deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-5001
Published: 2023-03-01
Description: 
IBM Financial Transaction Manager 3.2.0 through 3.2.7 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 192953.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/192953; https://www.ibm.com/support/pages/node/6958504; https://exchange.xforce.ibmcloud.com/vulnerabilities/192953
CVE: CVE-2020-5026
Published: 2023-03-01
Description: IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.2.0 through 3.2.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.  This information could be used in further attacks against the system.  IBM X-Force ID:  193662.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/193662; https://www.ibm.com/support/pages/node/6958504; https://exchange.xforce.ibmcloud.com/vulnerabilities/193662
CVE: CVE-2023-0053
Published: 2023-03-02
Description: SAUTER Controls Nova 200–220 Series with firmware version 3.3-006 and 
prior and BACnetstac version 4.2.1 and prior have only FTP and Telnet 
available for device management. Any sensitive information communicated 
through these protocols, such as credentials, is sent in cleartext. An 
attacker could obtain sensitive information such as user credentials to 
gain access to the system. 




CVSS Score: 7.5 (HIGH)
CWE: CWE-319, CWE-319
References: https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-05; https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-05
CVE: CVE-2023-22462
Published: 2023-03-02
Description: Grafana is an open-source platform for monitoring and observability. On 2023-01-01 during an internal audit of Grafana, a member of the security team found a stored XSS vulnerability affecting the core plugin "Text". The stored XSS vulnerability requires several user interactions in order to be fully exploited. The vulnerability was possible due to React's render cycle that will pass though the unsanitized HTML code, but in the next cycle the HTML is cleaned up and saved in Grafana's database. An attacker needs to have the Editor role in order to change a Text panel to include JavaScript. Another user needs to edit the same Text panel, and click on "Markdown" or "HTML" for the code to be executed. This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard. This issue has been patched in versions 9.2.10 and 9.3.4.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/grafana/grafana/commit/db83d5f398caffe35c5846cfa7727d1a2a414165; https://github.com/grafana/grafana/security/advisories/GHSA-7rqg-hjwc-6mjf; https://grafana.com/blog/2023/02/28/grafana-security-release-new-versions-with-security-fixes-for-cve-2023-0594-cve-2023-0507-and-cve-2023-22462/
CVE: CVE-2023-26046
Published: 2023-03-02
Description: teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. In teler-waf prior to version 0.1.1 is vulnerable to bypassing common web attack rules when a specific HTML entities payload is used. This vulnerability allows an attacker to execute arbitrary JavaScript code on the victim's browser and compromise the security of the web application. The vulnerability exists due to teler-waf failure to properly sanitize and filter HTML entities in user input. An attacker can exploit this vulnerability to bypass common web attack threat rules in teler-waf and launch cross-site scripting (XSS) attacks. The attacker can execute arbitrary JavaScript code on the victim's browser and steal sensitive information, such as login credentials and session tokens, or take control of the victim's browser and perform malicious actions. This issue has been fixed in version 0.1.1.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://github.com/kitabisa/teler-waf/commit/d1d49cfddfa3ec2adad962870f14b85cd1aaf739; https://github.com/kitabisa/teler-waf/releases/tag/v0.1.1; https://github.com/kitabisa/teler-waf/security/advisories/GHSA-9f95-hhg4-pg4f
CVE: CVE-2023-0196
Published: 2023-03-02
Description: 
NVIDIA CUDA Toolkit SDK contains a bug in cuobjdump, where a local user running the tool against an ill-formed binary may cause a null- pointer dereference, which may result in a limited denial of service.


CVSS Score: 3.3 (LOW)
CWE: CWE-476, CWE-476
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5446; https://nvidia.custhelp.com/app/answers/detail/a_id/5446
CVE: CVE-2023-0228
Published: 2023-03-02
Description: Improper Authentication vulnerability in ABB Symphony Plus S+ Operations.This issue affects Symphony Plus S+ Operations: from 2.X through 2.1 SP2, 2.2, from 3.X through 3.3 SP1, 3.3 SP2.


