deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-51384
Published: 2023-12-18
Description: In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys, these constraints are only applied to the first key, even if a PKCS#11 token returns multiple keys.
CVSS Score: 5.5 (MEDIUM)
References: http://seclists.org/fulldisclosure/2024/Mar/21; https://github.com/openssh/openssh-portable/commit/881d9c6af9da4257c69c327c4e2f1508b2fa754b; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-51385
Published: 2023-12-18
Description: In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-78, CWE-78
References: http://seclists.org/fulldisclosure/2024/Mar/21; http://www.openwall.com/lists/oss-security/2023/12/26/4; https://github.com/openssh/openssh-portable/commit/7ef3787c84b6b524501211b11a26c742f829af1a
CVE: CVE-2023-47741
Published: 2023-12-18
Description: 
IBM i 7.3, 7.4, 7.5, IBM i Db2 Mirror for i 7.4 and 7.5 web browser clients may leave clear-text passwords in browser memory that can be viewed using common browser tools before the memory is garbage collected. A malicious actor with access to the victim's PC could exploit this vulnerability to gain access to the IBM i operating system. IBM X-Force ID: 272532.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-522
References: https://www.ibm.com/support/pages/node/7097785; https://www.ibm.com/support/pages/node/7097801; https://www.ibm.com/support/pages/node/7097785
CVE: CVE-2023-4311
Published: 2023-12-18
Description: The Vrm 360 3D Model Viewer WordPress plugin through 1.2.1 is vulnerable to arbitrary file upload due to insufficient checks in a plugin shortcode.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://wpscan.com/vulnerability/21950116-1a69-4848-9da0-e912096c0fce; https://wpscan.com/vulnerability/21950116-1a69-4848-9da0-e912096c0fce
CVE: CVE-2023-4724
Published: 2023-12-18
Description: The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not validate and sanitise the `wp_query` parameter which allows an attacker to run arbitrary command on the remote server
CVSS Score: 7.2 (HIGH)
References: https://wpscan.com/vulnerability/48820f1d-45cb-4f1f-990d-d132bfc5536f; https://wpscan.com/vulnerability/48820f1d-45cb-4f1f-990d-d132bfc5536f
CVE: CVE-2023-5005
Published: 2023-12-18
Description: The Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro WordPress plugin before 2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/bfb174d4-7658-4883-a682-d06bda89ec44; https://wpscan.com/vulnerability/bfb174d4-7658-4883-a682-d06bda89ec44
CVE: CVE-2023-5348
Published: 2023-12-18
Description: The Product Catalog Mode For WooCommerce WordPress plugin before 5.0.3 does not properly authorize settings updates or escape settings values, leading to stored XSS by unauthenticated users.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/b37b09c1-1b53-471c-9b10-7d2d05ae11f1; https://wpscan.com/vulnerability/b37b09c1-1b53-471c-9b10-7d2d05ae11f1
CVE: CVE-2023-5882
Published: 2023-12-18
Description: The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers to make logged in users perform unwanted actions leading to remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wpscan.com/vulnerability/72be4b5c-21be-46af-a3f4-08b4c190a7e2; https://wpscan.com/vulnerability/72be4b5c-21be-46af-a3f4-08b4c190a7e2
CVE: CVE-2023-5886
Published: 2023-12-18
Description: The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers with the ability to upload files to make logged in users perform unwanted actions leading to PHAR deserialization, which may lead to remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wpscan.com/vulnerability/0a08e49d-d34e-4140-a15d-ad64444665a3; https://wpscan.com/vulnerability/0a08e49d-d34e-4140-a15d-ad64444665a3
CVE: CVE-2023-5949
Published: 2023-12-18
Description: The SmartCrawl WordPress plugin before 3.8.3 does not prevent unauthorised users from accessing password-protected posts' content.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://wpscan.com/vulnerability/3cec27ca-f470-402d-ae3e-271cb59cf407; https://wpscan.com/vulnerability/3cec27ca-f470-402d-ae3e-271cb59cf407
