deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-36201
Published: 2023-07-07
Description: An issue in JerryscriptProject jerryscript v.3.0.0 allows an attacker to obtain sensitive information via a crafted script to the arrays.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/jerryscript-project/jerryscript/issues/5026; https://github.com/jerryscript-project/jerryscript/issues/5026
CVE: CVE-2023-3541
Published: 2023-07-07
Description: A vulnerability has been found in ThinuTech ThinuCMS 1.5 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /author_posts.php. The manipulation of the argument author with the input g6g12<script>alert(1)</script>o8sdm leads to cross site scripting. The attack can be launched remotely. The identifier VDB-233293 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.233293; https://vuldb.com/?id.233293; https://vuldb.com/?ctiid.233293
CVE: CVE-2023-3542
Published: 2023-07-07
Description: A vulnerability was found in ThinuTech ThinuCMS 1.5 and classified as problematic. Affected by this issue is some unknown functionality of the file /contact.php. The manipulation of the argument name/body leads to cross site scripting. The attack may be launched remotely. VDB-233294 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.233294; https://vuldb.com/?id.233294; https://vuldb.com/?ctiid.233294
CVE: CVE-2023-27845
Published: 2023-07-07
Description: SQL injection vulnerability found in PrestaShop lekerawen_ocs before v.1.4.1 allow a remote attacker to gain privileges via the KerawenHelper::setCartOperationInfo, and KerawenHelper::resetCheckoutSessionData components.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://kerawen.com/logiciel-de-caisse/; https://security.friendsofpresta.org/modules/2023/07/06/kerawen_ocs.html; https://kerawen.com/logiciel-de-caisse/
CVE: CVE-2023-33715
Published: 2023-07-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-37061
Published: 2023-07-07
Description: Chamilo 1.11.x up to 1.11.20 allows users with an admin privilege account to insert XSS in the languages management section.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/chamilo/chamilo-lms/commit/75e9b3e0acac6f7a643da6ff19a00d55a94417a1; https://support.chamilo.org/projects/1/wiki/Security_issues#Issue-116-2023-06-06-Low-impact-Low-risk-XSS-through-admin-account-languages-management; https://github.com/chamilo/chamilo-lms/commit/75e9b3e0acac6f7a643da6ff19a00d55a94417a1
CVE: CVE-2023-37062
Published: 2023-07-07
Description: Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the course categories' definition.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/chamilo/chamilo-lms/commit/c263933d1d958edee3999820f636c8cb919d03d1; https://support.chamilo.org/projects/1/wiki/Security_issues#Issue-115-2023-06-06-Low-impact-Low-risk-XSS-through-admin-account-course-category; https://github.com/chamilo/chamilo-lms/commit/c263933d1d958edee3999820f636c8cb919d03d1
CVE: CVE-2023-37063
Published: 2023-07-07
Description: Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the careers & promotions management section.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/chamilo/chamilo-lms/commit/546a18b0bd1446123f4e29f81f42e71b761f51b7; https://support.chamilo.org/projects/1/wiki/Security_issues#Issue-117-2023-06-06-Low-impact-Low-risk-XSS-through-admin-account-careers-amp-promotions-management; https://github.com/chamilo/chamilo-lms/commit/546a18b0bd1446123f4e29f81f42e71b761f51b7
CVE: CVE-2023-37064
Published: 2023-07-07
Description: Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the extra fields management section.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/chamilo/chamilo-lms/commit/91ecc6141de6de9483c5a31fbb9fa91450f24940; https://support.chamilo.org/projects/1/wiki/Security_issues#Issue-119-2023-06-06-Low-impact-Low-risk-XSS-through-admin-account-extra-fields-management; https://github.com/chamilo/chamilo-lms/commit/91ecc6141de6de9483c5a31fbb9fa91450f24940
CVE: CVE-2023-37065
Published: 2023-07-07
Description: Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the session category management section.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/chamilo/chamilo-lms/commit/da61f287d2e508a5e940953b474051d0f21e91c0; https://support.chamilo.org/projects/1/wiki/Security_issues#Issue-118-2023-06-06-Low-impact-Low-risk-XSS-through-admin-account-session-category-management; https://github.com/chamilo/chamilo-lms/commit/da61f287d2e508a5e940953b474051d0f21e91c0
