Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-29189 State: PUBLISHED Published: 2020-12-24T14:36:59 Last Updated: 2024-08-04T16:48:01.685Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect Access Control vulnerability in TerraMaster TOS <= 4.2.06 allows remote authenticated attackers to bypass read-only restriction and obtain full access to any folder within the NAS Additional Analyst Notes: - CVE Program Container: References: - http://terramaster.com - https://www.ihteam.net/advisory/terramaster-tos-multiple-vulnerabilities/
CVE ID: CVE-2020-29193 State: PUBLISHED Published: 2020-12-28T06:30:59 Last Updated: 2024-08-04T16:48:01.721Z Vendors: n/a Products: n/a Problem Types: n/a Description: Panasonic Security System WV-S2231L 4.25 has an insecure hard-coded password of lkjhgfdsa (which is just the asdf keyboard row in reverse order). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cecada/Panasonic-WV-S2231L/blob/main/README.md - https://security.panasonic.com/products_technology/products/wv-s2231l/
CVE ID: CVE-2020-29194 State: PUBLISHED Published: 2020-12-28T06:33:27 Last Updated: 2024-08-04T16:48:01.713Z Vendors: n/a Products: n/a Problem Types: n/a Description: Panasonic Security System WV-S2231L 4.25 allows a denial of service of the admin control panel (which will require a physical reset to restore administrative control) via Randomnum=99AC8CEC6E845B28&mode=1 in a POST request to the cgi-bin/set_factory URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cecada/Panasonic-WV-S2231L/blob/main/README.md - https://security.panasonic.com/products_technology/products/wv-s2231l/
CVE ID: CVE-2020-29203 State: PUBLISHED Published: 2020-12-26T19:09:54 Last Updated: 2024-08-04T16:48:01.634Z Vendors: n/a Products: n/a Problem Types: n/a Description: struct2json before 2020-11-18 is affected by a Buffer Overflow because strcpy is used for S2J_STRUCT_GET_string_ELEMENT. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/armink/struct2json/issues/13
CVE ID: CVE-2020-29204 State: PUBLISHED Published: 2020-12-27T05:36:08 Last Updated: 2024-08-04T16:48:01.542Z Vendors: n/a Products: n/a Problem Types: n/a Description: XXL-JOB 2.2.0 allows Stored XSS (in Add User) to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/job/admin/controller/UserController.java. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xuxueli/xxl-job/issues/2083
CVE ID: CVE-2020-29205 State: PUBLISHED Published: 2021-05-17T19:00:39 Last Updated: 2024-08-04T16:48:01.688Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS in signup form in Project Worlds Online Examination System 1.0 allows remote attacker to inject arbitrary code via the name field Additional Analyst Notes: - CVE Program Container: References: - https://github.com/projectworldsofficial/online-examination-systen-in-php - https://www.exploit-db.com/exploits/48969 - https://nikhilkumar01.medium.com/cve-2020-29205-a7ab5cbcd156
CVE ID: CVE-2020-29214 State: PUBLISHED Published: 2021-06-15T19:57:22 Last Updated: 2024-08-04T16:48:01.777Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in SourceCodester Alumni Management System 1.0 allows the user to inject SQL payload to bypass the authentication via admin/login.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/48883
CVE ID: CVE-2020-29215 State: PUBLISHED Published: 2021-06-15T19:57:29 Last Updated: 2024-08-04T16:48:01.558Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting in SourceCodester Employee Management System 1.0 allows the user to execute alert messages via /Employee Management System/addemp.php on admin account. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/48881
CVE ID: CVE-2020-29227 State: PUBLISHED Published: 2020-12-14T13:24:20 Last Updated: 2024-08-04T16:48:01.776Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Car Rental Management System 1.0. An unauthenticated user can perform a file inclusion attack against the /index.php file with a partial filename in the "page" parameter, to cause local file inclusion resulting in code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com/php/14544/car-rental-management-system-using-phpmysqli-source-code.html - https://loopspell.medium.com/cve-2020-29227-unauthenticated-local-file-inclusion-7d3bd2c5c6a5
CVE ID: CVE-2020-29228 State: PUBLISHED Published: 2020-12-30T18:13:21 Last Updated: 2024-08-04T16:48:01.627Z Vendors: n/a Products: n/a Problem Types: n/a Description: EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by SQL injection in the User Login Page. Additional Analyst Notes: - CVE Program Container: References: - http://egavilanmedia.com - https://github.com/hemantsolo/CVE-Reference/blob/main/CVE-2020-29228.md