CVE: CVE-2023-6065
Published: 2023-12-18
Description: The Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 doesn't restrict access to detailed scan logs, which allows a malicious actor to discover local paths and portions of the site's code
CVSS Score: 5.3 (MEDIUM)
References: https://drive.google.com/file/d/1w83xWsVLS_gCpQy4LDwbjNK9JaB87EEf/view?usp=sharing; https://wpscan.com/vulnerability/64f2557f-c5e4-4779-9e28-911dfaf2dda5; https://drive.google.com/file/d/1w83xWsVLS_gCpQy4LDwbjNK9JaB87EEf/view?usp=sharing
CVE: CVE-2023-6077
Published: 2023-12-18
Description: The Slider WordPress plugin before 3.5.12 does not ensure that posts to be accessed via an AJAX action are slides and can be viewed by the user making the request, allowing any authenticated users, such as subscriber to access the content arbitrary post such as private, draft and password protected
CVSS Score: 6.5 (MEDIUM)
References: https://wpscan.com/vulnerability/1afc0e4a-f712-47d4-bf29-7719ccbbbb1b; https://wpscan.com/vulnerability/1afc0e4a-f712-47d4-bf29-7719ccbbbb1b
CVE: CVE-2023-6203
Published: 2023-12-18
Description: The Events Calendar WordPress plugin before 6.2.8.1 discloses the content of password protected posts to unauthenticated users via a crafted request
CVSS Score: 7.5 (HIGH)
References: https://wpscan.com/vulnerability/229273e6-e849-447f-a95a-0730969ecdae; https://wpscan.com/vulnerability/229273e6-e849-447f-a95a-0730969ecdae
CVE: CVE-2023-6222
Published: 2023-12-18
Description: IThe Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 does not validate user input used in a path, which could allow users with an admin role to perform path traversal attacks
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: https://drive.google.com/file/d/1krgHH2NvVFr93VpErLkOjDV3L6M5yIA1/view?usp=sharing; https://wpscan.com/vulnerability/df892e99-c0f6-42b8-a834-fc55d1bde130; https://drive.google.com/file/d/1krgHH2NvVFr93VpErLkOjDV3L6M5yIA1/view?usp=sharing
CVE: CVE-2023-6272
Published: 2023-12-18
Description: The Theme My Login 2FA WordPress plugin before 1.2 does not rate limit 2FA validation attempts, which may allow an attacker to brute-force all possibilities, which shouldn't be too long, as the 2FA codes are 6 digits.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307
References: https://wpscan.com/vulnerability/a03243ea-fee7-46e4-8037-a228afc5297a; https://wpscan.com/vulnerability/a03243ea-fee7-46e4-8037-a228afc5297a
CVE: CVE-2023-6289
Published: 2023-12-18
Description: The Swift Performance Lite WordPress plugin before 2.3.6.15 does not prevent users from exporting the plugin's settings, which may include sensitive information such as Cloudflare API tokens.
CVSS Score: 4.3 (MEDIUM)
References: https://wpscan.com/vulnerability/8c83dd57-9291-4dfc-846d-5ad47534e2ad; https://wpscan.com/vulnerability/8c83dd57-9291-4dfc-846d-5ad47534e2ad
CVE: CVE-2023-6295
Published: 2023-12-18
Description: The SiteOrigin Widgets Bundle WordPress plugin before 1.51.0 does not validate user input before using it to generate paths passed to include function/s, allowing users with the administrator role to perform LFI attacks in the context of Multisite WordPress sites.
CVSS Score: 7.2 (HIGH)
References: https://wpscan.com/vulnerability/adc9ed9f-55b4-43a9-a79d-c7120764f47c; https://wpscan.com/vulnerability/adc9ed9f-55b4-43a9-a79d-c7120764f47c
CVE: CVE-2023-40691
Published: 2023-12-18
Description: IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 may reveal sensitive information contained in application configuration to developer and administrator users.  IBM X-Force ID:  264805.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/264805; https://www.ibm.com/support/pages/node/7096365; https://exchange.xforce.ibmcloud.com/vulnerabilities/264805
CVE: CVE-2023-22439
Published: 2023-12-18
Description: 
Improper input validation of a large HTTP request in the Controller 6000 and Controller 7000 optional diagnostic web interface (Port 80) can be used to perform a Denial of Service of the diagnostic web interface.

