deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-24195
Published: 2023-02-06
Description: Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the page parameter in index.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/xiumulty/CVE/blob/main/Online%20Food%20Ordering%20System%20v2/xss%20in%20index.php.md; https://www.sourcecodester.com/php/16022/online-food-ordering-system-v2-using-php8-and-mysql-free-source-code.html; https://github.com/xiumulty/CVE/blob/main/Online%20Food%20Ordering%20System%20v2/xss%20in%20index.php.md
CVE: CVE-2023-24197
Published: 2023-02-06
Description: Online Food Ordering System v2 was discovered to contain a SQL injection vulnerability via the id parameter at view_order.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/xiumulty/CVE/blob/main/Online%20Food%20Ordering%20System%20v2/sql%20in%20view_order.php.md; https://www.sourcecodester.com/php/16022/online-food-ordering-system-v2-using-php8-and-mysql-free-source-code.html; https://github.com/xiumulty/CVE/blob/main/Online%20Food%20Ordering%20System%20v2/sql%20in%20view_order.php.md
CVE: CVE-2023-24198
Published: 2023-02-06
Description: Raffle Draw System v1.0 was discovered to contain multiple SQL injection vulnerabilities at save_winner.php via the ticket_id and draw parameters.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/xiumulty/CVE/blob/main/Raffle%20draw%20system%20v1.0/sql%20in%20save_winner.md; https://www.sourcecodester.com/php/15951/raffle-draw-system-using-php-and-javascript-free-source-code.html; https://github.com/xiumulty/CVE/blob/main/Raffle%20draw%20system%20v1.0/sql%20in%20save_winner.md
CVE: CVE-2023-24199
Published: 2023-02-06
Description: Raffle Draw System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at delete_ticket.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/xiumulty/CVE/blob/main/Raffle%20draw%20system%20v1.0/sql%20in%20delete_ticket.php.md; https://www.sourcecodester.com/php/15951/raffle-draw-system-using-php-and-javascript-free-source-code.html; https://github.com/xiumulty/CVE/blob/main/Raffle%20draw%20system%20v1.0/sql%20in%20delete_ticket.php.md
CVE: CVE-2023-24200
Published: 2023-02-06
Description: Raffle Draw System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at save_ticket.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/xiumulty/CVE/blob/main/Raffle%20draw%20system%20v1.0/sql%20in%20save_ticket.php.md; https://www.sourcecodester.com/php/15951/raffle-draw-system-using-php-and-javascript-free-source-code.html; https://github.com/xiumulty/CVE/blob/main/Raffle%20draw%20system%20v1.0/sql%20in%20save_ticket.php.md
CVE: CVE-2023-24201
Published: 2023-02-06
Description: Raffle Draw System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at get_ticket.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-789
References: https://github.com/xiumulty/CVE/blob/main/Raffle%20draw%20system%20v1.0/sql%20in%20get_ticket.php.md; https://www.sourcecodester.com/php/15951/raffle-draw-system-using-php-and-javascript-free-source-code.html; https://github.com/xiumulty/CVE/blob/main/Raffle%20draw%20system%20v1.0/sql%20in%20get_ticket.php.md
CVE: CVE-2023-24202
Published: 2023-02-06
Description: Raffle Draw System v1.0 was discovered to contain a local file inclusion vulnerability via the page parameter in index.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/xiumulty/CVE/blob/main/Raffle%20draw%20system%20v1.0/lfi%20in%20index.php.md; https://www.sourcecodester.com/php/15951/raffle-draw-system-using-php-and-javascript-free-source-code.html; https://github.com/xiumulty/CVE/blob/main/Raffle%20draw%20system%20v1.0/lfi%20in%20index.php.md
CVE: CVE-2023-24276
Published: 2023-02-06
Description: TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the country parameter at setting/delStaticDhcpRules.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/Am1ngl/ttt/tree/main/18; https://github.com/Am1ngl/ttt/tree/main/18
CVE: CVE-2022-48078
Published: 2023-02-06
Description: pycdc commit 44a730f3a889503014fec94ae6e62d8401cb75e5 was discovered to contain a stack overflow via the component ASTree.cpp:BuildFromCode.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/zrax/pycdc/issues/295; https://github.com/zrax/pycdc/issues/295
CVE: CVE-2020-36660
Published: 2023-02-06
Description: A vulnerability was found in paxswill EVE Ship Replacement Program 0.12.11. It has been rated as problematic. This issue affects some unknown processing of the file src/evesrp/views/api.py of the component User Information Handler. The manipulation leads to information disclosure. The attack may be initiated remotely. Upgrading to version 0.12.12 is able to address this issue. The patch is named 9e03f68e46e85ca9c9694a6971859b3ee66f0240. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220211.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/paxswill/evesrp/commit/9e03f68e46e85ca9c9694a6971859b3ee66f0240; https://github.com/paxswill/evesrp/releases/tag/v0.12.12; https://vuldb.com/?ctiid.220211
CVE: CVE-2022-47071
Published: 2023-02-06
Description: In NVS365 V01, the background network test function can trigger command execution.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/Sylon001/NVS-365-Camera/tree/master/NVS-365-V01%20camera%20command%20execution; https://github.com/Sylon001/NVS365/tree/main/NVS-365-V01%E6%91%84%E5%83%8F%E5%A4%B4%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C; https://github.com/Sylon001/NVS-365-Camera/tree/master/NVS-365-V01%20camera%20command%20execution
CVE: CVE-2022-2933
Published: 2023-02-06
Description: The 0mk Shortener plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.2. This is due to missing or incorrect nonce validation on the zeromk_options_page function. This makes it possible for unauthenticated attackers to inject malicious web scripts via the 'zeromk_user' and 'zeromk_apikluc' parameters through a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/0mk-shortener/trunk/0mk.php#L28; https://www.wordfence.com/threat-intel/vulnerabilities/id/3b798c64-3434-427d-b578-5abbdac8cd0e?source=cve; https://plugins.trac.wordpress.org/browser/0mk-shortener/trunk/0mk.php#L28
CVE: CVE-2022-38136
Published: 2023-02-06
Description: Uncontrolled search path in the Intel(R) oneAPI DPC++/C++ Compiler for Windows and Intel Fortran Compiler for Windows before version 2022.2.1 for some Intel(R) oneAPI Toolkits before version 2022.3.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00773.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00773.html
CVE: CVE-2022-40196
Published: 2023-02-06
Description: Improper access control in the Intel(R) oneAPI DPC++/C++ Compiler before version 2022.2.1 and Intel C++ Compiler Classic before version 2021.7.1 for some Intel(R) oneAPI Toolkits before version 2022.3.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00773.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00773.html
CVE: CVE-2022-41342
Published: 2023-02-06
Description: Improper buffer restrictions in the Intel(R) C++ Compiler Classic before version 2021.7.1 for some Intel(R) oneAPI Toolkits before version 2022.3.1 may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-119
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00773.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00773.html
CVE: CVE-2022-4902
Published: 2023-02-06
Description: A vulnerability classified as problematic has been found in eXo Chat Application. Affected is an unknown function of the file application/src/main/webapp/vue-app/components/ExoChatMessageComposer.vue of the component Mention Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 3.3.0-20220417 is able to address this issue. The name of the patch is 26bf307d3658d1403cfd5c3ad423ce4c4d1cb2dc. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-220212.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://community.exoplatform.com/portal/dw/tasks/taskDetail/56304; https://github.com/exoplatform/chat-application/commit/26bf307d3658d1403cfd5c3ad423ce4c4d1cb2dc; https://github.com/exoplatform/chat-application/pull/485
CVE: CVE-2023-0687
Published: 2023-02-06
Description: A vulnerability was found in GNU C Library 2.38. It has been declared as critical. This vulnerability affects the function __monstartup of the file gmon.c of the component Call Graph Monitor. The manipulation leads to buffer overflow. It is recommended to apply a patch to fix this issue. VDB-220246 is the identifier assigned to this vulnerability. NOTE: The real existence of this vulnerability is still doubted at the moment. The inputs that induce this vulnerability are basically addresses of the running application that is built with gmon enabled. It's basically trusted input or input that needs an actual security flaw to be compromised or controlled.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-120
References: https://patchwork.sourceware.org/project/glibc/patch/[PII_REDACTED]4138.5436-1-leo%40yuriev.ru/; https://sourceware.org/bugzilla/show_bug.cgi?id=29444; https://vuldb.com/?ctiid.220246
CVE: CVE-2015-10073
Published: 2023-02-06
Description: A vulnerability, which was classified as problematic, was found in tinymighty WikiSEO 1.2.1 on MediaWiki. This affects the function modifyHTML of the file WikiSEO.body.php of the component Meta Property Tag Handler. The manipulation of the argument content leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.2.2 is able to address this issue. The patch is named 089a5797be612b18a820f9f1e6593ad9a91b1dba. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220215.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/tinymighty/wiki-seo/commit/089a5797be612b18a820f9f1e6593ad9a91b1dba; https://github.com/tinymighty/wiki-seo/pull/21; https://github.com/tinymighty/wiki-seo/releases/tag/1.2.2
CVE: CVE-2017-20177
Published: 2023-02-06
Description: A vulnerability, which was classified as problematic, has been found in WangGuard Plugin 1.8.0 on WordPress. Affected by this issue is the function wangguard_users_info of the file wangguard-user-info.php of the component WGG User List Handler. The manipulation of the argument userIP leads to cross site scripting. The attack may be launched remotely. The patch is identified as 88414951e30773c8d2ec13b[PII_REDACTED]4bf3189. It is recommended to apply a patch to fix this issue. VDB-220214 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/joseconti/WangGuard/commit/88414951e30773c8d2ec13b[PII_REDACTED]4bf3189; https://github.com/joseconti/WangGuard/pull/14; https://vuldb.com/?ctiid.220214
CVE: CVE-2022-32595
Published: 2023-02-06
Description: In widevine, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07446236; Issue ID: ALPS07446236.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://corp.mediatek.com/product-security-bulletin/December-2022; https://corp.mediatek.com/product-security-bulletin/December-2022
CVE: CVE-2022-32642
Published: 2023-02-06
Description: In ccd, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07326547; Issue ID: ALPS07326547.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-662, CWE-662
References: https://corp.mediatek.com/product-security-bulletin/February-2023; https://corp.mediatek.com/product-security-bulletin/February-2023
CVE: CVE-2022-32643
Published: 2023-02-06
Description: In ccd, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07341261; Issue ID: ALPS07341261.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-662, CWE-662
References: https://corp.mediatek.com/product-security-bulletin/February-2023; https://corp.mediatek.com/product-security-bulletin/February-2023
CVE: CVE-2022-32654
Published: 2023-02-06
Description: In Wi-Fi driver, there is a possible undefined behavior due to incorrect error handling. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: GN[PII_REDACTED]1; Issue ID: GN[PII_REDACTED]1.
CVSS Score: 6.7 (MEDIUM)
References: https://corp.mediatek.com/product-security-bulletin/February-2023; https://corp.mediatek.com/product-security-bulletin/February-2023
CVE: CVE-2022-32655
Published: 2023-02-06
Description: In Wi-Fi driver, there is a possible undefined behavior due to incorrect error handling. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: GN[PII_REDACTED]8; Issue ID: GN[PII_REDACTED]8.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-755, CWE-755
References: https://corp.mediatek.com/product-security-bulletin/February-2023; https://corp.mediatek.com/product-security-bulletin/February-2023
CVE: CVE-2022-32656
Published: 2023-02-06
Description: In Wi-Fi driver, there is a possible undefined behavior due to incorrect error handling. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: GN[PII_REDACTED]5; Issue ID: GN[PII_REDACTED]5.
CVSS Score: 6.7 (MEDIUM)
References: https://corp.mediatek.com/product-security-bulletin/February-2023; https://corp.mediatek.com/product-security-bulletin/February-2023
CVE: CVE-2022-32663
Published: 2023-02-06
Description: In Wi-Fi driver, there is a possible system crash due to null pointer dereference. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: GN[PII_REDACTED]4; Issue ID: GN[PII_REDACTED]4.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://corp.mediatek.com/product-security-bulletin/February-2023; https://corp.mediatek.com/product-security-bulletin/February-2023
CVE: CVE-2022-4321
Published: 2023-02-06
Description: The PDF Generator for WordPress plugin before 1.1.2 includes a vendored dompdf example file which is susceptible to Reflected Cross-Site Scripting and could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/6ac1259c-86d9-428b-ba98-7f3d07910644; https://wpscan.com/vulnerability/6ac1259c-86d9-428b-ba98-7f3d07910644
CVE: CVE-2022-4384
Published: 2023-02-06
Description: The Stream WordPress plugin before 3.9.2 does not prevent users with little privileges on the site (like subscribers) from using its alert creation functionality, which may enable them to leak sensitive information.
CVSS Score: 6.5 (MEDIUM)
References: https://wpscan.com/vulnerability/2b506252-6f37-439e-8984-7316d5cca2e5; https://wpscan.com/vulnerability/2b506252-6f37-439e-8984-7316d5cca2e5
CVE: CVE-2022-4459
Published: 2023-02-06
Description: The WP Show Posts WordPress plugin before 1.1.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/3ef4783b-4e4a-4691-b858-a7fa8dada4ec; https://wpscan.com/vulnerability/3ef4783b-4e4a-4691-b858-a7fa8dada4ec
CVE: CVE-2022-4489
Published: 2023-02-06
Description: The HUSKY WordPress plugin before 1.3.2 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
CVSS Score: 7.2 (HIGH)
References: https://wpscan.com/vulnerability/067573f2-b1e6-49a9-8c5b-f91e3b9d722f; https://wpscan.com/vulnerability/067573f2-b1e6-49a9-8c5b-f91e3b9d722f
CVE: CVE-2022-4577
Published: 2023-02-06
Description: The Easy Testimonials WordPress plugin before 3.9.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/85d9fad7-ba3d-4140-ae05-46262d2643e6; https://wpscan.com/vulnerability/85d9fad7-ba3d-4140-ae05-46262d2643e6
CVE: CVE-2022-4626
Published: 2023-02-06
Description: The PPWP WordPress plugin before 1.8.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/59c577e9-7d1c-46bc-9218-3e143068738d; https://wpscan.com/vulnerability/59c577e9-7d1c-46bc-9218-3e143068738d
CVE: CVE-2022-4657
Published: 2023-02-06
Description: The Restaurant Menu WordPress plugin before 2.3.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/a90a413d-0e00-4da8-a339-d6cdfba70bb3; https://wpscan.com/vulnerability/a90a413d-0e00-4da8-a339-d6cdfba70bb3
CVE: CVE-2022-4664
Published: 2023-02-06
Description: The Logo Slider WordPress plugin before 3.6.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/d6a9cfaa-d3fa-442e-a9a1-b06588723e39; https://wpscan.com/vulnerability/d6a9cfaa-d3fa-442e-a9a1-b06588723e39
CVE: CVE-2022-4670
Published: 2023-02-06
Description: The PDF.js Viewer WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/2a67c290-2a27-44fe-95ae-2d427e9d7548; https://wpscan.com/vulnerability/2a67c290-2a27-44fe-95ae-2d427e9d7548
CVE: CVE-2022-4674
Published: 2023-02-06
Description: The Ibtana WordPress plugin before 1.1.8.8 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/eda64678-81ae-4be3-941e-a1e26e54029b; https://wpscan.com/vulnerability/eda64678-81ae-4be3-941e-a1e26e54029b
CVE: CVE-2022-4677
Published: 2023-02-06
Description: The Leaflet Maps Marker WordPress plugin before 3.12.7 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/9c293098-de54-4a04-b13d-2a702200f02e; https://wpscan.com/vulnerability/9c293098-de54-4a04-b13d-2a702200f02e
CVE: CVE-2022-4681
Published: 2023-02-06
Description: The Hide My WP WordPress plugin before 6.2.9 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
CVSS Score: 9.8 (CRITICAL)
References: https://wpscan.com/vulnerability/5a4096e8-abe4-41c4-b741-c44e740e8689; https://wpscan.com/vulnerability/5a4096e8-abe4-41c4-b741-c44e740e8689
CVE: CVE-2022-4717
Published: 2023-02-06
Description: The Strong Testimonials WordPress plugin before 3.0.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/14b679f5-44a8-46d4-89dd-94eb647cb672; https://wpscan.com/vulnerability/14b679f5-44a8-46d4-89dd-94eb647cb672
CVE: CVE-2022-4747
Published: 2023-02-06
Description: The Post Category Image With Grid and Slider WordPress plugin before 1.4.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/004f1872-1576-447f-8837-f29fa319cbdc; https://wpscan.com/vulnerability/004f1872-1576-447f-8837-f29fa319cbdc
CVE: CVE-2022-4756
Published: 2023-02-06
Description: The My YouTube Channel WordPress plugin before 3.23.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/d67b0f7a-fdb1-4305-9976-c5f77b0e3b61; https://wpscan.com/vulnerability/d67b0f7a-fdb1-4305-9976-c5f77b0e3b61
CVE: CVE-2022-4762
Published: 2023-02-06
Description: The Materialis Companion WordPress plugin before 1.3.40 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/4500566a-e5f2-40b8-a185-2bcace221b4e; https://wpscan.com/vulnerability/4500566a-e5f2-40b8-a185-2bcace221b4e
CVE: CVE-2022-4824
Published: 2023-02-06
Description: The WP Blog and Widgets WordPress plugin before 2.3.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/9af8e425-c477-4e2b-9445-70ffb769f3f0; https://wpscan.com/vulnerability/9af8e425-c477-4e2b-9445-70ffb769f3f0