CVSS Score: 8.8 (HIGH)
CWE: CWE-287, CWE-287
References: https://search.abb.com/library/Download.aspx?DocumentID=7PAA006722&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=7PAA006722&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2023-1106
Published: 2023-03-02
Description: Cross-site Scripting (XSS) - Reflected in GitHub repository flatpressblog/flatpress prior to 1.3.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/flatpressblog/flatpress/commit/5f23b4c2eac294cc0ba5e541f83a6f8a26f9fed1; https://huntr.dev/bounties/1288ec00-f69d-4b84-abce-efc9a97941a0; https://github.com/flatpressblog/flatpress/commit/5f23b4c2eac294cc0ba5e541f83a6f8a26f9fed1
CVE: CVE-2023-1107
Published: 2023-03-02
Description: Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/flatpressblog/flatpress/commit/d3f329496536dc99f9707f2f295d571d65a496f5; https://huntr.dev/bounties/4b880868-bd28-4fd0-af56-7686e55d3762; https://github.com/flatpressblog/flatpress/commit/d3f329496536dc99f9707f2f295d571d65a496f5
CVE: CVE-2023-1146
Published: 2023-03-02
Description: Cross-site Scripting (XSS) - Generic in GitHub repository flatpressblog/flatpress prior to 1.3.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/flatpressblog/flatpress/commit/0ee4f2e8a7b9276880b56858e408cc9c6643cc3b; https://huntr.dev/bounties/d6d1e1e2-2f67-4d28-aa84-b30fb1d2e737; https://github.com/flatpressblog/flatpress/commit/0ee4f2e8a7b9276880b56858e408cc9c6643cc3b
CVE: CVE-2023-1147
Published: 2023-03-02
Description: Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/flatpressblog/flatpress/commit/264217f318a8852c4f3e34350d4a0e1363cdd727; https://huntr.dev/bounties/187f5353-f866-4d26-a5ba-fca378520020; https://github.com/flatpressblog/flatpress/commit/264217f318a8852c4f3e34350d4a0e1363cdd727
CVE: CVE-2023-1148
Published: 2023-03-02
Description: Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/flatpressblog/flatpress/commit/3a32aad0dec5df24c6576d7567d4f2eadbfc75de; https://huntr.dev/bounties/f0cc2c4b-fdf9-483b-9a83-4e0dfeb4dac7; https://github.com/flatpressblog/flatpress/commit/3a32aad0dec5df24c6576d7567d4f2eadbfc75de
CVE: CVE-2023-25155
Published: 2023-03-02
Description: Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SRANDMEMBER`, `ZRANDMEMBER`, and `HRANDFIELD` commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process. This problem affects all Redis versions. Patches were released in Redis version(s) 6.0.18, 6.2.11 and 7.0.9.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://github.com/redis/redis/commit/2a2a582e7cd99ba3b531336b8bd41df2b566e619; https://github.com/redis/redis/releases/tag/6.0.18; https://github.com/redis/redis/releases/tag/6.2.11
CVE: CVE-2023-25806
Published: 2023-03-02
Description: OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. There is an observable discrepancy in the authentication response time between calls where the user provided exists and calls where it does not. This issue only affects calls using the internal basic identity provider (IdP), and not other externally configured IdPs. Patches were released in versions 1.3.9 and 2.6.0, there are no workarounds.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-208, CWE-203
References: https://github.com/opensearch-project/security/security/advisories/GHSA-c6wg-cm5x-rqvj; https://github.com/opensearch-project/security/security/advisories/GHSA-c6wg-cm5x-rqvj
CVE: CVE-2023-26053
Published: 2023-03-02
Description: Gradle is a build tool with a focus on build automation and support for multi-language development. This is a collision attack on long IDs (64bits) for PGP keys. Users of dependency verification in Gradle are vulnerable if they use long IDs for PGP keys in a `trusted-key` or `pgp` element in their dependency verification metadata file. The fix is to fail dependency verification if anything but a fingerprint is used in a trust element in dependency verification metadata. The problem is fixed in Gradle 8.0 and above. The problem is also patched in Gradle 6.9.4 and 7.6.1. As a workaround, use only full fingerprint IDs for `trusted-key` or `pgp` element in the metadata is a protection against this issue.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-829, CWE-829
References: https://github.com/gradle/gradle/commit/bf3cc0f2b463033037e67aaacda31291643ea1a9; https://github.com/gradle/gradle/security/advisories/GHSA-c724-3xg7-g3hf; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-1149
Published: 2023-03-02
Description: Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.8.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-76
References: https://github.com/btcpayserver/btcpayserver/commit/ddb125f45892b4dafdbd5c072af1ce623758bb92; https://huntr.dev/bounties/2e734209-d7b0-4f57-a8be-c65c82208f2f; https://github.com/btcpayserver/btcpayserver/commit/ddb125f45892b4dafdbd5c072af1ce623758bb92
CVE: CVE-2023-1151
Published: 2023-03-02
Description: A vulnerability was found in SourceCodester Electronic Medical Records System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file administrator.php of the component Cookie Handler. The manipulation of the argument userid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-222163.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/lcg-22266/bug_report/blob/main/vendors/Patrick%20Mvuma/Electronic%20Medical%20Records%20System/SQLi-1.md; https://vuldb.com/?ctiid.222163; https://vuldb.com/?id.222163
CVE: CVE-2021-45477
Published: 2023-03-02
Description: Improper Handling of Parameters vulnerability in Bordam Information Technologies Library Automation System allows Collect Data as Provided by Users.This issue affects Library Automation System: before 19.2.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-233
References: https://www.usom.gov.tr/bildirim/tr-23-0119; https://www.usom.gov.tr/bildirim/tr-23-0119
CVE: CVE-2021-45478
Published: 2023-03-02
Description: Improper Handling of Parameters vulnerability in Bordam Information Technologies Library Automation System allows Collect Data as Provided by Users.This issue affects Library Automation System: before 19.2.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-233
References: https://www.usom.gov.tr/bildirim/tr-23-0119; https://www.usom.gov.tr/bildirim/tr-23-0119
CVE: CVE-2021-45479
Published: 2023-03-02
Description: Improper Neutralization of Input During Web Page Generation vulnerability in Yordam Information Technologies Library Automation System allows Stored XSS.This issue affects Library Automation System: before 19.2.


CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.usom.gov.tr/bildirim/tr-23-0119; https://www.usom.gov.tr/bildirim/tr-23-0119
CVE: CVE-2021-3854
Published: 2023-03-02
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Glox Technology Useroam Hotspot allows SQL Injection. This issue affects Useroam Hotspot: before 5.1.0.15.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0120; https://www.usom.gov.tr/bildirim/tr-23-0120
CVE: CVE-2023-25358
Published: 2023-03-02
Description: A use-after-free vulnerability in WebCore::RenderLayer::addChild in WebKitGTK before 2.36.8 allows attackers to execute code remotely.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: http://www.openwall.com/lists/oss-security/2023/04/21/3; https://bugs.webkit.org/show_bug.cgi?id=242683; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5OKKVEUQAAGH3NHMX3WHWKRPYU4QFKTQ/
CVE: CVE-2023-25360
Published: 2023-03-02
Description: A use-after-free vulnerability in WebCore::RenderLayer::renderer in WebKitGTK before 2.36.8 allows attackers to execute code remotely.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: http://www.openwall.com/lists/oss-security/2023/04/21/3; https://bugs.webkit.org/show_bug.cgi?id=242686; https://security.gentoo.org/glsa/202305-32
CVE: CVE-2023-25361
Published: 2023-03-02
Description: A use-after-free vulnerability in WebCore::RenderLayer::setNextSibling in WebKitGTK before 2.36.8 allows attackers to execute code remotely.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: http://www.openwall.com/lists/oss-security/2023/04/21/3; https://bugs.webkit.org/show_bug.cgi?id=244249; https://security.gentoo.org/glsa/202305-32
CVE: CVE-2023-25362
Published: 2023-03-02
Description: A use-after-free vulnerability in WebCore::RenderLayer::repaintBlockSelectionGaps in WebKitGTK before 2.36.8 allows attackers to execute code remotely.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.openwall.com/lists/oss-security/2023/04/21/3; https://bugs.webkit.org/show_bug.cgi?id=244802; https://security.gentoo.org/glsa/202305-32
CVE: CVE-2023-25363
Published: 2023-03-02
Description: A use-after-free vulnerability in WebCore::RenderLayer::updateDescendantDependentFlags in WebKitGTK before 2.36.8 allows attackers to execute code remotely.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.openwall.com/lists/oss-security/2023/04/21/3; https://bugs.webkit.org/show_bug.cgi?id=242684; https://security.gentoo.org/glsa/202305-32
CVE: CVE-2023-25536
Published: 2023-03-02
Description: 
Dell PowerScale OneFS 9.4.0.x contains exposure of sensitive information to an unauthorized actor. A malicious authenticated local user could potentially exploit this vulnerability in certificate management, leading to a potential system takeover.


CVSS Score: 6.7 (MEDIUM)
CWE: CWE-200, CWE-668
References: https://www.dell.com/support/kbdoc/en-us/000209895/dell-emc-powerscale-onefs-security-updates-for-multiple-security; https://www.dell.com/support/kbdoc/en-us/000209895/dell-emc-powerscale-onefs-security-updates-for-multiple-security
CVE: CVE-2023-26780
Published: 2023-03-02
Description: CleverStupidDog yf-exam v 1.8.0 is vulnerable to SQL Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/CleverStupidDog/yf-exam/issues/4; https://github.com/Fw-fW-fw/UPDATE-CVE/blob/main/CVE-2023-26780; https://github.com/CleverStupidDog/yf-exam/issues/4
CVE: CVE-2023-0085
Published: 2023-03-02
Description: The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to reCaptcha Bypass in versions up to, and including, 3.2.1. This is due to insufficient server side checking on the captcha value submitted during a form submission. This makes it possible for unauthenticated attackers to bypass Captcha restrictions and for attackers to utilize bots to submit forms.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-693
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2868889%40metform&new=2868889%40metform&sfp_email=&sfph_mail=; https://wordpress.org/plugins/metform/; https://www.wordfence.com/threat-intel/vulnerabilities/id/69527d4b-49b6-47cd-93b6-39350f881ec9?source=cve
CVE: CVE-2022-38734
Published: 2023-03-02
Description: StorageGRID (formerly StorageGRID Webscale) versions prior to 11.6.0.8 are susceptible to a Denial of Service (DoS) vulnerability. A successful exploit could lead to to a crash of the Local Distribution Router (LDR) service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-1118
Published: 2023-03-02
Description: A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the way user detaching rc device. A local user could use this flaw to crash the system or potentially escalate their privileges on the system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://github.com/torvalds/linux/commit/29b0589a865b6f66d141d79b2dd1373e4e50fe17; https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html; https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html
CVE: CVE-2023-1155
Published: 2023-03-02
Description: The Cost Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the nd_cc_meta_box_cc_price_icon parameter in versions up to, and including, 1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/nd-projects/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/750be90d-dc12-4974-8921-75259d56c7b3?source=cve; https://wordpress.org/plugins/nd-projects/#developers
CVE: CVE-2023-26477
Published: 2023-03-02
Description: XWiki Platform is a generic wiki platform. Starting in versions 6.3-rc-1 and 6.2.4, it's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the `newThemeName` request parameter (URL parameter), in combination with additional parameters. This has been patched in the supported versions 13.10.10, 14.9-rc-1, and 14.4.6. As a workaround, it is possible to edit `FlamingoThemesCode.WebHomeSheet` and manually perform the changes from the patch fixing the issue.

