deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-43781
Published: 2022-11-17
Description: There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and Data Center instance has enabled “Allow public signup”.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://confluence.atlassian.com/x/Y4hXRg; https://jira.atlassian.com/browse/BSERV-13522; https://confluence.atlassian.com/x/Y4hXRg
CVE: CVE-2022-43782
Published: 2022-11-17
Description: Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd application via security misconfiguration and subsequent ability to call privileged endpoints in Crowd's REST API under the {{usermanagement}} path.

This vulnerability can only be exploited by IPs specified under the crowd application allowlist in the Remote Addresses configuration, which is {{none}} by default.

The affected versions are all versions 3.x.x, versions 4.x.x before version 4.4.4, and versions 5.x.x before 5.0.3
CVSS Score: 9.8 (CRITICAL)
References: https://jira.atlassian.com/browse/CWD-5888; https://jira.atlassian.com/browse/CWD-5888
CVE: CVE-2022-40881
Published: 2022-11-17
Description: SolarView Compact 6.00 was discovered to contain a command injection vulnerability via network_test.php
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/Timorlover/SolarView_Compact_6.0_rce_via_network_test.php; https://github.com/Timorlover/SolarView_Compact_6.0_rce_via_network_test.php
CVE: CVE-2022-42187
Published: 2022-11-17
Description: Hustoj 22.09.22 has a XSS Vulnerability in /admin/problem_judge.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/zhblue/hustoj/issues/866; https://github.com/zhblue/hustoj/issues/866
CVE: CVE-2022-42245
Published: 2022-11-17
Description: Dreamer CMS 4.0.01 is vulnerable to SQL Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://gitee.com/isoftforce/dreamer_cms/issues/I5U408; https://packetstormsecurity.com/files/171585/Dreamer-CMS-4.0.0-SQL-Injection.html; https://gitee.com/isoftforce/dreamer_cms/issues/I5U408
CVE: CVE-2022-42246
Published: 2022-11-17
Description: Doufox 0.0.4 contains a CSRF vulnerability that can add system administrator account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/farliy-hacker/Doufoxcms/issues/1; https://github.com/farliy-hacker/Doufoxcms/issues/1
CVE: CVE-2022-36432
Published: 2022-11-17
Description: The Preview functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 uses eval unsafely. This allows attackers to perform Cross-site Scripting attacks on admin panel users by manipulating the generated preview application response.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/afine-com/CVE-2022-36432; https://github.com/afine-com/CVE-2022-36432
CVE: CVE-2022-39834
Published: 2022-11-17
Description: A stored XSS vulnerability was discovered in adminweb/ra/viewendentity.jsp in PrimeKey EJBCA through 7.9.0.2. A low-privilege user can store JavaScript in order to exploit a higher-privilege user.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://support.keyfactor.com/s/detail/a6x1Q000000CwCoQAK; https://support.keyfactor.com/s/detail/a6x1Q000000CwCoQAK
CVE: CVE-2022-42954
Published: 2022-11-17
Description: Keyfactor EJBCA before 7.10.0 allows XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://support.keyfactor.com/s/detail/a6x1Q000000CwCjQAK; https://support.keyfactor.com/s/detail/a6x1Q000000CwCjQAK
CVE: CVE-2022-42982
Published: 2022-11-17
Description: BKG Professional NtripCaster 2.0.39 allows querying information over the UDP protocol without authentication. The NTRIP sourcetable is typically quite long (tens of kBs) and can be requested with a packet of only 30 bytes. This presents a vector that can be used for UDP amplification attacks. Normally, only authenticated streaming data will be provided over UDP and not the sourcetable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://cve.mahi.be/bkg_ntrip_udp/; https://igs.bkg.bund.de/ntrip/bkgcaster; https://cve.mahi.be/bkg_ntrip_udp/
CVE: CVE-2022-42985
Published: 2022-11-17
Description: The ScratchLogin extension through 1.1 for MediaWiki does not escape verification failure messages, which allows users with administrator privileges to perform cross-site scripting (XSS).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/InternationalScratchWiki/mediawiki-scratch-login/blob/4d2c1229b558b9cd685961274f20b621d114f4db/ScratchLogin.common.php#L104; https://github.com/InternationalScratchWiki/mediawiki-scratch-login/pull/22; https://github.com/InternationalScratchWiki/mediawiki-scratch-login/blob/4d2c1229b558b9cd685961274f20b621d114f4db/ScratchLogin.common.php#L104
CVE: CVE-2022-45461
Published: 2022-11-17
Description: The Java Admin Console in Veritas NetBackup through 10.1 and related Veritas products on Linux and UNIX allows authenticated non-root users (that have been explicitly added to the auth.conf file) to execute arbitrary commands as root.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.veritas.com/content/support/en_US/security/VTS22-015; https://www.veritas.com/content/support/en_US/security/VTS22-015
CVE: CVE-2022-38390
Published: 2022-11-17
Description: Multiple IBM Business Automation Workflow versions are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  233978.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/233978; https://www.ibm.com/support/pages/node/6839847; https://exchange.xforce.ibmcloud.com/vulnerabilities/233978
CVE: CVE-2022-40751
Published: 2022-11-17
Description: 
IBM UrbanCode Deploy (UCD) 6.2.7.0 through 6.2.7.17, 7.0.0.0 through 7.0.5.12, 7.1.0.0 through 7.1.2.8, and 7.2.0.0 through 7.2.3.1 could allow a user with administrative privileges including "Manage Security" permissions may be able to recover a credential previously saved for performing authenticated LDAP searches.  IBM X-Force ID:  

236601.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-522, CWE-522
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/236601; https://www.ibm.com/support/pages/node/6831907; https://exchange.xforce.ibmcloud.com/vulnerabilities/236601
CVE: CVE-2022-42732
Published: 2022-11-17
Description: A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper read access control that could allow files to be retrieved from any folder accessible to the account assigned to the website’s application pool.
CVSS Score: 7.5 (HIGH)
CWE: CWE-73, CWE-610
References: https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-741697; https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-741697
CVE: CVE-2022-42733
Published: 2022-11-17
Description: A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper read access control that could allow files to be retrieved from any folder accessible to the account assigned to the website’s application pool.
CVSS Score: 7.5 (HIGH)
CWE: CWE-73, CWE-610
References: https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-741697; https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-741697
CVE: CVE-2022-42734
Published: 2022-11-17
Description: A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper write access control that could allow to write data in any folder accessible to the account assigned to the website’s application pool.
CVSS Score: 7.5 (HIGH)
CWE: CWE-73, CWE-610
References: https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-741697; https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-741697
CVE: CVE-2022-42891
Published: 2022-11-17
Description: A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper write access control that could allow to write data in any folder accessible to the account assigned to the website’s application pool.
CVSS Score: 7.5 (HIGH)
CWE: CWE-73, CWE-610
References: https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-741697; https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-741697
CVE: CVE-2022-42892
Published: 2022-11-17
Description: A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper write access control that could allow directory listing in any folder accessible to the account assigned to the website’s application pool.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-23, CWE-22
References: https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-741697; https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-741697
CVE: CVE-2022-42893
Published: 2022-11-17
Description: A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper write access control that could allow to write data in any folder accessible to the account assigned to the website’s application pool.
CVSS Score: 7.5 (HIGH)
CWE: CWE-73, CWE-610
References: https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-741697; https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-741697
CVE: CVE-2022-42894
Published: 2022-11-17
Description: A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). An unauthenticated Server-Side Request Forgery (SSRF) vulnerability was identified in one of the web services exposed on the syngo Dynamics application that could allow for the leaking of NTLM credentials as well as local service enumeration.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918, CWE-918
References: https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-741697; https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-741697
CVE: CVE-2022-43138
Published: 2022-11-17
Description: Dolibarr Open Source ERP & CRM for Business before v14.0.1 allows attackers to escalate privileges via a crafted API.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://www.exploit-db.com/exploits/50248; https://www.exploit-db.com/exploits/50248
CVE: CVE-2022-43140
Published: 2022-11-17
Description: kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component cn.keking.web.controller.OnlinePreviewController#getCorsFile. This vulnerability allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the url parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918, CWE-918
References: https://github.com/kekingcn/kkFileView/issues/392; https://github.com/kekingcn/kkFileView/issues/392
CVE: CVE-2022-44384
Published: 2022-11-17
Description: An arbitrary file upload vulnerability in rconfig v3.9.6 allows attackers to execute arbitrary code via a crafted PHP file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://www.exploit-db.com/exploits/49783; https://www.exploit-db.com/exploits/49783
CVE: CVE-2022-4051
Published: 2022-11-17
Description: A vulnerability has been found in Hostel Searching Project and classified as critical. This vulnerability affects unknown code of the file view-property.php. The manipulation of the argument property_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-213844.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-707, CWE-89
References: https://github.com/itzmehedi/Hostel-searching-project-using-PHP-Mysql/issues/1; https://vuldb.com/?id.213844; https://github.com/itzmehedi/Hostel-searching-project-using-PHP-Mysql/issues/1
CVE: CVE-2022-4052
Published: 2022-11-17
Description: A vulnerability was found in Student Attendance Management System and classified as critical. This issue affects some unknown processing of the file /Admin/createClass.php. The manipulation of the argument Id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-213845 was assigned to this vulnerability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-707, CWE-89
References: https://github.com/rickxy/Student-Attendance-Management-System/issues/2; https://vuldb.com/?id.213845; https://github.com/rickxy/Student-Attendance-Management-System/issues/2
CVE: CVE-2022-4053
Published: 2022-11-17
Description: A vulnerability was found in Student Attendance Management System. It has been classified as problematic. Affected is an unknown function of the file createClass.php. The manipulation of the argument className leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-213846 is the identifier assigned to this vulnerability.
CVSS Score: 2.4 (LOW)
CWE: CWE-707, CWE-79
References: https://github.com/rickxy/Student-Attendance-Management-System/issues/3; https://vuldb.com/?id.213846; https://github.com/rickxy/Student-Attendance-Management-System/issues/3
CVE: CVE-2022-41920
Published: 2022-11-17
Description: Lancet is a general utility library for the go programming language. Affected versions are subject to a ZipSlip issue when using the fileutil package to unzip files. This issue has been addressed and a fix will be included in versions 2.1.10 and 1.3.4. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/duke-git/lancet/commit/f133b32faa05eb93e66175d01827afa4b7094572; https://github.com/duke-git/lancet/commit/f869a0a67098e92d24ddd913e188b32404fa72c9; https://github.com/duke-git/lancet/issues/62
CVE: CVE-2022-44402
Published: 2022-11-17
Description: Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/classes/Master.php?f=delete_transaction.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/acvxd/bug_report/blob/main/vendors/oretnom23/automotive-shop-management-system/SQLi-2.md; https://github.com/acvxd/bug_report/blob/main/vendors/oretnom23/automotive-shop-management-system/SQLi-2.md
CVE: CVE-2022-44403
Published: 2022-11-17
Description: Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/admin/?page=user/manage_user&id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/acvxd/bug_report/blob/main/vendors/oretnom23/automotive-shop-management-system/SQLi-1.md; https://github.com/acvxd/bug_report/blob/main/vendors/oretnom23/automotive-shop-management-system/SQLi-1.md
CVE: CVE-2022-43142
Published: 2022-11-17
Description: A cross-site scripting (XSS) vulnerability in the add-fee.php component of Password Storage Application v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the cmddept parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/TongJinBo/BugReport/blob/main/XssBug.md; https://github.com/TongJinBo/BugReport/blob/main/XssBug.md
CVE: CVE-2021-33897
Published: 2022-11-17
Description: A buffer overflow in Synthesia before 10.7.5567, when a non-Latin locale is used, allows user-assisted attackers to cause a denial of service (application crash) via a crafted MIDI file with malformed bytes. This file is mishandled during a deletion attempt. In Synthesia before 10.9, an improper path handling allows local attackers to cause a denial of service (application crash) via a crafted MIDI file with malformed bytes.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://isopach.dev/CVE-2021-33897; https://synthesiagame.com/news; https://isopach.dev/CVE-2021-33897
CVE: CVE-2022-43162
Published: 2022-11-17
Description: Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /tests/view_test.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/zys20201225/bug_report/blob/main/vendors/oretnom23/online-diagnostic-lab-management-system/SQLi-1.md; https://github.com/zys20201225/bug_report/blob/main/vendors/oretnom23/online-diagnostic-lab-management-system/SQLi-1.md
CVE: CVE-2022-43163
Published: 2022-11-17
Description: Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /clients/view_client.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/Zer0vAv/bug_report/blob/main/vendors/oretnom23./online-diagnostic-lab-management-system/SQLi-1.md; https://github.com/Zer0vAv/bug_report/blob/main/vendors/oretnom23./online-diagnostic-lab-management-system/SQLi-1.md
CVE: CVE-2022-43179
Published: 2022-11-17
Description: Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /admin/?page=user/manage_user&id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/debug601/bug_report/blob/main/vendors/oretnom23/online-leave-management-system/SQLi-1.md; https://github.com/debug601/bug_report/blob/main/vendors/oretnom23/online-leave-management-system/SQLi-1.md
CVE: CVE-2022-43183
Published: 2022-11-17
Description: XXL-Job before v2.3.1 contains a Server-Side Request Forgery (SSRF) via the component /admin/controller/JobLogController.java.
CVSS Score: 8.8 (HIGH)
CWE: CWE-918, CWE-918
References: https://github.com/xuxueli/xxl-job/issues/3002; https://github.com/xuxueli/xxl-job/issues/3002
CVE: CVE-2021-31608
Published: 2022-11-17
Description: Proofpoint Enterprise Protection before 18.8.0 allows a Bypass of a Security Control.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-693
References: https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2021-0011; https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2021-0011
CVE: CVE-2022-38461
Published: 2022-11-17
Description: Broken Access Control vulnerability in WPML Multilingual CMS premium plugin <= 4.5.10 on WordPress allows users with a subscriber or higher user role to change plugin settings (selected language for legacy widgets, the default behavior for media content).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-264
References: https://patchstack.com/database/vulnerability/sitepress-multilingual-cms/wordpress-wpml-multilingual-cms-plugin-4-5-10-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/sitepress-multilingual-cms/wordpress-wpml-multilingual-cms-plugin-4-5-10-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2022-39389
Published: 2022-11-17
Description: Lightning Network Daemon (lnd) is an implementation of a lightning bitcoin overlay network node. All lnd nodes before version `v0.15.4` are vulnerable to a block parsing bug that can cause a node to enter a degraded state once encountered. In this degraded state, nodes can continue to make payments and forward HTLCs, and close out channels. Opening channels is prohibited, and also on chain transaction events will be undetected. This can cause loss of funds if a CSV expiry is researched during a breach attempt or a CLTV delta expires forgetting the funds in the HTLC. A patch is available in `lnd` version 0.15.4. Users are advised to upgrade. Users unable to upgrade may use the `lncli updatechanpolicy` RPC call to increase their CLTV value to a very high amount or increase their fee policies. This will prevent nodes from routing through your node, meaning that no pending HTLCs can be present.
CVSS Score: 8.2 (HIGH)
CWE: CWE-20
References: https://github.com/lightningnetwork/lnd/issues/7096; https://github.com/lightningnetwork/lnd/pull/7098; https://github.com/lightningnetwork/lnd/releases/tag/v0.15.4-beta
CVE: CVE-2022-3090
Published: 2022-11-17
Description: Red Lion Controls Crimson 3.0 versions 707.000 and prior, Crimson 3.1 versions 3126.001 and prior, and Crimson 3.2 versions 3.2.0044.0 and prior are vulnerable to path traversal. When attempting to open a file using a specific path, the user's password hash is sent to an arbitrary host. This could allow an attacker to obtain user credential hashes.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-321-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-321-01
CVE: CVE-2022-42903
Published: 2022-11-17
Description: Zoho ManageEngine SupportCenter Plus through 11024 allows low-privileged users to view the organization users list.
CVSS Score: 3.3 (LOW)
CWE: CWE-862, CWE-862
References: https://www.manageengine.com/products/support-center/cve-2022-42903.html; https://www.manageengine.com/products/support-center/cve-2022-42903.html
CVE: CVE-2022-43192
Published: 2022-11-17
Description: An arbitrary file upload vulnerability in the component /dede/file_manage_control.php of Dedecms v5.7.101 allows attackers to execute arbitrary code via a crafted PHP file. This vulnerability is related to an incomplete fix for CVE-2022-40886.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-434, CWE-434
References: https://github.com/linchuzhu/Dedecms-v5.7.101-RCE; https://github.com/linchuzhu/Dedecms-v5.7.101-RCE
CVE: CVE-2022-44001
Published: 2022-11-17
Description: An issue was discovered in BACKCLICK Professional 5.9.63. User authentication for accessing the CORBA back-end services can be bypassed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-306
References: https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-035.txt; https://www.syss.de/pentest-blog/vielfaeltige-schwachstellen-in-backclick-professional-syss-2022-026-bis-037; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-035.txt
CVE: CVE-2022-44725
Published: 2022-11-17
Description: OPC Foundation Local Discovery Server (LDS) through 1.04.403.478 uses a hard-coded file path to a configuration file. This allows a normal user to create a malicious file that is loaded by LDS (running as a high-privilege user).
CVSS Score: 7.8 (HIGH)
CWE: CWE-732, CWE-732
References: https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2022-44725.pdf; https://opcfoundation.org/developer-tools/samples-and-tools-unified-architecture/local-discovery-server-lds/; https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2022-44725.pdf
CVE: CVE-2022-45071
Published: 2022-11-17
Description: Cross-Site Request Forgery (CSRF) vulnerability in WPML Multilingual CMS premium plugin <= 4.5.13 on WordPress.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/sitepress-multilingual-cms/wordpress-wpml-multilingual-cms-premium-plugin-4-5-13-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/sitepress-multilingual-cms/wordpress-wpml-multilingual-cms-premium-plugin-4-5-13-cross-site-request-forgery-csrf-vulnerability?_s_id=cve