rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-1523 Fuji Electric D300win Write-what-where condition
Fuji Electric D300win prior to version 3.7.1.17 is vulnerable to a write-what-where condition, which could allow an attacker to overwrite program memory to manipulate the flow of information.
Problem types: cwe_id: CWE-123
description: CWE-123 Write-what-where Condition
Affected products: vendor: Fuji Electric
product: D300win
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
Credits: lang: en
value: Uri Katz from Claroty reported these vulnerabilities to CISA.
Published: 2022-10-19T17:24:35.098Z
CVE-2022-1524 3.2.5    CLEARTEXT TRANSMISSION OF SENSITIVE INFORMATION CWE-319
LRM version 2.4 and lower does not implement TLS encryption. A malicious actor can MITM attack sensitive data in-transit, including credentials.
Problem types: cwe_id: CWE-319
description: CWE-319 Cleartext Transmission of Sensitive Information
Affected products: vendor: Illumina
product: NextSeq 550Dx
vendor: Illumina
product: MiSeq Dx
vendor: Illumina
product: NextSeq 500 Instrument
vendor: Illumina
product: NextSeq 550 Instrument
vendor: Illumina
product: MiSeq Instrument
vendor: Illumina
product: iSeq 100 Instrument
vendor: Illumina
product: MiniSeq Instrument
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Published: 2022-06-24T15:00:16.330Z
CVE-2022-1525 Cognex 3D-A1000 Dimensioning System Client-Side Enforcement of Server-Side Security
The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 (3354) and prior is vulnerable to CWE-602: Client-Side Enforcement of Server-Side Security, which could allow attackers to bypass web access controls by inspecting and modifying the source code of password protected web elements.
Problem types: cwe_id: CWE-602
description: CWE-602 Client-Side Enforcement of Server-Side Security
Affected products: vendor: Cognex
product: 3D-A1000 Dimensioning System
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Tri Quach, Shanil Prasad, Brandon Park, and Nishith Sinha reported these vulnerabilities to CISA.
Published: 2022-09-06T22:19:13.000Z
CVE-2022-1526 Emlog Pro POST Parameter cross site scripting
A vulnerability, which was classified as problematic, was found in Emlog Pro up to 1.2.2. This affects the POST parameter handling of articles. The manipulation with the input <script>alert(1);</script> leads to cross site scripting. It is possible to initiate the attack remotely but it requires a signup and login by the attacker. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: unspecified
product: Emlog Pro
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Published: 2022-04-29T07:40:10.000Z
CVE-2022-1527 WP 2FA < 2.2.1 - Reflected Cross-Site Scripting
The WP 2FA WordPress plugin before 2.2.1 does not sanitise and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WP 2FA – Two-factor authentication for WordPress
Credits: lang: en
value: Utkarsh Agrawal
Published: 2022-05-30T08:35:48.000Z
CVE-2022-1528 VikBooking < 1.5.9 - Reflected Cross-Site Scripting
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.9 does not escape the current URL before putting it back in a JavaScript context, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: VikBooking Hotel Booking Engine & PMS
Credits: lang: en
value: Bruno Halltari
Published: 2022-05-30T08:35:50.000Z
CVE-2022-1529 
An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScript object, leading to prototype pollution and ultimately attacker-controlled JavaScript executing in the privileged parent process. This vulnerability affects Firefox ESR < 91.9.1, Firefox < 100.0.2, Firefox for Android < 100.3.0, and Thunderbird < 91.9.1.
Problem types: description: Untrusted input used in JavaScript object indexing, leading to prototype pollution
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox for Android
vendor: Mozilla
product: Thunderbird
Published: 2022-12-22T00:00:00.000Z
CVE-2022-1530 Cross-site Scripting (XSS) in livehelperchat/livehelperchat
Cross-site Scripting (XSS) in GitHub repository livehelperchat/livehelperchat prior to 3.99v. The attacker can execute malicious JavaScript on the application.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: livehelperchat
product: livehelperchat/livehelperchat
Published: 2022-04-29T08:50:10.000Z
CVE-2022-1531 SQL injection vulnerability in ARAX-UI Synonym Lookup functionality in rtxteam/rtx
SQL injection vulnerability in ARAX-UI Synonym Lookup functionality in GitHub repository rtxteam/rtx prior to checkpoint_2022-04-20 . This vulnerability is critical as it can lead to remote code execution and thus complete server takeover.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command
Affected products: vendor: rtxteam
product: rtxteam/rtx
Published: 2022-04-29T09:10:10.000Z
CVE-2022-1532 Themify - WooCommerce Product Filter < 1.3.8 - Reflected Cross-Site Scripting
Themify WordPress plugin before 1.3.8 does not sanitise and escape the page parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Themify – WooCommerce Product Filter
Credits: lang: en
value: Utkarsh Agrawal
Published: 2022-06-13T12:41:54.000Z
CVE-2022-1533 Buffer Over-read in bfabiszewski/libmobi
Buffer Over-read in GitHub repository bfabiszewski/libmobi prior to 0.11. This vulnerability is capable of arbitrary code execution.
