rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-45019 
SLiMS 9 Bulian v9.5.0 was discovered to contain a SQL injection vulnerability via the keywords parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-05T00:00:00.000Z
CVE-2022-45020 
Rukovoditel v3.2.1 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability in the component /rukovoditel/index.php?module=users/login. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-05T00:00:00.000Z
CVE-2022-45025 
Markdown Preview Enhanced v0.6.5 and v0.19.6 for VSCode and Atom was discovered to contain a command injection vulnerability via the PDF file import function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-07T00:00:00.000Z
CVE-2022-45026 
An issue in Markdown Preview Enhanced v0.6.5 and v0.19.6 for VSCode and Atom allows attackers to execute arbitrary commands during the GFM export process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-07T00:00:00.000Z
CVE-2022-45027 
perfSONAR before 4.4.6, when performing participant discovery, incorrectly uses an HTTP request header value to determine a local address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-01T00:00:00.000Z
CVE-2022-45028 
A cross-site scripting (XSS) vulnerability in Arris NVG443B 9.3.0h3d36 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request sent to /cgi-bin/logs.ha.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-13T00:00:00.000Z
CVE-2022-45030 
A SQL injection vulnerability in rConfig 3.9.7 exists via lib/ajaxHandlers/ajaxCompareGetCmdDates.php?command= (this may interact with secure-file-priv).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-15T00:00:00.000Z
CVE-2022-45033 
A cross-site scripting (XSS) vulnerability in Expense Tracker 1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Chat text field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-15T00:00:00.000Z
CVE-2022-45036 
A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the No Results field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-25T00:00:00.000Z
CVE-2022-45037 
A cross-site scripting (XSS) vulnerability in /admin/users/index.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Display Name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-25T00:00:00.000Z
CVE-2022-45038 
A cross-site scripting (XSS) vulnerability in /admin/settings/save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website Footer field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-25T00:00:00.000Z
CVE-2022-45039 
An arbitrary file upload vulnerability in the Server Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary code via a crafted PHP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-25T00:00:00.000Z
CVE-2022-45040 
A cross-site scripting (XSS) vulnerability in /admin/pages/sections_save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name Section field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-25T00:00:00.000Z
CVE-2022-45041 
SQL Injection exits in xinhu < 2.5.0
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-19T00:00:00.000Z
CVE-2022-45043 
Tenda AX12 V22.03.01.16_cn is vulnerable to command injection via goform/fast_setting_internet_set.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-12T00:00:00.000Z
CVE-2022-45045 
Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.00000, allow authenticated users to execute arbitrary commands as root, as exploited in the wild starting in approximately 2019. A remote and authenticated attacker, possibly using the default admin:tlJwpbo6 credentials, can connect to port 34567 and execute arbitrary operating system commands via a crafted JSON file during an upgrade request. Since at least 2021, Xiongmai has applied patches to prevent attackers from using this mechanism to execute telnetd.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-01T00:00:00.000Z
CVE-2022-45047 Apache MINA SSHD: Java unsafe deserialization vulnerability
Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD can choose for loading the host keys of an SSH server.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Apache Software Foundation
product: Apache MINA SSHD
Credits: lang: en
value: The Apache MINA SSHD team would like to thank Zhang Zewei, NOFOCUS, for reporting this issue.
Published: 2022-11-16T00:00:00.000Z
CVE-2022-45048 Apache Ranger: code execution vulnerability in policy expressions
Authenticated users with appropriate privileges can create policies having expressions that can exploit code execution vulnerability. This issue affects Apache Ranger: 2.3.0. Users are recommended to update to version 2.4.0.



