deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-1056
Published: 2023-02-27
Description: A vulnerability was found in SourceCodester Doctors Appointment System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /edoc/doctor/patient.php. The manipulation of the argument search12 leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221821 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/edoc%20doctor%20appointment%20system/edoc%20docker%20search.pdf; https://vuldb.com/?ctiid.221821; https://vuldb.com/?id.221821
CVE: CVE-2023-1057
Published: 2023-02-27
Description: A vulnerability was found in SourceCodester Doctors Appointment System 1.0. It has been rated as critical. Affected by this issue is the function edoc of the file login.php. The manipulation of the argument usermail leads to sql injection. VDB-221822 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/edoc%20doctor%20appointment%20system/edoc%20doctor%20appointment%20system%20vlun1.pdf; https://vuldb.com/?ctiid.221822; https://vuldb.com/?id.221822
CVE: CVE-2023-1058
Published: 2023-02-27
Description: A vulnerability classified as critical has been found in SourceCodester Doctors Appointment System 1.0. This affects an unknown part of the file create-account.php. The manipulation of the argument newemail leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221823.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/edoc%20doctor%20appointment%20system/edoc%20doctor%20appointment%20system%20vlun2.pdf; https://vuldb.com/?ctiid.221823; https://vuldb.com/?id.221823
CVE: CVE-2023-1059
Published: 2023-02-27
Description: A vulnerability classified as critical was found in SourceCodester Doctors Appointment System 1.0. This vulnerability affects unknown code of the file /admin/doctors.php of the component Parameter Handler. The manipulation of the argument search/id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/edoc%20doctor%20appointment%20system/edoc%20doctor%20appointment%20system%20vlun3.pdf; https://vuldb.com/?ctiid.221824; https://vuldb.com/?id.221824
CVE: CVE-2023-1061
Published: 2023-02-27
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Doctors Appointment System 1.0. This issue affects some unknown processing of the file /admin/edit-doc.php. The manipulation of the argument email/oldmail leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/edoc%20doctor%20appointment%20system/edoc%20doctor%20appointment%20system%20vlun4.pdf; https://vuldb.com/?ctiid.221825; https://vuldb.com/?id.221825
CVE: CVE-2023-1062
Published: 2023-02-27
Description: A vulnerability, which was classified as critical, was found in SourceCodester Doctors Appointment System 1.0. Affected is an unknown function of the file /admin/add-new.php of the component Parameter Handler. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-221826 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/edoc%20doctor%20appointment%20system/edoc%20doctor%20appointment%20system%20vlun5.pdf; https://vuldb.com/?ctiid.221826; https://vuldb.com/?id.221826
CVE: CVE-2023-1063
Published: 2023-02-27
Description: A vulnerability has been found in SourceCodester Doctors Appointment System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/patient.php of the component Parameter Handler. The manipulation of the argument search leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221827.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/edoc%20doctor%20appointment%20system/edoc%20doctor%20appointment%20system%20vlun6.pdf; https://vuldb.com/?ctiid.221827; https://vuldb.com/?id.221827
CVE: CVE-2022-34908
Published: 2023-02-27
Description: An issue was discovered in the A4N (Aremis 4 Nomad) application 1.5.0 for Android. It possesses an authentication mechanism; however, some features do not require any token or cookie in a request. Therefore, an attacker may send a simple HTTP request to the right endpoint, and obtain authorization to retrieve application data.
CVSS Score: 8.2 (HIGH)
CWE: CWE-287, CWE-306
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2022-34908; https://excellium-services.com/cert-xlm-advisory/CVE-2022-34908; https://www.aremis.com/en_GB/welcome
CVE: CVE-2022-34909
Published: 2023-02-27
Description: An issue was discovered in the A4N (Aremis 4 Nomad) application 1.5.0 for Android. It allows SQL Injection, by which an attacker can bypass authentication and retrieve data that is stored in the database.