This issue affects: Gallagher Controller 6000 and 7000 8.90 prior to vCR8.90.231204a (distributed in 8.90.1620 (MR2)), 8.80 prior to vCR8.80.231204a (distributed in 8.80.1369 (MR3)), 8.70 prior to vCR8.70.231204a (distributed in 8.70.2375 (MR5)), 8.60 prior to vCR8.60.231116a (distributed in 8.60.2550 (MR7)), all versions of 8.50 and prior.


CVSS Score: 3.1 (LOW)
CWE: CWE-20, CWE-20
References: https://security.gallagher.com/Security-Advisories/CVE-2023-22439; https://security.gallagher.com/Security-Advisories/CVE-2023-22439
CVE: CVE-2023-23570
Published: 2023-12-18
Description: 
Client-Side enforcement of Server-Side security for the Command Centre server could be bypassed and lead to invalid configuration with undefined behavior. 

This issue affects: Gallagher Command Centre 8.90 prior to vEL8.90.1620 (MR2), all versions of 8.80 and prior.


CVSS Score: 5.4 (MEDIUM)
CWE: CWE-602
References: https://security.gallagher.com/Security-Advisories/CVE-2023-23570; https://security.gallagher.com/Security-Advisories/CVE-2023-23570
CVE: CVE-2023-23576
Published: 2023-12-18
Description: 
Incorrect behavior order in the Command Centre Server could allow privileged users to gain physical access to the site for longer than intended after a network outage when competencies are used in the access decision. 

This issue affects: Gallagher Command Centre: 8.90 prior to vEL8.90.1620 (MR2), 8.80 prior to vEL8.80.1369 (MR3), 8.70 prior to vEL8.70.2375 (MR5), 8.60 prior to vEL8.60.2550 (MR7), all versions of 8.50 and prior.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-696
References: https://security.gallagher.com/Security-Advisories/CVE-2023-23576; https://security.gallagher.com/Security-Advisories/CVE-2023-23576
CVE: CVE-2023-23584
Published: 2023-12-18
Description: 
An observable response discrepancy in the Gallagher Command Centre RESTAPI allows an insufficiently-privileged user to infer the presence of items that would not otherwise be viewable. 

This issue affects: Gallagher Command Centre 8.70 prior to vEL8.70.1787 (MR2), 8.60 prior to vEL8.60.2039 (MR4), all version of 8.50 and prior.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-204, CWE-203
References: https://security.gallagher.com/Security-Advisories/CVE-2023-23584; https://security.gallagher.com/Security-Advisories/CVE-2023-23584
CVE: CVE-2023-24590
Published: 2023-12-18
Description: 


A format string issue in the Controller 6000's optional diagnostic web interface can be used to write/read from memory, and in some instances crash the Controller 6000 leading to a Denial of Service.

This issue affects: Gallagher Controller 6000 8.60 prior to vCR8.60.231116a (distributed in 8.60.2550 (MR7)), all versions of 8.50 and prior.




CVSS Score: 7.5 (HIGH)
CWE: CWE-134, CWE-134
References: https://security.gallagher.com/Security-Advisories/CVE-2023-24590; https://security.gallagher.com/Security-Advisories/CVE-2023-24590
CVE: CVE-2023-41967
Published: 2023-12-18
Description: 
Sensitive information uncleared after debug/power state transition in the Controller 6000 could be abused by an attacker with knowledge of the Controller's default diagnostic password and physical access to the Controller to view its configuration through the diagnostic web pages. 