CVE ID: CVE-2020-29230 State: PUBLISHED Published: 2020-12-30T18:18:10 Last Updated: 2024-08-04T16:48:01.797Z Vendors: n/a Products: n/a Problem Types: n/a Description: EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by cross-site scripting (XSS) in the Admin Panel - Manage User tab using the Full Name of the user. This vulnerability can result in the attacker injecting the XSS payload in the User Registration section and each time admin visits the manage user section from the admin panel, the XSS triggers and the attacker can steal the cookie according to the crafted payload. Additional Analyst Notes: - CVE Program Container: References: - http://egavilanme
kie according to the crafted payload. Additional Analyst Notes: - CVE Program Container: References: - http://egavilanmedia.com - https://github.com/hemantsolo/CVE-Reference/blob/main/CVE-2020-29230.md
CVE ID: CVE-2020-29231 State: PUBLISHED Published: 2020-12-30T18:21:48 Last Updated: 2024-08-04T16:48:01.585Z Vendors: n/a Products: n/a Problem Types: n/a Description: EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by cross-site scripting (XSS) in the Admin Profile Page. This vulnerability can result in the attacker injecting the XSS payload in Admin Full Name and each time admin visits the Profile page from the admin panel, the XSS triggers. Additional Analyst Notes: - CVE Program Container: References: - http://egavilanmedia.com - https://github.com/hemantsolo/CVE-Reference/blob/main/CVE-2020-29231.md
CVE ID: CVE-2020-29233 State: PUBLISHED Published: 2020-12-30T14:48:01 Last Updated: 2024-08-04T16:48:01.646Z Vendors: n/a Products: n/a Problem Types: n/a Description: WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Page description component. This vulnerability can allow an attacker to inject the XSS payload in the Page description and each time any user will visits the website, the XSS triggers and attacker can steal the cookie according to the crafted payload. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/49085
CVE ID: CVE-2020-29238 State: PUBLISHED Published: 2021-03-10T02:10:05 Last Updated: 2024-08-04T16:48:01.620Z Vendors: n/a Products: n/a Problem Types: n/a Description: An integer buffer overflow in the Nginx webserver of ExpressVPN Router version 1 allows remote attackers to obtain sensitive information when the server running as reverse proxy via specially crafted request. Additional Analyst Notes: - CVE Program Container: References: - http://expressvpn.com - https://bugcrowd.com/disclosures/4e8d5325-8e49-4ea3-962a-a088bbb73a3f/expressvpn-router-integer-buffer-overflow-server-info-disclosure-when-router-s-nginx-server-used-as-reverse-proxy-server - http://ja1sharma.com/blog/2021/CVE-2020-
erver-info-disclosure-when-router-s-nginx-server-used-as-reverse-proxy-server - http://ja1sharma.com/blog/2021/CVE-2020-29238/ - http://packetstormsecurity.com/files/162152/ExpressVPN-VPN-Router-1.0-Integer-Overflow.html
CVE ID: CVE-2020-29239 State: PUBLISHED Published: 2020-12-02T16:37:16 Last Updated: 2024-08-04T16:48:01.649Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Birth Certificate System Project V 1.0 is affected by cross-site scripting (XSS). This vulnerability can result in an attacker injecting the XSS payload in the User Registration section. When an admin visits the View Detail of Application section from the admin panel, the attacker can able to steal the cookie according to the crafted payload. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/49159
CVE ID: CVE-2020-29240 State: PUBLISHED Published: 2020-12-02T16:45:16 Last Updated: 2024-08-04T16:48:01.574Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lepton-CMS 4.7.0 is affected by cross-site scripting (XSS). An attacker can inject the XSS payload in the URL field of the admin page and each time an admin visits the Menu-Pages-Pages Overview section, the XSS will be triggered. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/49137 - https://lepton-cms.org/english/home.php
CVE ID: CVE-2020-29241 State: PUBLISHED Published: 2021-01-21T14:41:06 Last Updated: 2024-08-04T16:48:01.574Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online News Portal using PHP/MySQLi 1.0 is affected by cross-site scripting (XSS) which allows remote attackers to inject an arbitrary web script or HTML via the "Title" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40parshwa.fabaf/cross-site-scripting-vulnerability-in-admin-panel-c95bd4ecb6aa
