deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-38861
Published: 2023-08-15
Description: An issue in Wavlink WL_WNJ575A3 v.R75A3_V1410_220513 allows a remote attacker to execute arbitrary code via username parameter of the set_sys_adm function in adm.cgi.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/TTY-flag/my_iot_vul/tree/main/WAVLINK/WL-WN575A3; https://github.com/TTY-flag/my_iot_vul/tree/main/WAVLINK/WL-WN575A3
CVE: CVE-2023-38862
Published: 2023-08-15
Description: An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the destination parameter of sub_431F64 function in bin/webmgnt.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/TTY-flag/my_iot_vul/tree/main/COMFAST/CF-XR11/Command_Inject1; https://github.com/TTY-flag/my_iot_vul/tree/main/COMFAST/CF-XR11/Command_Inject1
CVE: CVE-2023-38863
Published: 2023-08-15
Description: An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the ifname and mac parameters in the sub_410074 function at bin/webmgnt.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/TTY-flag/my_iot_vul/tree/main/COMFAST/CF-XR11/Command_Inject4; https://github.com/TTY-flag/my_iot_vul/tree/main/COMFAST/CF-XR11/Command_Inject4
CVE: CVE-2023-38865
Published: 2023-08-15
Description: COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub_4143F0. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter timestr.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/TTY-flag/my_iot_vul/tree/main/COMFAST/CF-XR11/Command_Inject5; https://github.com/TTY-flag/my_iot_vul/tree/main/COMFAST/CF-XR11/Command_Inject5
CVE: CVE-2023-4323
Published: 2023-08-15
Description: Broadcom RAID Controller web interface is vulnerable to improper session management of active sessions on Gateway setup
CVSS Score: 9.8 (CRITICAL)
References: https://www.broadcom.com/support/resources/product-security-center; https://www.broadcom.com/support/resources/product-security-center; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html
CVE: CVE-2023-4324
Published: 2023-08-15
Description: Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP Content-Security-Policy  headers
CVSS Score: 9.8 (CRITICAL)
References: https://www.broadcom.com/support/resources/product-security-center; https://www.broadcom.com/support/resources/product-security-center; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html
CVE: CVE-2023-4325
Published: 2023-08-15
Description: Broadcom RAID Controller web interface is vulnerable due to usage of Libcurl with LSA has known vulnerabilities
CVSS Score: 9.8 (CRITICAL)
References: https://www.broadcom.com/support/resources/product-security-center; https://www.broadcom.com/support/resources/product-security-center; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html
CVE: CVE-2023-4326
Published: 2023-08-15
Description: Broadcom RAID Controller web interface is vulnerable has an insecure default TLS configuration that supports obsolete SHA1-based ciphersuites
CVSS Score: 7.5 (HIGH)
CWE: CWE-327, CWE-327
References: https://www.broadcom.com/support/resources/product-security-center; https://www.broadcom.com/support/resources/product-security-center; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html
CVE: CVE-2023-4327
Published: 2023-08-15
Description: Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data and the keys used for encryption are accessible to any local user on Linux
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-522
References: https://www.broadcom.com/support/resources/product-security-center; https://www.broadcom.com/support/resources/product-security-center; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html
CVE: CVE-2023-4328
Published: 2023-08-15
Description: Broadcom RAID Controller web interface is vulnerable  to exposure of sensitive data and the keys used for encryption are accessible to any local user on Windows
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-522
References: https://www.broadcom.com/support/resources/product-security-center; https://www.broadcom.com/support/resources/product-security-center; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html
CVE: CVE-2023-4329
Published: 2023-08-15
Description: Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard SESSIONID cookie with SameSite attribute
CVSS Score: 9.8 (CRITICAL)
References: https://www.broadcom.com/support/resources/product-security-center; https://www.broadcom.com/support/resources/product-security-center; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html
CVE: CVE-2023-4330
Published: 2023-08-15
Description: Rejected reason: Broadcom were unable to duplicate the attack as described by Intel DCG Team.
CVE: CVE-2023-4331
Published: 2023-08-15
Description: Broadcom RAID Controller web interface is vulnerable has an insecure default TLS configuration that support obsolete and vulnerable TLS protocols
CVSS Score: 7.5 (HIGH)
CWE: CWE-327, CWE-327
References: https://www.broadcom.com/support/resources/product-security-center; https://www.broadcom.com/support/resources/product-security-center; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html
CVE: CVE-2023-4332
Published: 2023-08-15
Description: Broadcom RAID Controller web interface is vulnerable due to Improper permissions on the log file
CVSS Score: 7.5 (HIGH)
CWE: CWE-732, CWE-732
References: https://www.broadcom.com/support/resources/product-security-center; https://www.broadcom.com/support/resources/product-security-center; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html
CVE: CVE-2023-4333
Published: 2023-08-15
Description: Broadcom RAID Controller web interface doesn’t enforce SSL cipher ordering by server
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-326
References: https://www.broadcom.com/support/resources/product-security-center; https://www.broadcom.com/support/resources/product-security-center; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html
CVE: CVE-2023-4334
Published: 2023-08-15
Description: Broadcom RAID Controller Web server (nginx) is serving private files without any authentication
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://www.broadcom.com/support/resources/product-security-center; https://www.broadcom.com/support/resources/product-security-center; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html
CVE: CVE-2023-4335
Published: 2023-08-15
Description: Broadcom RAID Controller Web server (nginx) is serving private server-side files without any authentication on Linux
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://www.broadcom.com/support/resources/product-security-center; https://www.broadcom.com/support/resources/product-security-center
CVE: CVE-2023-4336
Published: 2023-08-15
Description: Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard cookies with Secure attribute
CVSS Score: 9.8 (CRITICAL)
References: https://www.broadcom.com/support/resources/product-security-center; https://www.broadcom.com/support/resources/product-security-center; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html
CVE: CVE-2023-4337
Published: 2023-08-15
Description: Broadcom RAID Controller web interface is vulnerable to improper session handling of managed servers on Gateway installation
CVSS Score: 9.8 (CRITICAL)
References: https://www.broadcom.com/support/resources/product-security-center; https://www.broadcom.com/support/resources/product-security-center; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html
CVE: CVE-2023-4338
Published: 2023-08-15
Description: Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not provide X-Content-Type-Options Headers
CVSS Score: 9.8 (CRITICAL)
References: https://www.broadcom.com/support/resources/product-security-center; https://www.broadcom.com/support/resources/product-security-center; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html
CVE: CVE-2023-4339
Published: 2023-08-15
Description: Broadcom RAID Controller web interface is vulnerable to exposure of private keys used for CIM stored with insecure file permissions
CVSS Score: 7.5 (HIGH)
References: https://www.broadcom.com/support/resources/product-security-center; https://www.broadcom.com/support/resources/product-security-center; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html
CVE: CVE-2023-4340
Published: 2023-08-15
Description: Broadcom RAID Controller is vulnerable to Privilege escalation by taking advantage of the Session prints in the log file
CVSS Score: 9.8 (CRITICAL)
References: https://www.broadcom.com/support/resources/product-security-center; https://www.broadcom.com/support/resources/product-security-center; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html
CVE: CVE-2023-4341
Published: 2023-08-15
Description: Broadcom RAID Controller is vulnerable to Privilege escalation to root due to creation of insecure folders by Web GUI
CVSS Score: 9.8 (CRITICAL)
References: https://www.broadcom.com/support/resources/product-security-center; https://www.broadcom.com/support/resources/product-security-center; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html
CVE: CVE-2023-4342
Published: 2023-08-15
Description: Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP strict-transport-security  policy
CVSS Score: 9.8 (CRITICAL)
References: https://www.broadcom.com/support/resources/product-security-center; https://www.broadcom.com/support/resources/product-security-center; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html
CVE: CVE-2023-4343
Published: 2023-08-15
Description: Broadcom RAID Controller web interface is vulnerable due to exposure of sensitive password information in the URL as a URL search parameter
CVSS Score: 7.5 (HIGH)
References: https://www.broadcom.com/support/resources/product-security-center; https://www.broadcom.com/support/resources/product-security-center; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html
CVE: CVE-2023-4344
Published: 2023-08-15
Description: Broadcom RAID Controller web interface is vulnerable to insufficient randomness due to improper use of ssl.rnd to setup CIM connection
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-331, CWE-330
References: https://www.broadcom.com/support/resources/product-security-center; https://www.broadcom.com/support/resources/product-security-center; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html
CVE: CVE-2023-38864
Published: 2023-08-15
Description: An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the protal_delete_picname parameter in the sub_41171C function at bin/webmgnt.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/TTY-flag/my_iot_vul/tree/main/COMFAST/CF-XR11/Command_Inject3; https://github.com/TTY-flag/my_iot_vul/tree/main/COMFAST/CF-XR11/Command_Inject3
CVE: CVE-2023-38866
Published: 2023-08-15
Description: COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub_415588. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter interface and display_name.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/TTY-flag/my_iot_vul/tree/main/COMFAST/CF-XR11/Command_Inject2; https://github.com/TTY-flag/my_iot_vul/tree/main/COMFAST/CF-XR11/Command_Inject2
CVE: CVE-2023-39841
Published: 2023-08-15
Description: Missing encryption in the RFID tag of Etekcity 3-in-1 Smart Door Lock v1.0 allows attackers to create a cloned tag via brief physical proximity to the original device.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-311
References: https://ashallen.net/smart-security-device-rfid-vulnerability-disclosure; https://ashallen.net/smart-security-device-rfid-vulnerability-disclosure
CVE: CVE-2023-39842
Published: 2023-08-15
Description: Missing encryption in the RFID tag of Digoo DG-HAMB Smart Home Security System v1.0 allows attackers to create a cloned tag via brief physical proximity to the original device.
