deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-32741
Published: 2023-11-04
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in IT Path Solutions PVT LTD Contact Form to Any API allows SQL Injection.This issue affects Contact Form to Any API: from n/a through 1.1.2.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89, CWE-89
References: http://packetstormsecurity.com/files/175654/WordPress-Contact-Form-To-Any-API-1.1.2-SQL-Injection.html; https://patchstack.com/database/vulnerability/contact-form-to-any-api/wordpress-contact-form-to-any-api-plugin-1-1-2-sql-injection-vulnerability?_s_id=cve; http://packetstormsecurity.com/files/175654/WordPress-Contact-Form-To-Any-API-1.1.2-SQL-Injection.html
CVE: CVE-2023-35910
Published: 2023-11-04
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nucleus_genius Quasar form free – Contact Form Builder for WordPress allows SQL Injection.This issue affects Quasar form free – Contact Form Builder for WordPress: from n/a through 6.0.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/quasar-form/wordpress-quasar-form-plugin-6-0-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/quasar-form/wordpress-quasar-form-plugin-6-0-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2023-38391
Published: 2023-11-04
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themesgrove Onepage Builder allows SQL Injection.This issue affects Onepage Builder: from n/a through 2.4.1.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/tx-onepager/wordpress-onepage-builder-easiest-landing-page-builder-for-wordpress-plugin-2-4-1-sql-injection?_s_id=cve; https://patchstack.com/database/vulnerability/tx-onepager/wordpress-onepage-builder-easiest-landing-page-builder-for-wordpress-plugin-2-4-1-sql-injection?_s_id=cve
CVE: CVE-2023-40215
Published: 2023-11-04
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Demonisblack demon image annotation allows SQL Injection.This issue affects demon image annotation: from n/a through 5.1.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/demon-image-annotation/wordpress-demon-image-annotation-plugin-5-1-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/demon-image-annotation/wordpress-demon-image-annotation-plugin-5-1-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2023-40922
Published: 2023-11-04
Description: kerawen before v2.5.1 was discovered to contain a SQL injection vulnerability via the ocs_id_cart parameter at KerawenDeliveryModuleFrontController::initContent().
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://security.friendsofpresta.org/modules/2023/11/02/kerawen.html; https://security.friendsofpresta.org/modules/2023/11/02/kerawen.html
CVE: CVE-2023-46380
Published: 2023-11-04
Description: LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) send password-change requests via cleartext HTTP.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319, CWE-319
References: http://packetstormsecurity.com/files/175646/LOYTEC-Electronics-Insecure-Transit-Insecure-Permissions-Unauthenticated-Access.html; https://seclists.org/fulldisclosure/2023/Nov/0; https://www.cisa.gov/news-events/ics-advisories/icsa-24-247-01
CVE: CVE-2023-46381
Published: 2023-11-04
Description: LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) lack authentication for the preinstalled version of LWEB-802 via an lweb802_pre/ URI. An unauthenticated attacker can edit any project (or create a new project) and control its GUI.