CVE: CVE-2023-37066
Published: 2023-07-07
Description: Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the skills wheel.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/chamilo/chamilo-lms/commit/4f7b5ebf90c35999917c231276e47a[PII_REDACTED]; https://support.chamilo.org/projects/1/wiki/Security_issues#Issue-114-2023-06-06-Low-impact-Low-risk-XSS-through-admin-account-skills; https://github.com/chamilo/chamilo-lms/commit/4f7b5ebf90c35999917c231276e47a[PII_REDACTED]
CVE: CVE-2023-37067
Published: 2023-07-07
Description: Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the classes/usergroups management section.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/chamilo/chamilo-lms/commit/c75ff227bcf00e9f88e9477b78eaeed9e0668905; https://support.chamilo.org/projects/1/wiki/Security_issues#Issue-120-2023-06-07-Low-impact-Low-risk-XSS-through-admin-account-classesusergroups-management; https://github.com/chamilo/chamilo-lms/commit/c75ff227bcf00e9f88e9477b78eaeed9e0668905
CVE: CVE-2023-37264
Published: 2023-07-07
Description: Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.35.0, pipelines do not validate child UIDs, which means that a user that has access to create TaskRuns can create their own Tasks that the Pipelines controller will accept as the child Task. While the software stores and validates the PipelineRun's (api version, kind, name, uid) in the child Run's OwnerReference, it only store (api version, kind, name) in the ChildStatusReference. This means that if a client had access to create TaskRuns on a cluster, they could create a child TaskRun for a pipeline with the same name + owner reference, and the Pipeline controller picks it up as if it was the original TaskRun. This is problematic since it can let users modify the config of Pipelines at runtime, which violates SLSA L2 Service Generated / Non-falsifiable requirements. This issue can be used to trick the Pipeline controller into associating unrelated Runs to the Pipeline, feeding its data through the rest of the Pipeline. This requires access to create TaskRuns, so impact may vary depending on one Tekton setup. If users already have unrestricted access to create any Task/PipelineRun, this does not grant any additional capabilities. As of time of publication, there are no known patches for this issue.
CVSS Score: 3.7 (LOW)
CWE: CWE-345
References: https://github.com/tektoncd/pipeline/blob/2d38f5fa[PII_REDACTED]78422d34b36b1bc739e2a2/pkg/reconciler/pipelinerun/pipelinerun.go#L1358-L1372; https://github.com/tektoncd/pipeline/security/advisories/GHSA-w2h3-vvvq-3m53; https://pkg.go.dev/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1#ChildStatusReference
CVE: CVE-2023-3543
Published: 2023-07-07
Description: A vulnerability was found in GZ Scripts Availability Booking Calendar PHP 1.8. It has been classified as problematic. This affects an unknown part of the file load.php of the component HTTP POST Request Handler. The manipulation of the argument cid/first_name/second_name/address_1/country leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-233295. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.233295; https://vuldb.com/?id.233295; https://vuldb.com/?ctiid.233295
CVE: CVE-2023-3544
Published: 2023-07-07
Description: A vulnerability was found in GZ Scripts Time Slot Booking Calendar PHP 1.8. It has been declared as problematic. This vulnerability affects unknown code of the file /load.php. The manipulation of the argument first_name/second_name/phone/address_1/country leads to cross site scripting. The attack can be initiated remotely. The identifier of this vulnerability is VDB-233296. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.233296; https://vuldb.com/?id.233296; https://vuldb.com/?ctiid.233296
CVE: CVE-2021-33796
Published: 2023-07-07
Description: In MuJS before version 1.1.2, a use-after-free flaw in the regexp source property access may cause denial of service.


CVSS Score: 10.0 (CRITICAL)
CWE: CWE-416, CWE-416
References: https://github.com/ccxvii/mujs/commit/7ef066a3bb95bf83e7c5be50d859e62e58fe8515; https://github.com/ccxvii/mujs/commit/7ef066a3bb95bf83e7c5be50d859e62e58fe8515
CVE: CVE-2021-33798
Published: 2023-07-07
Description: A null pointer dereference was found in libpano13, version libpano13-2.9.20. The flow allows attackers to cause a denial of service and potential code execute via a crafted file.