CVE ID: CVE-2020-29242 State: PUBLISHED Published: 2020-12-28T07:03:46 Last Updated: 2024-08-04T16:48:01.570Z Vendors: n/a Products: n/a Problem Types: n/a Description: dhowden tag before 2020-11-19 allows "panic: runtime error: index out of range" via readPICFrame. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dhowden/tag/issues/77
CVE ID: CVE-2020-29243 State: PUBLISHED Published: 2020-12-28T07:05:12 Last Updated: 2024-08-04T16:48:01.706Z Vendors: n/a Products: n/a Problem Types: n/a Description: dhowden tag before 2020-11-19 allows "panic: runtime error: index out of range" via readAPICFrame. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dhowden/tag/issues/80
CVE ID: CVE-2020-29244 State: PUBLISHED Published: 2020-12-28T07:07:14 Last Updated: 2024-08-04T16:48:01.656Z Vendors: n/a Products: n/a Problem Types: n/a Description: dhowden tag before 2020-11-19 allows "panic: runtime error: slice bounds out of range" via readTextWithDescrFrame. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dhowden/tag/issues/79
CVE ID: CVE-2020-29245 State: PUBLISHED Published: 2020-12-28T07:08:22 Last Updated: 2024-08-04T16:48:01.788Z Vendors: n/a Products: n/a Problem Types: n/a Description: dhowden tag before 2020-11-19 allows "panic: runtime error: slice bounds out of range" via readAtomData. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dhowden/tag/issues/78
CVE ID: CVE-2020-29247 State: PUBLISHED Published: 2020-12-24T19:22:46 Last Updated: 2024-08-04T16:48:01.768Z Vendors: n/a Products: n/a Problem Types: n/a Description: WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Admin Panel. An attacker can inject the XSS payload in Page keywords and each time any user will visit the website, the XSS triggers, and the attacker can able to steal the cookie according to the crafted payload. Additional Analyst Notes: - CVE Program Container: References: - http://wondercms.com - https://www.exploit-db.com/exploits/49102 - https://systemweakness.com/cve-2020-29247-wondercms-3-1-3-page-persistent-cross-site-scripting-3dd2bb210beb
CVE ID: CVE-2020-29249 State: PUBLISHED Published: 2020-12-27T06:13:52 Last Updated: 2024-08-04T16:48:01.766Z Vendors: n/a Products: n/a Problem Types: n/a Description: CXUUCMS V3 allows class="layui-input" XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cbkhwx/cxuucmsv3/issues/2
CVE ID: CVE-2020-29250 State: PUBLISHED Published: 2020-12-27T06:17:06 Last Updated: 2024-08-04T16:48:01.801Z Vendors: n/a Products: n/a Problem Types: n/a Description: CXUUCMS V3 allows XSS via the first and third input fields to /public/admin.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cbkhwx/cxuucmsv3/issues/3
CVE ID: CVE-2020-29254 State: PUBLISHED Published: 2020-12-11T15:11:10 Last Updated: 2024-08-04T16:48:01.577Z Vendors: n/a Products: n/a Problem Types: n/a Description: TikiWiki 21.2 allows templates to be edited without CSRF protection. This could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based management interface of the affected system. An attacker could exploit this vulnerability by persuading a user of the interface to follow a maliciously crafted link. A successful exploit could allow the attacker to perform arb
user of the interface to follow a maliciously crafted link. A successful exploit could allow the attacker to perform arbitrary actions on an affected system with the privileges of the user. These action include allowing attackers to submit their own code through an authenticated user resulting in local file Inclusion. If an authenticated user who is able to edit TikiWiki templates visits an malicious website, template code can be edited. Additional Analyst Notes: - CVE Program Container: References: - https://youtu.be/Uc3sRBitu50 - https://github.com/S1lkys/CVE-2020-29254 - https://github.com/S1lkys/CVE-2020-29254/blob/main/Tiki-Wiki%2021.2%20by%20Maximilian%20Barz.pdf
CVE ID: CVE-2020-29257 State: PUBLISHED Published: 2020-12-09T22:18:59 Last Updated: 2024-08-04T16:48:01.622Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Online Examination System 1.0 via the q parameter to feedback.php. Additional Analyst Notes: - CVE Program Container: References: - https://asfiyashaikh20.medium.com/exploit-for-cve-2020-29257-reflected-cross-site-scripting-xss-vulnerability-4a7bf9ae7d80