Problem types: cwe_id: CWE-74
description: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Affected products: vendor: Apache Software Foundation
product: Apache Ranger
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: g1831767442@163.com
Published: 2023-05-05T07:50:25.762Z
CVE-2022-45049 Reflected XSS in Axiell Iguana CMS
A reflected XSS vulnerability has been found in Axiell Iguana CMS, allowing an attacker to execute code in a victim's browser. The url parameter on the novelist.php endpoint does not properly neutralise user input, resulting in the vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Axiell
product: Iguana
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Amr Al Hallak
lang: en
value: Frank Breedijk (DIVD)
lang: en
value: Max van der Horst (DIVD)
Published: 2023-01-04T18:11:23.783Z
CVE-2022-45050 Reflected XSS in Axiell Iguana CMS
A reflected XSS vulnerability has been found in Axiell Iguana CMS, allowing an attacker to execute code in a victim's browser. The title parameter on the twitter.php endpoint does not properly neutralise user input, resulting in the vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Axiell
product: Iguana
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Amr Al Hallak
lang: en
value: Frank Breedijk (DIVD)
lang: en
value: Max van der Horst (DIVD)
Published: 2022-12-01T08:00:43.460Z
CVE-2022-45051 Reflected POST XSS in Axiell Iguana CMS
A reflected XSS vulnerability has been found in Axiell Iguana CMS, allowing an attacker to execute code in a victim's browser. The module parameter on the Service.template.cls endpoint does not properly neutralise user input, resulting in the vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Axiell
product: Iguana
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Amr Al Hallak
lang: en
value: Frank Breedijk (DIVD)
lang: en
value: Max van der Horst (DIVD)
Published: 2023-01-04T18:11:32.145Z
CVE-2022-45052 Local File Inclusion in Axiell Iguana CMS
A Local File Inclusion vulnerability has been found in Axiell Iguana CMS. Due to insufficient neutralisation of user input on the url parameter on the Proxy.type.php endpoint, external users are capable of accessing files on the server.
Problem types: cwe_id: CWE-552
description: CWE-552 Files or Directories Accessible to External Parties
Affected products: vendor: Axiell
product: Iguana
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Credits: lang: en
value: Amr Al Hallak
lang: en
value: Frank Breedijk (DIVD)
lang: en
value: Max van der Horst (DIVD)
Published: 2023-01-04T18:11:20.473Z
CVE-2022-45059 
An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling attack can be performed on Varnish Cache servers by requesting that certain headers are made hop-by-hop, preventing the Varnish Cache servers from forwarding critical headers to the backend.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-09T00:00:00.000Z
CVE-2022-45060 
An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-09T00:00:00.000Z
CVE-2022-45061 
An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-09T00:00:00.000Z
CVE-2022-45062 
In Xfce xfce4-settings before 4.16.4 and 4.17.x before 4.17.1, there is an argument injection vulnerability in xfce4-mime-helper.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-09T00:00:00.000Z
CVE-2022-45063 
xterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and therefore lead to command execution within the vi line-editing mode of Zsh. NOTE: font ops are not allowed in the xterm default configurations of some Linux distributions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-10T00:00:00.000Z
CVE-2022-45064 Apache Sling Engine: Include-based XSS
The SlingRequestDispatcher doesn't correctly implement the RequestDispatcher API resulting in a generic type of include-based cross-site scripting issues on the Apache Sling level. The vulnerability is exploitable by an attacker that is able to include a resource with specific content-type and control the include path (i.e. writing content). The impact of a successful attack is privilege escalation to administrative power.




Please update to Apache Sling Engine >= 2.14.0 and enable the "Check Content-Type overrides" configuration option.





Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Apache Software Foundation
product: Apache Sling Engine
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Lars Krapf
Published: 2023-04-13T10:01:14.502Z
CVE-2022-45065 WordPress SEO Plugin by Squirrly SEO Plugin <= 12.1.20 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Squirrly SEO Plugin by Squirrly SEO plugin <= 12.1.20 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Squirrly
product: SEO Plugin by Squirrly SEO
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Rafie Muhammad (Patchstack)
Published: 2023-05-08T14:31:15.202Z
CVE-2022-45066 WordPress WooSwipe WooCommerce Gallery plugin <= 2.0.1 - Auth. Broken Access Control vulnerability
Auth. (subscriber+) Broken Access Control vulnerability in WooSwipe WooCommerce Gallery plugin <= 2.0.1 on WordPress.
Problem types: cwe_id: CWE-264
description: CWE-264 Permissions, Privileges, and Access Controls
Affected products: vendor: Thrive Website Design
product: WooSwipe WooCommerce Gallery (WordPress plugin)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: Vulnerability discovered by Tien Nguyen Anh (Patchstack Alliance)
Published: 2022-11-17T22:05:03.860Z
CVE-2022-45067 WordPress Exclusive Addons Elementor Plugin <= 2.6.1 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in DevsCred Exclusive Addons Elementor plugin <= 2.6.1 versions.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: DevsCred
product: Exclusive Addons for Elementor
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Muhammad Daffa (Patchstack Alliance)
Published: 2023-02-02T16:05:52.955Z
CVE-2022-45068 WordPress Mercado Pago payments for WooCommerce Plugin <= 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in Mercado Pago Mercado Pago payments for WooCommerce plugin <= 6.3.1.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Mercado Pago
product: Mercado Pago payments for WooCommerce
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Muhammad Daffa (Patchstack Alliance)
Published: 2023-03-01T13:35:29.131Z
CVE-2022-45069 WordPress Crowdsignal Dashboard plugin <= 3.0.9 - Privilege Escalation vulnerability
Auth. (contributor+) Privilege Escalation vulnerability in Crowdsignal Dashboard plugin <= 3.0.9 on WordPress.
Problem types: cwe_id: CWE-264
description: CWE-264 Permissions, Privileges, and Access Controls
Affected products: vendor: Automattic, Inc.
product: Crowdsignal Dashboard – Polls, Surveys & more (WordPress plugin)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Vulnerability discovered by Nosa "apapedulimu" Shandy (Patchstack Alliance)
Published: 2022-11-17T22:18:38.893Z
CVE-2022-45070 WordPress Conditional Checkout Fields for WooCommerce plugin <= 1.2.3 - Broken Authentication vulnerability
Missing Authorization vulnerability in FmeAddons Conditional Checkout Fields for WooCommerce.This issue affects Conditional Checkout Fields for WooCommerce: from n/a through 1.2.3.
Problem types: cwe_id: CWE-862
description: CWE-862: Missing Authorization
Affected products: vendor: FmeAddons
product: Conditional Checkout Fields for WooCommerce
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: 84EM (Patchstack Alliance)
Published: 2024-05-17T06:27:25.870Z
CVE-2022-45071 WordPress WPML Multilingual CMS premium plugin <= 4.5.13 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in WPML Multilingual CMS premium plugin <= 4.5.13 on WordPress.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: OnTheGoSystems Ltd.
product: WPML Multilingual CMS (WordPress plugin)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: Vulnerability discovered by Dave Jong (Patchstack)
Published: 2022-11-17T21:58:30.968Z
CVE-2022-45072 WordPress WPML Multilingual CMS premium plugin <= 4.5.13 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in WPML Multilingual CMS premium plugin <= 4.5.13 on WordPress.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: OnTheGoSystems Ltd.
product: WPML Multilingual CMS (WordPress plugin)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Vulnerability discovered by Dave Jong (Patchstack)
Published: 2022-11-17T21:57:11.761Z
CVE-2022-45073 WordPress REST API Authentication plugin <= 2.4.0 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in REST API Authentication plugin <= 2.4.0 on WordPress.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: miniOrange
product: WordPress REST API Authentication (WordPress plugin)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: Vulnerability discovered by Lana Codes (Patchstack Alliance)
Published: 2022-11-18T21:42:34.048Z
CVE-2022-45074 WordPress Activity Reactions For Buddypress Plugin <= 1.0.22 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in Paramveer Singh for Arete IT Private Limited Activity Reactions For Buddypress plugin <= 1.0.22 versions.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Paramveer Singh for Arete IT Private Limited
product: Activity Reactions For Buddypress
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: ptsfence (Patchstack Alliance)
Published: 2023-04-23T11:08:00.451Z
CVE-2022-45076 WordPress Flexible Elementor Panel Plugin <= 2.3.8 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in WebMat Flexible Elementor Panel plugin <= 2.3.8 versions.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: WebMat
product: Flexible Elementor Panel
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Muhammad Daffa (Patchstack Alliance)
Published: 2023-05-22T09:40:39.348Z
CVE-2022-45077 WordPress Betheme theme <= 26.5.1.4 - Auth. PHP Object Injection vulnerability
Auth. (subscriber+) PHP Object Injection vulnerability in Betheme theme <= 26.5.1.4 on WordPress.
Problem types: description: PHP Object Injection
Affected products: vendor: Muffingroup
product: Betheme (WordPress theme)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Vulnerability discovered by Dave Jong (Patchstack)
Published: 2022-11-17T22:07:29.612Z