Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
y files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/87399a07-d2d8-42cd-81f0-9060f6cfff48?source=cve - https://plugins.trac.wordpress.org/browser/wpdirectorykit/tags/1.1.8/vendor/Winter_MVC/core/mvc_loader.php#L91 - https://plugins.trac.wordpress.org/changeset/2904689/wpdirectorykit/trunk/vendor/Winter_MVC/core/mvc_loader.php
CVE ID: CVE-2023-2279 State: PUBLISHED Published: 2023-08-31T05:33:12.671Z Last Updated: 2024-09-27T19:11:37.442Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: listingthemes Products: WP Directory Kit Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the 'admin_page_display' function. This makes it possible for unauthenticated attackers to delete or change plugin settings, import demo data, modify or delete Directory Kit related posts and terms via a forged
delete or change plugin settings, import demo data, modify or delete Directory Kit related posts and terms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Partial patches were made avilable in versions 1.2.0 and 1.2.1 but the issue was not fully patched until 1.2.2 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8a7a6da3-d67c-42b3-8826-7e7fc9b938b4?source=cve - https://plugins.trac.wordpress.org/browser/wpdirectorykit/tags/1.1.8/admin/class-wpdirectorykit-admin.php#L170 - https://plugins.trac.wordpress.org/changeset?sfp_em
pdirectorykit/tags/1.1.8/admin/class-wpdirectorykit-admin.php#L170 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2905795%40wpdirectorykit%2Ftrunk&old=2905046%40wpdirectorykit%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-2280 State: PUBLISHED Published: 2023-06-09T05:33:26.093Z Last Updated: 2024-12-28T00:51:51.218Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: listingthemes Products: WP Directory Kit Problem Types: CWE-862 Missing Authorization Description: The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'ajax_public' function in versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to delete or change plugin settings, import demo data, delete Directory Kit related posts and terms, and install arbitrary plugins. A par
ge plugin settings, import demo data, delete Directory Kit related posts and terms, and install arbitrary plugins. A partial patch was introduced in version 1.2.0 and an additional partial patch was introduced in version 1.2.2, but the issue was not fully patched until 1.2.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/abb1a758-5c16-4841-b1c7-0705ab16b328?source=cve - https://plugins.trac.wordpress.org/browser/wpdirectorykit/tags/1.1.8/public/class-wpdirectorykit-public.php#L249 - https://plugins.trac.wordpress.org/changeset/2907164/
CVE ID: CVE-2023-2281 State: PUBLISHED Published: 2023-04-25T13:04:42.287Z Last Updated: 2024-12-06T23:04:46.320Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-200 Description: When archiving a team, Mattermost fails to sanitize the related Websocket event sent to currently connected clients. This allows the clients to see the name, display name, description, and other data about the archived team. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates/
CVE ID: CVE-2023-2282 State: PUBLISHED Published: 2023-04-25T18:23:00.287Z Last Updated: 2025-02-04T14:25:24.760Z Vendors: Devolutions Products: Remote Desktop Manager Description: Improper access control in the Web Login listener in Devolutions Remote Desktop Manager 2023.1.22 and earlier on Windows allows an authenticated user to bypass administrator-enforced Web Login restrictions and gain access to entries via an unexpected vector. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2023-0012
CVE ID: CVE-2023-2283 State: PUBLISHED Published: 2023-05-26T00:00:00.000Z Last Updated: 2025-11-03T20:35:18.528Z Vendors: n/a Products: libssh Problem Types: CWE-287 Description: A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cr
he function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2023-2283 - https://www.libssh.org/security/advisories/CVE-2023-2283.txt - https://bugzilla.redhat.com/show_bug.cgi?id=2189736 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27PD44ALQTZXX7K6JAM3BXBUHYA6DFFN/ - http://packetstormsecurity.com/files/172861/libssh-0.9.6-0.10.4-pki_verify_data_signature-Authorization-Bypass.htm
FN/ - http://packetstormsecurity.com/files/172861/libssh-0.9.6-0.10.4-pki_verify_data_signature-Authorization-Bypass.html - https://security.gentoo.org/glsa/202312-05 - https://security.netapp.com/advisory/ntap-20240201-0005/
CVE ID: CVE-2023-2284 State: PUBLISHED Published: 2023-06-09T12:32:00.238Z Last Updated: 2024-12-20T23:32:37.426Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: wpwhitesecurity Products: WP Activity Log Premium Problem Types: CWE-862 Missing Authorization Description: The WP Activity Log Premium plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_switch_db function in versions up to, and including, 4.5.0. This makes it possible for authenticated attackers with subscriber-level or higher to make changes to the plugin's settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vul
el or higher to make changes to the plugin's settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6e29fd6b-462a-42be-9a2a-b6717b20a937?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2911239%40wp-security-audit-log%2Ftrunk&old=2897171%40wp-security-audit-log%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-2285 State: PUBLISHED Published: 2023-06-09T12:31:59.732Z Last Updated: 2024-12-20T23:32:44.722Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: wpwhitesecurity Products: WP Activity Log Premium Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP Activity Log Premium plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.0. This is due to missing or incorrect nonce validation on the ajax_switch_db function. This makes it possible for unauthenticated attackers to make changes to the plugin's settings via a forged request granted they can trick a site administrator into p
