Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-6945 State: PUBLISHED Published: 2023-12-19T10:57:27.291Z Last Updated: 2024-11-21T14:24:23.774Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: SourceCodester Products: Online Student Management System Problem Types: CWE-79 Description: A vulnerability has been found in SourceCodester Online Student Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file edit-student-detail.php. The manipulation of the argument notmsg leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248377 was assigned to this vu
emotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248377 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.248377 - https://vuldb.com/?ctiid.248377 - https://github.com/ch0ing/vul/blob/main/WebRay.com.cn/Online%20student%20management%20system(XSS)%202.md
CVE ID: CVE-2023-6946 State: PUBLISHED Published: 2024-01-29T14:44:22.240Z Last Updated: 2025-06-11T16:35:18.168Z Vendors: Unknown Products: Autotitle for WordPress Problem Types: CWE-352 Cross-Site Request Forgery (CSRF), CWE-79 Cross-Site Scripting (XSS) Description: The Autotitle for WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/54a00416-c7e3-44f3-8dd2-ed9e748055e6/ - https://magos-securitas.com/txt/CVE-2023-6946
CVE ID: CVE-2023-6947 State: PUBLISHED Published: 2024-12-10T05:24:41.940Z Last Updated: 2024-12-10T20:54:03.539Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: https://fooplugins.com Products: FooGallery Premium Problem Types: CWE-25 Description: The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4.26. This makes it possible for authenticated attackers, with contributor level or higher to read the contents of arbitrary folders on the server, which can contain sensitive information such as folder structure. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
can contain sensitive information such as folder structure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/68420c5a-4add-4597-bd2a-20dc831e81bd?source=cve - https://github.com/fooplugins/foogallery/pull/263/commits/9989f6f4f4d478ec04cb634d09b18c87a5b31c4d
CVE ID: CVE-2023-6948 State: PUBLISHED Published: 2024-04-02T10:27:25.475Z Last Updated: 2025-03-04T21:49:48.488Z Severity: LOW (CVSS 3 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: DJI, DJI Products: Mavic 3 Pro, Mavic 3, Mavic 3 Classic, Mavic 3 Enterprise, Matrice 300, Matrice M30, Mini 3 Pro Problem Types: CWE-120 Description: A Buffer Copy without Checking Size of Input issue affecting the v2_sdk_service running on a set of DJI drone devices on the port 10000 could allow an attacker to cause a crash of the service through a crafted payload triggering a missing input size check in the sdk_printf function implemented in the libv2_sdk.so library used by the dji_vtwo_sdk binary imp
input size check in the sdk_printf function implemented in the libv2_sdk.so library used by the dji_vtwo_sdk binary implementing the service, compromising it in a term of availability and producing a denial-of-service attack. Affected models are Mavic 3 Pro until v01.01.0300, Mavic 3 until v01.00.1200, Mavic 3 Classic until v01.00.0500, Mavic 3 Enterprise until v07.01.10.03, Matrice 300 until v57.00.01.00, Matrice M30 until v07.01.0022 and Mini 3 Pro until v01.00.0620. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-6948/
CVE ID: CVE-2023-6949 State: PUBLISHED Published: 2024-04-02T10:27:44.079Z Last Updated: 2025-02-13T17:27:01.071Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: DJI Products: Mini 3 Pro Problem Types: CWE-306 Description: A Missing Authentication for Critical Function issue affecting the HTTP service running on the DJI Mavic Mini 3 Pro on the standard port 80 could allow an attacker to enumerate and download videos and pictures saved on the drone internal or external memory without requiring any kind of authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-
otes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-6949/
CVE ID: CVE-2023-6950 State: PUBLISHED Published: 2024-04-02T10:27:54.813Z Last Updated: 2024-09-30T10:02:33.070Z Severity: LOW (CVSS 3 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: DJI Products: Mini 3 Pro Problem Types: CWE-1286 Description: An Improper Input Validation vulnerability affecting the FTP service running on the DJI Mavic Mini 3 Pro could allow an attacker to craft a malicious packet containing a malformed path provided to the FTP SIZE command that leads to a denial-of-service attack of the FTP service itself. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-6
ontainer: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-6950/
CVE ID: CVE-2023-6951 State: PUBLISHED Published: 2024-04-02T10:28:05.544Z Last Updated: 2024-09-30T10:04:13.991Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: DJI Products: Mavic 3 Pro, Mavic 3, Mavic 3 Classic, Mavic 3 Enterprise, Matrice 300, Matrice M30, Mini 3 Pro Problem Types: CWE-334 Description: A Use of Weak Credentials vulnerability affecting the Wi-Fi network generated by a set of DJI drones could allow a remote attacker to derive the WPA2 PSK key and authenticate without permission to the drone’s Wi- Fi network. This, in turn, allows the attacker to perform unauthorized interaction with the network services exposed by the drone and to potentia
, allows the attacker to perform unauthorized interaction with the network services exposed by the drone and to potentially decrypt the Wi-Fi traffic exchanged between the drone and the Android/IOS device of the legitimate user during QuickTransfer mode. Affected models are Mavic 3 Pro until v01.01.0300, Mavic 3 until v01.00.1200, Mavic 3 Classic until v01.00.0500, Mavic 3 Enterprise until v07.01.10.03, Matrice 300 until v57.00.01.00, Matrice M30 until v07.01.0022 and Mini 3 Pro until v01.00.0620. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-6951/
CVE ID: CVE-2023-6953 State: PUBLISHED Published: 2024-02-05T21:21:58.933Z Last Updated: 2024-08-02T08:42:08.543Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpmanageninja Products: PDF Generator For Fluent Forms – The Contact Form Plugin Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The PDF Generator For Fluent Forms – The Contact Form Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the header, PDF body and footer content parameters in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it pos
n all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploitation level depends on who is granted the right to create forms by an administrator. This level can be as low as contributor, but by default is admin. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b6675c48-43d4-4394-a4a3-f753bdaa5c4e?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3023486%40fluentf
bdaa5c4e?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3023486%40fluentforms-pdf%2Ftrunk&old=2929799%40fluentforms-pdf%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6954 State: PUBLISHED Published: 2024-03-13T15:26:51.116Z Last Updated: 2024-08-02T08:42:08.535Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: codename065 Products: Download Manager Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Download Manager Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.2.85 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permiss
on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5cdd64a4-040b-4dc9-a8df-dbecfeb928c8?source=cve - https://plugins.trac.wordpress.org/browser/download-manager/tags/3.2.83/src/Category/Shortcodes.php#L14 - https://plugins.trac.wordpress.org/browser/download-manager/tags/3.2.83/src/Package/Shortcodes.php#L106 - https://plugins.trac.wordpress.org/browser/download-manager/tag
ad-manager/tags/3.2.83/src/Package/Shortcodes.php#L106 - https://plugins.trac.wordpress.org/browser/download-manager/tags/3.2.83/src/Package/views/packages-shortcode.php - https://plugins.trac.wordpress.org/browser/download-manager/tags/3.2.83/src/Package/views/packages-shortcode-toolbar.php
CVE ID: CVE-2023-6955 State: PUBLISHED Published: 2024-01-12T13:56:31.881Z Last Updated: 2025-06-17T21:09:18.490Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-862 Description: A missing authorization check vulnerability exists in GitLab Remote Development affecting all versions prior to 16.5.6, 16.6 prior to 16.6.4 and 16.7 prior to 16.7.2. This condition allows an attacker to create a workspace in one group that is associated with an agent from another group. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/432188
CVE ID: CVE-2023-6956 State: PUBLISHED Published: 2024-06-06T02:02:56.106Z Last Updated: 2024-08-02T08:42:08.525Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: flowdee Products: EasyAzon – Amazon Associates Affiliate Plugin Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The EasyAzon – Amazon Associates Affiliate Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘easyazon-cloaking-locale’ parameter in all versions up to, and including, 5.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers
, 5.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3d13454c-0c46-4b16-8e0e-bbfcf2338230?source=cve - https://wordpress.org/plugins/easyazon/
CVE ID: CVE-2023-6957 State: PUBLISHED Published: 2024-03-13T15:27:24.732Z Last Updated: 2024-08-02T08:42:08.433Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: techjewel Products: Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Fluent Forms plugin for WordPress by Fluent Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.1.9 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitra
5.1.9 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploitation level depends on who is granted the right to create forms by an administrator. This level can be as low as contributor, but by default is admin. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f4050403-6b8c-4023-b170-39f3cb68583e?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3041316%40fluentform%2Ftrunk&old=3025740%40fluentform%
.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3041316%40fluentform%2Ftrunk&old=3025740%40fluentform%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6958 State: PUBLISHED Published: 2024-01-18T07:30:25.980Z Last Updated: 2024-08-29T20:52:38.988Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: brechtvds Products: WP Recipe Maker Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 9.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject a
attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ec201702-8c8c-4049-b647-422d18001b7f?source=cve - https://plugins.trac.wordpress.org/changeset/3019769/wp-recipe-maker/trunk/includes/public/shortcodes/general/class-wprm-sc-text.php
CVE ID: CVE-2023-6959 State: PUBLISHED Published: 2024-02-05T21:21:49.970Z Last Updated: 2024-08-02T08:50:06.710Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: jetmonsters Products: Getwid – Gutenberg Blocks Problem Types: CWE-862 Missing Authorization Description: The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the recaptcha_api_key_manage function in all versions up to, and including, 2.0.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to add, modify, or delete the 'Recaptcha Site Key' and 'Recaptcha Secret Key' settin
subscriber-level access and above, to add, modify, or delete the 'Recaptcha Site Key' and 'Recaptcha Secret Key' settings. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/774c00fb-82cd-44ca-bf96-3f6dfd1977d0?source=cve - https://plugins.trac.wordpress.org/changeset/3022982
