deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-1953
Published: 2019-08-08
Description: A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to view a password in clear text. The vulnerability is due to incorrectly logging the admin password when a user is forced to modify the default password when logging in to the web portal for the first time. Subsequent password changes are not logged and other accounts are not affected. An attacker could exploit this vulnerability by viewing the admin clear text password and using it to access the affected system. The attacker would need a valid user account to exploit this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-nfv-pwrecov; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-nfv-pwrecov
CVE: CVE-2019-1954
Published: 2019-08-08
Description: A vulnerability in the web-based management interface of Cisco Webex Meetings Server Software could allow an unauthenticated, remote attacker to redirect a user to an undesired web page. The vulnerability is due to improper input validation of the URL parameters in an HTTP request that is sent to an affected device. An attacker could exploit this vulnerability by crafting an HTTP request that could cause the web application to redirect the request to a specified malicious URL. A successful exploit could allow the attacker to redirect a user to a malicious website.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-20
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-wms-oredirect; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-wms-oredirect
CVE: CVE-2019-1955
Published: 2019-08-08
Description: A vulnerability in the Sender Policy Framework (SPF) functionality of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an unauthenticated, remote attacker to bypass configured user filters on the device. The vulnerability is due to incomplete input and validation checking mechanisms for certain SPF messages that are sent to an affected device. An attacker could exploit this vulnerability by sending a customized SPF packet to an affected device. A successful exploit could allow the attacker to bypass the header filters that are configured for the affected device, which could allow malicious content to pass through the device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-esm-inject; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-esm-inject
CVE: CVE-2019-1956
Published: 2019-08-08
Description: A vulnerability in the web-based interface of the Cisco SPA112 2-Port Phone Adapter could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against another user of the device. The vulnerability is due to insufficient validation of user-supplied input by the web-based interface of the affected device. An attacker could exploit this vulnerability by inserting malicious code in one of the configuration fields. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-spa112-xss; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-spa112-xss
CVE: CVE-2019-1957
Published: 2019-08-08
Description: A vulnerability in the web interface of Cisco IoT Field Network Director could allow an unauthenticated, remote attacker to trigger high CPU usage, resulting in a denial of service (DoS) condition on an affected device. The vulnerability is due to improper handling of Transport Layer Security (TLS) renegotiation requests. An attacker could exploit this vulnerability by sending renegotiation requests at a high rate. A successful exploit could increase the resource usage on the system, eventually leading to a DoS condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-fnd-dos; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-fnd-dos
CVE: CVE-2019-1958
Published: 2019-08-08
Description: A vulnerability in the web-based management interface of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web UI on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-hypflex-csrf; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-hypflex-csrf
CVE: CVE-2019-1959
Published: 2019-08-08
Description: Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to read arbitrary files on the underlying operating system (OS) of an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-20, CWE-78
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-nfv-read; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-nfv-read
CVE: CVE-2019-1960
Published: 2019-08-08
Description: Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to read arbitrary files on the underlying operating system (OS) of an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-20, CWE-78
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-nfv-read; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-nfv-read
CVE: CVE-2019-1961
Published: 2019-08-08
Description: A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system (OS) of an affected device. The vulnerability is due to the improper input validation of tar packages uploaded through the Web Portal to the Image Repository. An attacker could exploit this vulnerability by uploading a crafted tar package and viewing the log entries that are generated. A successful exploit could allow the attacker to read arbitrary files on the underlying OS.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-532, CWE-20
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-nfv-fileread; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-nfv-fileread
CVE: CVE-2019-1970
Published: 2019-08-08
Description: A vulnerability in the Secure Sockets Layer (SSL)/Transport Layer Security (TLS) protocol inspection engine of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass the configured file policies on an affected system. The vulnerability is due to errors when handling specific SSL/TLS messages. An attacker could exploit this vulnerability by sending crafted HTTP packets that would flow through an affected system. A successful exploit could allow the attacker to bypass the configured file policies and deliver a malicious payload to the protected network.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-693, CWE-693