CVSS Score: 8.2 (HIGH)
CWE: CWE-306
References: http://packetstormsecurity.com/files/175646/LOYTEC-Electronics-Insecure-Transit-Insecure-Permissions-Unauthenticated-Access.html; https://seclists.org/fulldisclosure/2023/Nov/0; https://www.cisa.gov/news-events/ics-advisories/icsa-24-247-01
CVE: CVE-2023-46382
Published: 2023-11-04
Description: LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) use cleartext HTTP for login.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: http://packetstormsecurity.com/files/175646/LOYTEC-Electronics-Insecure-Transit-Insecure-Permissions-Unauthenticated-Access.html; https://seclists.org/fulldisclosure/2023/Nov/0; https://www.cisa.gov/news-events/ics-advisories/icsa-24-247-01
CVE: CVE-2023-46963
Published: 2023-11-04
Description: An issue in Beijing Yunfan Internet Technology Co., Ltd, Yunfan Learning Examination System v.6.5 allows a remote attacker to obtain sensitive information via the password parameter in the login function.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: https://github.com/NBSLclass/glassfish/blob/main/Proof-of-vulnerability.md; https://github.com/NBSLclass/glassfish/blob/main/Proof-of-vulnerability.md
CVE: CVE-2023-46964
Published: 2023-11-05
Description: Cross Site Scripting (XSS) vulnerability in Hillstone Next Generation FireWall SG-6000-e3960 v.5.5 allows a remote attacker to execute arbitrary code via the use front-end filtering instead of back-end filtering.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://foremost-smash-52a.notion.site/Hillstone-Next-Generation-FireWall-XSS-CVE-2023-46964-6cf1fe91e7ed4795adb1d89d75030d16; https://foremost-smash-52a.notion.site/Hillstone-Next-Generation-FireWall-XSS-CVE-2023-46964-6cf1fe91e7ed4795adb1d89d75030d16
CVE: CVE-2023-46981
Published: 2023-11-05
Description: SQL injection vulnerability in Novel-Plus v.4.2.0 allows a remote attacker to execute arbitrary code via a crafted script to the sort parameter in /common/log/list.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/JunFengDeng/Cve-List/blob/main/novel-plus/20231027/vuln/readme.md; https://github.com/JunFengDeng/Cve-List/blob/main/novel-plus/20231027/vuln/readme.md
CVE: CVE-2023-47249
Published: 2023-11-05
Description: In International Color Consortium DemoIccMAX 79ecb74, a CIccXmlArrayType:::ParseText function (for unsigned short) in IccUtilXml.cpp in libIccXML.a has an out-of-bounds read.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/InternationalColorConsortium/DemoIccMAX/issues/54; https://github.com/InternationalColorConsortium/DemoIccMAX/issues/54
CVE: CVE-2023-47258
Published: 2023-11-05
Description: Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS in a Markdown formatter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.redmine.org/projects/redmine/wiki/Security_Advisories; https://www.redmine.org/projects/redmine/wiki/Security_Advisories
CVE: CVE-2023-47259
Published: 2023-11-05
Description: Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS in the Textile formatter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.redmine.org/projects/redmine/wiki/Security_Advisories; https://www.redmine.org/projects/redmine/wiki/Security_Advisories
CVE: CVE-2023-47260
Published: 2023-11-05
Description: Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS via thumbnails.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.redmine.org/projects/redmine/wiki/Security_Advisories; https://www.redmine.org/projects/redmine/wiki/Security_Advisories
CVE: CVE-2017-20187
Published: 2023-11-05
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Magnesium-PHP up to 0.3.0. It has been classified as problematic. Affected is the function formatEmailString of the file src/Magnesium/Message/Base.php. The manipulation of the argument email/name leads to injection. Upgrading to version 0.3.1 is able to address this issue. The patch is identified as 500d340e1f[PII_REDACTED]cc08a[PII_REDACTED]c2604. It is recommended to upgrade the affected component. VDB-244482 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 3.5 (LOW)
CWE: CWE-74
References: https://github.com/floriangaerber/Magnesium-PHP/commit/500d340e1f[PII_REDACTED]cc08a[PII_REDACTED]c2604; https://github.com/floriangaerber/Magnesium-PHP/releases/tag/v0.3.1; https://vuldb.com/?ctiid.244482
CVE: CVE-2018-25092
Published: 2023-11-05
Description: A vulnerability was found in Vaerys-Dawn DiscordSailv2 up to 2.10.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Command Mention Handler. The manipulation leads to improper access controls. Upgrading to version 2.10.3 is able to address this issue. The patch is named cc12e0be82a5d05d9f359ed8e56088f4f8b8eb69. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-244483.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: https://github.com/Vaerys-Dawn/DiscordSailv2/commit/cc12e0be82a5d05d9f359ed8e56088f4f8b8eb69; https://github.com/Vaerys-Dawn/DiscordSailv2/releases/tag/2.10.3; https://vuldb.com/?ctiid.244483
CVE: CVE-2023-47271
Published: 2023-11-06
Description: PKP-WAL (aka PKP Web Application Library or pkp-lib) before 3.3.0-16, as used in Open Journal Systems (OJS) and other products, does not verify that the file named in an XML document (used for the native import/export plugin) is an image file, before trying to use it for an issue cover image.
