deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-26539
Published: 2023-06-22
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Max Chirkov Advanced Text Widget plugin <= 2.1.2 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/advanced-text-widget/wordpress-advanced-text-widget-plugin-2-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/advanced-text-widget/wordpress-advanced-text-widget-plugin-2-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-27452
Published: 2023-06-22
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Wow-Company Button Generator – easily Button Builder plugin <= 2.3.3 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/button-generation/wordpress-button-generator-plugin-2-3-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/button-generation/wordpress-button-generator-plugin-2-3-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-28174
Published: 2023-06-22
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in eLightUp eRocket plugin <= 1.2.4 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/erocket/wordpress-erocket-plugin-1-2-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/erocket/wordpress-erocket-plugin-1-2-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-28750
Published: 2023-06-22
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ignazio Scimone Albo Pretorio On line plugin <= 4.6 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/albo-pretorio-on-line/wordpress-albo-pretorio-on-line-plugin-4-6-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/albo-pretorio-on-line/wordpress-albo-pretorio-on-line-plugin-4-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-28776
Published: 2023-06-22
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Continuous Image Carousel With Lightbox plugin <= 1.0.15 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/continuous-image-carousel-with-lightbox/wordpress-continuous-image-carousel-with-lightbox-plugin-1-0-15-reflected-cross-site-scripting-xss-vulnerability-2?_s_id=cve; https://patchstack.com/database/vulnerability/continuous-image-carousel-with-lightbox/wordpress-continuous-image-carousel-with-lightbox-plugin-1-0-15-reflected-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE: CVE-2023-28778
Published: 2023-06-22
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in BestWebSoft Pagination plugin <= 1.2.2 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/pagination/wordpress-pagination-by-bestwebsoft-1-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/pagination/wordpress-pagination-by-bestwebsoft-1-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-28784
Published: 2023-06-22
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Contest Gallery plugin <= 21.1.2 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/contest-gallery/wordpress-contest-gallery-plugin-21-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/contest-gallery/wordpress-contest-gallery-plugin-21-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-29711
Published: 2023-06-22
Description: An incorrect access control issue was discovered in Interlink PSG-5124 version 1.0.4, allows attackers to execute arbitrary code via crafted GET request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-346
References: https://github.com/shellpei/LINK-Unauthorized/blob/main/CVE-2023-29711; https://holistic-height-e6d.notion.site/LINK-PSG-5124-Switch-remote-command-vulnerability-da4fd8fb450d42879b07ef3a953a2366; https://github.com/shellpei/LINK-Unauthorized/blob/main/CVE-2023-29711
CVE: CVE-2023-30500
Published: 2023-06-22
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPForms WPForms Lite (wpforms-lite), WPForms WPForms Pro (wpforms) plugins <= 1.8.1.2 versions.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wpforms-lite/wordpress-wpforms-lite-plugin-1-8-1-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wpforms/wordpress-wpforms-pro-plugin-1-8-1-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wpforms-lite/wordpress-wpforms-lite-plugin-1-8-1-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-31867
Published: 2023-06-22
Description: Sage X3 version 12.14.0.50-0 is vulnerable to CSV Injection.
