rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-0218 WP HTML Mail <= 3.0.9 Missing Authorization on REST-API Route
The WP HTML Mail WordPress plugin is vulnerable to unauthorized access which allows unauthenticated attackers to retrieve and modify theme settings due to a missing capability check on the /themesettings REST-API endpoint found in the ~/includes/class-template-designer.php file, in versions up to and including 3.0.9. This makes it possible for attackers with no privileges to execute the endpoint and add malicious JavaScript to a vulnerable WordPress site.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: codemiq
product: WP HTML Mail
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Chloe Chamberland, Wordfence
Published: 2022-02-04T22:29:24.000Z
CVE-2022-0219 Improper Restriction of XML External Entity Reference in skylot/jadx
Improper Restriction of XML External Entity Reference in GitHub repository skylot/jadx prior to 1.3.2.
Problem types: cwe_id: CWE-611
description: CWE-611 Improper Restriction of XML External Entity Reference
Affected products: vendor: skylot
product: skylot/jadx
Published: 2022-01-20T16:30:11.000Z
CVE-2022-0220 WordPress GDPR & CCPA < 1.9.27 - Unauthenticated Reflected Cross-Site Scripting
The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.27, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web browser led to this endpoint. Javascript code may be executed on a victim's browser. Due to v1.9.26 adding a CSRF check, the XSS is only exploitable against unauthenticated users (as they all share the same nonce)
Problem types: description: CWE-116 Improper Encoding or Escaping of Output
Affected products: vendor: Unknown
product: WordPress GDPR
default_status: unaffected
Credits: lang: en
value: Ace Candelario (@0xspade)
lang: en
value: Victor Paynat-Sautivet (3DS Outscale SOC)
lang: en
value: WPScan
Published: 2022-02-01T12:21:41.000Z
CVE-2022-0221 
A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could result in information disclosure when opening a malicious solution file provided by an attacker with SCADAPack Workbench. This could be exploited to pass data from local files to a remote system controlled by an attacker. Affected Product: SCADAPack Workbench (6.6.8a and prior)
Problem types: cwe_id: CWE-611
description: CWE-611 Improper Restriction of XML External Entity Reference ('XXE')
Affected products: vendor: Schneider Electric
product: SCADAPack Workbench
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Published: 2022-03-28T16:25:26.000Z
CVE-2022-0222 
A CWE-269: Improper Privilege Management vulnerability exists that could cause a denial of service of the Ethernet communication of the controller when sending a specific request over SNMP. Affected products: Modicon M340 CPUs(BMXP34* versions prior to V3.40), Modicon M340 X80 Ethernet Communication modules:BMXNOE0100 (H), BMXNOE0110 (H), BMXNOR0200H RTU(BMXNOE* all versions)(BMXNOR* versions prior to v1.7 IR24)
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: Schneider Electric
product: Modicon M340 CPUs
vendor: Schneider Electric
product: Modicon M340 X80 Ethernet Communication modules: BMXNOE0100 (H) BMXNOE0110 (H) BMXNOR0200H RTU
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
Published: 2022-11-22T00:00:00.000Z
CVE-2022-0223 
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could allow an attacker to create or overwrite critical files that are used to execute code, such as programs or libraries and cause unauthenticated code execution. Affected Products: EcoStruxure Power Commission (Versions prior to V2.22)
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Schneider Electric
product: EcoStruxure Power Commission
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
Published: 2023-01-30T00:00:00.000Z
CVE-2022-0224 SQL Injection in dolibarr/dolibarr
dolibarr is vulnerable to Improper Neutralization of Special Elements used in an SQL Command
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command
Affected products: vendor: dolibarr
product: dolibarr/dolibarr
Published: 2022-01-14T17:35:09.000Z
CVE-2022-0225 
A flaw was found in Keycloak. This flaw allows a privileged attacker to use the malicious payload as the group name while creating a new group from the admin console, leading to a stored Cross-site scripting (XSS) attack.
Problem types: cwe_id: CWE-79
description: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: n/a
product: keycloak
Published: 2022-08-26T17:25:46.000Z
CVE-2022-0226 Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchat
livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: livehelperchat
product: livehelperchat/livehelperchat
Published: 2022-01-14T19:00:11.000Z
CVE-2022-0228 Popup Builder < 4.0.7 - Admin+ SQL Injection
The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboard, which could allow high privilege users to perform SQL injection
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Popup Builder – Create highly converting, mobile friendly marketing popups.
Credits: lang: en
value: Tony Wu
Published: 2022-02-21T10:46:06.000Z
CVE-2022-0229 miniOrange's Google Authenticator < 5.5 - Unauthenticated Arbitrary Options Deletion
The miniOrange's Google Authenticator WordPress plugin before 5.5 does not have proper authorisation and CSRF checks when handling the reconfigureMethod, and does not validate the parameters passed to it properly. As a result, unauthenticated users could delete arbitrary options from the blog, making it unusable.
Problem types: description: CWE-862 Missing Authorization
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: miniOrange's Google Authenticator
default_status: unaffected
Credits: lang: en
value: Krzysztof Zając
lang: en
value: WPScan
Published: 2022-03-21T18:55:42.000Z
CVE-2022-0230 Better WordPress Google XML Sitemaps <= 1.4.1 - Unauthenticated Stored Cross-Site Scripting
The Better WordPress Google XML Sitemaps WordPress plugin through 1.4.1 does not sanitise and escape its logs when outputting them in the admin dashboard, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks against admins
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Better WordPress Google XML Sitemaps (support Sitemap Index, Multi-site and Google News)
Credits: lang: en
value: Krzysztof Zając
Published: 2022-03-14T14:41:23.000Z
CVE-2022-0231 Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchat
livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: livehelperchat
product: livehelperchat/livehelperchat
Published: 2022-01-14T12:05:10.000Z
CVE-2022-0232 User Registration, Login & Landing Pages – LeadMagic <= 1.2.7 Admin+ Stored Cross-Site Scripting
The User Registration, Login & Landing Pages WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the loader_text parameter found in the ~/includes/templates/landing-page.php file which allows attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.2.7. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: User Registration, Login & Landing Pages – LeadMagic 
product: User Registration, Login & Landing Pages – LeadMagic 
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Big Tiger
Published: 2022-01-18T16:52:25.000Z
CVE-2022-0233 ProfileGrid – User Profiles, Memberships, Groups and Communities <= 4.7.4 Authenticated Stored Cross-Site Scripting
The ProfileGrid – User Profiles, Memberships, Groups and Communities WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the pm_user_avatar and pm_cover_image parameters found in the ~/admin/class-profile-magic-admin.php file which allows attackers with authenticated user access, such as subscribers, to inject arbitrary web scripts into their profile, in versions up to and including 1.2.7.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: ProfileGrid – User Profiles, Memberships, Groups and Communities
product: ProfileGrid – User Profiles, Memberships, Groups and Communities
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Big Tiger
Published: 2022-01-18T16:52:28.000Z
CVE-2022-0234 WOOCS < 1.3.7.5 - Reflected Cross-Site Scripting
The WOOCS WordPress plugin before 1.3.7.5 does not sanitise and escape the woocs_in_order_currency parameter of the woocs_get_products_price_html AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WOOCS – Currency Switcher for WooCommerce. Professional and Free multi currency plugin – Pay in selected currency
Credits: lang: en
value: Krzysztof Zając
Published: 2022-02-21T10:46:08.000Z
CVE-2022-0235 Exposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetch
node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: node-fetch
product: node-fetch/node-fetch
Published: 2022-01-16T00:00:00.000Z
CVE-2022-0236 WP Import Export (Lite) <= 3.9.15 Unauthenticated Sensitive Data Disclosure
The WP Import Export WordPress plugin (both free and premium versions) is vulnerable to unauthenticated sensitive data disclosure due to a missing capability check on the download function wpie_process_file_download found in the ~/includes/classes/class-wpie-general.php file. This made it possible for unauthenticated attackers to download any imported or exported information from a vulnerable site which can contain sensitive information like user data. This affects versions up to, and including, 3.9.15.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: vjinfotech
product: WP Import Export
vendor: vjinfotech
product: WP Import Export Lite
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Karan Saini (Kloudle Inc.)
