deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-1907
Published: 2022-05-27
Description: Buffer Over-read in GitHub repository bfabiszewski/libmobi prior to 0.11.
CVSS Score: 8.1 (HIGH)
CWE: CWE-126, CWE-125
References: https://github.com/bfabiszewski/libmobi/commit/1e0378e6f9e4ae415cedc9eb[PII_REDACTED]c5dba; https://huntr.dev/bounties/4eb0fa3e-4480-4fb5-8ec0-fbcd71de6012; https://github.com/bfabiszewski/libmobi/commit/1e0378e6f9e4ae415cedc9eb[PII_REDACTED]c5dba
CVE: CVE-2022-1908
Published: 2022-05-27
Description: Buffer Over-read in GitHub repository bfabiszewski/libmobi prior to 0.11.
CVSS Score: 8.1 (HIGH)
CWE: CWE-126, CWE-125
References: https://github.com/bfabiszewski/libmobi/commit/1e0378e6f9e4ae415cedc9eb[PII_REDACTED]c5dba; https://huntr.dev/bounties/a7436e88-0488-4bd4-816f-2e2c803e93e8; https://github.com/bfabiszewski/libmobi/commit/1e0378e6f9e4ae415cedc9eb[PII_REDACTED]c5dba
CVE: CVE-2022-1909
Published: 2022-05-27
Description: Cross-site Scripting (XSS) - Stored in GitHub repository causefx/organizr prior to 2.1.2200.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/causefx/organizr/commit/d5245cab1f4b[PII_REDACTED]266911d6ceda14858b; https://huntr.dev/bounties/8f83eb8f-51a8-41c0-bc7d-077f48faebdc; https://github.com/causefx/organizr/commit/d5245cab1f4b[PII_REDACTED]266911d6ceda14858b
CVE: CVE-2022-20666
Published: 2022-05-27
Description: Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cspc-multi-xss-tyDFjhwb; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cspc-multi-xss-tyDFjhwb
CVE: CVE-2022-20667
Published: 2022-05-27
Description: Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cspc-multi-xss-tyDFjhwb; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cspc-multi-xss-tyDFjhwb
CVE: CVE-2022-20668
Published: 2022-05-27
Description: Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cspc-multi-xss-tyDFjhwb; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cspc-multi-xss-tyDFjhwb
CVE: CVE-2022-20669
Published: 2022-05-27
Description: Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cspc-multi-xss-tyDFjhwb; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cspc-multi-xss-tyDFjhwb
CVE: CVE-2022-20670
Published: 2022-05-27
Description: Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cspc-multi-xss-tyDFjhwb; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cspc-multi-xss-tyDFjhwb
CVE: CVE-2022-20671
Published: 2022-05-27
Description: Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cspc-multi-xss-tyDFjhwb; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cspc-multi-xss-tyDFjhwb
CVE: CVE-2022-20672
Published: 2022-05-27
Description: Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cspc-multi-xss-tyDFjhwb; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cspc-multi-xss-tyDFjhwb
CVE: CVE-2022-20673
Published: 2022-05-27
Description: Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cspc-multi-xss-tyDFjhwb; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cspc-multi-xss-tyDFjhwb
CVE: CVE-2022-20674
Published: 2022-05-27
Description: Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cspc-multi-xss-tyDFjhwb; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cspc-multi-xss-tyDFjhwb
CVE: CVE-2022-20765
Published: 2022-05-27
Description: A vulnerability in the web applications of Cisco UCS Director could allow an authenticated, remote attacker to conduct a cross-site scripting attack on an affected system. This vulnerability is due to unsanitized user input. An attacker could exploit this vulnerability by submitting custom JavaScript to affected web applications. A successful exploit could allow the attacker to rewrite web page content, access sensitive information stored in the applications, and alter data by submitting forms.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-UCS-XSS-uQSME3L7; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-UCS-XSS-uQSME3L7
CVE: CVE-2022-20797
Published: 2022-05-27
Description: A vulnerability in the web-based management interface of Cisco Secure Network Analytics, formerly Cisco Stealthwatch Enterprise, could allow an authenticated, remote attacker to execute arbitrary commands as an administrator on the underlying operating system. This vulnerability is due to insufficient user input validation by the web-based management interface of the affected software. An attacker could exploit this vulnerability by injecting arbitrary commands in the web-based management interface. A successful exploit could allow the attacker to make configuration changes on the affected device or cause certain services to restart unexpectedly.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20, CWE-78
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-stealth-rce-2hYb9KFK; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-stealth-rce-2hYb9KFK
