deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-22602
Published: 2023-01-14
Description: When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass.

The authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro and Spring Boot < 2.6 default to Ant style pattern matching.
Mitigation: Update to Apache Shiro 1.11.0, or set the following Spring Boot configuration value:  `spring.mvc.pathmatch.matching-strategy = ant_path_matcher`



CVSS Score: 7.5 (HIGH)
CWE: CWE-436
References: https://lists.apache.org/thread/dzj0k2smpzzgj6g666hrbrgsrlf9yhkl; https://lists.apache.org/thread/dzj0k2smpzzgj6g666hrbrgsrlf9yhkl; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-38467
Published: 2023-01-14
Description: Reflected Cross-Site Scripting (XSS) vulnerability in CRM Perks Forms – WordPress Form Builder <= 1.1.0 ver.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/crm-perks-forms/wordpress-crm-perks-forms-plugin-1-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/crm-perks-forms/wordpress-crm-perks-forms-plugin-1-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-45353
Published: 2023-01-14
Description: Broken Access Control in Betheme theme <= 26.6.1 on WordPress.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://patchstack.com/database/vulnerability/betheme/wordpress-betheme-theme-26-6-1-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/betheme/wordpress-betheme-theme-26-6-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2022-1812
Published: 2023-01-14
Description: Integer Overflow or Wraparound in GitHub repository publify/publify prior to 9.2.10.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://github.com/publify/publify/commit/29a5837c29620e33857d7a5afce01384e3f8e41a; https://huntr.dev/bounties/17d86a50-265c-4ec8-9592-0bd909ddc8f3; https://github.com/publify/publify/commit/29a5837c29620e33857d7a5afce01384e3f8e41a
CVE: CVE-2022-2815
Published: 2023-01-14
Description: Insecure Storage of Sensitive Information in GitHub repository publify/publify prior to 9.2.10.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-922
References: https://github.com/publify/publify/commit/af69097d349f4c00f244c51cd3c3e937fd3387cd; https://huntr.dev/bounties/22fdcc39-8c1a-4e4c-8eae-be3fd764f8b4; https://github.com/publify/publify/commit/af69097d349f4c00f244c51cd3c3e937fd3387cd
CVE: CVE-2023-0299
Published: 2023-01-14
Description: Improper Input Validation in GitHub repository publify/publify prior to 9.2.10.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://github.com/publify/publify/commit/ca46da283572b4f8c0b5aa245008756c8a5fd1b1; https://huntr.dev/bounties/0049774b-1857-46dc-a834-f1fb15138c53; https://github.com/publify/publify/commit/ca46da283572b4f8c0b5aa245008756c8a5fd1b1
CVE: CVE-2023-0300
Published: 2023-01-14
Description: Cross-site Scripting (XSS) - Reflected in GitHub repository alfio-event/alf.io prior to 2.0-M4-2301.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/alfio-event/alf.io/commit/c1ae54ac84f1c7a5ec2831876f6445cb79be96fc; https://huntr.dev/bounties/0a91fec7-a76e-4ca3-80ba-81de1f10d59d; https://github.com/alfio-event/alf.io/commit/c1ae54ac84f1c7a5ec2831876f6445cb79be96fc
CVE: CVE-2023-0301
Published: 2023-01-14
Description: Cross-site Scripting (XSS) - Stored in GitHub repository alfio-event/alf.io prior to Alf.io 2.0-M4-2301.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/alfio-event/alf.io/commit/21cb2866e5f58b4a2b4a2cb0066479bbb26f7b39; https://huntr.dev/bounties/8a91e127-2903-4c6b-9a66-e4d2e30f8dec; https://github.com/alfio-event/alf.io/commit/21cb2866e5f58b4a2b4a2cb0066479bbb26f7b39
CVE: CVE-2017-20167
Published: 2023-01-14
Description: A vulnerability, which was classified as problematic, was found in Minichan. This affects an unknown part of the file reports.php. The manipulation of the argument headline leads to cross site scripting. It is possible to initiate the attack remotely. The identifier of the patch is fc0e732e58630cba318d6bf49d1388a7aa9d390e. It is recommended to apply a patch to fix this issue. The identifier VDB-217785 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/Minichan/Minichan/commit/fc0e732e58630cba318d6bf49d1388a7aa9d390e; https://github.com/Minichan/Minichan/pull/54; https://vuldb.com/?ctiid.217785
CVE: CVE-2015-10020
Published: 2023-01-14
Description: A vulnerability has been found in ssn2013 cis450Project and classified as critical. This vulnerability affects the function addUser of the file HeatMapServer/src/com/datformers/servlet/AddAppUser.java. The manipulation leads to sql injection. The name of the patch is 39b495011437a105c7670e17e071f99195b4922e. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218380.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/ssn2013/cis450Project/commit/39b495011437a105c7670e17e071f99195b4922e; https://vuldb.com/?ctiid.218380; https://vuldb.com/?id.218380
CVE: CVE-2015-10043
Published: 2023-01-14
Description: A vulnerability, which was classified as critical, was found in abreen Apollo. This affects an unknown part. The manipulation of the argument file leads to path traversal. The patch is named[PII_REDACTED]780bbd074aff34f4683fb764faba71. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218307.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/abreen/Apollo/commit/[PII_REDACTED]780bbd074aff34f4683fb764faba71; https://vuldb.com/?ctiid.218307; https://vuldb.com/?id.218307
CVE: CVE-2023-0302
Published: 2023-01-15
Description: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository radareorg/radare2 prior to 5.8.2.
CVSS Score: 7.8 (HIGH)
CWE: CWE-75, CWE-74
References: https://github.com/radareorg/radare2/commit/961f0e723903011d4f54c2396e44efa91fcc74ce; https://huntr.dev/bounties/583133af-7ae6-4a21-beef-a4b0182cf82e; https://github.com/radareorg/radare2/commit/961f0e723903011d4f54c2396e44efa91fcc74ce
CVE: CVE-2023-23590
Published: 2023-01-15
Description: Mercedes-Benz XENTRY Retail Data Storage 7.8.1 allows remote attackers to cause a denial of service (device restart) via an unauthenticated API request. The attacker must be on the same network as the device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://b2bconnect.mercedes-benz.com/gb/workshop-solutions/diagnosis/retail-data-storage; https://medium.com/%40windsormoreira/xentry-retail-data-storage-v7-8-1-denial-of-service-cve-2023-23590-60b65f5fa358; https://b2bconnect.mercedes-benz.com/gb/workshop-solutions/diagnosis/retail-data-storage
CVE: CVE-2023-23595
Published: 2023-01-15
Description: BlueCat Device Registration Portal 2.2 allows XXE attacks that exfiltrate single-line files. A single-line file might contain credentials, such as "machine example.com login daniel password qwerty" in the documentation example for the .netrc file format. NOTE: 2.x versions are no longer supported. There is no available information about whether any later version is affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611, CWE-611
References: https://bluecatnetworks.com/integrations/adaptive-application/device-registration-portal-drp/; https://everything.curl.dev/usingcurl/netrc; https://github.com/colemanjp/XXE-Vulnerability-in-Bluecat-Device-Registration-Portal-DRP
CVE: CVE-2022-4889
Published: 2023-01-15
Description: A vulnerability classified as critical was found in visegripped Stracker. Affected by this vulnerability is the function getHistory of the file doc_root/public_html/stracker/api.php. The manipulation of the argument symbol/startDate/endDate leads to sql injection. The identifier of the patch is 63e1b040373ee5b6c7d1e165ecf5ae1603d29e0a. It is recommended to apply a patch to fix this issue. The identifier VDB-218377 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/visegripped/stracker/commit/63e1b040373ee5b6c7d1e165ecf5ae1603d29e0a; https://github.com/visegripped/stracker/pull/16; https://vuldb.com/?ctiid.218377
CVE: CVE-2014-125077
Published: 2023-01-15
Description: A vulnerability, which was classified as critical, has been found in pointhi searx_stats. This issue affects some unknown processing of the file cgi/cron.php. The manipulation leads to sql injection. The patch is named 281bd679a4474ddb222d16c1c380f252839cc18f. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218351.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/pointhi/searx_stats/commit/281bd679a4474ddb222d16c1c380f252839cc18f; https://vuldb.com/?ctiid.218351; https://vuldb.com/?id.218351
CVE: CVE-2014-125078
Published: 2023-01-15
