deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-4714
Published: 2023-02-21
Description: The WP Dark Mode WordPress plugin before 4.0.0 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/61b475f1-bbfb-4450-a3b2-b8caf5df2340; https://wpscan.com/vulnerability/61b475f1-bbfb-4450-a3b2-b8caf5df2340
CVE: CVE-2022-4750
Published: 2023-02-21
Description: The WP Responsive Testimonials Slider And Widget WordPress plugin through 1.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/7bdc1324-8d08-4185-971f-8d49367702cf; https://wpscan.com/vulnerability/7bdc1324-8d08-4185-971f-8d49367702cf
CVE: CVE-2022-4752
Published: 2023-02-21
Description: The Opening Hours WordPress plugin through 2.3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/309799dd-dea7-489d-8d18-b6014534f5af; https://wpscan.com/vulnerability/309799dd-dea7-489d-8d18-b6014534f5af
CVE: CVE-2022-4754
Published: 2023-02-21
Description: The Easy Social Box / Page Plugin WordPress plugin through 4.1.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/d2cc0ab2-9bfd-4a09-ac31-bd90e6da12db; https://wpscan.com/vulnerability/d2cc0ab2-9bfd-4a09-ac31-bd90e6da12db
CVE: CVE-2022-4761
Published: 2023-02-21
Description: The Post Views Count WordPress plugin through 3.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/ad163020-8b9c-42cb-a55f-b137b224bafb; https://wpscan.com/vulnerability/ad163020-8b9c-42cb-a55f-b137b224bafb
CVE: CVE-2022-4764
Published: 2023-02-21
Description: The Simple File Downloader WordPress plugin through 1.0.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/788c6aa2-14cc-411f-95e8-5994f8c82d70; https://wpscan.com/vulnerability/788c6aa2-14cc-411f-95e8-5994f8c82d70
CVE: CVE-2022-4777
Published: 2023-02-21
Description: The Bootstrap Shortcodes WordPress plugin through 3.4.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/b4c53bef-e868-46f1-965d-720b5b9a931e; https://wpscan.com/vulnerability/b4c53bef-e868-46f1-965d-720b5b9a931e
CVE: CVE-2022-4784
Published: 2023-02-21
Description: The Hueman Addons WordPress plugin through 2.3.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/a30c6f1e-62fd-493d-ad5e-1b55ceec62a9; https://wpscan.com/vulnerability/a30c6f1e-62fd-493d-ad5e-1b55ceec62a9
CVE: CVE-2022-4785
Published: 2023-02-21
Description: The Video Sidebar Widgets WordPress plugin through 6.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/61873267-9f4f-4be5-bad6-95229ad54b99; https://wpscan.com/vulnerability/61873267-9f4f-4be5-bad6-95229ad54b99
CVE: CVE-2022-4786
Published: 2023-02-21
Description: The Video.js WordPress plugin through 4.5.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/fdad356f-cae4-4390-9a62-605201cee0c0; https://wpscan.com/vulnerability/fdad356f-cae4-4390-9a62-605201cee0c0
CVE: CVE-2022-4791
Published: 2023-02-21
Description: The Product Slider and Carousel with Category for WooCommerce WordPress plugin before 2.8 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/0a6e4c45-3f6d-4150-9546-141c2e3a1782; https://wpscan.com/vulnerability/0a6e4c45-3f6d-4150-9546-141c2e3a1782
CVE: CVE-2022-4897
Published: 2023-02-21
Description: The BackupBuddy WordPress plugin before 8.8.3 does not sanitise and escape some parameters before outputting them back in various places, leading to Reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/7b0eeafe-b9bc-43b2-8487-a23d3960f73f; https://wpscan.com/vulnerability/7b0eeafe-b9bc-43b2-8487-a23d3960f73f
CVE: CVE-2023-0059
Published: 2023-02-21
Description: The Youzify WordPress plugin before 1.2.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/5e26c485-9a5a-44a3-95b3-6c063a1c321c; https://wpscan.com/vulnerability/5e26c485-9a5a-44a3-95b3-6c063a1c321c
CVE: CVE-2023-0067
Published: 2023-02-21
Description: The Timed Content WordPress plugin before 2.73 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/92f43da9-9903-4bcf-99e8-0e269072d389; https://wpscan.com/vulnerability/92f43da9-9903-4bcf-99e8-0e269072d389
CVE: CVE-2023-0231
Published: 2023-02-21
Description: The ShopLentor WordPress plugin before 2.5.4 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/533c19d5-219c-4389-a8bf-8b3a35b33b20; https://wpscan.com/vulnerability/533c19d5-219c-4389-a8bf-8b3a35b33b20
CVE: CVE-2023-0232
Published: 2023-02-21
Description: The ShopLentor WordPress plugin before 2.5.4 unserializes user input from cookies in order to track viewed products and user data, which could lead to PHP Object Injection.
