deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-47937
Published: 2023-05-15
Description: Improper input validation in the Apache Sling Commons JSON bundle allows an attacker to trigger unexpected errors by supplying specially-crafted input.

The org.apache.sling.commons.json bundle has been deprecated as of March
 2017 and should not be used anymore. Consumers are encouraged to 
consider the Apache Sling Commons Johnzon OSGi bundle provided by the 
Apache Sling project, but may of course use other JSON libraries.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://github.com/apache/sling-org-apache-sling-commons-johnzon; https://issues.apache.org/jira/browse/SLING-6536; https://lists.apache.org/thread/sws7z50x47gv0c38q4kx6ktqrvrrg1pm
CVE: CVE-2022-4048
Published: 2023-05-15
Description: Inadequate Encryption Strength in CODESYS Development System V3 versions prior to V3.5.18.40 allows an unauthenticated local attacker to access and manipulate code of the encrypted boot application.
CVSS Score: 7.7 (HIGH)
CWE: CWE-326
References: https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17350&token=2cee62285d3ec76d6a78dfa9b9e81e66f6136a2a&download=; https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17350&token=2cee62285d3ec76d6a78dfa9b9e81e66f6136a2a&download=
CVE: CVE-2022-47392
Published: 2023-05-15
Description: An authenticated, remote attacker may use a improper input validation vulnerability in the CmpApp/CmpAppBP/CmpAppForce Components of multiple CODESYS products in multiple versions to read from an invalid address which can lead to a denial-of-service condition.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17554&token=5444f53b4c90fe37043671a100dffa75305d1825&download=; https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17554&token=5444f53b4c90fe37043671a100dffa75305d1825&download=
CVE: CVE-2022-47393
Published: 2023-05-15
Description: An authenticated, remote attacker may use a Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple versions of multiple CODESYS products to force a denial-of-service situation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17554&token=5444f53b4c90fe37043671a100dffa75305d1825&download=; https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17554&token=5444f53b4c90fe37043671a100dffa75305d1825&download=
CVE: CVE-2023-22684
Published: 2023-05-15
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Subscribers.Com Subscribers plugin <= 1.5.3 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/subscribers-com/wordpress-subscribers-free-web-push-notifications-plugin-1-5-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/subscribers-com/wordpress-subscribers-free-web-push-notifications-plugin-1-5-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-22690
Published: 2023-05-15
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Shopfiles Ltd Ebook Store plugin <= 5.775 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/ebook-store/wordpress-ebook-store-plugin-5-775-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ebook-store/wordpress-ebook-store-plugin-5-775-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-22703
Published: 2023-05-15
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Webcodin WCP Contact Form plugin <= 3.1.0 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wcp-contact-form/wordpress-wcp-contact-form-plugin-3-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wcp-contact-form/wordpress-wcp-contact-form-plugin-3-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23445
Published: 2023-05-15
Description: 
Improper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers
1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remote
attacker to gain unauthorized access to data fields by using a therefore unpriviledged account via the
REST interface.


CVSS Score: 7.5 (HIGH)
CWE: CWE-284, CWE-863
References: https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.json; https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.pdf; https://sick.com/psirt
CVE: CVE-2023-23446
Published: 2023-05-15
Description: 
Improper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers
1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remote attacker to download files by using a therefore unpriviledged account via the REST interface.



CVSS Score: 7.5 (HIGH)
CWE: CWE-284, CWE-863
References: https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.json; https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.pdf; https://sick.com/psirt
CVE: CVE-2023-23447
Published: 2023-05-15
Description: 
Uncontrolled Resource Consumption in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged
remote attacker to influence the availability of the webserver by invocing several open file requests via
the REST interface.


CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.json; https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.pdf; https://sick.com/psirt
CVE: CVE-2023-23448
Published: 2023-05-15
Description: 
Inclusion of Sensitive Information in Source Code in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows a
remote attacker to gain information about valid usernames via analysis of source code.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-540, CWE-668
References: https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.json; https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.pdf; https://sick.com/psirt
CVE: CVE-2023-23449
Published: 2023-05-15
Description: 
Observable Response Discrepancy in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows a remote attacker
to gain information about valid usernames by analyzing challenge responses from the server via the
REST interface.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-204, CWE-203
References: https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.json; https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.pdf; https://sick.com/psirt
CVE: CVE-2023-23450
Published: 2023-05-15
Description: 
Use of Password Hash Instead of Password for Authentication in SICK FTMg AIR
FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526
allows an unprivileged remote attacker to use a password hash instead of an actual password to login
to a valid user account via the REST interface.


CVSS Score: 6.2 (MEDIUM)
CWE: CWE-836, CWE-287
References: https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.json; https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.pdf; https://sick.com/psirt
CVE: CVE-2023-31408
Published: 2023-05-15
Description: 
Cleartext Storage of Sensitive Information in SICK FTMg AIR FLOW SENSOR with
Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows a remote
attacker to potentially steal user credentials that are stored in the user’s browsers local storage via
cross-site-scripting attacks.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-312, CWE-312
References: https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.json; https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.pdf; https://sick.com/psirt
CVE: CVE-2023-31409
Published: 2023-05-15
Description: 
Uncontrolled Resource Consumption in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an remote attacker to influence the availability of the webserver by invocing a Slowloris style attack via HTTP requests.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.json; https://sick.com/.well-known/csaf/white/2023/sca-2023-0004.pdf; https://sick.com/psirt
CVE: CVE-2023-22706
Published: 2023-05-15
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in PropertyHive plugin <= 1.5.48 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/propertyhive/wordpress-propertyhive-plugin-1-5-47-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/propertyhive/wordpress-propertyhive-plugin-1-5-47-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-22717
Published: 2023-05-15
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in nCrafts FormCraft plugin <= 1.2.6 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/formcraft-form-builder/wordpress-formcraft-contact-form-builder-for-wordpress-plugin-1-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/formcraft-form-builder/wordpress-formcraft-contact-form-builder-for-wordpress-plugin-1-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23654
Published: 2023-05-15
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in SparkPost plugin <= 3.2.5 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/sparkpost/wordpress-sparkpost-plugin-3-2-5-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/sparkpost/wordpress-sparkpost-plugin-3-2-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23674
Published: 2023-05-15
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in RVOLA WP Original Media Path plugin <= 2.4.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-original-media-path/wordpress-wp-original-media-path-plugin-2-4-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-original-media-path/wordpress-wp-original-media-path-plugin-2-4-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23683
Published: 2023-05-15
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Ozan Canakli White Label Branding for Elementor Page Builder plugin <= 1.0.2 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/white-label-branding-elementor/wordpress-white-label-branding-for-elementor-page-builder-plugin-1-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/white-label-branding-elementor/wordpress-white-label-branding-for-elementor-page-builder-plugin-1-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-23688
Published: 2023-05-15
Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Sumo Social Share Boost plugin <= 4.4 versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/social-share-boost/wordpress-social-share-boost-plugin-4-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/social-share-boost/wordpress-social-share-boost-plugin-4-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-31986
Published: 2023-05-15
Description: A Command Injection vulnerability in Edimax Wireless Router N300 Firmware BR-6428NS_v4 allows attacker to execute arbitrary code via the setWAN function in /bin/webs without any limitations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/Erebua/CVE/blob/main/N300_BR-6428nS%20V4/4/Readme.md; https://github.com/Erebua/CVE/blob/main/N300_BR-6428nS%20V4/4/Readme.md
CVE: CVE-2022-4774
Published: 2023-05-15
Description: The Bit Form WordPress plugin before 1.9 does not validate the file types uploaded via it's file upload form field, allowing unauthenticated users to upload arbitrary files types such as PHP or HTML files to the server, leading to Remote Code Execution.
