rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-3748 Improper authorization that can lead to account impersonation
Improper Authorization vulnerability in ForgeRock Inc. Access Management allows Authentication Bypass. This issue affects Access Management: from 6.5.0 through 7.2.0.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: ForgeRock Inc.
product: Access Management
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-04-14T14:06:30.571Z
CVE-2022-3750 Ask Me < 6.8.7 - Post Deletion via CSRF
The  has a CSRF vulnerability that allows the deletion of a post without using a nonce or prompting for confirmation.
Problem types: description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Ask me
default_status: unaffected
Credits: lang: en
value: Srijan Adhikari
Published: 2022-11-21T00:00:00.000Z
CVE-2022-3751  SQL Injection in owncast/owncast
SQL Injection in GitHub repository owncast/owncast prior to 0.0.13.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command
Affected products: vendor: owncast
product: owncast/owncast
Published: 2022-11-29T00:00:00.000Z
CVE-2022-3752 Rockwell Automation GuardLogix and ControlLogix controllers Vulnerable to Denial-Of-Service Attack
An unauthorized user could use a specially crafted sequence of Ethernet/IP messages, combined with heavy traffic 
loading to cause a denial-of-service condition in Rockwell Automation Logix controllers resulting in a major non-recoverable fault. If the target device becomes unavailable, a user would have to clear the fault and redownload 
the user project file to bring the device back online and continue normal operation.



Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Rockwell Automation
product: CompactLogix 5480
default_status: unaffected
vendor: Rockwell Automation
product: ControlLogix 5580 
default_status: unaffected
vendor: Rockwell Automation
product: GuardLogix 5580
default_status: unaffected
vendor: Rockwell Automation
product: Compact GuardLogix 5380
default_status: unaffected
vendor: Rockwell Automation
product: CompactLogix 5380
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
version: 3.1
Published: 2022-12-19T22:23:36.836Z
CVE-2022-3753 Evaluate <= 1.0 - Admin+ Stored Cross-Site Scripting
The Evaluate WordPress plugin through 1.0 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Evaluate
default_status: affected
Credits: lang: en
value: Mariah Almotlag
Published: 2022-11-21T00:00:00.000Z
CVE-2022-3754 Weak Password Requirements in thorsten/phpmyfaq
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8.
Problem types: cwe_id: CWE-521
description: CWE-521 Weak Password Requirements
Affected products: vendor: thorsten
product: thorsten/phpmyfaq
Published: 2022-10-29T00:00:00.000Z
CVE-2022-3758 
An issue has been discovered in GitLab affecting all versions starting from 15.5 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. Due to improper permissions checks an unauthorised user was able to read, add or edit a users private snippet.
Problem types: description: Authorization bypass through user-controlled key in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
Credits: lang: en
value: Thanks [cryptopone](https://hackerone.com/cryptopone) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2023-03-09T00:00:00.000Z
CVE-2022-3759 
An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versions starting from 15.8 before 15.8.1. An attacker may upload a crafted CI job artifact zip file in a project that uses dynamic child pipelines and make a sidekiq job allocate a lot of memory. In GitLab instances where Sidekiq is memory-limited, this may cause Denial of Service.
Problem types: description: Uncontrolled resource consumption in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Thanks [luryus](https://hackerone.com/luryus) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2023-02-13T00:00:00.000Z
CVE-2022-3760 SQLi in Mia-Med
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mia Technology Mia-Med.