CVE: CVE-2022-20802
Published: 2022-05-27
Description: A vulnerability in the web interface of Cisco Enterprise Chat and Email (ECE) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input that is processed by the web interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected system. A successful exploit could allow the attacker to execute arbitrary code in the context of the interface or access sensitive, browser-based information. To successfully exploit this vulnerability, an attacker would need valid agent credentials.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-strd-xss-BqFXO9D2; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-strd-xss-BqFXO9D2
CVE: CVE-2022-20806
Published: 2022-05-27
Description: Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to write files or disclose sensitive information on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-filewrite-bsFVwueV; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-filewrite-bsFVwueV
CVE: CVE-2022-20807
Published: 2022-05-27
Description: Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to write files or disclose sensitive information on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-filewrite-bsFVwueV; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-filewrite-bsFVwueV
CVE: CVE-2022-1897
Published: 2022-05-27
Description: Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://seclists.org/fulldisclosure/2022/Oct/28; http://seclists.org/fulldisclosure/2022/Oct/41; https://github.com/vim/vim/commit/338f1fc0ee3ca929387448fe464579d6113fa76a
CVE: CVE-2021-27780
Published: 2022-05-27
Description: The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-112
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098028; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098028
CVE: CVE-2021-27781
Published: 2022-05-27
Description: The Master operator may be able to embed script tag in HTML with alert pop-up display cookie.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098028; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098028
CVE: CVE-2022-25878
Published: 2022-05-27
Description: The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions 2. by parsing/loading .proto files
CVSS Score: 8.2 (HIGH)
CWE: CWE-1321
References: https://github.com/protobufjs/protobuf.js/blob/d13d5d5688052e366aa2e9169f50dfca376b32cf/src/util.js%23L176-L197; https://github.com/protobufjs/protobuf.js/commit/b5f1391dff[PII_REDACTED]a6570e6d73f5511b2e8f; https://github.com/protobufjs/protobuf.js/pull/1731
CVE: CVE-2022-1927
Published: 2022-05-29
Description: Buffer Over-read in GitHub repository vim/vim prior to 8.2.
CVSS Score: 7.8 (HIGH)
CWE: CWE-126, CWE-125
References: http://seclists.org/fulldisclosure/2022/Oct/28; http://seclists.org/fulldisclosure/2022/Oct/41; https://github.com/vim/vim/commit/4d97a565ae8be0d4debba04ebd2ac3e75a0c8010
CVE: CVE-2022-1928
Published: 2022-05-29
Description: Cross-site Scripting (XSS) - Stored in GitHub repository go-gitea/gitea prior to 1.16.9.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/go-gitea/gitea/commit/65e0688a5c9dacad50e71024b7529fdf0e3c2e9c; https://huntr.dev/bounties/6336ec42-5c4d-4f61-ae38-2bb539f433d2; https://security.gentoo.org/glsa/202210-14
CVE: CVE-2022-0376
Published: 2022-05-30
Description: The User Meta WordPress plugin before 2.4.3 does not sanitise and escape the Form Name, as well as Shared Field Labels before outputting them in the admin dashboard when editing a form, which could allow high privilege users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/a3ca2ed4-11ea-4d78-aa4c-4ed58f258932; https://wpscan.com/vulnerability/a3ca2ed4-11ea-4d78-aa4c-4ed58f258932
CVE: CVE-2022-0642
Published: 2022-05-30
Description: The JivoChat Live Chat WordPress plugin before 1.3.5.4 does not properly check CSRF tokens on POST requests to the plugins admin page, and does not sanitise some parameters, leading to a stored Cross-Site Scripting vulnerability where an attacker can trick a logged in administrator to inject arbitrary javascript.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/099cf9b4-0b3a-43c6-8ca9-7c2d50f86425; https://wpscan.com/vulnerability/099cf9b4-0b3a-43c6-8ca9-7c2d50f86425
CVE: CVE-2022-1009
Published: 2022-05-30
Description: The Smush WordPress plugin before 3.9.9 does not sanitise and escape a configuration parameter before outputting it back in an admin page when uploading a malicious preset configuration, leading to a Reflected Cross-Site Scripting. For the attack to be successful, an attacker would need an admin to upload a malicious configuration file
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/bb5af08f-bb19-46a1-a7ac-8381f428c11e; https://wpscan.com/vulnerability/bb5af08f-bb19-46a1-a7ac-8381f428c11e
