rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-0243 TuziCMS Article Module ArticleController.class.php index sql injection
A vulnerability classified as critical has been found in TuziCMS 2.0.6. This affects the function index of the file App\Manage\Controller\ArticleController.class.php of the component Article Module. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-218151.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: n/a
product: TuziCMS
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: Evilmu1 (VulDB User)
Published: 2023-01-12T14:46:36.016Z
CVE-2023-0244 TuziCMS KefuController.class.php delall sql injection
A vulnerability classified as critical was found in TuziCMS 2.0.6. This vulnerability affects the function delall of the file \App\Manage\Controller\KefuController.class.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-218152.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: n/a
product: TuziCMS
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: Evilmu1 (VulDB User)
Published: 2023-01-12T14:49:40.968Z
CVE-2023-0245 SourceCodester Online Flight Booking Management System add_contestant.php sql injection
A vulnerability, which was classified as critical, has been found in SourceCodester Online Flight Booking Management System. This issue affects some unknown processing of the file add_contestant.php. The manipulation of the argument add_contestant leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-218153 was assigned to this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: SourceCodester
product: Online Flight Booking Management System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: Evilmu1 (VulDB User)
Published: 2023-01-12T14:52:10.601Z
CVE-2023-0246 earclink ESPCMS Content cross site scripting
A vulnerability, which was classified as problematic, was found in earclink ESPCMS P8.21120101. Affected is an unknown function of the component Content Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-218154 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: earclink
product: ESPCMS
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: VulDB Gitee Analyzer
Published: 2023-01-12T14:57:07.023Z
CVE-2023-0247 Uncontrolled Search Path Element in bits-and-blooms/bloom
Uncontrolled Search Path Element in GitHub repository bits-and-blooms/bloom prior to 3.3.1.
Problem types: cwe_id: CWE-427
description: CWE-427 Uncontrolled Search Path Element
Affected products: vendor: bits-and-blooms
product: bits-and-blooms/bloom
Published: 2023-01-12T00:00:00.000Z
CVE-2023-0248 Kantech Gen1 ioSmart card reader
An attacker with physical access to the Kantech Gen1 ioSmart card reader with firmware version prior to 1.07.02 in certain circumstances can recover the reader's communication memory between the card and reader.


Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
cwe_id: CWE-401
description: CWE-401 Missing Release of Memory after Effective Lifetime
Affected products: vendor: Sensormatic Electronics, a subsidiary of Johnson Controls, Inc.
product: ioSmart Gen1
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L
version: 3.1
Credits: lang: en
value: Colin O’Flynn at NewAE Technology Inc.
Published: 2023-12-14T20:57:33.625Z
CVE-2023-0249 CVE-2023-0249
Delta Electronics DIAScreen versions 1.2.1.23 and prior are vulnerable to out-of-bounds write, which may allow an attacker to remotely execute arbitrary code.


Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: Delta Electronics
product: DIAScreen
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Natnael Samson (@NattiSamson)
lang: en
value: Trend Micro’s Zero Day Initiative
Published: 2023-02-08T22:43:50.324Z
CVE-2023-0250 CVE-2023-0250
Delta Electronics DIAScreen versions 1.2.1.23 and prior are vulnerable to a stack-based buffer overflow, which could allow an attacker to remotely execute arbitrary code.


Problem types: cwe_id: CWE-121
description: CWE-121 STACK-BASED BUFFER OVERFLOW
Affected products: vendor: Delta Electronics
product: DIAScreen
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Natnael Samson (@NattiSamson)
lang: en
value: Trend Micro’s Zero Day Initiative
Published: 2023-02-08T22:45:50.148Z
CVE-2023-0251 CVE-2023-0251
Delta Electronics DIAScreen versions 1.2.1.23 and prior are vulnerable to a buffer overflow through improper restrictions of operations within memory, which could allow an attacker to remotely execute arbitrary code.