CVE ID: CVE-2020-29258 State: PUBLISHED Published: 2020-12-09T22:22:18 Last Updated: 2024-08-04T16:48:01.725Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Online Examination System 1.0 via the w parameter to index.php. Additional Analyst Notes: - CVE Program Container: References: - https://asfiyashaikh20.medium.com/exploit-for-cve-2020-29258-reflected-cross-site-scripting-xss-vulnerability-957f365a1f3b
CVE ID: CVE-2020-29259 State: PUBLISHED Published: 2020-12-09T22:34:58 Last Updated: 2024-08-04T16:48:01.932Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Online Examination System 1.0 via the subject or feedback parameter to feedback.php. Additional Analyst Notes: - CVE Program Container: References: - https://asfiyashaikh20.medium.com/cve-2020-29259-persistent-xss-2ef63cc5cee6
CVE ID: CVE-2020-29260 State: PUBLISHED Published: 2022-09-02T22:14:35 Last Updated: 2024-08-04T16:48:01.600Z Vendors: n/a Products: n/a Problem Types: n/a Description: libvncclient v0.9.13 was discovered to contain a memory leak via the function rfbClientCleanup(). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LibVNC/libvncserver/commit/bef41f6ec4097a8ee094f90a1b34a708fbd757ec - https://lists.debian.org/debian-lts-announce/2022/09/msg00035.html
CVE ID: CVE-2020-29279 State: PUBLISHED Published: 2020-12-02T21:08:44 Last Updated: 2024-08-04T16:48:01.779Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion in the assign_resume_tpl method in Application/Common/Controller/BaseController.class.php in 74CMS before 6.0.48 allows remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BigTiger2020/74CMS/blob/main/README.md - http://www.74cms.com/news/show-2497.html
CVE ID: CVE-2020-29280 State: PUBLISHED Published: 2020-12-02T21:08:39 Last Updated: 2024-08-04T16:48:01.647Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Victor CMS v1.0 application is vulnerable to SQL injection via the 'search' parameter on the search.php page. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BigTiger2020/Victor-CMS-/blob/main/README.md - https://github.com/VictorAlagwu/CMSsite/issues/13 - https://www.exploit-db.com/exploits/48734
CVE ID: CVE-2020-29282 State: PUBLISHED Published: 2020-12-02T21:08:22 Last Updated: 2024-08-04T16:48:01.622Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in BloodX 1.0 allows attackers to bypass authentication. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BigTiger2020/BloodX-CMS/blob/main/README.md - https://www.exploit-db.com/exploits/48786 - https://github.com/diveshlunker/BloodX
CVE ID: CVE-2020-29283 State: PUBLISHED Published: 2020-12-02T21:08:16 Last Updated: 2024-08-04T16:48:01.918Z Vendors: n/a Products: n/a Problem Types: n/a Description: An SQL injection vulnerability was discovered in Online Doctor Appointment Booking System PHP and Mysql via the q parameter to getuser.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BigTiger2020/Online-Doctor-Appointment-Booking-System-PHP/blob/main/README.md - https://projectworlds.in/free-projects/php-projects/online-doctor-appointment-booking-system-php-and-mysql
CVE ID: CVE-2020-29284 State: PUBLISHED Published: 2020-12-02T21:08:09 Last Updated: 2024-08-04T16:48:01.780Z Vendors: n/a Products: n/a Problem Types: n/a Description: The file view-chair-list.php in Multi Restaurant Table Reservation System 1.0 does not perform input validation on the table_id parameter which allows unauthenticated SQL Injection. An attacker can send malicious input in the GET request to /dashboard/view-chair-list.php?table_id= to trigger the vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BigTiger2020/-Multi-Restaurant-Table-Reservation-System/blob/main/README.md - https://www.exploit-db.com/exploits/48984 - https://www.s
ulti-Restaurant-Table-Reservation-System/blob/main/README.md - https://www.exploit-db.com/exploits/48984 - https://www.sourcecodester.com/php/14568/multi-restaurant-table-reservation-system-php-full-source-code.html
CVE ID: CVE-2020-29285 State: PUBLISHED Published: 2020-12-02T21:07:51 Last Updated: 2024-08-04T16:48:01.603Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability was discovered in Point of Sales in PHP/PDO 1.0, which can be exploited via the id parameter to edit_category.php. Additional Analyst Notes: - CVE Program Container: References: - https://projectworlds.in/free-projects/php-projects/online-doctor-appointment-booking-system-php-and-mysql - https://github.com/BigTiger2020/Point-of-Sales/blob/main/README.md
CVE ID: CVE-2020-29287 State: PUBLISHED Published: 2020-12-02T21:07:20 Last Updated: 2024-08-04T16:48:01.872Z Vendors: n/a Products: n/a Problem Types: n/a Description: An SQL injection vulnerability was discovered in Car Rental Management System v1.0 can be exploited via the id parameter in view_car.php or the car_id parameter in booking.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com/php/14544/car-rental-management-system-using-phpmysqli-source-code.html - https://github.com/BigTiger2020/Car-Rental-Management-System/blob/main/README.md - https://www.exploit-db.com/exploits/49056
CVE ID: CVE-2020-29288 State: PUBLISHED Published: 2020-12-02T21:07:16 Last Updated: 2024-08-04T16:48:01.704Z Vendors: n/a Products: n/a Problem Types: n/a Description: An SQL injection vulnerability was discovered in Gym Management System In manage_user.php file, GET parameter 'id' is vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com/php/14541/gym-management-system-using-phpmysqli-source-code.html - https://www.exploit-db.com/exploits/48936 - https://github.com/BigTiger2020/Gym-Management-System/blob/main/README.md
CVE ID: CVE-2020-29292 State: PUBLISHED Published: 2021-12-30T16:11:55 Last Updated: 2024-08-04T16:48:01.623Z Vendors: n/a Products: n/a Problem Types: n/a Description: iBall WRD12EN 1.0.0 devices allow cross-site request forgery (CSRF) attacks as demonstrated by enabling DNS settings or modifying the range for IP addresses. Additional Analyst Notes: - CVE Program Container: References: - https://www.iball.co.in/ - https://github.com/Nitya91/iBall-WRD12EN-1.0.0
CVE ID: CVE-2020-29297 State: PUBLISHED Published: 2023-01-20T00:00:00.000Z Last Updated: 2025-04-03T17:42:11.885Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL Injection vulnerabilities in tourist5 Online-food-ordering-system 1.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/kdrypr/999a245abb4511d43e41df1ccdbcf0cb - https://github.com/tourist5/Online-food-ordering-system/issues/1 - https://github.com/tourist5/Online-food-ordering-system
CVE ID: CVE-2020-29299 State: PUBLISHED Published: 2020-12-27T05:51:45 Last Updated: 2024-08-04T16:48:01.635Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain Zyxel products allow command injection by an admin via an input string to chg_exp_pwd during a password-change action. This affects VPN On-premise before ZLD V4.39 week38, VPN Orchestrator before SD-OS V10.03 week32, USG before ZLD V4.39 week38, USG FLEX before ZLD V4.55 week38, ATP before ZLD V4.55 week38, and NSG before 1.33 patch 4. Additional Analyst Notes: - CVE Program Container: References: - https://www.zyxel.com/us/en/support/security_advisories.shtml - https://www.zyxel.com/support/Zyxel-security-advisory-fo
https://www.zyxel.com/us/en/support/security_advisories.shtml - https://www.zyxel.com/support/Zyxel-security-advisory-for-command-injection-vulnerability-of-firewalls.shtml
CVE ID: CVE-2020-29303 State: PUBLISHED Published: 2020-12-14T19:43:24 Last Updated: 2024-08-04T16:48:01.803Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the SabaiApp Directories Pro plugin 1.3.45 for WordPress allows remote attackers to inject arbitrary web script or HTML via a POST to /wp-admin/admin.php?page=drts/directories&q=%2F with _drts_form_build_id parameter containing the XSS payload and _t_ parameter set to an invalid or non-existent CSRF token. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2020/Dec/14 - http://packetstormsecurity.com/files/160452/WordPress-Directori
nces: - http://seclists.org/fulldisclosure/2020/Dec/14 - http://packetstormsecurity.com/files/160452/WordPress-DirectoriesPro-1.3.45-Cross-Site-Scripting.html - https://www.themissinglink.com.au/security-advisories-cve-2020-29303 - https://directoriespro.com/directories-pro-1-3-46/
CVE ID: CVE-2020-29304 State: PUBLISHED Published: 2020-12-14T19:48:28 Last Updated: 2024-08-04T16:48:01.650Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability exists in the SabaiApps WordPress Directories Pro plugin version 1.3.45 and previous, allows attackers who have convinced a site administrator to import a specially crafted CSV file to inject arbitrary web script or HTML as the victim is proceeding through the file import workflow. Additional Analyst Notes: - CVE Program Container: References: - https://directoriespro.com/directories-pro-1-3-46/ - http://seclists.org/fulldisclosure/2020/Dec/15 - http://packetstormsecurity.com/files/1