Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-6604 State: PUBLISHED Published: 2025-01-06T16:41:42.345Z Last Updated: 2025-11-03T19:29:03.485Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Problem Types: CWE-99 Description: A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2334337
CVE ID: CVE-2023-6605 State: PUBLISHED Published: 2025-01-06T16:42:04.611Z Last Updated: 2025-11-03T19:29:04.870Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Problem Types: CWE-99 Description: A flaw was found in FFmpeg's DASH playlist support. This vulnerability allows arbitrary HTTP GET requests to be made on behalf of the machine running FFmpeg via a crafted DASH playlist containing malicious URLs. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2334336
CVE ID: CVE-2023-6606 State: PUBLISHED Published: 2023-12-08T16:58:08.746Z Last Updated: 2025-11-08T07:10:24.326Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Virtualization 4 for Red Hat Enterprise Linux 8, RHOL-5.8-RHEL-9, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-125 Description: An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kern
5 Description: An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:0723 - https://access.redhat.com/errata/RHSA-2024:0725 - https://access.redhat.com/errata/RHSA-2024:0881 - https://access.redhat.com/errata/RHSA-2024:0897 - https://access.redhat.com/errata/RHSA-2024:1188 - https://access.redhat.com/errata/RHSA-2024:1248 - https://access.redhat.com/errata/RHSA-2024:1404 - https://access.redhat.com/errata/RHSA-2
at.com/errata/RHSA-2024:1248 - https://access.redhat.com/errata/RHSA-2024:1404 - https://access.redhat.com/errata/RHSA-2024:2094 - https://access.redhat.com/security/cve/CVE-2023-6606 - https://bugzilla.kernel.org/show_bug.cgi?id=218218 - https://bugzilla.redhat.com/show_bug.cgi?id=2253611
CVE ID: CVE-2023-6607 State: PUBLISHED Published: 2023-12-08T14:00:07.778Z Last Updated: 2024-08-02T08:35:14.816Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Tongda Products: OA 2017 Problem Types: CWE-89 Description: A vulnerability has been found in Tongda OA 2017 up to 11.10 and classified as critical. Affected by this vulnerability is an unknown functionality of the file general/wiki/cp/manage/delete.php. The manipulation of the argument TERM_ID_STR leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-247243. NOTE: The vendor was contacted early about this disclos
. The associated identifier of this vulnerability is VDB-247243. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.247243 - https://vuldb.com/?ctiid.247243 - https://github.com/willchen0011/cve/blob/main/sql.md
CVE ID: CVE-2023-6608 State: PUBLISHED Published: 2023-12-08T14:31:04.296Z Last Updated: 2024-08-02T08:35:14.867Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Tongda Products: OA 2017 Problem Types: CWE-89 Description: A vulnerability was found in Tongda OA 2017 up to 11.9 and classified as critical. Affected by this issue is some unknown functionality of the file general/notify/manage/delete.php. The manipulation of the argument DELETE_STR leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier of thi
version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-247244. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.247244 - https://vuldb.com/?ctiid.247244 - https://github.com/willchen0011/cve/blob/main/sql2.md
CVE ID: CVE-2023-6609 State: PUBLISHED Published: 2023-12-08T14:31:05.304Z Last Updated: 2024-08-02T08:35:14.822Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: n/a Products: osCommerce Problem Types: CWE-79 Description: A vulnerability was found in osCommerce 4. It has been classified as problematic. This affects an unknown part of the file /b2b-supermarket/catalog/all-products. The manipulation of the argument keywords with the input %27%22%3E%3Cimg%2Fsrc%3D1+onerror%3Dalert%28document.cookie%29%3E leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247245 was assigned to
attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247245 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.247245 - https://vuldb.com/?ctiid.247245
