deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-38545
Published: 2023-10-18
Description: This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy
handshake.

When curl is asked to pass along the host name to the SOCKS5 proxy to allow
that to resolve the address instead of it getting done by curl itself, the
maximum length that host name can be is 255 bytes.

If the host name is detected to be longer, curl switches to local name
resolving and instead passes on the resolved address only. Due to this bug,
the local variable that means "let the host resolve the name" could get the
wrong value during a slow SOCKS5 handshake, and contrary to the intention,
copy the too long host name to the target buffer instead of copying just the
resolved address there.

The target buffer being a heap based buffer, and the host name coming from the
URL that curl has been told to operate with.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: http://seclists.org/fulldisclosure/2024/Jan/34; http://seclists.org/fulldisclosure/2024/Jan/37; http://seclists.org/fulldisclosure/2024/Jan/38
CVE: CVE-2023-38546
Published: 2023-10-18
Description: This flaw allows an attacker to insert cookies at will into a running program
using libcurl, if the specific series of conditions are met.

libcurl performs transfers. In its API, an application creates "easy handles"
that are the individual handles for single transfers.

libcurl provides a function call that duplicates en easy handle called
[curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html).

If a transfer has cookies enabled when the handle is duplicated, the
cookie-enable state is also cloned - but without cloning the actual
cookies. If the source handle did not read any cookies from a specific file on
disk, the cloned version of the handle would instead store the file name as
`none` (using the four ASCII letters, no quotes).

Subsequent use of the cloned handle that does not explicitly set a source to
load cookies from would then inadvertently load cookies from a file named
`none` - if such a file exists and is readable in the current directory of the
program using libcurl. And if using the correct file format of course.
CVSS Score: 3.7 (LOW)
References: http://seclists.org/fulldisclosure/2024/Jan/34; http://seclists.org/fulldisclosure/2024/Jan/37; http://seclists.org/fulldisclosure/2024/Jan/38
CVE: CVE-2023-38552
Published: 2023-10-18
Description: When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy implementation, thus effectively disabling the integrity check.
Impacts:
This vulnerability affects all users using the experimental policy mechanism in all active release lines: 18.x and, 20.x.
Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js.
CVSS Score: 7.5 (HIGH)
CWE: CWE-345
References: https://hackerone.com/reports/2094235; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/
CVE: CVE-2023-39331
Published: 2023-10-18
Description: A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://hackerone.com/reports/2092852; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://hackerone.com/reports/2092852
CVE: CVE-2023-39332
Published: 2023-10-18
Description: Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class extends the `Uint8Array` class. Node.js prevents path traversal through strings (see CVE-2023-30584) and `Buffer` objects (see CVE-2023-32004), but not through non-`Buffer` `Uint8Array` objects.