Problem types: cwe_id: CWE-126
description: CWE-126 Buffer Over-read
Affected products: vendor: bfabiszewski
product: bfabiszewski/libmobi
Published: 2022-04-29T10:15:20.000Z
CVE-2022-1534 Buffer Over-read at parse_rawml.c:1416 in bfabiszewski/libmobi
Buffer Over-read at parse_rawml.c:1416 in GitHub repository bfabiszewski/libmobi prior to 0.11. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.
Problem types: cwe_id: CWE-126
description: CWE-126 Buffer Over-read
Affected products: vendor: bfabiszewski
product: bfabiszewski/libmobi
Published: 2022-04-29T10:15:14.000Z
CVE-2022-1536 automad Dashboard cross site scripting
A vulnerability has been found in automad up to 1.10.9 and classified as problematic. This vulnerability affects the Dashboard. The manipulation of the argument title with the input Home</title><script>alert("home")</script><title> leads to a cross site scripting. The attack can be initiated remotely but requires an authentication. The exploit details have disclosed to the public and may be used.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: unspecified
product: automad
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Published: 2022-04-29T13:10:12.000Z
CVE-2022-1537 file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in gruntjs/grunt
file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.
Problem types: cwe_id: CWE-367
description: CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
Affected products: vendor: gruntjs
product: gruntjs/grunt
Published: 2022-05-10T00:00:00.000Z
CVE-2022-1538 Theme-Demo-Importer < 1.1.1 - Admin+ Arbitrary File Upload
Theme Demo Import WordPress plugin before 1.1.1 does not validate the imported file, allowing high-privilege users such as admin to upload arbitrary files (such as PHP) even when FILE_MODS and FILE_EDIT are disallowed.
Problem types: description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Unknown
product: Theme Demo Import
default_status: unaffected
Credits: lang: en
value: ccltt1201
lang: en
value: WPScan
Published: 2024-01-16T15:50:34.551Z
CVE-2022-1539 Exports and Reports < 0.9.2 - Contributor+ CSV Injection
The Exports and Reports WordPress plugin before 0.9.2 does not sanitize and validate data when generating the CSV to export, which could lead to a CSV injection, by the use of Microsoft Excel DDE function, or to leak data via maliciously injected hyperlinks.
Problem types: cwe_id: CWE-1236
description: CWE-1236 Improper Neutralization of Formula Elements in a CSV File
Affected products: vendor: Unknown
product: Exports and Reports
Credits: lang: en
value: websafe2021
Published: 2022-07-25T12:46:03.000Z
CVE-2022-1540 PostmagThemes Demo <= 1.0.7 - Admin+ Arbitrary File Upload
The PostmagThemes Demo Import WordPress plugin through 1.0.7 does not validate the imported file, allowing high-privilege users such as admin to upload arbitrary files (such as PHP) leading to RCE.
Problem types: description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Unknown
product: PostmagThemes Demo Import
default_status: affected
Credits: lang: en
value: thunder.god.hhh@gmail.com
Published: 2022-12-05T16:50:37.267Z
CVE-2022-1541 Video Slider - Slider Carousel < 1.4.8 - Admin+ Stored Cross-Site Scripting
The Video Slider WordPress plugin before 1.4.8 does not sanitize or escape some of its video settings, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Video Slider – Slider Carousel
Credits: lang: en
value: Fayçal CHENA
Published: 2022-06-06T08:51:05.000Z
CVE-2022-1542 HPB Dashboard <= 1.3.1 - Admin+ Stored Cross Site Scripting
The HPB Dashboard WordPress plugin through 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: hpb Dashboard
Credits: lang: en
value: Vinay Varma Mudunuri
lang: en
value: Krishna Harsha Kondaveeti
Published: 2022-05-30T08:35:51.000Z
CVE-2022-1543 Improper handling of Length parameter in erudika/scoold
Improper handling of Length parameter in GitHub repository erudika/scoold prior to 1.49.4. When the text size is large enough the service results in a momentary outage in a production environment. That can lead to memory corruption on the server.