CVSS Score: 7.2 (HIGH)
CWE: CWE-1236
References: http://sage.com; https://github.com/Digitemis/Advisory/blob/main/CVE-2023-31867.txt; http://sage.com
CVE: CVE-2023-31868
Published: 2023-06-22
Description: Sage X3 version 12.14.0.50-0 is vulnerable to Cross Site Scripting (XSS). Some parts of the Web application are dynamically built using user's inputs. Yet, those inputs are not verified nor filtered by the application, so they mathed the expected format. Therefore, when HTML/JavaScript code is injected into those fields, this code will be saved by the application and executed by the web browser of the user viewing the web page. Several injection points have been identified on the application. The major one requires the user to be authenticated with a common account, he can then target an Administrator. All others endpoints need the malicious user to be authenticated as an Administrator. Therefore, the impact is diminished.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://sage.com; https://github.com/Digitemis/Advisory/blob/main/CVE-2023-31868.txt; http://sage.com
CVE: CVE-2023-34939
Published: 2023-06-22
Description: Onlyoffice Community Server before v12.5.2 was discovered to contain a remote code execution (RCE) vulnerability via the component UploadProgress.ashx.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/ONLYOFFICE/CommunityServer/blob/master/CHANGELOG.md#version-1252; https://github.com/firsov/onlyoffice; https://github.com/firsov/onlyoffice/blob/main/CVE-2023-34939-PoC.md
CVE: CVE-2023-35093
Published: 2023-06-22
Description: Broken Access Control vulnerability in StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin <= 3.0.8 versions allows any logged-in users, such as subscribers to view the "Orders" of the plugin and get the data related to the order like email, username, and more.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/masterstudy-lms-learning-management-system/wordpress-masterstudy-lms-plugin-3-0-7-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/masterstudy-lms-learning-management-system/wordpress-masterstudy-lms-plugin-3-0-7-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2023-35917
Published: 2023-06-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce PayPal Payments plugin <= 2.0.4 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/woocommerce-paypal-payments/wordpress-woocommerce-paypal-payments-plugin-2-0-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-paypal-payments/wordpress-woocommerce-paypal-payments-plugin-2-0-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-35918
Published: 2023-06-22
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Bulk Stock Management plugin <= 2.2.33 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/woocommerce-bulk-stock-management/wordpress-woocommerce-bulk-stock-management-plugin-2-2-33-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-bulk-stock-management/wordpress-woocommerce-bulk-stock-management-plugin-2-2-33-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-47593
Published: 2023-06-22
Description: Auth. (subscriber+) SQL Injection (SQLi) vulnerability in RapidLoad RapidLoad Power-Up for Autoptimize plugin <= 1.6.35 versions.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/unusedcss/wordpress-rapidload-power-up-for-autoptimize-plugin-1-6-35-sql-injection?_s_id=cve; https://patchstack.com/database/vulnerability/unusedcss/wordpress-rapidload-power-up-for-autoptimize-plugin-1-6-35-sql-injection?_s_id=cve
CVE: CVE-2023-20896
Published: 2023-06-22
Description: The VMware vCenter Server contains an out-of-bounds read vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds read by sending a specially crafted packet leading to denial-of-service of certain services (vmcad, vmdird, and vmafdd).
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-125
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1800; https://www.vmware.com/security/advisories/VMSA-2023-0014.html; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1800
CVE: CVE-2023-25499
Published: 2023-06-22
Description: When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12, 24.0.0 through 24.0.5 and 24.1.0.alpha1 to 24.1.0.beta1, resulting in potential information disclosure.


CVSS Score: 5.7 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://github.com/vaadin/flow/pull/15885; https://vaadin.com/security/CVE-2023-25499; https://github.com/vaadin/flow/pull/15885
CVE: CVE-2023-25500
Published: 2023-06-22
Description: Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in potential information disclosure of class and method names in RPC responses by sending modified requests.
CVSS Score: 3.5 (LOW)
CWE: CWE-200, CWE-200
References: https://github.com/vaadin/flow/pull/16935; https://vaadin.com/security/cve-2023-25500; https://github.com/vaadin/flow/pull/16935
CVE: CVE-2023-28418
Published: 2023-06-22
Description: Auth. (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Yudlee themes Mediciti Lite theme <= 1.3.0 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/mediciti-lite/wordpress-mediciti-lite-theme-1-3-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/mediciti-lite/wordpress-mediciti-lite-theme-1-3-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-28774
Published: 2023-06-22
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Grade Us, Inc. Review Stream plugin <= 1.6.5 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/review-stream/wordpress-review-stream-plugin-1-6-5-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/review-stream/wordpress-review-stream-plugin-1-6-5-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-32239
Published: 2023-06-22
Description: Auth. (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in xtemos WoodMart theme <= 7.2.1 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/woodmart/wordpress-woodmart-theme-7-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woodmart/wordpress-woodmart-theme-7-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-32960
Published: 2023-06-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in UpdraftPlus.Com, DavidAnderson UpdraftPlus WordPress Backup Plugin <= 1.23.3 versions leads to sitewide Cross-Site Scripting (XSS).
