deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-28716
Published: 2023-04-27
Description: mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands. 
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-096-06; https://www.cisa.gov/news-events/ics-advisories/icsa-23-096-06
CVE: CVE-2023-29150
Published: 2023-04-27
Description: mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands. 
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-096-06; https://www.cisa.gov/news-events/ics-advisories/icsa-23-096-06
CVE: CVE-2023-29169
Published: 2023-04-27
Description: mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands. 
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-096-06; https://www.cisa.gov/news-events/ics-advisories/icsa-23-096-06
CVE: CVE-2023-2356
Published: 2023-04-28
Description: Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-23
References: https://github.com/mlflow/mlflow/commit/f73147496e05c09a8b83d95fb4f1bf86696c6342; https://huntr.dev/bounties/7b5d130d-38eb-4133-8c7d-0dfc9a9d9896; https://github.com/mlflow/mlflow/commit/f73147496e05c09a8b83d95fb4f1bf86696c6342
CVE: CVE-2023-27556
Published: 2023-04-28
Description: IBM Counter Fraud Management for Safer Payments 6.1.0.00, 6.2.0.00, 6.3.0.00 through 6.3.1.03, 6.4.0.00 through 6.4.2.02 and 6.5.0.00 does not properly allocate resources without limits or throttling which could allow a remote attacker to cause a denial of service.  IBM X-Force ID:  249190.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/249190; https://www.ibm.com/support/pages/node/6985601; https://exchange.xforce.ibmcloud.com/vulnerabilities/249190
CVE: CVE-2020-4729
Published: 2023-04-28
Description: IBM Counter Fraud Management for Safer Payments 5.7.0.00 through 5.7.0.10, 6.0.0.00 through 6.0.0.07, 6.1.0.00 through 6.1.0.05, and 6.2.0.00 through 6.2.1.00 could allow an authenticated attacker under special circumstances to send multiple specially crafted API requests that could cause the application to crash.  IBM X-Force ID:  188052.
CVSS Score: 5.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/188052; https://www.ibm.com/support/pages/node/6985595; https://exchange.xforce.ibmcloud.com/vulnerabilities/188052
CVE: CVE-2023-27557
Published: 2023-04-28
Description: IBM Counter Fraud Management for Safer Payments 6.1.0.00 through 6.1.1.02, 6.2.0.00 through 6.2.2.02, 6.3.0.00 through 6.3.1.02, 6.4.0.00 through 6.4.2.01, and 6.5.0.00 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.  IBM X-Force ID:  249192.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/249192; https://www.ibm.com/support/pages/node/6985603; https://exchange.xforce.ibmcloud.com/vulnerabilities/249192
CVE: CVE-2023-31436
Published: 2023-04-28
Description: qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQ_MIN_LMAX.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://packetstormsecurity.com/files/173087/Kernel-Live-Patch-Security-Notice-LSN-0095-1.html; http://packetstormsecurity.com/files/173757/Kernel-Live-Patch-Security-Notice-LSN-0096-1.html; http://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html
CVE: CVE-2023-28528
Published: 2023-04-28
Description: IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout command to execute arbitrary commands.  IBM X-Force ID:  251207.
CVSS Score: 8.4 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/172458/IBM-AIX-7.2-inscout-Privilege-Escalation.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/251207; https://www.ibm.com/support/pages/node/6983232
CVE: CVE-2023-28882
Published: 2023-04-28
Description: Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash and unresponsiveness) because some inputs cause a segfault in the Transaction class for some configurations.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-770
References: https://www.trustwave.com/en-us/resources/security-resources/software-updates/announcing-modsecurity-version-309/; https://www.trustwave.com/en-us/resources/security-resources/software-updates/announcing-modsecurity-version-309/
CVE: CVE-2023-2361
Published: 2023-04-28
Description: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/pimcore/pimcore/commit/6970649f5d3790a1db9ef4324bece0d4cb95366a; https://huntr.dev/bounties/24d91b83-c3df-48f5-a713-9def733f2de7; https://github.com/pimcore/pimcore/commit/6970649f5d3790a1db9ef4324bece0d4cb95366a
CVE: CVE-2022-48481
Published: 2023-04-28
Description: In JetBrains Toolbox App before 1.28 a DYLIB injection on macOS was possible
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-691
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2023-2363
Published: 2023-04-28
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Resort Reservation System 1.0. This issue affects some unknown processing of the file view_room.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227639.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/navaidzansari/CVE_Demo/blob/main/2023/Resort_Reservation_System-SQL-Injection-1.md; https://vuldb.com/?ctiid.227639; https://vuldb.com/?id.227639
CVE: CVE-2023-2364
Published: 2023-04-28
Description: A vulnerability, which was classified as problematic, was found in SourceCodester Resort Reservation System 1.0. Affected is an unknown function of the file registration.php. The manipulation of the argument fullname leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227640.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/navaidzansari/CVE_Demo/blob/main/2023/Resort_Reservation_System-Stored-Cross-Site-Scripting-1.md; https://vuldb.com/?ctiid.227640; https://vuldb.com/?id.227640
CVE: CVE-2023-30466
Published: 2023-04-28
Description: This vulnerability exists in Milesight 4K/H.265 Series NVR models (MS-Nxxxx-xxG, MS-Nxxxx-xxE, MS-Nxxxx-xxT, MS-Nxxxx-xxH and MS-Nxxxx-xxC), due to a weak password reset mechanism at the Milesight NVR web-based management interface. A remote attacker could exploit this vulnerability by sending a specially crafted http requests on the targeted device.

Successful exploitation of this vulnerability could allow remote attacker to account takeover on the targeted device.











CVSS Score: 9.8 (CRITICAL)
CWE: CWE-640, CWE-640
References: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0121; https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0121
CVE: CVE-2023-30467
Published: 2023-04-28
Description: This vulnerability exists in Milesight 4K/H.265 Series NVR models (MS-Nxxxx-xxG, MS-Nxxxx-xxE, MS-Nxxxx-xxT, MS-Nxxxx-xxH and MS-Nxxxx-xxC), due to improper authorization at the Milesight NVR web-based management interface. A remote attacker could exploit this vulnerability by sending a specially crafted http requests on the targeted device.

Successful exploitation of this vulnerability could allow remote attacker to perform unauthorized activities on the targeted device.











CVSS Score: 7.5 (HIGH)
CWE: CWE-285, CWE-863
References: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0121; https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0121
CVE: CVE-2023-2360
Published: 2023-04-28
Description: Sensitive information disclosure due to CORS misconfiguration. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.2.0-135.
CVSS Score: 7.5 (HIGH)
CWE: CWE-942
References: https://security-advisory.acronis.com/advisories/SEC-4215; https://security-advisory.acronis.com/advisories/SEC-4215
CVE: CVE-2023-2365
Published: 2023-04-28
Description: A vulnerability has been found in SourceCodester Faculty Evaluation System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file ajax.php?action=delete_subject. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227641 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/oV201/cve_report/blob/main/vendors/oretnom23/faculty-evaluation-system/SQLi-1.md; https://vuldb.com/?ctiid.227641; https://vuldb.com/?id.227641
CVE: CVE-2023-2366
Published: 2023-04-28
Description: A vulnerability was found in SourceCodester Faculty Evaluation System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file ajax.php?action=delete_class. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-227642 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/oV201/cve_report/blob/main/vendors/oretnom23/faculty-evaluation-system/SQLi-2.md; https://vuldb.com/?ctiid.227642; https://vuldb.com/?id.227642
CVE: CVE-2022-38583
Published: 2023-04-28
Description: On versions of Sage 300 2017 - 2022 (6.4.x - 6.9.x) which are setup in a "Windows Peer-to-Peer Network" or "Client Server Network" configuration, a low-privileged Sage 300 workstation user could abuse their access to the "SharedData" folder on the connected Sage 300 server to view and/or modify the credentials associated with Sage 300 users and SQL accounts to impersonate users and/or access the SQL database as a system administrator. With system administrator-level access to the Sage 300 MS SQL database it would be possible to create, update, and delete all records associated with the program and, depending on the configuration, execute code on the underlying database server.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276, CWE-276
References: http://sage.com; https://www.controlgap.com/blog/sage-300-case-study; http://sage.com
CVE: CVE-2022-41397
Published: 2023-04-28
Description: The optional Web Screens and Global Search features for Sage 300 through version 2022 use a hard-coded 40-byte blowfish key ("LandlordPassKey") to encrypt and decrypt secrets stored in configuration files and in database tables.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://www.sage.com/en-ca/products/sage-300/; https://www.sage.com/en-ca/products/sage-300/
CVE: CVE-2022-41398
Published: 2023-04-28
Description: The optional Global Search feature for Sage 300 through version 2022 uses a set of hard-coded credentials for the accompanying Apache Solr instance. This issue could allow attackers to login to the Solr dashboard with admin privileges and access sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798, CWE-798
References: https://www.sage.com/en-ca/products/sage-300/; https://www.sage.com/en-ca/products/sage-300/
CVE: CVE-2022-41399
Published: 2023-04-28
Description: The optional Web Screens feature for Sage 300 through version 2022 uses a hard-coded 40-byte blowfish key ("PASS_KEY") to encrypt and decrypt the database connection string for the PORTAL database found in the "dbconfig.xml". This issue could allow attackers to obtain access to the SQL database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798, CWE-798
References: https://www.sage.com/en-ca/products/sage-300/; https://www.sage.com/en-ca/products/sage-300/
CVE: CVE-2022-41400
Published: 2023-04-28
Description: Sage 300 through 2022 uses a hard-coded 40-byte blowfish key to encrypt and decrypt user passwords and SQL connection strings stored in ISAM database files in the shared data directory. This issue could allow attackers to decrypt user passwords and SQL connection strings.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://www.sage.com/en-ca/products/sage-300/; https://www.sage.com/en-ca/products/sage-300/
CVE: CVE-2023-2367
Published: 2023-04-28
Description: A vulnerability was found in SourceCodester Faculty Evaluation System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/manage_academic.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227643.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://github.com/f0llow/bug_report/blob/main/vendors/oretnom23/faculty-evaluation-system/SQLi-1.md; https://vuldb.com/?ctiid.227643; https://vuldb.com/?id.227643
CVE: CVE-2023-2368
Published: 2023-04-28
Description: A vulnerability was found in SourceCodester Faculty Evaluation System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file index.php?page=manage_questionnaire. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227644.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://github.com/f0llow/bug_report/blob/main/vendors/oretnom23/faculty-evaluation-system/SQLi-2.md; https://vuldb.com/?ctiid.227644; https://vuldb.com/?id.227644
CVE: CVE-2023-2369
Published: 2023-04-28
Description: A vulnerability was found in SourceCodester Faculty Evaluation System 1.0. It has been rated as critical. This issue affects some unknown processing of the file admin/manage_restriction.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227645 was assigned to this vulnerability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://github.com/f0llow/bug_report/blob/main/vendors/oretnom23/faculty-evaluation-system/SQLi-3.md; https://vuldb.com/?ctiid.227645; https://vuldb.com/?id.227645
CVE: CVE-2023-30024
Published: 2023-04-28
Description: The MagicJack device, a VoIP solution for internet phone calls, contains a hidden NAND flash memory partition allowing unauthorized read/write access. Attackers can exploit this by replacing the original software with a malicious version, leading to ransomware deployment on the host computer. Affected devices have firmware versions prior to magicJack A921 USB Phone Jack Rev 3.0 V1.4.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-269, CWE-863
References: https://drive.google.com/drive/folders/1cKd8hksThK610GPtBQ3du8DEkwKywlAi?usp=sharing; https://pastebin.com/raw/irWcawp8; https://samuraisecurity.co.uk/red-teaming-0x01-click-rce-via-voip-usb/
CVE: CVE-2023-28471
Published: 2023-04-28
Description: Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS via a container name.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://concretecms.com; https://www.concretecms.org/about/project-news/security/2023-12-05-concrete-cms-new-cves-and-cve-updates; https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20
CVE: CVE-2023-28472
Published: 2023-04-28
Description: Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 does not have Secure and HTTP only attributes set for ccmPoll cookies.
CVSS Score: 5.3 (MEDIUM)
References: https://concretecms.com; https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release; https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20
CVE: CVE-2023-28473
Published: 2023-04-28
Description: Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to possible Auth bypass in the jobs section.
CVSS Score: 3.3 (LOW)
CWE: CWE-287
References: https://concretecms.com; https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release; https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20
CVE: CVE-2023-28474
Published: 2023-04-28
Description: Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Saved Presets on search.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://concretecms.com; https://www.concretecms.org/about/project-news/security/2023-12-05-concrete-cms-new-cves-and-cve-updates; https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20
CVE: CVE-2023-28475
Published: 2023-04-28
Description: Concrete CMS (previously concrete5) versions 8.5.12 and below, and versions 9.0 through 9.1.3 is vulnerable to Reflected XSS on the Reply form because msgID was not sanitized.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://concretecms.com; https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release; https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20
CVE: CVE-2023-28476
Published: 2023-04-28
Description: Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Tags on uploaded files.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://concretecms.com; https://www.concretecms.org/about/project-news/security/2023-12-05-concrete-cms-new-cves-and-cve-updates; https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20
CVE: CVE-2023-28477
Published: 2023-04-28
Description: Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to stored XSS on API Integrations via the name parameter.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://concretecms.com; https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release; https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20
CVE: CVE-2023-28819
Published: 2023-04-28
Description: Concrete CMS (previously concrete5) versions 8.5.12 and below, 9.0.0 through 9.0.2 is vulnerable to Stored XSS in uploaded file and folder names.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/concretecms/concretecms/releases; https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release; https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20
CVE: CVE-2023-28820
Published: 2023-04-28
Description: Concrete CMS (previously concrete5) before 9.1 is vulnerable to stored XSS in RSS Displayer via the href attribute because the link element input was not sanitized.
CVSS Score: 2.0 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/concretecms/concretecms/releases; https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20; https://github.com/concretecms/concretecms/releases
CVE: CVE-2023-28821
Published: 2023-04-28
Description: Concrete CMS (previously concrete5) before 9.1 did not have a rate limit for password resets.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-640, CWE-640
References: https://github.com/concretecms/concretecms/releases; https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20; https://github.com/concretecms/concretecms/releases
CVE: CVE-2023-2370
Published: 2023-04-28
Description: A vulnerability classified as critical has been found in SourceCodester Online DJ Management System 1.0. Affected is an unknown function of the file admin/events/manage_event.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-227646 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/aieouZZ/bug_report/blob/main/SQLi-1.md; https://vuldb.com/?ctiid.227646; https://vuldb.com/?id.227646
CVE: CVE-2023-2371
Published: 2023-04-28
Description: A vulnerability classified as critical was found in SourceCodester Online DJ Management System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/inquiries/view_details.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227647.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/yoyoyoyoyohane/bug_report/blob/main/SQLi-1.md; https://vuldb.com/?ctiid.227647; https://vuldb.com/?id.227647
CVE: CVE-2023-2372
Published: 2023-04-28
Description: A vulnerability, which was classified as problematic, has been found in SourceCodester Online DJ Management System 1.0. Affected by this issue is some unknown functionality of the file classes/Master.php?f=save_event. The manipulation of the argument name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227648.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/yoyoyoyoyohane/bug_report/blob/main/XSS-1.md; https://vuldb.com/?ctiid.227648; https://vuldb.com/?id.227648
CVE: CVE-2023-2373
Published: 2023-04-28
Description: A vulnerability, which was classified as critical, was found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This affects an unknown part of the component Web Management Interface. The manipulation of the argument ecn-up leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227649 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77
References: https://github.com/leetsun/IoT/tree/main/EdgeRouterX/CI/5; https://vuldb.com/?ctiid.227649; https://vuldb.com/?id.227649
CVE: CVE-2023-30123
Published: 2023-04-28
Description: wuzhicms v4.1.0 is vulnerable to Cross Site Scripting (XSS) in the Member Center, Account Settings.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/wuzhicms/wuzhicms/issues/205#issue[PII_REDACTED]; https://github.com/wuzhicms/wuzhicms/issues/205#issue[PII_REDACTED]
CVE: CVE-2023-30125
Published: 2023-04-28
Description: EyouCms V1.6.1-UTF8-sp1 is vulnerable to Cross Site Scripting (XSS).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/weng-xianhu/eyoucms/issues/40; https://github.com/weng-xianhu/eyoucms/issues/40
CVE: CVE-2023-30183
Published: 2023-04-28
Description: Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-30349. Reason: This record is a reservation duplicate of CVE-2023-30349. Notes: All CVE users should reference CVE-2023-30349 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.