CVSS Score: 4.7 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://groups.google.com/u/1/g/hugin-ptx/c/gLtz2vweD74; https://sourceforge.net/p/panotools/libpano13/ci/62aa7eed8fae5d8f247a2508a757f31000de386f/; https://groups.google.com/u/1/g/hugin-ptx/c/gLtz2vweD74
CVE: CVE-2023-36256
Published: 2023-07-07
Description: The Online Examination System Project 1.0 version is vulnerable to Cross-Site Request Forgery (CSRF) attacks. An attacker can craft a malicious link that, when clicked by an admin user, will delete a user account from the database without the admin's consent. The email of the user to be deleted is passed as a parameter in the URL, which can be manipulated by the attacker. This could result in a loss of data.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://www.exploit-db.com/exploits/51511; https://www.hackersnotes.com/blog/pentest/online-examination-system-project-1-0-cross-site-request-forgery-csrf/; https://www.exploit-db.com/exploits/51511
CVE: CVE-2021-32494
Published: 2023-07-07
Description: Radare2 has a division by zero vulnerability in Mach-O parser's rebase_buffer function. This allow attackers to create malicious inputs that can cause denial of service.



CVSS Score: 10.0 (CRITICAL)
CWE: CWE-369, CWE-369
References: https://github.com/radareorg/radare2/commit/a07dedb804a82bc01c[PII_REDACTED]2dd80c6b6d62; https://github.com/radareorg/radare2/issues/18667; https://github.com/radareorg/radare2/commit/a07dedb804a82bc01c[PII_REDACTED]2dd80c6b6d62
CVE: CVE-2021-32495
Published: 2023-07-07
Description: Radare2 has a use-after-free vulnerability in pyc parser's get_none_object function. Attacker can read freed memory afterwards. This will allow attackers to cause denial of service.


CVSS Score: 10.0 (CRITICAL)
CWE: CWE-416, CWE-416
References: https://github.com/radareorg/radare2/commit/5e16e2d1c9fe245e4c17005d779fde91ec0b9c05; https://github.com/radareorg/radare2/issues/18666; https://github.com/radareorg/radare2/commit/5e16e2d1c9fe245e4c17005d779fde91ec0b9c05
CVE: CVE-2021-39014
Published: 2023-07-07
Description: IBM Cloud Object System 3.15.8.97 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  213650.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/213650; https://www.ibm.com/support/pages/node/6517124; https://exchange.xforce.ibmcloud.com/vulnerabilities/213650
CVE: CVE-2023-36992
Published: 2023-07-07
Description: PHP injection in TravianZ 8.3.4 and 8.3.3 in the config editor in the admin page allows remote attackers to execute PHP code.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://bramdoessecurity.com/travianz-hacked/; https://bramdoessecurity.com/travianz-hacked/
CVE: CVE-2023-36993
Published: 2023-07-07
Description: The cryptographically insecure random number generator being used in TravianZ 8.3.4 and 8.3.3 in the password reset function allows an attacker to guess the password reset.parameters and to take over accounts.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-338
References: https://bramdoessecurity.com/travianz-hacked/; https://bramdoessecurity.com/travianz-hacked/
CVE: CVE-2023-36994
Published: 2023-07-07
Description: In TravianZ 8.3.4 and 8.3.3, Incorrect Access Control in the installation script allows an attacker to overwrite the server configuration and inject PHP code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: https://bramdoessecurity.com/travianz-hacked/; https://bramdoessecurity.com/travianz-hacked/
CVE: CVE-2022-4361
Published: 2023-07-07
Description: Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC providers. The vulnerability can allow an attacker to execute malicious scripts by setting the AssertionConsumerServiceURL value or the redirect_uri.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-81, CWE-79
References: https://bugzilla.redhat.com/show_bug.cgi?id=2151618; https://github.com/keycloak/keycloak/commit/a1cfe6e24e5b34792699a00b8b4a8016a5929e3a; https://bugzilla.redhat.com/show_bug.cgi?id=2151618
CVE: CVE-2023-20133
Published: 2023-07-07
Description: A vulnerability in the web interface of Cisco Webex Meetings could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface.
 This vulnerability exists because of insufficient validation of user-supplied input in Webex Events (classic) programs, email templates, and survey questions. An attacker could exploit this vulnerability by persuading a user to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sxsscsrf-2L24bBx6; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sxsscsrf-2L24bBx6
CVE: CVE-2023-20180
Published: 2023-07-07
Description: A vulnerability in the web interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system.
 This vulnerability is due to insufficient CSRF protections for the web interface on an affected system. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to perform arbitrary actions. These actions could include joining meetings and scheduling training sessions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sxsscsrf-2L24bBx6; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sxsscsrf-2L24bBx6
CVE: CVE-2023-37170
Published: 2023-07-07
Description: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the lang parameter in the setLanguageCfg function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/kafroc/Vuls/tree/main/TOTOLINK/A3300R/cmdi_1; https://github.com/kafroc/Vuls/tree/main/TOTOLINK/A3300R/cmdi_1
CVE: CVE-2023-37171
Published: 2023-07-07
Description: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the admuser parameter in the setPasswordCfg function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/kafroc/Vuls/tree/main/TOTOLINK/A3300R/cmdi_2; https://github.com/kafroc/Vuls/tree/main/TOTOLINK/A3300R/cmdi_2
CVE: CVE-2023-37172
Published: 2023-07-07
Description: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the ip parameter in the setDiagnosisCfg function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/kafroc/Vuls/tree/main/TOTOLINK/A3300R/cmdi_3; https://github.com/kafroc/Vuls/tree/main/TOTOLINK/A3300R/cmdi_3
CVE: CVE-2023-37173
Published: 2023-07-07
Description: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the command parameter in the setTracerouteCfg function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/kafroc/Vuls/tree/main/TOTOLINK/A3300R/cmdi_4; https://github.com/kafroc/Vuls/tree/main/TOTOLINK/A3300R/cmdi_4
CVE: CVE-2023-37261
Published: 2023-07-07
Description: OpenComputers is a Minecraft mod that adds programmable computers and robots to the game. This issue affects every version of OpenComputers with the Internet Card feature enabled; that is, OpenComputers 1.2.0 until 1.8.3 in their most common, default configurations. If the OpenComputers mod is installed as part of a Minecraft server hosted on a popular cloud hosting provider, such as AWS, GCP and Azure, those metadata services' API endpoints are not forbidden (aka "blacklisted") by default. As such, any player can gain access to sensitive information exposed via those metadata servers, potentially allowing them to pivot or privilege escalate into the hosting provider. In addition, IPv6 addresses are not correctly filtered at all, allowing broader access into the local IPv6 network. This can allow a player on a server using an OpenComputers computer to access parts of the private IPv4 address space, as well as the whole IPv6 address space, in order to retrieve sensitive information.

OpenComputers v1.8.3 for Minecraft 1.7.10 and 1.12.2 contains a patch for this issue. Some workarounds are also available. One may disable the Internet Card feature completely. If using OpenComputers 1.3.0 or above, using the allow list (`opencomputers.internet.whitelist` option) will prohibit connections to any IP addresses and/or domains not listed; or one may add entries to the block list (`opencomputers.internet.blacklist` option). More information about mitigations is available in the GitHub Security Advisory.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-918
References: https://github.com/MightyPirates/OpenComputers/blob/5b2ba76a4c242b369b9b6ac6196fd04d96580ad0/src/main/resources/application.conf#L966-L986; https://github.com/MightyPirates/OpenComputers/blob/5b2ba76a4c242b369b9b6ac6196fd04d96580ad0/src/main/scala/li/cil/oc/Settings.scala#L614-L637; https://github.com/MightyPirates/OpenComputers/commit/d13c015357fd6c42e0a1bdd6e1ef9462f0450a15
CVE: CVE-2023-37262
Published: 2023-07-07
Description: CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to versions 1.20.1-1.106.0, 1.19.4-1.106.0, 1.19.2-1.101.3, 1.18.2-1.101.3, and 1.16.5-1.101.3, if the cc-tweaked plugin is running on a Minecraft server hosted on a popular cloud hosting providers, like AWS, GCP, and Azure, those metadata services API endpoints are not forbidden (aka "blacklisted") by default. As such, any player can gain access to sensitive information exposed via those metadata servers, potentially allowing them to pivot or privilege escalate into the hosting provider. Versions 1.20.1-1.106.0, 1.19.4-1.106.0, 1.19.2-1.101.3, 1.18.2-1.101.3, and 1.16.5-1.101.3 contain a fix for this issue.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-918
References: https://github.com/MightyPirates/OpenComputers/security/advisories/GHSA-vvfj-xh7c-j2cm; https://github.com/cc-tweaked/CC-Tweaked/blob/96847bb8c28df51e5e49f2dd2978ff6cc4e2821b/projects/core/src/main/java/dan200/computercraft/core/apis/http/options/AddressPredicate.java#L116-L126; https://github.com/cc-tweaked/CC-Tweaked/commit/4bbde8c50c00bc572578ab2cff609b3443d10ddf
CVE: CVE-2023-37269
Published: 2023-07-07
Description: Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Users with the `backend.manage_branding` permission can upload SVGs as the application logo. Prior to version 1.2.3, SVG uploads were not sanitized, which could have allowed a stored cross-site scripting (XSS) attack. To exploit the vulnerability, an attacker would already need to have developer or super user level permissions in Winter CMS. This means they would already have extensive access and control within the system. Additionally, to execute the XSS, the attacker would need to convince the victim to directly visit the URL of the maliciously uploaded SVG, and the application would have to be using local storage where uploaded files are served under the same domain as the application itself instead of a CDN. This is because all SVGs in Winter CMS are rendered through an `img` tag, which prevents any payloads from being executed directly. These two factors significantly limit the potential harm of this vulnerability. This issue has been patched in v1.2.3 through the inclusion of full support for SVG uploads and automatic sanitization of uploaded SVG files. As a workaround, one may apply the patches manually.
CVSS Score: 2.0 (LOW)
CWE: CWE-79, CWE-79
References: http://packetstormsecurity.com/files/173520/WinterCMS-1.2.2-Cross-Site-Scripting.html; https://github.com/wintercms/storm/commit/186d85d8fea2cae43afc807d39f68553c24e56be; https://github.com/wintercms/winter/commit/fa50b4c7489b67ea80072f8ac9fe5294fce1df1c
CVE: CVE-2023-37270
Published: 2023-07-07
Description: Piwigo is open source photo gallery software. Prior to version 13.8.0, there is a SQL Injection vulnerability in the login of the administrator screen. The SQL statement that acquires the HTTP Header `User-Agent` is vulnerable at the endpoint that records user information when logging in to the administrator screen. It is possible to execute arbitrary SQL statements. Someone who wants to exploit the vulnerability must be log in to the administrator screen, even with low privileges. Any SQL statement can be executed. Doing so may leak information from the database. Version 13.8.0 contains a fix for this issue. As another mitigation, those who want to execute a SQL statement verbatim with user-enterable parameters should be sure to escape the parameter contents appropriately.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://github.com/Piwigo/Piwigo/blob/c01ec38bc43f09424a8d404719c35f963d63cf00/include/dblayer/functions_mysqli.inc.php#L491; https://github.com/Piwigo/Piwigo/blob/c01ec38bc43f09424a8d404719c35f963d63cf00/include/functions.inc.php#L621; https://github.com/Piwigo/Piwigo/commit/978425527d6c113887f845d75cf982bbb62d761a
CVE: CVE-2023-32000
Published: 2023-07-08
Description: A Cross-Site Scripting (XSS) vulnerability found in UniFi Network (Version 7.3.83 and earlier) allows a malicious actor with Site Administrator credentials to escalate privileges by persuading an Administrator to visit a malicious web page.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://community.ui.com/releases/Security-Advisory-Bulletin-034-034/53cfcb84-b42b-4f8f-afbf-07c0ca7cabe2; https://community.ui.com/releases/Security-Advisory-Bulletin-034-034/53cfcb84-b42b-4f8f-afbf-07c0ca7cabe2