Problem types: cwe_id: CWE-130
description: CWE-130 Improper Handling of Length Parameter Inconsistency
Affected products: vendor: erudika
product: erudika/scoold
Published: 2022-04-29T18:10:09.000Z
CVE-2022-1544 Formula Injection/CSV Injection due to Improper Neutralization of  Formula Elements  in CSV File in luyadev/yii-helpers
Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File in GitHub repository luyadev/yii-helpers prior to 1.2.1. Successful exploitation can lead to impacts such as client-sided command injection, code execution, or remote ex-filtration of contained confidential data.
Problem types: cwe_id: CWE-1236
description: CWE-1236 Improper Neutralization of Formula Elements in a CSV File
Affected products: vendor: luyadev
product: luyadev/yii-helpers
Published: 2022-05-01T11:45:12.000Z
CVE-2022-1545 
It was possible to disclose details of confidential notes created via the API in Gitlab CE/EE affecting all versions from 13.2 prior to 14.8.6, 14.9 prior to 14.9.4, and 14.10 prior to 14.10.1 if an unauthorised project member was tagged in the note.
Problem types: description: Improper authorization in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: This vulnerability has been discovered internally by the GitLab team
Published: 2022-05-11T14:25:17.000Z
CVE-2022-1546 WooCommerce - Product Importer <= 1.5.2 - Reflected Cross-Site Scripting
The WooCommerce - Product Importer WordPress plugin through 1.5.2 does not sanitise and escape the imported data before outputting it back in the page, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WooCommerce – Product Importer
Credits: lang: en
value: Benachi
Published: 2022-07-11T12:55:51.000Z
CVE-2022-1547 Check & Log email < 1.0.6 - Reflected Cross-Site Scripting
The Check & Log Email WordPress plugin before 1.0.6 does not sanitise and escape a parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Check & Log Email
Credits: lang: en
value: 7coo and JrXnm
Published: 2022-05-23T07:15:35.000Z
CVE-2022-1548 Playbook members are allowed to escalate their membership privileges and perform actions restricted to playbook admins.
Mattermost Playbooks plugin 1.25 and earlier fails to properly restrict user-level permissions, which allows playbook members to escalate their membership privileges and perform actions restricted to playbook admins.
Problem types: cwe_id: CWE-264
description: CWE-264 Permissions, Privileges, and Access Controls
Affected products: vendor: Mattermost
product: Mattermost Playbooks
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.7
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Thanks to Rohitesh Gupta for contributing to this improvement under the Mattermost responsible disclosure policy.
Published: 2022-05-03T20:11:21.000Z
CVE-2022-1549 WP Athletics <= 1.1.7 - Subscriber+ Stored Cross-Site Scripting
The WP Athletics WordPress plugin through 1.1.7 does not sanitize parameters before storing them in the database, nor does it escape the values when outputting them back in the admin dashboard, leading to a Stored Cross-Site Scripting vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WP Athletics
Credits: lang: en
value: Wejdan Alomari
Published: 2022-06-13T12:41:56.000Z
CVE-2022-1551 SP Project & Document Manager < 4.58 - Sensitive File Disclosure
The SP Project & Document Manager WordPress plugin before 4.58 uses an easily guessable path to store user files, bad actors could use that to access other users' sensitive files.
Problem types: description: CWE-425 Direct Request ('Forced Browsing')
Affected products: vendor: Unknown
product: SP Project & Document Manager
default_status: unaffected
Credits: lang: en
value: Viktor Markopoulos
lang: en
value: WPScan
Published: 2022-07-25T12:46:15.000Z
CVE-2022-1552 
A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pg_amcheck commands activated relevant protections too late or not at all during the process. This flaw allows an attacker with permission to create non-temporary objects in at least one schema to execute arbitrary SQL functions under a superuser identity.
Problem types: cwe_id: CWE-459
description: CWE-459- Incomplete Cleanup, CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection').
Affected products: vendor: n/a
product: postgresql
Published: 2022-08-31T00:00:00.000Z
CVE-2022-1553 Leaking password protected articles content due to improper access control in publify/publify
Leaking password protected articles content due to improper access control in GitHub repository publify/publify prior to 9.2.8. Attackers can leverage this vulnerability to view the contents of any password-protected article present on the publify website, compromising confidentiality and integrity of users.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: publify
product: publify/publify
Published: 2022-05-16T14:31:58.000Z
CVE-2022-1554 Path Traversal due to `send_file` call in clinical-genomics/scout
Path Traversal due to `send_file` call in GitHub repository clinical-genomics/scout prior to 4.52.
Problem types: cwe_id: CWE-36
description: CWE-36 Absolute Path Traversal
Affected products: vendor: clinical-genomics
product: clinical-genomics/scout
Published: 2022-05-03T08:20:09.000Z
CVE-2022-1555 DOM XSS in microweber ver 1.2.15  in microweber/microweber
DOM XSS in microweber ver 1.2.15 in GitHub repository microweber/microweber prior to 1.2.16. inject arbitrary js code, deface website, steal cookie...
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: microweber
product: microweber/microweber
Published: 2022-05-04T08:30:12.000Z
CVE-2022-1556 StaffList < 3.1.5 - Admin+ SQLi
The StaffList WordPress plugin before 3.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement when searching for Staff in the admin dashboard, leading to an SQL Injection
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: StaffList
Credits: lang: en
value: Hassan Khan Yusufzai
Published: 2022-05-30T08:35:52.000Z
CVE-2022-1557 ULeak Security & Monitoring <= 1.2.3 - Subscriber+ Stored Cross-Site Scripting
The ULeak Security & Monitoring WordPress plugin through 1.2.3 does not have authorisation and CSRF checks when updating its settings, and is also lacking sanitisation as well as escaping in some of them, which could allow any authenticated users such as subscriber to perform Stored Cross-Site Scripting attacks against admins viewing the settings
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: ULeak Security & Monitoring Plugin
Credits: lang: en
value: Hassan Khan Yusufzai - Splint3r7
Published: 2022-05-16T14:31:11.000Z
CVE-2022-1558 Curtain <= 1.0.2 - Admin+ Stored Cross-Site Scripting
The Curtain WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Curtain
Credits: lang: en
value: Hassan Khan Yusufzai
Published: 2022-05-23T07:15:37.000Z
CVE-2022-1559 Clipr <= 1.2.3 - Admin+ Stored Cross-Site Scripting
The Clipr WordPress plugin through 1.2.3 does not sanitise and escape its API Key settings before outputting it in an attribute, leading to a Stored Cross-Site Scripting issue even when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Clipr
Credits: lang: en
value: Hassan Khan Yusufzai - Splint3r7
Published: 2022-05-16T14:31:13.000Z
CVE-2022-1560 Amministrazione Aperta < 3.8 - Admin+ LFI
The Amministrazione Aperta WordPress plugin before 3.8 does not validate the open parameter before using it in an include statement, leading to a Local File Inclusion issue. The original advisory mentions that unauthenticated users can exploit this, however the affected file generates a fatal error when accessed directly and the affected code is not reached. The issue can be exploited via the dashboard when logged in as an admin, or by making a logged in admin open a malicious link
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Unknown
product: Amministrazione Aperta
Credits: lang: en
value: Hassan Khan Yusufzai - Splint3r7
Published: 2022-05-16T14:31:15.000Z
CVE-2022-1561 Crafted backend URLs in Lura Project
Lura and KrakenD-CE versions older than v2.0.2 and KrakenD-EE versions older than v2.0.0 do not sanitize URL parameters correctly, allowing a malicious user to alter the backend URL defined for a pipe when remote users send crafty URL requests. The vulnerability does not affect KrakenD itself, but the consumed backend might be vulnerable.
Problem types: cwe_id: CWE-471
description: CWE-471: Modification of Assumed-Immutable Data
Affected products: vendor: KrakenD
product: Lura Project
vendor: KrakenD
product: KrakenD-CE
vendor: KrakenD
product: KrakenD-EE
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Discovered by Github user Fepame
Published: 2022-08-01T12:47:45.682Z
CVE-2022-1562 Enable SVG < 1.4.0 - Author+ Stored Cross Site Scripting via SVG
The Enable SVG WordPress plugin before 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Enable SVG
Credits: lang: en
value: Luan Pedersini
Published: 2022-05-30T08:35:55.000Z