deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-28233
Published: 2021-08-27
Description: Heap-based Buffer Overflow vulnerability exists in ok-file-formats 1 via the ok_jpg_generate_huffman_table function in ok_jpg.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/brackeen/ok-file-formats/issues/11; https://github.com/brackeen/ok-file-formats/issues/11
CVE: CVE-2021-28694
Published: 2021-08-27
Description: IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Both AMD and Intel allow ACPI tables to specify regions of memory which should be left untranslated, which typically means these addresses should pass the translation phase unaltered. While these are typically device specific ACPI properties, they can also be specified to apply to a range of devices, or even all devices. On all systems with such regions Xen failed to prevent guests from undoing/replacing such mappings (CVE-2021-28694). On AMD systems, where a discontinuous range is specified by firmware, the supposedly-excluded middle range will also be identity-mapped (CVE-2021-28695). Further, on AMD systems, upon de-assigment of a physical device from a guest, the identity mappings would be left in place, allowing a guest continued access to ranges of memory which it shouldn't have access to anymore (CVE-2021-28696).
CVSS Score: 6.8 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2021/09/01/1; http://www.openwall.com/lists/oss-security/2021/09/01/5; http://www.openwall.com/lists/oss-security/2021/09/01/6
CVE: CVE-2021-28695
Published: 2021-08-27
Description: IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Both AMD and Intel allow ACPI tables to specify regions of memory which should be left untranslated, which typically means these addresses should pass the translation phase unaltered. While these are typically device specific ACPI properties, they can also be specified to apply to a range of devices, or even all devices. On all systems with such regions Xen failed to prevent guests from undoing/replacing such mappings (CVE-2021-28694). On AMD systems, where a discontinuous range is specified by firmware, the supposedly-excluded middle range will also be identity-mapped (CVE-2021-28695). Further, on AMD systems, upon de-assigment of a physical device from a guest, the identity mappings would be left in place, allowing a guest continued access to ranges of memory which it shouldn't have access to anymore (CVE-2021-28696).
CVSS Score: 6.8 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2021/09/01/1; http://www.openwall.com/lists/oss-security/2021/09/01/5; http://www.openwall.com/lists/oss-security/2021/09/01/6
CVE: CVE-2021-28696
Published: 2021-08-27
Description: IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Both AMD and Intel allow ACPI tables to specify regions of memory which should be left untranslated, which typically means these addresses should pass the translation phase unaltered. While these are typically device specific ACPI properties, they can also be specified to apply to a range of devices, or even all devices. On all systems with such regions Xen failed to prevent guests from undoing/replacing such mappings (CVE-2021-28694). On AMD systems, where a discontinuous range is specified by firmware, the supposedly-excluded middle range will also be identity-mapped (CVE-2021-28695). Further, on AMD systems, upon de-assigment of a physical device from a guest, the identity mappings would be left in place, allowing a guest continued access to ranges of memory which it shouldn't have access to anymore (CVE-2021-28696).
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-863
References: http://www.openwall.com/lists/oss-security/2021/09/01/1; http://www.openwall.com/lists/oss-security/2021/09/01/5; http://www.openwall.com/lists/oss-security/2021/09/01/6
CVE: CVE-2021-28697
Published: 2021-08-27
Description: grant table v2 status pages may remain accessible after de-allocation Guest get permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, get de-allocated when a guest switched (back) from v2 to v1. The freeing of such pages requires that the hypervisor know where in the guest these pages were mapped. The hypervisor tracks only one use within guest space, but racing requests from the guest to insert mappings of these pages may result in any of them to become mapped in multiple locations. Upon switching back from v2 to v1, the guest would then retain access to a page that was freed and perhaps re-used for other purposes.