CVSS Score: 9.8 (CRITICAL)
References: https://wpscan.com/vulnerability/2ae5c375-a6a0-4c0b-a9ef-e4d2a28bce5e; https://wpscan.com/vulnerability/2ae5c375-a6a0-4c0b-a9ef-e4d2a28bce5e
CVE: CVE-2023-0233
Published: 2023-05-15
Description: The ActiveCampaign WordPress plugin before 8.1.12 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/e95c85fd-fa47-45bd-b8e0-a7f33edd7130; https://wpscan.com/vulnerability/e95c85fd-fa47-45bd-b8e0-a7f33edd7130
CVE: CVE-2023-0490
Published: 2023-05-15
Description: The f(x) TOC WordPress plugin through 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/9b497d21-f075-41a9-afec-3e24034c8c63; https://wpscan.com/vulnerability/9b497d21-f075-41a9-afec-3e24034c8c63
CVE: CVE-2023-0520
Published: 2023-05-15
Description: The RapidExpCart WordPress plugin through 1.0 does not sanitize and escape the url parameter in the rapidexpcart endpoint before storing it and outputting it back in the page, leading to a Stored Cross-Site Scripting vulnerability which could be used against high-privilege users such as admin, furthermore lack of csrf protection means an attacker can trick a logged in admin to perform the attack by submitting a hidden form.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/be4f7ff9-af79-477b-9f47-e40e25a3558e; https://wpscan.com/vulnerability/be4f7ff9-af79-477b-9f47-e40e25a3558e
CVE: CVE-2023-0600
Published: 2023-05-15
Description: The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 6.9 does not escape user input which is concatenated to an SQL query, allowing unauthenticated visitors to conduct SQL Injection attacks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wpscan.com/vulnerability/8f46df4d-cb80-4d66-846f-85faf2ea0ec4; https://wpscan.com/vulnerability/8f46df4d-cb80-4d66-846f-85faf2ea0ec4
CVE: CVE-2023-0644
Published: 2023-05-15
Description: The Push Notifications for WordPress by PushAssist WordPress plugin through 3.0.8 does not sanitise and escape various parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/08f5089c-36f3-4d12-bca5-99cd3ae78f67; https://wpscan.com/vulnerability/08f5089c-36f3-4d12-bca5-99cd3ae78f67
CVE: CVE-2023-0761
Published: 2023-05-15
Description: The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting Staff members, which could allow attackers to make logged in admins delete arbitrary Staff via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
References: https://wpscan.com/vulnerability/88fb064e-0001-446c-8e43-9fe3feff6c1f; https://wpscan.com/vulnerability/88fb064e-0001-446c-8e43-9fe3feff6c1f
CVE: CVE-2023-0762
Published: 2023-05-15
Description: The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting designations, which could allow attackers to make logged in admins delete arbitrary designations via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
References: https://wpscan.com/vulnerability/9be952e0-d8ae-440f-8819-cb19485f35f3; https://wpscan.com/vulnerability/9be952e0-d8ae-440f-8819-cb19485f35f3
CVE: CVE-2023-0763
Published: 2023-05-15
Description: The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting Holidays, which could allow attackers to make logged in admins delete arbitrary holidays via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/4b55f868-62f8-43a1-9817-68cd1fc6190f; https://wpscan.com/vulnerability/4b55f868-62f8-43a1-9817-68cd1fc6190f
CVE: CVE-2023-0812
Published: 2023-05-15
Description: The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.1 does not have proper authorization or nonce values for some POST requests, leading to unauthenticated data disclosure.
CVSS Score: 7.5 (HIGH)
References: https://wpscan.com/vulnerability/0ed5e1b3-f2a3-4eb1-b8ae-d3a62f600107; https://wpscan.com/vulnerability/0ed5e1b3-f2a3-4eb1-b8ae-d3a62f600107
CVE: CVE-2023-0892
Published: 2023-05-15
Description: The BizLibrary WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/54150be5-a53f-4b94-8ce5-04e073e3ab1f; https://wpscan.com/vulnerability/54150be5-a53f-4b94-8ce5-04e073e3ab1f
CVE: CVE-2023-1019
Published: 2023-05-15
Description: The Help Desk WP WordPress plugin through 1.2.0 does not sanitise and escape some parameters, which could allow users with a role as low as Editor to perform Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/a6331ca8-9603-4134-af39-8e77ac9d511c; https://wpscan.com/vulnerability/a6331ca8-9603-4134-af39-8e77ac9d511c
CVE: CVE-2023-1207
Published: 2023-05-15
Description: This HTTP Headers WordPress plugin before 1.18.8 has an import functionality which executes arbitrary SQL on the server, leading to an SQL Injection vulnerability.
CVSS Score: 7.2 (HIGH)
References: https://wpscan.com/vulnerability/6f3f460b-542a-4d32-8feb-afa1aef57e37; https://wpscan.com/vulnerability/6f3f460b-542a-4d32-8feb-afa1aef57e37
CVE: CVE-2023-1549
Published: 2023-05-15
Description: The Ad Inserter WordPress plugin before 2.7.27 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present
CVSS Score: 7.2 (HIGH)
References: https://wpscan.com/vulnerability/c94b3a68-673b-44d7-9251-f3590cc5ee9e; https://wpscan.com/vulnerability/c94b3a68-673b-44d7-9251-f3590cc5ee9e
CVE: CVE-2023-1596
Published: 2023-05-15
Description: The tagDiv Composer WordPress plugin before 4.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/cada9be9-522a-4ce8-847d-c8fff2ddcc07; https://wpscan.com/vulnerability/cada9be9-522a-4ce8-847d-c8fff2ddcc07
CVE: CVE-2023-1835
Published: 2023-05-15
Description: The Ninja Forms Contact Form WordPress plugin before 3.6.22 does not properly escape user input before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/b5fc223c-5ec0-44b2-b2f6-b35f9942d341; https://wpscan.com/vulnerability/b5fc223c-5ec0-44b2-b2f6-b35f9942d341
CVE: CVE-2023-1839
Published: 2023-05-15
Description: The Product Addons & Fields for WooCommerce WordPress plugin before 32.0.6 does not sanitize and escape some of its setting fields, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/fddc5a1c-f267-4ef4-8acf-731dbecac450; https://wpscan.com/vulnerability/fddc5a1c-f267-4ef4-8acf-731dbecac450
CVE: CVE-2023-1890
Published: 2023-05-15
Description: The Tablesome WordPress plugin before 1.0.9 does not escape various generated URLs, before outputting them in attributes when some notices are displayed, leading to Reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
References: http://packetstormsecurity.com/files/173727/WordPress-Tablesome-Cross-Site-Scripting.html; https://wpscan.com/vulnerability/8ef64490-30cd-4e07-9b7c-64f551944f3d; http://packetstormsecurity.com/files/173727/WordPress-Tablesome-Cross-Site-Scripting.html
CVE: CVE-2023-1915
Published: 2023-05-15
Description: The Thumbnail carousel slider WordPress plugin before 1.1.10 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting vulnerability which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/0487c3f6-1a3c-4089-a614-15138f52f69b; https://wpscan.com/vulnerability/0487c3f6-1a3c-4089-a614-15138f52f69b
CVE: CVE-2023-23682
Published: 2023-05-15
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Snap Creek Software EZP Maintenance Mode plugin <= 1.0.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/easy-pie-maintenance-mode/wordpress-ezp-maintenance-mode-plugin-1-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/easy-pie-maintenance-mode/wordpress-ezp-maintenance-mode-plugin-1-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-29862
Published: 2023-05-15
Description: An issue found in Agasio-Camera device version not specified allows a remote attacker to execute arbitrary code via the check and authLevel parameters.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/Duke1410/CVE/blob/main/CVE-2023-29862; https://woolly-espadrille-ed5.notion.site/Agasio-Camera-device-has-a-logic-flaw-vulnerability-d4514e7217c54dd7ac62582b6664aa66; https://github.com/Duke1410/CVE/blob/main/CVE-2023-29862
CVE: CVE-2023-2009
Published: 2023-05-15
Description: Plugin does not sanitize and escape the URL field in the Pretty Url WordPress plugin through 1.5.4 settings, which could allow high-privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/f7988a18-ba9d-4ead-82c8-30ea8223846f; https://wpscan.com/vulnerability/f7988a18-ba9d-4ead-82c8-30ea8223846f
CVE: CVE-2023-2179
Published: 2023-05-15
Description: The WooCommerce Order Status Change Notifier WordPress plugin through 1.1.0 does not have authorisation and CSRF when updating status orders via an AJAX action available to any authenticated users, which could allow low privilege users such as subscriber to update arbitrary order status, making them paid without actually paying for them for example
CVSS Score: 6.5 (MEDIUM)
References: https://wpscan.com/vulnerability/fbc56973-4225-4f44-8c38-d488e57cd551; https://wpscan.com/vulnerability/fbc56973-4225-4f44-8c38-d488e57cd551
CVE: CVE-2023-2180
Published: 2023-05-15
Description: The KIWIZ Invoices Certification & PDF System WordPress plugin through 2.1.3 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/downlaod arbitrary files, as well as perform PHAR unserialization (assuming they can upload a file on the server)
CVSS Score: 7.5 (HIGH)
References: https://wpscan.com/vulnerability/4d3b90d8-8a6d-4b72-8bc7-21f861259a1b; https://wpscan.com/vulnerability/4d3b90d8-8a6d-4b72-8bc7-21f861259a1b