This issue affects Mia-Med: before 1.0.0.58.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Mia Technology
product: Mia-Med
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: 2023-03-07T08:37:30.992Z
CVE-2022-3761 
OpenVPN Connect versions before 3.4.0.4506 (macOS) and OpenVPN Connect before 3.4.0.3100 (Windows) allows man-in-the-middle attackers to intercept configuration profile download requests which contains the users credentials
Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: vendor: OpenVPN Inc
product: OpenVPN Connect
default_status: affected
Published: 2023-10-17T12:10:36.100Z
CVE-2022-3762 Booster for WooCommerce - ShopManager+ Arbitrary File Download
The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.5, Booster Elite for WooCommerce WordPress plugin before 1.1.7 do not validate files to download in some of its modules, which could allow ShopManager and Admin to download arbitrary files from the server even when they are not supposed to be able to (for example in multisite)
Problem types: description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Unknown
product: Booster for WooCommerce
default_status: unaffected
vendor: Unknown
product: Booster Plus for WooCommerce
default_status: unaffected
vendor: Unknown
product: Booster Elite for WooCommerce
default_status: unaffected
Credits: lang: en
value: WPScan
Published: 2022-11-21T00:00:00.000Z
CVE-2022-3763 Booster for WooCommerce - Checkout Files Deletion via CSRF
The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.5, Booster Elite for WooCommerce WordPress plugin before 1.1.7 do not have CSRF check in place when deleting files uploaded at the checkout, allowing attackers to make a logged in shop manager or admin delete them via a CSRF attack
Problem types: description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Booster for WooCommerce
default_status: unaffected
vendor: Unknown
product: Booster Plus for WooCommerce
default_status: unaffected
vendor: Unknown
product: Booster Elite for WooCommerce
default_status: unaffected
Credits: lang: en
value: WPScan
Published: 2022-11-21T00:00:00.000Z
CVE-2022-3764 Form Vibes < 1.4.5 - Admin+ SQLi
The plugin does not filter the "delete_entries" parameter from user requests, leading to an SQL Injection vulnerability.
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Form Vibes
default_status: unaffected
Credits: lang: en
value: Nguyen Duy Quoc Khanh
lang: en
value: WPScan
Published: 2024-01-16T15:50:50.054Z
CVE-2022-3765 Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.8.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: thorsten
product: thorsten/phpmyfaq
Published: 2022-10-31T00:00:00.000Z
CVE-2022-3766 Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq
Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.8.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: thorsten
product: thorsten/phpmyfaq
Published: 2022-10-31T00:00:00.000Z
CVE-2022-3767 
Missing validation in DAST analyzer affecting all versions from 1.11.0 prior to 3.0.32, allows custom request headers to be sent with every request, regardless of the host.
Problem types: description: Vulnerability in DAST
Affected products: vendor: GitLab
product: DAST
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 7.7
baseSeverity: HIGH
Credits: lang: en
value: This vulnerability has been discovered internally by the GitLab team
Published: 2023-03-09T00:00:00.000Z
CVE-2022-3768 WPSmartContracts < 1.3.12 - Author+ SQLi
The WPSmartContracts WordPress plugin before 1.3.12 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as author
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: WPSmartContracts
default_status: unaffected
Credits: lang: en
value: Kunal Sharma (University of Kaiserslautern)
lang: en
value: Daniel Krohmer (Fraunhofer IESE)
Published: 2022-11-28T13:47:07.347Z
CVE-2022-3769 OWM Weather < 5.6.9 - Contributor+ SQLi
The OWM Weather WordPress plugin before 5.6.9 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as contributor
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: OWM Weather
default_status: unaffected
Credits: lang: en
value: Kunal Sharma (University of Kaiserslautern)
lang: en
value: Daniel Krohmer (Fraunhofer IESE)
Published: 2022-11-28T13:47:08.267Z
CVE-2022-3770 Yunjing CMS upload_img.html unrestricted upload
A vulnerability classified as critical was found in Yunjing CMS. This vulnerability affects unknown code of the file /index/user/upload_img.html. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212500.
Problem types: cwe_id: CWE-266
description: CWE-266 Incorrect Privilege Assignment -> CWE-284 Improper Access Controls -> CWE-434 Unrestricted Upload
Affected products: vendor: Yunjing
product: CMS
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
Published: 2022-10-31T00:00:00.000Z
CVE-2022-3771 easyii CMS File Upload Management Upload.php file unrestricted upload
A vulnerability, which was classified as critical, has been found in easyii CMS. This issue affects the function file of the file helpers/Upload.php of the component File Upload Management. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The identifier VDB-212501 was assigned to this vulnerability.
Problem types: cwe_id: CWE-266
description: CWE-266 Incorrect Privilege Assignment -> CWE-284 Improper Access Controls -> CWE-434 Unrestricted Upload
Affected products: vendor: easyii
product: CMS
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
Published: 2022-10-31T00:00:00.000Z
CVE-2022-3774 SourceCodester Train Scheduler App resource injection
A vulnerability was found in SourceCodester Train Scheduler App 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /train_scheduler_app/?action=delete. The manipulation of the argument id leads to improper control of resource identifiers. The attack may be launched remotely. The identifier of this vulnerability is VDB-212504.
Problem types: cwe_id: CWE-99
description: CWE-99 Improper Control of Resource Identifiers
Affected products: vendor: SourceCodester
product: Train Scheduler App
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 5.4
baseSeverity: MEDIUM
Published: 2022-10-31T00:00:00.000Z
CVE-2022-3775 
When rendering certain unicode sequences, grub2's font code doesn't proper validate if the informed glyph's width and height is constrained within bitmap size. As consequence an attacker can craft an input which will lead to a out-of-bounds write into grub2's heap, leading to memory corruption and availability issues. Although complex, arbitrary code execution could not be discarded.
Problem types: cwe_id: CWE-787
description: CWE-787
Affected products: vendor: n/a
product: grub2
Published: 2022-12-19T00:00:00.000Z
CVE-2022-3776 Restaurant Menu – Food Ordering System – Table Reservation <= 2.3.1 - Cross-Site Request Forgery
The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.1. This is due to missing or incorrect nonce validation on several functions called via AJAX actions such as forms_action, set_option, & chosen_options to name a few . This makes it possible for unauthenticated attackers to perform a variety of administrative actions like modifying forms, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: gloriafood
product: Restaurant Menu – Food Ordering System – Table Reservation
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: ptsfence
Published: 2022-11-03T16:30:34.559Z
CVE-2022-3780 
Database connections on deleted users could stay active on MySQL data sources in Remote Desktop Manager 2022.3.7 and below which allow deleted users to access unauthorized data. 

This issue affects : 
Remote Desktop Manager 2022.3.7 and prior versions.


Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Devolutions
product: Remote Desktop Manager
default_status: unaffected
Published: 2022-11-01T18:22:29.174Z
CVE-2022-3781 
Dashlane password and Keepass Server password in My Account Settings  are not encrypted in the database in Devolutions Remote Desktop Manager 2022.2.26 and prior versions and Devolutions Server 2022.3.1 and prior versions which allows database users to read the data.

This issue affects : 
Remote Desktop Manager 2022.2.26 and prior versions.

Devolutions Server 2022.3.1 and prior versions.



Problem types: cwe_id: CWE-311
description: CWE-311 Missing Encryption of Sensitive Data
Affected products: vendor: Devolutions
product: Remote Desktop Manager
default_status: unaffected
vendor: Devolutions
product: Devolutions Server
default_status: unaffected
Published: 2022-11-01T18:28:28.590Z
CVE-2022-3782 
keycloak: path traversal via double URL encoding. A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain or possibly conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field.
Problem types: description: n/a
Affected products: vendor: redhat.com
product: Keycloak
default_status: unaffected
Published: 2023-01-11T16:58:10.434Z
CVE-2022-3783 node-red-dashboard ui_text Format ui-component-ctrl.js cross site scripting
A vulnerability, which was classified as problematic, has been found in node-red-dashboard. This issue affects some unknown processing of the file components/ui-component/ui-component-ctrl.js of the component ui_text Format Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The name of the patch is 9305d1a82f19b235dfad24a7d1dd4ed244db7743. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-212555.
Problem types: cwe_id: CWE-707
description: CWE-707 Improper Neutralization -> CWE-74 Injection -> CWE-79 Cross Site Scripting
Affected products: vendor: unspecified
product: node-red-dashboard
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
Published: 2022-10-31T00:00:00.000Z
CVE-2022-3784 Axiomatic Bento4 mp4hls Ap4Mp4AudioInfo.cpp ReadBits heap-based overflow
A vulnerability classified as critical was found in Axiomatic Bento4 5e7bb34. Affected by this vulnerability is the function AP4_Mp4AudioDsiParser::ReadBits of the file Ap4Mp4AudioInfo.cpp of the component mp4hls. The manipulation leads to heap-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212563.
Problem types: cwe_id: CWE-119
description: CWE-119 Memory Corruption -> CWE-122 Heap-based Buffer Overflow
Affected products: vendor: Axiomatic
product: Bento4
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
Published: 2022-10-31T00:00:00.000Z
CVE-2022-3785 Axiomatic Bento4 Avcinfo SetDataSize heap-based overflow
A vulnerability, which was classified as critical, has been found in Axiomatic Bento4. Affected by this issue is the function AP4_DataBuffer::SetDataSize of the component Avcinfo. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212564.
Problem types: cwe_id: CWE-119
description: CWE-119 Memory Corruption -> CWE-122 Heap-based Buffer Overflow
Affected products: vendor: Axiomatic
product: Bento4
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
Published: 2022-10-31T00:00:00.000Z
CVE-2022-3786 X.509 Email Address Variable Length Buffer Overflow
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.


Problem types: description: Buffer overflow
Affected products: vendor: OpenSSL
product: OpenSSL
default_status: unaffected
Credits: lang: en
value: Viktor Dukhovni
Published: 2022-11-01T00:00:00.000Z
CVE-2022-3787 
A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users to obtain root access, exploited alone or in conjunction with CVE-2022-41973. Local users that are able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This issue occurs because an attacker can repeat a keyword, which is mishandled when arithmetic ADD is used instead of bitwise OR. This could lead to local privilege escalation to root.
Problem types: cwe_id: CWE-285
description: CWE-285
Affected products: vendor: n/a
product: device-mapper-multipath
Published: 2023-03-29T00:00:00.000Z
CVE-2022-3789 Tim Campus Confession Wall share.php sql injection
A vulnerability has been found in Tim Campus Confession Wall and classified as critical. Affected by this vulnerability is an unknown functionality of the file share.php. The manipulation of the argument post_id leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212611.
Problem types: cwe_id: CWE-707
description: CWE-707 Improper Neutralization -> CWE-74 Injection -> CWE-89 SQL Injection
Affected products: vendor: Tim Campus
product: Confession Wall
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
attackVector: ADJACENT_NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 5.5
baseSeverity: MEDIUM
Published: 2022-11-01T00:00:00.000Z