rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-47946 
An issue was discovered in the Linux kernel 5.10.x before 5.10.155. A use-after-free in io_sqpoll_wait_sq in fs/io_uring.c allows an attacker to crash the kernel, resulting in denial of service. finish_wait can be skipped. An attack can occur in some situations by forking a process and then quickly terminating it. NOTE: later kernel versions, such as the 5.15 longterm series, substantially changed the implementation of io_sqpoll_wait_sq.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-23T00:00:00.000Z
CVE-2022-47949 
The Nintendo NetworkBuffer class, as used in Animal Crossing: New Horizons before 2.0.6 and other products, allows remote attackers to execute arbitrary code via a large UDP packet that causes a buffer overflow, aka ENLBufferPwn. The victim must join a game session with the attacker. Other affected products include Mario Kart 7 before 1.2, Mario Kart 8, Mario Kart 8 Deluxe before 2.1.0, ARMS before 5.4.1, Splatoon, Splatoon 2 before 5.5.1, Splatoon 3 before late 2022, Super Mario Maker 2 before 3.0.2, and Nintendo Switch Sports before late 2022.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
Published: 2022-12-24T00:00:00.000Z
CVE-2022-47950 
An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read access to potentially sensitive data. This impacts both s3api deployments (Rocky or later), and swift3 deployments (Queens and earlier, no longer actively developed).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-18T00:00:00.000Z
CVE-2022-47951 
An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-26T00:00:00.000Z
CVE-2022-47952 
lxc-user-nic in lxc through 5.0.1 is installed setuid root, and may allow local users to infer whether any file exists, even within a protected directory tree, because "Failed to open" often indicates that a file does not exist, whereas "does not refer to a network namespace path" often indicates that a file exists. NOTE: this is different from CVE-2018-6556 because the CVE-2018-6556 fix design was based on the premise that "we will report back to the user that the open() failed but the user has no way of knowing why it failed"; however, in many realistic cases, there are no plausible reasons for failing except that the file does not exist.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-01T00:00:00.000Z
CVE-2022-47965 
The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13. An app may be able to execute arbitrary code with kernel privileges.
Problem types: description: An app may be able to execute arbitrary code with kernel privileges
Affected products: vendor: Apple
product: macOS
Published: 2024-01-10T22:03:10.131Z
CVE-2022-47966 
Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects Access Manager Plus before 4308, Active Directory 360 before 4310, ADAudit Plus before 7081, ADManager Plus before 7162, ADSelfService Plus before 6211, Analytics Plus before 5150, Application Control Plus before 10.1.2220.18, Asset Explorer before 6983, Browser Security Plus before 11.1.2238.6, Device Control Plus before 10.1.2220.18, Endpoint Central before 10.1.2228.11, Endpoint Central MSP before 10.1.2228.11, Endpoint DLP before 10.1.2137.6, Key Manager Plus before 6401, OS Deployer before 1.1.2243.1, PAM 360 before 5713, Password Manager Pro before 12124, Patch Manager Plus before 10.1.2220.18, Remote Access Plus before 10.1.2228.11, Remote Monitoring and Management (RMM) before 10.1.41. ServiceDesk Plus before 14004, ServiceDesk Plus MSP before 13001, SupportCenter Plus before 11026, and Vulnerability Manager Plus before 10.1.2220.18. Exploitation is only possible if SAML SSO has ever been configured for a product (for some products, exploitation requires that SAML SSO is currently active).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-18T00:00:00.000Z
CVE-2022-47967 
A vulnerability has been identified in Solid Edge (All versions < V2023 MP1). The DOCMGMT.DLL contains a memory corruption vulnerability that could be triggered while parsing files in different file formats such as PAR, ASM, DFT. This could allow an attacker to execute code in the context of the current process.
Problem types: cwe_id: CWE-119
description: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: Siemens
product: Solid Edge
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
baseScore: 7.8
baseSeverity: HIGH
Published: 2023-01-10T11:39:48.279Z
CVE-2022-47968 
Heimdall Application Dashboard through 2.5.4 allows reflected and stored XSS via "Application name" to the "Add application" page. The stored XSS will be triggered in the "Application list" page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-27T00:00:00.000Z
CVE-2022-47974 
The Bluetooth AVRCP module has a vulnerability that can lead to DoS attacks.Successful exploitation of this vulnerability may cause the Bluetooth process to restart.
Problem types: description: DoS attack vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2023-01-06T00:00:00.000Z
CVE-2022-47975 
The DUBAI module has a double free vulnerability. Successful exploitation of this vulnerability may affect system availability.
Problem types: description: Double free vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2023-01-06T00:00:00.000Z
CVE-2022-47976 
The DMSDP module of the distributed hardware has a vulnerability that may cause imposter control connections.Successful exploitation of this vulnerability may disconnect normal service connections.
Problem types: description: Control connection replacement vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2023-01-06T00:00:00.000Z
CVE-2022-47977 
A vulnerability has been identified in JT Open (All versions < V11.2.3.0), JT Utilities (All versions < V13.2.3.0). The affected application contains a memory corruption vulnerability while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process.
Problem types: cwe_id: CWE-119
description: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: Siemens
product: JT Open
default_status: unknown
vendor: Siemens
product: JT Utilities
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
baseScore: 7.8
baseSeverity: HIGH
Published: 2023-02-14T10:36:22.513Z
CVE-2022-47983 IBM InfoSphere Information Server cross-site scripting
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  243161.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: IBM
product: InfoSphere Information Server
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2023-02-01T17:42:12.571Z
CVE-2022-47984 IBM InfoSphere Information Server SQL injection
IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.  IBM X-Force ID:  243163.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: IBM
product: InfoSphere Information Server
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2023-05-19T15:56:37.237Z
CVE-2022-47986 IBM Aspera Faspex code execution
IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: IBM
product: Aspera Faspex
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-02-17T15:46:04.120Z
CVE-2022-47990 IBM AIX denial of service

IBM AIX 7.1, 7.2, 7.3 and VIOS , 3.1 could allow a non-privileged local user to exploit a vulnerability in X11 to cause a buffer overflow that could result in a denial of service or arbitrary code execution. IBM X-Force ID: 243556.

 
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: IBM
product: AIX
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.2
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2023-01-18T18:19:12.270Z
CVE-2022-48006 
An arbitrary file upload vulnerability in taocms v3.0.2 allows attackers to execute arbitrary code via a crafted PHP file. This vulnerability is exploited via manipulation of the upext variable at /include/Model/Upload.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-30T00:00:00.000Z
CVE-2022-48007 
A stored cross-site scripting (XSS) vulnerability in identification.php of Piwigo v13.4.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the User-Agent.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-27T00:00:00.000Z
CVE-2022-48008 
An arbitrary file upload vulnerability in the plugin manager of LimeSurvey v5.4.15 allows attackers to execute arbitrary code via a crafted PHP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-27T00:00:00.000Z
CVE-2022-48010 
LimeSurvey v5.4.15 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /index.php/surveyAdministration/rendersidemenulink?subaction=surveytexts. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description or Welcome-message text fields. NOTE: the vendor indicates that this is not a vulnerability because the manipulation requires Superadministrator privileges, and Superadministrators are already allowed to customize surveys with JavaScript as they wish.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-27T00:00:00.000Z
CVE-2022-48011 
Opencats v0.9.7 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-27T00:00:00.000Z
CVE-2022-48012 
Opencats v0.9.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /opencats/index.php?m=settings&a=ajax_tags_upd.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-27T00:00:00.000Z
CVE-2022-48013 
Opencats v0.9.7 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /opencats/index.php?m=calendar. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description or Title text fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-27T00:00:00.000Z
CVE-2022-48019 
The components wfshbr64.sys and wfshbr32.sys in Another Eden before v3.0.20 and before v2.14.200 allows attackers to perform privilege escalation via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-06T00:00:00.000Z
CVE-2022-48020 
Vinteo VCC v2.36.4 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the conference parameter. This vulnerability allows attackers to inject arbitrary code which will be executed by the victim user's browser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-12T00:00:00.000Z
CVE-2022-48021 
A vulnerability in Zammad v5.3.0 allows attackers to execute arbitrary code or escalate privileges via a crafted message sent to the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2022-48022 
An issue in the component /api/v1/mentions of Zammad v5.3.0 allows authenticated attackers with agent permissions to view information about tickets they are not authorized to see.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2022-48023 
Insufficient privilege verification in Zammad v5.3.0 allows an authenticated attacker to perform changes on the tags of their customer tickets using the Zammad API. This is now corrected in v5.3.1 so that only agents with write permissions may change ticket tags.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2022-48063 
GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function load_separate_debug_files at dwarf2.c. The attacker could supply a crafted ELF file and cause a DNS attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-22T00:00:00.000Z
CVE-2022-48064 
GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function bfd_dwarf2_find_nearest_line_with_alt at dwarf2.c. The attacker could supply a crafted ELF file and cause a DNS attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-22T00:00:00.000Z
CVE-2022-48065 
GNU Binutils before 2.40 was discovered to contain a memory leak vulnerability var the function find_abstract_instance in dwarf2.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-22T00:00:00.000Z
CVE-2022-48066 
