deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-30989
Published: 2023-07-16
Description: IBM Performance Tools for i 7.2, 7.3, 7.4, and 7.5 contains a local privilege escalation vulnerability.  A malicious actor with command line access to the host operating system can elevate privileges to gain all object access to the host operating system.  IBM X-Force ID:  254017.
CVSS Score: 8.4 (HIGH)
CWE: CWE-269
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/254017; https://www.ibm.com/support/pages/node/7012353; https://exchange.xforce.ibmcloud.com/vulnerabilities/254017
CVE: CVE-2023-33857
Published: 2023-07-17
Description: IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain system information using a specially crafted query that could aid in further attacks against the system.  IBM X-Force ID:  257695.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/257695; https://www.ibm.com/support/pages/node/7007059; https://exchange.xforce.ibmcloud.com/vulnerabilities/257695
CVE: CVE-2023-35901
Published: 2023-07-17
Description: IBM Robotic Process Automation 21.0.0 through 21.0.7.6 and 23.0.0 through 23.0.6 is vulnerable to client side validation bypass which could allow invalid changes or values in some fields.  IBM X-Force ID:  259380.
CVSS Score: 2.7 (LOW)
CWE: CWE-287, CWE-287
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/259380; https://www.ibm.com/support/pages/node/7012317; https://exchange.xforce.ibmcloud.com/vulnerabilities/259380
CVE: CVE-2023-3694
Published: 2023-07-17
Description: A vulnerability, which was classified as critical, has been found in SourceCodester/projectworlds House Rental and Property Listing 1.0. This issue affects some unknown processing of the file /index.php. The manipulation of the argument keywords/location leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/safetom6/House-Rental-and-Property-Listing-System/blob/main/House%20Rental%20and%20Property%20Listing%20System%20index.php%20has%20Sqlinjection.pdf; https://vuldb.com/?ctiid.234245; https://vuldb.com/?id.234245
CVE: CVE-2023-35012
Published: 2023-07-17
Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 with a Federated configuration is vulnerable to a stack-based buffer overflow, caused by improper bounds checking.  A local user with SYSADM privileges could overflow the buffer and execute arbitrary code on the system.  IBM X-Force ID:  257763.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/257763; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/7010747
CVE: CVE-2023-3695
Published: 2023-07-17
Description: A vulnerability classified as critical has been found in Campcodes Beauty Salon Management System 1.0. Affected is an unknown function of the file add-product.php. The manipulation of the argument category leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-234252.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Beauty%20Salon%20Management%20System%20-%20vuln%201.pdf; https://vuldb.com/?ctiid.234252; https://vuldb.com/?id.234252
CVE: CVE-2023-3696
Published: 2023-07-17
Description: Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321
References: https://github.com/automattic/mongoose/commit/305ce4ff789261df7e3f6e72363d0703e025f80d; https://huntr.dev/bounties/1eef5a72-f6ab-4f61-b31d-fc66f5b4b467; https://github.com/automattic/mongoose/commit/305ce4ff789261df7e3f6e72363d0703e025f80d
CVE: CVE-2022-4952
Published: 2023-07-17
Description: A vulnerability has been found in OmniSharp csharp-language-server-protocol up to 0.19.6 and classified as problematic. This vulnerability affects the function CreateSerializerSettings of the file src/JsonRpc/Serialization/SerializerBase.cs of the component JSON Serializer. The manipulation leads to resource consumption. Upgrading to version 0.19.7 is able to address this issue. The patch is identified as 7fd2219f194a9ef2a8901bb131c5fa12272305ce. It is recommended to upgrade the affected component. VDB-234238 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-400
References: https://github.com/OmniSharp/csharp-language-server-protocol/commit/7fd2219f194a9ef2a8901bb131c5fa12272305ce; https://github.com/OmniSharp/csharp-language-server-protocol/pull/902; https://github.com/OmniSharp/csharp-language-server-protocol/releases/tag/v0.19.7
CVE: CVE-2023-2759
Published: 2023-07-17
Description: A hidden API exists in TapHome's core platform before version 2023.2 that allows an authenticated, low privileged user to change passwords of other users without any prior knowledge. The attacker may gain full access to the device by using this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://claroty.com/team82/disclosure-dashboard/cve-2023-2759; https://claroty.com/team82/disclosure-dashboard/cve-2023-2759
CVE: CVE-2023-2760
Published: 2023-07-17
Description: An SQL injection vulnerability exists in TapHome core HandleMessageUpdateDevicePropertiesRequest function before version 2023.2, allowing low privileged users to inject arbitrary SQL directives into an SQL query and execute arbitrary SQL commands and get full reading access. This may also lead to limited write access and temporary Denial-of-Service.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89, CWE-89
References: https://claroty.com/team82/disclosure-dashboard/cve-2023-2759; https://claroty.com/team82/disclosure-dashboard/cve-2023-2759
CVE: CVE-2023-3700
Published: 2023-07-17
Description: Authorization Bypass Through User-Controlled Key in GitHub repository alextselegidis/easyappointments prior to 1.5.0.


CVSS Score: 6.3 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://github.com/alextselegidis/easyappointments/commit/b37b[PII_REDACTED]9db4f22eb2fe998bca84b2cb64; https://huntr.dev/bounties/e8d530db-a6a7-4f79-a95d-b77654cc04f8; https://github.com/alextselegidis/easyappointments/commit/b37b[PII_REDACTED]9db4f22eb2fe998bca84b2cb64
CVE: CVE-2023-26512
Published: 2023-07-17
Description: CWE-502 Deserialization of Untrusted Data at the rabbitmq-connector plugin module in Apache EventMesh (incubating) V1.7.0\V1.8.0 on windows\linux\mac os e.g. platforms allows attackers to send controlled message and 

remote code execute via rabbitmq messages. Users can use the code under the master branch in project repo to fix this issue, we will release the new version as soon as possible.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://lists.apache.org/thread/zb1d62wh8o8pvntrnx4t1hj8vz0pm39p; https://lists.apache.org/thread/zb1d62wh8o8pvntrnx4t1hj8vz0pm39p
CVE: CVE-2023-22672
Published: 2023-07-17
Description: Cross-Site Request Forgery (CSRF) vulnerability in Mr.Vibe vSlider Multi Image Slider for WordPress plugin <= 4.1.2 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/vslider/wordpress-vslider-multi-image-slider-for-wordpress-plugin-4-1-2-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/vslider/wordpress-vslider-multi-image-slider-for-wordpress-plugin-4-1-2-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2023-23646
Published: 2023-07-17
Description: Cross-Site Request Forgery (CSRF) vulnerability in A WP Life Album Gallery – WordPress Gallery plugin <= 1.4.9 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/new-album-gallery/wordpress-album-gallery-wordpress-gallery-plugin-1-4-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/new-album-gallery/wordpress-album-gallery-wordpress-gallery-plugin-1-4-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-23719
Published: 2023-07-17
Description: Cross-Site Request Forgery (CSRF) vulnerability in Premmerce plugin <= 1.3.17 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/premmerce/wordpress-premmerce-plugin-1-3-17-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/premmerce/wordpress-premmerce-plugin-1-3-17-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-27606
Published: 2023-07-17
Description: Cross-Site Request Forgery (CSRF) vulnerability in Sajjad Hossain WP Reroute Email plugin <= 1.4.6 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-reroute-email/wordpress-wp-reroute-email-plugin-1-4-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-reroute-email/wordpress-wp-reroute-email-plugin-1-4-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-34036
Published: 2023-07-17
Description: 
Reactive web applications that use Spring HATEOAS to produce hypermedia-based responses might be exposed to malicious forwarded headers if they are not behind a trusted proxy that ensures correctness of such headers, or if they don't have anything else in place to handle (and possibly discard) forwarded headers either in WebFlux or at the level of the underlying HTTP server.

For the application to be affected, it needs to satisfy the following requirements:

  *  It needs to use the reactive web stack (Spring WebFlux) and Spring HATEOAS to create links in hypermedia-based responses.
  *  The application infrastructure does not guard against clients submitting (X-)Forwarded… headers.






CVSS Score: 5.3 (MEDIUM)
CWE: CWE-644, CWE-116
References: https://spring.io/security/cve-2023-34036; https://spring.io/security/cve-2023-34036
CVE: CVE-2023-27424
Published: 2023-07-17
Description: Cross-Site Request Forgery (CSRF) vulnerability in Korol Yuriy aka Shra Inactive User Deleter plugin <= 1.59 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/inactive-user-deleter/wordpress-inactive-user-deleter-plugin-1-58-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/inactive-user-deleter/wordpress-inactive-user-deleter-plugin-1-58-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-2912
Published: 2023-07-17
Description: Use After Free vulnerability in Secomea SiteManager Embedded allows Obstruction.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://www.secomea.com/support/cybersecurity-advisory/; https://www.secomea.com/support/cybersecurity-advisory/
CVE: CVE-2022-4023
Published: 2023-07-17
Description: The 3DPrint WordPress plugin before 3.5.6.9 does not protect against CSRF attacks in the modified version of Tiny File Manager included with the plugin, allowing an attacker to craft a malicious request that will create an archive of any files or directories on the target server by tricking a logged in admin into submitting a form. Furthermore the created archive has a predictable location and name, allowing the attacker to download the file if they know the time at which the form was submitted, making it possible to leak sensitive files like the WordPress configuration containing database credentials and secrets.
CVSS Score: 5.3 (MEDIUM)
References: https://jetpack.com/blog/vulnerabilities-found-in-the-3dprint-premium-plugin/; https://wpscan.com/vulnerability/859c6e7e-2381-4d93-a526-2000b4fb8fee; https://jetpack.com/blog/vulnerabilities-found-in-the-3dprint-premium-plugin/
CVE: CVE-2023-0439
Published: 2023-07-17
Description: The NEX-Forms WordPress plugin before 8.4.4 does not escape its form name, which could lead to Stored Cross-Site Scripting issues. By default only SuperAdmins (in multisite) / admins (in single site) can create forms, however there is a settings allowing them to give lower roles access to such feature.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/04cea9aa-b21c-49f8-836b-2d312253e09a; https://wpscan.com/vulnerability/04cea9aa-b21c-49f8-836b-2d312253e09a
CVE: CVE-2023-1893
Published: 2023-07-17
Description: The Login Configurator WordPress plugin through 2.1 does not properly escape a URL parameter before outputting it to the page, leading to a reflected cross-site scripting vulnerability targeting site administrators.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/173723/WordPress-Login-Configurator-2.1-Cross-Site-Scripting.html; https://wpscan.com/vulnerability/dbe6cf09-971f-42e9-b[PII_REDACTED]168c7; http://packetstormsecurity.com/files/173723/WordPress-Login-Configurator-2.1-Cross-Site-Scripting.html
CVE: CVE-2023-2143
Published: 2023-07-17
Description: The Enable SVG, WebP & ICO Upload WordPress plugin through 1.0.3 does not sanitize SVG file contents, leading to a Cross-Site Scripting vulnerability.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/91898762-aa7d-4fbc-a016-3de48901e5de; https://wpscan.com/vulnerability/91898762-aa7d-4fbc-a016-3de48901e5de
CVE: CVE-2023-2329
Published: 2023-07-17
Description: The WooCommerce Google Sheet Connector WordPress plugin before 1.3.6 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack
CVSS Score: 8.8 (HIGH)
References: https://wpscan.com/vulnerability/6e58f099-e8d6-49e4-9f02-d6a556c5b1d2; https://wpscan.com/vulnerability/6e58f099-e8d6-49e4-9f02-d6a556c5b1d2
CVE: CVE-2023-2330
Published: 2023-07-17
Description: The Caldera Forms Google Sheets Connector WordPress plugin before 1.3 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack
CVSS Score: 8.8 (HIGH)
References: https://wpscan.com/vulnerability/fa8ccdd0-7b23-4b12-9aa9-4b29d47256b8; https://wpscan.com/vulnerability/fa8ccdd0-7b23-4b12-9aa9-4b29d47256b8
CVE: CVE-2023-2579
Published: 2023-07-17