CVSS Score: 7.7 (HIGH)
CWE: CWE-89, CWE-89
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2022-34909; https://excellium-services.com/cert-xlm-advisory/CVE-2022-34909; https://www.aremis.com/en_GB/welcome
CVE: CVE-2022-34910
Published: 2023-02-27
Description: An issue was discovered in the A4N (Aremis 4 Nomad) application 1.5.0 for Android. It uses a local database to store data and accounts. However, the password is stored in cleartext. Therefore, an attacker can retrieve the passwords of other users that used the same device.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-312, CWE-312
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2022-34910; https://excellium-services.com/cert-xlm-advisory/CVE-2022-34910; https://www.aremis.com/en_GB/welcome
CVE: CVE-2023-24206
Published: 2023-02-27
Description: Davinci v0.3.0-rc was discovered to contain a SQL injection vulnerability via the copyDisplay function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/edp963/davinci/issues/2320; https://github.com/edp963/davinci/issues/2320
CVE: CVE-2021-32302
Published: 2023-02-27
Description: Cross Site Scripting vulnerability in IRZ Electronics RUH2 GSM router allows attacker to obtain sensitive information via the Upload File parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://irz.com; http://ruh2.com; https://s4nsec.github.io/2023/02/20/RUH2-GSM-Router-XSS-vulnerabilities.html
CVE: CVE-2023-1067
Published: 2023-02-27
Description: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/pimcore/pimcore/commit/4b5733266d7d6aeb4f221a15e005db83fc198edf; https://huntr.dev/bounties/31d17b34-f80d-49f2-86e7-97ae715cc045; https://github.com/pimcore/pimcore/commit/4b5733266d7d6aeb4f221a15e005db83fc198edf
CVE: CVE-2023-1068
Published: 2023-02-27
Description: The Download Read More Excerpt Link plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.0. This is due to missing or incorrect nonce validation on the read_more_excerpt_link_menu_options() function. This makes it possible for unauthenticated attackers to update he plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/changeset/2871098/read-more-excerpt-link/trunk/read-more-excerpt-link.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/0359434b-9d88-4a40-8e9f-ec354c8de816?source=cve; https://plugins.trac.wordpress.org/changeset/2871098/read-more-excerpt-link/trunk/read-more-excerpt-link.php
CVE: CVE-2023-23080
Published: 2023-02-27
Description: Certain Tenda products are vulnerable to command injection. This affects Tenda CP7 Tenda CP7<=V11.10.00[PII_REDACTED] and Tenda CP3 v.10 Tenda CP3 v.10<=V[PII_REDACTED]4_2025 and Tenda IT7-PCS Tenda IT7-PCS<=V[PII_REDACTED] and Tenda IT7-LCS Tenda IT7-LCS<=V[PII_REDACTED] and Tenda IT7-PRS Tenda IT7-PRS<=V[PII_REDACTED].
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/fxc233/iot-vul/tree/main/Tenda/IPC; https://github.com/fxc233/iot-vul/tree/main/Tenda/IPC
CVE: CVE-2023-23108
Published: 2023-02-27
Description: In crasm 1.8-3, invalid input validation, specific files passed to the command line application, can lead to a NULL pointer dereference in the function Xasc.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/WhatTheFuzz/crasm-fuzz/tree/a020ad6ad99a72ca373f7dd1aab3a61a7c87fd66/bug-null-pointer; https://github.com/colinbourassa/crasm/pull/7; https://github.com/WhatTheFuzz/crasm-fuzz/tree/a020ad6ad99a72ca373f7dd1aab3a61a7c87fd66/bug-null-pointer
CVE: CVE-2023-23109
Published: 2023-02-27
Description: In crasm 1.8-3, invalid input validation, specific files passed to the command line application, can lead to a divide by zero fault in the function opdiv.
CVSS Score: 7.5 (HIGH)
CWE: CWE-369
References: https://github.com/WhatTheFuzz/crasm-fuzz/tree/a020ad6ad99a72ca373f7dd1aab3a61a7c87fd66/bug-floating-point-exception; https://github.com/colinbourassa/crasm/pull/7; https://github.com/WhatTheFuzz/crasm-fuzz/tree/a020ad6ad99a72ca373f7dd1aab3a61a7c87fd66/bug-floating-point-exception
CVE: CVE-2022-40237
Published: 2023-02-27
Description: IBM MQ for HPE NonStop 8.1.0 is vulnerable to a denial of service attack due to an error within the CCDT and channel synchronization logic.  IBM X-Force ID:  235727.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/235727; https://www.ibm.com/support/pages/node/6958136; https://exchange.xforce.ibmcloud.com/vulnerabilities/235727
CVE: CVE-2022-45137
Published: 2023-02-27
Description: The configuration backend of the web-based management is vulnerable to reflected XSS (Cross-Site Scripting) attacks that targets the users browser. This leads to a limited impact of confidentiality and integrity but no impact of availability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cert.vde.com/en/advisories/VDE-2022-060/; https://cert.vde.com/en/advisories/VDE-2022-060/