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-ftd-bypass; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-ftd-bypass
CVE: CVE-2019-1971
Published: 2019-08-08
Description: A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to perform a command injection attack and execute arbitrary commands with root privileges. The vulnerability is due to insufficient input validation by the web portal framework. An attacker could exploit this vulnerability by providing malicious input during web portal authentication. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the underlying operating system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-20
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-nfv-commandinj; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-nfv-commandinj
CVE: CVE-2019-1972
Published: 2019-08-08
Description: A vulnerability the Cisco Enterprise NFV Infrastructure Software (NFVIS) restricted CLI could allow an authenticated, local attacker with valid administrator-level credentials to elevate privileges and execute arbitrary commands on the underlying operating system as root. The vulnerability is due to insufficient restrictions during the execution of an affected CLI command. An attacker could exploit this vulnerability by leveraging the insufficient restrictions during the execution of an affected command. A successful exploit could allow the attacker to elevate privileges and execute arbitrary commands on the underlying operating system as root.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-264
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-nfv-privescal; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-nfv-privescal
CVE: CVE-2019-1973
Published: 2019-08-08
Description: A vulnerability in the web portal framework of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface. The vulnerability is due to improper input validation of log file content stored on the affected device. An attacker could exploit this vulnerability by modifying a log file with malicious code and getting a user to view the modified log file. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or to access sensitive, browser-based information.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-nfv-xss; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-nfv-xss
CVE: CVE-2016-10864
Published: 2019-08-08
Description: NETGEAR EX7000 V1.0.0.42_1.0.94 devices allow XSS via the SSID.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-79
References: https://www.pentestpartners.com/security-blog/netgear-ex7000-wi-fi-range-extender-minor-xss-and-poor-password-handling/; https://www.pentestpartners.com/security-blog/netgear-ex7000-wi-fi-range-extender-minor-xss-and-poor-password-handling/
CVE: CVE-2018-19855
Published: 2019-08-08
Description: UiPath Orchestrator before 2018.3.4 allows CSV Injection, related to the Audit export, Robot log export, and Transaction log export features.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-1236
References: https://www.uipath.com/product/release-notes; https://www2.deloitte.com/de/de/pages/risk/articles/uipath-orchestrator-csv-injection.html; https://www.uipath.com/product/release-notes
CVE: CVE-2019-13101
Published: 2019-08-08
Description: An issue was discovered on D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices. wan.htm can be accessed directly without authentication, which can lead to disclosure of information about the WAN, and can also be leveraged by an attacker to modify the data fields of the page.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: http://packetstormsecurity.com/files/153994/D-Link-DIR-600M-Wireless-N-150-Home-Router-Access-Bypass.html; http://seclists.org/fulldisclosure/2019/Aug/5; https://github.com/d0x0/D-Link-DIR-600M/blob/master/CVE-2019-13101
CVE: CVE-2019-14221
Published: 2019-08-08
Description: 1CRM On-Premise Software 8.5.7 allows XSS via a payload that is mishandled during a Run Report operation.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/cccaaasser/1CRM-CVE/blob/master/CVE-2019-14221.md; https://www.exploit-db.com/exploits/47206; https://github.com/cccaaasser/1CRM-CVE/blob/master/CVE-2019-14221.md
CVE: CVE-2019-14255
Published: 2019-08-08
Description: A Server Side Request Forgery (SSRF) vulnerability in go-camo up to version 1.1.4 allows a remote attacker to perform HTTP requests to internal endpoints.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://github.com/cactus/go-camo/security/advisories/GHSA-xrmp-4542-q746; https://github.com/cactus/go-camo/security/advisories/GHSA-xrmp-4542-q746
CVE: CVE-2019-14754
Published: 2019-08-08
Description: Open-School 3.0, and Community Edition 2.3, allows SQL Injection via the index.php?r=students/students/document id parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://open-school.org; https://pastebin.com/xuZN5rJR; https://open-school.org
CVE: CVE-2019-14772
Published: 2019-08-08
Description: verdaccio before 3.12.0 allows XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/verdaccio/verdaccio/security/advisories/GHSA-78j5-gcmf-vqc8; https://github.com/verdaccio/verdaccio/security/advisories/GHSA-78j5-gcmf-vqc8
CVE: CVE-2019-13176
Published: 2019-08-08
Description: An issue was discovered in the 3CX Phone system (web) management console 12.5.44178.1002 through 12.5 SP2. The Content.MainForm.wgx component is affected by XXE via a crafted XML document in POST data. There is potential to use this for SSRF (reading local files, outbound HTTP, and outbound DNS).
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://www.logicallysecure.com/blog/3cx-phone-system-web-console-affected-by-xxe/; https://www.logicallysecure.com/blog/3cx-phone-system-web-console-affected-by-xxe/
CVE: CVE-2019-14335
Published: 2019-08-08
Description: An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is post-authenticated denial of service leading to the reboot of the AP via the admin.cgi?action=%s URI.
CVSS Score: 5.5 (MEDIUM)
References: http://packetstormsecurity.com/files/153840/D-Link-6600-AP-XSS-DoS-Information-Disclosure.html; https://www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdf; http://packetstormsecurity.com/files/153840/D-Link-6600-AP-XSS-DoS-Information-Disclosure.html
CVE: CVE-2019-11208
Published: 2019-08-08
Description: The authorization component of TIBCO Software Inc.'s TIBCO API Exchange Gateway, and TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric contains a vulnerability that theoretically processes OAuth authorization incorrectly, leading to potential escalation of privileges for the specific customer endpoint, when the implementation uses multiple scopes. This issue affects: TIBCO Software Inc.'s TIBCO API Exchange Gateway version 2.3.1 and prior versions, and TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric version 2.3.1 and prior versions.
CVSS Score: 9.9 (CRITICAL)
References: http://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2019/08/tibco-security-advisory-august-7-2019-tibco-api-exchange; http://www.tibco.com/services/support/advisories
CVE: CVE-2019-5236
Published: 2019-08-08
Description: Huawei smart phones Emily-L29C with versions of 8.1.0.132a(C432), 8.1.0.135(C782), 8.1.0.154(C10), 8.1.0.154(C461), 8.1.0.154(C635), 8.1.0.156(C185), 8.1.0.156(C605), 8.1.0.159(C636) have a double free vulnerability. An attacker can trick a user to click a URL to exploit this vulnerability. Successful exploitation may cause the affected phone abnormal.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-415
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190807-01-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190807-01-smartphone-en
CVE: CVE-2019-5237
Published: 2019-08-08
Description: Huawei PCManager with the versions before 9.0.1.66 (Oversea) and versions before 9.0.1.70 (China) have a code execution vulnerability. Successful exploitation may cause the attacker to execute code and read/write information.
CVSS Score: 7.8 (HIGH)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190710-01-pcmanager-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190710-01-pcmanager-en
CVE: CVE-2019-5238
Published: 2019-08-08
Description: Huawei PCManager with the versions before 9.0.1.66 (Oversea) and versions before 9.0.1.70 (China) have a code execution vulnerability. Successful exploitation may cause the attacker to execute code and read/write information.
CVSS Score: 7.8 (HIGH)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190710-01-pcmanager-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190710-01-pcmanager-en
CVE: CVE-2019-5239
Published: 2019-08-08
Description: Huawei PCManager with the versions before 9.0.1.66 (Oversea) and versions before 9.0.1.70 (China) have an information leak vulnerability. Successful exploitation may cause the attacker to read information.
CVSS Score: 5.5 (MEDIUM)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190710-01-pcmanager-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190710-01-pcmanager-en
CVE: CVE-2019-5301
Published: 2019-08-08
Description: Huawei smart phones Honor V20 with the versions before 9.0.1.161(C00E161R2P2) have an information leak vulnerability. An attacker may trick a user into installing a malicious application. Due to coding error during layer information processing, attackers can exploit this vulnerability to obtain some layer information.
CVSS Score: 3.3 (LOW)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190807-01-mobile-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190807-01-mobile-en
CVE: CVE-2019-12397
Published: 2019-08-08
Description: Policy import functionality in Apache Ranger 0.7.0 to 1.2.0 is vulnerable to a cross-site scripting issue. Upgrade to 2.0.0 or later version of Apache Ranger with the fix.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2019/08/08/1; https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger; https://lists.apache.org/thread.html/ab2de1adad96f5dbd19d976b28715dfc60dbe75e82a74f48be8ef695%40%3Cdev.ranger.apache.org%3E
CVE: CVE-2019-12959
Published: 2019-08-08
Description: Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer 6.2.0 and before for the ClientUtilServlet servlet via a URL in a parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-918
References: https://excellium-services.com/cert-xlm-advisory/cve-2019-12959/; https://excellium-services.com/cert-xlm-advisory/cve-2019-12959/
CVE: CVE-2019-12994
Published: 2019-08-08
Description: Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer version 6.2.0 for the AJaxServlet servlet via a parameter in a URL.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-918
References: https://www.excellium-services.com/cert-xlm-advisory/CVE-2019-12994; https://www.excellium-services.com/cert-xlm-advisory/CVE-2019-12994
CVE: CVE-2019-14693
Published: 2019-08-08
Description: Zoho ManageEngine AssetExplorer 6.2.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing license XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
CVSS Score: 8.5 (HIGH)
CWE: CWE-611
References: https://www.excellium-services.com/cert-xlm-advisory/cve-2019-14693; https://www.excellium-services.com/cert-xlm-advisory/cve-2019-14693
CVE: CVE-2019-14353
Published: 2019-08-08
Description: On Trezor One devices before 1.8.2, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover confidential secrets such as the PIN and BIP39 mnemonic. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data. NOTE: this CVE applies exclusively to the Trezor One, and does not refer to any issues with OLED displays on other devices.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-203
References: https://blog.trezor.io/details-of-the-oled-vulnerability-and-its-mitigation-d331c4e2001a; https://blog.trezor.io/details-of-the-oled-vulnerability-and-its-mitigation-d331c4e2001a
CVE: CVE-2018-20962
Published: 2019-08-08
Description: The Backpack\CRUD Backpack component before 3.4.9 for Laravel allows XSS via the select field type.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Laravel-Backpack/CRUD/blob/master/CHANGELOG.md; https://github.com/Laravel-Backpack/CRUD/commit/8b6bd0a2d489a4690f6b1d7ace67e2f07f5f0cc6; https://github.com/Laravel-Backpack/CRUD/compare/3.4.8...3.4.9
CVE: CVE-2019-14679
Published: 2019-08-08
Description: core/views/arprice_import_export.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arplite_import_export CSRF.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wordpress.org/plugins/arprice-responsive-pricing-table/#developers; https://www.pluginvulnerabilities.com/2019/07/11/cross-site-request-forgery-csrf-vulnerability-in-arprice-lite/; https://wordpress.org/plugins/arprice-responsive-pricing-table/#developers
CVE: CVE-2019-14680
Published: 2019-08-08
Description: The admin-renamer-extended (aka Admin renamer extended) plugin 3.2.1 for WordPress allows wp-admin/plugins.php?page=admin-renamer-extended/admin.php CSRF.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-352
References: https://wpvulndb.com/vulnerabilities/9551; https://www.pluginvulnerabilities.com/2019/06/24/cross-site-request-forgery-csrf-vulnerability-in-admin-renamer-extended/; https://wpvulndb.com/vulnerabilities/9551
CVE: CVE-2019-14681
Published: 2019-08-08
Description: The Deny All Firewall plugin before 1.1.7 for WordPress allows wp-admin/options-general.php?page=daf_settings&daf_remove=true CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/deny-all-firewall/#developers; https://www.pluginvulnerabilities.com/2019/06/21/cross-site-request-forgery-csrf-vulnerability-in-deny-all-firewall/; https://wordpress.org/plugins/deny-all-firewall/#developers
CVE: CVE-2019-14682
Published: 2019-08-08
Description: The acf-better-search (aka ACF: Better Search) plugin before 3.3.1 for WordPress allows wp-admin/options-general.php?page=acfbs_admin_page CSRF.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wordpress.org/plugins/acf-better-search/#developers; https://wpvulndb.com/vulnerabilities/9399; https://www.pluginvulnerabilities.com/2019/06/26/cross-site-request-forgery-csrf-settings-change-vulnerability-in-acf-better-search/