CVSS Score: 10.0 (CRITICAL)
CWE: CWE-95, CWE-94
References: https://github.com/xwiki/xwiki-platform/commit/ea2e615f50a918802fd60b09ec87aa04bc6ea8e2#diff-e2153fa59f9d92ef67b0afbf27984bd17170921a3b558fac227160003d0dfd2aR283-R284; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-x2qm-r4wx-8gpg; https://jira.xwiki.org/browse/XWIKI-19757
CVE: CVE-2023-26478
Published: 2023-03-02
Description: XWiki Platform is a generic wiki platform. Starting in version 14.3-rc-1, `org.xwiki.store.script.TemporaryAttachmentsScriptService#uploadTemporaryAttachment` returns an instance of `com.xpn.xwiki.doc.XWikiAttachment`. This class is not supported to be exposed to users without the `programing` right.
`com.xpn.xwiki.api.Attachment` should be used instead and takes case of checking the user's rights before performing dangerous operations. This has been patched in versions 14.9-rc-1 and 14.4.6. There are no known workarounds for this issue.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-749
References: https://github.com/xwiki/xwiki-platform/commit/3c73c59e39b6436b1074d8834cf[PII_REDACTED]14d; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-8692-g6g9-gm5p; https://jira.xwiki.org/browse/XWIKI-20180
CVE: CVE-2023-26479
Published: 2023-03-02
Description: XWiki Platform is a generic wiki platform. Starting in version 6.0, users with write rights can insert well-formed content that is not handled well by the parser. As a consequence, some pages becomes unusable, including the user index (if the page containing the faulty content is a user page) and the page index.

Note that on the page, the normal UI is completely missing and it is not possible to open the editor directly to revert the change as the stack overflow is already triggered while getting the title of the document. This means that it is quite difficult to remove this content once inserted.

This has been patched in XWiki 13.10.10, 14.4.6, and 14.9-rc-1. A temporary workaround to avoid Stack Overflow errors is to increase the memory allocated to the stack by using the `-Xss` JVM parameter (e.g., `-Xss32m`). This should allow the parser to pass and to fix the faulty content. The consequences for other aspects of the system (e.g., performance) are unknown, and this workaround should be only be used as a temporary solution. The workaround does not prevent the issue occurring again with other content. Consequently, it is strongly advised to upgrade to a version where the issue has been patched.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-755, CWE-755
References: https://github.com/xwiki/xwiki-platform/commit/e5b82cd[PII_REDACTED]6a468b8f7fe6396dce142a7; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-52vf-hvv3-98h7; https://jira.xwiki.org/browse/XWIKI-19838
CVE: CVE-2023-26480
Published: 2023-03-02
Description: XWiki Platform is a generic wiki platform. Starting in version 12.10, a user without script rights can introduce a stored cross-site scripting by using the Live Data macro. This has been patched in XWiki 14.9, 14.4.7, and 13.10.10. There are no known workarounds.

CVSS Score: 8.9 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/xwiki/xwiki-platform/commit/23d5ea9b23e84b5f3d1f1b2d5673fe8c774d0d79; https://github.com/xwiki/xwiki-platform/commit/556e7823260b826f344c1a6e95d935774587e028; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-32fq-m2q5-h83g
CVE: CVE-2021-4328
Published: 2023-03-02
Description: A vulnerability has been found in 狮子鱼CMS and classified as critical. Affected by this vulnerability is the function goods_detail of the file ApiController.class.php. The manipulation of the argument goods_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The associated identifier of this vulnerability is VDB-222223.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://hammerking.top/index.php/archives/104/; https://vuldb.com/?ctiid.222223; https://vuldb.com/?id.222223
CVE: CVE-2023-0084
Published: 2023-03-02
Description: The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via text areas on forms in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, which is the submissions page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2845078%40metform&new=2845078%40metform&sfp_email=&sfph_mail=; https://wordpress.org/plugins/metform/#description; https://www.wordfence.com/blog/2023/02/high-severity-xss-vulnerability-in-metform-elementor-contact-form-builder/