alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: CVE similar to CVE-2015-3307
Matching passage: CVE-2015-3307. CWE: CWE-119. CVSS: 7.5. The phar_parse_metadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (heap metadata corruption) or possibly have unspecified other impact via a crafted tar archive.
Near-miss passage: CVE-2015-6080. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6068, CVE-2015-6072, CVE-2015-6073, CVE-2015-6075, CVE-2015-6077, CVE-2015-6079, and CVE-2015-6082.
Query: risk of Apache Directory LDAP API before 1.0.0-M31 allows attackers to conduct timing attacks via unspecified vectors.
Matching passage: CVE-2015-3250. CWE: CWE-200. CVSS: 7.5. Apache Directory LDAP API before 1.0.0-M31 allows attackers to conduct timing attacks via unspecified vectors.
Near-miss passage: CVE-2015-3092. CWE: CWE-200. CVSS: 5.0. Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors, a different vulnerability than CVE-2015-3091.
Query: rule covering Detects execution of regsvr32 where the DLL is located in a potentially suspicious location.
Matching passage: Sigma rule: Detects execution of regsvr32 where the DLL is located in a potentially suspicious location.. Logsource: windows / process_creation. Rule: title: Regsvr32 Execution From Potential Suspicious Location id: 9525dc73-0327-438c-8c04-13c0e037e9da related: - id: 8e2b24c9-4add-46a0-b4bb-0057b4e6187d type: obsolete status: test description: Detects execution of regsvr32 where the DLL is located in a potentially suspicious location. references: - https://web.archive.org/web/20171001085340/https://subt0x10.blogspot.com/2017/04/bypass-application-whitelisting-script.html - https://app.any.run/tasks/34221348-072d-4b70-93f3-aa71f6ebecad/ author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2023-05-26 tags: - attack.stealth - attack.t1218.010 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \regsvr32.exe - OriginalFileName: REGSVR32.EXE selection_cli: CommandLine|contains: - :\ProgramData\ - :\Temp\ - :\Users\Public\ - :\Windows\Temp\ - \AppData\Local\Temp\ - \AppData\Roaming\ condition: all of selection_* falsepositives: - Some installers might execute "regsvr32" with DLLs located in %TEMP% or in %PROGRAMDATA%. Apply additional filters if necessary. level: medium
Near-miss passage: Sigma rule: Detects application popup reporting a failure of the Sysmon service. Logsource: windows / system. Rule: title: Sysmon Application Crashed id: 4d7f1827-1637-4def-8d8a-fd254f9454df status: test description: Detects application popup reporting a failure of the Sysmon service references: - https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows10/1803/W10_1803_Pro_19700101_17134.1/WEPExplorer/Application%20Popup.xml#L36 author: Tim Shelton date: 2022-04-26 modified: 2024-01-17 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: system detection: selection: Provider_Name: Application Popup EventID: 26 Caption: - sysmon64.exe - Application Error - sysmon.exe - Application Error condition: selection falsepositives: - Unknown level: high
Query: detect TFTP Boot
Matching passage: T1542.005 TFTP Boot. Tactics: stealth, persistence. Description: Adversaries may abuse netbooting to load an unauthorized network device operating system from a Trivial File Transfer Protocol (TFTP) server. TFTP boot (netbooting) is commonly used by network administrators to load configuration-controlled network device images from a centralized management server. Netbooting is one option in the boot sequence and can be used to centralize, manage, and control device images. Adversaries may manipulate the configuration on the network device specifying use of a malicious TFTP server, which may be used in conjunction with [Modify System Image](https://attack.mitre.org/techniques/T1601) to load a modified image on device startup or reset. The unauthorized image allows adversaries to modify device configuration, add malicious capabilities to the device, and introduce backdoors to maintain control of the network device while minimizing detection through use of a standard functionality. This technique is similar to [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) and may result in the network device running a modified image. (Citation: Cisco Blog Legacy Device Attacks)
Near-miss passage: T1542 Pre-OS Boot. Tactics: stealth, persistence. Description: Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system. During the booting process of a computer, firmware and various startup services are loaded before the operating system. These programs control flow of execution before the operating system takes control.(Citation: Wikipedia Booting) Adversaries may overwrite data in boot drivers or firmware such as BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) to persist on systems at a layer below the operating system. This can be particularly difficult to detect as malware at this level will not be detected by host software-based defenses.
Query: patch priority for CVE-2015-5002
Matching passage: CVE-2015-5002. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in IBM Host On-Demand 11.0 through 11.0.14 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-9300. CWE: CWE-79. CVSS: 6.099999904632568. The events-manager plugin before 5.5.7 for WordPress has multiple XSS issues.
Query: patch priority for CVE-2015-3955
Matching passage: CVE-2015-3955. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in Hospira LifeCare PCA Infusion System 5.0 and earlier, and possibly other versions, allows remote attackers to execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-5822. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Query: containment actions for Lateral movement indicators for Video Capture
Matching passage: Playbook for T1125 Video Capture. 1) Validate alert telemetry against T1125. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: collection. 5) Eradicate persistence and recover. Reference detection notes: An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering information. Images may also be captured from devices or applications, potentially in specified intervals, in lieu of video files. Malware or scripts may be used to interact with the devices through an a
Near-miss passage: Playbook for T1123 Audio Capture. Different response path focused on collection.
Query: describe CVE-2015-3178
Matching passage: CVE-2015-3178. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the external_format_text function in lib/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to inject arbitrary web script or HTML into an external application via a crafted string that is visible to web services.
Near-miss passage: CVE-2015-8684. CWE: CWE-79. CVSS: 6.099999904632568. Exponent CMS before 2.3.7 does not properly restrict the types of files that can be uploaded, which allows remote attackers to conduct cross-site scripting (XSS) attacks and possibly have other unspecified impact as demonstrated by uploading a file with an .html extension, then accessing it via the elFinder functionality.
Query: Lateral movement indicators for Email Accounts
Matching passage: T1585.002 Email Accounts. Tactics: resource development. Description: Adversaries may create email accounts that can be used during targeting. Adversaries can use accounts created with email providers to further their operations, such as leveraging them to conduct [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Mandiant APT1) Establishing email accounts may also allow adversaries to abuse free services – such as trial periods – to [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) for follow-on purposes.(Citation: Free Trial PurpleUrchin) Adversaries may also take steps to cultivate a persona around the email account, such as through use of [Social Media Accounts](https://attack.mitre.org/techniques/T1585/001), to increase the chance of success of follow-on behaviors. Created email accounts can also be used in the acquisition of infrastructure (ex: [Domains](https://attack.mitre.org/techniques/T1583/001)).(Citation: Mandiant APT1) To decrease the chance of physically tying back operations to themselves, adversaries may make use of disposable email services.(Citation: Trend Micro R980 2016)
Near-miss passage: T1585.003 Cloud Accounts. Tactics: resource development. Description: Adversaries may create accounts with cloud providers that can be used during targeting. Adversaries can use cloud accounts to further their operations, including leveraging cloud storage services such as Dropbox, MEGA, Microsoft OneDrive, or AWS S3 buckets for [Exfiltration to Cloud Storage](https://attack.mitre.org/techniques/T1567/002) or to [Upload Tool](https://attack.mitre.org/techniques/T1608/002)s. Cloud accounts can also be used in the acquisition of infrastructure, such as [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003)s or [Serverless](https://attack.mitre.org/techniques/T1583/007) infrastructure. Establishing cloud accounts may allow adversaries to develop sophisticated capabilities without managing their own servers.(Citation: Awake Security C2 Cloud) Creating [Cloud Accounts](https://attack.mitre.org/techniques/T1585/003) may also require adversaries to establish [Email Accounts](https://attack.mitre.org/techniques/T1585/002) to register with the cloud provider.
Query: rule covering Detects Obfuscated Powershell via Stdin in Scripts
Matching passage: Sigma rule: Detects Obfuscated Powershell via Stdin in Scripts. Logsource: windows / ps_module. Rule: title: Invoke-Obfuscation Via Stdin - PowerShell Module id: c72aca44-8d52-45ad-8f81-f96c4d3c755e related: - id: 86b896ba-ffa1-4fea-83e3-ee28a4c915c7 type: derived status: test description: Detects Obfuscated Powershell via Stdin in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2020-10-12 modified: 2024-04-05 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_4103: Payload|re: (?i)(set).*&&\s?set.*(environment|invoke|\$?\{?input).*&&.*" condition: selection_4103 falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects command that type the content of ntdll.dll to a different file or a pipe in order to evade AV / EDR detection. A. Logsource: windows / process_creation. Rule: title: NtdllPipe Like Activity Execution id: bbc865e4-7fcd-45a6-8ff1-95ced28ec5b2 status: test description: Detects command that type the content of ntdll.dll to a different file or a pipe in order to evade AV / EDR detection. As seen being used in the POC NtdllPipe references: - https://web.archive.org/web/20220306121156/https://www.x86matthew.com/view_post?id=ntdll_pipe author: Florian Roth (Nextron Systems) date: 2022-03-05 modified: 2023-03-07 tags: - attack.defense-impairment logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - type %windir%\system32\ntdll.dll - type %systemroot%\system32\ntdll.dll - type c:\windows\system32\ntdll.dll - \\ntdll.dll > \\\\.\\pipe\\ condition: selection falsepositives: - Unknown level: high
Query: vulnerability: The bmexec_trans function in kwset.c in grep 2.19 through 2.21 allows local users to cause a denial of service (out-of-bounds heap read and crash) via crafted input when using the 
Matching passage: CVE-2015-1345. CWE: CWE-119. CVSS: 2.0999999046325684. The bmexec_trans function in kwset.c in grep 2.19 through 2.21 allows local users to cause a denial of service (out-of-bounds heap read and crash) via crafted input when using the -F option.
