Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-4354 State: PUBLISHED Published: 2022-12-08T00:00:00.000Z Last Updated: 2025-04-15T13:07:09.880Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: LinZhaoguan Products: pb-cms Problem Types: CWE-707 Description: A vulnerability was found in LinZhaoguan pb-cms 2.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /blog/comment of the component Message Board. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-215114 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Progr
blic and may be used. VDB-215114 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/LinZhaoguan/pb-cms/issues/I4XWJ7 - https://vuldb.com/?id.215114
CVE ID: CVE-2022-4355 State: PUBLISHED Published: 2023-01-02T21:49:20.342Z Last Updated: 2025-04-10T18:54:05.581Z Vendors: Unknown Products: LetsRecover Problem Types: CWE-89 SQL Injection Description: The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/221bf87b-69e2-4c53-971e-8516b798c759 - https://bulletin.iese.de/post/letsrecover-woocommerce-abandoned-cart_1-1-0_2
CVE ID: CVE-2022-4356 State: PUBLISHED Published: 2023-01-02T21:49:17.076Z Last Updated: 2025-04-10T19:05:12.760Z Vendors: Unknown Products: LetsRecover Problem Types: CWE-89 SQL Injection Description: The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/27a8d7cb-e179-408e-af13-8722ab41947b - https://bulletin.iese.de/post/letsrecover-woocommerce-abandoned-cart_1-1-0_3
CVE ID: CVE-2022-4357 State: PUBLISHED Published: 2023-01-02T21:49:11.254Z Last Updated: 2025-04-10T19:13:36.450Z Vendors: Unknown Products: LetsRecover Problem Types: CWE-89 SQL Injection Description: The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/4d1c0886-11f7-494f-b175-691253f46626 - https://bulletin.iese.de/post/letsrecover-woocommerce-abandoned-cart_1-1-0_1
CVE ID: CVE-2022-4358 State: PUBLISHED Published: 2023-01-02T21:49:24.151Z Last Updated: 2025-04-10T15:06:49.835Z Vendors: Unknown Products: WP RSS By Publishers Problem Types: CWE-89 SQL Injection Description: The WP RSS By Publishers WordPress plugin through 0.1 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0076a3b8-9a25-41c9-bb07-36ffe2c8c37d - https://bulletin.iese.de/post/wp-rss-by-publishers_0-1_3
CVE ID: CVE-2022-4359 State: PUBLISHED Published: 2023-01-02T21:49:23.302Z Last Updated: 2025-04-10T15:10:31.960Z Vendors: Unknown Products: WP RSS By Publishers Problem Types: CWE-89 SQL Injection Description: The WP RSS By Publishers WordPress plugin through 0.1 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8472dd40-27e3-4084-907a-e251a2a0f339 - https://bulletin.iese.de/post/wp-rss-by-publishers_0-1_2
CVE ID: CVE-2022-4360 State: PUBLISHED Published: 2023-01-02T21:49:13.655Z Last Updated: 2025-04-10T19:10:24.233Z Vendors: Unknown Products: WP RSS By Publishers Problem Types: CWE-89 SQL Injection Description: The WP RSS By Publishers WordPress plugin through 0.1 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/40c420aa-5da0-42f9-a94f-f68ef57fcdae - https://bulletin.iese.de/post/wp-rss-by-publishers_0-1_1
CVE ID: CVE-2022-4361 State: PUBLISHED Published: 2023-07-07T19:57:44.567Z Last Updated: 2024-11-12T19:43:42.651Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: keycloak Products: keycloak Problem Types: CWE-81 Description: Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC providers. The vulnerability can allow an attacker to execute malicious scripts by setting the AssertionConsumerServiceURL value or the redirect_uri. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2151618 - https://githu
am Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2151618 - https://github.com/keycloak/keycloak/commit/a1cfe6e24e5b34792699a00b8b4a8016a5929e3a
CVE ID: CVE-2022-4362 State: PUBLISHED Published: 2023-01-02T21:49:24.966Z Last Updated: 2025-04-10T15:03:53.813Z Vendors: Unknown Products: Popup Maker Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Popup Maker WordPress plugin before 1.16.9 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2660225a-e4c8-40f2-8c98-775ef2301212
CVE ID: CVE-2022-4363 State: PUBLISHED Published: 2025-05-16T20:33:45.656Z Last Updated: 2025-05-17T02:22:31.473Z Vendors: Unknown Products: Wholesale Market, Wholesale Market for WooCommerce Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Wholesale Market WordPress plugin before 2.2.2, Wholesale Market for WooCommerce WordPress plugin before 2.0.1 have a flawed CSRF check when updating their settings, which could allow attackers to make a logged in admin update them via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/734dba0b-f550-4372-884a-d42f7b0c00c7/
CVE ID: CVE-2022-4364 State: PUBLISHED Published: 2022-12-08T00:00:00.000Z Last Updated: 2025-10-15T13:18:53.461Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C) Vendors: Teledyne FLIR Products: AX8 Problem Types: CWE-77, CWE-74 Description: A vulnerability has been found in Teledyne FLIR AX8 up to 1.46.16. Affected by this issue is some unknown functionality of the file palette.php of the component Web Service Handler. The manipulation of the argument palette leads to command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.49.16 can resolve this issue. Upgrading the affect
been disclosed to the public and may be used. Upgrading to version 1.49.16 can resolve this issue. Upgrading the affected component is advised. The vendor points out: "FLIR AX8 internal web site has been refactored to be able to handle the reported vulnerabilities." Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.215118 - https://vuldb.com/?ctiid.215118 - https://vuldb.com/?submit.55748 - https://github.com/siriuswhiter/VulnHub/blob/main/Flir/02-FLIR-AX8%20palette.php%20%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E/FLIR-AX8%20palette.php%20%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E1.md
CVE ID: CVE-2022-4365 State: PUBLISHED Published: 2023-01-12T00:00:00.000Z Last Updated: 2025-04-08T13:51:16.139Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Information exposure in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A malicious Maintainer can leak the sentry token by changing the configured URL in the Sentry error tracking settings page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git
ing settings page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/385193 - https://hackerone.com/reports/1792626 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4365.json
CVE ID: CVE-2022-4366 State: PUBLISHED Published: 2022-12-08T00:00:00.000Z Last Updated: 2025-04-14T17:58:10.518Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: lirantal Products: lirantal/daloradius Problem Types: CWE-862 Description: Missing Authorization in GitHub repository lirantal/daloradius prior to master branch. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/f225d69a-d971-410d-a8f9-b0026143aed8 - https://github.com/lirantal/daloradius/commit/3d11f375a76ddb3741200296e15f81d82dfb80ce
CVE ID: CVE-2022-4367 State: REJECTED Published: N/A Last Updated: 2023-08-21T12:53:37.840Z Description: No description available.
CVE ID: CVE-2022-4368 State: PUBLISHED Published: 2023-01-09T22:13:44.939Z Last Updated: 2025-04-09T18:31:59.239Z Vendors: Unknown Products: WP CSV Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP CSV WordPress plugin through 1.8.0.0 does not sanitize and escape a parameter before outputting it back in the page when importing a CSV, and doe snot have CSRF checks in place as well, leading to a Reflected Cross-Site Scripting. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/fa7e2b64-ca48-4b76-a2c2-f5e31e42eab7
CVE ID: CVE-2022-4369 State: PUBLISHED Published: 2023-01-02T21:49:33.453Z Last Updated: 2025-04-10T18:37:17.812Z Vendors: Unknown Products: WP-Lister Lite for Amazon Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP-Lister Lite for Amazon WordPress plugin before 2.4.4 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which can be used against high-privilege users such as admin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/460a01e5-7ce5-4d49-b068-a93ea1fba0e3
CVE ID: CVE-2022-4370 State: PUBLISHED Published: 2023-01-02T21:49:09.194Z Last Updated: 2025-04-11T13:39:14.137Z Vendors: Unknown Products: multimedial images Problem Types: CWE-89 SQL Injection Description: The multimedial images WordPress plugin through 1.0b does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/cf336783-9959-413d-a5d7-73c7087426d8 - https://bulletin.iese.de/post/multimedial-images_1-0b
CVE ID: CVE-2022-4371 State: PUBLISHED Published: 2023-01-02T21:49:06.781Z Last Updated: 2025-04-11T13:41:13.522Z Vendors: Unknown Products: Web Invoice Problem Types: CWE-89 SQL Injection Description: The Web Invoice WordPress plugin through 2.1.3 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by high privilege users such as admin by default. However, depending on the plugin configuration, other users, such as subscriber could exploit this as well Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/45f43359-98c2-4447-b51b-2d466bad8261 - https:/
