deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-1658
Published: 2022-06-13
Description: Vulnerable versions of the Jupiter Theme (<= 6.10.1) allow arbitrary plugin deletion by any authenticated user, including users with the subscriber role, via the abb_remove_plugin AJAX action registered in the framework/admin/control-panel/logic/plugin-management.php file. Using this functionality, any logged-in user can delete any installed plugin on the site.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-284
References: https://www.wordfence.com/blog/2022/05/critical-privilege-escalation-vulnerability-in-jupiter-and-jupiterx-premium-themes/; https://www.wordfence.com/blog/2022/05/critical-privilege-escalation-vulnerability-in-jupiter-and-jupiterx-premium-themes/
CVE: CVE-2022-1659
Published: 2022-06-13
Description: Vulnerable versions of the JupiterX Core (<= 2.0.6) plugin register an AJAX action jupiterx_conditional_manager which can be used to call any function in the includes/condition/class-condition-manager.php file by sending the desired function to call in the sub_action parameter. This can be used to view site configuration and logged-in users, modify post conditions, or perform a denial of service attack.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-284
References: https://www.wordfence.com/blog/2022/05/critical-privilege-escalation-vulnerability-in-jupiter-and-jupiterx-premium-themes/; https://www.wordfence.com/blog/2022/05/critical-privilege-escalation-vulnerability-in-jupiter-and-jupiterx-premium-themes/
CVE: CVE-2022-1749
Published: 2022-06-13
Description: The WPMK Ajax Finder WordPress plugin is vulnerable to Cross-Site Request Forgery via the createplugin_atf_admin_setting_page() function found in the ~/inc/config/create-plugin-config.php file due to a missing nonce check which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/browser/find-any-think/trunk/inc/config/create-plugin-admin.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/1d063d01-5f67-4c7f-ab71-01708456e82b?source=cve; https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1749
CVE: CVE-2022-1750
Published: 2022-06-13
Description: The Sticky Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ popup_title' parameter in versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with admin level capabilities and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This issue mostly affects sites where unfiltered_html has been disabled for administrators and on multi-site installations where unfiltered_html is disabled for administrators.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79, CWE-79, CWE-79
References: https://www.wordfence.com/threat-intel/vulnerabilities/id/4a5262d8-d9cd-4bd9-a95e-f[PII_REDACTED]3?source=cve; https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1750; https://www.wordfence.com/threat-intel/vulnerabilities/id/4a5262d8-d9cd-4bd9-a95e-f[PII_REDACTED]3?source=cve
CVE: CVE-2022-1768
Published: 2022-06-13
Description: The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to insufficient escaping and parameterization on user supplied data passed to multiple SQL queries in the ~/rsvpmaker-email.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to, and including, 9.3.2. 

Please note that this is separate from CVE-2022-1453 & CVE-2022-1505.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/Xib3rR4dAr/441d6bb4a5b8ad4b25074a49210a02cc; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2725322%40rsvpmaker&new=2725322%40rsvpmaker&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/c1d02646-271a-4079-8a47-00b4029e9c1f?source=cve
CVE: CVE-2022-1820
Published: 2022-06-13
Description: The Keep Backup Daily plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘t’ parameter in versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2727789%40keep-backup-daily&new=2727789%40keep-backup-daily&sfp_email=&sfph_mail=; https://wordpress.org/plugins/keep-backup-daily/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/8693a8b1-15e1-4c9c-90fb-51fcaf5ff451?source=cve
CVE: CVE-2022-1961
Published: 2022-06-13
Description: The Google Tag Manager for WordPress (GTM4WP) plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the `gtm4wp-options[scroller-contentid]` parameter found in the `~/public/frontend.php` file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.15.1. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79, CWE-79, CWE-79
References: https://gist.github.com/Xib3rR4dAr/02a21cd0ea0b7bf586131c5eebb69f1d; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2732977%40duracelltomi-google-tag-manager&new=2732977%40duracelltomi-google-tag-manager&sfp_email=&sfph_mail=; https://wordpress.org/plugins/duracelltomi-google-tag-manager/#developers
CVE: CVE-2022-1969
Published: 2022-06-13
Description: The Mobile browser color select plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the admin_update_data() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/browser/mobile-browser-color-select/trunk/mobile-browser-color-select.php#L62; https://www.wordfence.com/threat-intel/vulnerabilities/id/687cd0ac-5f78-4429-b6b5-dd1113143a4d?source=cve; https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1969
CVE: CVE-2022-24077
Published: 2022-06-13
Description: Naver Cloud Explorer Beta allows the attacker to execute arbitrary code as System privilege via malicious DLL injection.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-427
References: https://cve.naver.com/detail/cve-2022-24077.html; https://cve.naver.com/detail/cve-2022-24077.html
CVE: CVE-2022-29244
Published: 2022-06-13
Description: npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=<name>`). Anyone who has run `npm pack` or `npm publish` inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include. Users should upgrade to the latest, patched version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0 include the patched v8.11.0 version of npm.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/nodejs/node/pull/43210; https://github.com/nodejs/node/releases/tag/v16.15.1; https://github.com/nodejs/node/releases/tag/v17.9.1
CVE: CVE-2022-30308
Published: 2022-06-13
Description: In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-on" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-863, CWE-78, CWE-863
References: https://cert.vde.com/en/advisories/VDE-2022-020/; https://cert.vde.com/en/advisories/VDE-2022-020/
CVE: CVE-2022-30309
Published: 2022-06-13
Description: In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-off" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-863, CWE-78, CWE-863
References: https://cert.vde.com/en/advisories/VDE-2022-020/; https://cert.vde.com/en/advisories/VDE-2022-020/
CVE: CVE-2022-30310
Published: 2022-06-13
Description: In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-acknerr-request" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-863, CWE-78, CWE-863
References: https://cert.vde.com/en/advisories/VDE-2022-020/; https://cert.vde.com/en/advisories/VDE-2022-020/
CVE: CVE-2022-30311
Published: 2022-06-13
Description: In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-refresh-request" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-863, CWE-78, CWE-863
References: https://cert.vde.com/en/advisories/VDE-2022-020/; https://cert.vde.com/en/advisories/VDE-2022-020/
