Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-6875 State: PUBLISHED Published: 2024-01-11T08:33:06.214Z Last Updated: 2025-06-03T14:08:33.781Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: wpexpertsio Products: POST SMTP – The #1 WordPress SMTP Plugin with Advanced Email Logging and Delivery Failure Notifications Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a type juggling issue on the connect-app REST endpoint in all versions up to, and including, 2.
ification of data due to a type juggling issue on the connect-app REST endpoint in all versions up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to reset the API key used to authenticate to the mailer and view logs, including password reset emails, allowing site takeover. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e675d64c-cbb8-4f24-9b6f-2597a97b49af?source=cve - https://plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/Mobile/includes/rest-api/v1/rest-api.php#L60 - https://plugins.trac.wordpress.org/changeset/3016051/post-smtp/trunk?contextall=1&
cludes/rest-api/v1/rest-api.php#L60 - https://plugins.trac.wordpress.org/changeset/3016051/post-smtp/trunk?contextall=1&old=3012318&old_path=%2Fpost-smtp%2Ftrunk - http://packetstormsecurity.com/files/176525/WordPress-POST-SMTP-Mailer-2.8.7-Authorization-Bypass-Cross-Site-Scripting.html
CVE ID: CVE-2023-6876 State: PUBLISHED Published: 2024-06-07T02:02:39.081Z Last Updated: 2024-08-02T08:42:08.420Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: nayrathemes Products: Clever Fox Problem Types: CWE-862 Missing Authorization Description: The Clever Fox – One Click Website Importer by Nayra Themes plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'clever-fox-activate-theme' function in all versions up to, and including, 25.2.0. This makes it possible for authenticated attackers, with subscriber access and above, to modify the active theme, including to an invalid value which can tak
ted attackers, with subscriber access and above, to modify the active theme, including to an invalid value which can take down the site. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9e1f94d9-8be6-4174-90a5-820c0207a2fa?source=cve - https://plugins.trac.wordpress.org/browser/clever-fox/trunk/clever-fox.php#L539 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3096085%40clever-fox&new=3096085%40clever-fox&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6877 State: PUBLISHED Published: 2024-04-07T01:55:15.228Z Last Updated: 2024-08-02T08:42:08.264Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themeisle Products: RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 4.3.3 due to insufficient input sanitiza
e Scripting via the plugin's shortcode(s) in all versions up to, and including, 4.3.3 due to insufficient input sanitization and output escaping on the Content-Type field of error messages when retrieving an invalid RSS feed. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7d25e85f-28f7-4cc5-9856-25cc5aaf1418?source=cve - https://plugins.trac.wordpress.org/changeset/3012849/feedzy-rss-feeds
CVE ID: CVE-2023-6878 State: PUBLISHED Published: 2024-01-11T08:32:39.464Z Last Updated: 2025-06-17T21:09:14.660Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: remix4 Products: Slick Social Share Buttons Problem Types: CWE-285 Improper Authorization Description: The Slick Social Share Buttons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'dcssb_ajax_update' function in versions up to, and including, 2.4.11. This makes it possible for authenticated attackers, with subscriber-level permissions or above to update the site options arbitrarily. Additional Analyst Notes: - CVE Program Container: -
level permissions or above to update the site options arbitrarily. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/79a5c01d-3867-4b1e-b0ba-9a802f0bed92?source=cve - https://plugins.trac.wordpress.org/browser/slick-social-share-buttons/tags/2.4.11/inc/dcwp_admin.php#L49
CVE ID: CVE-2023-6879 State: PUBLISHED Published: 2023-12-27T22:16:41.709Z Last Updated: 2025-02-13T17:26:59.114Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: libaom Products: libaom Problem Types: CWE-20 Description: Increasing the resolution of video frames, while performing a multi-threaded encode, can result in a heap overflow in av1_loop_restoration_dealloc(). Additional Analyst Notes: - CVE Program Container: References: - https://crbug.com/aomedia/3491 - https://aomedia.googlesource.com/aom/+/refs/tags/v3.7.1 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D6C2HN4T2S6GYNTAUXLH45LQZHK7QPHP/ - https://
aproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D6C2HN4T2S6GYNTAUXLH45LQZHK7QPHP/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AYONA2XSNFMXLAW4IHLFI5UVV3QRNG5K/
CVE ID: CVE-2023-6880 State: PUBLISHED Published: 2024-03-13T15:26:52.043Z Last Updated: 2025-04-15T15:22:21.047Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: visualcomposer Products: Visual Composer Website Builder, Landing Page Builder, Custom Theme Builder, Maintenance Mode & Coming Soon Pages Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Visual Composer Website Builder, Landing Page Builder, Custom Theme Builder, Maintenance Mode & Coming Soon Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom fields in all versions up to, and inc
for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom fields in all versions up to, and including, 45.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/622b9b46-774d-4251-9a79-73e5b398de57?source=cve - https://help.visualcomposer.com/release-notes/
CVE ID: CVE-2023-6881 State: PUBLISHED Published: 2024-02-20T18:25:19.453Z Last Updated: 2024-08-02T08:42:08.232Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: zephyrproject-rtos Products: Zephyr Problem Types: CWE-120 Description: Possible buffer overflow in is_mount_point Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-mh67-4h3q-p437
CVE ID: CVE-2023-6882 State: PUBLISHED Published: 2024-01-11T08:32:31.384Z Last Updated: 2025-06-03T14:09:54.530Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: mra13 Products: Simple Membership Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Simple Membership plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘environment_mode’ parameter in all versions up to, and including, 4.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can
. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/366165fe-93e5-49ab-b2e5-1de624f22286?source=cve - https://plugins.trac.wordpress.org/changeset/3010737/simple-membership
CVE ID: CVE-2023-6883 State: PUBLISHED Published: 2024-01-11T06:49:32.594Z Last Updated: 2025-06-17T21:09:14.785Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: sjaved Products: Easy Social Feed – Social Photos Gallery – Post Feed – Like Box Problem Types: CWE-862 Missing Authorization Description: The Easy Social Feed plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in all versions up to, and including, 6.5.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform unauthorized actions, such as modifying the plugin's Facebook a
kers, with subscriber-level access and above, to perform unauthorized actions, such as modifying the plugin's Facebook and Instagram access tokens and updating group IDs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3deee9b5-2e36-447d-a492-e22e3dc6a5ab?source=cve - https://plugins.trac.wordpress.org/changeset/3012165/easy-facebook-likebox
CVE ID: CVE-2023-6884 State: PUBLISHED Published: 2024-02-05T21:21:56.066Z Last Updated: 2024-08-02T08:42:07.970Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: widgetpack Products: Plugin for Google Reviews Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: This plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on the 'place_id' attribute. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary
te. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a8971d54-b54e-4e62-9db2-fa87d2564599?source=cve - https://plugins.svn.wordpress.org/widget-google-reviews/tags/3.1/includes/class-feed-shortcode.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3018964%40widget-google-reviews&new=3018964%40widget-google-reviews&sfp_email=&sfph_mail= - https://advisory.abay.sh/c
d=3018964%40widget-google-reviews&new=3018964%40widget-google-reviews&sfp_email=&sfph_mail= - https://advisory.abay.sh/cve-2023-6884
CVE ID: CVE-2023-6885 State: PUBLISHED Published: 2023-12-16T22:31:04.269Z Last Updated: 2024-08-02T08:42:08.412Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Tongda Products: OA 2017 Problem Types: CWE-89 Description: A vulnerability was found in Tongda OA 2017 up to 11.10. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file general/vote/manage/delete.php. The manipulation of the argument DELETE_STR leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-248245 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure
The identifier VDB-248245 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.248245 - https://vuldb.com/?ctiid.248245 - https://github.com/Martinzb/cve/blob/main/sql.md
CVE ID: CVE-2023-6886 State: PUBLISHED Published: 2023-12-17T00:00:07.384Z Last Updated: 2024-08-02T08:42:08.440Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: xnx3 Products: wangmarket Problem Types: CWE-94 Description: A vulnerability was found in xnx3 wangmarket 6.1. It has been rated as critical. Affected by this issue is some unknown functionality of the component Role Management Page. The manipulation leads to code injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-248246 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.24
ssigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.248246 - https://vuldb.com/?ctiid.248246 - https://github.com/xnx3/wangmarket/issues/8
CVE ID: CVE-2023-6887 State: PUBLISHED Published: 2023-12-17T00:31:04.405Z Last Updated: 2024-08-27T16:07:38.915Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: saysky Products: ForestBlog Problem Types: CWE-434 Description: A vulnerability classified as critical has been found in saysky ForestBlog up to 20220630. This affects an unknown part of the file /admin/upload/img of the component Image Upload Handler. The manipulation of the argument filename leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248247. Additional Analyst Notes: -
o the public and may be used. The associated identifier of this vulnerability is VDB-248247. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.248247 - https://vuldb.com/?ctiid.248247 - https://github.com/daydust/vuln/blob/main/ForestBlog/Arbitrary_File_Upload_Vulnerability.md
CVE ID: CVE-2023-6888 State: PUBLISHED Published: 2023-12-17T01:00:05.578Z Last Updated: 2024-10-07T14:54:46.869Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHZ76 Products: RtspServer Problem Types: CWE-121 Description: A vulnerability classified as critical was found in PHZ76 RtspServer 1.0.0. This vulnerability affects the function ParseRequestLine of the file RtspMesaage.cpp. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248248. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Ad
lnerability is VDB-248248. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.248248 - https://vuldb.com/?ctiid.248248 - http://www.huiyao.love/2023/12/08/rtspserver-stackoverflow-vulnerability/ - https://github.com/hu1y40/PoC/blob/main/rtspserver_stackoverflow_poc.py
CVE ID: CVE-2023-6889 State: PUBLISHED Published: 2023-12-16T08:57:30.625Z Last Updated: 2024-08-02T08:42:08.652Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: thorsten Products: thorsten/phpmyfaq Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.17. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.com/bounties/52897778-fad7-4169-bf04-a68a0646df0c - https://github.com/thorsten/phpmyfaq/commit/1037a8f012e0d9ec4bf4c8107972f6695e381392
