deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-28128
Published: 2023-05-09
Description: An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to achieve a remove code execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-434
References: http://packetstormsecurity.com/files/172398/Ivanti-Avalanche-FileStoreConfig-Shell-Upload.html; https://forums.ivanti.com/s/article/ZDI-CAN-17812-Ivanti-Avalanche-FileStoreConfig-Arbitrary-File-Upload-Remote-Code-Execution-Vulnerability?language=en_US; http://packetstormsecurity.com/files/172398/Ivanti-Avalanche-FileStoreConfig-Shell-Upload.html
CVE: CVE-2023-28316
Published: 2023-05-09
Description: A security vulnerability has been discovered in the implementation of 2FA on the rocket.chat platform, where other active sessions are not invalidated upon activating 2FA. This could potentially allow an attacker to maintain access to a compromised account even after 2FA is enabled.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-384, CWE-384
References: https://hackerone.com/reports/992280; https://hackerone.com/reports/992280
CVE: CVE-2023-28317
Published: 2023-05-09
Description: A vulnerability has been discovered in Rocket.Chat, where editing messages can change the original timestamp, causing the UI to display messages in an incorrect order.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-285, CWE-494
References: https://hackerone.com/reports/1379635; https://hackerone.com/reports/1379635
CVE: CVE-2023-28318
Published: 2023-05-09
Description: A vulnerability has been discovered in Rocket.Chat, where messages can be hidden regardless of the Message_KeepHistory or Message_ShowDeletedStatus server configuration. This allows users to bypass the intended message deletion behavior, hiding messages and deletion notices.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-285, CWE-346
References: https://hackerone.com/reports/1379451; https://hackerone.com/reports/1379451
CVE: CVE-2023-2156
Published: 2023-05-09
Description: A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol. This issue results from the lack of proper handling of user-supplied data, which can lead to an assertion failure. This may allow an unauthenticated remote attacker to create a denial of service condition on the system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617, CWE-617
References: http://www.openwall.com/lists/oss-security/2023/05/17/8; http://www.openwall.com/lists/oss-security/2023/05/17/9; http://www.openwall.com/lists/oss-security/2023/05/18/1
CVE: CVE-2023-2610
Published: 2023-05-09
Description: Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://github.com/vim/vim/commit/ab9a2d884b3a4abe319606ea95a5a6d6b01cd73a; https://huntr.dev/bounties/31e67340-935b-4f6c-a923-f7246bc29c7d; https://lists.debian.org/debian-lts-announce/2023/06/msg00015.html
CVE: CVE-2023-31478
Published: 2023-05-09
Description: An issue was discovered on GL.iNet devices before 3.216. An API endpoint reveals information about the Wi-Fi configuration, including the SSID and key.
CVSS Score: 7.5 (HIGH)
References: https://github.com/gl-inet/CVE-issues/blob/main/3.215/SSID_Key_Disclosure.md; https://www.gl-inet.com; https://github.com/gl-inet/CVE-issues/blob/main/3.215/SSID_Key_Disclosure.md
CVE: CVE-2022-36330
Published: 2023-05-10
Description: A buffer overflow vulnerability was discovered on firmware version validation that could lead to an unauthenticated remote code execution in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi devices. An attacker would require exploitation of another vulnerability to raise their privileges in order to exploit this buffer overflow vulnerability.

This issue affects My Cloud Home and My Cloud Home Duo: before 9.4.0-191; ibi: before 9.4.0-191. 




CVSS Score: 1.9 (LOW)
CWE: CWE-120, CWE-120
References: https://www.westerndigital.com/support/product-security/wdc-23003-western-digital-my-cloud-home-my-cloud-home-duo-and-sandisk-ibi-firmware-version-9-4-0-191; https://www.westerndigital.com/support/product-security/wdc-23003-western-digital-my-cloud-home-my-cloud-home-duo-and-sandisk-ibi-firmware-version-9-4-0-191
CVE: CVE-2023-25833
Published: 2023-05-10
Description: There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.0 and below that may allow a remote, authenticated attacker to create a crafted link which when clicked could render arbitrary HTML in the victim’s browser (no stateful change made or customer data rendered).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://support.esri.com/en-us/patches-updates/2023/portal-for-arcgis-security-2023-update-1-patch-8095; https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2023-update-1-patch-is-now-available/; https://support.esri.com/en-us/patches-updates/2023/portal-for-arcgis-security-2023-update-1-patch-8095
CVE: CVE-2023-26126
Published: 2023-05-10
Description: All versions of the package m.static are vulnerable to Directory Traversal due to improper input sanitization of the path being requested via the requestFile function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22, CWE-22
References: https://gist.github.com/lirantal/dcb32c11ce87f5aafd2282b90b4dc998; https://security.snyk.io/vuln/SNYK-JS-MSTATIC-3244915; https://gist.github.com/lirantal/dcb32c11ce87f5aafd2282b90b4dc998
CVE: CVE-2023-2616
Published: 2023-05-10
Description: Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/pimcore/pimcore/commit/07a2c95be524c7e20105cef58c5767d4ebb06091; https://huntr.dev/bounties/564cb512-2bcc-4458-8c20-88110ab45801; https://github.com/pimcore/pimcore/commit/07a2c95be524c7e20105cef58c5767d4ebb06091
CVE: CVE-2023-32568
Published: 2023-05-10
Description: An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2.800 and 8.x before 8.0.410. The VIOM web application does not validate user-supplied data and appends it to OS commands and internal binaries used by the application. An attacker with root/administrator level privileges can leverage this to read sensitive data stored on the servers, modify data or server configuration, and delete data or application configuration.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.veritas.com/content/support/en_US/security/VTS23-007; https://www.veritas.com/content/support/en_US/security/VTS23-007
CVE: CVE-2023-32569
Published: 2023-05-10
Description: An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2.800 and 8.x before 8.0.410. The InfoScale VIOM web application is vulnerable to SQL Injection in some of the areas of the application. This allows attackers (who must have admin credentials) to submit arbitrary SQL commands on the back-end database to create, read, update, or delete any sensitive data stored in the database.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.veritas.com/content/support/en_US/security/VTS23-007; https://www.veritas.com/content/support/en_US/security/VTS23-007
CVE: CVE-2023-32570
Published: 2023-05-10
Description: VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_decode_frame_exit.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-362, CWE-362
References: https://code.videolan.org/videolan/dav1d/-/commit/cf617fdae0b9bfabd27282854c8e81450d955efa; https://code.videolan.org/videolan/dav1d/-/tags/1.2.0; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3WGSO7UMOF4MVLQ5H6KIV7OG6ONS377B/
CVE: CVE-2022-4008
Published: 2023-05-10
Description: In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://advisories.octopus.com/post/2023/sa2023-08/; https://advisories.octopus.com/post/2023/sa2023-08/
CVE: CVE-2023-22361
Published: 2023-05-10
Description: Improper privilege management vulnerability in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier allows a remote authenticated attacker to alter a WebUI password of the product.
CVSS Score: 6.5 (MEDIUM)
References: https://jvn.jp/en/jp/JVN40604023/; https://www.seiko-sol.co.jp/archives/73969/; https://www.seiko-sol.co.jp/products/skybridge/skybridge_download/mb-a100/
CVE: CVE-2023-22441
Published: 2023-05-10
Description: Missing authentication for critical function exists in Seiko Solutions SkyBridge series, which may allow a remote attacker to obtain or alter the setting information of the product or execute some critical functions without authentication, e.g., rebooting the product. Affected products and versions are as follows: SkyBridge MB-A200 firmware Ver. 01.00.05 and earlier, and SkyBridge BASIC MB-A130 firmware Ver. 1.4.1 and earlier
CVSS Score: 8.6 (HIGH)
CWE: CWE-306, CWE-306
References: https://jvn.jp/en/jp/JVN40604023/; https://www.seiko-sol.co.jp/archives/73969/; https://www.seiko-sol.co.jp/products/skybridge/skybridge_download/mb-a100/
CVE: CVE-2023-23578
Published: 2023-05-10
Description: Improper access control vulnerability in SkyBridge MB-A200 firmware Ver. 01.00.05 and earlier allows a remote unauthenticated attacker to connect to the product's ADB port.
