deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-28995
Published: 2023-07-10
Description: Cross-Site Request Forgery (CSRF) vulnerability in Keith Solomon Configurable Tag Cloud (CTC) plugin <= 5.2 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/configurable-tag-cloud-widget/wordpress-configurable-tag-cloud-plugin-5-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/configurable-tag-cloud-widget/wordpress-configurable-tag-cloud-plugin-5-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-29095
Published: 2023-07-10
Description: Auth. (admin+) SQL Injection (SQLi) vulnerability in David F. Carr RSVPMaker plugin < 10.5.5 versions.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89, CWE-89
References: https://patchstack.com/database/vulnerability/rsvpmaker/wordpress-rsvpmaker-plugin-10-5-3-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/rsvpmaker/wordpress-rsvpmaker-plugin-10-5-3-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2023-29256
Published: 2023-07-10
Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to an information disclosure due to improper privilege management when certain federation features are used.  IBM X-Force ID:  252046.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-269
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/252046; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/7010573
CVE: CVE-2023-2026
Published: 2023-07-10
Description: The Image Protector WordPress plugin through 1.1 does not properly sanitize some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/2b59f640-5568-42bb-87b7-36eb448db5be; https://wpscan.com/vulnerability/2b59f640-5568-42bb-87b7-36eb448db5be
CVE: CVE-2023-2028
Published: 2023-07-10
Description: The Call Now Accessibility Button WordPress plugin before 1.1 does not properly sanitize some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/0f1c1f1c-acdd-4c8a-bd5e-a21f4915e69f; https://wpscan.com/vulnerability/0f1c1f1c-acdd-4c8a-bd5e-a21f4915e69f
CVE: CVE-2023-2029
Published: 2023-07-10
Description: The PrePost SEO WordPress plugin through 3.0 does not properly sanitize some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
References: http://packetstormsecurity.com/files/173729/WordPress-PrePost-SEO-3.0-Cross-Site-Scripting.html; https://wpscan.com/vulnerability/4889ad5a-c8c4-4958-b[PII_REDACTED]0497b; http://packetstormsecurity.com/files/173729/WordPress-PrePost-SEO-3.0-Cross-Site-Scripting.html
CVE: CVE-2023-2046
Published: 2023-07-10
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yontem Informatics Vehicle Tracking System allows SQL Injection.This issue affects Vehicle Tracking System: before 8.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0389; https://www.usom.gov.tr/bildirim/tr-23-0389
CVE: CVE-2023-2234
Published: 2023-07-10
Description: Union variant confusion allows any malicious BT controller to execute arbitrary code on the Zephyr host.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-843, CWE-843
References: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fx9g-8fr2-q899; https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fx9g-8fr2-q899
CVE: CVE-2023-2493
Published: 2023-07-10
Description: The All In One Redirection WordPress plugin before 2.2.0 does not properly sanitise and escape multiple parameters before using them in an SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
CVSS Score: 7.2 (HIGH)
References: https://wpscan.com/vulnerability/a9a205a4-eef9-4f30-877a-4c562930650c; https://wpscan.com/vulnerability/a9a205a4-eef9-4f30-877a-4c562930650c
CVE: CVE-2023-2495
Published: 2023-07-10
Description: The Greeklish-permalink WordPress plugin through 3.3 does not implement correct authorization or nonce checks in the cyrtrans_ajax_old AJAX action, allowing unauthenticated and low-privilege users to trigger the plugin's functionality to change Post slugs either directly or through CSRF.
CVSS Score: 4.3 (MEDIUM)
References: https://wpscan.com/vulnerability/45878983-7e9b-49c2-8f99-4c28aab24f09; https://wpscan.com/vulnerability/45878983-7e9b-49c2-8f99-4c28aab24f09
CVE: CVE-2023-2529
Published: 2023-07-10
Description: The Enable SVG Uploads WordPress plugin through 2.1.5 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/4ac03907-2373-48f0-bca1-8f7073c06b18; https://wpscan.com/vulnerability/4ac03907-2373-48f0-bca1-8f7073c06b18
CVE: CVE-2023-2578
Published: 2023-07-10
Description: The Buy Me a Coffee WordPress plugin before 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/4dad1c0d-bcf9-4486-bd8e-387ac8e6c892; https://wpscan.com/vulnerability/4dad1c0d-bcf9-4486-bd8e-387ac8e6c892
CVE: CVE-2023-2635
Published: 2023-07-10
Description: The Call Now Accessibility Button WordPress plugin before 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/81b89613-18d0-4c13-84e3-9e2e1802fd7c; https://wpscan.com/vulnerability/81b89613-18d0-4c13-84e3-9e2e1802fd7c
CVE: CVE-2023-2709
Published: 2023-07-10
Description: The AN_GradeBook WordPress plugin through 5.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/2504dadb-1086-4fa9-8fc7-b[PII_REDACTED]5; https://wpscan.com/vulnerability/2504dadb-1086-4fa9-8fc7-b[PII_REDACTED]5
CVE: CVE-2023-2796
Published: 2023-07-10
Description: The EventON WordPress plugin before 2.1.2 lacks authentication and authorization in its eventon_ics_download ajax action, allowing unauthenticated visitors to access private and password protected Events by guessing their numeric id.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: http://packetstormsecurity.com/files/173984/WordPress-EventON-Calendar-4.4-Insecure-Direct-Object-Reference.html; https://wpscan.com/vulnerability/e9ef793c-e5a3-4c55-beee-56b0909f7a0d; http://packetstormsecurity.com/files/173984/WordPress-EventON-Calendar-4.4-Insecure-Direct-Object-Reference.html
CVE: CVE-2023-2852
Published: 2023-07-10
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Softmed SelfPatron allows SQL Injection.This issue affects SelfPatron : before 2.0.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0388; https://www.usom.gov.tr/bildirim/tr-23-0388
CVE: CVE-2023-2853
Published: 2023-07-10
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Softmed SelfPatron allows Reflected XSS.This issue affects SelfPatron : before 2.0.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.usom.gov.tr/bildirim/tr-23-0388; https://www.usom.gov.tr/bildirim/tr-23-0388
CVE: CVE-2023-2964
Published: 2023-07-10
Description: The Simple Iframe WordPress plugin before 1.2.0 does not properly validate one of its WordPress block attribute's content, which may allow users whose role is at least that of a contributor to conduct Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/97aac334-5323-41bb-90f0-d180bcc9162f; https://wpscan.com/vulnerability/97aac334-5323-41bb-90f0-d180bcc9162f
CVE: CVE-2023-2967
Published: 2023-07-10
Description: The TinyMCE Custom Styles WordPress plugin before 1.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/9afec4aa-1210-4c40-b566-64e37acf2b64; https://wpscan.com/vulnerability/9afec4aa-1210-4c40-b566-64e37acf2b64
CVE: CVE-2023-30431
Published: 2023-07-10
Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 db2set is vulnerable to a buffer overflow, caused by improper bounds checking.  An attacker could overflow the buffer and execute arbitrary code.  IBM X-Force ID:  252184.
CVSS Score: 8.4 (HIGH)
CWE: CWE-119, CWE-119
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/252184; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/7010565
CVE: CVE-2023-30442
Published: 2023-07-10
Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 federated server is vulnerable to a denial of service as the server may crash when using a specially crafted wrapper using certain options.  IBM X-Force ID:  253202.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/253202; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/7010561
CVE: CVE-2023-30445
Published: 2023-07-10
Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on certain tables.  IBM X-Force ID:  253357.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/253357; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/7010557
CVE: CVE-2023-30446
Published: 2023-07-10
Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on certain tables.  IBM X-Force ID:  

