Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-0288 State: PUBLISHED Published: 2023-01-13T00:00:00.000Z Last Updated: 2025-04-07T15:36:06.577Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-122 Description: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/550a0852-9be0-4abe-906c-f803b34e41d3 - https://github.com/vim/vim/commit/232bdaaca98c34a99ffadf27bf6ee08be6cc8f6a - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYC22GGZ6QA66HLNLHCTAJU265TT3O33/ - https:/
project.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYC22GGZ6QA66HLNLHCTAJU265TT3O33/ - https://support.apple.com/kb/HT213670 - http://seclists.org/fulldisclosure/2023/Mar/17
CVE ID: CVE-2023-0289 State: PUBLISHED Published: 2023-01-13T00:00:00.000Z Last Updated: 2025-04-07T15:34:55.082Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: craigk5n Products: craigk5n/webcalendar Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository craigk5n/webcalendar prior to master. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/b9584c87-60e8-4a03-9e79-5f1e2d595361 - https://github.com/craigk5n/webcalendar/commit/7906b4924c2dc3727c3540682f432ebbb93f810d
CVE ID: CVE-2023-0290 State: PUBLISHED Published: 2023-01-18T21:10:42.929Z Last Updated: 2025-04-03T19:52:44.579Z Vendors: Rapid7 Products: Velociraptor Problem Types: CWE-22 Description: Rapid7 Velociraptor did not properly sanitize the client ID parameter to the CreateCollection API, allowing a directory traversal in where the collection task could be written. It was possible to provide a client id of "../clients/server" to schedule the collection for the server (as a server artifact), but only require privileges to schedule collections on the client. Normally, to schedule an artifact on the server, the COLLECT_SERVER permission is required. This permission is normally only granted to "adm
e an artifact on the server, the COLLECT_SERVER permission is required. This permission is normally only granted to "administrator" role. Due to this issue, it is sufficient to have the COLLECT_CLIENT privilege, which is normally granted to the "investigator" role. To exploit this vulnerability, the attacker must already have a Velociraptor user account at least "investigator" level, and be able to authenticate to the GUI and issue an API call to the backend. Typically, most users deploy Velociraptor with limited access to a trusted group, and most users will already be administrators within the GUI. This issue affects Velociraptor versions before 0.6.7-5. Version 0.6.7-5, released January 1
inistrators within the GUI. This issue affects Velociraptor versions before 0.6.7-5. Version 0.6.7-5, released January 16, 2023, fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Velocidex/velociraptor
CVE ID: CVE-2023-0291 State: PUBLISHED Published: 2023-06-09T05:33:19.875Z Last Updated: 2024-12-28T00:51:57.705Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L) Vendors: expresstech Products: Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress Problem Types: CWE-862 Missing Authorization Description: The Quiz And Survey Master for WordPress is vulnerable to authorization bypass due to a missing capability check on the function associated with the qsm_remove_file_fd_question AJAX action in versions up to, and including, 8.0.8. This makes it possible for unauthenticated attackers to delete arbitrary media files. Additional Analyst Notes: - CVE Progr
s makes it possible for unauthenticated attackers to delete arbitrary media files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/68110321-db1a-4634-98cd-0afd3ec933b8?source=cve - https://wordpress.org/plugins/quiz-master-next/ - https://packetstormsecurity.com/files/171011/wpqsm808-xsrf.txt - https://plugins.trac.wordpress.org/changeset/2834471/quiz-master-next
CVE ID: CVE-2023-0292 State: PUBLISHED Published: 2023-06-09T05:33:32.758Z Last Updated: 2024-12-20T23:35:22.249Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: expresstech Products: Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Quiz And Survey Master plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.0.8. This is due to missing nonce validation on the function associated with the qsm_remove_file_fd_question AJAX action. This makes it possible for unauthenticated attackers to delete arbitrary media files via
_file_fd_question AJAX action. This makes it possible for unauthenticated attackers to delete arbitrary media files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c75e6d27-7f6b-4bec-b653-c2024504f427?source=cve - https://wordpress.org/plugins/quiz-master-next/ - https://packetstormsecurity.com/files/171011/wpqsm808-xsrf.txt - https://plugins.trac.wordpress.org/changeset/2834471/quiz-master-next