tackers to make changes to the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4c659f6d-e02b-42ab-ba02-eb9b00602ad4?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2911239%40wp-security-audit-log%2Ftrunk&old=2897171%40wp-security-audit-log%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-2286 State: PUBLISHED Published: 2023-06-09T12:32:00.696Z Last Updated: 2024-11-09T15:45:01.007Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: wpwhitesecurity Products: WP Activity Log, WP Activity Log Premium Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP Activity Log for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.0. This is due to missing or incorrect nonce validation on the ajax_run_cleanup function. This makes it possible for unauthenticated attackers to invoke this function via a forged request granted they can trick a site administrator into performing an
d attackers to invoke this function via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e2008e0b-32c6-46fb-93b9-2b0004f478e8?source=cve - https://plugins.trac.wordpress.org/browser/wp-security-audit-log/trunk/classes/Views/Settings.php#L278 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2911239%40wp-security-audit-log%2Ftrunk&old=2897171%40wp-security-audit-log%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-2287 State: PUBLISHED Published: 2023-05-30T07:49:17.119Z Last Updated: 2025-01-10T20:55:53.771Z Vendors: Unknown Products: Orbit Fox by ThemeIsle Problem Types: CWE-918 Server-Side Request Forgery (SSRF) Description: The Orbit Fox by ThemeIsle WordPress plugin before 2.10.24 does not limit URLs which may be used for the stock photo import feature, allowing the user to specify arbitrary URLs. This leads to a server-side request forgery as the user may force the server to access any URL of their choosing. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1b36a184-2138-4a65-8940-07e7764669bb
CVE ID: CVE-2023-2288 State: PUBLISHED Published: 2023-05-30T07:49:15.477Z Last Updated: 2025-01-10T21:04:14.508Z Vendors: Unknown Products: Otter Problem Types: CWE-502 Deserialization of Untrusted Data Description: The Otter WordPress plugin before 2.2.6 does not sanitize some user-controlled file paths before performing file operations on them. This leads to a PHAR deserialization vulnerability on PHP < 8.0 using the phar:// stream wrapper. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/93acb4ee-1053-48e1-8b69-c09dc3b2f302
CVE ID: CVE-2023-2289 State: PUBLISHED Published: 2023-06-09T05:33:33.580Z Last Updated: 2024-11-23T13:18:21.544Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: nik00726 Products: wordpress vertical image slider plugin Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The wordpress vertical image slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘search_term’ parameter in versions up to, and including, 1.2.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in
nitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c9983364-9b52-4acc-91d4-b352c6d24d52?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2824902%40wp-vertical-image-slider%2Ftags%2F1.2.16&new=2902084%40wp-vertical-image-slider%2Ftags%2F1.2.17
CVE ID: CVE-2023-2290 State: PUBLISHED Published: 2023-06-26T19:44:19.989Z Last Updated: 2024-12-03T18:40:33.407Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: ThinkPad Problem Types: CWE-787 Description: A potential vulnerability in the LenovoFlashDeviceInterface SMI handler may allow an attacker with local access and elevated privileges to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-106014
CVE ID: CVE-2023-2291 State: PUBLISHED Published: 2023-04-26T00:00:00.000Z Last Updated: 2025-02-03T17:31:55.129Z Vendors: n/a Products: Zoho ManageEngine Multiple Products Problem Types: Hardcoded Credentials Description: Static credentials exist in the PostgreSQL data used in ManageEngine Access Manager Plus (AMP) build 4309, ManageEngine Password Manager Pro, and ManageEngine PAM360. These credentials could allow a malicious actor to modify configuration data that would escalate their permissions from that of a low-privileged user to an Administrative user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tenable.com/security/research/tra-2
alyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tenable.com/security/research/tra-2023-16
CVE ID: CVE-2023-2293 State: PUBLISHED Published: 2023-04-25T21:00:04.871Z Last Updated: 2024-08-02T06:19:14.857Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: SourceCodester Products: Purchase Order Management System Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Purchase Order Management System 1.0. It has been classified as problematic. This affects an unknown part of the file classes/Master.php?f=save_item. The manipulation of the argument description with the input <script>alert(document.cookie)</script> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be use
e scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227463. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.227463 - https://vuldb.com/?ctiid.227463 - https://github.com/biantaibao/bug_report/blob/main/XSS-1.md
CVE ID: CVE-2023-2294 State: PUBLISHED Published: 2023-04-26T06:00:05.601Z Last Updated: 2024-08-02T06:19:14.236Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: n/a Products: UCMS Problem Types: CWE-79 Description: A vulnerability was found in UCMS 1.6.0. It has been classified as problematic. This affects an unknown part of the file saddpost.php of the component Column Configuration. The manipulation of the argument strorder leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227481 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: Refe
d. The identifier VDB-227481 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.227481 - https://vuldb.com/?ctiid.227481 - https://github.com/yztale/UCMS1.6/blob/main/README.md