Near-miss passage: CVE-2015-5578. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5575, CVE-2015-5577, CVE-2015-5580, CVE-2015-5582, CVE-2015-5588, and CVE-2015-6677.
Query: rule covering Detects a suspicious curl process start the adds a file to a web request
Matching passage: Sigma rule: Detects a suspicious curl process start the adds a file to a web request. Logsource: linux / process_creation. Rule: title: Suspicious Curl File Upload - Linux id: 00b90cc1-17ec-402c-96ad-3a8117d7a582 related: - id: 00bca14a-df4e-4649-9054-3f2aa676bc04 type: derived status: test description: Detects a suspicious curl process start the adds a file to a web request references: - https://twitter.com/d1r4c/status/1279042657508081664 - https://medium.com/@petehouston/upload-files-with-curl-93064dcccc76 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1105/T1105.md#atomic-test-19---curl-upload-file - https://curl.se/docs/manpage.html - https://www.trendmicro.com/en_us/research/22/i/how-malicious-actors-abuse-native-linux-tools-in-their-attacks.html author: Nasreddine Bencherchali (Nextron Systems), Cedric MAURUGEON (Update) date: 2022-09-15 modified: 2023-05-02 tags: - attack.exfiltration - attack.command-and-control - attack.t1567 - attack.t1105 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: /curl selection_cli: - CommandLine|contains: - ' --form' - ' --upload-file ' - ' --data ' - ' --data-' - CommandLine|re: \s-[FTd]\s filter_optional_localhost: CommandLine|contains: - ://localhost - ://127.0.0.1 condition: all of selection_* and not 1 of filter_optional_* falsepositives: - Scripts created by developers and admins level: medium
Near-miss passage: Sigma rule: Detect PetitPotam coerced authentication activity.. Logsource: windows / security. Rule: title: Possible PetitPotam Coerce Authentication Attempt id: 1ce8c8a3-2723-48ed-8246-906ac91061a6 status: test description: Detect PetitPotam coerced authentication activity. references: - https://github.com/topotam/PetitPotam - https://github.com/splunk/security_content/blob/0dd6de32de2118b2818550df9e65255f4109a56d/detections/endpoint/petitpotam_network_share_access_request.yml author: Mauricio Velazco, Michael Haag date: 2021-09-02 modified: 2022-08-11 tags: - attack.credential-access - attack.t1187 logsource: product: windows service: security definition: The advanced audit policy setting "Object Access > Detailed File Share" must be configured for Success/Failure detection: selection: EventID: 5145 ShareName|startswith: \\\\ ShareName|endswith: \IPC$ RelativeTargetName: lsarpc SubjectUserName: ANONYMOUS LOGON condition: selection falsepositives: - Unknown. Feedback welcomed. level: high
Query: describe CVE-2015-9065
Matching passage: CVE-2015-9065. CWE: CWE-254. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a UE can respond to a UEInformationRequest before Access Stratum security is established.
Near-miss passage: CVE-2015-3756. CWE: CWE-254. CVSS: 2.0999999046325684. The Certificate UI in Apple iOS before 8.4.1 does not prevent X.509 certificate acceptance within the lock screen, which allows physically proximate attackers to establish arbitrary certificate trust relationships by completing a dialog.
Query: exploit FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font fil
Matching passage: CVE-2015-6976. CWE: CWE-119. CVSS: 6.800000190734863. FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6977, CVE-2015-6978, CVE-2015-6990, CVE-2015-6991, CVE-2015-6993, CVE-2015-7008, CVE-2015-7009, CVE-2015-7010, and CVE-2015-7018.
Near-miss passage: CVE-2015-4485. CWE: CWE-119. CVSS: 10.0. Heap-based buffer overflow in the resize_context_buffers function in libvpx in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code via malformed WebM video data.
Query: vulnerability: Buffer overflow in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows
Matching passage: CVE-2015-1727. CWE: CWE-119. CVSS: 7.199999809265137. Buffer overflow in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Win32k Pool Buffer Overflow Vulnerability."
Near-miss passage: CVE-2015-4933. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12.1 allows remote attackers to execute arbitrary code via a crafted packet, a different vulnerability than CVE-2015-4931, CVE-2015-4932, CVE-2015-4934, and CVE-2015-4935.