Problem types: cwe_id: CWE-119
description: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: Delta Electronics
product: DIAScreen
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Natnael Samson (@NattiSamson)
lang: en
value: Trend Micro’s Zero Day Initiative
Published: 2023-02-08T22:47:40.716Z
CVE-2023-0252 Contextual Related Posts < 3.3.1 - Contributor+ Stored XSS
The Contextual Related Posts WordPress plugin before 3.3.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Contextual Related Posts
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-06T19:59:49.263Z
CVE-2023-0254 Simple Membership WP user Import <= 1.7 - Authenticated (Admin+) SQL Injection
The Simple Membership WP user Import plugin for WordPress is vulnerable to SQL Injection via the ‘orderby’ parameter in versions up to, and including, 1.7 due to insufficient escaping on the user supplied parameter. This makes it possible for authenticated attackers with administrative privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: wpinsider-1
product: Simple Membership WP user Import
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
baseScore: 7.2
baseSeverity: HIGH
Credits: lang: en
value: Etan Imanol Castro Aldrete
Published: 2023-01-12T17:34:26.499Z
CVE-2023-0255 Enable Media Replace < 4.0.2 - Author+ Arbitrary File Upload
The Enable Media Replace WordPress plugin before 4.0.2 does not prevent authors from uploading arbitrary files to the site, which may allow them to upload PHP shells on affected sites.
Problem types: description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Unknown
product: Enable Media Replace
default_status: unaffected
Credits: lang: en
value: dc11
lang: en
value: WPScan
Published: 2023-02-13T14:32:21.404Z
CVE-2023-0256 SourceCodester Online Food Ordering System Login Page sql injection
A vulnerability was found in SourceCodester Online Food Ordering System 2.0. It has been classified as critical. Affected is an unknown function of the file /fos/admin/ajax.php?action=login of the component Login Page. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-218184.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: SourceCodester
product: Online Food Ordering System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: Lohith19 (VulDB User)
Published: 2023-01-12T21:03:04.018Z
CVE-2023-0257 SourceCodester Online Food Ordering System Menu Form unrestricted upload
A vulnerability was found in SourceCodester Online Food Ordering System 2.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /fos/admin/index.php?page=menu of the component Menu Form. The manipulation of the argument Image with the input <?php system($_GET['c']); ?> leads to unrestricted upload. The attack can be launched remotely. The identifier VDB-218185 was assigned to this vulnerability.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload
Affected products: vendor: SourceCodester
product: Online Food Ordering System
CVSS v3.1: version: 3.1
baseScore: 4.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: DisguisedRoot (VulDB User)
Published: 2023-01-12T21:09:33.279Z
CVE-2023-0258 SourceCodester Online Food Ordering System Category List cross site scripting
A vulnerability was found in SourceCodester Online Food Ordering System 2.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Category List Handler. The manipulation of the argument Reason with the input "><script>prompt(1)</script> leads to cross site scripting. The attack may be launched remotely. VDB-218186 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: SourceCodester
product: Online Food Ordering System
CVSS v3.1: version: 3.1
baseScore: 2.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: lucifoxer001 (VulDB User)
Published: 2023-01-12T21:20:59.100Z
CVE-2023-0259 WP Google Review Slider < 11.8 - Subscriber+ SQLi
The WP Google Review Slider WordPress plugin before 11.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber.
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: WP Google Review Slider
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-13T14:32:19.847Z
CVE-2023-0260 WP Review Slider < 12.2 - Subscriber+ SQLi
The WP Review Slider WordPress plugin before 12.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber.
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: WP Review Slider
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-13T14:32:12.713Z
CVE-2023-0261 WP TripAdvisor Review Slider < 10.8 - Subscriber+ SQLi
The WP TripAdvisor Review Slider WordPress plugin before 10.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber.
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: WP TripAdvisor Review Slider
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-13T14:32:10.388Z
CVE-2023-0262 WP Airbnb Review Slider < 3.3 - Subscriber+ SQLi
The WP Airbnb Review Slider WordPress plugin before 3.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber.
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: WP Airbnb Review Slider
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-13T14:32:28.589Z
CVE-2023-0263 WP Yelp Review Slider < 7.1 - Subscriber+ SQLi
The WP Yelp Review Slider WordPress plugin before 7.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber.
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: WP Yelp Review Slider
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-13T14:32:17.532Z
CVE-2023-0264 
A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the same realm could use that data to impersonate the victim and generate new session tokens. This issue could impact confidentiality, integrity, and availability.
Affected products: vendor: redhat.com
product: Keycloak
default_status: unaffected
Published: 2023-08-04T17:09:27.693Z
CVE-2023-0265 
Uvdesk version 1.1.1 allows an authenticated remote attacker to execute commands on the server. This is possible because the application does not properly validate profile pictures uploaded by customers.