CVE: CVE-2021-46814
Published: 2022-06-13
Description: The video framework has an out-of-bounds memory read/write vulnerability. Successful exploitation of this vulnerability may affect system availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-787
References: https://consumer.huawei.com/en/support/bulletin/2022/6/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202206-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/6/
CVE: CVE-2022-31751
Published: 2022-06-13
Description: The kernel emcom module has multi-thread contention. Successful exploitation of this vulnerability may affect system availability.
CVSS Score: 5.5 (MEDIUM)
References: https://consumer.huawei.com/en/support/bulletin/2022/6/; https://consumer.huawei.com/en/support/bulletin/2022/7/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202206-[PII_REDACTED]
CVE: CVE-2022-31755
Published: 2022-06-13
Description: The communication module has a vulnerability of improper permission preservation. Successful exploitation of this vulnerability may affect system availability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-281
References: https://consumer.huawei.com/en/support/bulletin/2022/6/; https://consumer.huawei.com/en/support/bulletin/2022/7/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202206-[PII_REDACTED]
CVE: CVE-2022-31756
Published: 2022-06-13
Description: The fingerprint sensor module has design defects. Successful exploitation of this vulnerability may affect data confidentiality.
CVSS Score: 5.5 (MEDIUM)
References: https://consumer.huawei.com/en/support/bulletin/2022/6/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202206-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/6/
CVE: CVE-2022-31758
Published: 2022-06-13
Description: The kernel module has the race condition vulnerability. Successful exploitation of this vulnerability may affect data confidentiality.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: https://consumer.huawei.com/en/support/bulletin/2022/6/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202206-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/6/
CVE: CVE-2022-31759
Published: 2022-06-13
Description: AppLink has a vulnerability of accessing uninitialized pointers. Successful exploitation of this vulnerability may affect system availability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-824
References: https://consumer.huawei.com/en/support/bulletin/2022/6/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202206-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/6/
CVE: CVE-2022-31762
Published: 2022-06-13
Description: The AMS module has a vulnerability in input validation. Successful exploitation of this vulnerability may cause privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://consumer.huawei.com/en/support/bulletin/2022/6/; https://consumer.huawei.com/en/support/bulletin/2022/7/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202206-[PII_REDACTED]
CVE: CVE-2022-31763
Published: 2022-06-13
Description: The kernel module has the null pointer and out-of-bounds array vulnerabilities. Successful exploitation of this vulnerability may affect system availability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://consumer.huawei.com/en/support/bulletin/2022/6/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202206-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/6/
CVE: CVE-2021-46811
Published: 2022-06-13
Description: HwSEServiceAPP has a vulnerability in permission management. Successful exploitation of this vulnerability may cause disclosure of the Card Production Life Cycle (CPLC) information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-276
References: https://consumer.huawei.com/en/support/bulletin/2022/6/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202206-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/6/
CVE: CVE-2021-46812
Published: 2022-06-13
Description: The Device Manager has a vulnerability in multi-device interaction. Successful exploitation of this vulnerability may affect data integrity.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2022/6/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202206-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/6/
CVE: CVE-2021-46813
Published: 2022-06-13
Description: Vulnerability of residual files not being deleted after an update in the ChinaDRM module. Successful exploitation of this vulnerability may affect availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-212
References: https://consumer.huawei.com/en/support/bulletin/2022/6/; https://consumer.huawei.com/en/support/bulletin/2022/6/
CVE: CVE-2021-46815
Published: 2022-06-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-46789. Reason: This candidate is a duplicate of CVE-2021-46789. Notes: All CVE users should reference CVE-2021-46789 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2022-31055
Published: 2022-06-13
Description: kCTF is a Kubernetes-based infrastructure for capture the flag (CTF) competitions. Prior to version 1.6.0, the kctf cluster set-src-ip-ranges was broken and allowed traffic from any IP. The problem has been patched in v1.6.0. As a workaround, those who want to test challenges privately can mark them as `public: false` and use `kctf chal debug port-forward` to connect.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://github.com/google/kctf/commit/8cf050be974fcc2fd8aa136701f9a66f2b2a5202; https://github.com/google/kctf/pull/371; https://github.com/google/kctf/security/advisories/GHSA-4g2v-6qc6-6jv5
CVE: CVE-2022-31752
Published: 2022-06-13
Description: Missing authorization vulnerability in the system components. Successful exploitation of this vulnerability will affect confidentiality.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://consumer.huawei.com/en/support/bulletin/2022/6/; https://consumer.huawei.com/en/support/bulletin/2022/6/
CVE: CVE-2022-31753
Published: 2022-06-13
Description: The voice wakeup module has a vulnerability of using externally-controlled format strings. Successful exploitation of this vulnerability may affect system availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-134
References: https://consumer.huawei.com/en/support/bulletin/2022/6/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202206-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/6/
CVE: CVE-2022-31754
Published: 2022-06-13
Description: Logical defects in code implementation in some products. Successful exploitation of this vulnerability may affect the availability of some features.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2022/6/; https://consumer.huawei.com/en/support/bulletin/2022/6/
CVE: CVE-2022-31757
Published: 2022-06-13
Description: The setting module has a vulnerability of improper use of APIs. Successful exploitation of this vulnerability may affect data confidentiality.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2022/6/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202206-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/6/
CVE: CVE-2022-31760
Published: 2022-06-13
Description: Dialog boxes can still be displayed even if the screen is locked in carrier-customized USSD services. Successful exploitation of this vulnerability may affect data integrity and confidentiality.