CVE: CVE-2022-45138
Published: 2023-02-27
Description: The configuration backend of the web-based management can be used by unauthenticated users, although only authenticated users should be able to use the API. The vulnerability allows an unauthenticated attacker to read and set several device parameters that can lead to full compromise of the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://cert.vde.com/en/advisories/VDE-2022-060/; https://cert.vde.com/en/advisories/VDE-2022-060/
CVE: CVE-2022-45139
Published: 2023-02-27
Description: A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of device information like CPU diagnostics. As there is just a limited amount of information readable the impact only affects a small subset of confidentiality.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-346, CWE-346
References: https://cert.vde.com/en/advisories/VDE-2022-060/; https://cert.vde.com/en/advisories/VDE-2022-060/
CVE: CVE-2022-45140
Published: 2023-02-27
Description: The configuration backend allows an unauthenticated user to write arbitrary data with root privileges to the storage, which could lead to unauthenticated remote code execution and full system compromise.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://cert.vde.com/en/advisories/VDE-2022-060/; https://cert.vde.com/en/advisories/VDE-2022-060/
CVE: CVE-2022-45697
Published: 2023-02-27
Description: Arbitrary File Delete vulnerability in Razer Central before v7.8.0.381 when handling files in the Accounts directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: http://razer.com; https://github.com/Wh04m1001/CVE; http://razer.com
CVE: CVE-2023-22860
Published: 2023-02-27
Description: IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  244100.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/244100; https://www.ibm.com/support/pages/node/6958062; https://exchange.xforce.ibmcloud.com/vulnerabilities/244100
CVE: CVE-2023-26042
Published: 2023-02-27
Description: Part-DB is an open source inventory management system for your electronic components. User input was found not being properly escaped, which allowed malicious users to inject arbitrary HTML into the pages. The Content-Security-Policy forbids inline and external scripts so it is not possible to execute JavaScript code, unless in combination with other vulnerabilities. There are no workarounds, please upgrade to Pat-DB 1.0.2 or later.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/Part-DB/Part-DB-server/commit/5b7f44f4eaacad8a79bcedec32780e00d7347099; https://github.com/Part-DB/Part-DB-server/pull/227; https://github.com/Part-DB/Part-DB-server/releases/tag/v1.0.2
CVE: CVE-2023-27263
Published: 2023-02-27
Description: A missing permissions check in the /plugins/playbooks/api/v0/runs API in Mattermost allows an attacker to list and view playbooks belonging to a team they are not a member of.



CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2023-27264
Published: 2023-02-27
Description: A missing permissions check in Mattermost Playbooks in Mattermost allows an attacker to modify a playbook via the /plugins/playbooks/api/v0/playbooks/[playbookID] API.



CVSS Score: 7.1 (HIGH)
CWE: CWE-862, CWE-862
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2023-27265
Published: 2023-02-27
Description: Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the "Regenerate Invite Id" API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in the response.



CVSS Score: 2.7 (LOW)
CWE: CWE-200, CWE-668
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2023-27266
Published: 2023-02-27
Description: Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the /api/v4/users/me/teams  API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in the response.



CVSS Score: 2.7 (LOW)
CWE: CWE-200, CWE-200
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2022-4550
Published: 2023-02-27
Description: The User Activity WordPress plugin through 1.0.1 checks headers such as the X-Forwarded-For to retrieve the IP address of the request, which could lead to IP spoofing
CVSS Score: 7.5 (HIGH)
CWE: CWE-290
References: https://wpscan.com/vulnerability/a[PII_REDACTED]-479f-a5ca-3c9ffc46d00e; https://wpscan.com/vulnerability/a[PII_REDACTED]-479f-a5ca-3c9ffc46d00e
CVE: CVE-2022-4679
Published: 2023-02-27
Description: The Wufoo Shortcode WordPress plugin before 1.52 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/c817c4af-cff2-4720-944d-c59e27544d41; https://wpscan.com/vulnerability/c817c4af-cff2-4720-944d-c59e27544d41
CVE: CVE-2022-4757
Published: 2023-02-27
Description: The List Pages Shortcode WordPress plugin before 1.7.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/30211ffd-8751-4354-96d3-69b0106100b1; https://wpscan.com/vulnerability/30211ffd-8751-4354-96d3-69b0106100b1
