deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-43797
Published: 2023-10-30
Description: BigBlueButton is an open-source virtual classroom. Prior to versions 2.6.11 and 2.7.0-beta.3, Guest Lobby was vulnerable to cross-site scripting when users wait to enter the meeting due to inserting unsanitized messages to the element using unsafe innerHTML. Text sanitizing was added for lobby messages starting in versions 2.6.11 and 2.7.0-beta.3. There are no known workarounds.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/bigbluebutton/bigbluebutton/commit/304bc851a00558f99a908880f4ac44234a074c9d; https://github.com/bigbluebutton/bigbluebutton/pull/18392; https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-v6wg-q866-h73x
CVE: CVE-2023-43798
Published: 2023-10-30
Description: BigBlueButton is an open-source virtual classroom. BigBlueButton prior to versions 2.6.12 and 2.7.0-rc.1 is vulnerable to Server-Side Request Forgery (SSRF). This issue is a bypass of CVE-2023-33176. A patch in versions 2.6.12 and 2.7.0-rc.1 disabled follow redirect at `httpclient.execute` since the software no longer has to follow it when using `finalUrl`. There are no known workarounds. We recommend upgrading to a patched version of BigBlueButton.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-918
References: https://github.com/bigbluebutton/bigbluebutton/pull/18494; https://github.com/bigbluebutton/bigbluebutton/pull/18580; https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-3q22-hph2-cff7
CVE: CVE-2023-44397
Published: 2023-10-30
Description: CloudExplorer Lite is an open source, lightweight cloud management platform. Prior to version 1.4.1, the gateway filter of CloudExplorer Lite uses a controller with path starting with `matching/API/`, which can cause a permission bypass. Version 1.4.1 contains a patch for this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://github.com/CloudExplorer-Dev/CloudExplorer-Lite/security/advisories/GHSA-fqxr-7g94-vrfj; https://github.com/CloudExplorer-Dev/CloudExplorer-Lite/security/advisories/GHSA-fqxr-7g94-vrfj
CVE: CVE-2023-45670
Published: 2023-10-30
Description: Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, the `config/save` and `config/set` endpoints of Frigate do not implement any CSRF protection. This makes it possible for a request sourced from another site to update the configuration of the Frigate server (e.g. via "drive-by" attack). Exploiting this vulnerability requires the attacker to both know very specific information about a user's Frigate server and requires an authenticated user to be tricked into clicking a specially crafted link to their Frigate instance. This vulnerability could exploited by an attacker under the following circumstances: Frigate publicly exposed to the internet (even with authentication); attacker knows the address of a user's Frigate instance; attacker crafts a specialized page which links to the user's Frigate instance; attacker finds a way to get an authenticated user to visit their specialized page and click the button/link. This issue can lead to arbitrary configuration updates for the Frigate server, resulting in denial of service and possible data exfiltration. Version 0.13.0 Beta 3 contains a patch.
CVSS Score: 7.5 (HIGH)
CWE: CWE-352
References: https://about.gitlab.com/blog/2021/09/07/why-are-developers-vulnerable-to-driveby-attacks/; https://github.com/blakeblackshear/frigate/blob/5658e5a4cc7376504af9de5e1eff178939a13e7f/frigate/http.py#L1060; https://github.com/blakeblackshear/frigate/blob/6aedc39a9a421cf48000a727f36b4c1495848a1d/frigate/http.py#L998
CVE: CVE-2023-45671
Published: 2023-10-30
Description: Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, there is a reflected cross-site scripting vulnerability in any API endpoints reliant on the `/<camera_name>` base path as values provided for the path are not sanitized. Exploiting this vulnerability requires the attacker to both know very specific information about a user's Frigate server and requires an authenticated user to be tricked into clicking a specially crafted link to their Frigate instance. This vulnerability could exploited by an attacker under the following circumstances: Frigate publicly exposed to the internet (even with authentication); attacker knows the address of a user's Frigate instance; attacker crafts a specialized page which links to the user's Frigate instance; attacker finds a way to get an authenticated user to visit their specialized page and click the button/link. As the reflected values included in the URL are not sanitized or escaped, this permits execution arbitrary Javascript payloads. Version 0.13.0 Beta 3 contains a patch for this issue.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://github.com/blakeblackshear/frigate/security/advisories/GHSA-jjxc-m35j-p56f; https://securitylab.github.com/advisories/GHSL-2023-190_Frigate/; https://github.com/blakeblackshear/frigate/security/advisories/GHSA-jjxc-m35j-p56f