Problem types: description: Insecure file upload
Affected products: vendor: n/a
product: Uvdesk
Published: 2023-04-04T00:00:00.000Z
CVE-2023-0266 Use after free in SNDRV_CTL_IOCTL_ELEM in Linux Kernel
A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. We recommend upgrading past commit 56b88b50565cd8b946a2d00b0c83927b7ebb055e
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: Linux
product: Linux Kernel
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 7.9
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H
version: 3.1
Published: 2023-01-30T13:09:32.141Z
CVE-2023-0267 Ultimate Carousel For WPBakery Page Builder <= 2.6 - Contributor+ Stored XSS
The Ultimate Carousel For WPBakery Page Builder WordPress plugin through 2.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Ultimate Carousel For WPBakery Page Builder
default_status: affected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-05-08T13:58:02.805Z
CVE-2023-0268 Mega Addons For WPBakery Page Builder < 4.3.0 - Contributor+ Stored XSS
The Mega Addons For WPBakery Page Builder WordPress plugin before 4.3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Mega Addons For WPBakery Page Builder
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-05-08T13:58:25.619Z
CVE-2023-0270 YaMaps for WordPress Plugin < 0.6.26 - Contributor+ Stored XSS
The YaMaps for WordPress Plugin WordPress plugin before 0.6.26 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: YaMaps for WordPress Plugin
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-13T14:32:02.489Z
CVE-2023-0271 WP Font Awesome < 1.7.9 - Contributor+ Stored XSS
The WP Font Awesome WordPress plugin before 1.7.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: WP Font Awesome
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-21T08:50:36.488Z
CVE-2023-0272 NEX-Forms < 8.3.3 - Contributor+ Stored XSS
The NEX-Forms WordPress plugin before 8.3.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: NEX-Forms
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-03-27T15:37:41.482Z
CVE-2023-0273 Custom Content Shortcode <= 4.0.2 - Contributor+ Stored XSS
The Custom Content Shortcode WordPress plugin through 4.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Custom Content Shortcode
default_status: affected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-03-20T15:52:21.047Z
CVE-2023-0274 URL Params < 2.5 - Contributor+ Stored XSS
The URL Params WordPress plugin before 2.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: URL Params
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-08-16T11:03:26.919Z
CVE-2023-0275 Easy Accept Payments for PayPal < 4.9.10 - Contributor+ Stored XSS
The Easy Accept Payments for PayPal WordPress plugin before 4.9.10 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Easy Accept Payments for PayPal
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-02-13T14:32:18.294Z
CVE-2023-0276 Weaver Xtreme Theme Support < 6.2.7 - Contributor+ Stored XSS
The Weaver Xtreme Theme Support WordPress plugin before 6.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Weaver Xtreme Theme Support
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-04-24T18:30:53.152Z
CVE-2023-0277 WC Fields Factory <= 4.1.5 - ShopManager+ SQLi
The WC Fields Factory WordPress plugin through 4.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: WC Fields Factory
default_status: affected
Credits: lang: en
value: Daniel Krohmer (Fraunhofer IESE)
lang: en
value: Kunal Sharma (University of Kaiserslautern)
lang: en
value: WPScan
Published: 2023-04-17T12:17:40.775Z
CVE-2023-0278 GeoDirectory < 2.2.24 - Admin+ SQLi
The GeoDirectory WordPress plugin before 2.2.24 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: GeoDirectory
default_status: unaffected
Credits: lang: en
value: Daniel Krohmer (Fraunhofer IESE)
lang: en
value: Kunal Sharma (University of Kaiserslautern)
lang: en
value: WPScan
Published: 2023-02-27T15:24:40.738Z
CVE-2023-0279 Media Library Assistant < 3.06 - Admin+ SQLi
The Media Library Assistant WordPress plugin before 3.06 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Media Library Assistant
default_status: unaffected
Credits: lang: en
value: Daniel Krohmer (Fraunhofer IESE)
lang: en
value: Kunal Sharma (University of Kaiserslautern)
lang: en
value: WPScan
Published: 2023-02-27T15:24:39.076Z
CVE-2023-0280 Ultimate Carousel For Elementor <= 2.1.7 - Contributor+ Stored XSS
The Ultimate Carousel For Elementor WordPress plugin through 2.1.7 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Ultimate Carousel For Elementor
default_status: affected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-05-08T13:58:17.650Z