CVE: CVE-2022-4788
Published: 2023-02-27
Description: The Embed PDF WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/2a162365-5a86-423d-b7c4-55c9b4d8b024; https://wpscan.com/vulnerability/2a162365-5a86-423d-b7c4-55c9b4d8b024
CVE: CVE-2022-4795
Published: 2023-02-27
Description: The Galleries by Angie Makes WordPress plugin through 1.67 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/5052e60f-59ea-4758-8af3-112285a18639; https://wpscan.com/vulnerability/5052e60f-59ea-4758-8af3-112285a18639
CVE: CVE-2022-4829
Published: 2023-02-27
Description: The Show-Hide / Collapse-Expand WordPress plugin before 1.3.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/57e528ce-ec8c-4734-8903-926be36f91e7; https://wpscan.com/vulnerability/57e528ce-ec8c-4734-8903-926be36f91e7
CVE: CVE-2023-0043
Published: 2023-02-27
Description: The Custom Add User WordPress plugin through 2.0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/e012f23a-7daf-4ef3-b116-d0e2ed5bd0a3; https://wpscan.com/vulnerability/e012f23a-7daf-4ef3-b116-d0e2ed5bd0a3
CVE: CVE-2023-0168
Published: 2023-02-27
Description: The Olevmedia Shortcodes WordPress plugin through 1.1.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/e854efee-16fc-4379-9e66-d2883e01fb32; https://wpscan.com/vulnerability/e854efee-16fc-4379-9e66-d2883e01fb32
CVE: CVE-2023-0230
Published: 2023-02-27
Description: The VK All in One Expansion Unit WordPress plugin before 9.86.0.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/a4ad73b2-6a70-48ff-bf4c-28f81b193748; https://wpscan.com/vulnerability/a4ad73b2-6a70-48ff-bf4c-28f81b193748
CVE: CVE-2023-0278
Published: 2023-02-27
Description: The GeoDirectory WordPress plugin before 2.2.24 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
CVSS Score: 7.2 (HIGH)
References: https://bulletin.iese.de/post/geodirectory_2-2-21; https://wpscan.com/vulnerability/98deb84e-01ca-4b70-a8f8-0a226daa85a6; https://bulletin.iese.de/post/geodirectory_2-2-21
CVE: CVE-2023-0279
Published: 2023-02-27
Description: The Media Library Assistant WordPress plugin before 3.06 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
CVSS Score: 7.2 (HIGH)
References: https://bulletin.iese.de/post/media-library-assistant_3-05_1; https://wpscan.com/vulnerability/42db1ba5-1b14-41bd-a2b3-7243a84c9d3d; https://bulletin.iese.de/post/media-library-assistant_3-05_1
CVE: CVE-2023-0331
Published: 2023-02-27
Description: The Correos Oficial WordPress plugin through 1.2.0.2 does not have an authorization check user input validation when generating a file path, allowing unauthenticated attackers to download arbitrary files from the server.
CVSS Score: 7.5 (HIGH)
References: https://wpscan.com/vulnerability/1b4dbaf3-1364-4103-9a7b-b5a1355c685b; https://wpscan.com/vulnerability/1b4dbaf3-1364-4103-9a7b-b5a1355c685b
CVE: CVE-2023-0334
Published: 2023-02-27
Description: The ShortPixel Adaptive Images WordPress plugin before 3.6.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against any high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/b027a8db-0fd6-444d-b14a-0ae58f04f931; https://wpscan.com/vulnerability/b027a8db-0fd6-444d-b14a-0ae58f04f931
CVE: CVE-2023-0381
Published: 2023-02-27
Description: The GigPress WordPress plugin through 2.3.28 does not validate and escape some of its shortcode attributes before using them in SQL statement/s, which could allow any authenticated users, such as subscriber to perform SQL Injection attacks
CVSS Score: 8.8 (HIGH)
References: https://wpscan.com/vulnerability/39c964fa-6d8d-404d-ac38-72f6f88d203c; https://wpscan.com/vulnerability/39c964fa-6d8d-404d-ac38-72f6f88d203c
CVE: CVE-2023-0487
Published: 2023-02-27
Description: The My Sticky Elements WordPress plugin before 2.0.9 does not properly sanitise and escape a parameter before using it in a SQL statement when deleting messages, leading to a SQL injection exploitable by high privilege users such as admin
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://wpscan.com/vulnerability/0e874a1d-c866-45fa-b456-c8012dca32af; https://wpscan.com/vulnerability/0e874a1d-c866-45fa-b456-c8012dca32af
CVE: CVE-2023-0535
Published: 2023-02-27
Description: The Donation Block For PayPal WordPress plugin before 2.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/8c50321a-dba8-4379-9b9c-4c349e44b2ed; https://wpscan.com/vulnerability/8c50321a-dba8-4379-9b9c-4c349e44b2ed
CVE: CVE-2023-0539
Published: 2023-02-27
Description: The GS Insever Portfolio WordPress plugin before 1.4.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/a4b6a83a-6394-4dfc-8bb3-4982867dab7d; https://wpscan.com/vulnerability/a4b6a83a-6394-4dfc-8bb3-4982867dab7d