CVE ID: CVE-2023-0293 State: PUBLISHED Published: 2023-01-13T19:44:45.861Z Last Updated: 2025-01-13T17:12:21.237Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: plugincraft Products: Mediamatic – Media Library Folders Problem Types: CWE-862 Missing Authorization Description: The Mediamatic – Media Library Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions up to, and including, 2.8.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to change image categories, which it uses to arrange them in folder views. Additional Analyst Notes
rmissions and above, to change image categories, which it uses to arrange them in folder views. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e5c87ae0-9a53-4292-a4d3-05b3bdb37b71 - https://plugins.trac.wordpress.org/browser/mediamatic/trunk/inc/sidebar.php?rev=2652957#L343
CVE ID: CVE-2023-0294 State: PUBLISHED Published: 2023-01-13T19:46:14.739Z Last Updated: 2025-01-13T17:12:04.960Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: plugincraft Products: Mediamatic – Media Library Folders Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Mediamatic – Media Library Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.1. This is due to missing or incorrect nonce validation on its AJAX actions function. This makes it possible for unauthenticated attackers to change image categories used by the plugin, via forged request granted they can trick a site ad
thenticated attackers to change image categories used by the plugin, via forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d81ed8d9-4a7a-4b75-aab4-8e4dbd554f32 - https://plugins.trac.wordpress.org/browser/mediamatic/trunk/inc/sidebar.php?rev=2652957#L343
CVE ID: CVE-2023-0295 State: PUBLISHED Published: 2023-01-13T19:54:33.692Z Last Updated: 2025-01-13T17:11:53.060Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: obox Products: Launchpad – Coming Soon & Maintenance Mode Plugin Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Launchpad plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of its settings parameters in versions up to, and including, 1.0.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above,
and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b8721c4d-d89b-4e97-af01-20327013cfb6 - https://plugins.trac.wordpress.org/browser/launchpad-by-obox/tags/1.0.13/functions/settings.php#L542
CVE ID: CVE-2023-0296 State: PUBLISHED Published: 2023-01-17T00:00:00.000Z Last Updated: 2025-04-04T18:48:51.215Z Vendors: n/a Products: Red Hat OpenShift Problem Types: CWE-327 Description: The Birthday attack against 64-bit block ciphers flaw (CVE-2016-2183) was reported for the health checks port (9979) on etcd grpc-proxy component. Even though the CVE-2016-2183 has been fixed in the etcd components, to enable periodic health checks from kubelet, it was necessary to open up a new port (9979) on etcd grpc-proxy, hence this port might be considered as still vulnerable to the same type of vulnerability. The health checks on etcd grpc-proxy do not contain sensitive data (only metrics data), t
he same type of vulnerability. The health checks on etcd grpc-proxy do not contain sensitive data (only metrics data), therefore the potential impact related to this vulnerability is minimal. The CVE-2023-0296 has been assigned to this issue to track the permanent fix in the etcd component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2161287
CVE ID: CVE-2023-0297 State: PUBLISHED Published: 2023-01-14T00:00:00.000Z Last Updated: 2025-04-07T18:41:55.800Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: pyload Products: pyload/pyload Problem Types: CWE-94 Description: Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/3fd606f7-83e1-4265-b083-2e1889a05e65 - https://github.com/pyload/pyload/commit/7d73ba7919e594d783b3411d7ddb87885aea782d - http://packetstormsecurity.com/files/171096/pyLoad-js2py-Python-Execution.html - http://packetstormsecurity.com/files/17291
p://packetstormsecurity.com/files/171096/pyLoad-js2py-Python-Execution.html - http://packetstormsecurity.com/files/172914/PyLoad-0.5.0-Remote-Code-Execution.html
CVE ID: CVE-2023-0298 State: PUBLISHED Published: 2023-01-14T00:00:00.000Z Last Updated: 2025-04-07T18:41:21.353Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: firefly-iii Products: firefly-iii/firefly-iii Problem Types: CWE-863 Description: Incorrect Authorization in GitHub repository firefly-iii/firefly-iii prior to 5.8.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/9689052c-c1d7-4aae-aa08-346c9b6e04ed - https://github.com/firefly-iii/firefly-iii/commit/db0500dcf0d4f1990fc7a377ef0d56c3884fcaa4