CVSS Score: 7.1 (HIGH)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/updraftplus/wordpress-updraftplus-plugin-1-23-3-csrf-lead-to-wp-admin-site-wide-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/updraftplus/wordpress-updraftplus-plugin-1-23-3-csrf-lead-to-wp-admin-site-wide-xss-vulnerability?_s_id=cve
CVE: CVE-2023-33323
Published: 2023-06-22
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Repute InfoSystems ARMember plugin <= 4.0.2 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/armember-membership/wordpress-armember-plugin-4-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/armember-membership/wordpress-armember-plugin-4-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-33997
Published: 2023-06-22
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Robin Wilson bbp style pack plugin <= 5.5.5 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/bbp-style-pack/wordpress-bbp-style-pack-plugin-5-5-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/bbp-style-pack/wordpress-bbp-style-pack-plugin-5-5-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-34006
Published: 2023-06-22
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Marco Milesi Telegram Bot & Channel plugin <= 3.6.2 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/telegram-bot/wordpress-telegram-bot-channel-plugin-3-6-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/telegram-bot/wordpress-telegram-bot-channel-plugin-3-6-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-34368
Published: 2023-06-22
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kanban for WordPress Kanban Boards for WordPress plugin <= 2.5.20 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/kanban/wordpress-kanban-boards-for-wordpress-plugin-2-5-20-cross-site-scripting-xss-vulnerability-2?_s_id=cve; https://patchstack.com/database/vulnerability/kanban/wordpress-kanban-boards-for-wordpress-plugin-2-5-20-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE: CVE-2023-34927
Published: 2023-06-22
Description: Casdoor v1.331.0 and below was discovered to contain a Cross-Site Request Forgery (CSRF) in the endpoint /api/set-password. This vulnerability allows attackers to arbitrarily change the victim user's password via supplying a crafted URL.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://casdoor.org/; https://gist.github.com/omriman067/4e90a3a4ffa40984f011d8777a995469; https://github.com/casdoor/casdoor/issues/1531
CVE: CVE-2023-35174
Published: 2023-06-22
Description: Livebook is a web application for writing interactive and collaborative code notebooks. On Windows, it is possible to open a `livebook://` link from a browser which opens Livebook Desktop and triggers arbitrary code execution on victim's machine. Any user using Livebook Desktop on Windows is potentially vulnerable to arbitrary code execution when they expect Livebook to be opened from browser. This vulnerability has been fixed in version 0.8.2 and 0.9.3.


CVSS Score: 8.6 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/livebook-dev/livebook/commit/2e11b59f677c6ed3b6aa82dad412a8b3406ffdf1; https://github.com/livebook-dev/livebook/commit/beb10daaadcc765f0380e436bd7cd5f74cf086c8; https://github.com/livebook-dev/livebook/releases/tag/v0.8.2
CVE: CVE-2023-35926
Published: 2023-06-22
Description: Backstage is an open platform for building developer portals. The Backstage scaffolder-backend plugin uses a templating library that requires sandbox, as it by design allows for code injection. The library used for this sandbox so far has been `vm2`, but in light of several past vulnerabilities and existing vulnerabilities  that may not have a fix, the plugin has switched to using a different sandbox library. A malicious actor with write access to a registered scaffolder template could manipulate the template in a way that allows for remote code execution on the scaffolder-backend instance. This was only exploitable in the template YAML definition itself and not by user input data. This is vulnerability is fixed in version 1.15.0 of `@backstage/plugin-scaffolder-backend`.
CVSS Score: 8.0 (HIGH)
CWE: CWE-94, CWE-94
References: https://github.com/backstage/backstage/commit/fb7375507d56faedcb7bb[PII_REDACTED]593c8949a; https://github.com/backstage/backstage/releases/tag/v1.15.0; https://github.com/backstage/backstage/security/advisories/GHSA-wg6p-jmpc-xjmr
CVE: CVE-2023-36362
Published: 2023-06-22
Description: An issue in the rel_sequences component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/MonetDB/MonetDB/issues/7387; https://github.com/MonetDB/MonetDB/issues/7387
CVE: CVE-2023-36363
Published: 2023-06-22
Description: An issue in the __nss_database_lookup component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/MonetDB/MonetDB/issues/7384; https://github.com/MonetDB/MonetDB/issues/7384
CVE: CVE-2023-36364
Published: 2023-06-22
Description: An issue in the rel_deps component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/MonetDB/MonetDB/issues/7386; https://github.com/MonetDB/MonetDB/issues/7386
CVE: CVE-2023-36365
Published: 2023-06-22
Description: An issue in the sql_trans_copy_key component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/MonetDB/MonetDB/issues/7378; https://github.com/MonetDB/MonetDB/issues/7378
CVE: CVE-2023-36366
Published: 2023-06-22
Description: An issue in the log_create_delta component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/MonetDB/MonetDB/issues/7381; https://github.com/MonetDB/MonetDB/issues/7381
CVE: CVE-2023-36367
Published: 2023-06-22
Description: An issue in the BLOBcmp component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/MonetDB/MonetDB/issues/7380; https://github.com/MonetDB/MonetDB/issues/7380
CVE: CVE-2023-36368
Published: 2023-06-22
Description: An issue in the cs_bind_ubat component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/MonetDB/MonetDB/issues/7379; https://github.com/MonetDB/MonetDB/issues/7379
CVE: CVE-2023-36369
Published: 2023-06-22
Description: An issue in the list_append component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/MonetDB/MonetDB/issues/7383; https://github.com/MonetDB/MonetDB/issues/7383
CVE: CVE-2023-36370
Published: 2023-06-22
Description: An issue in the gc_col component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/MonetDB/MonetDB/issues/7382; https://github.com/MonetDB/MonetDB/issues/7382
CVE: CVE-2023-36371
Published: 2023-06-22
Description: An issue in the GDKfree component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/MonetDB/MonetDB/issues/7385; https://github.com/MonetDB/MonetDB/issues/7385
CVE: CVE-2023-34028
Published: 2023-06-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin <= 1.0.7 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/bulk-editor/wordpress-wolf-wordpress-posts-bulk-editor-and-manager-professional-plugin-1-0-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/bulk-editor/wordpress-wolf-wordpress-posts-bulk-editor-and-manager-professional-plugin-1-0-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-34170
Published: 2023-06-22
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP Overnight Quick/Bulk Order Form for WooCommerce plugin <= 3.5.7 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/woocommerce-bulk-order-form/wordpress-quick-bulk-order-form-for-woocommerce-plugin-3-5-7-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-bulk-order-form/wordpress-quick-bulk-order-form-for-woocommerce-plugin-3-5-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-36093
Published: 2023-06-22
Description: There is a storage type cross site scripting (XSS) vulnerability in the filing number of the Basic Information tab on the backend management page of EyouCMS v1.6.3
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/weng-xianhu/eyoucms/issues/44; https://github.com/weng-xianhu/eyoucms/issues/44
CVE: CVE-2023-36097
Published: 2023-06-22
Description: funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/funadmin/funadmin/issues/17; https://github.com/funadmin/funadmin/issues/17
CVE: CVE-2023-2611
Published: 2023-06-22
Description: Advantech R-SeeNet 
versions 2.4.22 

is installed with a hidden root-level user that is not available in the 
users list. This hidden user has a password that cannot be changed by 
users.






CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-173-02; https://www.cisa.gov/news-events/ics-advisories/icsa-23-173-02
CVE: CVE-2023-3256
Published: 2023-06-22
Description: Advantech R-SeeNet 
versions 2.4.22 
allows low-level users to access and load the content of local files.




CVSS Score: 8.8 (HIGH)
CWE: CWE-73, CWE-610
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-173-02; https://www.cisa.gov/news-events/ics-advisories/icsa-23-173-02