rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-28648 CVE-2023-28648
Osprey Pump Controller version 1.01 inputs passed to a GET parameter are not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML/JS code in a user's browser session in context of an affected site.
Problem types: description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: ProPump and Controls, Inc.
product: Osprey Pump Controller
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
baseScore: 7.5
baseSeverity: HIGH
Published: 2023-03-28T20:06:56.715Z
CVE-2023-28649 
The Hub in the Snap One OvrC cloud platform is a device used to centralize and manage nested devices connected to it. A vulnerability exists in which an attacker could impersonate a hub and send device requests to claim already claimed devices. The OvrC cloud platform receives the requests but does not validate if the found devices are already managed by another user.
Problem types: cwe_id: CWE-413
description: CWE-413 Improper Resource Locking
Affected products: vendor: Snap One
product: OvrC Cloud
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Uri Katz of Claroty reported these vulnerabilities to CISA.
Published: 2023-05-22T19:10:51.219Z
CVE-2023-28650 CVE-2023-28650
An unauthenticated remote attacker could provide a malicious link and trick an unsuspecting user into clicking on it. If clicked, the attacker could execute the malicious JavaScript (JS) payload in the target’s security context.
Problem types: description: CWE-79 Cross-site Scripting
Affected products: vendor: SAUTER
product: EY-AS525F001 with moduWeb
Published: 2023-03-27T19:40:04.111Z
CVE-2023-28651 
Cross-site scripting vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. If a user who can access the affected product with an administrative privilege configures specially crafted settings, an arbitrary script may be executed on the web browser of the other user who is accessing the affected product with an administrative privilege.
Problem types: description: Cross-site scripting
Affected products: vendor: Contec Co., Ltd.
product: CONPROSYS HMI System (CHS)
Published: 2023-06-01T00:00:00.000Z
CVE-2023-28652 CVE-2023-28652
An authenticated malicious user could successfully upload a malicious image could lead to a denial-of-service condition.
Problem types: description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: SAUTER
product: EY-AS525F001 with moduWeb
Published: 2023-03-27T19:29:45.917Z
CVE-2023-28653 

















The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP). This could lead to a use-after-free vulnerability. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process. 

 

 

 



 








Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: Horner Automation
product: Cscape
default_status: unaffected
vendor: Horner Automation
product: Cscape EnvisionRV
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Michael Heinzl reported these vulnerabilities to CISA. 
Published: 2023-06-06T16:42:49.346Z
CVE-2023-28654 CVE-2023-28654
Osprey Pump Controller version 1.01 has a hidden administrative account that has the hardcoded password that allows full access to the web management interface configuration. The user is not visible in Usernames and Passwords menu list of the application and the password cannot be changed through any normal operation of the device.
Problem types: description: CWE-259 Use of Hard-Coded Password
Affected products: vendor: ProPump and Controls, Inc.
product: Osprey Pump Controller
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
baseScore: 9.8
baseSeverity: CRITICAL
Published: 2023-03-28T20:03:03.238Z
CVE-2023-28655 CVE-2023-28655
A malicious user could leverage this vulnerability to escalate privileges or perform unauthorized actions in the context of the targeted privileged users.
Problem types: description: CWE-79 Cross-site Scripting
Affected products: vendor: SAUTER
product: EY-AS525F001 with moduWeb
Published: 2023-03-27T19:38:44.049Z
CVE-2023-28656 NGINX Management Suite vulnerability
NGINX Management Suite may allow an authenticated attacker to gain access to configuration objects outside of their assigned environment.  