Query: describe CVE-2015-5623
Matching passage: CVE-2015-5623. CWE: CWE-284. CVSS: 4.0. WordPress before 4.2.3 does not properly verify the edit_posts capability, which allows remote authenticated users to bypass intended access restrictions and create drafts by leveraging the Subscriber role, as demonstrated by a post-quickdraft-save action to wp-admin/post.php.
Near-miss passage: CVE-2015-8001. CWE: CWE-284. CVSS: 3.5. The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not restrict the uploaded data to the claimed file size, which allows remote authenticated users to cause a denial of service via a chunk that exceeds the file size.
Query: risk of The CFNetwork HTTPProtocol component in Apple iOS before 9 allows remote attackers to bypass the HSTS protection mechanism, and consequently obtain sensitive information, via a cra
Matching passage: CVE-2015-5858. CWE: CWE-200. CVSS: 5.0. The CFNetwork HTTPProtocol component in Apple iOS before 9 allows remote attackers to bypass the HSTS protection mechanism, and consequently obtain sensitive information, via a crafted URL.
Near-miss passage: CVE-2015-3340. CWE: CWE-200. CVSS: 2.9000000953674316. Xen 4.2.x through 4.5.x does not initialize certain fields, which allows certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request.
Query: vulnerability: F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.x, 11.4.x before 11.4.1 HF10, 11.5.x before 11.5.4, 11.6.x before 11.6.1, and 12.x before 12.0.0 HF1; BIG-IP 
Matching passage: CVE-2015-8099. CWE: CWE-20. CVSS: 5.900000095367432. F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.x, 11.4.x before 11.4.1 HF10, 11.5.x before 11.5.4, 11.6.x before 11.6.1, and 12.x before 12.0.0 HF1; BIG-IP AAM 11.4.x before 11.4.1 HF10, 11.5.x before 11.5.4, 11.6.x before 11.6.1, and 12.x before 12.0.0 HF1; BIG-IP DNS 12.x before 12.0.0 HF1; BIG-IP Edge Gateway, WebAccelerator, and WOM 11.3.0; BIG-IP GTM 11.3.x, 11.4.x before 11.4.1 HF10, 11.5.x before 11.5.4, and 11.6.x before 11.6.1; BIG-IP PSM 11.3.x and 11.4.x before 11.4.1 HF10; Enterprise Manager 3.0.0 through 3.1.1; BIG-IQ Cloud and BIG-IQ Security 4.0.0 through 4.5.0; BIG-IQ Device 4.2.0 through 4.5.0; BIG-IQ ADC 4.5.0; BIG-IQ Centralized Management 4.6.0; and BIG-IQ Cloud and Orchestration 1.0.0 on the 3900, 6900, 8900, 8950, 11000, 11050, PB100 and PB200 platforms, when software SYN cookies are configured on virtual servers, allow remote attackers to cause a denial of service (High-Speed Bridge hang) via an invalid TCP segment.
Near-miss passage: CVE-2015-5230. CWE: CWE-20. CVSS: 7.5. The DNS packet parsing/generation code in PowerDNS (aka pdns) Authoritative Server 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (crash) via crafted query packets.
Query: detection rule: Detects enumeration of local network configuration
Matching passage: Sigma rule: Detects enumeration of local network configuration. Logsource: macos / process_creation. Rule: title: System Network Discovery - macOS id: 58800443-f9fc-4d55-ae0c-98a3966dfb97 status: test description: Detects enumeration of local network configuration references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md author: remotephone, oscd.community date: 2020-10-06 modified: 2024-08-29 tags: - attack.discovery - attack.t1016 logsource: product: macos category: process_creation detection: selection_1: Image|endswith: - /arp - /ifconfig - /netstat - /networksetup - /socketfilterfw selection_2: Image: /usr/bin/defaults CommandLine|contains|all: - /Library/Preferences/com.apple.alf - read filter_main_wifivelocityd: ParentImage|endswith: /wifivelocityd condition: 1 of selection_* and not 1 of filter_main_* falsepositives: - Legitimate administration activities level: informational
Near-miss passage: Sigma rule: Detects Commandlet names from ShellIntel exploitation scripts.. Logsource: windows / ps_script. Rule: title: Malicious ShellIntel PowerShell Commandlets id: 402e1e1d-ad59-47b6-bf80-1ee44985b3a7 status: test description: Detects Commandlet names from ShellIntel exploitation scripts. references: - https://github.com/Shellntel/scripts/ author: Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems) date: 2021-08-09 modified: 2023-01-02 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - Invoke-SMBAutoBrute - Invoke-GPOLinks - Invoke-Potato condition: selection falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-5455
Matching passage: CVE-2015-5455. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in X-Cart 4.5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to install/.
Near-miss passage: CVE-2015-4127. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the church_admin plugin before 0.810 for WordPress allows remote attackers to inject arbitrary web script or HTML via the address parameter, as demonstrated by a request to index.php/2015/05/21/church_admin-registration-form/.