CVE: CVE-2023-45672
Published: 2023-10-30
Description: Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, an unsafe deserialization vulnerability was identified in the endpoints used to save configurations for Frigate. This can lead to unauthenticated remote code execution. This can be performed through the UI at `/config` or through a direct call to `/api/config/save`. Exploiting this vulnerability requires the attacker to both know very specific information about a user's Frigate server and requires an authenticated user to be tricked into clicking a specially crafted link to their Frigate instance. This vulnerability could exploited by an attacker under the following circumstances: Frigate publicly exposed to the internet (even with authentication); attacker knows the address of a user's Frigate instance; attacker crafts a specialized page which links to the user's Frigate instance; attacker finds a way to get an authenticated user to visit their specialized page and click the button/link. Input is initially accepted through `http.py`. The user-provided input is then parsed and loaded by `load_config_with_no_duplicates`. However, `load_config_with_no_duplicates` does not sanitize this input by merit of using `yaml.loader.Loader` which can instantiate custom constructors. A provided payload will be executed directly at `frigate/util/builtin.py:110`. This issue may lead to pre-authenticated Remote Code Execution. Version 0.13.0 Beta 3 contains a patch.
CVSS Score: 7.5 (HIGH)
CWE: CWE-502
References: https://github.com/blakeblackshear/frigate/blob/5658e5a4cc7376504af9de5e1eff178939a13e7f/frigate/config.py#L1244-L1244; https://github.com/blakeblackshear/frigate/blob/5658e5a4cc7376504af9de5e1eff178939a13e7f/frigate/http.py#L998-L998; https://github.com/blakeblackshear/frigate/blob/5658e5a4cc7376504af9de5e1eff178939a13e7f/frigate/util/builtin.py#L110-L110
CVE: CVE-2023-45804
Published: 2023-10-30
Description: Rejected reason: User requested a CVE number by mistake
CVE: CVE-2023-46478
Published: 2023-10-30
Description: An issue in minCal v.1.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the customer_data parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-639, CWE-639
References: https://github.com/mr-xmen786/CVE-2023-46478/tree/main; https://github.com/mr-xmen786/CVE-2023-46478/tree/main
CVE: CVE-2023-46502
Published: 2023-10-30
Description: An issue in openCRX v.5.2.2 allows a remote attacker to read internal files and execute server side request forgery attack via insecure DocumentBuilderFactory.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611, CWE-918
References: https://gist.github.com/spookhorror/9519fc66d3946e887e4a86c06ddbee0e; https://github.com/opencrx/opencrx/commit/ce7a71db0bb34ecbcb0e822d40598e410a48b399; https://gist.github.com/spookhorror/9519fc66d3946e887e4a86c06ddbee0e
CVE: CVE-2023-46129
Published: 2023-10-31
Description: NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained support for encryption, not just for signing/authentication. This is used in nats-server 2.10 (Sep 2023) and newer for authentication callouts. In nkeys versions 0.4.0 through 0.4.5, corresponding with NATS server versions 2.10.0 through 2.10.3, the nkeys library's `xkeys` encryption handling logic mistakenly passed an array by value into an internal function, where the function mutated that buffer to populate the encryption key to use. As a result, all encryption was actually to an all-zeros key. This affects encryption only, not signing.  
FIXME: FILL IN IMPACT ON NATS-SERVER AUTH CALLOUT SECURITY. nkeys Go library 0.4.6, corresponding with NATS Server 2.10.4, has a patch for this issue. No known workarounds are available. For any application handling auth callouts in Go, if using the nkeys library, update the dependency, recompile and deploy that in lockstep.
CVSS Score: 7.5 (HIGH)
CWE: CWE-321, CWE-325
References: http://www.openwall.com/lists/oss-security/2023/10/31/1; https://github.com/nats-io/nkeys/security/advisories/GHSA-mr45-rx8q-wcm9; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS/
CVE: CVE-2023-46138
Published: 2023-10-31
Description: JumpServer is an open source bastion host and maintenance security audit system that complies with 4A specifications. Prior to version 3.8.0, the default email for initial user admin is `admin[@]mycompany[.]com`, and users reset their passwords by sending an email. Currently, the domain `mycompany.com` has not been registered. However, if it is registered in the future, it may affect the password reset functionality. This issue has been patched in version 3.8.0 by changing the default email domain to `example.com`. Those who cannot upgrade may change the default email domain to `example.com` manually.