CVE ID: CVE-2023-6610 State: PUBLISHED Published: 2023-12-08T16:58:09.963Z Last Updated: 2025-11-08T07:10:28.228Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Virtualization 4 for Red Hat Enterprise Linux 8, RHOL-5.8-RHEL-9, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-125 Description: An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux
5 Description: An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:0723 - https://access.redhat.com/errata/RHSA-2024:0724 - https://access.redhat.com/errata/RHSA-2024:0725 - https://access.redhat.com/errata/RHSA-2024:0881 - https://access.redhat.com/errata/RHSA-2024:0897 - https://access.redhat.com/errata/RHSA-2024:1248 - https://access.redhat.com/errata/RHSA-2024:1404 - https://access.redhat.com/errata/RHSA-2024:2094 - https://a
024:1248 - https://access.redhat.com/errata/RHSA-2024:1404 - https://access.redhat.com/errata/RHSA-2024:2094 - https://access.redhat.com/security/cve/CVE-2023-6610 - https://bugzilla.kernel.org/show_bug.cgi?id=218219 - https://bugzilla.redhat.com/show_bug.cgi?id=2253614
CVE ID: CVE-2023-6611 State: PUBLISHED Published: 2023-12-08T15:00:05.077Z Last Updated: 2024-08-02T08:35:14.864Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Tongda Products: OA 2017 Problem Types: CWE-89 Description: A vulnerability was found in Tongda OA 2017 up to 11.9. It has been declared as critical. This vulnerability affects unknown code of the file pda/pad/email/delete.php. The manipulation of the argument EMAIL_ID leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. VDB-247246 is the identifier assigned
s able to address this issue. It is recommended to upgrade the affected component. VDB-247246 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.247246 - https://vuldb.com/?ctiid.247246 - https://github.com/13223355/cve/blob/main/sql.md
CVE ID: CVE-2023-6612 State: PUBLISHED Published: 2023-12-08T15:31:04.669Z Last Updated: 2024-10-09T13:34:29.496Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Totolink Products: X5000R Problem Types: CWE-78 Description: A vulnerability was found in Totolink X5000R 9.1.0cu.2300_B20230112. It has been rated as critical. This issue affects the function setDdnsCfg/setDynamicRoute/setFirewallType/setIPSecCfg/setIpPortFilterRules/setLancfg/setLoginPasswordCfg/setMacFilterRules/setMtknatCfg/setNetworkConfig/setPortForwardRules/setRemoteCfg/setSSServer/setScheduleCfg/setSmartQosCfg/setStaticDhcpRules/setStaticRoute/setVpnAccountCfg/setVpnPassCfg/setVpnUser/setWiF
SServer/setScheduleCfg/setSmartQosCfg/setStaticDhcpRules/setStaticRoute/setVpnAccountCfg/setVpnPassCfg/setVpnUser/setWiFiAclAddConfig/setWiFiEasyGuestCfg/setWiFiGuestCfg/setWiFiRepeaterConfig/setWiFiScheduleCfg/setWizardCfg of the file /cgi-bin/cstecgi.cgi. The manipulation leads to os command injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-247247. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.247247 - https://vuldb.com/?ctiid.247247 - https://github.com/Orac
ADP Vulnrichment: References: - https://vuldb.com/?id.247247 - https://vuldb.com/?ctiid.247247 - https://github.com/OraclePi/repo/tree/main/totolink%20X5000R
CVE ID: CVE-2023-6613 State: PUBLISHED Published: 2023-12-08T15:31:05.710Z Last Updated: 2024-11-21T15:28:12.894Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: n/a Products: Typecho Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in Typecho 1.2.1. Affected is an unknown function of the file /admin/options-theme.php of the component Logo Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-247248. NOTE: The vendor was contacted early about this disclosure but did not respond in any
this vulnerability is VDB-247248. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.247248 - https://vuldb.com/?ctiid.247248 - https://github.com/JTZ-a/SRC/blob/master/Typecho/Typecho-Stored%20XSS/en-us.md
CVE ID: CVE-2023-6614 State: PUBLISHED Published: 2023-12-08T16:00:05.803Z Last Updated: 2024-08-02T08:35:14.449Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:N/A:P) Vendors: n/a Products: Typecho Problem Types: CWE-912 Description: A vulnerability classified as problematic was found in Typecho 1.2.1. Affected by this vulnerability is an unknown functionality of the file /admin/manage-pages.php of the component Page Handler. The manipulation leads to backdoor. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247249 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not res