CVE: CVE-2022-1203
Published: 2022-05-30
Description: The Content Mask WordPress plugin before 1.8.4.1 does not have authorisation and CSRF checks in various AJAX actions, as well as does not validate the option to be updated to ensure it belongs to the plugin. As a result, any authenticated user, such as subscriber could modify arbitrary blog options
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862
References: https://wpscan.com/vulnerability/3c9969e5-ca8e-4e5d-a482-c6b5c4257820; https://wpscan.com/vulnerability/3c9969e5-ca8e-4e5d-a482-c6b5c4257820
CVE: CVE-2022-1275
Published: 2022-05-30
Description: The BannerMan WordPress plugin through 0.2.4 does not sanitize or escape its settings, which could allow high-privileged users to perform Cross-Site Scripting attacks when the unfiltered_html is disallowed (such as in multisite)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/bc2e5be3-cd2b-4ee9-8d7a-cabce46b7092; https://wpscan.com/vulnerability/bc2e5be3-cd2b-4ee9-8d7a-cabce46b7092
CVE: CVE-2022-1294
Published: 2022-05-30
Description: The IMDB info box WordPress plugin through 2.0 does not sanitize and escape some of its settings, which could allow high-privileged users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/205a24b8-6d14-4458-aecd-79748e1324c7; https://wpscan.com/vulnerability/205a24b8-6d14-4458-aecd-79748e1324c7
CVE: CVE-2022-1299
Published: 2022-05-30
Description: The Slideshow WordPress plugin through 2.3.1 does not sanitize and escape some of its default slideshow settings, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/8c46adb1-82d7-4621-a8c3-15cd90e98b96; https://wpscan.com/vulnerability/8c46adb1-82d7-4621-a8c3-15cd90e98b96
CVE: CVE-2022-1387
Published: 2022-05-30
Description: The No Future Posts WordPress plugin through 1.4 does not escape its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/48252ffb-f21c-4e2a-8f78-bdc7164e7347; https://wpscan.com/vulnerability/48252ffb-f21c-4e2a-8f78-bdc7164e7347
CVE: CVE-2022-1395
Published: 2022-05-30
Description: The Easy FAQ with Expanding Text WordPress plugin through 3.2.8.3.1 does not sanitise and escape its settings, allowing high privilege users to perform Cross-Site Scripting attacks when unfiltered_html is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/e5c06b38-fab8-44af-84dc-df94eb72ce80; https://wpscan.com/vulnerability/e5c06b38-fab8-44af-84dc-df94eb72ce80
CVE: CVE-2022-1456
Published: 2022-05-30
Description: The Poll Maker WordPress plugin before 4.0.2 does not sanitise and escape some settings, which could allow high privilege users such as admin to perform Store Cross-Site Scripting attack even when unfiltered_html is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/1f41fc5c-18d0-493d-9a7d-8b521ab49f85; https://wpscan.com/vulnerability/1f41fc5c-18d0-493d-9a7d-8b521ab49f85
CVE: CVE-2022-1527
Published: 2022-05-30
Description: The WP 2FA WordPress plugin before 2.2.1 does not sanitise and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/0260d5c0-52a9-44ce-b7be-aff642056d16; https://wpscan.com/vulnerability/0260d5c0-52a9-44ce-b7be-aff642056d16
CVE: CVE-2022-1528
Published: 2022-05-30
Description: The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.9 does not escape the current URL before putting it back in a JavaScript context, leading to a Reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/d1e59894-382f-4151-8c4c-5608f3d8ac1f; https://wpscan.com/vulnerability/d1e59894-382f-4151-8c4c-5608f3d8ac1f
CVE: CVE-2022-1542
Published: 2022-05-30
Description: The HPB Dashboard WordPress plugin through 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/40916242-df03-49a1-9a6a-9af33907e359; https://wpscan.com/vulnerability/40916242-df03-49a1-9a6a-9af33907e359
CVE: CVE-2022-1556
Published: 2022-05-30
Description: The StaffList WordPress plugin before 3.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement when searching for Staff in the admin dashboard, leading to an SQL Injection
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://packetstormsecurity.com/files/166918/; https://wpscan.com/vulnerability/04890549-6bd1-44dd-8bce-7125c01be5d4; https://packetstormsecurity.com/files/166918/
CVE: CVE-2022-1562
Published: 2022-05-30
Description: The Enable SVG WordPress plugin before 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/8e5b1e4f-c132-42ee-b2d0-7306ab4ab615; https://wpscan.com/vulnerability/8e5b1e4f-c132-42ee-b2d0-7306ab4ab615
CVE: CVE-2022-1564
Published: 2022-05-30
Description: The Form Maker by 10Web WordPress plugin before 1.14.12 does not sanitize and escape the Custom Text settings, which could allow high privilege user such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/a487c7e7-667c-4c92-a427-c43cc13b348d; https://wpscan.com/vulnerability/a487c7e7-667c-4c92-a427-c43cc13b348d