Description: The InventoryPress WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow users with the role of author and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://github.com/daniloalbuqrque/poc-cve-xss-inventory-press-plugin; https://wpscan.com/vulnerability/3cfcb8cc-9c4f-409c-934f-9f3f043de6fe; https://github.com/daniloalbuqrque/poc-cve-xss-inventory-press-plugin
CVE: CVE-2023-2636
Published: 2023-07-17
Description: The AN_GradeBook WordPress plugin through 5.0.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/173815/WordPress-AN_Gradebook-5.0.1-SQL-Injection.html; https://wpscan.com/vulnerability/6a3bfd88-1251-4d40-b26f-62950a3ce0b5; http://packetstormsecurity.com/files/173815/WordPress-AN_Gradebook-5.0.1-SQL-Injection.html
CVE: CVE-2023-2701
Published: 2023-07-17
Description: The Gravity Forms WordPress plugin before 2.7.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high-privileged users such as admin.
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/298fbe34-62c2-4e56-9bdb-90da570c5bbe; https://wpscan.com/vulnerability/298fbe34-62c2-4e56-9bdb-90da570c5bbe
CVE: CVE-2023-2959
Published: 2023-07-17
Description: Authentication Bypass by Primary Weakness vulnerability in Oliva Expertise Oliva Expertise EKS allows Collect Data as Provided by Users.This issue affects Oliva Expertise EKS: before 1.2.


CVSS Score: 7.5 (HIGH)
CWE: CWE-305, CWE-287
References: https://www.usom.gov.tr/bildirim/tr-23-0409; https://www.usom.gov.tr/bildirim/tr-23-0409
CVE: CVE-2023-2960
Published: 2023-07-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Oliva Expertise Oliva Expertise EKS allows Cross-Site Scripting (XSS).This issue affects Oliva Expertise EKS: before 1.2.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-23-0409; https://www.usom.gov.tr/bildirim/tr-23-0409
CVE: CVE-2023-2963
Published: 2023-07-17
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Oliva Expertise Oliva Expertise EKS allows SQL Injection.This issue affects Oliva Expertise EKS: before 1.2.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0409; https://www.usom.gov.tr/bildirim/tr-23-0409
CVE: CVE-2023-31216
Published: 2023-07-17
Description: Cross-Site Request Forgery (CSRF) vulnerability in Ultimate Member plugin <= 2.6.0 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/ultimate-member/wordpress-ultimate-member-plugin-2-6-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ultimate-member/wordpress-ultimate-member-plugin-2-6-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-31852
Published: 2023-07-17
Description: Cudy LT400 1.13.4 is vulnerable to Cross Site Scripting (XSS) in cgi-bin/luci/admin/network/wireless/config via the iface parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/CalfCrusher/CVE-2023-31852; https://www.cudy.com; https://github.com/CalfCrusher/CVE-2023-31852
CVE: CVE-2023-35038
Published: 2023-07-17
Description: Cross-Site Request Forgery (CSRF) vulnerability in wpexperts.Io WP PDF Generator plugin <= 1.2.2 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-pdf-generator/wordpress-wp-pdf-generator-plugin-1-2-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-pdf-generator/wordpress-wp-pdf-generator-plugin-1-2-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-35089
Published: 2023-07-17
Description: Cross-Site Request Forgery (CSRF) vulnerability in Really Simple Plugins Recipe Maker For Your Food Blog from Zip Recipes plugin <= 8.0.7 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/zip-recipes/wordpress-recipe-maker-for-your-food-blog-from-zip-recipes-plugin-8-0-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/zip-recipes/wordpress-recipe-maker-for-your-food-blog-from-zip-recipes-plugin-8-0-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-35096
Published: 2023-07-17
Description: Cross-Site Request Forgery (CSRF) vulnerability in myCred plugin <= 2.5 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/mycred/wordpress-mycred-plugin-2-5-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/mycred/wordpress-mycred-plugin-2-5-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2023-35880
Published: 2023-07-17
Description: Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Brands plugin <= 1.6.49 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/woocommerce-brands/wordpress-woocommerce-brands-plugin-1-6-49-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-brands/wordpress-woocommerce-brands-plugin-1-6-49-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-3041
Published: 2023-07-17
Description: The Autochat Automatic Conversation WordPress plugin through 1.1.7 does not sanitise and escape user input before outputting it back on the page, leading to a cross-site Scripting attack.