CVSS Score: 5.3 (MEDIUM)
References: http://packetstormsecurity.com/files/176255/PKP-WAL-3.4.0-3-Remote-Code-Execution.html; http://seclists.org/fulldisclosure/2023/Dec/23; https://github.com/pkp/pkp-lib/issues/9464
CVE: CVE-2023-47272
Published: 2023-11-06
Description: Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header (used for attachment preview or download).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/roundcube/roundcubemail/commit/5ec496885e18ec6af956e8c0d627856c2257ba2d; https://github.com/roundcube/roundcubemail/releases/tag/1.5.6; https://github.com/roundcube/roundcubemail/releases/tag/1.6.5
CVE: CVE-2018-25093
Published: 2023-11-06
Description: A vulnerability was found in Vaerys-Dawn DiscordSailv2 up to 2.10.2. It has been rated as critical. Affected by this issue is some unknown functionality of the component Tag Handler. The manipulation leads to improper access controls. Upgrading to version 2.10.3 is able to address this issue. The name of the patch is cc12e0be82a5d05d9f359ed8e56088f4f8b8eb69. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-244484.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: https://github.com/Vaerys-Dawn/DiscordSailv2/commit/cc12e0be82a5d05d9f359ed8e56088f4f8b8eb69; https://github.com/Vaerys-Dawn/DiscordSailv2/releases/tag/2.10.3; https://vuldb.com/?ctiid.244484
CVE: CVE-2023-46802
Published: 2023-11-06
Description: e-Tax software Version3.0.10 and earlier improperly restricts XML external entity references (XXE) due to the configuration of the embedded XML parser. By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611
References: https://jvn.jp/en/jp/JVN14762986/; https://www.e-tax.nta.go.jp/topics/topics_20231102.htm; https://jvn.jp/en/jp/JVN14762986/
CVE: CVE-2023-20702
Published: 2023-11-06
Description: In 5G NRLC, there is a possible invalid memory access due to lack of error handling. This could lead to remote denial of service, if UE received invalid 1-byte rlc sdu, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY00921261; Issue ID: MOLY01128895.
CVSS Score: 7.5 (HIGH)
References: https://corp.mediatek.com/product-security-bulletin/November-2023; https://corp.mediatek.com/product-security-bulletin/November-2023
CVE: CVE-2023-32818
Published: 2023-11-06
Description: In vdec, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08163896 & ALPS08013430; Issue ID: ALPS07867715.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-843, CWE-843
References: https://corp.mediatek.com/product-security-bulletin/November-2023; https://corp.mediatek.com/product-security-bulletin/November-2023
CVE: CVE-2023-32825
Published: 2023-11-06
Description: In bluethooth service, there is a possible out of bounds reads due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07884130; Issue ID: ALPS07884130.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/November-2023; https://corp.mediatek.com/product-security-bulletin/November-2023
CVE: CVE-2023-32832
Published: 2023-11-06
Description: In video, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08235273; Issue ID: ALPS08235273.
CVSS Score: 7.0 (HIGH)
CWE: CWE-787, CWE-787
References: http://packetstormsecurity.com/files/175662/Android-mtk_jpeg-Driver-Race-Condition-Privilege-Escalation.html; https://corp.mediatek.com/product-security-bulletin/November-2023; http://packetstormsecurity.com/files/175662/Android-mtk_jpeg-Driver-Race-Condition-Privilege-Escalation.html
CVE: CVE-2023-32834
Published: 2023-11-06
Description: In secmem, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08161762; Issue ID: ALPS08161762.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-843, CWE-843
References: https://corp.mediatek.com/product-security-bulletin/November-2023; https://corp.mediatek.com/product-security-bulletin/November-2023
CVE: CVE-2023-32835
Published: 2023-11-06
Description: In keyinstall, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08157918; Issue ID: ALPS08157918.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-843, CWE-843
References: https://corp.mediatek.com/product-security-bulletin/November-2023; https://corp.mediatek.com/product-security-bulletin/November-2023
CVE: CVE-2023-32836
Published: 2023-11-06
Description: In display, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08126725; Issue ID: ALPS08126725.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/November-2023; https://corp.mediatek.com/product-security-bulletin/November-2023
CVE: CVE-2023-32837
Published: 2023-11-06
Description: In video, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08235273; Issue ID: ALPS08250357.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://packetstormsecurity.com/files/175665/mtk-jpeg-Driver-Out-Of-Bounds-Read-Write.html; https://corp.mediatek.com/product-security-bulletin/November-2023; http://packetstormsecurity.com/files/175665/mtk-jpeg-Driver-Out-Of-Bounds-Read-Write.html
CVE: CVE-2023-32838
Published: 2023-11-06
Description: In dpe, there is a possible out of bounds write due to a missing valid range checking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07310805; Issue ID: ALPS07310805.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/November-2023; https://corp.mediatek.com/product-security-bulletin/November-2023
CVE: CVE-2023-32839
Published: 2023-11-06
Description: In dpe, there is a possible out of bounds write due to a missing valid range checking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07262576; Issue ID: ALPS07262576.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/November-2023; https://corp.mediatek.com/product-security-bulletin/November-2023
CVE: CVE-2023-32840
Published: 2023-11-06
Description: In modem CCCI, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction may be also needed for exploitation Patch ID: MOLY01138425; Issue ID: MOLY01138425 (MSV-862).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/November-2023; https://corp.mediatek.com/product-security-bulletin/November-2023
CVE: CVE-2023-4625
Published: 2023-11-06
Description: Improper Restriction of Excessive Authentication Attempts vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F/iQ-R Series CPU modules Web server function allows a remote unauthenticated attacker to prevent legitimate users from logging into the Web server function for a certain period after the attacker has attempted to log in illegally by continuously attempting unauthorized login to the Web server function. The impact of this vulnerability will persist while the attacker continues to attempt unauthorized login.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-307, CWE-307
References: https://jvn.jp/vu/JVNVU94620134; https://www.cisa.gov/news-events/ics-advisories/icsa-23-306-02; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-014_en.pdf
CVE: CVE-2023-38406
Published: 2023-11-06
Description: bgpd/bgp_flowspec.c in FRRouting (FRR) before 8.4.3 mishandles an nlri length of zero, aka a "flowspec overflow."
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-755
References: https://github.com/FRRouting/frr/compare/frr-8.4.2...frr-8.4.3; https://github.com/FRRouting/frr/pull/12884; https://lists.debian.org/debian-lts-announce/2024/04/msg00019.html
CVE: CVE-2023-38407
Published: 2023-11-06
Description: bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during labeled unicast parsing.
CVSS Score: 7.5 (HIGH)
References: https://github.com/FRRouting/frr/compare/frr-8.5-rc...frr-8.5; https://github.com/FRRouting/frr/pull/12951; https://github.com/FRRouting/frr/pull/12956
CVE: CVE-2023-47253
Published: 2023-11-06
Description: Qualitor through 8.20 allows remote attackers to execute arbitrary code via PHP code in the html/ad/adpesquisasql/request/processVariavel.php gridValoresPopHidden parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://openxp.xpsec.co/blog/cve-2023-47253; https://www.linkedin.com/in/hairrison-wenning-4631a4124/; https://www.linkedin.com/in/xvinicius/
CVE: CVE-2023-4699
Published: 2023-11-06
Description: Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation MELSEC-F Series CPU modules, MELSEC iQ-F Series, MELSEC iQ-R series CPU modules, MELSEC iQ-R series, MELSEC iQ-L series, MELSEC Q series, MELSEC-L series, Mitsubishi Electric CNC M800V/M80V series, Mitsubishi Electric CNC M800/M80/E80 series and Mitsubishi Electric CNC M700V/M70V/E70 series allows a remote unauthenticated attacker to execute arbitrary commands by sending specific packets to the affected products. This could lead to disclose or tamper with information by reading or writing control programs, or cause a denial-of-service (DoS) condition on the products by resetting the memory contents of the products to factory settings or resetting the products remotely.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-306, CWE-345
References: https://jvn.jp/vu/JVNVU94620134/; https://www.cisa.gov/news-events/ics-advisories/icsa-23-306-03; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-013_en.pdf
CVE: CVE-2023-42669
Published: 2023-11-06
Description: A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. This vulnerability stems from an RPC function that can be blocked indefinitely. The issue arises because the "rpcecho" service operates with only one worker in the main RPC task, allowing calls to the "rpcecho" server to be blocked for a specified time, causing service disruptions. This disruption is triggered by a "sleep()" call in the "dcesrv_echo_TestSleep()" function under specific conditions. Authenticated users or attackers can exploit this vulnerability to make calls to the "rpcecho" server, requesting it to block for a specified duration, effectively disrupting most services and leading to a complete denial of service on the AD DC. The DoS affects all other services as "rpcecho" runs in the main RPC task.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://access.redhat.com/errata/RHSA-2023:6209; https://access.redhat.com/errata/RHSA-2023:6744; https://access.redhat.com/errata/RHSA-2023:7371
CVE: CVE-2021-4430
Published: 2023-11-06
Description: A vulnerability classified as problematic has been found in Ortus Solutions ColdBox Elixir 3.1.6. This affects an unknown part of the file src/defaultConfig.js of the component ENV Variable Handler. The manipulation leads to information disclosure. Upgrading to version 3.1.7 is able to address this issue. The identifier of the patch is a3aa62daea2e44c76d08d1eac63768cd928cd69e. It is recommended to upgrade the affected component. The identifier VDB-244485 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: https://github.com/Ortus-Solutions/coldbox-elixir/commit/a3aa62daea2e44c76d08d1eac63768cd928cd69e; https://github.com/Ortus-Solutions/coldbox-elixir/releases/tag/v3.1.7; https://vuldb.com/?ctiid.244485
CVE: CVE-2022-45373
Published: 2023-11-06
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jason Crouse, VeronaLabs Slimstat Analytics allows SQL Injection.This issue affects Slimstat Analytics: from n/a through 5.0.4.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/wp-slimstat/wordpress-slimstat-analytics-plugin-5-0-4-sql-injection-sqli-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-slimstat/wordpress-slimstat-analytics-plugin-5-0-4-sql-injection-sqli-vulnerability?_s_id=cve
CVE: CVE-2022-46849
Published: 2023-11-06
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Weblizar Coming Soon Page – Responsive Coming Soon & Maintenance Mode allows SQL Injection.This issue affects Coming Soon Page – Responsive Coming Soon & Maintenance Mode: from n/a through 1.5.9.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/responsive-coming-soon-page/wordpress-coming-soon-page-plugin-1-5-8-sql-injection-sqli-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/responsive-coming-soon-page/wordpress-coming-soon-page-plugin-1-5-8-sql-injection-sqli-vulnerability?_s_id=cve
CVE: CVE-2022-46860
Published: 2023-11-06
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in KaizenCoders Short URL allows SQL Injection.This issue affects Short URL: from n/a through 1.6.4.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/shorten-url/wordpress-short-url-plugin-1-6-4-sql-injection?_s_id=cve; https://patchstack.com/database/vulnerability/shorten-url/wordpress-short-url-plugin-1-6-4-sql-injection?_s_id=cve