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: F5
product: NGINX Instance Manager
default_status: unknown
vendor: F5
product: NGINX API Connectivity Manager
default_status: unknown
vendor: F5
product: NGINX Security Monitoring
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: F5
Published: 2023-05-03T14:34:11.577Z
CVE-2023-28657 
Improper access control vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. A user of the PC where the affected product is installed may gain an administrative privilege. As a result, information regarding the product may be obtained and/or altered by the user.
Problem types: description: Improper access control
Affected products: vendor: Contec Co., Ltd.
product: CONPROSYS HMI System (CHS)
Published: 2023-06-01T00:00:00.000Z
CVE-2023-28658 
Insecure inherited permissions in some Intel(R) oneMKL software before version 2022.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
cwe_id: CWE-277
description: Insecure inherited permissions
Affected products: vendor: n/a
product: Intel(R) oneMKL software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2023-08-11T02:37:14.703Z
CVE-2023-28659 
The Waiting: One-click Countdowns WordPress Plugin, version <= 0.6.2, is affected by an authenticated SQL injection vulnerability in the pbc_down[meta][id] parameter of the pbc_save_downs action.
Problem types: description: Authenticated SQL Injection
Affected products: vendor: n/a
product: Waiting: One-click Countdowns WordPress Plugin
Published: 2023-03-22T00:00:00.000Z
CVE-2023-28660 
The Events Made Easy WordPress Plugin, version <= 2.3.14 is affected by an authenticated SQL injection vulnerability in the 'search_name' parameter in the eme_recurrences_list action.
Problem types: description: Authenticated SQL Injection
Affected products: vendor: n/a
product: Events Made Easy WordPress Plugin
Published: 2023-03-22T00:00:00.000Z
CVE-2023-28661 
The WP Popup Banners WordPress Plugin, version <= 1.2.5, is affected by an authenticated SQL injection vulnerability in the 'value' parameter in the get_popup_data action.
Problem types: description: Authenticated SQL Injection
Affected products: vendor: n/a
product: WP Popup Banners WordPress Plugin
Published: 2023-03-22T00:00:00.000Z
CVE-2023-28662 
The Gift Cards (Gift Vouchers and Packages) WordPress Plugin, version <= 4.3.1, is affected by an unauthenticated SQL injection vulnerability in the template parameter in the wpgv_doajax_voucher_pdf_save_func action.
Problem types: description: Unauthenticated SQL Injection
Affected products: vendor: n/a
product: Gift Cards (Gift Vouchers and Packages) WordPress Plugin
Published: 2023-03-22T00:00:00.000Z
CVE-2023-28663 
The Formidable PRO2PDF WordPress Plugin, version < 3.11, is affected by an authenticated SQL injection vulnerability in the ‘fieldmap’ parameter in the fpropdf_export_file action.
Problem types: description: Authenticated SQL Injection
Affected products: vendor: n/a
product: Formidable PRO2PDF WordPress Plugin
Published: 2023-03-22T00:00:00.000Z
CVE-2023-28664 
The Meta Data and Taxonomies Filter WordPress plugin, in versions < 1.3.1, is affected by a reflected cross-site scripting vulnerability in the 'tax_name' parameter of the mdf_get_tax_options_in_widget action, which can only be triggered by an authenticated user.
Problem types: description: Authenticated Reflected Cross-Site Scripting
Affected products: vendor: n/a
product: Meta Data and Taxonomies Filter WordPress Plugin
Published: 2023-03-22T00:00:00.000Z
CVE-2023-28665 
The Woo Bulk Price Update WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'page' parameter to the techno_get_products action, which can only be triggered by an authenticated user.
Problem types: description: Authenticated Reflected Cross-Site Scripting
Affected products: vendor: n/a
product: Woo Bulk Price Update WordPress Plugin
Published: 2023-03-22T00:00:00.000Z
CVE-2023-28666 
The InPost Gallery WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'imgurl' parameter to the add_inpost_gallery_slide_item action, which can only be triggered by an authenticated user.
Problem types: description: Authenticated Reflected Cross-Site Scripting
Affected products: vendor: n/a
product: InPost Gallery WordPress Plugin
Published: 2023-03-22T00:00:00.000Z
CVE-2023-28667 
The Lead Generated WordPress Plugin, version <= 1.23, was affected by an unauthenticated insecure deserialization issue. The tve_labels parameter of the tve_api_form_submit action is passed to the PHP unserialize() function without being sanitized or verified, and as a result could lead to PHP object injection, which when combined with certain class implementations / gadget chains could be leveraged to perform a variety of malicious actions granted a POP chain is also present.
Problem types: description: Deserialization of Untrusted Data
Affected products: vendor: n/a
product: Lead Generated WordPress Plugin
Published: 2023-03-22T00:00:00.000Z
CVE-2023-28668 
Jenkins Role-based Authorization Strategy Plugin 587.v2872c41fa_e51 and earlier grants permissions even after they've been disabled.
Affected products: vendor: Jenkins Project
product: Jenkins Role-based Authorization Strategy Plugin
default_status: unaffected
Published: 2023-03-23T11:25:59.292Z
CVE-2023-28669 
Jenkins JaCoCo Plugin 3.3.2 and earlier does not escape class and method names shown on the UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control input files for the 'Record JaCoCo coverage report' post-build action.
Affected products: vendor: Jenkins Project
product: Jenkins JaCoCo Plugin
default_status: unaffected
Published: 2023-03-23T11:26:00.146Z
CVE-2023-28670 
Jenkins Pipeline Aggregator View Plugin 1.13 and earlier does not escape a variable representing the current view's URL in inline JavaScript, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by authenticated attackers with Overall/Read permission.
Affected products: vendor: Jenkins Project
product: Jenkins Pipeline Aggregator View Plugin
default_status: unaffected
Published: 2023-03-23T11:26:00.852Z
CVE-2023-28671 
A cross-site request forgery (CSRF) vulnerability in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected products: vendor: Jenkins Project
product: Jenkins OctoPerf Load Testing Plugin Plugin
default_status: unaffected
Published: 2023-03-23T11:26:01.646Z
CVE-2023-28672 
Jenkins OctoPerf Load Testing Plugin Plugin 4.5.1 and earlier does not perform a permission check in a connection test HTTP endpoint, allowing attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected products: vendor: Jenkins Project
product: Jenkins OctoPerf Load Testing Plugin Plugin
default_status: unaffected
Published: 2023-03-23T11:26:02.427Z
CVE-2023-28673 
A missing permission check in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Affected products: vendor: Jenkins Project
product: Jenkins OctoPerf Load Testing Plugin Plugin
default_status: unaffected
Published: 2023-03-23T11:26:03.128Z
CVE-2023-28674 
A cross-site request forgery (CSRF) vulnerability in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to connect to a previously configured Octoperf server using attacker-specified credentials.
Affected products: vendor: Jenkins Project
product: Jenkins OctoPerf Load Testing Plugin Plugin
default_status: unaffected
Published: 2023-03-23T11:26:03.841Z
CVE-2023-28675 
A missing permission check in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to connect to a previously configured Octoperf server using attacker-specified credentials.
Affected products: vendor: Jenkins Project
product: Jenkins OctoPerf Load Testing Plugin Plugin
default_status: unaffected
Published: 2023-03-23T11:26:04.539Z
CVE-2023-28676 
A cross-site request forgery (CSRF) vulnerability in Jenkins Convert To Pipeline Plugin 1.0 and earlier allows attackers to create a Pipeline based on a Freestyle project, potentially leading to remote code execution (RCE).
Affected products: vendor: Jenkins Project
product: Jenkins Convert To Pipeline Plugin
default_status: unknown
Published: 2023-03-23T11:26:05.301Z
CVE-2023-28677 
Jenkins Convert To Pipeline Plugin 1.0 and earlier uses basic string concatenation to convert Freestyle projects' Build Environment, Build Steps, and Post-build Actions to the equivalent Pipeline step invocations, allowing attackers able to configure Freestyle projects to prepare a crafted configuration that injects Pipeline script code into the (unsandboxed) Pipeline resulting from a convertion by Jenkins Convert To Pipeline Plugin.
Affected products: vendor: Jenkins Project
product: Jenkins Convert To Pipeline Plugin
default_status: unknown
Published: 2023-03-23T11:26:06.014Z
CVE-2023-28678 
Jenkins Cppcheck Plugin 1.26 and earlier does not escape file names from Cppcheck report files before showing them on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control report file contents.
Affected products: vendor: Jenkins Project
product: Jenkins Cppcheck Plugin
default_status: unknown
Published: 2023-03-23T11:26:06.733Z
CVE-2023-28679 
Jenkins Mashup Portlets Plugin 1.1.2 and earlier provides the "Generic JS Portlet" feature that lets a user populate a portlet using a custom JavaScript expression, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by authenticated attackers with Overall/Read permission.
Affected products: vendor: Jenkins Project
product: Jenkins Mashup Portlets Plugin
default_status: unknown
Published: 2023-03-23T11:26:07.445Z
CVE-2023-28680 
Jenkins Crap4J Plugin 0.9 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Affected products: vendor: Jenkins Project
product: Jenkins Crap4J Plugin
default_status: unknown
Published: 2023-03-23T11:26:08.166Z
CVE-2023-28681 
Jenkins Visual Studio Code Metrics Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Affected products: vendor: Jenkins Project
product: Jenkins Visual Studio Code Metrics Plugin
default_status: unknown
Published: 2023-03-23T11:26:08.881Z
CVE-2023-28682 
Jenkins Performance Publisher Plugin 8.09 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Affected products: vendor: Jenkins Project
product: Jenkins Performance Publisher Plugin
default_status: unknown
Published: 2023-03-23T11:26:09.595Z
CVE-2023-28683 
Jenkins Phabricator Differential Plugin 2.1.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Affected products: vendor: Jenkins Project
product: Jenkins Phabricator Differential Plugin
default_status: unknown
Published: 2023-03-23T11:26:10.324Z
CVE-2023-28684 
Jenkins remote-jobs-view-plugin Plugin 0.0.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Affected products: vendor: Jenkins Project
product: Jenkins remote-jobs-view-plugin Plugin
default_status: unknown
Published: 2023-03-23T11:26:11.035Z
CVE-2023-28685 
Jenkins AbsInt a³ Plugin 1.1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Affected products: vendor: Jenkins Project
product: Jenkins AbsInt a³ Plugin
default_status: unknown
Published: 2023-03-21T15:53:30.952Z
CVE-2023-28686 
Dino before 0.2.3, 0.3.x before 0.3.2, and 0.4.x before 0.4.2 allows attackers to modify the personal bookmark store via a crafted message. The attacker can change the display of group chats or force a victim to join a group chat; the victim may then be tricked into disclosing sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-24T00:00:00.000Z
CVE-2023-28687 Reflected Cross-Site Scripting (XSS) vulnerability in multiple WordPress themes
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in perfectwpthemes Glaze Blog Lite, themebeez Fascinate, themebeez Cream Blog, themebeez Cream Magazine allows Reflected XSS.This issue affects Glaze Blog Lite: from n/a through <= 1.1.4; Fascinate: from n/a through 1.0.8; Cream Blog: from n/a through 2.1.3; Cream Magazine: from n/a through 2.1.4.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: perfectwpthemes
product: Glaze Blog Lite
default_status: unaffected
vendor: themebeez
product: Fascinate
default_status: unaffected
vendor: themebeez
product: Cream Blog
default_status: unaffected
vendor: themebeez
product: Cream Magazine
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: László Radnai (Patchstack Alliance)
Published: 2024-03-26T20:20:59.986Z
CVE-2023-28688 WordPress TH Variation Swatches plugin <= 1.2.7 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in ThemeHunk TH Variation Swatches allows Cross Site Request Forgery.This issue affects TH Variation Swatches: from n/a through 1.2.7.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: ThemeHunk
product: TH Variation Swatches
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: István Márton (Patchstack Alliance)
Published: 2024-12-09T11:31:15.325Z
CVE-2023-28689 WordPress JS Job Manager plugin <= 2.0.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in JoomSky JS Job Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Job Manager: from n/a through 2.0.0.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: JoomSky
product: JS Job Manager
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: Fariq Fadillah Gusti Insani (Patchstack Alliance)
Published: 2024-12-09T11:31:14.476Z
CVE-2023-28690 WordPress WP BrowserUpdate Plugin <= 4.5 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Marco Steinbrecher WP BrowserUpdate plugin <= 4.5 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Marco Steinbrecher
product: WP BrowserUpdate
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: qilin_99 (Patchstack Alliance)
Published: 2023-08-17T21:19:53.025Z
CVE-2023-28692 WordPress WP Abstracts Plugin <= 2.6.3 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kevon Adonis WP Abstracts plugin <= 2.6.3 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Kevon Adonis
product: WP Abstracts
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: qilin_99 (Patchstack Alliance)
Published: 2023-08-30T15:27:09.400Z
CVE-2023-28693 WordPress Advanced Youtube Channel Pagination Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Balasaheb Bhise Advanced Youtube Channel Pagination plugin <= 1.0 version.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Balasaheb Bhise
product: Advanced Youtube Channel Pagination
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: qilin_99 (Patchstack Alliance)
Published: 2023-08-17T14:44:56.405Z