This issue affects: Gallagher Controller 6000 8.70 prior to vCR8.70.231204a (distributed in 8.70.2375 (MR5)), v8.60 or earlier.



CVSS Score: 2.4 (LOW)
CWE: CWE-1272, CWE-212
References: https://security.gallagher.com/Security-Advisories/CVE-2023-41967; https://security.gallagher.com/Security-Advisories/CVE-2023-41967
CVE: CVE-2023-46686
Published: 2023-12-18
Description: 
A reliance on untrusted inputs in a security decision could be exploited by a privileged user to configure the Gallagher Command Centre Diagnostics Service to use less secure communication protocols. 

This issue affects: Gallagher Diagnostics Service prior to v1.3.0 (distributed in 9.00.1507(MR1)).




CVSS Score: 5.5 (MEDIUM)
CWE: CWE-807
References: https://security.gallagher.com/Security-Advisories/CVE-2023-46686; https://security.gallagher.com/Security-Advisories/CVE-2023-46686
CVE: CVE-2023-48768
Published: 2023-12-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in CodeAstrology Team Quantity Plus Minus Button for WooCommerce by CodeAstrology.This issue affects Quantity Plus Minus Button for WooCommerce by CodeAstrology: from n/a through 1.1.9.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wc-quantity-plus-minus-button/wordpress-quantity-plus-minus-button-for-woocommerce-by-codeastrology-plugin-1-1-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wc-quantity-plus-minus-button/wordpress-quantity-plus-minus-button-for-woocommerce-by-codeastrology-plugin-1-1-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-48769
Published: 2023-12-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Blue Coral Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back.This issue affects Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back: from n/a through 2.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/chat-bubble/wordpress-chat-bubble-plugin-2-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/chat-bubble/wordpress-chat-bubble-plugin-2-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-48772
Published: 2023-12-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Arul Prasad J Prevent Landscape Rotation.This issue affects Prevent Landscape Rotation: from n/a through 2.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/prevent-landscape-rotation/wordpress-prevent-landscape-rotation-plugin-2-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/prevent-landscape-rotation/wordpress-prevent-landscape-rotation-plugin-2-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-48773
Published: 2023-12-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in WP Doctor WooCommerce Login Redirect.This issue affects WooCommerce Login Redirect: from n/a through 2.2.4.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/woo-login-redirect/wordpress-woo-login-redirect-plugin-2-2-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woo-login-redirect/wordpress-woo-login-redirect-plugin-2-2-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-48778
Published: 2023-12-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme Product Size Chart For WooCommerce.This issue affects Product Size Chart For WooCommerce: from n/a through 1.1.5.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/product-size-chart-for-woo/wordpress-product-size-chart-for-woocommerce-plugin-1-1-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/product-size-chart-for-woo/wordpress-product-size-chart-for-woocommerce-plugin-1-1-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-48781
Published: 2023-12-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Marketing Rapel MkRapel Regiones y Ciudades de Chile para WC.This issue affects MkRapel Regiones y Ciudades de Chile para WC: from n/a through 4.3.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wc-ciudades-y-regiones-de-chile/wordpress-mkrapel-regiones-y-ciudades-de-chile-para-wc-plugin-4-3-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wc-ciudades-y-regiones-de-chile/wordpress-mkrapel-regiones-y-ciudades-de-chile-para-wc-plugin-4-3-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-49148
Published: 2023-12-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Kulwant Nagi Affiliate Booster – Pros & Cons, Notice, and CTA Blocks for Affiliates.This issue affects Affiliate Booster – Pros & Cons, Notice, and CTA Blocks for Affiliates: from n/a through 3.0.5.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/affiliatebooster-blocks/wordpress-affiliate-booster-plugin-3-0-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/affiliatebooster-blocks/wordpress-affiliate-booster-plugin-3-0-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-6355
Published: 2023-12-18
Description: 
Incorrect selection of fuse values in the Controller 7000 platform allows an attacker to bypass some protection mechanisms to enable local debug. 