CVSS Score: 3.7 (LOW)
CWE: CWE-640
References: https://github.com/jumpserver/jumpserver/commit/15a5dda9e0cdbe2ac618a6b2a09df8928f485c88; https://github.com/jumpserver/jumpserver/security/advisories/GHSA-9mrc-75cv-46cq; https://github.com/jumpserver/jumpserver/commit/15a5dda9e0cdbe2ac618a6b2a09df8928f485c88
CVE: CVE-2023-46139
Published: 2023-10-31
Description: KernelSU is a Kernel based root solution for Android. Starting in version 0.6.1 and prior to version 0.7.0, if a KernelSU installed device is infected with a malware whose app signing block specially constructed, it can take over root privileges on the device. The vulnerable verification logic actually obtains the signature of the last block with an id of `0x7109871a`, while the verification logic during Android installation is to obtain the first one. In addition to the actual signature upgrade that has been fixed (KSU thought it was V2 but was actually V3), there is also the problem of actual signature downgrading (KSU thought it was V2 but was actually V1). Find a condition in the signature verification logic that will cause the signature not to be found error, and KernelSU does not implement the same conditions, so KSU thinks there is a V2 signature, but the APK signature verification actually uses the V1 signature. This issue is fixed in version 0.7.0. As workarounds, keep the KernelSU manager installed and avoid installing unknown apps.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-863
References: http://aospxref.com/android-14.0.0_r2/xref/frameworks/base/core/java/android/util/apk/ApkSigningBlockUtils.java#770; http://aospxref.com/android-14.0.0_r2/xref/frameworks/base/core/java/android/util/apk/ApkSigningBlockUtils.java#783; https://drive.google.com/drive/folders/1XdYCCAhC_mkt1k1IyUiwcgFsuOFvwNRl
CVE: CVE-2023-31794
Published: 2023-10-31
Description: MuPDF v1.21.1 was discovered to contain an infinite recursion in the component pdf_mark_list_push. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-674
References: https://bugs.ghostscript.com/show_bug.cgi?id=706506; https://gist.github.com/spookhorror/c770d118767b1b0d89fdfe2845169d06; https://git.ghostscript.com/?p=mupdf.git%3Bh=c[PII_REDACTED]b58e2deb5d75c39f27bc1216e47c6
CVE: CVE-2023-5861
Published: 2023-10-31
Description: Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 2.0.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/microweber/microweber/commit/6ed7ebf1631dd8f0780caa4151a5538f3b227d26; https://huntr.com/bounties/7baecef8-6c59-42fc-bced-886c4929e220; https://github.com/microweber/microweber/commit/6ed7ebf1631dd8f0780caa4151a5538f3b227d26
CVE: CVE-2023-5862
Published: 2023-10-31
Description: Missing Authorization in GitHub repository hamza417/inure prior to Build95.
CVSS Score: 3.3 (LOW)
CWE: CWE-862
References: https://github.com/hamza417/inure/commit/52b8c0bae36f129a5be05e377d7391afc3629df6; https://huntr.com/bounties/0e517db6-d8ba-4cb9-9339-7991dda52e6d; https://github.com/hamza417/inure/commit/52b8c0bae36f129a5be05e377d7391afc3629df6
CVE: CVE-2023-5863
Published: 2023-10-31
Description: Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/thorsten/phpmyfaq/commit/97e813dcd2022bd10a8770569a8b[PII_REDACTED]5f; https://huntr.com/bounties/fbfd4e84-61fb-4063-8f11-15877b8c1f6f; https://github.com/thorsten/phpmyfaq/commit/97e813dcd2022bd10a8770569a8b[PII_REDACTED]5f
CVE: CVE-2023-5864
Published: 2023-10-31
Description: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.1.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/thorsten/phpmyfaq/commit/b3e5a053b59dcc072d76a55d6ce0311ea30174fa; https://huntr.com/bounties/e4b0e8f4-5e06-49d1-832f[PII_REDACTED]ad; https://github.com/thorsten/phpmyfaq/commit/b3e5a053b59dcc072d76a55d6ce0311ea30174fa
CVE: CVE-2023-5865
Published: 2023-10-31
Description: Insufficient Session Expiration in GitHub repository thorsten/phpmyfaq prior to 3.2.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-613
References: https://github.com/thorsten/phpmyfaq/commit/5f43786f52c3d517e7665abd25d534e180e08dc5; https://huntr.com/bounties/4c4b7395-d9fd-4ca0-98d7-2e20c1249aff; https://github.com/thorsten/phpmyfaq/commit/5f43786f52c3d517e7665abd25d534e180e08dc5
CVE: CVE-2023-5866
Published: 2023-10-31
Description: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.2.1.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-614
References: https://github.com/thorsten/phpmyfaq/commit/fdacff14acd5e69841068f0e32b59e2d1b1d0d55; https://huntr.com/bounties/ec44bcba-ae7f-497a-851e-8165ecf56945; https://github.com/thorsten/phpmyfaq/commit/fdacff14acd5e69841068f0e32b59e2d1b1d0d55
CVE: CVE-2023-5867
Published: 2023-10-31
Description: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/thorsten/phpmyfaq/commit/5310cb8c37dc3a5c5aead0898690b14705c433d3; https://huntr.com/bounties/5c09b32e-a041-4a1e-a277-eb3e80967df0; https://github.com/thorsten/phpmyfaq/commit/5310cb8c37dc3a5c5aead0898690b14705c433d3
CVE: CVE-2023-45899
Published: 2023-10-31
Description: An issue in the component SuperUserSetuserModuleFrontController:init() of idnovate superuser before v2.4.2 allows attackers to bypass authentication via a crafted HTTP call.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://security.friendsofpresta.org/modules/2023/10/26/superuser.html; https://security.friendsofpresta.org/modules/2023/10/26/superuser.html
CVE: CVE-2023-46040
Published: 2023-10-31
Description: Cross Site Scripting vulnerability in GetSimpleCMS v.3.4.0a allows a remote attacker to execute arbitrary code via the a crafted payload to the components.php function.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Num-Nine/CVE/wiki/GetSimplecms-exists-to-store-xss; https://github.com/Num-Nine/CVE/wiki/GetSimplecms-exists-to-store-xss
CVE: CVE-2015-20110
Published: 2023-10-31
Description: JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first character that is different. Attackers can guess tokens by brute forcing one character at a time and observing the timing. This of course drastically reduces the search space to a linear amount of guesses based on the token length times the possible characters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307
References: https://github.com/jhipster/generator-jhipster/commit/79fe5626cb1bb80f9ac86cf46980748e65d2bdbc; https://github.com/jhipster/generator-jhipster/commit/7c49ab3d45dc4921b831a2ca55fb1e2a2db1ee25; https://github.com/jhipster/generator-jhipster/compare/v2.22.0...v2.23.0
CVE: CVE-2023-27846
Published: 2023-10-31
Description: SQL injection vulnerability found in PrestaShop themevolty v.4.0.8 and before allow a remote attacker to gain privileges via the tvcmsblog, tvcmsvideotab, tvcmswishlist, tvcmsbrandlist, tvcmscategorychainslider, tvcmscategoryproduct, tvcmscategoryslider, tvcmspaymenticon, tvcmstestimonial components.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://security.friendsofpresta.org/modules/2023/10/25/tvcmsblog.html; https://security.friendsofpresta.org/modules/2023/10/25/tvcmsblog.html
CVE: CVE-2023-45378
Published: 2023-10-31
Description: In the module "PrestaBlog" (prestablog) version 4.4.7 and before from HDclic for PrestaShop, a guest can perform SQL injection. The script ajax slider_positions.php has a sensitive SQL call that can be executed with a trivial http call and exploited to forge a SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://security.friendsofpresta.org/modules/2023/10/26/prestablog.html; https://security.friendsofpresta.org/modules/2023/10/26/prestablog.html
CVE: CVE-2023-46356
Published: 2023-10-31
Description: In the module "CSV Feeds PRO" (csvfeeds) before 2.6.1 from Bl Modules for PrestaShop, a guest can perform SQL injection. The method `SearchApiCsv::getProducts()` has sensitive SQL call that can be executed with a trivial http call and exploited to forge a SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://security.friendsofpresta.org/modules/2023/10/26/csvfeeds-89.html; https://security.friendsofpresta.org/modules/2023/10/26/csvfeeds-89.html
CVE: CVE-2023-47174
Published: 2023-10-31
Description: Thorn SFTP gateway 3.4.x before 3.4.4 uses Pivotal Spring Framework for Java deserialization of untrusted data, which is not supported by Pivotal, a related issue to CVE-2[PII_REDACTED]. Also, within the specific context of Thorn SFTP gateway, this leads to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://help.thorntech.com/docs/sftp-gateway-gcp-3.0/gcp-java-deserialization-rce/; https://help.thorntech.com/docs/sftp-gateway-gcp-3.0/gcp-java-deserialization-rce/
CVE: CVE-2023-36263
Published: 2023-10-31
Description: Prestashop opartlimitquantity 1.4.5 and before is vulnerable to SQL Injection. OpartlimitquantityAlertlimitModuleFrontController::displayAjaxPushAlertMessage()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://security.friendsofpresta.org/modules/2023/10/25/opartlimitquantity.html; https://security.friendsofpresta.org/modules/2023/10/25/opartlimitquantity.html
CVE: CVE-2023-43139
Published: 2023-10-31
Description: An issue in franfinance before v.2.0.27 allows a remote attacker to execute arbitrary code via the validation.php, and controllers/front/validation.php components.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://security.friendsofpresta.org/modules/2023/10/25/franfinance.html; https://security.friendsofpresta.org/modules/2023/10/25/franfinance.html
CVE: CVE-2023-45996
Published: 2023-10-31
Description: SQL injection vulnerability in Senayan Library Management Systems Slims v.9 and Bulian v.9.6.1 allows a remote attacker to obtain sensitive information and execute arbitrary code via a crafted script to the reborrowLimit parameter in the member_type.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/Vuln0wned/slims_owned/blob/main/slims/slims9-bulian-9.6.1-SQLI-member_type.md; https://github.com/slims/slims9_bulian/issues/216; https://github.com/Vuln0wned/slims_owned/blob/main/slims/slims9-bulian-9.6.1-SQLI-member_type.md
CVE: CVE-2023-46361
Published: 2023-10-31
Description: Artifex Software jbig2dec v0.20 was discovered to contain a SEGV vulnerability via jbig2_error at /jbig2dec/jbig2.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://github.com/Frank-Z7/z-vulnerabilitys/blob/main/jbig2dec-SEGV/jbig2dec-SEGV.md; https://github.com/Frank-Z7/z-vulnerabilitys/blob/main/jbig2dec-SEGV/jbig2dec-SEGV.md
CVE: CVE-2023-46451
Published: 2023-10-31
Description: Best Courier Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in the change username field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/sajaljat/CVE-2023-46451; https://youtu.be/f8B3_m5YfqI; https://github.com/sajaljat/CVE-2023-46451
CVE: CVE-2023-46210
Published: 2023-10-31
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WebCource WC Captcha plugin <= 1.4 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wc-captcha/wordpress-wc-captcha-plugin-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wc-captcha/wordpress-wc-captcha-plugin-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-5412
Published: 2023-10-31
Description: The Image horizontal reel scroll slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 13.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/image-horizontal-reel-scroll-slideshow/trunk/image-horizontal-reel-scroll-slideshow.php?rev=2827121#L176; https://plugins.trac.wordpress.org/changeset/2985331/image-horizontal-reel-scroll-slideshow#file1; https://www.wordfence.com/threat-intel/vulnerabilities/id/08fb698f-c87c-4200-85fe-3fe72745633e?source=cve
CVE: CVE-2023-5428
Published: 2023-10-31
Description: The Image vertical reel scroll slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 9.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/image-vertical-reel-scroll-slideshow/trunk/image-vertical-reel-scroll-slideshow.php?rev=2827122#L273; https://plugins.trac.wordpress.org/changeset/2985333/image-vertical-reel-scroll-slideshow#file1; https://www.wordfence.com/threat-intel/vulnerabilities/id/01d31d8a-4459-488a-9cbe-92761faa58b4?source=cve