Description: A vulnerability was found in yanheven console and classified as problematic. Affected by this issue is some unknown functionality of the file horizon/static/horizon/js/horizon.instances.js. The manipulation leads to cross site scripting. The attack may be launched remotely. The patch is identified as 32a7b[PII_REDACTED]82f2ea01d5e2faff980d924cd. It is recommended to apply a patch to fix this issue. VDB-218354 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/yanheven/console/commit/32a7b[PII_REDACTED]82f2ea01d5e2faff980d924cd; https://vuldb.com/?ctiid.218354; https://vuldb.com/?id.218354
CVE: CVE-2014-125079
Published: 2023-01-15
Description: A vulnerability was found in agy pontifex.http. It has been declared as critical. This vulnerability affects unknown code of the file lib/Http.coffee. The manipulation leads to sql injection. Upgrading to version 0.1.0 is able to address this issue. The name of the patch is e52a758f96861dcef2dabfecb9da191bb2e07761. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218356.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/agy/pontifex.http/commit/e52a758f96861dcef2dabfecb9da191bb2e07761; https://github.com/agy/pontifex.http/releases/tag/v0.1.0; https://vuldb.com/?ctiid.218356
CVE: CVE-2015-10044
Published: 2023-01-15
Description: A vulnerability classified as critical was found in gophergala sqldump. This vulnerability affects unknown code. The manipulation leads to sql injection. The patch is identified as 76db54e9073b5248b8863e71a63d66a32d567d21. It is recommended to apply a patch to fix this issue. VDB-218350 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/gophergala/sqldump/commit/76db54e9073b5248b8863e71a63d66a32d567d21; https://vuldb.com/?ctiid.218350; https://vuldb.com/?id.218350
CVE: CVE-2015-10045
Published: 2023-01-15
Description: A vulnerability, which was classified as critical, was found in tutrantta project_todolist. Affected is the function getAffectedRows/where/insert/update in the library library/Database.php. The manipulation leads to sql injection. The name of the patch is 194a0411bbe11aa4813f13c66b9e8ea403539141. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218352.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/tutrantta/project_todolist/commit/194a0411bbe11aa4813f13c66b9e8ea403539141; https://vuldb.com/?ctiid.218352; https://vuldb.com/?id.218352
CVE: CVE-2015-10046
Published: 2023-01-15
Description: A vulnerability has been found in lolfeedback and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to sql injection. The identifier of the patch is 6cf0b5f2228cd8765f734badd[PII_REDACTED]0f2b2. It is recommended to apply a patch to fix this issue. The identifier VDB-218353 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/philipblaquiere/lolfeedback/commit/6cf0b5f2228cd8765f734badd[PII_REDACTED]0f2b2; https://vuldb.com/?ctiid.218353; https://vuldb.com/?id.218353
CVE: CVE-2015-10047
Published: 2023-01-15
Description: A vulnerability was found in KYUUBl school-register. It has been classified as critical. This affects an unknown part of the file src/DBManager.java. The manipulation leads to sql injection. The patch is named 1cf7e01b878aee923f2b22cc2535c71a680e4c30. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218355.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/KYUUBl/school-register/commit/1cf7e01b878aee923f2b22cc2535c71a680e4c30; https://vuldb.com/?ctiid.218355; https://vuldb.com/?id.218355
CVE: CVE-2015-10048
Published: 2023-01-15
Description: A vulnerability was found in bmattoso desafio_buzz_woody. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to sql injection. The identifier of the patch is cb8220cbae06082c969b1776fcb2fdafb3a1006b. It is recommended to apply a patch to fix this issue. The identifier VDB-218357 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/bmattoso/desafio_buzz_woody/commit/cb8220cbae06082c969b1776fcb2fdafb3a1006b; https://vuldb.com/?ctiid.218357; https://vuldb.com/?id.218357
CVE: CVE-2023-0303
Published: 2023-01-15
Description: A vulnerability was found in SourceCodester Online Food Ordering System. It has been rated as critical. Affected by this issue is some unknown functionality of the file view_prod.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-218384.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Hanfu-l/cvetest/blob/main/1.pdf; https://vuldb.com/?ctiid.218384; https://vuldb.com/?id.218384
CVE: CVE-2023-0304
Published: 2023-01-15
Description: A vulnerability classified as critical has been found in SourceCodester Online Food Ordering System. This affects an unknown part of the file admin_class.php of the component Signup Module. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-218385 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Hanfu-l/cvetest/blob/main/2.pdf; https://vuldb.com/?ctiid.218385; https://vuldb.com/?id.218385
CVE: CVE-2023-0305
Published: 2023-01-15
Description: A vulnerability classified as critical was found in SourceCodester Online Food Ordering System. This vulnerability affects unknown code of the file admin_class.php of the component Login Module. The manipulation of the argument username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-218386 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Hanfu-l/cvetest/blob/main/3.pdf; https://vuldb.com/?ctiid.218386; https://vuldb.com/?id.218386
CVE: CVE-2015-10049
Published: 2023-01-15
Description: A vulnerability was found in Overdrive Eletrônica course-builder up to 1.7.x and classified as problematic. Affected by this issue is some unknown functionality of the file coursebuilder/modules/oeditor/oeditor.html. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.8.0 is able to address this issue. The name of the patch is e39645fd714adb7e[PII_REDACTED]35911ae282b21b. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218372.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/overdrive-diy/course-builder/commit/e39645fd714adb7e[PII_REDACTED]35911ae282b21b; https://github.com/overdrive-diy/course-builder/releases/tag/V1.8.0; https://vuldb.com/?ctiid.218372
CVE: CVE-2015-10050
Published: 2023-01-15
Description: A vulnerability was found in brandonfire miRNA_Database_by_PHP_MySql. It has been declared as critical. This vulnerability affects the function __construct/select_single_rna/count_rna of the file inc/model.php. The manipulation leads to sql injection. The patch is identified as 307c5d510841e6142ddcbbdbb93d0e8a0dc3fd6a. It is recommended to apply a patch to fix this issue. VDB-218374 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/brandonfire/miRNA_Database_by_PHP_MySql/commit/307c5d510841e6142ddcbbdbb93d0e8a0dc3fd6a; https://vuldb.com/?ctiid.218374; https://vuldb.com/?id.218374
CVE: CVE-2015-10051
Published: 2023-01-15
Description: A vulnerability, which was classified as critical, has been found in bony2023 Discussion-Board. Affected by this issue is the function display_all_replies of the file functions/main.php. The manipulation of the argument str leads to sql injection. The patch is identified as 26439bc4c63632d63ba89ebc0f149b25a9010361. It is recommended to apply a patch to fix this issue. VDB-218378 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/bony2023/Discussion-Board/commit/26439bc4c63632d63ba89ebc0f149b25a9010361; https://vuldb.com/?ctiid.218378; https://vuldb.com/?id.218378
CVE: CVE-2015-10052
Published: 2023-01-15
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as problematic, was found in calesanz gibb-modul-151. This affects the function bearbeiten/login. The manipulation leads to open redirect. It is possible to initiate the attack remotely. The patch is named 88a517dc[PII_REDACTED]c804b655e[PII_REDACTED]0d. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218379. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-601
References: https://github.com/calesanz/gibb-modul-151/commit/88a517dc[PII_REDACTED]c804b655e[PII_REDACTED]0d; https://vuldb.com/?ctiid.218379; https://vuldb.com/?id.218379
CVE: CVE-2016-15018
Published: 2023-01-15
Description: A vulnerability was found in krail-jpa up to 0.9.1. It has been classified as critical. This affects an unknown part. The manipulation leads to sql injection. Upgrading to version 0.9.2 is able to address this issue. The identifier of the patch is c1e848665492e21ef6cc9be443205e36b9a1f6be. It is recommended to upgrade the affected component. The identifier VDB-218373 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/KrailOrg/krail-jpa/commit/c1e848665492e21ef6cc9be443205e36b9a1f6be; https://github.com/KrailOrg/krail-jpa/issues/18; https://github.com/KrailOrg/krail-jpa/releases/tag/0.9.2
CVE: CVE-2016-15019
Published: 2023-01-15
Description: A vulnerability was found in tombh jekbox. It has been rated as problematic. This issue affects some unknown processing of the file lib/server.rb. The manipulation leads to exposure of information through directory listing. The attack may be initiated remotely. The patch is named 64eb[PII_REDACTED]fc08b96718b81e3dbc83693190. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218375.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-548, CWE-22
References: https://github.com/tombh/jekbox/commit/64eb[PII_REDACTED]fc08b96718b81e3dbc83693190; https://vuldb.com/?ctiid.218375; https://vuldb.com/?id.218375
CVE: CVE-2018-25075
Published: 2023-01-15
Description: A vulnerability classified as critical has been found in karsany OBridge up to 1.3. Affected is the function getAllStandaloneProcedureAndFunction of the file obridge-main/src/main/java/org/obridge/dao/ProcedureDao.java. The manipulation leads to sql injection. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 1.4 is able to address this issue. The name of the patch is 52eca4ad05f3c292aed3178b2f58977686ffa376. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218376.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-89
References: https://github.com/karsany/obridge/commit/52eca4ad05f3c292aed3178b2f58977686ffa376; https://github.com/karsany/obridge/releases/tag/v1.4; https://vuldb.com/?ctiid.218376
CVE: CVE-2023-0306
Published: 2023-01-15
Description: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/thorsten/phpmyfaq/commit/1815daef61c432bb73b9dca43f03d140c94ef0c5; https://huntr.dev/bounties/cbba22f0-89ed-4d01-81ea-744979c8cbde; https://github.com/thorsten/phpmyfaq/commit/1815daef61c432bb73b9dca43f03d140c94ef0c5
CVE: CVE-2023-0307
Published: 2023-01-15
Description: Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-521
References: https://github.com/thorsten/phpmyfaq/commit/8beed2fca5b0b82c6ba866d0ffd286d0c1fbf596; https://huntr.dev/bounties/fac01e9f-e3e5-4985-94ad-59a76485f215; https://github.com/thorsten/phpmyfaq/commit/8beed2fca5b0b82c6ba866d0ffd286d0c1fbf596
CVE: CVE-2023-0308
Published: 2023-01-15
Description: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/thorsten/phpmyfaq/commit/810ee26d25c3d[PII_REDACTED][PII_REDACTED]f0e9a1f; https://huntr.dev/bounties/83cfed62-af8b-4aaa-94f2-5a33dc0c2d69; https://github.com/thorsten/phpmyfaq/commit/810ee26d25c3d[PII_REDACTED][PII_REDACTED]f0e9a1f
CVE: CVE-2023-0309
Published: 2023-01-15
Description: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/thorsten/phpmyfaq/commit/376d1d3e5a42edf07260e98461d2fddbee74419b; https://huntr.dev/bounties/c03c5925-43ff-450d-9827-2b65a3307ed6; https://github.com/thorsten/phpmyfaq/commit/376d1d3e5a42edf07260e98461d2fddbee74419b
CVE: CVE-2023-0310
Published: 2023-01-15
Description: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/thorsten/phpmyfaq/commit/53099a9bcc928f5f6f7cce111c04b79a72a04142; https://huntr.dev/bounties/051d5e20-7fab-4769-bd7d-d986b804bb5a; https://github.com/thorsten/phpmyfaq/commit/53099a9bcc928f5f6f7cce111c04b79a72a04142
CVE: CVE-2023-0311
Published: 2023-01-15
Description: Improper Authentication in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://github.com/thorsten/phpmyfaq/commit/fe6e9f02ef1b26a03134b9becda12687ee5f3214; https://huntr.dev/bounties/82b0b629-c56b-4651-af3f-17f749751857; https://github.com/thorsten/phpmyfaq/commit/fe6e9f02ef1b26a03134b9becda12687ee5f3214
CVE: CVE-2023-0312
Published: 2023-01-15
Description: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/thorsten/phpmyfaq/commit/65d419ca04111ee2612ae81cdd59753654cfe18a; https://huntr.dev/bounties/f50ec8d1-cd60-4c2d-9ab8-3711870d83b9; https://github.com/thorsten/phpmyfaq/commit/65d419ca04111ee2612ae81cdd59753654cfe18a
CVE: CVE-2023-0313
Published: 2023-01-15
Description: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/thorsten/phpmyfaq/commit/1123c0872314fa68d7d0d8136939f62270fb4b7b; https://huntr.dev/bounties/bc27e84b-1f91-4e1b-a78c-944edeba8256; https://github.com/thorsten/phpmyfaq/commit/1123c0872314fa68d7d0d8136939f62270fb4b7b