This issue affects: Gallagher Controller 7000 9.00 prior to vCR9.00.231204b (distributed in 9.00.1507 (MR1)), 8.90 prior to vCR8.90.231204a (distributed in 8.90.1620 (MR2)), 8.80 prior to vCR8.80.231204a (distributed in 8.80.1369 (MR3)), 8.70 prior to vCR8.70.231204a (distributed in 8.70.2375 (MR5)).


CVSS Score: 6.8 (MEDIUM)
CWE: CWE-1253, CWE-863
References: https://security.gallagher.com/Security-Advisories/CVE-2023-6355; https://security.gallagher.com/Security-Advisories/CVE-2023-6355
CVE: CVE-2023-33331
Published: 2023-12-18
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce Product Vendors allows SQL Injection.This issue affects Product Vendors: from n/a through 2.1.76.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/woocommerce-product-vendors/wordpress-woocommerce-product-vendors-plugin-2-1-76-vendor-admin-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-product-vendors/wordpress-woocommerce-product-vendors-plugin-2-1-76-vendor-admin-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2023-34168
Published: 2023-12-18
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alex Raven WP Report Post allows SQL Injection.This issue affects WP Report Post: from n/a through 2.1.2.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/wp-report-post/wordpress-wp-report-post-plugin-2-1-2-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-report-post/wordpress-wp-report-post-plugin-2-1-2-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2023-47506
Published: 2023-12-18
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Master slider Master Slider Pro allows SQL Injection.This issue affects Master Slider Pro: from n/a through 3.6.5.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/masterslider/wordpress-master-slider-pro-plugin-3-6-5-authenticated-editor-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/masterslider/wordpress-master-slider-pro-plugin-3-6-5-authenticated-editor-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2023-47530
Published: 2023-12-18
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPVibes Redirect 404 Error Page to Homepage or Custom Page with Logs allows SQL Injection.This issue affects Redirect 404 Error Page to Homepage or Custom Page with Logs: from n/a through 1.8.7.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/redirect-404-error-page-to-homepage-or-custom-page/wordpress-redirect-404-error-page-to-homepage-or-custom-page-with-logs-plugin-1-8-7-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/redirect-404-error-page-to-homepage-or-custom-page/wordpress-redirect-404-error-page-to-homepage-or-custom-page-with-logs-plugin-1-8-7-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2023-47558
Published: 2023-12-18
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mahlamusa Who Hit The Page – Hit Counter allows SQL Injection.This issue affects Who Hit The Page – Hit Counter: from n/a through 1.4.14.3.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/who-hit-the-page-hit-counter/wordpress-who-hit-the-page-hit-counter-plugin-1-4-14-3-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/who-hit-the-page-hit-counter/wordpress-who-hit-the-page-hit-counter-plugin-1-4-14-3-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2023-49153
Published: 2023-12-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Saiful Islam Add to Cart Text Changer and Customize Button, Add Custom Icon.This issue affects Add to Cart Text Changer and Customize Button, Add Custom Icon: from n/a through 2.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/woo-add-to-cart-text-change/wordpress-add-to-cart-text-changer-and-customize-button-add-custom-icon-plugin-2-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woo-add-to-cart-text-change/wordpress-add-to-cart-text-changer-and-customize-button-add-custom-icon-plugin-2-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-49155
Published: 2023-12-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Button Generator – easily Button Builder.This issue affects Button Generator – easily Button Builder: from n/a through 2.3.8.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/button-generation/wordpress-button-generator-easily-button-builder-plugin-2-3-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/button-generation/wordpress-button-generator-easily-button-builder-plugin-2-3-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-49163
Published: 2023-12-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Michael Winkler teachPress.This issue affects teachPress: from n/a through 9.0.5.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/teachpress/wordpress-teachpress-plugin-9-0-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/teachpress/wordpress-teachpress-plugin-9-0-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve