deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-49082
Published: 2023-11-29
Description: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP method. The vulnerability occurs only if the attacker can control the HTTP method (GET, POST etc.) of the request. If the attacker can control the HTTP version of the request it will be able to modify the request (request smuggling). This issue has been patched in version 3.9.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-93
References: https://gist.github.com/jnovikov/7f411ae9fe6a9a7804cf162a3bdbb44b; https://github.com/aio-libs/aiohttp/commit/e4ae01c2077d2cfa116aa82e4ff6866857f7c466; https://github.com/aio-libs/aiohttp/pull/7806/files
CVE: CVE-2023-49091
Published: 2023-11-29
Description: Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Cosmos-server is vulnerable due to to the authorization header used for user login remaining valid and not expiring after log out. This vulnerability allows an attacker to use the token to gain unauthorized access to the application/system even after the user has logged out. This issue has been patched in version 0.13.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-613, CWE-613
References: https://github.com/azukaar/Cosmos-Server/commit/7a3fdfb467bd4d1f8333e3e1f3c3f5fca0b69cd7; https://github.com/azukaar/Cosmos-Server/security/advisories/GHSA-hpvm-x7m8-3c6x; https://github.com/azukaar/Cosmos-Server/security/advisories/GHSA-hpvm-x7m8-3c6x
CVE: CVE-2023-40458
Published: 2023-11-29
Description: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Sierra Wireless, Inc ALEOS could potentially allow a remote attacker to trigger a 
Denial of Service (DoS) condition for ACEManager without impairing 
other router functions. This condition is cleared by restarting the 
device.


CVSS Score: 7.5 (HIGH)
CWE: CWE-835, CWE-835
References: https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006/#sthash.5ZcnyPM1.dpbs; https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006/#sthash.5ZcnyPM1.dpbs
CVE: CVE-2023-49693
Published: 2023-11-29
Description: 
NETGEAR ProSAFE Network Management System has Java Debug Wire Protocol (JDWP) listening on port 11611 and it is remotely accessible by unauthenticated users, allowing attackers to execute arbitrary code.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-306
References: https://kb.netgear.com/000065886/Security-Advisory-for-Sensitive-Information-Disclosure-on-the-NMS300-PSV-2023-0126; https://www.tenable.com/security/research/tra-2023-39; https://kb.netgear.com/000065886/Security-Advisory-for-Sensitive-Information-Disclosure-on-the-NMS300-PSV-2023-0126
CVE: CVE-2023-49694
Published: 2023-11-29
Description: 


A low-privileged OS user with access to a Windows host where NETGEAR ProSAFE Network Management System is installed can create arbitrary JSP files in a Tomcat web application directory. The user can then execute the JSP files under the security context of SYSTEM.




CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://kb.netgear.com/000065885/Security-Advisory-for-Vertical-Privilege-Escalation-on-the-NMS300-PSV-2023-0127; https://www.tenable.com/security/research/tra-2023-39; https://kb.netgear.com/000065885/Security-Advisory-for-Vertical-Privilege-Escalation-on-the-NMS300-PSV-2023-0127
CVE: CVE-2023-3741
Published: 2023-11-30
Description: An OS Command injection vulnerability in NEC Platforms DT900 and DT900S Series all versions allows an attacker to execute any command on the device.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://https://jpn.nec.com/security-info/secinfo/nv23-011_en.html; https://https://jpn.nec.com/security-info/secinfo/nv23-011_en.html
CVE: CVE-2023-35137
Published: 2023-11-30
Description: An improper authentication vulnerability in the authentication module of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to obtain system information by sending a crafted URL to a vulnerable device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-authentication-bypass-and-command-injection-vulnerabilities-in-nas-products; https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-authentication-bypass-and-command-injection-vulnerabilities-in-nas-products
CVE: CVE-2023-35138
Published: 2023-11-30
Description: A command injection vulnerability in the “show_zysync_server_contents” function of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-authentication-bypass-and-command-injection-vulnerabilities-in-nas-products; https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-authentication-bypass-and-command-injection-vulnerabilities-in-nas-products
CVE: CVE-2023-37927
Published: 2023-11-30
Description: The improper neutralization of special elements in the CGI program of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an authenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://bugprove.com/knowledge-hub/cve-2023-37927-and-cve-2023-37928-multiple-post-auth-blind-os-command-and-python-code-injection-vulnerabilities-in-zyxel-s-nas-326-devices/; https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-authentication-bypass-and-command-injection-vulnerabilities-in-nas-products; https://bugprove.com/knowledge-hub/cve-2023-37927-and-cve-2023-37928-multiple-post-auth-blind-os-command-and-python-code-injection-vulnerabilities-in-zyxel-s-nas-326-devices/
CVE: CVE-2023-37928
Published: 2023-11-30
Description: A post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an authenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://bugprove.com/knowledge-hub/cve-2023-37927-and-cve-2023-37928-multiple-post-auth-blind-os-command-and-python-code-injection-vulnerabilities-in-zyxel-s-nas-326-devices/; https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-authentication-bypass-and-command-injection-vulnerabilities-in-nas-products; https://bugprove.com/knowledge-hub/cve-2023-37927-and-cve-2023-37928-multiple-post-auth-blind-os-command-and-python-code-injection-vulnerabilities-in-zyxel-s-nas-326-devices/
CVE: CVE-2023-4473
Published: 2023-11-30
Description: A command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://bugprove.com/knowledge-hub/cve-2023-4473-and-cve-2023-4474-authentication-bypass-and-multiple-blind-os-command-injection-vulnerabilities-in-zyxel-s-nas-326-devices/; https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-authentication-bypass-and-command-injection-vulnerabilities-in-nas-products; https://bugprove.com/knowledge-hub/cve-2023-4473-and-cve-2023-4474-authentication-bypass-and-multiple-blind-os-command-injection-vulnerabilities-in-zyxel-s-nas-326-devices/
CVE: CVE-2023-4474
Published: 2023-11-30
Description: The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://bugprove.com/knowledge-hub/cve-2023-4473-and-cve-2023-4474-authentication-bypass-and-multiple-blind-os-command-injection-vulnerabilities-in-zyxel-s-nas-326-devices/; https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-authentication-bypass-and-command-injection-vulnerabilities-in-nas-products; https://bugprove.com/knowledge-hub/cve-2023-4473-and-cve-2023-4474-authentication-bypass-and-multiple-blind-os-command-injection-vulnerabilities-in-zyxel-s-nas-326-devices/
CVE: CVE-2023-5247
Published: 2023-11-30
Description: Malicious Code Execution Vulnerability due to External Control of File Name or Path in multiple Mitsubishi Electric FA Engineering Software Products allows a malicious attacker to execute a malicious code by having legitimate users open a specially crafted project file, which could result in information disclosure, tampering and deletion, or a denial-of-service (DoS) condition.
CVSS Score: 7.8 (HIGH)
CWE: CWE-73, CWE-610
References: https://jvn.jp/vu/JVNVU93383160/; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-016_en.pdf; https://jvn.jp/vu/JVNVU93383160/
CVE: CVE-2023-5772
Published: 2023-11-30
Description: The Debug Log Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.1. This is due to missing or incorrect nonce validation on the clear_log() function. This makes it possible for unauthenticated attackers to clear the debug log via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/browser/debug-log-manager/tags/2.2.0/classes/class-debug-log.php#L822; https://plugins.trac.wordpress.org/browser/debug-log-manager/tags/2.2.2/classes/class-debug-log.php#L828; https://research.cleantalk.org/cve-2023-5772-debug-log-manager-csrf-to-clear-error-logs-poc/
CVE: CVE-2023-47463
Published: 2023-11-30
Description: Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via a crafted script to the gl_nas_sys authentication function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-281, CWE-281
References: https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/an%20unauthenticated%20remote%20code%20execution.md; https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/an%20unauthenticated%20remote%20code%20execution.md
CVE: CVE-2023-47464
Published: 2023-11-30
Description: Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via the upload API function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Arbitrary%20File%20Creation%20Through%20API%20upload.md; https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Arbitrary%20File%20Creation%20Through%20API%20upload.md
CVE: CVE-2023-49094
Published: 2023-11-30
Description: Symbolicator is a symbolication service for native stacktraces and minidumps with symbol server support. An attacker could make Symbolicator send arbitrary GET HTTP requests to internal IP addresses by using a specially crafted HTTP endpoint. The response could be reflected to the attacker if they have an account on Sentry instance. The issue has been fixed in the release 23.11.2.

CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/getsentry/symbolicator/commit/9db2fb9197dd200d62aacebd8efef4df7678865a; https://github.com/getsentry/symbolicator/pull/1332; https://github.com/getsentry/symbolicator/releases/tag/23.11.2
CVE: CVE-2023-49097
Published: 2023-11-30
Description: ZITADEL is an identity infrastructure system. ZITADEL uses the notification triggering requests Forwarded or X-Forwarded-Host header to build the button link sent in emails for confirming a password reset with the emailed code. If this header is overwritten and a user clicks the link to a malicious site in the email, the secret code can be retrieved and used to reset the users password and take over his account. Accounts with MFA or Passwordless enabled can not be taken over by this attack. This issue has been patched in versions 2.41.6, 2.40.10 and 2.39.9.

CVSS Score: 8.1 (HIGH)
CWE: CWE-640
References: https://github.com/zitadel/zitadel/security/advisories/GHSA-2wmj-46rj-qm2w; https://github.com/zitadel/zitadel/security/advisories/GHSA-2wmj-46rj-qm2w
CVE: CVE-2023-5274
Published: 2023-11-30
Description: Improper Input Validation vulnerability in simulation function of GX Works2 allows an attacker to cause a denial-of-service (DoS) condition on the function by sending specially crafted packets. However, the attacker would need to send the packets from within the same personal computer where the function is running.

CVSS Score: 2.5 (LOW)
CWE: CWE-20, CWE-20
References: https://jvn.jp/vu/JVNVU98760962/index.html; https://www.cisa.gov/news-events/ics-advisories/icsa-23-331-03; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-015_en.pdf
CVE: CVE-2023-5275
Published: 2023-11-30
Description: Improper Input Validation vulnerability in simulation function of GX Works2 allows an attacker to cause a denial-of-service (DoS) condition on the function by sending specially crafted packets. However, the attacker would need to send the packets from within the same personal computer where the function is running.

CVSS Score: 2.5 (LOW)
CWE: CWE-20, CWE-20
References: https://jvn.jp/vu/JVNVU98760962/index.html; https://www.cisa.gov/news-events/ics-advisories/icsa-23-331-03; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-015_en.pdf
CVE: CVE-2023-47418
Published: 2023-11-30
Description: Remote Code Execution (RCE) vulnerability in o2oa version 8.1.2 and before, allows attackers to create a new interface in the service management function to execute JavaScript.
CVSS Score: 9.8 (CRITICAL)
References: https://gist.github.com/Onlyning/0cf7b1c597a36dd3a2e9ec948b881ac8; https://github.com/Onlyning/O2OA; https://gist.github.com/Onlyning/0cf7b1c597a36dd3a2e9ec948b881ac8
CVE: CVE-2023-49076
Published: 2023-11-30
Description: Customer-data-framework allows management of customer data within Pimcore. There are no tokens or headers to prevent CSRF attacks from occurring, therefore an attacker could abuse this vulnerability to create new customers. This issue has been patched in version 4.0.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/pimcore/customer-data-framework/commit/ef7414415cfa64189b8433eff0aa2a9b537a89f7.patch; https://github.com/pimcore/customer-data-framework/security/advisories/GHSA-xx63-4jr8-9ghc; https://github.com/pimcore/customer-data-framework/commit/ef7414415cfa64189b8433eff0aa2a9b537a89f7.patch
CVE: CVE-2023-49087
Published: 2023-11-30
Description: xml-security is a library that implements XML signatures and encryption. Validation of an XML signature requires verification that the hash value of the related XML-document matches a specific DigestValue-value, but also that the cryptographic signature on the SignedInfo-tree (the one that contains the DigestValue) verifies and matches a trusted public key. If an attacker somehow (i.e. by exploiting a bug in PHP's canonicalization function) manages to manipulate the canonicalized version's DigestValue, it would be possible to forge the signature. This issue has been patched in version 1.6.12 and 5.0.0-alpha.13.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-345
References: https://github.com/simplesamlphp/xml-security/commit/f509e3083dd7870cce5880c804b[PII_REDACTED]581; https://github.com/simplesamlphp/xml-security/security/advisories/GHSA-ww7x-3gxh-qm6r; https://github.com/simplesamlphp/xml-security/commit/f509e3083dd7870cce5880c804b[PII_REDACTED]581
CVE: CVE-2023-49052
Published: 2023-11-30
Description: File Upload vulnerability in Microweber v.2.0.4 allows a remote attacker to execute arbitrary code via a crafted script to the file upload function in the created forms component.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/Cyber-Wo0dy/CVE-2023-49052; https://github.com/Cyber-Wo0dy/report/blob/main/microweber/v2.0.4/microweber_unrestricted_upload; https://github.com/Cyber-Wo0dy/CVE-2023-49052
CVE: CVE-2023-49077
Published: 2023-11-30
Description: Mailcow: dockerized is an open source groupware/email suite based on docker. A Cross-Site Scripting (XSS) vulnerability has been identified within the Quarantine UI of the system. This vulnerability poses a significant threat to administrators who utilize the Quarantine feature. An attacker can send a carefully crafted email containing malicious JavaScript code. This issue has been patched in version 2023-11.
CVSS Score: 8.3 (HIGH)
CWE: CWE-79
References: https://github.com/mailcow/mailcow-dockerized/releases/tag/2023-11; https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-46x4-w2fm-5x6g; https://github.com/mailcow/mailcow-dockerized/releases/tag/2023-11
CVE: CVE-2023-49081
Published: 2023-11-30
Description: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: https://gist.github.com/jnovikov/184afb593d9c2114d77f508e0ccd508e; https://github.com/aio-libs/aiohttp/commit/1e86b777e61cf4eefc7d92fa57fa19dcc676013b; https://github.com/aio-libs/aiohttp/pull/7835/files
CVE: CVE-2023-49095
Published: 2023-11-30
Description: nexkey is a microblogging platform. Insufficient validation of ActivityPub requests received in inbox could allow any user to impersonate another user in certain circumstances. This issue has been patched in version 12.122.2.
CVSS Score: 8.6 (HIGH)
CWE: CWE-20
References: https://github.com/nexryai/nexkey/commit/b96da0eac5a1e75abba94cf926f[PII_REDACTED]bab; https://github.com/nexryai/nexkey/security/advisories/GHSA-fpxw-rw9v-2gmx; https://github.com/nexryai/nexkey/commit/b96da0eac5a1e75abba94cf926f[PII_REDACTED]bab
CVE: CVE-2023-49699
Published: 2023-11-30
Description: Memory Corruption in IMS while calling VoLTE Streamingmedia Interface 
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-119, CWE-787
References: https://www.asrmicro.com/en/goods/psirt?cid=31; https://www.asrmicro.com/en/goods/psirt?cid=31
CVE: CVE-2023-49700
Published: 2023-11-30
Description: Security best practices violations, a string operation in Streamingmedia will write past the end of fixed-size destination buffer if the source buffer is too large.  
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.asrmicro.com/en/goods/psirt?cid=31; https://www.asrmicro.com/en/goods/psirt?cid=31
CVE: CVE-2022-45135
Published: 2023-11-30
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Cocoon.This issue affects Apache Cocoon: from 2.2.0 before 2.3.0.