DB-247249 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.247249 - https://vuldb.com/?ctiid.247249 - https://github.com/JTZ-a/SRC/blob/master/Typecho/Typecho-IDOR/en-us.md
CVE ID: CVE-2023-6615 State: PUBLISHED Published: 2023-12-08T16:31:04.041Z Last Updated: 2024-08-02T08:35:14.888Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: Typecho Problem Types: CWE-200 Description: A vulnerability, which was classified as problematic, has been found in Typecho 1.2.1. Affected by this issue is some unknown functionality of the file /admin/manage-users.php. The manipulation of the argument page leads to information disclosure. The exploit has been disclosed to the public and may be used. VDB-247250 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond
dentifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.247250 - https://vuldb.com/?ctiid.247250 - https://github.com/JTZ-a/SRC/blob/master/Typecho/Typecho-Information%20leakage/en-us.md
CVE ID: CVE-2023-6616 State: PUBLISHED Published: 2023-12-08T16:31:05.055Z Last Updated: 2024-08-02T08:35:14.824Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Simple Student Attendance System Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Simple Student Attendance System 1.0 and classified as problematic. This issue affects some unknown processing of the file index.php. The manipulation of the argument page leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247253 was assigned to this vulnerability. Additional Analyst Notes:
d to the public and may be used. The identifier VDB-247253 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.247253 - https://vuldb.com/?ctiid.247253 - https://www.yuque.com/u39339523/el4dxs/sxa6f9gywg6vfbur
CVE ID: CVE-2023-6617 State: PUBLISHED Published: 2023-12-08T17:00:07.961Z Last Updated: 2024-08-28T14:25:53.059Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Simple Student Attendance System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been classified as critical. Affected is an unknown function of the file attendance.php. The manipulation of the argument class_id leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-247254 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Cont
d may be used. VDB-247254 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.247254 - https://vuldb.com/?ctiid.247254 - https://www.yuque.com/u39339523/el4dxs/gcsvdc5oohx6v38c
CVE ID: CVE-2023-6618 State: PUBLISHED Published: 2023-12-08T17:00:09.032Z Last Updated: 2025-05-27T17:13:40.622Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Simple Student Attendance System Problem Types: CWE-73 Description: A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file index.php. The manipulation of the argument page leads to file inclusion. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-247255. Additional Analyst Not
sed to the public and may be used. The associated identifier of this vulnerability is VDB-247255. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.247255 - https://vuldb.com/?ctiid.247255 - https://www.yuque.com/u39339523/el4dxs/krpez3nzv1144cuc
CVE ID: CVE-2023-6619 State: PUBLISHED Published: 2023-12-08T17:31:03.703Z Last Updated: 2024-08-02T08:35:14.832Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Simple Student Attendance System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /modals/class_form.php. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-247256. Additional Analyst Notes: - CVE Pro
d to the public and may be used. The identifier of this vulnerability is VDB-247256. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.247256 - https://vuldb.com/?ctiid.247256 - https://github.com/daydust/vuln/blob/main/Simple_Student_Attendance_System/class_form.php_SQL-injection.md
CVE ID: CVE-2023-6620 State: PUBLISHED Published: 2024-01-15T15:10:41.386Z Last Updated: 2025-06-20T16:52:48.813Z Vendors: Unknown Products: POST SMTP Mailer Problem Types: CWE-89 SQL Injection Description: The POST SMTP Mailer WordPress plugin before 2.8.7 does not properly sanitise and escape several parameters before using them in SQL statements, leading to a SQL injection exploitable by high privilege users such as admin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ab5c42ca-ee7d-4344-bd88-0d727ed3d9c4