An issue in the component global.so of Totolink A830R V4.1.2cu.5182 allows attackers to bypass authentication via a crafted cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-27T00:00:00.000Z
CVE-2022-48067 
An information disclosure vulnerability in Totolink A830R V4.1.2cu.5182 allows attackers to obtain the root password via a brute-force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-27T00:00:00.000Z
CVE-2022-48069 
Totolink A830R V4.1.2cu.5182 was discovered to contain a command injection vulnerability via the QUERY_STRING parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-27T00:00:00.000Z
CVE-2022-48070 
Phicomm K2 v22.6.534.263 was discovered to contain a command injection vulnerability via the autoUpTime parameter in the automatic upgrade function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-27T00:00:00.000Z
CVE-2022-48071 
Phicomm K2 v22.6.534.263 was discovered to store the root and admin passwords in plaintext.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-27T00:00:00.000Z
CVE-2022-48072 
Phicomm K2G v22.6.3.20 was discovered to contain a command injection vulnerability via the autoUpTime parameter in the automatic upgrade function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-27T00:00:00.000Z
CVE-2022-48073 
Phicomm K2G v22.6.3.20 was discovered to store the root and admin passwords in plaintext.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-27T00:00:00.000Z
CVE-2022-48074 
An issue in NoMachine before v8.2.3 allows attackers to execute arbitrary commands via a crafted .nxs file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2022-48077 
Genymotion Desktop v3.3.2 was discovered to contain a DLL hijacking vulnerability that allows attackers to escalate privileges and execute arbitrary code via a crafted DLL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-13T00:00:00.000Z
CVE-2022-48078 
pycdc commit 44a730f3a889503014fec94ae6e62d8401cb75e5 was discovered to contain a stack overflow via the component ASTree.cpp:BuildFromCode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-06T00:00:00.000Z
CVE-2022-48079 
Monnai aaPanel host system v1.5 contains an access control issue which allows attackers to escalate privileges and execute arbitrary code via uploading a crafted PHP file to the virtual host directory of the system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-02T00:00:00.000Z
CVE-2022-48082 
Easyone CRM v5.50.02 was discovered to contain a SQL Injection vulnerability via the text parameter at /Services/Misc.asmx/SearchTag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-02T00:00:00.000Z
CVE-2022-48085 
Softr v2.0 was discovered to contain a HTML injection vulnerability via the Work Space Name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-06T00:00:00.000Z
CVE-2022-48090 
Tramyardg hotel-mgmt-system version 2022.4 is vulnerable to SQL Injection via /app/dao/CustomerDAO.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-13T00:00:00.000Z
CVE-2022-48091 
Tramyardg hotel-mgmt-system version 2022.4 is vulnerable to Cross Site Scripting (XSS) via process_update_profile.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-13T00:00:00.000Z
CVE-2022-48093 
Seacms v12.7 was discovered to contain a remote code execution (RCE) vulnerability via the ip parameter at admin_ ip.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-01T00:00:00.000Z
CVE-2022-48094 
lmxcms v1.41 was discovered to contain an arbitrary file read vulnerability via TemplateAction.class.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-01T00:00:00.000Z
CVE-2022-48107 
D-Link DIR_878_FW1.30B08 was discovered to contain a command injection vulnerability via the component /setnetworksettings/IPAddress. This vulnerability allows attackers to escalate privileges to root via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-27T00:00:00.000Z
CVE-2022-48108 
D-Link DIR_878_FW1.30B08 was discovered to contain a command injection vulnerability via the component /SetNetworkSettings/SubnetMask. This vulnerability allows attackers to escalate privileges to root via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-27T00:00:00.000Z
CVE-2022-48110 
CKSource CKEditor 5 35.4.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Full Featured CKEditor5 widget. NOTE: the vendor's position is that this is not a vulnerability. The CKEditor 5 documentation discusses that it is the responsibility of an integrator (who is adding CKEditor 5 functionality to a website) to choose the correct security settings for their use case. Also, safe default values are established (e.g., config.htmlEmbed.showPreviews is false).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-13T00:00:00.000Z
CVE-2022-48111 
A cross-site scripting (XSS) vulnerability in the check_login function of SIPE s.r.l WI400 between version 8 and 11 included allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the f parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-10T00:00:00.000Z
CVE-2022-48113 
A vulnerability in TOTOLINK N200RE_v5 firmware V9.3.5u.6139 allows unauthenticated attackers to access the telnet service via a crafted POST request. Attackers are also able to leverage this vulnerability to login as root via hardcoded credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-02T00:00:00.000Z
CVE-2022-48114 
RuoYi up to v4.7.5 was discovered to contain a SQL injection vulnerability via the component /tool/gen/createTable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-02T00:00:00.000Z
CVE-2022-48115 
The dropdown menu in jspreadsheet before v4.6.0 was discovered to be vulnerable to cross-site scripting (XSS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-17T00:00:00.000Z
CVE-2022-48116 
AyaCMS v3.1.2 was discovered to contain a remote code execution (RCE) vulnerability via the component /admin/tpl_edit.inc.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-27T00:00:00.000Z
CVE-2022-48118 
Jorani v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Acronym parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-27T00:00:00.000Z