Users are recommended to upgrade to version 2.3.0, which fixes the issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.openwall.com/lists/oss-security/2023/11/30/3; https://lists.apache.org/thread/lsvd1hmr2t2q823x21d5ygzgbj9jpvjp; http://www.openwall.com/lists/oss-security/2023/11/30/3
CVE: CVE-2023-49701
Published: 2023-11-30
Description: Memory Corruption in SIM management while USIMPhase2init  
CVSS Score: 7.2 (HIGH)
CWE: CWE-119, CWE-787
References: https://www.asrmicro.com/en/goods/psirt?cid=31; https://www.asrmicro.com/en/goods/psirt?cid=31
CVE: CVE-2023-49620
Published: 2023-11-30
Description: Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unauthorized access vulnerability (IDOR), but after version 3.1.0 we fixed this issue. We mark this cve as moderate level because it still requires user login to operate, please upgrade to version 3.1.0 to avoid this vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2023/11/30/4; https://github.com/apache/dolphinscheduler/pull/10307; https://lists.apache.org/thread/zm4t1ykj4cro1c8183q7y32z0yzfz8yj
CVE: CVE-2021-36806
Published: 2023-11-30
Description: 
A reflected XSS vulnerability allows an open redirect when the victim clicks a malicious link to an error page on 

Sophos Email Appliance 

older than version 4.5.3.4.


CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://community.sophos.com/email-appliance/b/blog/posts/sophos-email-appliance-version-4-5-3-4-released; https://community.sophos.com/email-appliance/b/blog/posts/sophos-email-appliance-version-4-5-3-4-released
CVE: CVE-2023-48336
Published: 2023-11-30
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cybernetikz Easy Social Icons allows Stored XSS.This issue affects Easy Social Icons: from n/a through 3.2.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/easy-social-icons/wordpress-easy-social-icons-plugin-3-2-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/easy-social-icons/wordpress-easy-social-icons-plugin-3-2-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-48737
Published: 2023-11-30
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PT Trijaya Digital Grup TriPay Payment Gateway allows Stored XSS.This issue affects TriPay Payment Gateway: from n/a through 3.2.7.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/tripay-payment-gateway/wordpress-tripay-payment-gateway-plugin-3-2-7-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/tripay-payment-gateway/wordpress-tripay-payment-gateway-plugin-3-2-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-48743
Published: 2023-11-30
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paul Menard Simply Exclude allows Reflected XSS.This issue affects Simply Exclude: from n/a through 2.0.6.6.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/simply-exclude/wordpress-simply-exclude-plugin-2-0-6-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/simply-exclude/wordpress-simply-exclude-plugin-2-0-6-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-41136
Published: 2023-11-30
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Laurence/OhMyBox.Info Simple Long Form allows Stored XSS.This issue affects Simple Long Form: from n/a through 2.2.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/simple-long-form/wordpress-simple-long-form-plugin-2-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/simple-long-form/wordpress-simple-long-form-plugin-2-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve