deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-45602
Published: 2023-10-18
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Shopfiles Ltd Ebook Store plugin <= 5.785 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/ebook-store/wordpress-ebook-store-plugin-5-784-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ebook-store/wordpress-ebook-store-plugin-5-784-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-45604
Published: 2023-10-18
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Scott Reilly Get Custom Field Values plugin <= 4.0.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/get-custom-field-values/wordpress-get-custom-field-values-plugin-4-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/get-custom-field-values/wordpress-get-custom-field-values-plugin-4-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-45607
Published: 2023-10-18
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Hector Cabrera WordPress Popular Posts plugin <= 6.3.2 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wordpress-popular-posts/wordpress-popular-posts-plugin-6-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wordpress-popular-posts/wordpress-popular-posts-plugin-6-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-45628
Published: 2023-10-18
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in QROkes QR Twitter Widget plugin <= 0.2.3 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/qr-twitter-widget/wordpress-qr-twitter-widget-plugin-0-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/qr-twitter-widget/wordpress-qr-twitter-widget-plugin-0-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-45630
Published: 2023-10-18
Description: Unauth. Stored Cross-Site Scripting (XSS) vulnerability in wpdevart Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/gallery-album/wordpress-gallery-image-and-video-gallery-with-thumbnails-plugin-2-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/gallery-album/wordpress-gallery-image-and-video-gallery-with-thumbnails-plugin-2-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-45632
Published: 2023-10-18
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WebDorado SpiderVPlayer plugin <= 1.5.22 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/player/wordpress-spidervplayer-plugin-1-5-22-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/player/wordpress-spidervplayer-plugin-1-5-22-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-5631
Published: 2023-10-18
Description: Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker

to load arbitrary JavaScript code.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.openwall.com/lists/oss-security/2023/11/01/1; http://www.openwall.com/lists/oss-security/2023/11/01/3; http://www.openwall.com/lists/oss-security/2023/11/17/2
CVE: CVE-2023-43250
Published: 2023-10-18
Description: XNSoft Nconvert 7.136 is vulnerable to Buffer Overflow. There is a User Mode Write AV via a crafted image file. Attackers could exploit this issue for a Denial of Service (DoS) or possibly to achieve code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: http://packetstormsecurity.com/files/175145/XNSoft-Nconvert-7.136-Buffer-Overflow-Denial-Of-Service.html; http://seclists.org/fulldisclosure/2023/Oct/15; https://github.com/mrtouch93/exploits/tree/main/NConvert7.136/User%20Mode%20Write%20AV
CVE: CVE-2023-45383
Published: 2023-10-18
Description: In the module "SoNice etiquetage" (sonice_etiquetage) up to version 2.5.9 from Common-Services for PrestaShop, a guest can download personal information without restriction by performing a path traversal attack. Due to a lack of permissions control and a lack of control in the path name construction, a guest can perform a path traversal to view all files on the information system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://common-services.com/fr/home-fr/; https://security.friendsofpresta.org/modules/2023/10/17/sonice_etiquetage.html; https://common-services.com/fr/home-fr/
CVE: CVE-2023-46009
Published: 2023-10-18
Description: gifsicle-1.94 was found to have a floating point exception (FPE) vulnerability via resize_stream at src/xform.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-697
References: https://github.com/kohler/gifsicle/issues/196; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3I6Z7VAHUYX3Q4DULJ76NFD2CIFZJYH5/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3WLTXJS6AIKPGVOAJ7EYC4HL3NEG6CGF/
CVE: CVE-2023-5642
Published: 2023-10-18
Description: Advantech R-SeeNet v2.4.23 allows an unauthenticated remote attacker to read from and write to the snmpmon.ini file, which contains sensitive information.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: https://tenable.com/security/research/tra-2023-33; https://tenable.com/security/research/tra-2023-33
CVE: CVE-2023-20261
Published: 2023-10-18
Description: A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to retrieve arbitrary files from an affected system.
 This vulnerability is due to improper validation of parameters that are sent to the web UI. An attacker could exploit this vulnerability by logging in to Cisco Catalyst SD-WAN Manager and issuing crafted requests using the web UI. A successful exploit could allow the attacker to obtain arbitrary files from the underlying Linux file system of an affected system. To exploit this vulnerability, the attacker must be an authenticated user.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-lfi-OWLbKUGe; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-lfi-OWLbKUGe
CVE: CVE-2023-30911
Published: 2023-10-18
Description: HPE Integrated Lights-Out 5, and Integrated Lights-Out 6 using iLOrest may cause denial of service.
CVSS Score: 6.8 (MEDIUM)
References: https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbhf04544en_us; https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbhf04544en_us
CVE: CVE-2023-45911
Published: 2023-10-18
Description: An issue in WIPOTEC GmbH ComScale v4.3.29.21344 and v4.4.12.723 allows unauthenticated attackers to login as any user without a password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-668, CWE-668
References: https://github.com/Henkel-CyberVM/CVEs/tree/main/CVE-2023-45911; https://github.com/PostalBlab/Vulnerabilities/blob/main/ComScale/auth_bypass.txt; https://github.com/PostalBlab/Vulnerabilities/blob/main/ComScale/auth_bypass.txt
CVE: CVE-2023-45912
Published: 2023-10-18
Description: WIPOTEC GmbH ComScale v4.3.29.21344 and v4.4.12.723 fails to validate user sessions, allowing unauthenticated attackers to read files from the underlying operating system and obtain directory listings.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/Henkel-CyberVM/CVEs/tree/main/CVE-2023-45912; https://github.com/PostalBlab/Vulnerabilities/blob/main/ComScale/file_access.txt; https://github.com/PostalBlab/Vulnerabilities/blob/main/ComScale/file_access.txt
CVE: CVE-2023-26300
Published: 2023-10-18
Description: A potential security vulnerability has been identified in the system BIOS for certain HP PC products which might allow escalation of privilege. HP is releasing firmware updates to mitigate the potential vulnerability.
CVSS Score: 7.8 (HIGH)
References: https://support.hp.com/us-en/document/ish_9[PII_REDACTED]828-16; https://support.hp.com/us-en/document/ish_9[PII_REDACTED]828-16
CVE: CVE-2023-35656
Published: 2023-10-18
Description:  In multiple functions of protocolembmsadapter.cpp, there is a possible out
    of bounds read due to a missing bounds check. This could lead to remote
    information disclosure with no additional execution privileges needed. User
    interaction is not needed for exploitation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2023-10-01; https://source.android.com/security/bulletin/pixel/2023-10-01
CVE: CVE-2023-35663
Published: 2023-10-18
Description:   In Init of protocolnetadapter.cpp, there is a possible out of bounds read
    due to a missing bounds check. This could lead to remote information
    disclosure with no additional execution privileges needed. User interaction
    is not needed for exploitation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2023-10-01; https://source.android.com/security/bulletin/pixel/2023-10-01
CVE: CVE-2023-4601
Published: 2023-10-18
Description: A stack-based buffer overflow vulnerability exists in NI System Configuration that could result in information disclosure and/or arbitrary code execution. Successful exploitation requires that an attacker can provide a specially crafted response. This affects NI System Configuration 2023 Q3 and all previous versions.

