deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-39678
Published: 2023-08-29
Description: A cross-site scripting (XSS) vulnerability in the device web interface (Log Query page) of BDCOM OLT P3310D-2AC 10.1.0F Build 69083 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://telegra.ph/XSS-in-BDCOM-OLT-P3310D-2AC-07-29; https://telegra.ph/XSS-in-BDCOM-OLT-P3310D-2AC-07-29
CVE: CVE-2023-3253
Published: 2023-08-29
Description: An improper authorization vulnerability exists where an authenticated, 
low privileged remote attacker could view a list of all the users 
available in the application.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://www.tenable.com/security/tns-2023-29; https://www.tenable.com/security/tns-2023-29
CVE: CVE-2023-4346
Published: 2023-08-29
Description: 
KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the device. The BCU key feature on the devices can be used to create a password for the device, but this password can often not be reset without entering the current password. If the device is configured to interface with a network, an attacker with access to that network could interface with the KNX installation, purge all devices without additional security options enabled, and set a BCU key, locking the device. Even if a device is not connected to a network, an attacker with physical access to the device could also exploit this vulnerability in the same way. 


CVSS Score: 7.5 (HIGH)
CWE: CWE-645
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-01; https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-01
CVE: CVE-2023-4572
Published: 2023-08-29
Description: Use after free in MediaStream in Google Chrome prior to 116.0.5845.140 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_29.html; https://crbug.com/1472492; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/27NR3KG553CG6LGPMP6SHWEVHTYPL6RC/
CVE: CVE-2023-32241
Published: 2023-08-29
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPDeveloper Essential Addons for Elementor Pro plugin <= 5.4.8 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/essential-addons-elementor/wordpress-essential-addons-for-elementor-pro-plugin-5-4-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/essential-addons-elementor/wordpress-essential-addons-for-elementor-pro-plugin-5-4-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-38971
Published: 2023-08-29
Description: Cross Site Scripting vulnerabiltiy in Badaso v.0.0.1 thru v.2.9.7 allows a remote attacker to execute arbitrary code via a crafted payload to the rack number parameter in the add new rack function.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/anh91/uasoft-indonesia--badaso/blob/main/XSS3.md; https://panda002.hashnode.dev/badaso-version-297-has-xss-vulnerability-in-add-ranks; https://github.com/anh91/uasoft-indonesia--badaso/blob/main/XSS3.md
CVE: CVE-2023-38975
Published: 2023-08-29
Description: * Buffer Overflow vulnerability in qdrant v.1.3.2 allows a remote attacker cause a denial of service via the chucnked_vectors.rs component.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://aisec.today/Qdrant-56dd05e12ca94d75a5e798b3fee80fa3; https://github.com/qdrant/qdrant/issues/2268; https://aisec.today/Qdrant-56dd05e12ca94d75a5e798b3fee80fa3
CVE: CVE-2023-41153
Published: 2023-08-29
Description: A Stored Cross-Site Scripting (XSS) vulnerability in the SSH configuration tab in Usermin 2.001 allows remote attackers to inject arbitrary web script or HTML via options for the host value while editing the host options.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/shindeanik/Usermin-2.001/blob/main/CVE-2023-41153; https://webmin.com/tags/webmin-changelog/; https://github.com/shindeanik/Usermin-2.001/blob/main/CVE-2023-41153
CVE: CVE-2023-4296
Published: 2023-08-29
Description: ​If an attacker tricks an admin user of PTC Codebeamer into clicking on a malicious link, it may allow the attacker to inject arbitrary code to be executed in the browser on the target device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: http://packetstormsecurity.com/files/174703/PTC-Codebeamer-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2023/Sep/10; https://codebeamer.com/cb/wiki/31346480
CVE: CVE-2023-4611
Published: 2023-08-29
Description: A use-after-free flaw was found in mm/mempolicy.c in the memory management subsystem in the Linux Kernel. This issue is caused by a race between mbind() and VMA-locked page fault, and may allow a local attacker to crash the system or lead to a kernel information leak.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416, CWE-416
References: https://access.redhat.com/security/cve/CVE-2023-4611; https://bugzilla.redhat.com/show_bug.cgi?id=2227244; https://www.spinics.net/lists/stable-commits/msg310136.html
CVE: CVE-2020-18912
Published: 2023-08-29
Description: An issue found in Earcms Ear App v.20181124 allows a remote attacker to execute arbitrary code via the uload/index-uplog.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.cnblogs.com/hantom/p/10621198.html; https://www.cnblogs.com/yiwd/archive/2013/03/03/2941269.html; https://www.cnblogs.com/hantom/p/10621198.html
CVE: CVE-2023-39558
Published: 2023-08-29
Description: AudimexEE v15.0 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities via the Show Kai Data component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://en.web-audimex.com/; https://github.com/CapgeminiCisRedTeam/Disclosure/blob/main/CVE%20PoC/CVE-2023-39558.md; https://en.web-audimex.com/
CVE: CVE-2023-39559
Published: 2023-08-29
Description: AudimexEE 15.0 was discovered to contain a full path disclosure vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://en.web-audimex.com/; https://github.com/CapgeminiCisRedTeam/Disclosure/blob/main/CVE%20PoC/CVE-2023-39559.md; https://en.web-audimex.com/
CVE: CVE-2023-41265
Published: 2023-08-29
Description: An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows a remote attacker to elevate their privilege by tunneling HTTP requests in the raw HTTP request. This allows them to send requests that get executed by the backend server hosting the repository application. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-444, CWE-444
References: https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801; https://community.qlik.com/t5/Release-Notes/tkb-p/ReleaseNotes; https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801
CVE: CVE-2023-41266
Published: 2023-08-29
Description: A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows an unauthenticated remote attacker to generate an anonymous session. This allows them to transmit HTTP requests to unauthorized endpoints. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.
CVSS Score: 8.2 (HIGH)
CWE: CWE-22, CWE-22
References: https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801; https://community.qlik.com/t5/Release-Notes/tkb-p/ReleaseNotes; https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801
CVE: CVE-2023-41269
Published: 2023-08-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none.
CVE: CVE-2023-4525
Published: 2023-08-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none.
CVE: CVE-2023-4526
Published: 2023-08-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none.
CVE: CVE-2023-4596
Published: 2023-08-30
Description: The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server in the upload_post_image() function in versions up to, and including, 1.24.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/changeset/2954409/forminator/trunk/library/fields/postdata.php; https://www.exploit-db.com/exploits/51664; https://www.wordfence.com/threat-intel/vulnerabilities/id/9cd87da6-1f4c-4a15-8ebb-6e0f8ef72513?source=cve
CVE: CVE-2023-4597
Published: 2023-08-30
Description: The Slimstat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slimstat' shortcode in versions up to, and including, 5.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-slimstat/tags/5.0.9/wp-slimstat.php#L892; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2959452%40wp-slimstat&new=2959452%40wp-slimstat&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/52aee4b8-f494-4eeb-8357-71ce8d5bc656?source=cve
CVE: CVE-2023-4599
Published: 2023-08-30
Description: The Email Encoder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'eeb_mailto' shortcode in versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A partial patch was issued in version 2.1.8. The vulnerability was fully patched in 2.1.9.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/email-encoder-bundle/tags/2.1.7/core/includes/classes/class-email-encoder-bundle-run.php#L529; https://plugins.trac.wordpress.org/changeset/2958823/email-encoder-bundle#file60; https://plugins.trac.wordpress.org/changeset/2994384/email-encoder-bundle/trunk?contextall=1&old=2958823&old_path=%2Femail-encoder-bundle%2Ftrunk#file0
CVE: CVE-2023-4609
Published: 2023-08-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none.
CVE: CVE-2023-4522
Published: 2023-08-30
Description: An issue has been discovered in GitLab affecting all versions before 16.2.0. Committing directories containing LF character results in 500 errors when viewing the commit.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1287
References: https://gitlab.com/gitlab-org/gitlab/-/issues/406817; https://hackerone.com/reports/1937213; https://gitlab.com/gitlab-org/gitlab/-/issues/406817
CVE: CVE-2023-3136
Published: 2023-08-30
Description: The MailArchiver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/2937545/mailarchiver; https://www.wordfence.com/threat-intel/vulnerabilities/id/ce330cae-c2f8-42f3-822b-ca24bf46e433?source=cve; https://plugins.trac.wordpress.org/changeset/2937545/mailarchiver
CVE: CVE-2023-32740
Published: 2023-08-30
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Kunal Nagar Custom 404 Pro plugin <= 3.8.1 versions.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/custom-404-pro/wordpress-custom-404-pro-plugin-3-8-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/custom-404-pro/wordpress-custom-404-pro-plugin-3-8-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-25019
Published: 2023-08-30
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Premio Chaty plugin <= 3.0.9 versions
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/chaty/wordpress-chaty-plugin-3-0-9-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/chaty/wordpress-chaty-plugin-3-0-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-32597
Published: 2023-08-30
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Video Gallery plugin <= 1.0.10 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/video-slider-with-thumbnails/wordpress-video-gallery-plugin-1-0-10-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/video-slider-with-thumbnails/wordpress-video-gallery-plugin-1-0-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-32742
Published: 2023-08-30
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in VeronaLabs WP SMS plugin <= 6.1.4 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-sms/wordpress-wp-sms-plugin-6-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-sms/wordpress-wp-sms-plugin-6-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-32746
Published: 2023-08-30
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Brands plugin <= 1.6.45 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/woocommerce-brands/wordpress-woocommerce-brands-plugin-1-6-45-contributor-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-brands/wordpress-woocommerce-brands-plugin-1-6-45-contributor-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-32793
Published: 2023-08-30
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Pre-Orders plugin <= 2.0.0 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/woocommerce-pre-orders/wordpress-woocommerce-pre-orders-plugin-2-0-0-contributor-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-pre-orders/wordpress-woocommerce-pre-orders-plugin-2-0-0-contributor-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-32801
Published: 2023-08-30
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Composite Products plugin <= 8.7.5 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/woocommerce-composite-products/wordpress-woocommerce-composite-products-plugin-8-7-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-composite-products/wordpress-woocommerce-composite-products-plugin-8-7-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-32802
Published: 2023-08-30
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Pre-Orders plugin <= 1.9.0 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/woocommerce-pre-orders/wordpress-woocommerce-pre-orders-plugin-1-9-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-pre-orders/wordpress-woocommerce-pre-orders-plugin-1-9-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-32962
Published: 2023-08-30
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in HasTheme WishSuite – Wishlist for WooCommerce plugin <= 1.3.4 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wishsuite/wordpress-wishsuite-wishlist-for-woocommerce-plugin-1-3-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wishsuite/wordpress-wishsuite-wishlist-for-woocommerce-plugin-1-3-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-4600
Published: 2023-08-30
Description: The AffiliateWP for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'affwp_activate_addons_page_plugin' function called via an AJAX action in versions up to, and including, 2.14.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to activate arbitrary plugins.
CVSS Score: 4.3 (MEDIUM)
References: https://affiliatewp.com/changelog/; https://www.wordfence.com/threat-intel/vulnerabilities/id/eab422b8-8cf5-441e-a21f-6a0e1b7642b2?source=cve; https://affiliatewp.com/changelog/
CVE: CVE-2023-25462
Published: 2023-08-30
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP htaccess Control plugin <= 3.5.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-htaccess-control/wordpress-wp-htaccess-control-plugin-3-5-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-htaccess-control/wordpress-wp-htaccess-control-plugin-3-5-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-27426
Published: 2023-08-30
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Notifyvisitors NotifyVisitors plugin <= 1.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/notifyvisitors-lead-form/wordpress-notify-visitors-lead-form-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/notifyvisitors-lead-form/wordpress-notify-visitors-lead-form-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-33208
Published: 2023-08-30
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gsmith Cookie Monster plugin <= 1.51 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/cookiemonster/wordpress-cookie-monster-plugin-1-51-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/cookiemonster/wordpress-cookie-monster-plugin-1-51-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-33210
Published: 2023-08-30
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in nuajik plugin <= 0.1.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/nuajik-cdn/wordpress-nuajik-cdn-plugin-0-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/nuajik-cdn/wordpress-nuajik-cdn-plugin-0-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-33317
Published: 2023-08-30
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Returns and Warranty Requests plugin <= 2.1.6 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/woocommerce-warranty/wordpress-woocommerce-warranty-requests-plugin-2-1-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-warranty/wordpress-woocommerce-warranty-requests-plugin-2-1-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-33320
Published: 2023-08-30
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Mohammad I. Okfie WP-Hijri plugin <= 1.5.1 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-hijri/wordpress-wp-hijri-plugin-1-5-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-hijri/wordpress-wp-hijri-plugin-1-5-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-33325
Published: 2023-08-30
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Teplitsa of social technologies Leyka plugin <= 3.30.1 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/leyka/wordpress-leyka-plugin-3-29-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/leyka/wordpress-leyka-plugin-3-29-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-33929
Published: 2023-08-30
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Joaquín Ruiz Easy Admin Menu plugin <= 1.3 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/easy-admin-menu/wordpress-easy-admin-menu-plugin-1-3-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/easy-admin-menu/wordpress-easy-admin-menu-plugin-1-3-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-41552
Published: 2023-08-30
Description: Tenda AC7 V1.0 V15.03.06.44 and Tenda AC9 V3.0 V15.03.06.42_multi were discovered to contain a stack overflow via parameter ssid at url /goform/fast_setting_wifi_set.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/peris-navince/founded-0-days/blob/main/form_fast_setting_wifi_set/1.md; https://github.com/peris-navince/founded-0-days/blob/main/form_fast_setting_wifi_set/1.md
CVE: CVE-2023-41553
Published: 2023-08-30
Description: Tenda AC9 V3.0 V15.03.06.42_multi and Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 were discovered to contain a stack overflow via parameter list at url /goform/SetStaticRouteCfg.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/peris-navince/founded-0-days/blob/main/fromSetRouteStatic/1.md; https://github.com/peris-navince/founded-0-days/blob/main/fromSetRouteStatic/1.md
CVE: CVE-2023-41554
Published: 2023-08-30
Description: Tenda AC9 V3.0 V15.03.06.42_multi was discovered to contain a stack overflow via parameter wpapsk_crypto at url /goform/WifiExtraSet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/peris-navince/founded-0-days/blob/main/fromSetWirelessRepeat/1.md; https://github.com/peris-navince/founded-0-days/blob/main/fromSetWirelessRepeat/1.md
CVE: CVE-2023-41555
Published: 2023-08-30
Description: Tenda AC7 V1.0 V15.03.06.44 was discovered to contain a stack overflow via parameter security_5g at url /goform/WifiBasicSet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/peris-navince/founded-0-days/blob/main/formWifiBasicSet/1.md; https://github.com/peris-navince/founded-0-days/blob/main/formWifiBasicSet/1.md