deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-0314
Published: 2023-01-15
Description: Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/thorsten/phpmyfaq/commit/3872e7eac2ddeac182fc1335cc312d1392d56f98; https://huntr.dev/bounties/eac0a9d7-9721-4191-bef3-d43b0df59c67; https://github.com/thorsten/phpmyfaq/commit/3872e7eac2ddeac182fc1335cc312d1392d56f98
CVE: CVE-2023-0315
Published: 2023-01-16
Description: Command Injection in GitHub repository froxlor/froxlor prior to 2.0.8.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: http://packetstormsecurity.com/files/171108/Froxlor-2.0.6-Remote-Command-Execution.html; http://packetstormsecurity.com/files/171729/Froxlor-2.0.3-Stable-Remote-Code-Execution.html; https://github.com/froxlor/froxlor/commit/090cfc26f2722ac3036cc7fd1861955bc36f065a
CVE: CVE-2023-0316
Published: 2023-01-16
Description: Path Traversal: '\..\filename' in GitHub repository froxlor/froxlor prior to 2.0.0.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-29
References: https://github.com/froxlor/froxlor/commit/983d[PII_REDACTED]018225d672795bd8b4a526f41e; https://huntr.dev/bounties/c190e42a-4806-47aa-aa1e-ff5d6407e244; https://github.com/froxlor/froxlor/commit/983d[PII_REDACTED]018225d672795bd8b4a526f41e
CVE: CVE-2022-4258
Published: 2023-01-16
Description: In multiple versions of HIMA PC based Software an unquoted Windows search path vulnerability might allow local users to gain privileges via a malicious .exe file and gain full access to the system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428
References: https://cert.vde.com/en/advisories/VDE-2022-059/; https://cert.vde.com/en/advisories/VDE-2022-059/
CVE: CVE-2010-10005
Published: 2023-01-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: It is a duplicate of CVE-2010-2799.
CVE: CVE-2013-10012
Published: 2023-01-16
Description: A vulnerability, which was classified as critical, was found in antonbolling clan7ups. Affected is an unknown function of the component Login/Session. The manipulation leads to sql injection. The name of the patch is 25afad571c[PII_REDACTED]58d845830ba0a1710764. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218388.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/antonbolling/clan7ups/commit/25afad571c[PII_REDACTED]58d845830ba0a1710764; https://vuldb.com/?ctiid.218388; https://vuldb.com/?id.218388
CVE: CVE-2016-15020
Published: 2023-01-16
Description: A vulnerability was found in liftkit database up to 2.13.1. It has been classified as critical. This affects the function processOrderBy of the file src/Query/Query.php. The manipulation leads to sql injection. Upgrading to version 2.13.2 is able to address this issue. The patch is named 42ec8f2b22e0b0b98fb5b4444ed451c1b21d125a. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-218391.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/liftkit/database/commit/42ec8f2b22e0b0b98fb5b4444ed451c1b21d125a; https://github.com/liftkit/database/releases/tag/v2.13.2; https://vuldb.com/?ctiid.218391
CVE: CVE-2022-41703
Published: 2023-01-16
Description: A vulnerability in the SQL Alchemy connector of Apache Superset allows an authenticated user with read access to a specific database to add subqueries to the WHERE and HAVING fields referencing tables on the same database that the user should not have access to, despite the user having the feature flag "ALLOW_ADHOC_SUBQUERY" disabled (default value).  This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.



CVSS Score: 5.4 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://lists.apache.org/thread/g7jjw0okxjk5y57pbbxy19ydw42kqcos; https://lists.apache.org/thread/g7jjw0okxjk5y57pbbxy19ydw42kqcos
CVE: CVE-2022-43717
Published: 2023-01-16
Description: Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack vectors that can be performed by authenticated users with create dashboard permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://lists.apache.org/thread/g6zy6vkpvkbj5mj32vmyzwol5ldtg9pl; https://lists.apache.org/thread/g6zy6vkpvkbj5mj32vmyzwol5ldtg9pl
CVE: CVE-2022-43718
Published: 2023-01-16
Description: Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by authenticated users with database connection update permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://lists.apache.org/thread/8615608jt2x7b3rmqrtngldy8pn3nz2r; https://lists.apache.org/thread/8615608jt2x7b3rmqrtngldy8pn3nz2r
CVE: CVE-2022-43719
Published: 2023-01-16
Description: Two legacy REST API endpoints for approval and request access are vulnerable to cross site request forgery. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.



CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://lists.apache.org/thread/xc309h2dphrkg33154djf3nqlh2xc1c0; https://lists.apache.org/thread/xc309h2dphrkg33154djf3nqlh2xc1c0
CVE: CVE-2022-43720
Published: 2023-01-16
Description: An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will not get properly escaped by the toast message displayed when a user deletes that specific CSS template record. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

CVSS Score: 5.4 (MEDIUM)
CWE: CWE-74
References: https://lists.apache.org/thread/jts6x56kghr9mbowb653bk70pl81jp8l; https://lists.apache.org/thread/jts6x56kghr9mbowb653bk70pl81jp8l
CVE: CVE-2022-43721
Published: 2023-01-16
Description: An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601
References: https://lists.apache.org/thread/s6sqt5jmcv6qxtvdot1t5tpt57v439kg; https://lists.apache.org/thread/s6sqt5jmcv6qxtvdot1t5tpt57v439kg
CVE: CVE-2022-45438
Published: 2023-01-16
Description: When explicitly enabling the feature flag DASHBOARD_CACHE (disabled by default), the system allowed for an unauthenticated user to access dashboard configuration metadata using a REST API Get endpoint. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

CVSS Score: 5.3 (MEDIUM)
CWE: CWE-668, CWE-668
References: https://lists.apache.org/thread/snxbkf2x9kww7s0wkmydct9nhqqn9rv9; https://lists.apache.org/thread/snxbkf2x9kww7s0wkmydct9nhqqn9rv9
CVE: CVE-2015-10053
Published: 2023-01-16
Description: A vulnerability classified as critical has been found in prodigasistemas curupira up to 0.1.3. Affected is an unknown function of the file app/controllers/curupira/passwords_controller.rb. The manipulation leads to sql injection. Upgrading to version 0.1.4 is able to address this issue. The patch is identified as 93a9a77896bb66c949acb8e64bceafc74bc8c271. It is recommended to upgrade the affected component. VDB-218394 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/prodigasistemas/curupira/commit/93a9a77896bb66c949acb8e64bceafc74bc8c271; https://github.com/prodigasistemas/curupira/releases/tag/v0.1.4; https://vuldb.com/?ctiid.218394
CVE: CVE-2018-25076
Published: 2023-01-16
Description: A vulnerability classified as critical was found in Events Extension on BigTree. Affected by this vulnerability is the function getRandomFeaturedEventByDate/getUpcomingFeaturedEventsInCategoriesWithSubcategories/recacheEvent/searchResults of the file classes/events.php. The manipulation leads to sql injection. The patch is named 11169e48ab[PII_REDACTED]fdb1e0c9fca3d25ba01d. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218395.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/timbuckingham/bigtree-events/commit/11169e48ab[PII_REDACTED]fdb1e0c9fca3d25ba01d; https://vuldb.com/?ctiid.218395; https://vuldb.com/?id.218395
CVE: CVE-2021-4313
Published: 2023-01-16
Description: A vulnerability was found in NethServer phonenehome. It has been rated as critical. This issue affects the function get_info/get_country_coor of the file server/index.php. The manipulation leads to sql injection. The identifier of the patch is 759c30b0ddd7d493836bbdf695cf71624b377391. It is recommended to apply a patch to fix this issue. The identifier VDB-218393 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/NethServer/nethserver-phonehome/commit/759c30b0ddd7d493836bbdf695cf71624b377391; https://github.com/NethServer/nethserver-phonehome/pull/10; https://vuldb.com/?ctiid.218393
CVE: CVE-2022-4890
Published: 2023-01-16
Description: A vulnerability, which was classified as critical, has been found in abhilash1985 PredictApp. This issue affects some unknown processing of the file config/initializers/new_framework_defaults_7_0.rb of the component Cookie Handler. The manipulation leads to deserialization. The attack may be initiated remotely. The patch is named b067372f3ee26fe1b657121f0f41883ff4461a06. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218387.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-502, CWE-502
References: https://github.com/abhilash1985/PredictApp/commit/b067372f3ee26fe1b657121f0f41883ff4461a06; https://github.com/abhilash1985/PredictApp/pull/73; https://vuldb.com/?ctiid.218387
CVE: CVE-2023-0323
Published: 2023-01-16
Description: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.14.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/pimcore/pimcore/commit/746fac1a342841624f63ab13edcd340358e1bc04; https://huntr.dev/bounties/129d6a4b-0504-4de1-a72c-3f12c4552343; https://github.com/pimcore/pimcore/commit/746fac1a342841624f63ab13edcd340358e1bc04
CVE: CVE-2023-0324
Published: 2023-01-16
Description: A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file admin/page-login.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-218426 is the identifier assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/linmoren/online-tours-travels-management-system/blob/main/adminpage-login-email.md; https://vuldb.com/?ctiid.218426; https://vuldb.com/?id.218426
CVE: CVE-2022-2658
Published: 2023-01-16
Description: The WP Spell Check WordPress plugin before 9.13 does not escape ignored words, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/e72fa040-3ca5-4570-9a3c-c704574b1ca3; https://wpscan.com/vulnerability/e72fa040-3ca5-4570-9a3c-c704574b1ca3
CVE: CVE-2022-3904
Published: 2023-01-16
Description: The MonsterInsights WordPress plugin before 8.9.1 does not sanitize or escape page titles in the top posts/pages section, allowing an unauthenticated attacker to inject arbitrary web scripts into the titles by spoofing requests to google analytics.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/244d9ef1-335c-4f65-94ad-27c0c633f6ad; https://wpscan.com/vulnerability/244d9ef1-335c-4f65-94ad-27c0c633f6ad
CVE: CVE-2022-47630
Published: 2023-01-16
Description: Trusted Firmware-A through 2.8 has an out-of-bounds read in the X.509 parser for parsing boot certificates. This affects downstream use of get_ext and auth_nvctr. Attackers might be able to trigger dangerous read side effects or obtain sensitive information about microarchitectural state.
CVSS Score: 7.4 (HIGH)
CWE: CWE-125, CWE-125
References: http://www.openwall.com/lists/oss-security/2023/01/16/8; https://trustedfirmware-a.readthedocs.io/en/latest/security_advisories/security-advisory-tfv-10.html; https://www.trustedfirmware.org/news/
CVE: CVE-2022-4060
Published: 2023-01-16
Description: The User Post Gallery WordPress plugin through 2.19 does not limit what callback functions can be called by users, making it possible to any visitors to run code on sites running it.
CVSS Score: 9.8 (CRITICAL)
References: https://wpscan.com/vulnerability/8f982ebd-6fc5-452d-8280-42e027d01b1e; https://wpscan.com/vulnerability/8f982ebd-6fc5-452d-8280-42e027d01b1e
CVE: CVE-2022-4101
Published: 2023-01-16
Description: The Images Optimize and Upload CF7 WordPress plugin through 2.1.4 does not validate the file to be deleted via an AJAX action available to unauthenticated users, which could allow them to delete arbitrary files on the server via path traversal attack.
CVSS Score: 9.1 (CRITICAL)
References: https://wpscan.com/vulnerability/2ce4c837-c62c-41ac-95ca-54bb1a6d1eeb; https://wpscan.com/vulnerability/2ce4c837-c62c-41ac-95ca-54bb1a6d1eeb
CVE: CVE-2022-4199
Published: 2023-01-16
Description: The Link Library WordPress plugin before 7.4.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/c4688c0b-0538-4151-995c-d437d7e4829d; https://wpscan.com/vulnerability/c4688c0b-0538-4151-995c-d437d7e4829d
CVE: CVE-2022-4295
Published: 2023-01-16
Description: The Show All Comments WordPress plugin before 7.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a logged in high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/4ced1a4d-0c1f-42ad-8473-241c68b92b56; https://wpscan.com/vulnerability/4ced1a4d-0c1f-42ad-8473-241c68b92b56
CVE: CVE-2022-4299
Published: 2023-01-16
Description: The Metricool WordPress plugin before 1.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/169c5611-ed10-4cc3-bd07-09b365adf303; https://wpscan.com/vulnerability/169c5611-ed10-4cc3-bd07-09b365adf303
CVE: CVE-2022-4309
Published: 2023-01-16
Description: The Subscribe2 WordPress plugin before 10.38 does not have CSRF check when deleting users, which could allow attackers to make a logged in admin delete arbitrary users by knowing their email via a CSRF attack.
CVSS Score: 3.1 (LOW)
References: https://wpscan.com/vulnerability/1965f53d-c94e-4322-9059-49de69df1051; https://wpscan.com/vulnerability/1965f53d-c94e-4322-9059-49de69df1051
CVE: CVE-2022-4320
Published: 2023-01-16
Description: The WordPress Events Calendar WordPress plugin before 1.4.5 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against both unauthenticated and authenticated users (such as high-privilege ones like admin).
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/f1244c57-d886-4a6e-8cdb-18404e8c153c; https://wpscan.com/vulnerability/f1244c57-d886-4a6e-8cdb-18404e8c153c
CVE: CVE-2022-4327
Published: 2023-01-16
Description: Rejected reason: This issue does not bear any security risk as it's only exploitable by users with administrator or super-administrator roles, who can already do what they want on their site.
CVE: CVE-2022-4330
Published: 2023-01-16
Description: The WP Attachments WordPress plugin before 5.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/d3c39e17-1dc3-4275-97d8-543ca7226772; https://wpscan.com/vulnerability/d3c39e17-1dc3-4275-97d8-543ca7226772
CVE: CVE-2022-4431
Published: 2023-01-16
Description: The WOOCS WordPress plugin before 1.3.9.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/860b882b-983c-44b5-8c09-b6890df8a0da; https://wpscan.com/vulnerability/c7d12fd4-7346-4727-9f6c-7e7e5524a932; https://wpscan.com/vulnerability/860b882b-983c-44b5-8c09-b6890df8a0da
CVE: CVE-2022-4442
Published: 2023-01-16
Description: The Custom Post Types and Custom Fields creator WordPress plugin before 2.3.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/12766537-df59-49d6-815a-4d68265a4c4a; https://wpscan.com/vulnerability/12766537-df59-49d6-815a-4d68265a4c4a
CVE: CVE-2022-4447
Published: 2023-01-16
Description: The Fontsy WordPress plugin through 1.8.6 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
CVSS Score: 9.8 (CRITICAL)
References: https://wpscan.com/vulnerability/6939c405-ac62-4144-bd86-944d7b89d0ad; https://wpscan.com/vulnerability/6939c405-ac62-4144-bd86-944d7b89d0ad
CVE: CVE-2022-4449
Published: 2023-01-16
Description: The Page scroll to id WordPress plugin before 1.7.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/a4895f8d-5a4c-49cb-b144-b761ed82923d; https://wpscan.com/vulnerability/a4895f8d-5a4c-49cb-b144-b761ed82923d
CVE: CVE-2022-4451
Published: 2023-01-16
Description: The Social Sharing WordPress plugin before 3.3.45 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/a28f52a4-fd57-4f46-8983-f34c71ec88d5; https://wpscan.com/vulnerability/a28f52a4-fd57-4f46-8983-f34c71ec88d5
CVE: CVE-2022-4453
Published: 2023-01-16
Description: The 3D FlipBook WordPress plugin through 1.13.2 does not validate or escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against high privilege users like administrators.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/120bdcb3-4288-4101-b738-cc84d02da171; https://wpscan.com/vulnerability/120bdcb3-4288-4101-b738-cc84d02da171
CVE: CVE-2022-4460
Published: 2023-01-16
Description: The Sidebar Widgets by CodeLights WordPress plugin through 1.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high-privilege users such as admins.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/034c4c75-42a4-4884-b63f-f9d4d2d6aebc; https://wpscan.com/vulnerability/034c4c75-42a4-4884-b63f-f9d4d2d6aebc
CVE: CVE-2022-4464
Published: 2023-01-16
Description: Themify Portfolio Post WordPress plugin before 1.2.1 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high privileged users such as admin.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/1d3636c1-976f-4c84-8cca-413e38170d0c; https://wpscan.com/vulnerability/1d3636c1-976f-4c84-8cca-413e38170d0c
CVE: CVE-2022-4465
Published: 2023-01-16
Description: The WP Video Lightbox WordPress plugin before 1.9.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/28abe589-1371-4ed2-90b6-2bb96c93832c; https://wpscan.com/vulnerability/28abe589-1371-4ed2-90b6-2bb96c93832c
CVE: CVE-2022-4469
Published: 2023-01-16
Description: The Simple Membership WordPress plugin before 4.2.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/b195c373-1db9-4fd7-98d0-0860dacd189e; https://wpscan.com/vulnerability/b195c373-1db9-4fd7-98d0-0860dacd189e
CVE: CVE-2022-4476
Published: 2023-01-16
Description: The Download Manager WordPress plugin before 3.2.62 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in admins.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/856cac0f-2526-4978-acad-d6d82a0bec45; https://wpscan.com/vulnerability/856cac0f-2526-4978-acad-d6d82a0bec45
CVE: CVE-2022-4477
Published: 2023-01-16
Description: The Smash Balloon Social Post Feed WordPress plugin before 4.1.6 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in admins.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/c32a4c58-9f2b-4afa-9a21-4b4a5c4c4c41; https://wpscan.com/vulnerability/c32a4c58-9f2b-4afa-9a21-4b4a5c4c4c41
CVE: CVE-2022-4478
Published: 2023-01-16
Description: The Font Awesome WordPress plugin before 4.3.2 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in admins.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/4de75de5-e557-46df-9675-e3f0220f4003; https://wpscan.com/vulnerability/4de75de5-e557-46df-9675-e3f0220f4003