CVSS Score: 8.1 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.ni.com/en/support/documentation/supplemental/23/stack-based-buffer-overflow-in-ni-system-configuration.html; https://www.ni.com/en/support/documentation/supplemental/23/stack-based-buffer-overflow-in-ni-system-configuration.html
CVE: CVE-2023-43802
Published: 2023-10-18
Description: Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/upload` which handles request with the `filename` parameter. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can escalate their privileges to those of the user running the Arduino Create Agent service via a crafted HTTP POST request. This issue has been addressed in version `1.3.3`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 7.1 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/arduino/arduino-create-agent/releases/tag/1.3.3; https://github.com/arduino/arduino-create-agent/security/advisories/GHSA-75j7-w798-cwwx; https://www.nozominetworks.com/blog/security-flaws-affect-a-component-of-the-arduino-create-cloud-ide
CVE: CVE-2023-43803
Published: 2023-10-18
Description: Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/v2/pkgs/tools/installed` and the way it handles plugin names supplied as user input. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can delete arbitrary files or folders belonging to the user that runs the Arduino Create Agent via a crafted HTTP POST request. This issue has been addressed in version `1.3.3`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/arduino/arduino-create-agent/releases/tag/1.3.3; https://github.com/arduino/arduino-create-agent/security/advisories/GHSA-m5jc-r4gf-c6p8; https://lists.debian.org/debian-lts-announce/2023/11/msg00005.html
CVE: CVE-2023-45145
Published: 2023-10-18
Description: Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask(2) is used, this creates a race condition that enables, during a short period of time, another process to establish an otherwise unauthorized connection. This problem has existed since Redis 2.6.0-RC1. This issue has been addressed in Redis versions 7.2.2, 7.0.14 and 6.2.14. Users are advised to upgrade. For users unable to upgrade, it is possible to work around the problem by disabling Unix sockets, starting Redis with a restrictive umask, or storing the Unix socket file in a protected directory.
CVSS Score: 3.6 (LOW)
CWE: CWE-668, CWE-668
References: https://github.com/redis/redis/commit/03345ddc7faf7af079485f2cbe5d17a1611cbce1; https://github.com/redis/redis/security/advisories/GHSA-ghmp-889m-7cvx; https://lists.debian.org/debian-lts-announce/2023/10/msg00032.html
CVE: CVE-2023-45813
Published: 2023-10-18
Description: Torbot is an open source tor network intelligence tool. In affected versions the `torbot.modules.validators.validate_link function` uses the python-validators URL validation regex. This particular regular expression has an exponential complexity which allows an attacker to cause an application crash using a well-crafted argument. An attacker can use a well-crafted URL argument to exploit the vulnerability in the regular expression and cause a Denial of Service on the system. The validators file has been removed in version 4.0.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-1333, CWE-1333
References: https://github.com/DedSecInside/TorBot/commit/ef6e06bc7785355b1701d5524eb[PII_REDACTED]ac4; https://github.com/DedSecInside/TorBot/security/advisories/GHSA-72qw-p7hh-m3ff; https://github.com/DedSecInside/TorBot/commit/ef6e06bc7785355b1701d5524eb[PII_REDACTED]ac4
CVE: CVE-2023-43800
Published: 2023-10-18
Description: Arduino Create Agent is a package to help manage Arduino development. The vulnerability affects the endpoint `/v2/pkgs/tools/installed`. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can escalate his privileges to those of the user running the Arduino Create Agent service via a crafted HTTP POST request. This issue has been addressed in version `1.3.3`. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 7.3 (HIGH)
CWE: CWE-345, CWE-345
References: https://github.com/arduino/arduino-create-agent/releases/tag/1.3.3; https://github.com/arduino/arduino-create-agent/security/advisories/GHSA-4x5q-q7wc-q22p; https://www.nozominetworks.com/blog/security-flaws-affect-a-component-of-the-arduino-create-cloud-ide
CVE: CVE-2023-43801
Published: 2023-10-18
Description: Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/v2/pkgs/tools/installed` and the way it handles plugin names supplied as user input. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can delete arbitrary files or folders belonging to the user that runs the Arduino Create Agent via a crafted HTTP DELETE request. This issue has been addressed in version `1.3.3`. Users are advised to upgrade. There are no known workarounds for this issue.