CVSS Score: 2.4 (LOW)
CWE: CWE-311
References: https://ashallen.net/smart-security-device-rfid-vulnerability-disclosure; https://ashallen.net/smart-security-device-rfid-vulnerability-disclosure
CVE: CVE-2023-39843
Published: 2023-08-15
Description: Missing encryption in the RFID tag of Suleve 5-in-1 Smart Door Lock v1.0 allows attackers to create a cloned tag via brief physical proximity to the original device.
CVSS Score: 2.4 (LOW)
CWE: CWE-311
References: https://ashallen.net/smart-security-device-rfid-vulnerability-disclosure; https://ashallen.net/smart-security-device-rfid-vulnerability-disclosure
CVE: CVE-2023-39848
Published: 2023-08-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-39852
Published: 2023-08-15
Description: Doctormms v1.0 was discovered to contain a SQL injection vulnerability via the $userid parameter at myAppoinment.php. NOTE: this is disputed by a third party who claims that the userid is a session variable controlled by the server, and thus cannot be used for exploitation. The original reporter counterclaims that this originates from $_SESSION["userid"]=$_POST["userid"] at line 68 in doctors\doctorlogin.php, where userid under POST is not a session variable controlled by the server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/KLSEHB/vulnerability-report/blob/main/Doctormms_CVE-2023-39852; https://www.sourcecodester.com/php/14182/doctor-appointment-system.html; https://github.com/KLSEHB/vulnerability-report/blob/main/Doctormms_CVE-2023-39852
CVE: CVE-2023-20560
Published: 2023-08-15
Description: 








Insufficient validation of the IOCTL (Input Output Control) input buffer in AMD Ryzen™ Master may allow a privileged attacker to provide a null value potentially resulting in a Windows crash leading to denial of service.











CVSS Score: 4.4 (MEDIUM)
CWE: CWE-20
References: https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-7004; https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-7004
CVE: CVE-2023-20564
Published: 2023-08-15
Description: 






Insufficient validation in the IOCTL (Input Output Control) input buffer in AMD Ryzen™ Master may permit a privileged attacker to perform memory reads/writes potentially leading to a loss of confidentiality or arbitrary kernel execution.












CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20
References: https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-7004; https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-7004
CVE: CVE-2023-39849
Published: 2023-08-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-39850
Published: 2023-08-15
Description: Schoolmate v1.3 was discovered to contain multiple SQL injection vulnerabilities via the $courseid and $teacherid parameters at DeleteFunctions.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/KLSEHB/vulnerability-report/blob/main/Schoolmate_CVE-2023-39850; https://sourceforge.net/projects/schoolmate; https://github.com/KLSEHB/vulnerability-report/blob/main/Schoolmate_CVE-2023-39850
CVE: CVE-2023-39851
Published: 2023-08-15
Description: webchess v1.0 was discovered to contain a SQL injection vulnerability via the $playerID parameter at mainmenu.php. NOTE: this is disputed by a third party who indicates that the playerID is a session variable controlled by the server, and thus cannot be used for exploitation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/KLSEHB/vulnerability-report/blob/main/webchess_CVE-2023-39851; https://sourceforge.net/projects/webchess; https://github.com/KLSEHB/vulnerability-report/blob/main/webchess_CVE-2023-39851
CVE: CVE-2023-26140
Published: 2023-08-16
Description: Versions of the package @excalidraw/excalidraw from 0.0.0 are vulnerable to Cross-site Scripting (XSS) via embedded links in whiteboard objects due to improper input sanitization.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/excalidraw/excalidraw/commit/b33fa6d6f64d27adc3a47b25c0aa55711740d0af; https://github.com/excalidraw/excalidraw/pull/6728; https://security.snyk.io/vuln/SNYK-JS-EXCALIDRAWEXCALIDRAW-5841658
CVE: CVE-2023-3958
Published: 2023-08-16
Description: The WP Remote Users Sync plugin for WordPress is vulnerable to Server Side Request Forgery via the 'notify_ping_remote' AJAX function in versions up to, and including, 1.2.12. This can allow authenticated attackers with subscriber-level permissions or above to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. This was partially patched in version 1.2.12 and fully patched in version 1.2.13.
