yepas Digital Yepas allows Authentication Bypass.This issue affects Digital Yepas: before 1.0.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0526
CVE ID: CVE-2023-4703 State: PUBLISHED Published: 2024-01-16T15:56:47.204Z Last Updated: 2025-06-20T17:05:33.061Z Vendors: Unknown Products: All in One B2B for WooCommerce Problem Types: CWE-269 Improper Privilege Management Description: The All in One B2B for WooCommerce WordPress plugin through 1.0.3 does not properly validate parameters when updating user details, allowing an unauthenticated attacker to update the details of any user. Updating the password of an Admin user leads to privilege escalation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/83278bbb-90e6-4465-a46d-60b4c703c11a/
CVE ID: CVE-2023-4704 State: PUBLISHED Published: 2023-09-01T09:55:29.640Z Last Updated: 2024-10-01T13:12:36.669Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: instantsoft Products: instantsoft/icms2 Problem Types: CWE-15 Description: External Control of System or Configuration Setting in GitHub repository instantsoft/icms2 prior to 2.16.1-git. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/4a54134d-df1f-43d4-9b14-45f023cd654a - https://github.com/instantsoft/icms2/commit/bc22d89691fdaf38055eba13dda8d959b16fa731
CVE ID: CVE-2023-4705 State: REJECTED Published: N/A Last Updated: 2023-09-06T07:36:01.577Z Description: No description available.
CVE ID: CVE-2023-4706 State: PUBLISHED Published: 2023-11-08T21:59:24.521Z Last Updated: 2024-08-02T07:37:59.548Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: 1Lenovo Preload Directory Problem Types: CWE-276 Description: A privilege escalation vulnerability was reported in Lenovo preloaded devices deployed using Microsoft AutoPilot under a standard user account due to incorrect default privileges. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-127385
CVE ID: CVE-2023-4707 State: PUBLISHED Published: 2023-09-01T17:31:04.319Z Last Updated: 2024-08-02T07:37:59.603Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Infosoftbd Products: Clcknshop Problem Types: CWE-79 Description: A vulnerability was found in Infosoftbd Clcknshop 1.0.0. It has been declared as problematic. This vulnerability affects unknown code of the file /collection/all. The manipulation of the argument q leads to cross site scripting. The attack can be initiated remotely. VDB-238570 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Co
dor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.238570 - https://vuldb.com/?ctiid.238570 - http://packetstormsecurity.com/files/174444/Clcknshop-1.0.0-Cross-Site-Scripting.html
CVE ID: CVE-2023-4708 State: PUBLISHED Published: 2023-09-01T17:31:05.381Z Last Updated: 2024-10-01T13:10:01.160Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Infosoftbd Products: Clcknshop Problem Types: CWE-89 Description: A vulnerability was found in Infosoftbd Clcknshop 1.0.0. It has been rated as critical. This issue affects some unknown processing of the file /collection/all of the component GET Parameter Handler. The manipulation of the argument tag leads to sql injection. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-238571. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additio
bility is VDB-238571. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.238571 - https://vuldb.com/?ctiid.238571 - http://packetstormsecurity.com/files/174445/Clcknshop-1.0.0-SQL-Injection.html
CVE ID: CVE-2023-4709 State: PUBLISHED Published: 2023-09-01T18:31:04.891Z Last Updated: 2025-05-27T06:18:11.588Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: TOTVS Products: RM Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic has been found in TOTVS RM 12.1. Affected is an unknown function of the file Login.aspx of the component Portal. The manipulation of the argument VIEWSTATE leads to cross site scripting. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. It is possible to mitigate the problem by applying the configuration setting <page
ploitability is told to be difficult. It is possible to mitigate the problem by applying the configuration setting <pages validateRequest="true" [...] viewStateEncryptionMode="Always" />. It is recommended to change the configuration settings. The vendor was initially contacted early about this disclosure but did not respond in any way. In a later statement he explains, that "the behavior described [...] is related to specific configurations that are not part of the default application setup. In standard production environments, the relevant feature (VIEWSTATE) is disabled by default, which effectively mitigates the risk of exploitation." Additional Analyst Notes: - CISA ADP Vulnrichment: -
by default, which effectively mitigates the risk of exploitation." Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.238572 - https://vuldb.com/?ctiid.238572 - https://vuldb.com/?submit.196885 - https://tdn.totvs.com/pages/releaseview.action?pageId=284462425#COMOAUMENTARASEGURAN%C3%87ADESUAAPLICA%C3%87%C3%83O-Reduziron%C3%ADveldedetalhamentodemensagensexibidasparaousu%C3%A1rio
CVE ID: CVE-2023-4710 State: PUBLISHED Published: 2023-09-01T19:00:06.765Z Last Updated: 2024-08-02T07:37:59.614Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: TOTVS Products: RM Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in TOTVS RM 12.1. Affected by this vulnerability is an unknown functionality of the component Portal. The manipulation of the argument d leads to cross site scripting. The attack can be launched remotely. The identifier VDB-238573 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Progra
ly about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.238573 - https://vuldb.com/?ctiid.238573
CVE ID: CVE-2023-4711 State: PUBLISHED Published: 2023-09-01T19:00:07.967Z Last Updated: 2024-08-02T07:37:59.572Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: D-Link Products: DAR-8000-10 Problem Types: CWE-78 Description: A vulnerability, which was classified as critical, has been found in D-Link DAR-8000-10 up to 20230819. Affected by this issue is some unknown functionality of the file /log/decodmail.php. The manipulation of the argument file leads to os command injection. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used
is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. VDB-238574 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.238574 - https://vuldb.com/?ctiid.238574 - https://github.com/TinkAnet/cve/blob/main/rce.md
CVE ID: CVE-2023-4712 State: PUBLISHED Published: 2023-09-01T19:31:05.073Z Last Updated: 2024-08-02T07:38:00.595Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Xintian Products: Smart Table Integrated Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in Xintian Smart Table Integrated Management System 5.6.9. This affects an unknown part of the file /SysManage/AddUpdateRole.aspx. The manipulation of the argument txtRoleName leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-238575. NOTE: The vendor was con
d to the public and may be used. The associated identifier of this vulnerability is VDB-238575. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.238575 - https://vuldb.com/?ctiid.238575 - https://github.com/wpay65249519/cve/blob/main/SQL_injection.md
CVE ID: CVE-2023-4713 State: PUBLISHED Published: 2023-09-01T20:00:07.081Z Last Updated: 2024-08-02T07:37:59.942Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: IBOS Products: OA Problem Types: CWE-89 Description: A vulnerability has been found in IBOS OA 4.5.5 and classified as critical. This vulnerability affects the function addComment of the file ?r=weibo/comment/addcomment. The manipulation of the argument touid leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-238576. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Anal
s VDB-238576. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.238576 - https://vuldb.com/?ctiid.238576 - https://github.com/13aiZe1/cve/blob/main/sql.md
CVE ID: CVE-2023-4714 State: PUBLISHED Published: 2023-09-01T20:00:08.391Z Last Updated: 2024-08-02T07:37:59.637Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: PlayTube Problem Types: CWE-200 Description: A vulnerability was found in PlayTube 3.0.1 and classified as problematic. This issue affects some unknown processing of the component Redirect Handler. The manipulation leads to information disclosure. The attack may be initiated remotely. The identifier VDB-238577 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment:
ontacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.238577 - https://vuldb.com/?ctiid.238577 - http://packetstormsecurity.com/files/174446/PlayTube-3.0.1-Information-Disclosure.html
CVE ID: CVE-2023-4716 State: PUBLISHED Published: 2023-09-22T05:31:26.394Z Last Updated: 2025-02-05T19:27:10.166Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: dglingren Products: Media Library Assistant Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_gallery' shortcode in versions up to, and including, 3.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above per
ing on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c5f6ae5d-7854-44c7-9fb8-efaa6e850d59?source=cve - https://plugins.trac.wordpress.org/browser/media-library-assistant/trunk/includes/class-mla-shortcode-support.php?rev=2955933#L1507 - https://plugins.trac.wordpress.org/browser/media-library-assistant/trunk/includes/class-mla-shortcode-support.php?rev=2955933#L1511 - htt
rac.wordpress.org/browser/media-library-assistant/trunk/includes/class-mla-shortcode-support.php?rev=2955933#L1511 - https://plugins.trac.wordpress.org/browser/media-library-assistant/trunk/includes/class-mla-shortcode-support.php?rev=2955933#L1515 - https://plugins.trac.wordpress.org/browser/media-library-assistant/trunk/includes/class-mla-shortcode-support.php?rev=2955933#L1531 - https://plugins.trac.wordpress.org/changeset/2963256/media-library-assistant
CVE ID: CVE-2023-4717 State: REJECTED Published: N/A Last Updated: 2024-08-16T20:13:18.661Z Description: No description available.