CVE ID: CVE-2023-2295 State: PUBLISHED Published: 2023-05-17T00:00:00.000Z Last Updated: 2025-01-22T18:25:15.561Z Vendors: n/a Products: libreswan Problem Types: CWE-400 Description: A vulnerability was found in the libreswan library. This security issue occurs when an IKEv1 Aggressive Mode packet is received with only unacceptable crypto algorithms, and the response packet is not sent with a zero responder SPI. When a subsequent packet is received where the sender reuses the libreswan responder SPI as its own initiator SPI, the pluto daemon state machine crashes. No remote code execution is possible. This CVE exists because of a CVE-2023-30570 security regression for libreswan package in Re
code execution is possible. This CVE exists because of a CVE-2023-30570 security regression for libreswan package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2189777 - https://access.redhat.com/security/cve/CVE-2023-2295 - https://access.redhat.com/errata/RHSA-2023:3107 - https://access.redhat.com/errata/RHSA-2023:3148
CVE ID: CVE-2023-2296 State: PUBLISHED Published: 2023-05-30T07:49:21.849Z Last Updated: 2025-01-10T17:34:14.934Z Vendors: Unknown Products: Loginizer Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Loginizer WordPress plugin before 1.7.9 does not escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8126ff73-c0e5-4c1b-ba10-2e51f690521e
CVE ID: CVE-2023-2297 State: PUBLISHED Published: 2023-04-26T23:30:18.376Z Last Updated: 2025-01-13T16:50:32.449Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: reflectionmedia Products: Profile Builder – User Profile & User Registration Forms Problem Types: CWE-620 Unverified Password Change Description: The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 3.9.0. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function (wppb_front_end_password_recovery). The function uses the p
with insufficient validation on the password reset function (wppb_front_end_password_recovery). The function uses the plaintext value of a password reset key instead of a hashed value which means it can easily be retrieved and subsequently used. An attacker can leverage CVE-2023-0814, or another vulnerability like SQL Injection in another plugin or theme installed on the site to successfully exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e731292a-4f95-46eb-889e-b00d58f3444e?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&o
-4f95-46eb-889e-b00d58f3444e?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2864329%40profile-builder&new=2864329%40profile-builder&sfp_email=&sfph_mail= - https://lana.codes/lanavdb/512e7307-04a5-4d8b-8f79-f75f37784a9f/ - https://www.wordfence.com/blog/2023/03/vulnerability-patched-in-cozmolabs-profile-builder-plugin-information-disclosure-leads-to-account-takeover/
CVE ID: CVE-2023-2298 State: PUBLISHED Published: 2023-06-03T04:35:15.934Z Last Updated: 2024-12-28T00:57:57.735Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: vcita Products: Online Booking & Scheduling Calendar for WordPress by vcita Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'business_id' parameter in versions up to, and including, 4.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated atta
ding, 4.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7e6a0bf9-4767-4d4c-9a1e-adcb3c7719d9?source=cve - https://plugins.trac.wordpress.org/browser/meeting-scheduler-by-vcita/trunk/vcita-api-functions.php - https://blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcita
CVE ID: CVE-2023-2299 State: PUBLISHED Published: 2023-06-03T04:35:14.168Z Last Updated: 2024-12-28T00:58:05.050Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: vcita Products: Online Booking & Scheduling Calendar for WordPress by vcita Problem Types: CWE-862 Missing Authorization Description: The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized medication of data via the /wp-json/vcita-wordpress/v1/actions/auth REST-API endpoint in versions up to, and including, 4.2.10 due to a missing capability check on the processAction function. This makes it possible for unauthenticated attackers modify the
missing capability check on the processAction function. This makes it possible for unauthenticated attackers modify the plugin's settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4855627a-de56-49ee-b0b0-01b9735d8557?source=cve - https://plugins.trac.wordpress.org/browser/meeting-scheduler-by-vcita/trunk/vcita-api-functions.php - https://blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcita
CVE ID: CVE-2023-2300 State: PUBLISHED Published: 2023-06-03T04:35:12.522Z Last Updated: 2024-12-20T23:58:33.948Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: eyale-vc Products: Contact Form Builder by vcita Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Contact Form Builder by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 4.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with the edit_posts capability, such as contributors and a
escaping. This makes it possible for authenticated attackers with the edit_posts capability, such as contributors and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/12ce97ba-8053-481f-bcd7-05d5e8292adb?source=cve - https://plugins.trac.wordpress.org/browser/contact-form-with-a-meeting-scheduler-by-vcita/trunk/system/parse_vcita_callback.php#L55 - https://blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcita
CVE ID: CVE-2023-2301 State: PUBLISHED Published: 2023-06-03T04:35:15.116Z Last Updated: 2024-12-20T23:57:36.813Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: eyale-vc Products: Contact Form Builder by vcita Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Contact Form Builder by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.9.1. This is due to missing nonce validation on the ls_parse_vcita_callback function. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious JavaScript via a forged request granted they can trick a s