CVSS Score: 7.8 (HIGH)
CWE: CWE-362
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2VQCFAPBNGBBAOMJZG6QBREOG5IIDZID/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FZCNPSRPGFCQRYE2BI4D4Q4SCE56ANV2/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LPRVHW4J4ZCPPOHZEWP5MOJT7XDGFFPJ/
CVE: CVE-2021-28698
Published: 2021-08-27
Description: long running loops in grant table handling In order to properly monitor resource use, Xen maintains information on the grant mappings a domain may create to map grants offered by other domains. In the process of carrying out certain actions, Xen would iterate over all such entries, including ones which aren't in use anymore and some which may have been created but never used. If the number of entries for a given domain is large enough, this iterating of the entire table may tie up a CPU for too long, starving other domains or causing issues in the hypervisor itself. Note that a domain may map its own grants, i.e. there is no need for multiple domains to be involved here. A pair of "cooperating" guests may, however, cause the effects to be more severe.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: http://www.openwall.com/lists/oss-security/2021/09/01/2; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2VQCFAPBNGBBAOMJZG6QBREOG5IIDZID/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FZCNPSRPGFCQRYE2BI4D4Q4SCE56ANV2/
CVE: CVE-2021-28699
Published: 2021-08-27
Description: inadequate grant-v2 status frames array bounds check The v2 grant table interface separates grant attributes from grant status. That is, when operating in this mode, a guest has two tables. As a result, guests also need to be able to retrieve the addresses that the new status tracking table can be accessed through. For 32-bit guests on x86, translation of requests has to occur because the interface structure layouts commonly differ between 32- and 64-bit. The translation of the request to obtain the frame numbers of the grant status table involves translating the resulting array of frame numbers. Since the space used to carry out the translation is limited, the translation layer tells the core function the capacity of the array within translation space. Unfortunately the core function then only enforces array bounds to be below 8 times the specified value, and would write past the available space if enough frame numbers needed storing.
CVSS Score: 5.5 (MEDIUM)
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2VQCFAPBNGBBAOMJZG6QBREOG5IIDZID/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FZCNPSRPGFCQRYE2BI4D4Q4SCE56ANV2/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LPRVHW4J4ZCPPOHZEWP5MOJT7XDGFFPJ/
CVE: CVE-2021-28700
Published: 2021-08-27
Description: xen/arm: No memory limit for dom0less domUs The dom0less feature allows an administrator to create multiple unprivileged domains directly from Xen. Unfortunately, the memory limit from them is not set. This allow a domain to allocate memory beyond what an administrator originally configured.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-770
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2VQCFAPBNGBBAOMJZG6QBREOG5IIDZID/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FZCNPSRPGFCQRYE2BI4D4Q4SCE56ANV2/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LPRVHW4J4ZCPPOHZEWP5MOJT7XDGFFPJ/
CVE: CVE-2021-3264
Published: 2021-08-27
Description: SQL Injection vulnerability in cxuucms 3.1 ivia the pid parameter in public/admin.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/cbkhwx/cxuucmsv3/issues/6; https://github.com/cbkhwx/cxuucmsv3/issues/6
CVE: CVE-2020-18106
Published: 2021-08-27
Description: The GET parameter "id" in WMS v1.0 is passed without filtering, which allows attackers to perform SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/FeMiner/wms/issues/7; https://github.com/FeMiner/wms/issues/7
CVE: CVE-2020-18114
Published: 2021-08-27
Description: An arbitrary file upload vulnerability in the /uploads/dede component of DedeCMS V5.7SP2 allows attackers to upload a webshell in HTM format.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://blog.csdn.net/qq_36093477/article/details/86681178; https://blog.csdn.net/qq_36093477/article/details/86681178
CVE: CVE-2020-18116
Published: 2021-08-27
Description: A lack of filtering for searched keywords in the search bar of YouDianCMS 8.0 allows attackers to perform SQL injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://blog.csdn.net/qq_36093477/article/details/98035255; https://blog.csdn.net/qq_36093477/article/details/98035255
CVE: CVE-2021-32759
Published: 2021-08-27
Description: OpenMage magento-lts is an alternative to the Magento CE official releases. Due to missing sanitation in data flow in versions prior to 19.4.15 and 20.0.13, it was possible for admin users to upload arbitrary executable files to the server. OpenMage versions 19.4.15 and 20.0.13 have a patch for this Issue.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20, CWE-20
References: https://github.com/OpenMage/magento-lts/releases/tag/v19.4.15; https://github.com/OpenMage/magento-lts/releases/tag/v20.0.13; https://github.com/OpenMage/magento-lts/security/advisories/GHSA-xm9f-vxmx-4m58
CVE: CVE-2021-39171
Published: 2021-08-27
Description: Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. Prior to version 3.1.0, a malicious SAML payload can require transforms that consume significant system resources to process, thereby resulting in reduced or denied service. This would be an effective way to perform a denial-of-service attack. This has been resolved in version 3.1.0. The resolution is to limit the number of allowable transforms to 2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://github.com/node-saml/passport-saml/pull/595; https://github.com/node-saml/passport-saml/security/advisories/GHSA-5379-r78w-42h2; https://github.com/node-saml/passport-saml/pull/595
CVE: CVE-2021-39172
Published: 2021-08-27
Description: Cachet is an open source status page system. Prior to version 2.5.1, authenticated users, regardless of their privileges (User or Admin), can exploit a new line injection in the configuration edition feature (e.g. mail settings) and gain arbitrary code execution on the server. This issue was addressed in version 2.5.1 by improving `UpdateConfigCommandHandler` and preventing the use of new lines characters in new configuration values. As a workaround, only allow trusted source IP addresses to access to the administration dashboard.
CVSS Score: 8.8 (HIGH)
CWE: CWE-93
References: https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injection/; https://github.com/fiveai/Cachet/releases/tag/v2.5.1; https://github.com/fiveai/Cachet/security/advisories/GHSA-9jxw-cfrh-jxq6
CVE: CVE-2021-39173
Published: 2021-08-27
Description: Cachet is an open source status page system. Prior to version 2.5.1 authenticated users, regardless of their privileges (User or Admin), can trick Cachet and install the instance again, leading to arbitrary code execution on the server. This issue was addressed in version 2.5.1 by improving the middleware `ReadyForUse`, which now performs a stricter validation of the instance name. As a workaround, only allow trusted source IP addresses to access to the administration dashboard.
CVSS Score: 8.8 (HIGH)
CWE: CWE-704, CWE-704
References: https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injection/; https://github.com/fiveai/Cachet/releases/tag/v2.5.1; https://github.com/fiveai/Cachet/security/advisories/GHSA-r67m-m8c7-jp83
CVE: CVE-2021-39174
Published: 2021-08-28
Description: Cachet is an open source status page system. Prior to version 2.5.1, authenticated users, regardless of their privileges (User or Admin), can leak the value of any configuration entry of the dotenv file, e.g. the application secret (`APP_KEY`) and various passwords (email, database, etc). This issue was addressed in version 2.5.1 by improving `UpdateConfigCommandHandler` and preventing the use of nested variables in the resulting dotenv configuration file. As a workaround, only allow trusted source IP addresses to access to the administration dashboard.
CVSS Score: 8.8 (HIGH)
CWE: CWE-75
References: https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injection/; https://github.com/fiveai/Cachet/releases/tag/v2.5.1; https://github.com/fiveai/Cachet/security/advisories/GHSA-88f9-7xxh-c688
CVE: CVE-2021-38154
Published: 2021-08-29
Description: Certain Canon devices manufactured in 2012 through 2020 (such as imageRUNNER ADVANCE iR-ADV C5250), when Catwalk Server is enabled for HTTP access, allow remote attackers to modify an e-mail address setting, and thus cause the device to send sensitive information through e-mail to the attacker. For example, an incoming FAX may be sent through e-mail to the attacker. This occurs when a PIN is not required for General User Mode, as exploited in the wild in August 2021.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732
References: https://protocolpolice.nl/CVE-2021-38154_Protocol_Police_Catwalk_Alert; https://www.usa.canon.com/internet/portal/us/home/support/product-advisories; https://protocolpolice.nl/CVE-2021-38154_Protocol_Police_Catwalk_Alert
CVE: CVE-2021-40172
Published: 2021-08-29
Description: Zoho ManageEngine Log360 before Build 5219 allows a CSRF attack on proxy settings.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.manageengine.com/log-management/readme.html#Build%205219; https://www.manageengine.com/log-management/readme.html#Build%205219
CVE: CVE-2021-40173
Published: 2021-08-29
Description: Zoho ManageEngine Cloud Security Plus before Build 4117 allows a CSRF attack on the server proxy settings.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.manageengine.com/cloud-security/release-notes.html#build%204117; https://www.manageengine.com/cloud-security/release-notes.html#build%204117
CVE: CVE-2021-40174
Published: 2021-08-29
Description: Zoho ManageEngine Log360 before Build 5224 allows a CSRF attack for disabling the logon security settings.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.manageengine.com/log-management/readme.html#Build%205224; https://www.manageengine.com/log-management/readme.html#Build%205224
CVE: CVE-2021-40175
Published: 2021-08-29
Description: Zoho ManageEngine Log360 before Build 5219 allows unrestricted file upload with resultant remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.manageengine.com/log-management/readme.html#Build%205219; https://www.manageengine.com/log-management/readme.html#Build%205219
CVE: CVE-2021-40176
Published: 2021-08-29
Description: Zoho ManageEngine Log360 before Build 5225 allows stored XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.manageengine.com/log-management/readme.html#Build%205225; https://www.manageengine.com/log-management/readme.html#Build%205225
CVE: CVE-2021-40177
Published: 2021-08-29
Description: Zoho ManageEngine Log360 before Build 5225 allows remote code execution via BCP file overwrite.
CVSS Score: 9.8 (CRITICAL)
References: https://www.manageengine.com/log-management/readme.html#Build%205225; https://www.manageengine.com/log-management/readme.html#Build%205225
CVE: CVE-2021-40178
Published: 2021-08-29
Description: Zoho ManageEngine Log360 before Build 5224 allows stored XSS via the LOGO_PATH key value in the logon settings.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.manageengine.com/log-management/readme.html#Build%205224; https://www.manageengine.com/log-management/readme.html#Build%205224
CVE: CVE-2021-37749
Published: 2021-08-30
Description: MapService.svc in Hexagon GeoMedia WebMap 2020 before Update 2 (aka 16.6.2.66) allows blind SQL Injection via the Id (within sourceItems) parameter to the GetMap method.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://download.hexagongeospatial.com/en/downloads/webgis/geomedia-webmap-2020-update-2; https://www.hexagongeospatial.com/products/power-portfolio/geomedia-webmap; https://www.silentgrid.com/blog/cve-2021-37749-hexagon-geomedia-webmap-2020-blind-sql-injection/
CVE: CVE-2021-36359
Published: 2021-08-30
Description: OrbiTeam BSCW Classic before 7.4.3 allows exportpdf authenticated remote code execution (RCE) via XML tag injection because reportlab\platypus\paraparser.py (reached via bscw.cgi op=_editfolder.EditFolder) calls eval on attacker-supplied Python code. This is fixed in 5.0.12, 5.1.10, 5.2.4, 7.3.3, and 7.4.3.
CVSS Score: 8.8 (HIGH)
CWE: CWE-91
References: http://packetstormsecurity.com/files/163988/BSCW-Server-XML-Injection.html; http://seclists.org/fulldisclosure/2021/Aug/23; https://www.bscw.de/en/company/
CVE: CVE-2021-38385
Published: 2021-08-30
Description: Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-signature verification, leading to a remote assertion failure, aka TROVE-2021-007.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://blog.torproject.org; https://blog.torproject.org/node/2062; https://bugs.torproject.org/tpo/core/tor/40078
CVE: CVE-2021-39271
Published: 2021-08-30
Description: OrbiTeam BSCW Classic before 7.4.3 allows authenticated remote code execution (RCE) during archive extraction via attacker-supplied Python code in the class attribute of a .bscw file. This is fixed in 5.0.12, 5.1.10, 5.2.4, 7.3.3, and 7.4.3.