CVE ID: CVE-2023-4718 State: PUBLISHED Published: 2023-09-02T03:28:36.715Z Last Updated: 2025-02-05T19:31:49.692Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: new-nine Products: Font Awesome 4 Menus Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Font Awesome 4 Menus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fa' and 'fa-stack' shortcodes in versions up to, and including, 4.7.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above pe
ping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dc59510c-6eaf-4526-8acb-c07e39923ad9?source=cve - https://plugins.trac.wordpress.org/browser/font-awesome-4-menus/trunk/n9m-font-awesome-4.php?rev=1526295#L197 - https://plugins.trac.wordpress.org/browser/font-awesome-4-menus/trunk/n9m-font-awesome-4.php?rev=1526295#L214
CVE ID: CVE-2023-4719 State: PUBLISHED Published: 2023-09-06T01:52:45.050Z Last Updated: 2025-02-05T19:31:26.421Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: mra13 Products: Simple Membership Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Simple Membership plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `list_type` parameter in versions up to, and including, 4.3.5 due to insufficient input sanitization and output escaping. Using this vulnerability, unauthenticated attackers could inject arbitrary web scripts into pages that are being executed if they c
vulnerability, unauthenticated attackers could inject arbitrary web scripts into pages that are being executed if they can successfully trick a user into taking an action, such as clicking a malicious link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e4b10172-7e54-4ff8-9fbb-41d160ce49e4?source=cve - https://wordpress.org/plugins/simple-membership/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2962730%40simple-membership&new=2962730%40simple-membership&sfp_email=&sfph_mail=
CVE ID: CVE-2023-4720 State: PUBLISHED Published: 2023-09-01T15:27:40.853Z Last Updated: 2024-09-19T15:36:24.017Z Severity: MEDIUM (CVSS 4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: gpac Products: gpac/gpac Problem Types: CWE-1077 Description: Floating Point Comparison with Incorrect Operator in GitHub repository gpac/gpac prior to 2.3-DEV. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/1dc2954c-8497-49fa-b2af-113e1e9381ad - https://github.com/gpac/gpac/commit/e396648e48c57e2d53988d3fd4465b068b96c89a
CVE ID: CVE-2023-4721 State: PUBLISHED Published: 2023-09-01T15:27:41.287Z Last Updated: 2024-09-19T15:36:08.879Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: gpac Products: gpac/gpac Problem Types: CWE-125 Description: Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3-DEV. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/f457dc62-3cff-47bd-8fd2-1cb2b4a832fc - https://github.com/gpac/gpac/commit/3ec93d73d048ed7b46fe6e9f307cc7a0cc13db63
CVE ID: CVE-2023-4722 State: PUBLISHED Published: 2023-09-01T15:27:41.694Z Last Updated: 2024-09-19T15:35:59.542Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: gpac Products: gpac/gpac Problem Types: CWE-190 Description: Integer Overflow or Wraparound in GitHub repository gpac/gpac prior to 2.3-DEV. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/ddfdb41d-e708-4fec-afe5-68ff1f88f830 - https://github.com/gpac/gpac/commit/de7f3a852bef72a52825fd307cf4e8f486401a76
CVE ID: CVE-2023-4723 State: PUBLISHED Published: 2023-11-15T22:32:29.259Z Last Updated: 2024-08-02T07:37:59.876Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: webtechstreet Products: Elementor Addon Elements Problem Types: CWE-862 Missing Authorization Description: The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.12.7 via the ajax_eae_post_data function. This can allow unauthenticated attackers to extract sensitive data including post/page ids and titles including those of with pending/draft/future/private status. Additional Analyst Notes: - CVE Program Container: Referen
including those of with pending/draft/future/private status. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/89489218-263f-4157-a5cd-a12bc6a0dfe6?source=cve - https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/trunk/classes/helper.php#L20 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2996185%40addon-elements-for-elementor-page-builder%2Ftrunk&old=2980987%40addon-elements-for-elementor-page-builder%2Ftrunk&sfp_email=&sfph_mail=#file15
CVE ID: CVE-2023-4724 State: PUBLISHED Published: 2023-12-18T20:08:04.057Z Last Updated: 2025-05-20T17:58:39.497Z Vendors: Unknown Products: Export any WordPress data to XML/CSV, WP All Export Pro Problem Types: CWE-94 Improper Control of Generation of Code ('Code Injection') Description: The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not validate and sanitise the `wp_query` parameter which allows an attacker to run arbitrary command on the remote server Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/48820f1d-45cb-4f1f-990d-d132bfc5536f
CVE ID: CVE-2023-4725 State: PUBLISHED Published: 2023-10-16T19:39:20.180Z Last Updated: 2025-04-23T12:59:17.772Z Vendors: Unknown Products: Simple Posts Ticker Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Simple Posts Ticker WordPress plugin before 1.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e9b9a594-c960-4692-823e-23fc60cca7e7
CVE ID: CVE-2023-4726 State: PUBLISHED Published: 2023-11-22T15:33:28.869Z Last Updated: 2024-08-02T07:37:59.604Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: davidvongries Products: Ultimate Dashboard – Custom WordPress Dashboard Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Ultimate Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 3.7.7. due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to