deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-20038
Published: 2023-01-20
Description: A vulnerability in the monitoring application of Cisco Industrial Network Director could allow an authenticated, local attacker to access a static secret key used to store both local data and credentials for accessing remote systems.
 This vulnerability is due to a static key value stored in the application used to encrypt application data and remote credentials. An attacker could exploit this vulnerability by gaining local access to the server Cisco Industrial Network Director is installed on. A successful exploit could allow the attacker to decrypt data allowing the attacker to access remote systems monitored by Cisco Industrial Network Director.
CVSS Score: 8.8 (HIGH)
CWE: CWE-321, CWE-798
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ind-fZyVjJtG; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ind-fZyVjJtG
CVE: CVE-2023-20040
Published: 2023-01-20
Description: A vulnerability in the NETCONF service of Cisco Network Services Orchestrator (NSO) could allow an authenticated, remote attacker to cause a denial of service (DoS) on an affected system that is running as the root user. To exploit this vulnerability, the attacker must be a member of the admin group.
 This vulnerability exists because user-supplied input is not properly validated when NETCONF is used to upload packages to an affected device. An attacker could exploit this vulnerability by uploading a specially crafted package file. A successful exploit could allow the attacker to write crafted files to arbitrary locations on the filesystem or delete arbitrary files from the filesystem of an affected device, resulting in a DoS condition. 
 Note: By default, during install, Cisco NSO will be set up to run as the root user unless the --run-as-user option is used.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-23, CWE-434
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nso-path-trvsl-zjBeMkZg; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nso-path-trvsl-zjBeMkZg
CVE: CVE-2023-20043
Published: 2023-01-20
Description: A vulnerability in Cisco CX Cloud Agent of could allow an authenticated, local attacker to elevate their privileges.
 This vulnerability is due to insecure file permissions. An attacker could exploit this vulnerability by calling the script with sudo. A successful exploit could allow the attacker to take complete control of the affected device.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-708, CWE-276
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cxagent-gOq9QjqZ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cxagent-gOq9QjqZ
CVE: CVE-2023-20044
Published: 2023-01-20
Description: A vulnerability in Cisco CX Cloud Agent of could allow an authenticated, local attacker to elevate their privileges.
 This vulnerability is due to insecure file permissions. An attacker could exploit this vulnerability by persuading support to update settings which call the insecure script. A successful exploit could allow the attacker to take complete control of the affected device.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-708
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cxagent-gOq9QjqZ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cxagent-gOq9QjqZ
CVE: CVE-2023-20045
Published: 2023-01-20
Description: A vulnerability in the web-based management interface of Cisco Small Business RV160 and RV260 Series VPN Routers could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device.
 This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary commands using root-level privileges on the affected device. To exploit this vulnerability, the attacker must have valid Administrator-level credentials on the affected device.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-77, CWE-20
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-cmd-exe-n47kJQLE; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-cmd-exe-n47kJQLE
CVE: CVE-2023-20047
Published: 2023-01-20
Description: A vulnerability in the Link Layer Discovery Protocol (LLDP) feature of Cisco Webex Room Phone and Cisco Webex Share devices could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device.
 This vulnerability is due to insufficient resource allocation. An attacker could exploit this vulnerability by sending crafted LLDP traffic to an affected device. A successful exploit could allow the attacker to exhaust the memory resources of the affected device, resulting in a crash of the LLDP process. If the affected device is configured to support LLDP only, this could cause an interruption to inbound and outbound calling. By default, these devices are configured to support both Cisco Discovery Protocol and LLDP. To recover operational state, the affected device needs a manual restart.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-770
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-lldp-memlk-McOecPT; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-lldp-memlk-McOecPT
CVE: CVE-2023-20057
Published: 2023-01-20
Description: A vulnerability in the URL filtering mechanism of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device.
 This vulnerability is due to improper processing of URLs. An attacker could exploit this vulnerability by crafting a URL in a particular way. A successful exploit could allow the attacker to bypass the URL reputation filters that are configured for an affected device, which could allow malicious URLs to pass through the device.
CVSS Score: 0.0 (NONE)
CWE: CWE-792, CWE-74
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-url-bypass-WbMQqNJh; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-url-bypass-WbMQqNJh
CVE: CVE-2023-20058
Published: 2023-01-20
Description: A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface.
 This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuis-xss-Omm8jyBX; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuis-xss-Omm8jyBX
CVE: CVE-2022-40267
Published: 2023-01-20
Description: Predictable Seed in Pseudo-Random Number Generator (PRNG) vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-xMy/z (x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with serial number 17X**** or later, and versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-xMy/z (x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with serial number 179**** and prior, and versions 1.074 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-xMy/z (x=32,64,96, y=T, z=D,DSS)) with serial number 17X**** or later, and versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-xMy/z (x=32,64,96, y=T, z=D,DSS)) with serial number 179**** and prior, and versions 1.074 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-32MT/DS-TS versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-32MT/DSS-TS versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UJ-xMy/z (x=24,40,60, y=T,R, z=ES,ESS) versions 1.042 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UJ-xMy/ES-A (x=24,40,60, y=T,R) versions 1.043 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5S-xMy/z (x=30,40,60,80, y=T,R, z=ES,ESS) versions 1.003 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-32MR/DS-TS versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-R Series R00/01/02CPU versions 33 and prior, Mitsubishi Electric Corporation MELSEC iQ-R Series R04/08/16/32/120(EN)CPU versions 66 and prior allows a remote unauthenticated attacker to access the Web server function by guessing the random numbers used for authentication from several used random numbers.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-337, CWE-335
References: https://jvn.jp/vu/JVNVU99673580/index.html; https://www.cisa.gov/uscert/ics/advisories/icsa-23-017-02; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-019_en.pdf
CVE: CVE-2023-23596
Published: 2023-01-20
Description: jc21 NGINX Proxy Manager through 2.9.19 allows OS command injection. When creating an access list, the backend builds an htpasswd file with crafted username and/or password input that is concatenated without any validation, and is directly passed to the exec command, potentially allowing an authenticated attacker to execute arbitrary commands on the system. NOTE: this is not part of any NGINX software shipped by F5.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://advisory.dw1.io/57; https://github.com/NginxProxyManager/nginx-proxy-manager/blob/4f10d129c20cc82494b95cc94b97f859dbd4b54d/backend/internal/access-list.js#L510; https://advisory.dw1.io/57
CVE: CVE-2023-23691
Published: 2023-01-20
Description: 
Dell EMC PV ME5, versions ME5.1.0.0.0 and ME5.1.0.1.0, contains a Client-side desync Vulnerability. An unauthenticated attacker could potentially exploit this vulnerability to force a victim's browser to desynchronize its connection with the website, typically leading to XSS and DoS.


CVSS Score: 8.1 (HIGH)
CWE: CWE-444, CWE-444
References: https://www.dell.com/support/kbdoc/en-us/000207533/dsa-2023-018-dell-emc-powervault-me5-security-update-for-a-client-desync-attack-vulnerability; https://www.dell.com/support/kbdoc/en-us/000207533/dsa-2023-018-dell-emc-powervault-me5-security-update-for-a-client-desync-attack-vulnerability
CVE: CVE-2021-37498
Published: 2023-01-20
Description: An SSRF issue was discovered in Reprise License Manager (RLM) web interface through 14.2BL4 that allows remote attackers to trigger outbound requests to intranet servers, conduct port scans via the actserver parameter in License Activation function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918, CWE-918
References: http://reprise.com; http://reprisesoftware.com; https://github.com/blakduk/Advisories/blob/main/Reprise%20License%20Manager/README.md
CVE: CVE-2021-37499
Published: 2023-01-20
Description: CRLF vulnerability in Reprise License Manager (RLM) web interface through 14.2BL4 in the password parameter in View License Result function, that allows remote attackers to inject arbitrary HTTP headers.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-74
References: http://reprise.com; http://reprisesoftware.com; https://github.com/blakduk/Advisories/blob/main/Reprise%20License%20Manager/README.md
CVE: CVE-2021-37500
Published: 2023-01-20
Description: Directory traversal vulnerability in Reprise License Manager (RLM) web interface before 14.2BL4 in the diagnostics function that allows RLM users with sufficient privileges to overwrite any file the on the server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22, CWE-22
References: http://reprise.com; http://reprisesoftware.com; https://github.com/blakduk/Advisories/blob/main/Reprise%20License%20Manager/README.md
CVE: CVE-2022-41441
Published: 2023-01-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in ReQlogic v11.3 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the POBatch and WaitDuration parameters.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://packetstormsecurity.com/files/171557/ReQlogic-11.3-Cross-Site-Scripting.html; http://reqlogic.com; https://okankurtulus.com.tr/2023/01/17/reqlogic-v11-3-unauthenticated-reflected-cross-site-scripting-xss/
CVE: CVE-2022-43959
Published: 2023-01-20
Description: Insufficiently Protected Credentials in the AD/LDAP server settings in 1C-Bitrix Bitrix24 through 22.200.200 allow remote administrators to discover an AD/LDAP administrative password by reading the source code of /bitrix/admin/ldap_server_edit.php.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://github.com/secware-ru/CVE-2022-43959; https://www.bitrix24.com/prices/self-hosted.php; https://www.bitrix24.com/security/
CVE: CVE-2022-48121
Published: 2023-01-20
Description: TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the rsabits parameter in the setting/delStaticDhcpRules function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/Am1ngl/ttt/tree/main/16; https://github.com/Am1ngl/ttt/tree/main/16
CVE: CVE-2022-48122
Published: 2023-01-20
Description: TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the dayvalid parameter in the setting/delStaticDhcpRules function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/Am1ngl/ttt/tree/main/17; https://github.com/Am1ngl/ttt/tree/main/17
CVE: CVE-2022-48123
Published: 2023-01-20
Description: TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the servername parameter in the setting/delStaticDhcpRules function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/Am1ngl/ttt/tree/main/15; https://github.com/Am1ngl/ttt/tree/main/15
CVE: CVE-2022-48124
Published: 2023-01-20
Description: TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the FileName parameter in the setting/setOpenVpnCertGenerationCfg function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/Am1ngl/ttt/tree/main/14; https://github.com/Am1ngl/ttt/tree/main/14
CVE: CVE-2022-48125
Published: 2023-01-20
Description: TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the password parameter in the setting/setOpenVpnCertGenerationCfg function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/Am1ngl/ttt/tree/main/13; https://github.com/Am1ngl/ttt/tree/main/13
CVE: CVE-2022-48126
Published: 2023-01-20
Description: TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the username parameter in the setting/setOpenVpnCertGenerationCfg function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/Am1ngl/ttt/tree/main/12; https://github.com/Am1ngl/ttt/tree/main/12
CVE: CVE-2021-26642
Published: 2023-01-20
Description: When uploading an image file to a bulletin board developed with XpressEngine, a vulnerability in which an arbitrary file can be uploaded due to insufficient verification of the file. A remote attacker can use this vulnerability to execute arbitrary code on the server where the bulletin board is running.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=67125; https://boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=67125
CVE: CVE-2021-26644
Published: 2023-01-20
Description: SQL-Injection vulnerability caused by the lack of verification of input values for the table name of DB used by the Mangboard bulletin board. A remote attacker can use this vulnerability to execute arbitrary code on the server where the bulletin board is running.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=67127; https://boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=67127
CVE: CVE-2022-25631
Published: 2023-01-20
Description: Symantec Endpoint Protection, prior to 14.3 RU6 (14.3.9210.6000), may be susceptible to a Elevation of Privilege vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://support.broadcom.com/external/content/SecurityAdvisories/0/21165; https://support.broadcom.com/external/content/SecurityAdvisories/0/21165
CVE: CVE-2022-27915
Published: 2023-01-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-27916
Published: 2023-01-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-27917
Published: 2023-01-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-27918
Published: 2023-01-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-43704
Published: 2023-01-20
Description: The Sinilink XY-WFT1 WiFi Remote Thermostat, running firmware 1.3.6, allows an attacker to bypass the intended requirement to communicate using MQTT. It is possible to replay Sinilink aka SINILINK521 protocol (udp/1024) commands interfacing directly with the target device. This, in turn, allows for an attack to control the onboard relay without requiring authentication via the mobile application. This might result in an unacceptable temperature within the target device's physical environment.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-294, CWE-294
References: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2022-43704-capture-replay-vulnerability-in-sinilink-xy-wft1-thermostat/; https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2022-43704-capture-replay-vulnerability-in-sinilink-xy-wft1-thermostat/
CVE: CVE-2022-47732
Published: 2023-01-20
Description: In Yeastar N412 and N824 Configuration Panel 42.x and 45.x, an unauthenticated attacker can create backup file and download it, revealing admin hash, allowing, once cracked, to login inside the Configuration Panel, otherwise, replacing the hash in the archive and restoring it on the device which will change admin password granting access to the device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-916, CWE-916
References: https://www.swascan.com/security-advisory-yeastar-n412-and-n824-configuration-panel/; https://www.yeastar.com/n-series-analog-phone-system/; https://www.swascan.com/security-advisory-yeastar-n412-and-n824-configuration-panel/
CVE: CVE-2022-47747
Published: 2023-01-20
Description: kraken <= 0.1.4 has an arbitrary file read vulnerability via the component testfs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/uber/kraken/issues/333; https://github.com/uber/kraken/issues/333
CVE: CVE-2023-22964
Published: 2023-01-20
Description: Zoho ManageEngine ServiceDesk Plus MSP before 10611, and 13x before 13004, is vulnerable to authentication bypass when LDAP authentication is enabled.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://manageengine.com; https://www.manageengine.com/products/service-desk-msp/cve-2023-22964.html; https://manageengine.com
CVE: CVE-2022-38110
Published: 2023-01-20
Description: In Database Performance Analyzer (DPA) 2022.4 and older releases, certain URL vectors are susceptible to authenticated reflected cross-site scripting.


CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://documentation.solarwinds.com/en/success_center/dpa/content/release_notes/dpa_2023-1_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-38110; https://documentation.solarwinds.com/en/success_center/dpa/content/release_notes/dpa_2023-1_release_notes.htm
CVE: CVE-2022-38112
Published: 2023-01-20
Description: In DPA 2022.4 and older releases, generated heap memory dumps contain sensitive information in cleartext.


CVSS Score: 7.5 (HIGH)
CWE: CWE-312, CWE-312
References: https://documentation.solarwinds.com/en/success_center/dpa/content/release_notes/dpa_2023-1_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-38112; https://documentation.solarwinds.com/en/success_center/dpa/content/release_notes/dpa_2023-1_release_notes.htm
CVE: CVE-2023-22910
Published: 2023-01-20
Description: An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. There is XSS in Wikibase date formatting via wikibase-time-precision-* fields. This allows JavaScript execution by staff/admin users who do not intentionally have the editsitejs capability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://phabricator.wikimedia.org/T323592; https://phabricator.wikimedia.org/T323592
CVE: CVE-2023-22912
Published: 2023-01-20
Description: An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. CheckUser TokenManager insecurely uses AES-CTR encryption with a repeated (aka re-used) nonce, allowing an adversary to decrypt.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-330, CWE-330
References: https://phabricator.wikimedia.org/T315123; https://phabricator.wikimedia.org/T315123
CVE: CVE-2023-23488
Published: 2023-01-20
Description: The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerability in the 'code' parameter of the '/pmpro/v1/order' REST route.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: http://packetstormsecurity.com/files/171661/WordPress-Paid-Memberships-Pro-2.9.8-SQL-Injection.html; https://www.tenable.com/security/research/tra-2023-2; http://packetstormsecurity.com/files/171661/WordPress-Paid-Memberships-Pro-2.9.8-SQL-Injection.html
CVE: CVE-2023-23489
Published: 2023-01-20
Description: The Easy Digital Downloads WordPress Plugin, versions 3.1.0.2 & 3.1.0.3, is affected by an unauthenticated SQL injection vulnerability in the 's' parameter of its 'edd_download_search' action.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.tenable.com/security/research/tra-2023-2; https://www.tenable.com/security/research/tra-2023-2
CVE: CVE-2020-21152
Published: 2023-01-20
Description: SQL Injection vulnerability in inxedu 2.0.6 allows attackers to execute arbitrary commands via the functionIds parameter to /saverolefunction.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: http://8sec.cc/index.php/archives/330/; https://gitee.com/inxeduopen/inxedu/issues/I14DNG; http://8sec.cc/index.php/archives/330/