CVSS Score: 8.8 (HIGH)
References: http://packetstormsecurity.com/files/163989/BSCW-Server-Remote-Code-Execution.html; https://seclists.org/fulldisclosure/2021/Aug/24; https://www.bscw.de/en/company/
CVE: CVE-2021-39272
Published: 2021-08-30
Description: Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319
References: http://www.openwall.com/lists/oss-security/2021/08/27/3; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XJ6XLEJCEZCAM5LGGD6XBCC522QLG4/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXMKSEHAQSEDCWZMAOJEGX3P3JW6QY6H/
CVE: CVE-2021-26084
Published: 2021-08-30
Description: In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-917, CWE-917
References: http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html; https://jira.atlassian.com/browse/CONFSERVER-67940; http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html
CVE: CVE-2021-39111
Published: 2021-08-30
Description: The Editor plugin in Atlassian Jira Server and Data Center before version 8.5.18, from 8.6.0 before 8.13.10, and from version 8.14.0 before 8.18.2 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the handling of supplied content such as from a PDF when pasted into a field such as the description field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jira.atlassian.com/browse/JRASERVER-72716; https://jira.atlassian.com/browse/JRASERVER-72716
CVE: CVE-2021-39113
Published: 2021-08-30
Description: Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to continue to view cached content even after losing permissions, via a Broken Access Control vulnerability in the allowlist feature. The affected versions are before version 8.13.9, and from version 8.14.0 before 8.18.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-613, CWE-613
References: https://jira.atlassian.com/browse/JRASERVER-72573; https://jira.atlassian.com/browse/JRASERVER-72573
CVE: CVE-2021-39117
Published: 2021-08-30
Description: The AssociateFieldToScreens page in Atlassian Jira Server and Data Center before version 8.18.0 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability via the name of a custom field.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://jira.atlassian.com/browse/JRASERVER-72597; https://jira.atlassian.com/browse/JRASERVER-72597
CVE: CVE-2020-15744
Published: 2021-08-30
Description: Stack-based Buffer Overflow vulnerability in the ONVIF server component of Victure PC420 smart camera allows an attacker to execute remote code on the target device. This issue affects: Victure PC420 firmware version 1.2.2 and prior versions.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://www.bitdefender.com/blog/labs/cracking-the-victure-pc420-camera; https://www.bitdefender.com/blog/labs/cracking-the-victure-pc420-camera
CVE: CVE-2021-25958
Published: 2021-08-30
Description: In Apache Ofbiz, versions v17.12.01 to v17.12.07 implement a try catch exception to handle errors at multiple locations but leaks out sensitive table info which may aid the attacker for further recon. A user can register with a very long password, but when he tries to login with it an exception occurs.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-209, CWE-209
References: https://github.com/apache/ofbiz-framework/commit/2f5b8d33e32c4d9a48243cf9e503236acd5aec5c; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25958; https://github.com/apache/ofbiz-framework/commit/2f5b8d33e32c4d9a48243cf9e503236acd5aec5c
CVE: CVE-2021-24437
Published: 2021-08-30
Description: The Favicon by RealFaviconGenerator WordPress plugin through 1.3.20 does not sanitise or escape one of its parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting (XSS) which is executed in the context of a logged administrator.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/ed9d26be-cc96-4274-a05b-0b7ad9d8cfd9; https://wpscan.com/vulnerability/ed9d26be-cc96-4274-a05b-0b7ad9d8cfd9
CVE: CVE-2021-24438
Published: 2021-08-30
Description: The ShareThis Dashboard for Google Analytics WordPress plugin before 2.5.2 does not sanitise or escape the 'ga_action' parameter in the stats view before outputting it back in an attribute when the plugin is connected to a Google Analytics account, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/af[PII_REDACTED]-45c2-957f-e7bed77e4c2d; https://wpscan.com/vulnerability/af[PII_REDACTED]-45c2-957f-e7bed77e4c2d