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/93cad990-b6be-4ee1-9cdf-0211a7fe6c96; https://wpscan.com/vulnerability/93cad990-b6be-4ee1-9cdf-0211a7fe6c96
CVE: CVE-2023-3179
Published: 2023-07-17
Description: The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the manage_postman_smtp capability resend an email to an arbitrary address (for example a password reset email could be resent to an attacker controlled email, and allow them to take over an account).
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wpscan.com/vulnerability/542caa40-b199-4397-90bb-4fdb693ebb24; https://wpscan.com/vulnerability/542caa40-b199-4397-90bb-4fdb693ebb24
CVE: CVE-2023-3182
Published: 2023-07-17
Description: The Membership WordPress plugin before 3.2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/655a68ee-9447-41ca-899e-986a419fb7ed; https://wpscan.com/vulnerability/655a68ee-9447-41ca-899e-986a419fb7ed
CVE: CVE-2023-3186
Published: 2023-07-17
Description: The Popup by Supsystic WordPress plugin before 1.10.19 has a prototype pollution vulnerability that could allow an attacker to inject arbitrary properties into Object.prototype.
CVSS Score: 9.8 (CRITICAL)
References: https://wpscan.com/vulnerability/545007fc-3173-47b1-82c4-ed3fd1247b9c; https://wpscan.com/vulnerability/545007fc-3173-47b1-82c4-ed3fd1247b9c
CVE: CVE-2023-3245
Published: 2023-07-17
Description: The Floating Chat Widget WordPress plugin before 3.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/f9f8ae7e-6621-4e29-9257-b8306dbe8811; https://wpscan.com/vulnerability/f9f8ae7e-6621-4e29-9257-b8306dbe8811
CVE: CVE-2023-3376
Published: 2023-07-17
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Digital Strategy Zekiweb allows SQL Injection.This issue affects Zekiweb: before 2.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0408; https://www.usom.gov.tr/bildirim/tr-23-0408
CVE: CVE-2023-3418
Published: 2023-07-17
Description: Rejected reason: The issue is not in the plugin itself but the underlying chat service
CVE: CVE-2023-3496
Published: 2023-07-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none.
CVE: CVE-2022-47172
Published: 2023-07-17
Description: Cross-Site Request Forgery (CSRF) vulnerability in HasThemes ShopLentor plugin <= 2.6.2 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/woolentor-addons/wordpress-shoplentor-plugin-2-6-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woolentor-addons/wordpress-shoplentor-plugin-2-6-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-2958
Published: 2023-07-17
Description: Authorization Bypass Through User-Controlled Key vulnerability in Origin Software ATS Pro allows Authentication Abuse, Authentication Bypass.This issue affects ATS Pro: before 20230714.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-639
References: https://www.usom.gov.tr/bildirim/tr-23-0410; https://www.usom.gov.tr/bildirim/tr-23-0410