CVE ID: CVE-2023-6960 State: PUBLISHED Published: 2024-03-15T17:09:26.926Z Last Updated: 2025-11-04T18:22:04.237Z Vendors: Sciener Products: TTLock App Problem Types: CWE-324: Use of a Key Past its Expiration Date, CWE-603: Use of Client-Side Authentication Description: TTLock App virtual keys and settings are only deleted client side, and if preserved, can access the lock after intended deletion. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/
CVE ID: CVE-2023-6961 State: PUBLISHED Published: 2024-05-02T16:52:39.223Z Last Updated: 2024-08-02T08:50:06.655Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: joomunited Products: WP Meta SEO Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The WP Meta SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Referer’ header in all versions up to, and including, 4.5.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected
nauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ca91e41d-b728-4eb0-86d5-043813d8c2c1?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3071453%40wp-meta-seo%2Ftrunk&old=3068145%40wp-meta-seo%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6962 State: PUBLISHED Published: 2024-05-02T16:51:41.692Z Last Updated: 2024-08-02T08:50:06.698Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: joomunited Products: WP Meta SEO Problem Types: CWE-1230 Exposure of Sensitive Information Through Metadata Description: The WP Meta SEO plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.12 via the meta description. This makes it possible for unauthenticated attackers to disclose potentially sensitive information via the meta description of password-protected posts. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container
meta description of password-protected posts. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0323b54b-c15b-4d2d-9e8f-3df87c84dd49?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3071453%40wp-meta-seo%2Ftrunk&old=3068145%40wp-meta-seo%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6963 State: PUBLISHED Published: 2024-02-05T21:22:02.318Z Last Updated: 2024-08-02T08:50:06.720Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: jetmonsters Products: Getwid – Gutenberg Blocks Problem Types: CWE-804 Guessable CAPTCHA Description: The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 2.0.4. This makes it possible for unauthenticated attackers to bypass the Captcha Verification of the Contact Form block by omitting 'g-recaptcha-response' from the 'data' array. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.word
'data' array. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d317f2c7-06f3-4875-9f9b-eb7f450aa2f4?source=cve - https://plugins.trac.wordpress.org/changeset/3022982
CVE ID: CVE-2023-6964 State: PUBLISHED Published: 2024-04-09T18:59:15.108Z Last Updated: 2024-08-02T08:50:06.683Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) Vendors: britner Products: Gutenberg Blocks by Kadence Blocks – Page Builder Features Problem Types: CWE-918 Server-Side Request Forgery (SSRF) Description: The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.26 via the 'kadence_import_get_new_connection_data' AJAX action. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbit
is makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b01ad77f-2349-48bb-b4e9-f7cbce435de9?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3019592%40kadence-blocks&old=2996625%40kadence-blocks&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6965 State: PUBLISHED Published: 2024-04-09T18:59:20.952Z Last Updated: 2024-08-02T08:50:06.714Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: sc0ttkclark Products: Pods – Custom Content Types and Fields Problem Types: CWE-862 Missing Authorization Description: The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0.10 (with the exception of 2.7.31.2, 2.8.23.2, 2.9.19.2). This is due to the fact that the plugin allows the use of a file inclusion feature via shortcode. This makes it possible for authenticated attackers, with contributor access or higher
e inclusion feature via shortcode. This makes it possible for authenticated attackers, with contributor access or higher, to create pods and users (with default role). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c5d330cd-ad1f-451e-bf41-39cfeb296cf0?source=cve - https://plugins.trac.wordpress.org/browser/pods/trunk/classes/PodsView.php#L750 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3039486%40pods%2Ftrunk&old=3039467%40pods%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6966 State: PUBLISHED Published: 2024-06-06T02:02:58.810Z Last Updated: 2024-08-02T08:50:06.854Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: lvaudore Products: The Moneytizer Problem Types: CWE-284 Improper Access Control Description: The The Moneytizer plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missing capability check on multiple AJAX functions in the /core/core_ajax.php file in all versions up to, and including, 9.5.20. This makes it possible for authenticated attackers, with subscriber access and above, to update and retrieve billing and bank details, update and re
uthenticated attackers, with subscriber access and above, to update and retrieve billing and bank details, update and reset the plugin's settings, and update languages as well as other lower-severity actions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/71823e36-3899-4253-a1d2-c6f8921d18dc?source=cve - https://plugins.trac.wordpress.org/browser/the-moneytizer/trunk/core/core_ajax.php