CVE ID: CVE-2023-6621 State: PUBLISHED Published: 2024-01-03T08:32:42.957Z Last Updated: 2025-06-18T15:36:31.330Z Vendors: Unknown Products: POST SMTP Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The POST SMTP WordPress plugin before 2.8.7 does not sanitise and escape the msg parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b49ca336-5bc2-4d72-a9a5-b8c020057928
CVE ID: CVE-2023-6622 State: PUBLISHED Published: 2023-12-08T17:33:55.348Z Last Updated: 2025-11-06T19:47:02.675Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-476 Description: A null pointer dereference vulnerability was found in nft_dynset_init() in net/netfilter/nft_dynset.c in nf_tables in the Linux kernel. This issue may allow a local attacker with CAP_NET_ADMIN user privilege to trigger a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/R
a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:2394 - https://access.redhat.com/errata/RHSA-2024:2950 - https://access.redhat.com/errata/RHSA-2024:3138 - https://access.redhat.com/security/cve/CVE-2023-6622 - https://bugzilla.redhat.com/show_bug.cgi?id=2253632 - https://github.com/torvalds/linux/commit/3701cd390fd731ee7ae8b8006246c8db82c72bea
CVE ID: CVE-2023-6623 State: PUBLISHED Published: 2024-01-15T15:10:40.328Z Last Updated: 2025-06-11T16:37:55.499Z Vendors: Unknown Products: Essential Blocks Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The Essential Blocks WordPress plugin before 4.4.3 does not prevent unauthenticated attackers from overwriting local variables when rendering templates over the REST API, which may lead to Local File Inclusion attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/633c28e0-0c9e-4e68-9424-55c32789b41f - https://wpscan.com/blog/file-inclusion-vulnerab
https://wpscan.com/vulnerability/633c28e0-0c9e-4e68-9424-55c32789b41f - https://wpscan.com/blog/file-inclusion-vulnerability-fixed-in-essential-blocks-4-4-3/
CVE ID: CVE-2023-6624 State: PUBLISHED Published: 2024-01-11T08:32:33.293Z Last Updated: 2025-06-17T21:09:13.415Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: carazo Products: Import and export users and customers Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.24.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contribut
ation and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4731eb39-8c01-4a2b-80f7-15d8c13a19b5?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3007926%40import-users-from-csv-with-meta%2Ftrunk&old=3007057%40import-users-from-csv-with-meta%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6625 State: PUBLISHED Published: 2024-01-22T19:14:24.183Z Last Updated: 2025-06-20T18:37:30.685Z Vendors: Unknown Products: Product Enquiry for WooCommerce Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Product Enquiry for WooCommerce WordPress plugin before 3.1 does not have a CSRF check in place when deleting inquiries, which could allow attackers to make a logged in admin delete them via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d483f7ce-cb3f-4fcb-b060-005cec0ea10f/
CVE ID: CVE-2023-6626 State: PUBLISHED Published: 2024-01-22T19:14:28.393Z Last Updated: 2025-05-30T14:22:12.670Z Vendors: Unknown Products: Product Enquiry for WooCommerce Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Product Enquiry for WooCommerce WordPress plugin before 3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/327ae124-79eb-4e07-b029-e4f543cbd356/
CVE ID: CVE-2023-6627 State: PUBLISHED Published: 2024-01-08T19:00:30.023Z Last Updated: 2025-06-18T16:53:01.945Z Vendors: Unknown Products: WP Go Maps (formerly WP Google Maps) Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Go Maps (formerly WP Google Maps) WordPress plugin before 9.0.28 does not properly protect most of its REST API routes, which attackers can abuse to store malicious HTML/Javascript on the site. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f5687d0e-98ca-4449-98d6-7170c97c8f54 - https://wpscan.com/blog/stored-xss-fixed-in-wp-go-maps-9-0-28/