CVE ID: CVE-2023-0299 State: PUBLISHED Published: 2023-01-14T00:00:00.000Z Last Updated: 2025-04-07T18:40:49.723Z Severity: HIGH (CVSS 8.4 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: publify Products: publify/publify Problem Types: CWE-20 Description: Improper Input Validation in GitHub repository publify/publify prior to 9.2.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/0049774b-1857-46dc-a834-f1fb15138c53 - https://github.com/publify/publify/commit/ca46da283572b4f8c0b5aa245008756c8a5fd1b1
CVE ID: CVE-2023-0300 State: PUBLISHED Published: 2023-01-14T00:00:00.000Z Last Updated: 2025-04-07T18:27:10.813Z Severity: LOW (CVSS 3.5 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N) Vendors: alfio-event Products: alfio-event/alf.io Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Reflected in GitHub repository alfio-event/alf.io prior to 2.0-M4-2301. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/0a91fec7-a76e-4ca3-80ba-81de1f10d59d - https://github.com/alfio-event/alf.io/commit/c1ae54ac84f1c7a5ec2831876f6445cb79be96fc
CVE ID: CVE-2023-0301 State: PUBLISHED Published: 2023-01-14T00:00:00.000Z Last Updated: 2025-04-07T18:26:43.444Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: alfio-event Products: alfio-event/alf.io Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository alfio-event/alf.io prior to Alf.io 2.0-M4-2301. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/8a91e127-2903-4c6b-9a66-e4d2e30f8dec - https://github.com/alfio-event/alf.io/commit/21cb2866e5f58b4a2b4a2cb0066479bbb26f7b39
CVE ID: CVE-2023-0302 State: PUBLISHED Published: 2023-01-15T00:00:00.000Z Last Updated: 2025-04-07T17:47:12.256Z Severity: HIGH (CVSS 8.6 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: radareorg Products: radareorg/radare2 Problem Types: CWE-75 Description: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository radareorg/radare2 prior to 5.8.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/583133af-7ae6-4a21-beef-a4b0182cf82e - https://github.com/radareorg/radare2/commit/961f0e723903011d4f54c2396e44efa91fcc74ce
CVE ID: CVE-2023-0303 State: PUBLISHED Published: 2023-01-15T11:58:03.447Z Last Updated: 2024-08-02T05:10:55.012Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Food Ordering System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Online Food Ordering System. It has been rated as critical. Affected by this issue is some unknown functionality of the file view_prod.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-218384. Additional Analyst Notes: - CVE Program Co
e public and may be used. The identifier of this vulnerability is VDB-218384. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.218384 - https://vuldb.com/?ctiid.218384 - https://github.com/Hanfu-l/cvetest/blob/main/1.pdf
CVE ID: CVE-2023-0304 State: PUBLISHED Published: 2023-01-15T11:58:04.380Z Last Updated: 2024-08-02T05:10:55.200Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Food Ordering System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in SourceCodester Online Food Ordering System. This affects an unknown part of the file admin_class.php of the component Signup Module. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-218385 was assigned to this vulnerability. Additional A
been disclosed to the public and may be used. The identifier VDB-218385 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.218385 - https://vuldb.com/?ctiid.218385 - https://github.com/Hanfu-l/cvetest/blob/main/2.pdf
CVE ID: CVE-2023-0305 State: PUBLISHED Published: 2023-01-15T11:58:05.307Z Last Updated: 2024-08-02T05:10:55.167Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Food Ordering System Problem Types: CWE-89 Description: A vulnerability classified as critical was found in SourceCodester Online Food Ordering System. This vulnerability affects unknown code of the file admin_class.php of the component Login Module. The manipulation of the argument username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-218386 is the identifier assigned to this vulnerability. Additional Anal
en disclosed to the public and may be used. VDB-218386 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.218386 - https://vuldb.com/?ctiid.218386 - https://github.com/Hanfu-l/cvetest/blob/main/3.pdf
CVE ID: CVE-2023-0306 State: PUBLISHED Published: 2023-01-15T00:00:00.000Z Last Updated: 2025-04-07T17:46:37.325Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: thorsten Products: thorsten/phpmyfaq Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/cbba22f0-89ed-4d01-81ea-744979c8cbde - https://github.com/thorsten/phpmyfaq/commit/1815daef61c432bb73b9dca43f03d140c94ef0c5