253361

.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/253361; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/7010557
CVE: CVE-2023-30447
Published: 2023-07-10
Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on certain tables.  IBM X-Force ID:  253436.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/253436; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/7010557
CVE: CVE-2023-30448
Published: 2023-07-10
Description: IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on certain tables.  IBM X-Force ID:  253437.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/253437; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/7010557
CVE: CVE-2023-30449
Published: 2023-07-10
Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query.  IBM X-Force ID:  253439.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/253439; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/7010557
CVE: CVE-2023-32250
Published: 2023-07-10
Description: A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_SESSION_SETUP commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-362, CWE-362
References: https://access.redhat.com/security/cve/CVE-2023-32250; https://bugzilla.redhat.com/show_bug.cgi?id=2208849; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-32254
Published: 2023-07-10
Description: A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_TREE_DISCONNECT commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-362, CWE-362
References: https://access.redhat.com/security/cve/CVE-2023-32254; https://bugzilla.redhat.com/show_bug.cgi?id=2191658; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-34442
Published: 2023-07-10
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Camel.This issue affects Apache Camel: from 3.X through <=3.14.8, from 3.18.X through <=3.18.7, from 3.20.X through <= 3.20.5, from 4.X through <= 4.0.0-M3.

Users should upgrade to 3.14.9, 3.18.8, 3.20.6 or 3.21.0 and for users on Camel 4.x update to 4.0.0-M1

CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: https://lists.apache.org/thread/x4vy2hhbltb1xrvy1g6m8hpjgj2k7wgh; https://lists.apache.org/thread/x4vy2hhbltb1xrvy1g6m8hpjgj2k7wgh
CVE: CVE-2023-34682
Published: 2023-07-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-35696
Published: 2023-07-10
Description: 
Unauthenticated endpoints in the SICK ICR890-4 could allow an unauthenticated
remote attacker to retrieve sensitive information about the device via HTTP requests.


CVSS Score: 7.5 (HIGH)
CWE: CWE-668, CWE-668
References: https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.json; https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf; https://sick.com/psirt
CVE: CVE-2023-35697
Published: 2023-07-10
Description: 
Improper Restriction of Excessive Authentication Attempts in the SICK ICR890-4
could allow a remote attacker to brute-force user credentials.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-307, CWE-307
References: https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.json; https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf; https://sick.com/psirt
CVE: CVE-2023-35698
Published: 2023-07-10
Description: 
Observable Response Discrepancy in the SICK ICR890-4 could allow a remote attacker to identify valid usernames for the FTP server from the response given during a failed login
attempt.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-204, CWE-203
References: https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.json; https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf; https://sick.com/psirt
CVE: CVE-2023-35699
Published: 2023-07-10
Description: 
Cleartext Storage on Disk in the SICK ICR890-4 could allow an unauthenticated attacker with local access to the device to disclose sensitive information by accessing a SD card.



CVSS Score: 5.3 (MEDIUM)
CWE: CWE-313, CWE-312
References: https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.json; https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf; https://sick.com/psirt
CVE: CVE-2023-35887
Published: 2023-07-10
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA.

In SFTP servers implemented using Apache MINA SSHD that use a RootedFileSystem, logged users may be able to discover "exists/does not exist" information about items outside the rooted tree via paths including parent navigation ("..") beyond the root, or involving symlinks.

This issue affects Apache MINA: from 1.0 before 2.10. Users are recommended to upgrade to 2.10

CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://lists.apache.org/thread/b9qgtqvhnvgfpn0w1gz918p21p53tqk2; https://lists.apache.org/thread/b9qgtqvhnvgfpn0w1gz918p21p53tqk2
CVE: CVE-2023-35912
Published: 2023-07-10
Description: Cross-Site Request Forgery (CSRF) vulnerability in WP Zone Potent Donations for WooCommerce plugin <= 1.1.9 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/donations-for-woocommerce/wordpress-potent-donations-for-woocommerce-plugin-1-1-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/donations-for-woocommerce/wordpress-potent-donations-for-woocommerce-plugin-1-1-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-36360
Published: 2023-07-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-36376
Published: 2023-07-10
Description: Cross-Site Scripting (XSS) vulnerability in Hostel Management System v.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the add course section.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40ridheshgohil1092/cve-2023-36376-xss-on-hostel-management-system-c[PII_REDACTED]; https://packetstormsecurity.com; https://medium.com/%40ridheshgohil1092/cve-2023-36376-xss-on-hostel-management-system-c[PII_REDACTED]
CVE: CVE-2023-36691
Published: 2023-07-10
Description: Cross-Site Request Forgery (CSRF) vulnerability in Albert Peschar WebwinkelKeur plugin <= 3.24 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/webwinkelkeur/wordpress-webwinkelkeu-plugin-3-24-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/webwinkelkeur/wordpress-webwinkelkeu-plugin-3-24-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-36935
Published: 2023-07-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-37150
Published: 2023-07-10
Description: Sourcecodester Online Pizza Ordering System v1.0 has a Cross-site scripting (XSS) vulnerability in "/admin/index.php?page=categories" Category item.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Trinity-SYT-SECURITY/XSS_vuln_issue/blob/main/Online%20Pizza%20Ordering%20System%20v1.0.md; https://www.chtsecurity.com/news/57fd2fe6-11d9-421d-9087-88b4d5090452; https://www.chtsecurity.com/news/c27389f3-a70b-4a71-952a-49f273d1db90
CVE: CVE-2023-37151
Published: 2023-07-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-2246. Reason: This candidate is a reservation duplicate of CVE-2023-2246. Notes: All CVE users should reference CVE-2023-2246 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2023-37152
Published: 2023-07-10
Description: Projectworlds Online Art Gallery Project 1.0 allows unauthenticated users to perform arbitrary file uploads via the adminHome.php page. Note: This has been disputed as not a valid vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/Trinity-SYT-SECURITY/arbitrary-file-upload-RCE/blob/main/Online%20Art%20gallery%20project%201.0.md; https://www.chtsecurity.com/news/ad3cee07-3e35-45c0-97f9-811cce13dda9; https://www.chtsecurity.com/news/afe25fb4-55ac-45d9-9ece-cbc1edda2fb2%20
CVE: CVE-2023-37153
Published: 2023-07-10
Description: KodExplorer 4.51 contains a Cross-Site Scripting (XSS) vulnerability in the Description box of the Light App creation feature. An attacker can exploit this vulnerability by injecting XSS syntax into the Description field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Trinity-SYT-SECURITY/XSS_vuln_issue/blob/main/KodExplorer4.51.03.md; https://github.com/kalcaddle/KodExplorer; https://www.chtsecurity.com/news/13a86b33-7e49-4167-9682-7ff3f51cbcba%20
CVE: CVE-2023-37392
Published: 2023-07-10
Description: Cross-Site Request Forgery (CSRF) vulnerability in Deepak Anand WP Dummy Content Generator plugin <= 2.3.0 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-dummy-content-generator/wordpress-wp-dummy-content-generator-plugin-2-3-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-dummy-content-generator/wordpress-wp-dummy-content-generator-plugin-2-3-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-3045
Published: 2023-07-10
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tise Technology Parking Web Report allows SQL Injection.This issue affects Parking Web Report: before 2.1.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0387; https://www.usom.gov.tr/bildirim/tr-23-0387
CVE: CVE-2023-3076
Published: 2023-07-10
Description: The MStore API WordPress plugin before 3.9.9 does not prevent visitors from creating user accounts with the role of their choice via their wholesale REST API endpoint. This is only exploitable if the site owner paid to access the plugin's pro features.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://wpscan.com/vulnerability/ac662436-29d7-4ea6-84e1-f9e229b44f5b; https://wpscan.com/vulnerability/ac662436-29d7-4ea6-84e1-f9e229b44f5b
CVE: CVE-2023-3077
Published: 2023-07-10
Description: The MStore API WordPress plugin before 3.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to a Blind SQL injection exploitable by unauthenticated users. This is only exploitable if the site owner elected to pay to get access to the plugins' pro features, and uses the woocommerce-appointments plugin.
CVSS Score: 9.8 (CRITICAL)
References: https://wpscan.com/vulnerability/9480d0b5-97da-467d-98f6-71a32599a432; https://wpscan.com/vulnerability/9480d0b5-97da-467d-98f6-71a32599a432
CVE: CVE-2023-3118
Published: 2023-07-10
Description: The Export All URLs WordPress plugin before 4.6 does not sanitise and escape a parameter before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/8a9efc8d-561a-42c6-8e61-ae5c3be581ea; https://wpscan.com/vulnerability/8a9efc8d-561a-42c6-8e61-ae5c3be581ea