: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/45f43359-98c2-4447-b51b-2d466bad8261 - https://bulletin.iese.de/post/web-invoice_2-1-3_1
CVE ID: CVE-2022-4372 State: PUBLISHED Published: 2023-01-02T21:49:39.886Z Last Updated: 2025-04-10T17:55:40.174Z Vendors: Unknown Products: Web Invoice Problem Types: CWE-89 SQL Injection Description: The Web Invoice WordPress plugin through 2.1.3 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by high privilege users such as admin by default. However, depending on the plugin configuration, other users, such as subscriber could exploit this as well Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/218f8015-e14b-46a8-889d-08b2b822f8ae - https:/
: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/218f8015-e14b-46a8-889d-08b2b822f8ae - https://bulletin.iese.de/post/web-invoice_2-1-3_2
CVE ID: CVE-2022-4373 State: PUBLISHED Published: 2023-01-02T21:49:29.434Z Last Updated: 2025-04-10T18:48:39.135Z Vendors: Unknown Products: Quote-O-Matic Problem Types: CWE-89 SQL Injection Description: The Quote-O-Matic WordPress plugin through 1.0.5 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/aa07ddac-4f3d-4c4c-ba26-19bc05f22f02
CVE ID: CVE-2022-4374 State: PUBLISHED Published: 2023-01-09T22:13:39.294Z Last Updated: 2025-04-09T14:03:45.729Z Vendors: Unknown Products: Bg Bible References Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Bg Bible References WordPress plugin through 3.8.14 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/bbaa808d-47b1-4c70-b157-f8297f627a07
CVE ID: CVE-2022-4375 State: PUBLISHED Published: 2022-12-09T00:00:00.000Z Last Updated: 2025-04-15T13:06:55.576Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Mingsoft Products: MCMS Problem Types: CWE-707 Description: A vulnerability was found in Mingsoft MCMS up to 5.2.9. It has been classified as critical. Affected is an unknown function of the file /cms/category/list. The manipulation of the argument sqlWhere leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.2.10 is able to address this issue. It is recommended to upgrade the affected component. Th
used. Upgrading to version 5.2.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215196. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/mingSoft/MCMS/issues/I61TG5 - https://vuldb.com/?id.215196
CVE ID: CVE-2022-4376 State: PUBLISHED Published: 2023-05-03T00:00:00.000Z Last Updated: 2025-02-12T16:05:51.793Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Information exposure in GitLab Description: An issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Under certain conditions, an attacker may be able to map a private email of a GitLab user to their GitLab account on an instance. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/385246 - https://hackerone.com/reports/1794713 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4376.json
CVE ID: CVE-2022-4377 State: PUBLISHED Published: 2022-12-09T00:00:00.000Z Last Updated: 2025-04-15T13:06:46.719Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: unspecified Products: S-CMS Problem Types: CWE-707 Description: A vulnerability was found in S-CMS 5.0 Build 20220328. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Contact Information Page. The manipulation of the argument Make a Call leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-215197 was assigned to this vulnerability. Additional A
been disclosed to the public and may be used. The identifier VDB-215197 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mengdeyin/main/blob/main/README.md - https://vuldb.com/?id.215197
CVE ID: CVE-2022-4378 State: PUBLISHED Published: 2023-01-05T00:00:00.000Z Last Updated: 2025-04-10T14:19:42.254Z Vendors: n/a Products: kernel Problem Types: CWE-131 Description: A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a user changes certain kernel parameters and variables. This flaw allows a local user to crash or potentially escalate their privileges on the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2152548 - https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.0/proc-avoid-integer-type-confusion-in-get_proc_long.patch - h
scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.0/proc-avoid-integer-type-confusion-in-get_proc_long.patch - https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-6.0/proc-proc_skip_spaces-shouldn-t-think-it-is-working-on-c-strings.patch - https://seclists.org/oss-sec/2022/q4/178 - http://packetstormsecurity.com/files/171289/Kernel-Live-Patch-Security-Notice-LNS-0092-1.html
CVE ID: CVE-2022-4379 State: PUBLISHED Published: 2023-01-10T00:00:00.000Z Last Updated: 2025-04-08T18:40:03.110Z Vendors: n/a Products: Linux kernel Problem Types: CWE-416 Description: A use-after-free vulnerability was found in __nfs42_ssc_open() in fs/nfs/nfs4file.c in the Linux kernel. This flaw allows an attacker to conduct a remote denial Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://seclists.org/oss-sec/2022/q4/185 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=aeba12b26c79fc35e07e511f692a8907037d95da - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=75333d48f92256a0dec91
1f692a8907037d95da - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=75333d48f92256a0dec91dbf07835e804fc411c0 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RAVD6JIILAVSRHZ4VXSV3RAAGUXKVXZA/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LECFVUHKIRBV5JJBE3KQCLGKNYJPBRCN/ - https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html
CVE ID: CVE-2022-4381 State: PUBLISHED Published: 2023-01-02T21:49:25.883Z Last Updated: 2025-04-10T15:01:25.372Z Vendors: Unknown Products: Popup Maker Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Popup Maker WordPress plugin before 1.16.9 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8bf8ebe8-1063-492d-a0f9-2f824408d0df
CVE ID: CVE-2022-4382 State: PUBLISHED Published: 2023-01-10T00:00:00.000Z Last Updated: 2025-04-09T15:34:11.631Z Vendors: n/a Products: Linux kernel Problem Types: CWE-416 Description: A use-after-free flaw caused by a race among the superblock operations in the gadgetfs Linux driver was found. It could be triggered by yanking out a device that is running the gadgetfs side. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openwall.com/lists/oss-security/2022/12/14/5
CVE ID: CVE-2022-4383 State: PUBLISHED Published: 2023-01-23T14:31:39.680Z Last Updated: 2025-04-02T15:36:20.243Z Vendors: Unknown Products: CBX Petition for WordPress Problem Types: CWE-89 SQL Injection Description: The CBX Petition for WordPress plugin through 1.0.3 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e0fe5a53-8ae2-4b67-ac6e-4a8860e39035
CVE ID: CVE-2022-4384 State: PUBLISHED Published: 2023-02-06T19:59:16.563Z Last Updated: 2025-03-25T20:41:44.440Z Vendors: Unknown Products: Stream Problem Types: CWE-862 Missing Authorization Description: The Stream WordPress plugin before 3.9.2 does not prevent users with little privileges on the site (like subscribers) from using its alert creation functionality, which may enable them to leak sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2b506252-6f37-439e-8984-7316d5cca2e5
CVE ID: CVE-2022-4385 State: PUBLISHED Published: 2023-02-21T08:50:40.508Z Last Updated: 2025-03-12T16:14:17.795Z Vendors: Unknown Products: Intuitive Custom Post Order Problem Types: CWE-862 Missing Authorization Description: The Intuitive Custom Post Order WordPress plugin before 3.1.4 does not check for authorization in the update-menu-order ajax action, allowing any logged in user (with roles as low as Subscriber) to update the menu order Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8f900d37-6eee-4434-8b9b-d10cc4a9167c
CVE ID: CVE-2022-4386 State: PUBLISHED Published: 2023-02-21T08:51:02.973Z Last Updated: 2025-03-12T15:24:27.953Z Vendors: Unknown Products: Intuitive Custom Post Order Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Intuitive Custom Post Order WordPress plugin before 3.1.4 lacks CSRF protection in its update-menu-order ajax action, allowing an attacker to trick any user to change the menu order via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/734064e3-afe9-4dfd-8d76-8a757cc94815
CVE ID: CVE-2022-4390 State: PUBLISHED Published: 2022-12-09T00:00:00.000Z Last Updated: 2025-04-14T18:11:54.051Z Vendors: n/a Products: NETGEAR Nighthawk RAX30 Problem Types: Security Misconfiguration Description: A network misconfiguration is present in versions prior to 1.0.9.90 of the NETGEAR RAX30 AX2400 series of routers. IPv6 is enabled for the WAN interface by default on these devices. While there are firewall restrictions in place that define access restrictions for IPv4 traffic, these restrictions do not appear to be applied to the WAN interface for IPv6. This allows arbitrary access to any services running on the device that may be inadvertently listening via IPv6, such as the SSH