CVE ID: CVE-2023-0307 State: PUBLISHED Published: 2023-01-15T00:00:00.000Z Last Updated: 2025-04-07T15:25:30.956Z Severity: MEDIUM (CVSS 5.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: thorsten Products: thorsten/phpmyfaq Problem Types: CWE-521 Description: Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/fac01e9f-e3e5-4985-94ad-59a76485f215 - https://github.com/thorsten/phpmyfaq/commit/8beed2fca5b0b82c6ba866d0ffd286d0c1fbf596
CVE ID: CVE-2023-0308 State: PUBLISHED Published: 2023-01-15T00:00:00.000Z Last Updated: 2025-04-07T15:23:38.365Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: thorsten Products: thorsten/phpmyfaq Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/83cfed62-af8b-4aaa-94f2-5a33dc0c2d69 - https://github.com/thorsten/phpmyfaq/commit/810ee26d25c3d97664532861863099952f0e9a1f
CVE ID: CVE-2023-0309 State: PUBLISHED Published: 2023-01-15T00:00:00.000Z Last Updated: 2025-04-07T15:22:24.721Z Severity: HIGH (CVSS 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: thorsten Products: thorsten/phpmyfaq Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/c03c5925-43ff-450d-9827-2b65a3307ed6 - https://github.com/thorsten/phpmyfaq/commit/376d1d3e5a42edf07260e98461d2fddbee74419b
CVE ID: CVE-2023-0310 State: PUBLISHED Published: 2023-01-15T00:00:00.000Z Last Updated: 2025-04-07T15:21:09.671Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: thorsten Products: thorsten/phpmyfaq Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/051d5e20-7fab-4769-bd7d-d986b804bb5a - https://github.com/thorsten/phpmyfaq/commit/53099a9bcc928f5f6f7cce111c04b79a72a04142
CVE ID: CVE-2023-0311 State: PUBLISHED Published: 2023-01-15T00:00:00.000Z Last Updated: 2025-04-07T15:19:22.209Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: thorsten Products: thorsten/phpmyfaq Problem Types: CWE-287 Description: Improper Authentication in GitHub repository thorsten/phpmyfaq prior to 3.1.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/82b0b629-c56b-4651-af3f-17f749751857 - https://github.com/thorsten/phpmyfaq/commit/fe6e9f02ef1b26a03134b9becda12687ee5f3214
CVE ID: CVE-2023-0312 State: PUBLISHED Published: 2023-01-15T00:00:00.000Z Last Updated: 2025-04-07T15:17:04.130Z Severity: HIGH (CVSS 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: thorsten Products: thorsten/phpmyfaq Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/f50ec8d1-cd60-4c2d-9ab8-3711870d83b9 - https://github.com/thorsten/phpmyfaq/commit/65d419ca04111ee2612ae81cdd59753654cfe18a
CVE ID: CVE-2023-0313 State: PUBLISHED Published: 2023-01-15T00:00:00.000Z Last Updated: 2025-04-07T15:15:48.792Z Severity: MEDIUM (CVSS 4.7 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: thorsten Products: thorsten/phpmyfaq Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/bc27e84b-1f91-4e1b-a78c-944edeba8256 - https://github.com/thorsten/phpmyfaq/commit/1123c0872314fa68d7d0d8136939f62270fb4b7b
CVE ID: CVE-2023-0314 State: PUBLISHED Published: 2023-01-15T00:00:00.000Z Last Updated: 2025-04-07T15:14:52.719Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: thorsten Products: thorsten/phpmyfaq Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/eac0a9d7-9721-4191-bef3-d43b0df59c67 - https://github.com/thorsten/phpmyfaq/commit/3872e7eac2ddeac182fc1335cc312d1392d56f98
CVE ID: CVE-2023-0315 State: PUBLISHED Published: 2023-01-16T00:00:00.000Z Last Updated: 2025-04-07T15:10:02.344Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: froxlor Products: froxlor/froxlor Problem Types: CWE-77 Description: Command Injection in GitHub repository froxlor/froxlor prior to 2.0.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/ff4e177b-ba48-4913-bbfa-ab8ce0db5943 - https://github.com/froxlor/froxlor/commit/090cfc26f2722ac3036cc7fd1861955bc36f065a - http://packetstormsecurity.com/files/171108/Froxlor-2.0.6-Remote-Command-Execution.html - http://packetstormsecurity.com/file
//packetstormsecurity.com/files/171108/Froxlor-2.0.6-Remote-Command-Execution.html - http://packetstormsecurity.com/files/171729/Froxlor-2.0.3-Stable-Remote-Code-Execution.html
CVE ID: CVE-2023-0316 State: PUBLISHED Published: 2023-01-16T00:00:00.000Z Last Updated: 2025-04-07T15:09:07.193Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: froxlor Products: froxlor/froxlor Problem Types: CWE-29 Description: Path Traversal: '\..\filename' in GitHub repository froxlor/froxlor prior to 2.0.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/c190e42a-4806-47aa-aa1e-ff5d6407e244 - https://github.com/froxlor/froxlor/commit/983d9294603925018225d672795bd8b4a526f41e