Published: 2022-01-18T16:52:22.000Z
CVE-2022-0237 Rapid7 Insight Agent Privilege Escalation
Rapid7 Insight Agent versions 3.1.2.38 and earlier suffer from a privilege escalation vulnerability, whereby an attacker can hijack the flow of execution due to an unquoted argument to the runas.exe command used by the ir_agent.exe component, resulting in elevated rights and persistent access to the machine. This issue was fixed in Rapid7 Insight Agent version 3.1.3.80.
Problem types: cwe_id: CWE-264
description: CWE-264 Permissions, Privileges, and Access Controls
Affected products: vendor: Rapid7
product: Insight Agent
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Ryan Schachtschneider
Published: 2022-03-17T22:30:16.553Z
CVE-2022-0238 Cross-Site Request Forgery (CSRF) in phoronix-test-suite/phoronix-test-suite
phoronix-test-suite is vulnerable to Cross-Site Request Forgery (CSRF)
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: phoronix-test-suite
product: phoronix-test-suite/phoronix-test-suite
Published: 2022-01-16T10:35:10.000Z
CVE-2022-0239 Improper Restriction of XML External Entity Reference in stanfordnlp/corenlp
corenlp is vulnerable to Improper Restriction of XML External Entity Reference
Problem types: cwe_id: CWE-611
description: CWE-611 Improper Restriction of XML External Entity Reference
Affected products: vendor: stanfordnlp
product: stanfordnlp/corenlp
Published: 2022-01-17T06:15:11.000Z
CVE-2022-0240 NULL Pointer Dereference in mruby/mruby
mruby is vulnerable to NULL Pointer Dereference
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: mruby
product: mruby/mruby
Published: 2022-01-17T13:35:10.000Z
CVE-2022-0242 Unrestricted Upload of File with Dangerous Type in crater-invoice/crater
Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: crater-invoice
product: crater-invoice/crater
Published: 2022-01-17T18:15:11.000Z
CVE-2022-0243 Cross-site Scripting (XSS) - Stored in orchardcms/orchardcore
Cross-site Scripting (XSS) - Stored in NuGet OrchardCore.Application.Cms.Targets prior to 1.2.2.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: orchardcms
product: orchardcms/orchardcore
Published: 2022-01-19T19:20:10.000Z
CVE-2022-0244 
An issue has been discovered in GitLab CE/EE affecting all versions starting with 14.5. Arbitrary file read was possible by importing a group was due to incorrect handling of file.
Problem types: description: Information exposure in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Thanks [vakzz](https://hackerone.com/vakzz) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2022-01-18T16:52:00.000Z
CVE-2022-0245 Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchat
Cross-Site Request Forgery (CSRF) in GitHub repository livehelperchat/livehelperchat prior to 2.0.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: livehelperchat
product: livehelperchat/livehelperchat
Published: 2022-01-18T05:15:10.000Z
CVE-2022-0246 iQ Block Country < 1.2.13 - Admin+ Arbitrary File Deletion via Zip Slip
The settings of the iQ Block Country WordPress plugin before 1.2.13 can be exported or imported using its backup functionality. An authorized user can import preconfigured settings of the plugin by uploading a zip file. After the uploading process, files in the uploaded zip file are extracted one by one. During the extraction process, existence of a file is checked. If the file exists, it is deleted without any security control by only considering the name of the extracted file. This behavior leads to "Zip Slip" vulnerability.
Problem types: cwe_id: CWE-73
description: CWE-73 External Control of File Name or Path
Affected products: vendor: Unknown
product: iQ Block Country
Credits: lang: en
value: Ceylan Bozogullarindan
Published: 2022-04-11T14:40:40.000Z
CVE-2022-0247 Write access to VMO data through copy-on-write in Fuchsia
An issue exists in Fuchsia where VMO data can be modified through access to copy-on-write snapshots. A local attacker could modify objects in the VMO that they do not have permission to. We recommend upgrading past commit d97c05d2301799ed585620a9c5c739d36e7b5d3d or any of the listed versions.
Problem types: cwe_id: CWE-732
description: CWE-732 Incorrect Permission Assignment for Critical Resource
Affected products: vendor: Google LLC
product: Fuchsia
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
version: 3.1
Published: 2022-02-25T11:10:09.000Z
CVE-2022-0248 Contact Form Submissions < 1.7.3 - Unauthenticated Stored XSS
The Contact Form Submissions WordPress plugin before 1.7.3 does not sanitise and escape additional fields in contact form requests before outputting them in the related submission. As a result, unauthenticated attacker could perform Cross-Site Scripting attacks against admins viewing the malicious submission
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Contact Form Submissions
Credits: lang: en
value: Yoru Oni
Published: 2022-03-14T14:41:25.000Z
CVE-2022-0249 
A vulnerability was discovered in GitLab starting with version 12. GitLab was vulnerable to a blind SSRF attack since requests to shared address space were not blocked.
Problem types: description: Information exposure in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.1
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Thanks [no1zy](https://hackerone.com/no1zy) for reporting this vulnerability through our HackerOne bug bounty program.
Published: 2022-03-28T18:53:07.000Z
CVE-2022-0250 Redirection for Contact Form 7 < 2.5.0 - Reflected Cross-Site Scripting
The Redirection for Contact Form 7 WordPress plugin before 2.5.0 does not escape a link generated before outputting it in an attribute, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Redirection for Contact Form 7
Credits: lang: en
value: JrXnm
Published: 2022-07-04T13:05:38.000Z
CVE-2022-0251 Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.2.10.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: pimcore
product: pimcore/pimcore
Published: 2022-01-26T10:35:10.000Z
CVE-2022-0252 Give < 2.17.3 - Reflected Cross-Site Scripting via Import Tool
The GiveWP WordPress plugin before 2.17.3 does not escape the json parameter before outputting it back in an attribute in the Import admin dashboard, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: GiveWP – Donation Plugin and Fundraising Platform
Credits: lang: en
value: JrXnm
Published: 2022-02-21T10:46:09.000Z
CVE-2022-0253 Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat
livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: livehelperchat
product: livehelperchat/livehelperchat
Published: 2022-01-17T13:15:09.000Z
CVE-2022-0254 Zero Spam < 5.2.11 - Admin+ SQL Injection
The WordPress Zero Spam WordPress plugin before 5.2.11 does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboard, leading to a SQL injection
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: WordPress Zero Spam
Credits: lang: en
value: JrXnm
Published: 2022-03-14T14:41:26.000Z
CVE-2022-0255 Database Backup for WordPress < 2.5.1 - Admin+ SQL Injection
The Database Backup for WordPress plugin before 2.5.1 does not properly sanitise and escape the fragment parameter before using it in a SQL statement in the admin dashboard, leading to a SQL injection issue
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Database Backup for WordPress
Credits: lang: en
value: JrXnm
Published: 2022-02-21T10:46:11.000Z
CVE-2022-0256 Cross-site Scripting (XSS) - Stored in pimcore/pimcore
pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: pimcore
product: pimcore/pimcore
Published: 2022-01-17T15:10:09.000Z
CVE-2022-0257 Cross-site Scripting (XSS) - Stored in pimcore/pimcore
pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: pimcore
product: pimcore/pimcore
Published: 2022-01-17T15:15:15.000Z
CVE-2022-0258 SQL Injection in pimcore/pimcore
pimcore is vulnerable to Improper Neutralization of Special Elements used in an SQL Command
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command
Affected products: vendor: pimcore
product: pimcore/pimcore
Published: 2022-01-17T15:15:10.000Z