This is distinct from CVE-2023-32004 which only referred to `Buffer` objects. However, the vulnerability follows the same pattern using `Uint8Array` instead of `Buffer`.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://hackerone.com/reports/2199818; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-3254
Published: 2023-10-18
Description: The Widgets for Google Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.9. This is due to missing or incorrect nonce validation within setup_no_reg_header.php. This makes it possible for unauthenticated attackers to reset plugin settings and remove reviews via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2980022%40wp-reviews-plugin-for-google%2Ftrunk&old=2977531%40wp-reviews-plugin-for-google%2Ftrunk&sfp_email=&sfph_mail=#file8; https://www.wordfence.com/threat-intel/vulnerabilities/id/70968476-b064-477f-999f-4aa2c51d89cc?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2980022%40wp-reviews-plugin-for-google%2Ftrunk&old=2977531%40wp-reviews-plugin-for-google%2Ftrunk&sfp_email=&sfph_mail=#file8
CVE: CVE-2023-5538
Published: 2023-10-18
Description: The MpOperationLogs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the IP Request Headers in versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/juweihuitao/MpOperationLogs/; https://plugins.trac.wordpress.org/browser/mpoperationlogs/trunk/common.php#L10; https://plugins.trac.wordpress.org/browser/mpoperationlogs/trunk/template/ipslist_td.php
CVE: CVE-2023-42319
Published: 2023-10-18
Description: Geth (aka go-ethereum) through 1.13.4, when --http --graphql is used, allows remote attackers to cause a denial of service (memory consumption and daemon hang) via a crafted GraphQL query. NOTE: the vendor's position is that the "graphql endpoint [is not] designed to withstand attacks by hostile clients, nor handle huge amounts of clients/traffic.
CVSS Score: 7.5 (HIGH)
References: https://blog.mevsec.com/posts/geth-dos-with-graphql/; https://geth.ethereum.org/docs/fundamentals/security; https://blog.mevsec.com/posts/geth-dos-with-graphql/
CVE: CVE-2023-25476
Published: 2023-10-18
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ezoic AmpedSense – AdSense Split Tester plugin <= 4.68 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/ampedsense-adsense-split-tester/wordpress-ampedsense-adsense-split-tester-plugin-4-68-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ampedsense-adsense-split-tester/wordpress-ampedsense-adsense-split-tester-plugin-4-68-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-45008
Published: 2023-10-18
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPJohnny Comment Reply Email plugin <= 1.0.3 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/comment-reply-email/wordpress-comment-reply-email-plugin-1-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/comment-reply-email/wordpress-comment-reply-email-plugin-1-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-45049
Published: 2023-10-18
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Ciprian Popescu YouTube Playlist Player plugin <= 4.6.7 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/youtube-playlist-player/wordpress-youtube-playlist-player-plugin-4-6-7-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/youtube-playlist-player/wordpress-youtube-playlist-player-plugin-4-6-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-4938
Published: 2023-10-18
Description: The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability check on the woobe_bulkoperations_apply_default_combination function. This makes it possible for authenticated attackers (subscriber or higher) to manipulate products.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/woo-bulk-editor/trunk/ext/bulkoperations/bulkoperations.php#L286; https://plugins.trac.wordpress.org/changeset/2970262/woo-bulk-editor/trunk/ext/bulkoperations/bulkoperations.php?contextall=1&old=2844667&old_path=%2Fwoo-bulk-editor%2Ftrunk%2Fext%2Fbulkoperations%2Fbulkoperations.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/c42f56a2-b9f9-40ef-86ad-fea6cf2e29f8?source=cve
CVE: CVE-2023-5621
Published: 2023-10-18
Description: The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Title field in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=1263536%40wp-responsive-slider-with-lightbox&new=1263536%40wp-responsive-slider-with-lightbox&sfp_email=&sfph_mail=; https://wordpress.org/plugins/wp-responsive-slider-with-lightbox/; https://www.wordfence.com/threat-intel/vulnerabilities/id/547c425d-8b0f-4e65-8b8a-c3a3059301fe?source=cve
CVE: CVE-2023-45051
Published: 2023-10-18
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Image vertical reel scroll slideshow plugin <= 9.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/image-vertical-reel-scroll-slideshow/wordpress-image-vertical-reel-scroll-slideshow-plugin-9-0-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/image-vertical-reel-scroll-slideshow/wordpress-image-vertical-reel-scroll-slideshow-plugin-9-0-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-45054
Published: 2023-10-18
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in AWESOME TOGI Product Category Tree plugin <= 2.5 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/product-category-tree/wordpress-product-category-tree-plugin-2-5-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/product-category-tree/wordpress-product-category-tree-plugin-2-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-45056
Published: 2023-10-18
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in 100plugins Open User Map plugin <= 1.3.26 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/open-user-map/wordpress-open-user-map-plugin-1-3-24-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/open-user-map/wordpress-open-user-map-plugin-1-3-24-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-45057
Published: 2023-10-18
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Hitsteps Web Analytics plugin <= 5.86 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/hitsteps-visitor-manager/wordpress-hitsteps-web-analytics-plugin-5-85-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/hitsteps-visitor-manager/wordpress-hitsteps-web-analytics-plugin-5-85-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-45059
Published: 2023-10-18
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Gumroad plugin <= 3.1.0 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/gumroad/wordpress-gumroad-plugin-3-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/gumroad/wordpress-gumroad-plugin-3-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-45062
Published: 2023-10-18
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Thomas Scholl canvasio3D Light plugin <= 2.4.6 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/canvasio3d-light/wordpress-canvasio3d-light-plugin-2-4-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/canvasio3d-light/wordpress-canvasio3d-light-plugin-2-4-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-45064
Published: 2023-10-18
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Daisuke Takahashi(Extend Wings) OPcache Dashboard plugin <= 0.3.1 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/opcache/wordpress-opcache-dashboard-plugin-0-3-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/opcache/wordpress-opcache-dashboard-plugin-0-3-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-5632
Published: 2023-10-18
Description: In Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server without sending data causes the EPOLLOUT event to be added, which results excessive CPU consumption. This could be used by a malicious actor to perform denial of service type attack. This issue is fixed in 2.0.6



CVSS Score: 7.5 (HIGH)
CWE: CWE-834, CWE-834
References: https://github.com/eclipse/mosquitto/commit/18bad1ff32435e523d7507e9b2ce0010124a8f2d; https://github.com/eclipse/mosquitto/pull/2053; https://github.com/eclipse/mosquitto/commit/18bad1ff32435e523d7507e9b2ce0010124a8f2d
CVE: CVE-2023-45727
Published: 2023-10-18
Description: Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthenticated attacker to conduct XML External Entity (XXE) attacks. By processing a specially crafted request containing malformed XML data, arbitrary files on the server containing account information may be read by the attacker.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611, CWE-611
References: https://jvn.jp/en/jp/JVN95981460/; https://www.proself.jp/information/153/; https://jvn.jp/en/jp/JVN95981460/
CVE: CVE-2023-32087
Published: 2023-10-18
Description: 
Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with task creation






CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://support.pega.com/support-doc/pega-security-advisory-e23-vulnerability-remediation-note; https://support.pega.com/support-doc/pega-security-advisory-e23-vulnerability-remediation-note
CVE: CVE-2023-32088
Published: 2023-10-18
Description: 
Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with ad-hoc case creation






CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://support.pega.com/support-doc/pega-security-advisory-e23-vulnerability-remediation-note; https://support.pega.com/support-doc/pega-security-advisory-e23-vulnerability-remediation-note
CVE: CVE-2023-32089
Published: 2023-10-18
Description: 
Pega Platform versions 8.1 to 8.8.2 are affected by an XSS issue with Pin description






CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://support.pega.com/support-doc/pega-security-advisory-e23-vulnerability-remediation-note; https://support.pega.com/support-doc/pega-security-advisory-e23-vulnerability-remediation-note
CVE: CVE-2023-31217
Published: 2023-10-18
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in MyTechTalky User Location and IP plugin <= 1.6 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/user-location-and-ip/wordpress-user-location-and-ip-plugin-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/user-location-and-ip/wordpress-user-location-and-ip-plugin-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-45065
Published: 2023-10-18
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Mad Fish Digital Bulk NoIndex & NoFollow Toolkit plugin <= 1.42 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/bulk-noindex-nofollow-toolkit-by-mad-fish/wordpress-bulk-noindex-nofollow-toolkit-plugin-1-42-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/bulk-noindex-nofollow-toolkit-by-mad-fish/wordpress-bulk-noindex-nofollow-toolkit-plugin-1-42-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-45067
Published: 2023-10-18
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Ashish Ajani WordPress Simple HTML Sitemap plugin <= 2.1 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/wp-simple-html-sitemap/wordpress-wordpress-simple-html-sitemap-plugin-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-simple-html-sitemap/wordpress-wordpress-simple-html-sitemap-plugin-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-45070
Published: 2023-10-18
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in 10Web Form Builder Team Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin <= 1.15.18 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/form-maker/wordpress-form-maker-by-10web-mobile-friendly-drag-drop-contact-form-builder-plugin-1-15-18-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/form-maker/wordpress-form-maker-by-10web-mobile-friendly-drag-drop-contact-form-builder-plugin-1-15-18-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-45071
Published: 2023-10-18
Description: Unauth. Stored Cross-Site Scripting (XSS) vulnerability in 10Web Form Builder Team Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin <= 1.15.18 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/form-maker/wordpress-form-maker-by-10web-mobile-friendly-drag-drop-contact-form-builder-plugin-1-15-18-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/form-maker/wordpress-form-maker-by-10web-mobile-friendly-drag-drop-contact-form-builder-plugin-1-15-18-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-45072
Published: 2023-10-18
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kardi Order auto complete for WooCommerce plugin <= 1.2.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/order-auto-complete-for-woocommerce/wordpress-order-auto-complete-for-woocommerce-plugin-1-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/order-auto-complete-for-woocommerce/wordpress-order-auto-complete-for-woocommerce-plugin-1-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-45073
Published: 2023-10-18
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Michael Koch Mendeley Plugin plugin <= 1.3.2 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/mendeleyplugin/wordpress-mendeley-plugin-plugin-1-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/mendeleyplugin/wordpress-mendeley-plugin-plugin-1-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-45608
Published: 2023-10-18
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Nicola Modugno Smart Cookie Kit plugin <= 2.3.1 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/smart-cookie-kit/wordpress-smart-cookie-kit-plugin-2-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/smart-cookie-kit/wordpress-smart-cookie-kit-plugin-2-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-46004
Published: 2023-10-18
Description: Sourcecodester Best Courier Management System 1.0 is vulnerable to Arbitrary file upload in the update_user function.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/zerrr0/Zerrr0_Vulnerability/blob/main/Best%20Courier%20Management%20System%201.0/Arbitrary-File-Upload-Vulnerability.md; https://github.com/zerrr0/Zerrr0_Vulnerability/blob/main/Best%20Courier%20Management%20System%201.0/Arbitrary-File-Upload-Vulnerability.md
CVE: CVE-2023-46005
Published: 2023-10-18
Description: Sourcecodester Best Courier Management System 1.0 is vulnerable to SQL Injection via the parameter id in /edit_branch.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/zerrr0/Zerrr0_Vulnerability/blob/main/Best%20Courier%20Management%20System%201.0/SQL-Injection-Vulnerability.md; https://github.com/zerrr0/Zerrr0_Vulnerability/blob/main/Best%20Courier%20Management%20System%201.0/SQL-Injection-Vulnerability.md
CVE: CVE-2023-46006
Published: 2023-10-18
Description: Sourcecodester Best Courier Management System 1.0 is vulnerable to SQL Injection via the parameter id in /edit_user.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/zerrr0/Zerrr0_Vulnerability/blob/main/Best%20Courier%20Management%20System%201.0/SQL-Injection-Vulnerability-2.md; https://github.com/zerrr0/Zerrr0_Vulnerability/blob/main/Best%20Courier%20Management%20System%201.0/SQL-Injection-Vulnerability-2.md
CVE: CVE-2023-46007
Published: 2023-10-18
Description: Sourcecodester Best Courier Management System 1.0 is vulnerable to SQL Injection via the parameter id in /edit_staff.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/zerrr0/Zerrr0_Vulnerability/blob/main/Best%20Courier%20Management%20System%201.0/SQL-Injection-Vulnerability-3.md; https://github.com/zerrr0/Zerrr0_Vulnerability/blob/main/Best%20Courier%20Management%20System%201.0/SQL-Injection-Vulnerability-3.md
CVE: CVE-2023-30781
Published: 2023-10-18
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Theme Blvd Tweeple plugin <= 0.9.5 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/tweeple/wordpress-tweeple-plugin-0-9-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/tweeple/wordpress-tweeple-plugin-0-9-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve