deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-47128
Published: 2023-11-10
Description: Piccolo is an object-relational mapping and query builder which supports asyncio. Prior to version 1.1.1, the handling of named transaction `savepoints` in all database implementations is vulnerable to SQL Injection via f-strings. While the likelihood of an end developer exposing a `savepoints` `name` parameter to a user is highly unlikely, it would not be unheard of. If a malicious user was able to abuse this functionality they would have essentially direct access to the database and the ability to modify data to the level of permissions associated with the database user. A non exhaustive list of actions possible based on database permissions is: Read all data stored in the database, including usernames and password hashes; insert arbitrary data into the database, including modifying existing records; and gain a shell on the underlying server. Version 1.1.1 fixes this issue.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89
References: https://github.com/piccolo-orm/piccolo/commit/82679eb8cd1449cf31d87c9914a072e70168b6eb; https://github.com/piccolo-orm/piccolo/security/advisories/GHSA-xq59-7jf3-rjc6; https://github.com/piccolo-orm/piccolo/commit/82679eb8cd1449cf31d87c9914a072e70168b6eb
CVE: CVE-2023-47108
Published: 2023-11-10
Description: OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Starting in version 0.37.0 and prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels `net.peer.sock.addr` and `net.peer.sock.port` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent. An attacker can easily flood the peer address and port for requests. Version 0.46.0 contains a fix for this issue. As a workaround to stop being affected, a view removing the attributes can be used. The other possibility is to disable grpc metrics instrumentation by passing `otelgrpc.WithMeterProvider` option with `noop.NewMeterProvider`.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/open-telemetry/opentelemetry-go-contrib/blob/9d4eb7e7706038b07d33f83f76afbe13f53d171d/instrumentation/google.golang.org/grpc/otelgrpc/interceptor.go#L327; https://github.com/open-telemetry/opentelemetry-go-contrib/blob/instrumentation/google.golang.org/grpc/otelgrpc/v0.45.0/instrumentation/google.golang.org/grpc/otelgrpc/config.go#L138; https://github.com/open-telemetry/opentelemetry-go-contrib/commit/04c5dcbb5b35f14b4e6793b245919c72addbc7d0
CVE: CVE-2023-47129
Published: 2023-11-10
Description: Statmic is a core Laravel content management system Composer package. Prior to versions 3.4.13 and 4.33.0, on front-end forms with an asset upload field, PHP files crafted to look like images may be uploaded. This only affects forms using the "Forms" feature and not just _any_ arbitrary form. This does not affect the control panel. This issue has been patched in 3.4.13 and 4.33.0.

CVSS Score: 8.3 (HIGH)
CWE: CWE-434, CWE-434
References: https://github.com/statamic/cms/commit/098ef8024d97286ca501273c18ae75b646262d75; https://github.com/statamic/cms/commit/f6c688154f6bdbd0b67039f8f11dcd98ba061e77; https://github.com/statamic/cms/security/advisories/GHSA-72hg-5wr5-rmfc
CVE: CVE-2023-36027
Published: 2023-11-10
Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVSS Score: 7.1 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36027; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36027
CVE: CVE-2023-47122
Published: 2023-11-10
Description: Gitsign is software for keyless Git signing using Sigstore. In versions of gitsign starting with 0.6.0 and prior to 0.8.0, Rekor public keys were fetched via the Rekor API, instead of through the local TUF client. If the upstream Rekor server happened to be compromised, gitsign clients could potentially be tricked into trusting incorrect signatures. There is no known compromise the default public good instance (`rekor.sigstore.dev`) - anyone using this instance is unaffected. This issue was fixed in v0.8.0. No known workarounds are available.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-347
References: https://docs.sigstore.dev/about/threat-model/#sigstore-threat-model; https://github.com/sigstore/gitsign/commit/cd66ccb03c86a3600955f0c15f6bfeb75f697236; https://github.com/sigstore/gitsign/pull/399
CVE: CVE-2023-4804
Published: 2023-11-10
Description: An unauthorized user could access debug features in Quantum HD Unity products that were accidentally exposed.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-489
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-313-01; https://www.johnsoncontrols.com/cyber-solutions/security-advisories; https://www.cisa.gov/news-events/ics-advisories/icsa-23-313-01
CVE: CVE-2023-46849
Published: 2023-11-11
Description: Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger a divide by zero behaviour which could cause an application crash, leading to a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-369, CWE-369
References: https://community.openvpn.net/openvpn/wiki/CVE-2023-46849; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3FS46ANNTAVLIQY56ZKGM5CBTRVBUNE/; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O54I7D753V6PU6XBU26FEROD2DSHEJQ4/
CVE: CVE-2023-46850
Published: 2023-11-11
Description: Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416, CWE-416
References: https://community.openvpn.net/openvpn/wiki/CVE-2023-46850; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3FS46ANNTAVLIQY56ZKGM5CBTRVBUNE/; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O54I7D753V6PU6XBU26FEROD2DSHEJQ4/
CVE: CVE-2023-5959
Published: 2023-11-11
Description: A vulnerability, which was classified as problematic, was found in Byzoro Smart S85F Management Platform V31R02B10-01. Affected is an unknown function of the file /login.php. The manipulation of the argument txt_newpwd leads to weak password recovery. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-244992. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-640
References: https://github.com/Changboqian/cve/blob/main/reset_password_improperly.md; https://vuldb.com/?ctiid.244992; https://vuldb.com/?id.244992
CVE: CVE-2023-43057
Published: 2023-11-11
Description: IBM QRadar SIEM 7.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  267484.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/267484; https://www.ibm.com/support/pages/node/7070736; https://exchange.xforce.ibmcloud.com/vulnerabilities/267484
CVE: CVE-2023-47390
Published: 2023-11-11
Description: Headscale through 0.22.3 writes bearer tokens to info-level logs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: https://github.com/juanfont/headscale/issues/1259; https://github.com/juanfont/headscale/issues/1259
CVE: CVE-2023-6084
Published: 2023-11-12
Description: A vulnerability was found in Tongda OA 2017 up to 11.9 and classified as critical. Affected by this issue is some unknown functionality of the file general/vehicle/checkup/delete.php. The manipulation of the argument VU_ID leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. VDB-244994 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/T1ANGzy/cve/blob/main/sql.md; https://vuldb.com/?ctiid.244994; https://vuldb.com/?id.244994
CVE: CVE-2023-42781
Published: 2023-11-12
Description: Apache Airflow, versions before 2.7.3, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs.  This is a different issue than CVE-2023-42663 but leading to similar outcome.
Users of Apache Airflow are advised to upgrade to version 2.7.3 or newer to mitigate the risk associated with this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2023/11/12/2; https://github.com/apache/airflow/pull/34939; https://lists.apache.org/thread/7dnl8nszdxqyns57f3dw0sloy5dfl9o1
CVE: CVE-2023-47037
Published: 2023-11-12
Description: We failed to apply CVE-2023-40611 in 2.7.1 and this vulnerability was marked as fixed then. 

Apache Airflow, versions before 2.7.3, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc. 

Users should upgrade to version 2.7.3 or later which has removed the vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: http://www.openwall.com/lists/oss-security/2023/11/12/1; https://github.com/apache/airflow/pull/33413; https://lists.apache.org/thread/04y4vrw1t2xl030gswtctc4nt1w90cb0
CVE: CVE-2023-28495
Published: 2023-11-12
Description: Cross-Site Request Forgery (CSRF) vulnerability in MyThemeShop WP Shortcode by MyThemeShop plugin <= 1.4.16 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-shortcode/wordpress-wp-shortcode-by-mythemeshop-plugin-1-4-16-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-shortcode/wordpress-wp-shortcode-by-mythemeshop-plugin-1-4-16-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-28497
Published: 2023-11-12
Description: Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Slideshow Gallery LITE plugin <= 1.7.6 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/slideshow-gallery/wordpress-slideshow-gallery-lite-plugin-1-7-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/slideshow-gallery/wordpress-slideshow-gallery-lite-plugin-1-7-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-28498
Published: 2023-11-12
Description: Cross-Site Request Forgery (CSRF) vulnerability in MotoPress Hotel Booking Lite plugin <= 4.6.0 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/motopress-hotel-booking-lite/wordpress-hotel-booking-lite-plugin-4-6-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/motopress-hotel-booking-lite/wordpress-hotel-booking-lite-plugin-4-6-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-28618
Published: 2023-11-12
Description: Cross-Site Request Forgery (CSRF) vulnerability in Marios Alexandrou Enhanced Plugin Admin plugin <= 1.16 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/enhanced-plugin-admin/wordpress-enhanced-plugin-admin-plugin-1-16-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/enhanced-plugin-admin/wordpress-enhanced-plugin-admin-plugin-1-16-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-28694
Published: 2023-11-12
Description: Cross-Site Request Forgery (CSRF) vulnerability in Wbcom Designs Wbcom Designs – BuddyPress Activity Social Share plugin <= 3.5.0 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/bp-activity-social-share/wordpress-wbcom-designs-buddypress-activity-social-share-plugin-3-4-0-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/bp-activity-social-share/wordpress-wbcom-designs-buddypress-activity-social-share-plugin-3-4-0-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2023-28696
Published: 2023-11-12
Description: Cross-Site Request Forgery (CSRF) vulnerability in Harish Chouhan, Themeist I Recommend This allows Cross Site Request Forgery.This issue affects I Recommend This: from n/a through 3.9.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/i-recommend-this/wordpress-i-recommend-this-plugin-3-8-3-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/i-recommend-this/wordpress-i-recommend-this-plugin-3-8-3-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2023-28930
Published: 2023-11-12
Description: Cross-Site Request Forgery (CSRF) vulnerability in Robin Phillips Mobile Banner plugin <= 1.5 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/mobile-banner/wordpress-mobile-banner-plugin-1-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/mobile-banner/wordpress-mobile-banner-plugin-1-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-28987
Published: 2023-11-12
Description: Cross-Site Request Forgery (CSRF) vulnerability in Wpmet Wp Ultimate Review plugin <= 2.0.3 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-ultimate-review/wordpress-wp-ultimate-review-plugin-2-0-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-ultimate-review/wordpress-wp-ultimate-review-plugin-2-0-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-29238
Published: 2023-11-12
Description: Cross-Site Request Forgery (CSRF) vulnerability in Whydonate Whydonate – FREE Donate button – Crowdfunding – Fundraising plugin <= 3.12.15 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/wp-whydonate/wordpress-whydonate-plugin-3-12-13-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-whydonate/wordpress-whydonate-plugin-3-12-13-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-29425
Published: 2023-11-12
Description: Cross-Site Request Forgery (CSRF) vulnerability in plainware.Com ShiftController Employee Shift Scheduling plugin <= 4.9.23 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/shiftcontroller/wordpress-shiftcontroller-employee-shift-scheduling-plugin-4-9-23-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/shiftcontroller/wordpress-shiftcontroller-employee-shift-scheduling-plugin-4-9-23-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-27417
Published: 2023-11-12
Description: Cross-Site Request Forgery (CSRF) vulnerability in Timo Reith Affiliate Super Assistent plugin <= 1.5.1 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/amazonsimpleadmin/wordpress-affiliate-super-assistent-plugin-1-5-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/amazonsimpleadmin/wordpress-affiliate-super-assistent-plugin-1-5-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-27418
Published: 2023-11-12
Description: Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Side Menu Lite – add sticky fixed buttons plugin <= 4.0 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/side-menu-lite/wordpress-side-menu-lite-plugin-4-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/side-menu-lite/wordpress-side-menu-lite-plugin-4-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-27431
Published: 2023-11-12
Description: Cross-Site Request Forgery (CSRF) vulnerability in ThemeHunk Big Store theme <= 1.9.3 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/big-store/wordpress-big-store-theme-1-9-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/big-store/wordpress-big-store-theme-1-9-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-27611
Published: 2023-11-12
Description: Cross-Site Request Forgery (CSRF) vulnerability in audrasjb Reusable Blocks Extended plugin <= 0.9 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/reusable-blocks-extended/wordpress-reusable-blocks-extended-plugin-0-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/reusable-blocks-extended/wordpress-reusable-blocks-extended-plugin-0-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-27623
Published: 2023-11-12
Description: Cross-Site Request Forgery (CSRF) vulnerability in Jens Törnell WP Page Numbers plugin <= 0.5 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-page-numbers/wordpress-wp-page-numbers-plugin-0-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-page-numbers/wordpress-wp-page-numbers-plugin-0-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-27632
Published: 2023-11-12
Description: Cross-Site Request Forgery (CSRF) vulnerability in mmrs151 Daily Prayer Time plugin <= 2023.03.08 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/daily-prayer-time-for-mosques/wordpress-daily-prayer-time-plugin-2023-02-21-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/daily-prayer-time-for-mosques/wordpress-daily-prayer-time-plugin-2023-02-21-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-28134
Published: 2023-11-12
Description: Local attacker can escalate privileges on affected installations of Check Point Harmony Endpoint/ZoneAlarm Extreme Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732, CWE-732
References: https://support.checkpoint.com/results/sk/sk181597; https://support.checkpoint.com/results/sk/sk181597
CVE: CVE-2023-28167
Published: 2023-11-12
Description: Cross-Site Request Forgery (CSRF) vulnerability in Vsourz Digital CF7 Invisible reCAPTCHA plugin <= 1.3.3 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/cf7-invisible-recaptcha/wordpress-cf7-invisible-recaptcha-plugin-1-3-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/cf7-invisible-recaptcha/wordpress-cf7-invisible-recaptcha-plugin-1-3-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-28172
Published: 2023-11-12
Description: Cross-Site Request Forgery (CSRF) vulnerability in flippercode WordPress Plugin for Google Maps – WP MAPS (formerly WP Google Map Plugin) plugin <= 4.4.2 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-google-map-plugin/wordpress-wp-maps-plugin-4-4-2-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/wp-google-map-plugin/wordpress-wp-maps-plugin-4-4-2-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2023-28173
Published: 2023-11-12
Description: Cross-Site Request Forgery (CSRF) vulnerability in Amit Agarwal Google XML Sitemap for Images plugin <= 2.1.3 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/google-image-sitemap/wordpress-google-xml-sitemap-for-images-plugin-2-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/google-image-sitemap/wordpress-google-xml-sitemap-for-images-plugin-2-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-28419
Published: 2023-11-12
Description: Cross-Site Request Forgery (CSRF) vulnerability in Stranger Studios Force First and Last Name as Display Name plugin <= 1.2 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/force-first-last/wordpress-force-first-and-last-name-as-display-name-plugin-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/force-first-last/wordpress-force-first-and-last-name-as-display-name-plugin-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-28420
Published: 2023-11-12
Description: Cross-Site Request Forgery (CSRF) vulnerability in Leo Caseiro Custom Options Plus plugin <= 1.8.1 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/custom-options-plus/wordpress-custom-options-plus-plugin-1-8-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/custom-options-plus/wordpress-custom-options-plus-plugin-1-8-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-26514
Published: 2023-11-13
Description: Cross-Site Request Forgery (CSRF) vulnerability in WPGrim Dynamic XML Sitemaps Generator for Google plugin <= 1.3.3 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/xml-sitemap-generator-for-google/wordpress-xml-sitemap-generator-for-google-plugin-1-2-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/xml-sitemap-generator-for-google/wordpress-xml-sitemap-generator-for-google-plugin-1-2-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-26516
Published: 2023-11-13
Description: Cross-Site Request Forgery (CSRF) vulnerability in WPIndeed Debug Assistant plugin <= 1.4 versions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/debug-assistant/wordpress-debug-assistant-plugin-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/debug-assistant/wordpress-debug-assistant-plugin-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-26518
Published: 2023-11-13
Description: Cross-Site Request Forgery (CSRF) vulnerability in AccessPress Themes WP TFeed plugin <= 1.6.9 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/accesspress-twitter-feed/wordpress-wp-tfeed-plugin-1-6-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/accesspress-twitter-feed/wordpress-wp-tfeed-plugin-1-6-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-26524
Published: 2023-11-13
Description: Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin <= 8.0.10 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/quiz-master-next/wordpress-quiz-and-survey-master-plugin-8-0-10-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/quiz-master-next/wordpress-quiz-and-survey-master-plugin-8-0-10-cross-site-request-forgery-csrf-vulnerability?_s_id=cve