CVE ID: CVE-2023-6890 State: PUBLISHED Published: 2023-12-16T08:57:31.033Z Last Updated: 2024-08-02T08:42:08.501Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: thorsten Products: thorsten/phpmyfaq Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.17. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.com/bounties/2cf11678-8793-4fa1-b21a-f135564a105d - https://github.com/thorsten/phpmyfaq/commit/97d90ebbe11ebc6081bf49a2ba4b60f227cd1b43
CVE ID: CVE-2023-6891 State: PUBLISHED Published: 2023-12-17T03:31:03.908Z Last Updated: 2024-08-02T08:42:08.513Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: PeaZip Problem Types: CWE-427 Description: A vulnerability has been found in PeaZip 9.4.0 and classified as problematic. Affected by this vulnerability is an unknown functionality in the library dragdropfilesdll.dll of the component Library Handler. The manipulation leads to uncontrolled search path. An attack has to be approached locally. Upgrading to version 9.6.0 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vul
s able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-248251. NOTE: Vendor was contacted early, confirmed the existence of the flaw and immediately worked on a patched release. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.248251 - https://vuldb.com/?ctiid.248251 - https://peazip.github.io/changelog.html
CVE ID: CVE-2023-6892 State: PUBLISHED Published: 2024-04-18T11:05:29.236Z Last Updated: 2024-08-02T08:42:08.646Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: algoritmika Products: EAN for WooCommerce Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The EAN for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'alg_wc_ean_product_meta' shortcode in all versions up to, and including, 4.8.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor
ion and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d798406b-2b7f-4ca0-8d05-8aff4bf44dd8?source=cve - https://plugins.trac.wordpress.org/changeset/3070991/ean-for-woocommerce
CVE ID: CVE-2023-6893 State: PUBLISHED Published: 2023-12-17T06:31:03.966Z Last Updated: 2024-08-02T08:42:08.394Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Hikvision Products: Intercom Broadcasting System Problem Types: CWE-22 Description: A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK) and classified as problematic. Affected by this issue is some unknown functionality of the file /php/exportrecord.php. The manipulation of the argument downname with the input C:\ICPAS\Wnmp\WWW\php\conversion.php leads to path traversal. The exploit has been disclosed to the public and may be used. Upgrading to version 4.1
sion.php leads to path traversal. The exploit has been disclosed to the public and may be used. Upgrading to version 4.1.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-248252. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.248252 - https://vuldb.com/?ctiid.248252 - https://github.com/willchen0011/cve/blob/main/download.md
CVE ID: CVE-2023-6894 State: PUBLISHED Published: 2023-12-17T07:31:03.712Z Last Updated: 2025-05-07T20:41:21.185Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Hikvision Products: Intercom Broadcasting System Problem Types: CWE-200 Description: A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK). It has been classified as problematic. This affects an unknown part of the file access/html/system.html of the component Log File Handler. The manipulation leads to information disclosure. The exploit has been disclosed to the public and may be used. Upgrading to version 4.1.0 is able to address this issue. It is recomme
as been disclosed to the public and may be used. Upgrading to version 4.1.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-248253 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.248253 - https://vuldb.com/?ctiid.248253 - https://github.com/willchen0011/cve/blob/main/unaccess.md
CVE ID: CVE-2023-6895 State: PUBLISHED Published: 2023-12-17T08:00:05.112Z Last Updated: 2024-11-21T14:28:13.968Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Hikvision Products: Intercom Broadcasting System Problem Types: CWE-78 Description: A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK). It has been declared as critical. This vulnerability affects unknown code of the file /php/ping.php. The manipulation of the argument jsondata[ip] with the input netstat -ano leads to os command injection. The exploit has been disclosed to the public and may be used. Upgrading to version 4.1.0 is able to address this issu
n. The exploit has been disclosed to the public and may be used. Upgrading to version 4.1.0 is able to address this issue. It is recommended to upgrade the affected component. VDB-248254 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.248254 - https://vuldb.com/?ctiid.248254 - https://github.com/willchen0011/cve/blob/main/rce.md
CVE ID: CVE-2023-6896 State: PUBLISHED Published: 2023-12-17T10:00:05.211Z Last Updated: 2024-10-03T19:08:22.528Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Simple Image Stack Website Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Simple Image Stack Website 1.0. It has been rated as problematic. This issue affects some unknown processing. The manipulation of the argument search with the input sy2ap%22%3e%3cscript%3ealert(1)%3c%2fscript%3etkxh1 leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability
remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248255. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.248255 - https://vuldb.com/?ctiid.248255 - https://www.yuque.com/u39434519/pfhiwd/vry762ncuczem3yi?singleDoc#