deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-46153
Published: 2023-10-27
Description: Unauth. Stored Cross-Site Scripting (XSS) vulnerability in UserFeedback Team User Feedback plugin <= 1.0.9 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/userfeedback-lite/wordpress-user-feedback-plugin-1-0-9-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/userfeedback-lite/wordpress-user-feedback-plugin-1-0-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-46192
Published: 2023-10-27
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Internet Marketing Ninjas Internal Link Building plugin <= 1.2.3 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/internal-link-building-plugin/wordpress-internal-link-building-plugin-1-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/internal-link-building-plugin/wordpress-internal-link-building-plugin-1-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-46194
Published: 2023-10-27
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Eric Teubert Archivist – Custom Archive Templates plugin <= 1.7.5 versions.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/archivist-custom-archive-templates/wordpress-archivist-custom-archive-templates-plugin-1-7-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/archivist-custom-archive-templates/wordpress-archivist-custom-archive-templates-plugin-1-7-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-46199
Published: 2023-10-27
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Triberr plugin <= 4.1.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/triberr-wordpress-plugin/wordpress-triberr-plugin-4-1-1-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/triberr-wordpress-plugin/wordpress-triberr-plugin-4-1-1-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-5774
Published: 2023-10-27
Description: The Animated Counters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/2984228/; https://research.cleantalk.org/cve-2023-5774-animated-counters-stored-xss-via-shortcode-author-poc/; https://www.wordfence.com/threat-intel/vulnerabilities/id/33c2756d-c300-479f-b3aa-8f22c3a70278?source=cve
CVE: CVE-2023-5817
Published: 2023-10-27
Description: The Neon text plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's neontext_box shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes (color). This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2984188%40neon-text&new=2984188%40neon-text&sfp_email=&sfph_mail=; https://research.cleantalk.org/cve-2023-5817-neon-text-1-1-stored-xss-via-shortcode-author/; https://www.wordfence.com/threat-intel/vulnerabilities/id/f9998485-e272-48fc-b2f1-9e30158d0d16?source=cve
CVE: CVE-2023-5570
Published: 2023-10-27
Description: Improper Protection for Outbound Error Messages and Alert Signals vulnerability in Inohom Home Manager Gateway allows Account Footprinting.This issue affects Home Manager Gateway: before v.1.27.12.


CVSS Score: 7.5 (HIGH)
CWE: CWE-1320, CWE-1320
References: https://www.usom.gov.tr/bildirim/tr-23-0609; https://www.usom.gov.tr/bildirim/tr-23-0609
CVE: CVE-2023-5705
Published: 2023-10-27
Description: The VK Filter Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vk_filter_search' shortcode in all versions up to, and including, 2.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/vk-filter-search/tags/2.3.1/inc/filter-search/package/class-vk-filter-search-shortcode.php#L40; https://plugins.trac.wordpress.org/changeset/2983339/vk-filter-search#file1; https://www.wordfence.com/threat-intel/vulnerabilities/id/012946d4-82ce-48b9-9b9a-1fc49846dca6?source=cve
CVE: CVE-2023-5820
Published: 2023-10-27
Description: The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing or incorrect nonce validation on the addedit functionality. This makes it possible for unauthenticated attackers to upload arbitrary files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=1263536%40wp-responsive-slider-with-lightbox&new=1263536%40wp-responsive-slider-with-lightbox&sfp_email=&sfph_mail=; https://wordpress.org/plugins/wp-responsive-slider-with-lightbox; https://www.wordfence.com/threat-intel/vulnerabilities/id/e51e1cd2-6de9-4820-8bba-1c6b5053e2c1?source=cve
CVE: CVE-2023-5821
Published: 2023-10-27
Description: The Thumbnail carousel slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing nonce validation on the deleteselected function. This makes it possible for unauthenticated attackers to delete sliders in bulk via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
References: https://plugins.trac.wordpress.org/changeset/1263536/wp-responsive-slider-with-lightbox/trunk/wp-responsive-slider-with-lightbox.php; https://wordpress.org/plugins/wp-responsive-thumbnail-slider; https://www.wordfence.com/threat-intel/vulnerabilities/id/bde75c5a-b0b7-4f26-91e9-dd4816e276c9?source=cve
CVE: CVE-2023-44376
Published: 2023-10-27
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-44377
Published: 2023-10-27
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-5807
Published: 2023-10-27
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TRtek Software Education Portal allows SQL Injection.This issue affects Education Portal: before 3.2023.29.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0608; https://www.usom.gov.tr/bildirim/tr-23-0608
CVE: CVE-2023-46393
Published: 2023-10-27
Description: gougucms v4.08.18 was discovered to contain a password reset poisoning vulnerability which allows attackers to arbitrarily reset users' passwords via a crafted packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-460
References: https://gitee.com/gouguopen/gougucms/issues/I88TKH; https://gitee.com/gouguopen/gougucms/issues/I88TKH
CVE: CVE-2023-46394
Published: 2023-10-27
Description: A stored cross-site scripting (XSS) vulnerability in /home/user/edit_submit of gougucms v4.08.18 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the headimgurl parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gitee.com/gouguopen/gougucms/issues/I88TC0; https://gitee.com/gouguopen/gougucms/issues/I88TC0
CVE: CVE-2023-5443
Published: 2023-10-27
Description: Improper Protection for Outbound Error Messages and Alert Signals vulnerability in EDM Informatics E-invoice allows Account Footprinting.This issue affects E-invoice: before 2.1.


CVSS Score: 7.5 (HIGH)
CWE: CWE-1320
References: https://www.usom.gov.tr/bildirim/tr-23-0610; https://www.usom.gov.tr/bildirim/tr-23-0610
CVE: CVE-2023-46604
Published: 2023-10-27
Description: The Java OpenWire protocol marshaller is vulnerable to Remote Code 
Execution. This vulnerability may allow a remote attacker with network 
access to either a Java-based OpenWire broker or client to run arbitrary
 shell commands by manipulating serialized class types in the OpenWire 
protocol to cause either the client or the broker (respectively) to 
instantiate any class on the classpath.

Users are recommended to upgrade
 both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 
which fixes this issue.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-502
References: http://seclists.org/fulldisclosure/2024/Apr/18; https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt; https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html
CVE: CVE-2023-5826
Published: 2023-10-27
Description: A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/list_onlineuser.php. The manipulation of the argument SessionId leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-243716. NOTE: We tried to contact the vendor early about the disclosure but the official mail address was not working properly.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/Cubi123123123/cve/blob/main/NS-ASG-sql-list_onlineuser.md; https://vuldb.com/?ctiid.243716; https://vuldb.com/?id.243716
CVE: CVE-2023-5827
Published: 2023-10-27
Description: A vulnerability was found in Shanghai CTI Navigation CTI Monitoring and Early Warning System 2.2. It has been classified as critical. This affects an unknown part of the file /Web/SysManage/UserEdit.aspx. The manipulation of the argument ID leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-243717 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/Ox1dq/cve/blob/main/rce.md; https://vuldb.com/?ctiid.243717; https://vuldb.com/?id.243717
CVE: CVE-2022-34886
Published: 2023-10-27
Description: A remote code execution vulnerability was found in the firmware used in some Lenovo printers, which can be caused by a remote user pushing an illegal string to the server-side interface via a script, resulting in a stack overflow.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120, CWE-787
References: https://iknow.lenovo.com.cn/detail/205041.html; https://iknow.lenovo.com.cn/detail/205041.html
CVE: CVE-2022-34887
Published: 2023-10-27
Description: Standard users can directly operate and set printer configuration information , such as IP, in some Lenovo Printers without having to authenticate with the administrator password.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: https://iknow.lenovo.com.cn/detail/205041.html; https://iknow.lenovo.com.cn/detail/205041.html
CVE: CVE-2022-3429
Published: 2023-10-27
Description: A denial-of-service vulnerability was found in the firmware used in Lenovo printers, where users send illegal or malformed strings to an open port, triggering a denial of service that causes a display error and prevents the printer from functioning properly.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://iknow.lenovo.com.cn/detail/205041.html; https://iknow.lenovo.com.cn/detail/205041.html
CVE: CVE-2023-27854
Published: 2023-10-27
Description: 
An arbitrary code execution vulnerability was reported to Rockwell Automation in Arena Simulation that could potentially allow a malicious user to commit unauthorized arbitrary code to the software by using a memory buffer overflow.  The threat-actor could then execute malicious code on the system affecting the confidentiality, integrity, and availability of the product.  The user would need to open a malicious file provided to them by the attacker for the code to execute.



CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1141145; https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1141145
CVE: CVE-2023-27858
Published: 2023-10-27
Description: 
Rockwell Automation Arena Simulation contains an arbitrary code execution vulnerability that could potentially allow a malicious user to commit unauthorized code to the software by using an uninitialized pointer in the application.  The threat-actor could then execute malicious code on the system affecting the confidentiality, integrity, and availability of the product.  The user would need to open a malicious file provided to them by the attacker for the code to execute.


CVSS Score: 7.8 (HIGH)
CWE: CWE-824, CWE-824
References: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1141145; https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1141145
CVE: CVE-2023-46246
Published: 2023-10-27
Description: Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free in memory allocated in the function `ga_grow_inner` in in the file `src/alloc.c` at line 748, which is freed in the file `src/ex_docmd.c` in the function `do_cmdline` at line 1010 and then used again in `src/cmdhist.c` at line 759. When using the `:history` command, it's possible that the provided argument overflows the accepted value. Causing an Integer Overflow and potentially later an use-after-free. This vulnerability has been patched in version 9.0.2068.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-190, CWE-416, CWE-190, CWE-416
References: https://github.com/vim/vim/commit/9198c1f2b1ddecde22af918541e0de2a32f0f45a; https://github.com/vim/vim/security/advisories/GHSA-q22m-h7m2-9mgm; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DNMFS3IH74KEMMESOA3EOB6MZ56TWGFF/
CVE: CVE-2023-46289
Published: 2023-10-27
Description: 
Rockwell Automation FactoryTalk View Site Edition insufficiently validates user input, which could potentially allow threat actors to send malicious data bringing the product offline. If exploited, the product would become unavailable and require a restart to recover resulting in a denial-of-service condition.


CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1141167; https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1141167
CVE: CVE-2023-46290
Published: 2023-10-27
Description: 
Due to inadequate code logic, a previously unauthenticated threat actor could potentially obtain a local Windows OS user token through the FactoryTalk® Services Platform web service and then use the token to log in into FactoryTalk® Services Platform . This vulnerability can only be exploited if the authorized user did not previously log in into the FactoryTalk® Services Platform web service.


CVSS Score: 8.1 (HIGH)
CWE: CWE-287, CWE-287
References: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1141165; https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1141165
CVE: CVE-2023-4967
Published: 2023-10-27
Description: Denial of Service in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA Virtual Server
CVSS Score: 8.2 (HIGH)
CWE: CWE-119, CWE-119
References: https://support.citrix.com/article/CTX579459/; https://support.citrix.com/article/CTX579459/
CVE: CVE-2022-3611
Published: 2023-10-27
Description: An information disclosure vulnerability has been identified in the Lenovo App Store which may allow some applications to gain unauthorized access to sensitive user data used by other unrelated applications.
CVSS Score: 7.6 (HIGH)
CWE: CWE-200
References: https://iknow.lenovo.com.cn/detail/205280.html; https://iknow.lenovo.com.cn/detail/205280.html
CVE: CVE-2022-3681
Published: 2023-10-27
Description: A vulnerability has been identified in the MR2600 router v1.0.18 and earlier that could allow an attacker within range of the wireless network to successfully brute force the WPS pin, potentially allowing them unauthorized access to a wireless network.
 
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://web.archive.org/web/[PII_REDACTED]4952/https://help.motorolanetwork.com/hc/en-us/articles/[PII_REDACTED]523; https://web.archive.org/web/[PII_REDACTED]4952/https://help.motorolanetwork.com/hc/en-us/articles/[PII_REDACTED]523
CVE: CVE-2022-3700
Published: 2023-10-27
Description: A Time of Check Time of Use (TOCTOU) vulnerability was reported in the Lenovo Vantage SystemUpdate Plugin version 2.0.0.212 and earlier that could allow a local attacker to delete arbitrary files.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-367
References: https://support.lenovo.com/us/en/product_security/LEN-94532; https://support.lenovo.com/us/en/product_security/LEN-94532
CVE: CVE-2022-3701
Published: 2023-10-27
Description: 
A privilege elevation vulnerability was reported in the Lenovo Vantage SystemUpdate plugin version 2.0.0.212 and earlier that could allow a local attacker to execute arbitrary code with elevated privileges.


CVSS Score: 7.8 (HIGH)
CWE: CWE-367, CWE-269
References: https://support.lenovo.com/us/en/product_security/LEN-94532; https://support.lenovo.com/us/en/product_security/LEN-94532
CVE: CVE-2022-3702
Published: 2023-10-27
Description: 
A denial of service vulnerability was reported in Lenovo Vantage HardwareScan Plugin version 1.3.0.5 and earlier that could allow a local attacker to delete contents of an arbitrary directory under certain conditions.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-367
References: https://support.lenovo.com/us/en/product_security/LEN-94532; https://support.lenovo.com/us/en/product_security/LEN-94532
CVE: CVE-2023-29009
Published: 2023-10-27
Description: baserCMS is a website development framework with WebAPI that runs on PHP8 and CakePHP4. There is a XSS Vulnerability in Favorites Feature to baserCMS. This issue has been patched in version 4.8.0.

CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://basercms.net/security/JVN_45547161; https://github.com/baserproject/basercms/releases/tag/basercms-4.8.0; https://github.com/baserproject/basercms/security/advisories/GHSA-8vqx-prq4-rqrq
CVE: CVE-2023-46407
Published: 2023-10-27
Description: FFmpeg prior to commit bf814 was discovered to contain an out of bounds read via the dist->alphabet_size variable in the read_vlc_prefix() function.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/FFmpeg/FFmpeg/commit/bf814387f42e9b0dea9d75c03db4723c88e7d962; https://patchwork.ffmpeg.org/project/ffmpeg/patch/[PII_REDACTED]4959.536776-1-leo.izen%40gmail.com/; https://patchwork.ffmpeg.org/project/ffmpeg/patch/[PII_REDACTED]4924.597746-1-leo.izen%40gmail.com/
CVE: CVE-2023-46852
Published: 2023-10-27
Description: In Memcached before 1.6.22, a buffer overflow exists when processing multiget requests in proxy mode, if there are many spaces after the "get" substring.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://github.com/memcached/memcached/commit/76a6c363c18cfe7b6a1524ae64202ac9db330767; https://github.com/memcached/memcached/compare/1.6.21...1.6.22; https://github.com/memcached/memcached/commit/76a6c363c18cfe7b6a1524ae64202ac9db330767
CVE: CVE-2023-46853
Published: 2023-10-27
Description: In Memcached before 1.6.22, an off-by-one error exists when processing proxy requests in proxy mode, if \n is used instead of \r\n.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-193
References: https://github.com/memcached/memcached/commit/6987918e9a3094ec4fc8976f01f769f624d790fa; https://github.com/memcached/memcached/compare/1.6.21...1.6.22; https://github.com/memcached/memcached/commit/6987918e9a3094ec4fc8976f01f769f624d790fa
CVE: CVE-2023-5828
Published: 2023-10-27
Description: A vulnerability was found in Nanning Ontall Longxing Industrial Development Zone Project Construction and Installation Management System up to 20231026. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file login.aspx. The manipulation of the argument tbxUserName leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-243727.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/Echosssy/-SQL-injection/blob/main/%E5%8D%97%E5%AE%81%E5%B8%82%E5%AE%89%E6%8B%93%E8%BD%AF%E4%BB%B6%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8SQL%20injection.doc; https://vuldb.com/?ctiid.243727; https://vuldb.com/?id.243727
CVE: CVE-2023-5829
Published: 2023-10-27
Description: A vulnerability was found in code-projects Admission Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file student_avatar.php. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-243728.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/lxxcute/Bug/blob/main/Admission%20Management%20System%20has%20a%20file%20upload%20(RCE)%20vulnerability.pdf; https://vuldb.com/?ctiid.243728; https://vuldb.com/?id.243728
CVE: CVE-2022-34832
Published: 2023-10-27
Description: An issue was discovered in VERMEG AgileReporter 21.3. XXE can occur via an XML document to the Analysis component.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611
References: https://crashpark.weebly.com/blog/xxe-in-agilereporter-213-by-vermeg; https://www.vermeg.com/agile-reporter/; https://crashpark.weebly.com/blog/xxe-in-agilereporter-213-by-vermeg
CVE: CVE-2022-34833
Published: 2023-10-27
Description: An issue was discovered in VERMEG AgileReporter 21.3. An admin can enter an XSS payload in the Analysis component.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://crashpark.weebly.com/blog/1-stored-xss-in-agilereporter-213-by-vermeg; https://www.vermeg.com/agile-reporter/; https://crashpark.weebly.com/blog/1-stored-xss-in-agilereporter-213-by-vermeg
CVE: CVE-2022-34834
Published: 2023-10-27
Description: An issue was discovered in VERMEG AgileReporter 21.3. Attackers can gain privileges via an XSS payload in an Add Comment action to the Activity log.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://crashpark.weebly.com/blog/2-stored-xss-in-agilereporter-213-by-vermeg; https://www.vermeg.com/agile-reporter/; https://crashpark.weebly.com/blog/2-stored-xss-in-agilereporter-213-by-vermeg
CVE: CVE-2023-32738
Published: 2023-10-27
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alkaweb Eonet Manual User Approve plugin <= 2.1.3 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/eonet-manual-user-approve/wordpress-eonet-manual-user-approve-plugin-2-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/eonet-manual-user-approve/wordpress-eonet-manual-user-approve-plugin-2-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve