deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-26601
Published: 2022-03-28
Description: ImpressCMS before 1.4.3 allows libraries/image-editor/image-edit.php image_temp Directory Traversal.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: http://karmainsecurity.com/KIS-2022-02; http://packetstormsecurity.com/files/166402/ImpressCMS-1.4.2-Path-Traversal.html; http://seclists.org/fulldisclosure/2022/Mar/44
CVE: CVE-2021-44208
Published: 2022-03-28
Description: OX App Suite through 7.10.5 allows XSS via an unknown system message in Chat.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/166389/OX-App-Suite-7.10.5-Cross-Site-Scripting.html; https://open-xchange.com; http://packetstormsecurity.com/files/166389/OX-App-Suite-7.10.5-Cross-Site-Scripting.html
CVE: CVE-2021-44209
Published: 2022-03-28
Description: OX App Suite through 7.10.5 allows XSS via an HTML 5 element such as AUDIO.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/166389/OX-App-Suite-7.10.5-Cross-Site-Scripting.html; https://open-xchange.com; http://packetstormsecurity.com/files/166389/OX-App-Suite-7.10.5-Cross-Site-Scripting.html
CVE: CVE-2021-44210
Published: 2022-03-28
Description: OX App Suite through 7.10.5 allows XSS via NIFF (Notation Interchange File Format) data.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/166389/OX-App-Suite-7.10.5-Cross-Site-Scripting.html; https://open-xchange.com; http://packetstormsecurity.com/files/166389/OX-App-Suite-7.10.5-Cross-Site-Scripting.html
CVE: CVE-2021-44211
Published: 2022-03-28
Description: OX App Suite through 7.10.5 allows XSS via the class attribute of an element in an HTML e-mail signature.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/166389/OX-App-Suite-7.10.5-Cross-Site-Scripting.html; https://open-xchange.com; http://packetstormsecurity.com/files/166389/OX-App-Suite-7.10.5-Cross-Site-Scripting.html
CVE: CVE-2022-26259
Published: 2022-03-28
Description: A buffer over flow in Xiongmai DVR devices NBD80X16S-KL, NBD80X09S-KL, NBD80X08S-KL, NBD80X09RA-KL, AHB80X04R-MH, AHB80X04R-MH-V2, AHB80X04-R-MH-V3, AHB80N16T-GS, AHB80N32F4-LME, and NBD90S0VT-QW allows attackers to cause a Denial of Service (DoS) via a crafted RSTP request.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://blog.ret2.me/post/2022-01-26-exploiting-xiongmai-dvrs/; https://www.xiongmaitech.com/en/index.php/service/notice_info/51/2; https://blog.ret2.me/post/2022-01-26-exploiting-xiongmai-dvrs/
CVE: CVE-2022-26268
Published: 2022-03-28
Description: Xiaohuanxiong v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /app/controller/Books.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/hiliqi/xiaohuanxiong/issues/33; https://github.com/hiliqi/xiaohuanxiong/issues/33
CVE: CVE-2022-26271
Published: 2022-03-28
Description: 74cmsSE v3.4.1 was discovered to contain an arbitrary file read vulnerability via the $url parameter at \index\controller\Download.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-552
References: https://github.com/N1ce759/74cmsSE-Arbitrary-File-Reading/issues/1; https://github.com/N1ce759/74cmsSE-Arbitrary-File-Reading/issues/1
CVE: CVE-2021-44212
Published: 2022-03-28
Description: OX App Suite through 7.10.5 allows XSS via a trailing control character such as the SCRIPT\t substring.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/166389/OX-App-Suite-7.10.5-Cross-Site-Scripting.html; https://open-xchange.com; http://packetstormsecurity.com/files/166389/OX-App-Suite-7.10.5-Cross-Site-Scripting.html
CVE: CVE-2021-44213
Published: 2022-03-28
Description: OX App Suite through 7.10.5 allows XSS via uuencoding in a multipart/alternative message.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://open-xchange.com; https://packetstormsecurity.com/files/166389/OX-App-Suite-7.10.5-Cross-Site-Scripting.html; https://open-xchange.com
CVE: CVE-2021-44617
Published: 2022-03-28
Description: A SQL Injection vulnerability exits in the Ramo plugin for GLPI 9.4.6 via the idu parameter in plugins/ramo/ramoapirest.php/getOutdated.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/166285/Baixar-GLPI-Project-9.4.6-SQL-Injection.html; http://packetstormsecurity.com/files/166285/Baixar-GLPI-Project-9.4.6-SQL-Injection.html
CVE: CVE-2021-45490
Published: 2022-03-28
Description: The client applications in 3CX on Windows, the 3CX app for iOS, and the 3CX application for Android through 2022-03-17 lack SSL certificate validation.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-295
References: https://packetstormsecurity.com/files/166376/3CX-Client-Missing-TLS-Validation.html; https://www.3cx.com/community/forums/posts-articles-news/; https://packetstormsecurity.com/files/166376/3CX-Client-Missing-TLS-Validation.html
CVE: CVE-2021-45491
Published: 2022-03-28
Description: 3CX System through 2022-03-17 stores cleartext passwords in a database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-312
References: http://packetstormsecurity.com/files/166386/3CX-Phone-System-Cleartext-Passwords.html; https://www.3cx.com/community/forums/posts-articles-news/; http://packetstormsecurity.com/files/166386/3CX-Phone-System-Cleartext-Passwords.html
CVE: CVE-2022-24303
Published: 2022-03-28
Description: Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.
CVSS Score: 9.1 (CRITICAL)
References: https://github.com/python-pillow/Pillow/pull/3450; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W4ZUXPKEX72O3E5IHBPVY5ZCPMJ4GHHV/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XR6UP2XONXOVXI4446VY72R63YRO2YTP/
CVE: CVE-2022-26273
Published: 2022-03-28
Description: EyouCMS v1.5.4 was discovered to lack parameter filtering in \user\controller\shop.php, leading to payment logic vulnerabilities.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/wwwxxxw/issue; https://github.com/wwwxxxw/issue
CVE: CVE-2022-27950
Published: 2022-03-28
Description: In drivers/hid/hid-elo.c in the Linux kernel before 5.16.11, a memory leak exists for a certain hid_parse error condition.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.11; https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=817b8b9c5396d2b2d92311b46719aad5d3339dbe; https://github.com/torvalds/linux/commit/817b8b9c5396d2b2d92311b46719aad5d3339dbe
CVE: CVE-2022-25757
Published: 2022-03-28
Description: In Apache APISIX before 2.13.0, when decoding JSON with duplicate keys, lua-cjson will choose the last occurred value as the result. By passing a JSON with a duplicate key, the attacker can bypass the body_schema validation in the request-validation plugin. For example, `{"string_payload":"bad","string_payload":"good"}` can be used to hide the "bad" input. Systems satisfy three conditions below are affected by this attack: 1. use body_schema validation in the request-validation plugin 2. upstream application uses a special JSON library that chooses the first occurred value, like jsoniter or gojay 3. upstream application does not validate the input anymore. The fix in APISIX is to re-encode the validated JSON input back into the request body at the side of APISIX. Improper Input Validation vulnerability in __COMPONENT__ of Apache APISIX allows an attacker to __IMPACT__. This issue affects Apache APISIX Apache APISIX version 2.12.1 and prior versions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-20
References: http://www.openwall.com/lists/oss-security/2022/03/28/2; https://lists.apache.org/thread/03vd2j81krxmpz6xo8p1dl642flpo6fv; http://www.openwall.com/lists/oss-security/2022/03/28/2
CVE: CVE-2021-46433
Published: 2022-03-28
Description: In fenom 2.12.1 and before, there is a way in fenom/src/Fenom/Template.php function getTemplateCode()to bypass sandbox to execute arbitrary PHP code when disable_native_funcs is true.
CVSS Score: 10.0 (CRITICAL)
References: https://github.com/fenom-template/fenom/issues/331; https://github.com/fenom-template/fenom/issues/331
CVE: CVE-2021-46434
Published: 2022-03-28
Description: EMQ X Dashboard V3.0.0 is affected by username enumeration in the "/api /v3/auth" interface. When a user login, the application returns different results depending on whether the account is correct, that allowed an attacker to determine if a given username was valid
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/emqx/emqx/issues/6791; https://github.com/emqx/emqx/issues/6791
CVE: CVE-2022-23882
Published: 2022-03-28
Description: TuziCMS 2.0.6 is affected by SQL injection in \App\Manage\Controller\BannerController.class.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/yeyinshi/tuzicms/issues/10; https://github.com/yeyinshi/tuzicms/issues/10
CVE: CVE-2021-43725
Published: 2022-03-28
Description: There is a Cross Site Scripting (XSS) vulnerability in SpotPage_login.php of Spotweb 1.5.1 and below, which allows remote attackers to inject arbitrary web script or HTML via the data[performredirect] parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/spotweb/spotweb/commit/2bfa001689aae96009688a193c64478647ba45a1; https://github.com/spotweb/spotweb/issues/718; https://github.com/spotweb/spotweb/commit/2bfa001689aae96009688a193c64478647ba45a1
CVE: CVE-2022-0342
Published: 2022-03-28
Description: An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.32 through 5.20, VPN series firmware versions 4.30 through 5.20, and NSG series firmware versions V1.20 through V1.33 Patch 4, which could allow an attacker to bypass the web authentication and obtain administrative access of the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://www.zyxel.com/support/Zyxel-security-advisory-for-authentication-bypass-vulnerability-of-firewalls.shtml; https://www.zyxel.com/support/Zyxel-security-advisory-for-authentication-bypass-vulnerability-of-firewalls.shtml
CVE: CVE-2022-23884
Published: 2022-03-28
Description: Mojang Bedrock Dedicated Server 1.18.2 is affected by an integer overflow leading to a bound check bypass caused by PurchaseReceiptPacket::_read (packet deserializer).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://s3.bmp.ovh/imgs/2022/01/962e0c75f5969cfb.png; https://s3.bmp.ovh/imgs/2022/01/962e0c75f5969cfb.png
CVE: CVE-2021-43721
Published: 2022-03-28
Description: Leanote 2.7.0 is vulnerable to Cross Site Scripting (XSS) in the markdown type note. This leads to remote code execution with payload : <video src=x onerror=(function(){require('child_process').exec('calc');})();>
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/leanote/desktop-app/issues/364; https://github.com/leanote/desktop-app/issues/364
CVE: CVE-2021-44103
Published: 2022-03-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-42192. Reason: This candidate is a duplicate of CVE-2021-42192. Notes: All CVE users should reference CVE-2021-42192 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2021-44124
Published: 2022-03-28
Description: Hiby Music Hiby OS R3 Pro 1.5 and 1.6 is vulnerable to Directory Traversal. The HTTP Server does not have enough input data sanitization when shown data from SD Card, an attacker can navigate through the device's File System over HTTP.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/feric/Findings/tree/main/Hiby/Web%20Server/Path%20Traversal; https://github.com/vext01/hiby-issues/issues/9#issuecomment-907891626; https://github.com/feric/Findings/tree/main/Hiby/Web%20Server/Path%20Traversal
CVE: CVE-2015-10002
Published: 2022-03-28
Description: A vulnerability classified as problematic has been found in Kiddoware Kids Place. This affects the Home Button Protection. A repeated pressing of the button causes a local denial of service. It is recommended to upgrade the affected component.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-404
References: https://vuldb.com/?id.118359; https://vuldb.com/?id.118359
CVE: CVE-2018-25030
Published: 2022-03-28
Description: A vulnerability classified as problematic has been found in Mirmay Secure Private Browser and File Manager up to 2.5. Affected is the Auto Lock. A race condition leads to a local authentication bypass. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.3 (LOW)
CWE: CWE-287, CWE-287, CWE-362
References: https://vuldb.com/?id.106056; https://www.scip.ch/en/?labs.20180201; https://youtu.be/cd6nbos-BI0
CVE: CVE-2021-24746
Published: 2022-03-28
Description: The Social Sharing Plugin WordPress plugin before 3.3.40 does not escape the viewed post URL before outputting it back in onclick attributes when the "Enable 'More' icon" option is enabled (which is the default setting), leading to a Reflected Cross-Site Scripting issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/99f4fb32-e312-4059-adaf-f4cbaa92d4fa; https://wpscan.com/vulnerability/99f4fb32-e312-4059-adaf-f4cbaa92d4fa
CVE: CVE-2021-24962
Published: 2022-03-28
Description: The WordPress File Upload Free and Pro WordPress plugins before 4.16.3 allow users with a role as low as Contributor to perform path traversal via a shortcode argument, which can then be used to upload a PHP code disguised as an image inside the auto-loaded directory of the plugin, resulting in arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-22
References: https://plugins.trac.wordpress.org/changeset/2677722; https://wpscan.com/vulnerability/7a95b3f2-285e-40e3-aead-41932c207623; https://plugins.trac.wordpress.org/changeset/2677722
CVE: CVE-2021-24978
Published: 2022-03-28
Description: The OSMapper WordPress plugin through 2.1.5 contains an AJAX action to delete a plugin related post type named 'map' and is registered with the wp_ajax_nopriv prefix, making it available to unauthenticated users. There is no authorisation, CSRF and checks in place to ensure that the post to delete is a map one. As a result, unauthenticated user can delete arbitrary posts from the blog
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862, CWE-352, CWE-862
References: https://wpscan.com/vulnerability/f0f2af29-e21e-4d16-9424-1a49bff7fb86; https://wpscan.com/vulnerability/f0f2af29-e21e-4d16-9424-1a49bff7fb86
CVE: CVE-2021-25012
Published: 2022-03-28
Description: The Pz-LinkCard WordPress plugin through 2.4.4.4 does not sanitise and escape multiple parameters before outputting them back in admin dashboard pages, leading to Reflected Cross-Site Scripting issues
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/b126d2fc-6cc7-4c18-b95e-d32c2effcc4f; https://wpscan.com/vulnerability/b126d2fc-6cc7-4c18-b95e-d32c2effcc4f
CVE: CVE-2021-25064
Published: 2022-03-28
Description: The Wow Countdowns WordPress plugin through 3.1.2 does not sanitize user input into the 'did' parameter and uses it in a SQL statement, leading to an authenticated SQL Injection.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://wpscan.com/vulnerability/30c70315-3c17-41f0-a12f-7e3f793e259c; https://wpscan.com/vulnerability/30c70315-3c17-41f0-a12f-7e3f793e259c
CVE: CVE-2021-25068
Published: 2022-03-28
Description: The Sync WooCommerce Product feed to Google Shopping WordPress plugin through 1.2.4 uses the 'feed_id' POST parameter which is not properly sanitized for use in a SQL statement, leading to a SQL injection vulnerability in the admin dashboard
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://wpscan.com/vulnerability/32799efd-99dc-46dd-8648-e9eb872a0371; https://wpscan.com/vulnerability/32799efd-99dc-46dd-8648-e9eb872a0371
CVE: CVE-2021-25070
Published: 2022-03-28
Description: The Block Bad Bots WordPress plugin before 6.88 does not properly sanitise and escape the User Agent before using it in a SQL statement to record logs, leading to an SQL Injection issue
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wpscan.com/vulnerability/e00b2946-15e5-4458-9b13-2e272630a36f; https://wpscan.com/vulnerability/e00b2946-15e5-4458-9b13-2e272630a36f
CVE: CVE-2021-25071
Published: 2022-03-28
Description: The WordPress plugin through 2.0.1 does not sanitise and escape the translation parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/53085936-fa07-4f00-a7dc-bbe98c51320e; https://wpscan.com/vulnerability/53085936-fa07-4f00-a7dc-bbe98c51320e
CVE: CVE-2022-0388
Published: 2022-03-28
Description: The Interactive Medical Drawing of Human Body WordPress plugin before 2.6 does not sanitise and escape the Link field, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/7d4ad1f3-6d27-4655-9796-ce370ef5fced; https://wpscan.com/vulnerability/7d4ad1f3-6d27-4655-9796-ce370ef5fced
CVE: CVE-2022-0397
Published: 2022-03-28
Description: The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.4 does not sanitise and escape the key parameter before outputting it back in the wishlist_quickview AJAX action's response (available to any authenticated user), leading to a Reflected Cross-Site Scripting
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/c8091254-1ced-4363-ab7f-5b880447713d; https://wpscan.com/vulnerability/c8091254-1ced-4363-ab7f-5b880447713d
CVE: CVE-2022-0450
Published: 2022-03-28
Description: The Menu Image, Icons made easy WordPress plugin before 3.0.6 does not have authorisation and CSRF checks when saving menu settings, and does not validate, sanitise and escape them. As a result, any authenticate users, such as subscriber can update the settings or arbitrary menu and put Cross-Site Scripting payloads in them which will be triggered in the related menu in the frontend
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-116
References: https://wpscan.com/vulnerability/612f9273-acc8-4be6-b372-33f1e687f54a; https://wpscan.com/vulnerability/612f9273-acc8-4be6-b372-33f1e687f54a
CVE: CVE-2022-0479
Published: 2022-03-28
Description: The Popup Builder WordPress plugin before 4.1.1 does not sanitise and escape the sgpb-subscription-popup-id parameter before using it in a SQL statement in the All Subscribers admin dashboard, leading to a SQL injection, which could also be used to perform Reflected Cross-Site Scripting attack against a logged in admin opening a malicious link
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/changeset/2686454; https://wpscan.com/vulnerability/0d2bbbaf-fbfd-4921-ba4e-684e2e77e816; https://plugins.trac.wordpress.org/changeset/2686454
CVE: CVE-2022-0493
Published: 2022-03-28
Description: The String locator WordPress plugin before 2.5.0 does not properly validate the path of the files to be searched, allowing high privilege users such as admin to query arbitrary files on the web server via a path traversal vector. Furthermore, due to a flaw in the search, allowing a pattern to be provided, which will be used to output the relevant matches from the matching file, all content of the file can be disclosed.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/changeset/2685592; https://wpscan.com/vulnerability/21e2e5fc-03d2-4791-beef-07af6bf985ed; https://plugins.trac.wordpress.org/changeset/2685592
CVE: CVE-2022-0499
Published: 2022-03-28
Description: The Sermon Browser WordPress plugin through 0.45.22 does not have CSRF checks in place when uploading Sermon files, and does not validate them in any way, allowing attackers to make a logged in admin upload arbitrary files such as PHP ones.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-434
References: https://wpscan.com/vulnerability/e9ccf1fc-1dbf-4a41-bf4a-90af20b286d6; https://wpscan.com/vulnerability/e9ccf1fc-1dbf-4a41-bf4a-90af20b286d6
CVE: CVE-2022-0595
Published: 2022-03-28
Description: The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.3 allows SVG files to be uploaded by default via the dnd_codedropz_upload AJAX action, which could lead to Stored Cross-Site Scripting issue
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/2686614; https://wpscan.com/vulnerability/1b849957-eaca-47ea-8f84-23a3a98cc8de; https://plugins.trac.wordpress.org/changeset/2686614
CVE: CVE-2022-0599
Published: 2022-03-28
Description: The Mapping Multiple URLs Redirect Same Page WordPress plugin through 5.8 does not sanitize and escape the mmursp_id parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/4f1d45bc-d3bd-472c-959d-05abeff32765; https://wpscan.com/vulnerability/4f1d45bc-d3bd-472c-959d-05abeff32765
CVE: CVE-2022-0600
Published: 2022-03-28
Description: The Conference Scheduler WordPress plugin before 2.4.3 does not sanitize and escape the tab parameter before outputting back in an admin page, leading to a Reflected Cross-Site Scripting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/5dd6f625-6738-4e6a-81dc-21c0add4368d; https://wpscan.com/vulnerability/5dd6f625-6738-4e6a-81dc-21c0add4368d
CVE: CVE-2022-0619
Published: 2022-03-28
Description: The Database Peek WordPress plugin through 1.2 does not sanitize and escape the match parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/d18892c6-2b19-4037-bc39-5d170adaf3d9; https://wpscan.com/vulnerability/d18892c6-2b19-4037-bc39-5d170adaf3d9
CVE: CVE-2022-0620
Published: 2022-03-28
Description: The Delete Old Orders WordPress plugin through 0.2 does not sanitize and escape the date parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/77b92130-167c-4e8a-bde5-3fd1bd6982c6; https://wpscan.com/vulnerability/77b92130-167c-4e8a-bde5-3fd1bd6982c6
CVE: CVE-2022-0621
Published: 2022-03-28
Description: The dTabs WordPress plugin through 1.4 does not sanitize and escape the tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/b5578747-298d-4f4b-867e-46b767485a98; https://wpscan.com/vulnerability/b5578747-298d-4f4b-867e-46b767485a98
CVE: CVE-2022-0641
Published: 2022-03-28
Description: The Popup Like box WordPress plugin before 3.6.1 does not sanitize and escape the ays_fb_tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/0a9830df-5f5d-40a3-9[PII_REDACTED]5136f; https://wpscan.com/vulnerability/0a9830df-5f5d-40a3-9[PII_REDACTED]5136f
CVE: CVE-2022-0643
Published: 2022-03-28
Description: The Bank Mellat WordPress plugin through 1.3.7 does not sanitize and escape the orderId parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/5be0de93-9625-419a-8c37-521c1bd9c24c; https://wpscan.com/vulnerability/5be0de93-9625-419a-8c37-521c1bd9c24c
CVE: CVE-2022-0647
Published: 2022-03-28
Description: The Bulk Creator WordPress plugin through 1.0.1 does not sanitize and escape the post_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/4a585d5f-72ba-43e3-b04f-8b3e1b84444a; https://wpscan.com/vulnerability/4a585d5f-72ba-43e3-b04f-8b3e1b84444a