CVSS Score: 9.8 (CRITICAL)
References: https://plugins.trac.wordpress.org/changeset/2852711/woolentor-addons/trunk/includes/helper-function.php; https://wpscan.com/vulnerability/1885a708-0e8a-4f4c-8e26-069bebe9a518; https://plugins.trac.wordpress.org/changeset/2852711/woolentor-addons/trunk/includes/helper-function.php
CVE: CVE-2023-0271
Published: 2023-02-21
Description: The WP Font Awesome WordPress plugin before 1.7.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/fd7aaf06-4be7-48d6-83a1-cd5cd6c3d9c2; https://wpscan.com/vulnerability/fd7aaf06-4be7-48d6-83a1-cd5cd6c3d9c2
CVE: CVE-2023-0285
Published: 2023-02-21
Description: The Real Media Library WordPress plugin before 4.18.29 does not sanitise and escape the created folder names, which could allow users with the role of author and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/adf09e29-baf5-4426-a281-6763c107d348; https://wpscan.com/vulnerability/adf09e29-baf5-4426-a281-6763c107d348
CVE: CVE-2023-0366
Published: 2023-02-21
Description: The Loan Comparison WordPress plugin before 1.5.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/7d68b0df-7169-46b2-b8e3-4d0c2aa8d605; https://wpscan.com/vulnerability/7d68b0df-7169-46b2-b8e3-4d0c2aa8d605
CVE: CVE-2023-0371
Published: 2023-02-21
Description: The EmbedSocial WordPress plugin before 1.1.28 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/0b6381cd-fa31-4cc7-8b42-063a4c545577; https://wpscan.com/vulnerability/0b6381cd-fa31-4cc7-8b42-063a4c545577
CVE: CVE-2023-0372
Published: 2023-02-21
Description: The EmbedStories WordPress plugin before 0.7.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/9cf90ad8-4aa4-466c-a33e-4f[PII_REDACTED]; https://wpscan.com/vulnerability/9cf90ad8-4aa4-466c-a33e-4f[PII_REDACTED]
CVE: CVE-2023-0375
Published: 2023-02-21
Description: The Easy Affiliate Links WordPress plugin before 3.7.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/915d6add-d3e2-4ced-969e-9523981ac886; https://wpscan.com/vulnerability/915d6add-d3e2-4ced-969e-9523981ac886
CVE: CVE-2023-0378
Published: 2023-02-21
Description: The Greenshift WordPress plugin before 5.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/3313cc05-2267-4d93-a8a8-2c0701c21f66; https://wpscan.com/vulnerability/3313cc05-2267-4d93-a8a8-2c0701c21f66
CVE: CVE-2023-0380
Published: 2023-02-21
Description: The Easy Digital Downloads WordPress plugin before 3.1.0.5 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/3256e090-1131-459d-ade5-f052cd5d189f; https://wpscan.com/vulnerability/3256e090-1131-459d-ade5-f052cd5d189f
CVE: CVE-2023-0419
Published: 2023-02-21
Description: The Shortcode for Font Awesome WordPress plugin before 1.4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/5ccfee43-920d-4613-b976-2ea8966696ba; https://wpscan.com/vulnerability/5ccfee43-920d-4613-b976-2ea8966696ba
CVE: CVE-2023-0428
Published: 2023-02-21
Description: The Watu Quiz WordPress plugin before 3.3.8.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/c933460b-f77d-4986-9f5a-32d9f3f8b412; https://wpscan.com/vulnerability/c933460b-f77d-4986-9f5a-32d9f3f8b412
CVE: CVE-2023-0429
Published: 2023-02-21
Description: The Watu Quiz WordPress plugin before 3.3.8.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/67d84549-d368-4504-9fa9-b1fce63cb967; https://wpscan.com/vulnerability/67d84549-d368-4504-9fa9-b1fce63cb967
CVE: CVE-2023-0442
Published: 2023-02-21
Description: The Loan Comparison WordPress plugin before 1.5.3 does not validate and escape some of its query parameters before outputting them back in a page/post via an embedded shortcode, which could allow an attacker to inject javascript into into the site via a crafted URL.
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/34d95d88-4114-4597-b4db-e9f5ef80d322; https://wpscan.com/vulnerability/34d95d88-4114-4597-b4db-e9f5ef80d322
CVE: CVE-2023-0453
Published: 2023-02-21
Description: The WP Private Message WordPress plugin (bundled with the Superio theme as a required plugin) before 1.0.6 does not ensure that private messages to be accessed belong to the user making the requests. This allowing any authenticated users to access private messages belonging to other users by tampering the ID.
CVSS Score: 4.3 (MEDIUM)
References: https://themeforest.net/item/superio-job-board-wordpress-theme/32180231; https://wpscan.com/vulnerability/f915e5ac-e216-4d1c-aec1-c3be11e2a6de; https://themeforest.net/item/superio-job-board-wordpress-theme/32180231
CVE: CVE-2023-0492
Published: 2023-02-21
Description: The GS Products Slider for WooCommerce WordPress plugin before 1.5.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/ea3b129d-32d8-40e3-b1af-8b92a760db23; https://wpscan.com/vulnerability/ea3b129d-32d8-40e3-b1af-8b92a760db23
CVE: CVE-2023-0540
Published: 2023-02-21
Description: The GS Filterable Portfolio WordPress plugin before 1.6.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/b35b3da2-468d-4fe5-bff6-812432197a38; https://wpscan.com/vulnerability/b35b3da2-468d-4fe5-bff6-812432197a38
CVE: CVE-2023-0541
Published: 2023-02-21
Description: The GS Books Showcase WordPress plugin before 1.3.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/8453e587-cc8c-491a-af09-fc4ab215134b; https://wpscan.com/vulnerability/8453e587-cc8c-491a-af09-fc4ab215134b
CVE: CVE-2023-0559
Published: 2023-02-21
Description: The GS Portfolio for Envato WordPress plugin before 1.4.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/e5549261-66e2-4a5e-8781-bc555b629ccc; https://wpscan.com/vulnerability/e5549261-66e2-4a5e-8781-bc555b629ccc
CVE: CVE-2023-26267
Published: 2023-02-21
Description: php-saml-sp before 1.1.1 and 2.x before 2.1.1 allows reading arbitrary files as the webserver user because resolving XML external entities was silently enabled via \LIBXML_DTDLOAD | \LIBXML_DTDATTR.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://git.sr.ht/~fkooman/php-saml-sp/commit/851f75b298a77e62d9022f1b170f662f5f7716d6; https://git.sr.ht/~fkooman/php-saml-sp/log; https://git.sr.ht/~fkooman/php-saml-sp/commit/851f75b298a77e62d9022f1b170f662f5f7716d6
CVE: CVE-2023-0935
Published: 2023-02-21
Description: A vulnerability was found in DolphinPHP up to 1.5.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file common.php of the component Incomplete Fix CVE-2021-46097. The manipulation of the argument id leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221551.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-78
References: https://github.com/ssteveez/dolphin/blob/main/README.md; https://vuldb.com/?ctiid.221551; https://vuldb.com/?id.221551
CVE: CVE-2023-0936
Published: 2023-02-21
Description: A vulnerability was found in TP-Link Archer C50 V2_160801. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Web Management Interface. The manipulation leads to denial of service. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-221552.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-404
References: https://vuldb.com/?ctiid.221552; https://vuldb.com/?id.221552; https://vuldb.com/?ctiid.221552
CVE: CVE-2023-0938
Published: 2023-02-21
Description: A vulnerability classified as critical has been found in SourceCodester Music Gallery Site 1.0. This affects an unknown part of the file music_list.php of the component GET Request Handler. The manipulation of the argument cid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221553 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/navaidzansari/CVE_Demo/blob/main/2023/Music%20Gallery%20Site%20-%20SQL%20Injection%201.md; https://vuldb.com/?ctiid.221553; https://vuldb.com/?id.221553
CVE: CVE-2022-31394
Published: 2023-02-21
Description: Hyperium Hyper before 0.14.19 does not allow for customization of the max_header_list_size method in the H2 third-party software, allowing attackers to perform HTTP2 attacks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-770
References: https://github.com/hyperium/hyper/compare/v0.14.18...v0.14.19; https://github.com/hyperium/hyper/issues/2826; https://github.com/hyperium/hyper/pull/2828
CVE: CVE-2022-45564
Published: 2023-02-21
Description: SQL Injection vulnerability in znfit Home improvement ERP management system V50_20220207,v42 allows attackers to execute arbitrary sql commands via the userCode parameter to the wechat applet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/catwj/exp/blob/main/Injected%20by%20Shanghai%20Zhuangmeng%20Information%20Technology%20Co.%2C%20Ltd.md; https://github.com/catwj/exp/blob/main/Injected%20by%20Shanghai%20Zhuangmeng%20Information%20Technology%20Co.%2C%20Ltd.md
CVE: CVE-2022-45677
Published: 2023-02-21
Description: SQL Injection Vulnerability in tanujpatra228 Tution Management System (TMS) via the email parameter to processes/student_login.process.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-489
References: https://github.com/yukar1z0e/temp/blob/main/README.md; https://github.com/yukar1z0e/temp/blob/main/README.md
CVE: CVE-2023-25928
Published: 2023-02-21
Description: IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  247646.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/247646; https://www.ibm.com/support/pages/node/6956598; https://exchange.xforce.ibmcloud.com/vulnerabilities/247646
CVE: CVE-2015-10083
Published: 2023-02-21
Description: A vulnerability has been found in harrystech Dynosaur-Rails and classified as critical. Affected by this vulnerability is the function basic_auth of the file app/controllers/application_controller.rb. The manipulation leads to improper authentication. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named 04b223813f0e336aab50bff140d0f5889c31dbec. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-221503.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-287
References: https://github.com/harrystech/dynosaur-rails/commit/04b223813f0e336aab50bff140d0f5889c31dbec; https://github.com/harrystech/dynosaur-rails/pull/11; https://vuldb.com/?ctiid.221503
CVE: CVE-2015-10084
Published: 2023-02-21
Description: A vulnerability was found in irontec klear-library chloe and classified as critical. Affected by this issue is the function _prepareWhere of the file Controller/Rest/BaseController.php. The manipulation leads to sql injection. Upgrading to version marla is able to address this issue. The name of the patch is b25262de52fdaffde2a4434fc2a84408b304fbc5. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-221504.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/irontec/klear-library/commit/b25262de52fdaffde2a4434fc2a84408b304fbc5; https://github.com/irontec/klear-library/tree/marla; https://vuldb.com/?ctiid.221504
CVE: CVE-2021-32854
Published: 2023-02-21
Description: textAngular is a text editor for Angular.js. Version 1.5.16 and prior are vulnerable to copy-paste cross-site scripting (XSS). For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor. There are no known patches.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://securitylab.github.com/advisories/GHSL-2021-1001-textAngular/; https://securitylab.github.com/advisories/GHSL-2021-1001-textAngular/
CVE: CVE-2021-32855
Published: 2023-02-21
Description: Vditor is a browser-side Markdown editor. Versions prior to 3.8.7 are vulnerable to copy-paste cross-site scripting (XSS). For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor. Version 3.8.7 contains a patch for this issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/Vanessa219/vditor/commit/1b2382d7f8a4ee509d9245db4450d926a0b24146; https://github.com/Vanessa219/vditor/issues/1085; https://securitylab.github.com/advisories/GHSL-2021-1006-vditor/