CVSS Score: 7.5 (HIGH)
CWE: CWE-346
References: https://jvn.jp/en/jp/JVN40604023/; https://www.seiko-sol.co.jp/archives/73969/; https://www.seiko-sol.co.jp/products/skybridge/skybridge_download/mb-a100/
CVE: CVE-2023-23901
Published: 2023-05-10
Description: Improper following of a certificate's chain of trust exists in SkyBridge MB-A200 firmware Ver. 01.00.05 and earlier, and SkyBridge BASIC MB-A130 firmware Ver. 1.4.1 and earlier, which may allow a remote unauthenticated attacker to eavesdrop on or alter the communication sent to the WebUI of the product.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-295, CWE-295
References: https://jvn.jp/en/jp/JVN40604023/; https://www.seiko-sol.co.jp/archives/73969/; https://www.seiko-sol.co.jp/products/skybridge/skybridge_download/mb-a100/
CVE: CVE-2023-23906
Published: 2023-05-10
Description: Missing authentication for critical function exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier, which may allow a remote unauthenticated attacker to execute some critical functions without authentication, e.g., rebooting the product.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: https://jvn.jp/en/jp/JVN40604023/; https://www.seiko-sol.co.jp/archives/73969/; https://www.seiko-sol.co.jp/products/skybridge/skybridge_download/mb-a100/
CVE: CVE-2023-24586
Published: 2023-05-10
Description: Cleartext storage of sensitive information exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier, which may allow a remote authenticated attacker to obtain an APN credential for the product.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-312, CWE-312
References: https://jvn.jp/en/jp/JVN40604023/; https://www.seiko-sol.co.jp/archives/73969/; https://www.seiko-sol.co.jp/products/skybridge/skybridge_download/mb-a100/
CVE: CVE-2023-25070
Published: 2023-05-10
Description: Cleartext transmission of sensitive information exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier. If the telnet connection is enabled, a remote unauthenticated attacker may eavesdrop on or alter the administrator's communication to the product.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-319, CWE-319
References: https://jvn.jp/en/jp/JVN40604023/; https://www.seiko-sol.co.jp/archives/73969/; https://www.seiko-sol.co.jp/products/skybridge/skybridge_download/mb-a100/
CVE: CVE-2023-25072
Published: 2023-05-10
Description: Use of weak credentials exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier, which may allow a remote unauthenticated attacker to decrypt password for the WebUI of the product.
CVSS Score: 7.5 (HIGH)
CWE: CWE-521, CWE-521
References: https://jvn.jp/en/jp/JVN40604023/; https://www.seiko-sol.co.jp/archives/73969/; https://www.seiko-sol.co.jp/products/skybridge/skybridge_download/mb-a100/
CVE: CVE-2023-25184
Published: 2023-05-10
Description: Use of weak credentials exists in Seiko Solutions SkyBridge and SkySpider series, which may allow a remote unauthenticated attacker to decrypt password for the WebUI of the product. Affected products and versions are as follows: SkyBridge MB-A200 firmware Ver. 01.00.05 and earlier, SkyBridge BASIC MB-A130 firmware Ver. 1.4.1 and earlier, and SkySpider MB-R210 firmware Ver. 1.01.00 and earlier.
CVSS Score: 7.5 (HIGH)
CWE: CWE-521, CWE-521
References: https://jvn.jp/en/jp/JVN40604023/; https://www.seiko-sol.co.jp/archives/73969/; https://www.seiko-sol.co.jp/products/skybridge/skybridge_download/mb-a100/
CVE: CVE-2023-27385
Published: 2023-05-10
Description: Heap-based buffer overflow vulnerability exists in CX-Drive All models all versions. By having a user open a specially crafted SDD file, arbitrary code may be executed and/or information may be disclosed.

CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://jvn.jp/en/vu/JVNVU97372625/; https://www.ia.omron.com/product/vulnerability/OMSR-2023-004_en.pdf; https://jvn.jp/en/vu/JVNVU97372625/
CVE: CVE-2023-27510
Published: 2023-05-10
Description: JB Inquiry form contains an exposure of private personal information to an unauthorized actor vulnerability, which may allow a remote unauthenticated attacker to obtain information entered from forms created using the affected product. The affected products and versions are as follows: JB Inquiry form versions 0.6.1 and 0.6.0, JB Inquiry form versions 0.5.2, 0.5.1 and 0.5.0, and JB Inquiry form version 0.40.
CVSS Score: 7.5 (HIGH)
References: https://jubei.co.jp/formmail/info20230414.html; https://jvn.jp/en/jp/JVN36340790/; https://jubei.co.jp/formmail/info20230414.html
CVE: CVE-2023-27527
Published: 2023-05-10
Description: Shinseiyo Sogo Soft (7.9A) and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the PC may be accessed by an attacker.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611, CWE-611
References: https://jvn.jp/en/jp/JVN73178249/; https://www.touki-kyoutaku-online.moj.go.jp/; https://jvn.jp/en/jp/JVN73178249/
CVE: CVE-2023-27888
Published: 2023-05-10
Description: Cross-site scripting vulnerability in Joruri Gw Ver 3.2.5 and earlier allows a remote authenticated attacker to inject an arbitrary script via Message Memo function of the affected product.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://joruri-pwm.jp/org/docs/[PII_REDACTED]017/; https://jvn.jp/en/jp/JVN87559956/; https://joruri-pwm.jp/org/docs/[PII_REDACTED]017/
CVE: CVE-2023-27889
Published: 2023-05-10
Description: Cross-site request forgery (CSRF) vulnerability in LIQUID SPEECH BALLOON versions prior to 1.2 allows a remote unauthenticated attacker to hijack the authentication of a user and to perform unintended operations by having a user view a malicious page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://jvn.jp/en/jp/JVN99657911/; https://wordpress.org/plugins/liquid-speech-balloon/#developers; https://jvn.jp/en/jp/JVN99657911/
CVE: CVE-2023-27918
Published: 2023-05-10
Description: Cross-site scripting vulnerability in Appointment and Event Booking Calendar for WordPress - Amelia versions prior to 1.0.76 allows a remote unauthenticated attacker to inject an arbitrary script by having a user who is logging in the WordPress where the product is installed visit a malicious URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://jvn.jp/en/jp/JVN00971105/; https://wordpress.org/plugins/ameliabooking/#developers; https://jvn.jp/en/jp/JVN00971105/
CVE: CVE-2023-27919
Published: 2023-05-10
Description: Authentication bypass vulnerability in NEXT ENGINE Integration Plugin (for EC-CUBE 2.0 series) all versions allows a remote unauthenticated attacker to alter the information stored in the system.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: https://jvn.jp/en/jp/JVN50862842/; https://main.next-engine.com/Usernotice/detail?id=1054; https://jvn.jp/en/jp/JVN50862842/
CVE: CVE-2023-2614
Published: 2023-05-10
Description: Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.21.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/pimcore/pimcore/commit/c36ef54ce33f7b5e74b7b0ab9eabfed47c018fc7; https://huntr.dev/bounties/1a5e6c65-2c5e-4617-9411-5b47a7e743a6; https://github.com/pimcore/pimcore/commit/c36ef54ce33f7b5e74b7b0ab9eabfed47c018fc7
CVE: CVE-2023-2615
Published: 2023-05-10
Description: Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/pimcore/pimcore/commit/7a799399e6843cd049e85da27ceb75b78505317f; https://huntr.dev/bounties/af9c360a-87f8-4e97-a24b-6db675ee942a; https://github.com/pimcore/pimcore/commit/7a799399e6843cd049e85da27ceb75b78505317f
CVE: CVE-2023-2617
Published: 2023-05-10
Description: A vulnerability classified as problematic was found in OpenCV wechat_qrcode Module up to 4.7.0. Affected by this vulnerability is the function DecodedBitStreamParser::decodeByteSegment of the file qrcode/decoder/decoded_bit_stream_parser.cpp. The manipulation leads to null pointer dereference. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-228547.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://gist.github.com/GZTimeWalker/3ca70a8af2f5830711e9cccc73fb5270; https://github.com/opencv/opencv_contrib/pull/3480; https://vuldb.com/?ctiid.228547
CVE: CVE-2023-2618
Published: 2023-05-10