CVSS Score: 8.5 (HIGH)
CWE: CWE-918
References: https://plugins.trac.wordpress.org/browser/wp-remote-users-sync/trunk/inc/api/class-wprus-api-abstract.php#L674; https://plugins.trac.wordpress.org/changeset/2946667/wp-remote-users-sync#file127; https://plugins.trac.wordpress.org/changeset/2953845/wp-remote-users-sync#file0
CVE: CVE-2023-4374
Published: 2023-08-16
Description: The WP Remote Users Sync plugin for WordPress is vulnerable to unauthorized access of data and addition of data due to a missing capability check on the 'refresh_logs_async' functions in versions up to, and including, 1.2.11. This makes it possible for authenticated attackers with subscriber privileges or above, to view logs.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/wp-remote-users-sync/trunk/inc/class-wprus-logger.php#L117; https://plugins.trac.wordpress.org/changeset/2946667/wp-remote-users-sync#file130; https://www.wordfence.com/threat-intel/vulnerabilities/id/2e87cfc4-8e7c-47d6-80fc-9c293cdd8acb?source=cve
CVE: CVE-2023-39507
Published: 2023-08-16
Description: Improper authorization in the custom URL scheme handler in "Rikunabi NEXT" App for Android prior to ver. 11.5.0 allows a malicious intent to lead the vulnerable App to access an arbitrary website.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-862
References: https://jvn.jp/en/jp/JVN84820712/; https://jvn.jp/en/jp/JVN84820712/
CVE: CVE-2023-30473
Published: 2023-08-16
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Maxim Glazunov YML for Yandex Market plugin <= 3.10.7 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/yml-for-yandex-market/wordpress-yml-for-yandex-market-plugin-3-10-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/yml-for-yandex-market/wordpress-yml-for-yandex-market-plugin-3-10-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-30782
Published: 2023-08-16
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Andy Moyle Church Admin plugin <= 3.7.5 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/church-admin/wordpress-church-admin-plugin-3-7-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/church-admin/wordpress-church-admin-plugin-3-7-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-30784
Published: 2023-08-16
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Kaya Studio Kaya QR Code Generator plugin <= 1.5.2 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/kaya-qr-code-generator/wordpress-kaya-qr-code-generator-plugin-1-5-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/kaya-qr-code-generator/wordpress-kaya-qr-code-generator-plugin-1-5-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-30785
Published: 2023-08-16
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Video Grid plugin <= 1.21 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/video-grid/wordpress-video-grid-plugin-1-21-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/video-grid/wordpress-video-grid-plugin-1-21-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-30786
Published: 2023-08-16
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Benjamin Guy Captcha Them All plugin <= 1.3.3 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/captcha-them-all/wordpress-captcha-them-all-plugin-1-3-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/captcha-them-all/wordpress-captcha-them-all-plugin-1-3-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-30779
Published: 2023-08-16
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Jonathan Daggerhart Query Wrangler plugin <= 1.5.51 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/query-wrangler/wordpress-query-wrangler-plugin-1-5-51-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/query-wrangler/wordpress-query-wrangler-plugin-1-5-51-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-30871
Published: 2023-08-16
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in PT Woo Plugins (by Webdados) Stock Exporter for WooCommerce plugin <= 1.1.0 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/stock-exporter-for-woocommerce/wordpress-stock-exporter-for-woocommerce-plugin-1-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/stock-exporter-for-woocommerce/wordpress-stock-exporter-for-woocommerce-plugin-1-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-4241
Published: 2023-08-16
Description: lol-html can cause panics on certain HTML inputs. Anyone processing arbitrary 3rd party HTML with the library is affected.


CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/cloudflare/lol-html/security/advisories/GHSA-c3x7-354f-4p2x; https://github.com/cloudflare/lol-html/security/advisories/GHSA-c3x7-354f-4p2x
CVE: CVE-2022-4782
Published: 2023-08-16
Description: The ClickFunnels WordPress plugin through 3.1.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/d3a0468a-8405-4b6c-800f-abd5ce5387b5; https://wpscan.com/vulnerability/d3a0468a-8405-4b6c-800f-abd5ce5387b5
CVE: CVE-2023-0058
Published: 2023-08-16
Description: The Tiempo.com WordPress plugin through 0.1.2 does not have CSRF check when creating and editing its shortcode, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/0e677df9-2c49-42f0-a8e2-dbcf85bfc1a2; https://wpscan.com/vulnerability/0e677df9-2c49-42f0-a8e2-dbcf85bfc1a2