CVSS Score: 9.1 (CRITICAL)
References: https://consumer.huawei.com/en/support/bulletin/2022/6/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202206-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/6/
CVE: CVE-2022-31761
Published: 2022-06-13
Description: Configuration defects in the secure OS module. Successful exploitation of this vulnerability will affect confidentiality.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2022/6/; https://consumer.huawei.com/en/support/bulletin/2022/6/
CVE: CVE-2021-41438
Published: 2022-06-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-41439
Published: 2022-06-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-41446
Published: 2022-06-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-41447
Published: 2022-06-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-41448
Published: 2022-06-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-41452
Published: 2022-06-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-41453
Published: 2022-06-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-41454
Published: 2022-06-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2022-23167
Published: 2022-06-13
Description: Attacker crafts a GET request to: /mobile/downloadfile.aspx? Filename =../.. /windows/boot.ini the LFI is UNAUTHENTICATED.
CVSS Score: 5.3 (MEDIUM)
References: https://www.gov.il/en/departments/faq/cve_advisories; https://www.gov.il/en/departments/faq/cve_advisories
CVE: CVE-2022-23168
Published: 2022-06-13
Description: The attacker could get access to the database. The SQL injection is in the username parameter at the login panel: username: admin'--
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://www.gov.il/en/departments/faq/cve_advisories; https://www.gov.il/en/departments/faq/cve_advisories
CVE: CVE-2022-23169
Published: 2022-06-13
Description: attacker needs to craft a SQL payload. the vulnerable parameter is "agentid" must be authenticated to the admin panel.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://www.gov.il/en/departments/faq/cve_advisories; https://www.gov.il/en/departments/faq/cve_advisories
CVE: CVE-2022-28217
Published: 2022-06-13
Description: Some part of SAP NetWeaver (EP Web Page Composer) does not sufficiently validate an XML document accepted from an untrusted source, which allows an adversary to exploit unprotected XML parking at endpoints, and a possibility to conduct SSRF attacks that could compromise system�s Availability by causing system to crash.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://launchpad.support.sap.com/#/notes/3148377; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3148377
CVE: CVE-2022-29455
Published: 2022-06-13
Description: DOM-based Reflected Cross-Site Scripting (XSS) vulnerability in Elementor's Elementor Website Builder plugin <= 3.5.5 versions.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/elementor/wordpress-elementor-plugin-3-5-5-unauthenticated-dom-based-reflected-cross-site-scripting-xss-vulnerability; https://rotem-bar.com/hacking-65-million-websites-greater-cve-2022-29455-elementor; https://wordpress.org/plugins/elementor/#developers
CVE: CVE-2021-40036
Published: 2022-06-13
Description: The bone voice ID TA has a memory overwrite vulnerability. Successful exploitation of this vulnerability may result in malicious code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202201-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202201-[PII_REDACTED]
CVE: CVE-2021-40604
Published: 2022-06-13
Description: A Server-Side Request Forgery (SSRF) vulnerability in IPS Community Suite before 4.6.2 allows remote authenticated users to request arbitrary URLs or trigger deserialization via phar protocol when generating class names dynamically. In some cases an exploitation is possible by an unauthenticated user.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-918
References: https://invisioncommunity.com/release-notes/462-r99/; https://invisioncommunity.com/release-notes/462-r99/
CVE: CVE-2021-41663
Published: 2022-06-13
Description: A cross-site scripting (XSS) vulnerability exists in Mini CMS V1.11. The vulnerability exists in the article upload: post-edit.php page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://minicms.com; https://github.com/bg5sbk/MiniCMS; https://github.com/bg5sbk/MiniCMS/issues/41