Description: A vulnerability, which was classified as problematic, has been found in OpenCV wechat_qrcode Module up to 4.7.0. Affected by this issue is the function DecodedBitStreamParser::decodeHanziSegment of the file qrcode/decoder/decoded_bit_stream_parser.cpp. The manipulation leads to memory leak. The attack may be launched remotely. The name of the patch is 2b62ff6181163eea029ed1cab11363b4996e9cd6. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-228548.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-401
References: https://github.com/opencv/opencv_contrib/pull/3484; https://github.com/opencv/opencv_contrib/pull/3484/commits/2b62ff6181163eea029ed1cab11363b4996e9cd6; https://vuldb.com/?ctiid.228548
CVE: CVE-2023-2619
Published: 2023-05-10
Description: A vulnerability, which was classified as critical, was found in SourceCodester Online Tours & Travels Management System 1.0. This affects the function exec of the file disapprove_delete.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-228549 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://blog.csdn.net/weixin_43864034/article/details/130596916; https://vuldb.com/?ctiid.228549; https://vuldb.com/?id.228549
CVE: CVE-2023-30777
Published: 2023-05-10
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WP Engine Advanced Custom Fields Pro, WP Engine Advanced Custom Fields plugins <= 6.1.5 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/articles/reflected-xss-in-advanced-custom-fields-plugins-affecting-2-million-sites?_s_id=cve; https://patchstack.com/database/vulnerability/advanced-custom-fields-pro/wordpress-advanced-custom-fields-pro-plugin-6-1-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/advanced-custom-fields/wordpress-advanced-custom-fields-plugin-6-1-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-32573
Published: 2023-05-10
Description: In Qt before 5.15.14, 6.0.x through 6.2.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1, QtSvg QSvgFont m_unitsPerEm initialization is mishandled.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-369, CWE-369
References: https://codereview.qt-project.org/c/qt/qtsvg/+/474093; https://lists.debian.org/debian-lts-announce/2023/08/msg00028.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UE3IHQZCEUFVOPWG75V2HDKXNUZBB4FX/
CVE: CVE-2023-22711
Published: 2023-05-10
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Agent Evolution IMPress Listings plugin <= 2.6.2 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-listings/wordpress-impress-listings-plugin-2-6-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-listings/wordpress-impress-listings-plugin-2-6-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23701
Published: 2023-05-10
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Andrew @ Geeenville Web Design Easy Sign Up plugin <= 3.4.1 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/easy-sign-up/wordpress-easy-sign-up-plugin-3-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/easy-sign-up/wordpress-easy-sign-up-plugin-3-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23786
Published: 2023-05-10
Description: Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Christof Servit affiliate-toolkit plugin <= 3.3.3 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/affiliate-toolkit-starter/wordpress-affiliate-toolkit-plugin-3-3-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/affiliate-toolkit-starter/wordpress-affiliate-toolkit-plugin-3-3-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23788
Published: 2023-05-10
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Florin Arjocu Custom More Link Complete plugin <= 1.4.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/custom-more-link-complete/wordpress-custom-more-link-complete-plugin-1-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/custom-more-link-complete/wordpress-custom-more-link-complete-plugin-1-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23789
Published: 2023-05-10
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Premmerce Premmerce Redirect Manager plugin <= 1.0.9 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/premmerce-redirect-manager/wordpress-premmerce-redirect-manager-plugin-1-0-9-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/premmerce-redirect-manager/wordpress-premmerce-redirect-manager-plugin-1-0-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23812
Published: 2023-05-10
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Joost de Valk Enhanced WP Contact Form plugin <= 2.2.3 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/enhanced-wordpress-contactform/wordpress-enhanced-wp-contact-form-plugin-2-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/enhanced-wordpress-contactform/wordpress-enhanced-wp-contact-form-plugin-2-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve