deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-23885
Published: 2023-04-07
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Contact Form plugin <= 8.0.3.1 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/quick-contact-form/wordpress-quick-contact-form-plugin-8-0-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/quick-contact-form/wordpress-quick-contact-form-plugin-8-0-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23994
Published: 2023-04-07
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Marcel Bootsman Auto Hide Admin Bar plugin <= 1.6.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/auto-hide-admin-bar/wordpress-auto-hide-admin-bar-plugin-1-6-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/auto-hide-admin-bar/wordpress-auto-hide-admin-bar-plugin-1-6-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-25020
Published: 2023-04-07
Description: Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Arigato Autoresponder and Newsletter plugin <= 2.7.1.1 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/bft-autoresponder/wordpress-arigato-autoresponder-and-newsletter-plugin-2-7-1-1-cross-site-scripting-xss-2?_s_id=cve; https://patchstack.com/database/vulnerability/bft-autoresponder/wordpress-arigato-autoresponder-and-newsletter-plugin-2-7-1-1-cross-site-scripting-xss-2?_s_id=cve
CVE: CVE-2023-25031
Published: 2023-04-07
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Arigato Autoresponder and Newsletter plugin <= 2.7.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/bft-autoresponder/wordpress-arigato-autoresponder-and-newsletter-plugin-2-7-1-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/bft-autoresponder/wordpress-arigato-autoresponder-and-newsletter-plugin-2-7-1-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-25041
Published: 2023-04-07
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Cththemes Monolit theme <= 2.0.6 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/monolit/wordpress-monolit-theme-theme-2-0-6-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/monolit/wordpress-monolit-theme-theme-2-0-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-25049
Published: 2023-04-07
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress plugin <= 3.3.4 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/ecommerce-product-catalog/wordpress-ecommerce-product-catalog-plugin-for-wordpress-plugin-3-3-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ecommerce-product-catalog/wordpress-ecommerce-product-catalog-plugin-for-wordpress-plugin-3-3-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-25716
Published: 2023-04-07
Description: Auth (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gqevu6bsiz Announce from the Dashboard plugin <= 1.5.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/announce-from-the-dashboard/wordpress-announce-from-the-dashboard-plugin-1-5-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/announce-from-the-dashboard/wordpress-announce-from-the-dashboard-plugin-1-5-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-28993
Published: 2023-04-07
Description: Unauth.  Reflected Cross-Site Scripting (XSS) vulnerability in Ignazio Scimone Albo Pretorio On Line plugin <= 4.6.1 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/albo-pretorio-on-line/wordpress-albo-pretorio-on-line-plugin-4-6-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/albo-pretorio-on-line/wordpress-albo-pretorio-on-line-plugin-4-6-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-29236
Published: 2023-04-07
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Cththemes Outdoor theme <= 3.9.6 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/outdoor/wordpress-outdoor-theme-3-9-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/outdoor/wordpress-outdoor-theme-3-9-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-34333
Published: 2023-04-07
Description: 
IBM Sterling Order Management 10.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 229698.


CVSS Score: 5.9 (MEDIUM)
CWE: CWE-521
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/229698; https://www.ibm.com/support/pages/node/6981917; https://exchange.xforce.ibmcloud.com/vulnerabilities/229698
CVE: CVE-2023-1726
Published: 2023-04-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Proliz OBS allows Stored XSS for an authenticated user.This issue affects OBS: before 23.04.01.


CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-23-0205; https://www.usom.gov.tr/bildirim/tr-23-0205
CVE: CVE-2023-25464
Published: 2023-04-07
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in StreamWeasels Twitch Player plugin <= 2.1.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/ttv-easy-embed-player/wordpress-twitch-player-plugin-2-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ttv-easy-embed-player/wordpress-twitch-player-plugin-2-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-25702
Published: 2023-04-07
Description: Auth. (admin+) Stored Cross-site Scripting (XSS) vulnerability in Fullworks Quick Paypal Payments plugin <= 5.7.25 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/quick-paypal-payments/wordpress-quick-paypal-payments-plugin-5-7-25-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/quick-paypal-payments/wordpress-quick-paypal-payments-plugin-5-7-25-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-25705
Published: 2023-04-07
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Go Prayer WP Prayer plugin <= 1.9.6 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-prayer/wordpress-wp-prayer-plugin-1-9-6-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/wp-prayer/wordpress-wp-prayer-plugin-1-9-6-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-25711
Published: 2023-04-07
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPGlobus WPGlobus Translate Options plugin <= 2.1.0 versions.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wpglobus-translate-options/wordpress-wpglobus-translate-options-plugin-2-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wpglobus-translate-options/wordpress-wpglobus-translate-options-plugin-2-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-25712
Published: 2023-04-07
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP-Buddy Google Analytics Opt-Out plugin <= 2.3.4 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/google-analytics-opt-out/wordpress-opt-out-for-google-analytics-plugin-2-3-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/google-analytics-opt-out/wordpress-opt-out-for-google-analytics-plugin-2-3-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-25713
Published: 2023-04-07
Description: Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Paypal Payments plugin <= 5.7.25 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/quick-paypal-payments/wordpress-quick-paypal-payments-plugin-5-7-25-cross-site-scripting-xss-2?_s_id=cve; https://patchstack.com/database/vulnerability/quick-paypal-payments/wordpress-quick-paypal-payments-plugin-5-7-25-cross-site-scripting-xss-2?_s_id=cve
CVE: CVE-2023-29094
Published: 2023-04-07
Description: Auth. (admin+) Stored Cross-site Scripting (XSS) vulnerability in PI Websolution Product page shipping calculator for WooCommerce plugin <= 1.3.20 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/product-page-shipping-calculator-for-woocommerce/wordpress-product-page-shipping-calculator-for-woocommerce-plugin-1-3-20-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/product-page-shipping-calculator-for-woocommerce/wordpress-product-page-shipping-calculator-for-woocommerce-plugin-1-3-20-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-33959
Published: 2023-04-07
Description: IBM Sterling Order Management 10.0 could allow a user to bypass validation and perform unauthorized actions on behalf of other users.  IBM X-Force ID:  229320.
CVSS Score: 5.4 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/229320; https://www.ibm.com/support/pages/node/6981911; https://exchange.xforce.ibmcloud.com/vulnerabilities/229320
CVE: CVE-2022-43914
Published: 2023-04-07
Description: IBM TRIRIGA Application Platform 4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  241036.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/241036; https://www.ibm.com/support/pages/node/6981597; https://exchange.xforce.ibmcloud.com/vulnerabilities/241036
CVE: CVE-2022-43928
Published: 2023-04-07
Description: The IBM Toolbox for Java (Db2 Mirror for i 7.4 and 7.5) could allow a user to obtain sensitive information, caused by utilizing a Java string for processing. Since Java strings are immutable, their contents exist in memory until garbage collected.  This means sensitive data could be visible in memory over an indefinite amount of time. IBM has addressed this issue by reducing the amount of time the sensitive data is visible in memory.  IBM X-Force ID:  241675.
CVSS Score: 4.9 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/241675; https://www.ibm.com/support/pages/node/6981113; https://exchange.xforce.ibmcloud.com/vulnerabilities/241675
CVE: CVE-2023-23799
Published: 2023-04-07
Description: Auth. (admin+) Stored Cross-site Scripting (XSS) vulnerability in Leonardo Giacone Easy Panorama plugin <= 1.1.4 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/easy-panorama/wordpress-easy-panorama-plugin-1-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/easy-panorama/wordpress-easy-panorama-plugin-1-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-25442
Published: 2023-04-07
Description: Auth. (admin+) Stored Cross-site Scripting (XSS) vulnerability in Marcel Pol Zeno Font Resizer plugin <= 1.7.9 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/zeno-font-resizer/wordpress-zeno-font-resizer-plugin-1-7-9-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/zeno-font-resizer/wordpress-zeno-font-resizer-plugin-1-7-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-27620
Published: 2023-04-07
Description: Auth. (contributor+) Stored Cross-site Scripting (XSS) vulnerability in RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery plugin <= 3.2.12 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/robo-gallery/wordpress-robo-gallery-plugin-3-2-12-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/robo-gallery/wordpress-robo-gallery-plugin-3-2-12-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-27801
Published: 2023-04-07
Description: H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the DelDNSHnList interface at /goform/aspForm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted payload.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://hackmd.io/%400dayResearch/DelDNSHnList; https://hackmd.io/%400dayResearch/DelDNSHnList
CVE: CVE-2023-27802
Published: 2023-04-07
Description: H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the EditvsList parameter at /goform/aspForm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted payload.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://hackmd.io/%400dayResearch/EditvsList; https://hackmd.io/%400dayResearch/EditvsList
CVE: CVE-2023-27803
Published: 2023-04-07
Description: H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the EdittriggerList interface at /goform/aspForm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted payload.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://hackmd.io/%400dayResearch/EdittriggerList; https://hackmd.io/%400dayResearch/EdittriggerList
CVE: CVE-2023-27804
Published: 2023-04-07
Description: H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the DelvsList interface at /goform/aspForm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted payload.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://hackmd.io/%400dayResearch/DelvsList; https://hackmd.io/%400dayResearch/DelvsList
CVE: CVE-2023-27805
Published: 2023-04-07
Description: H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the EditSTList interface at /goform/aspForm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted payload.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://hackmd.io/%400dayResearch/EditSTList; https://hackmd.io/%400dayResearch/EditSTList
CVE: CVE-2023-27806
Published: 2023-04-07
Description: H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the ipqos_lanip_dellist interface at /goform/aspForm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted payload.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://hackmd.io/%400dayResearch/ipqos_lanip_dellist; https://hackmd.io/%400dayResearch/ipqos_lanip_dellist
CVE: CVE-2023-27807
Published: 2023-04-07
Description: H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the Delstlist interface at /goform/aspForm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted payload.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://hackmd.io/%400dayResearch/Delstlist; https://hackmd.io/%400dayResearch/Delstlist
CVE: CVE-2023-27808
Published: 2023-04-07
Description: H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the DeltriggerList interface at /goform/aspForm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted payload.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://hackmd.io/%400dayResearch/DeltriggerList; https://hackmd.io/%400dayResearch/DeltriggerList
CVE: CVE-2023-27810
Published: 2023-04-07
Description: H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the ipqos_lanip_editlist interface at /goform/aspForm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted payload.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://hackmd.io/%400dayResearch/ipqos_lanip_editlist; https://hackmd.io/%400dayResearch/ipqos_lanip_editlist
CVE: CVE-2023-27876
Published: 2023-04-07
Description: IBM TRIRIGA 4.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.  IBM X-Force ID:  249975.
CVSS Score: 7.1 (HIGH)
CWE: CWE-611
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/249975; https://www.ibm.com/support/pages/node/6981115; https://exchange.xforce.ibmcloud.com/vulnerabilities/249975
CVE: CVE-2023-28706
Published: 2023-04-07
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Software Foundation Apache Airflow Hive Provider.This issue affects Apache Airflow Hive Provider: before 6.0.0.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: http://www.openwall.com/lists/oss-security/2023/04/07/2; https://github.com/apache/airflow/pull/30212; https://lists.apache.org/thread/dl20xxd51xvlx0zzc0wzgxfjwgtbbxo3
CVE: CVE-2023-28707
Published: 2023-04-07
Description: Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider.This issue affects Apache Airflow Drill Provider: before 2.3.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.openwall.com/lists/oss-security/2023/04/07/1; https://github.com/apache/airflow/pull/30215; https://lists.apache.org/thread/dfoj7q1nd0vhhsl8fjg63z4j6mfmdxtk
CVE: CVE-2023-28710
Published: 2023-04-07
Description: Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Spark Provider.This issue affects Apache Airflow Spark Provider: before 4.0.1.


CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.openwall.com/lists/oss-security/2023/04/07/3; https://github.com/apache/airflow/pull/30223; https://lists.apache.org/thread/lb9w9114ow00h2nkn8bjm106v5x1p1d2
CVE: CVE-2023-28781
Published: 2023-04-07
Description: Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Cimatti Consulting WordPress Contact Forms by Cimatti plugin <= 1.5.4 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/contact-forms/wordpress-contact-forms-by-cimatti-plugin-1-5-4-unauth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/contact-forms/wordpress-contact-forms-by-cimatti-plugin-1-5-4-unauth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-28789
Published: 2023-04-07
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Cimatti Consulting WordPress Contact Forms by Cimatti plugin <= 1.5.4 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/contact-forms/wordpress-contact-forms-by-cimatti-plugin-1-5-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/contact-forms/wordpress-contact-forms-by-cimatti-plugin-1-5-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-28792
Published: 2023-04-07
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Continuous Image Carousel With Lightbox plugin <= 1.0.15 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/continuous-image-carousel-with-lightbox/wordpress-continuous-image-carousel-with-lightbox-plugin-1-0-15-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/continuous-image-carousel-with-lightbox/wordpress-continuous-image-carousel-with-lightbox-plugin-1-0-15-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-29170
Published: 2023-04-07
Description: Auth. (admin+) Stored Cross-site Scripting (XSS) vulnerability in PI Websolution Product Enquiry for WooCommerce, WooCommerce product catalog plugin <= 2.2.12 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/enquiry-quotation-for-woocommerce/wordpress-product-enquiry-for-woocommerce-plugin-2-2-12-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/enquiry-quotation-for-woocommerce/wordpress-product-enquiry-for-woocommerce-plugin-2-2-12-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-29171
Published: 2023-04-07
Description: Unauth. Reflected Cross-site Scripting (XSS) vulnerability in Magic Post Thumbnail plugin <= 4.1.10 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/magic-post-thumbnail/wordpress-magic-post-thumbnail-plugin-4-1-10-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/magic-post-thumbnail/wordpress-magic-post-thumbnail-plugin-4-1-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-29172
Published: 2023-04-07
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in PropertyHive plugin <= 1.5.46 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/propertyhive/wordpress-propertyhive-plugin-1-5-46-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/propertyhive/wordpress-propertyhive-plugin-1-5-46-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-29388
Published: 2023-04-07
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in impleCode Product Catalog Simple plugin <= 1.6.17 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/post-type-x/wordpress-product-catalog-simple-plugin-1-6-17-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/post-type-x/wordpress-product-catalog-simple-plugin-1-6-17-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-1909
Published: 2023-04-07
Description: A vulnerability, which was classified as critical, was found in PHPGurukul BP Monitoring Management System 1.0. Affected is an unknown function of the file profile.php of the component User Profile Update Handler. The manipulation of the argument name/mobno leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-225318 is the identifier assigned to this vulnerability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://github.com/vsdwef/BP-Monitoring-Management-System/blob/main/report_English.pdf; https://vuldb.com/?ctiid.225318; https://vuldb.com/?id.225318
CVE: CVE-2023-1940
Published: 2023-04-07
Description: A vulnerability classified as critical was found in SourceCodester Simple and Beautiful Shopping Cart System 1.0. This vulnerability affects unknown code of the file delete_user_query.php. The manipulation of the argument user_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-225316.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/anchnet-security/Mkshope/blob/main/simple%20and%20beautiful%20shopping%20cart%20system%20delete_user_query.php%20has%20Sqlinjection.pdf; https://vuldb.com/?ctiid.225316; https://vuldb.com/?id.225316