CVSS Score: 6.1 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/arduino/arduino-create-agent/releases/tag/1.3.3; https://github.com/arduino/arduino-create-agent/security/advisories/GHSA-mjq6-pv9c-qppq; https://www.nozominetworks.com/blog/security-flaws-affect-a-component-of-the-arduino-create-cloud-ide
CVE: CVE-2023-45146
Published: 2023-10-18
Description: XXL-RPC is a high performance, distributed RPC framework. With it, a TCP server can be set up using the Netty framework and the Hessian serialization mechanism. When such a configuration is used, attackers may be able to connect to the server and provide malicious serialized objects that, once deserialized, force it to execute arbitrary code. This can be abused to take control of the machine the server is running by way of remote code execution. This issue has not been fixed.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://securitylab.github.com/advisories/GHSL-2023-052_XXL-RPC/; https://securitylab.github.com/advisories/GHSL-2023-052_XXL-RPC/; https://www.vicarius.io/vsociety/posts/xxl-rpc-rce-cve-2023-45146
CVE: CVE-2023-45812
Published: 2023-10-18
Description: The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and terminate when a multi-part response is sent. When users send queries to the router that uses the `@defer` or Subscriptions, the Router will panic. To be vulnerable, users of Router must have a coprocessor with `coprocessor.supergraph.response` configured in their `router.yaml` and also to support either `@defer` or Subscriptions. Apollo Router version 1.33.0 has a fix for this vulnerability which was introduced in PR #4014. Users are advised to upgrade. Users unable to upgrade should avoid using the coprocessor supergraph response or disable defer and subscriptions support and continue to use the coprocessor supergraph response.
CVSS Score: 7.5 (HIGH)
CWE: CWE-754, CWE-754
References: https://github.com/apollographql/router/pull/4014; https://github.com/apollographql/router/security/advisories/GHSA-r344-xw3p-2frj; https://github.com/apollographql/router/pull/4014
CVE: CVE-2023-45814
Published: 2023-10-18
Description: Bunkum is an open-source protocol-agnostic request server for custom game servers. First, a little bit of background. So, in the beginning, Bunkum's `AuthenticationService` only supported injecting `IUser`s. However, as Refresh and SoundShapesServer implemented permissions systems support for injecting `IToken`s into endpoints was added. All was well until 4.0. Bunkum 4.0 then changed to enforce relations between `IToken`s and `IUser`s. This wasn't implemented in a very good way in the `AuthenticationService`, and ended up breaking caching in such a way that cached tokens would persist after the lifetime of the request - since we tried to cache both tokens and users. From that point until now, from what I understand, Bunkum was attempting to use that cached token at the start of the next request once cached. Naturally, when that token expired, downstream projects like Refresh would remove the object from Realm - and cause the object in the cache to be in a detached state, causing an exception from invalid use of `IToken.User`. So in other words, a use-after-free since Realm can't manage the lifetime of the cached token. Security-wise, the scope is fairly limited, can only be pulled off on a couple endpoints given a few conditions, and you can't guarantee which token you're going to get. Also, the token *would* get invalidated properly if the endpoint had either a `IToken` usage or a `IUser` usage. The fix is to just wipe the token cache after the request was handled, which is now in `4.2.1`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-772, CWE-772
References: https://github.com/LittleBigRefresh/Bunkum/commit/6e109464ed9255f558182f001f475a378405ff76; https://github.com/LittleBigRefresh/Bunkum/security/advisories/GHSA-jrf2-h5j6-3rrq; https://github.com/LittleBigRefresh/Bunkum/commit/6e109464ed9255f558182f001f475a378405ff76
CVE: CVE-2023-45958
Published: 2023-10-18
Description: Thirty Bees Core v1.4.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the backup_pagination parameter at /controller/AdminController.php. This vulnerability allows attackers to execute arbitrary JavaScript in the web browser of a user via a crafted payload.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/thirtybees/thirtybees/commit/2c99464376ad7b3c95f220163a2411e35274c3ba; https://zigrin.com/advisories/thirty-bees-reflected-cross-site-scripting-xss/; https://github.com/thirtybees/thirtybees/commit/2c99464376ad7b3c95f220163a2411e35274c3ba
CVE: CVE-2023-37502
Published: 2023-10-18
Description: HCL Compass is vulnerable to lack of file upload security.  An attacker could upload files containing active code that can be executed by the server or by a user's web browser.

CVSS Score: 9.0 (CRITICAL)
CWE: CWE-434
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0107510; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0107510
CVE: CVE-2023-45909
Published: 2023-10-18
Description: zzzcms v2.2.0 was discovered to contain an open redirect vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/Num-Nine/CVE/issues/7; https://github.com/Num-Nine/CVE/issues/7
CVE: CVE-2023-34437
Published: 2023-10-19
Description: Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05

 contains a vulnerability in their password retrieval functionality which could allow an attacker to access passwords stored on the device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732, CWE-200
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-05; https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-05
CVE: CVE-2023-34441
Published: 2023-10-19
Description: 


Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05

 contains a cleartext transmission vulnerability which could allow an attacker to 

steal the authentication secret from communication traffic to the device and reuse it for arbitrary requests.


CVSS Score: 6.8 (MEDIUM)
CWE: CWE-319, CWE-319
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-05; https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-05
CVE: CVE-2023-36857
Published: 2023-10-19
Description: 


Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05

 contains a replay vulnerability which could allow an attacker to 



replay older captured packets of traffic to the device to gain access.




CVSS Score: 5.4 (MEDIUM)
CWE: CWE-294, CWE-294
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-05; https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-05
CVE: CVE-2023-37504
Published: 2023-10-19
Description: HCL Compass is vulnerable to failure to invalidate sessions. The application does not invalidate authenticated sessions when the log out functionality is called.  If the session identifier can be discovered, it could be replayed to the application and used to impersonate the user.

CVSS Score: 7.1 (HIGH)
CWE: CWE-613
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0107511; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0107511
CVE: CVE-2023-4645
Published: 2023-10-19
Description: The Ad Inserter for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.30 via the ai_ajax function. This can allow unauthenticated attackers to extract sensitive data such as post titles and slugs (including those of protected posts along with their passwords), usernames, available roles, the plugin license key provided the remote debugging option is enabled. In the default state it is disabled.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/ad-inserter/trunk/ad-inserter.php#L6529; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2969942%40ad-inserter%2Ftags%2F2.7.31&old=2922718%40ad-inserter%2Ftrunk; https://www.wordfence.com/threat-intel/vulnerabilities/id/57b3eef3-e165-45ac-89d7-2a2a6529b310?source=cve