rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-5401 
Server receiving a malformed message based on a using the specified key values can cause a stack overflow vulnerability which could lead to an attacker performing remote code execution or causing a failure. See Honeywell Security Notification for recommendations on upgrading and versioning.


Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: Honeywell
product: Experion Server
default_status: unaffected
vendor: Honeywell
product: Experion Server
default_status: unaffected
vendor: Honeywell
product: Experion Server
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-04-17T16:42:00.403Z
CVE-2023-5402 



A CWE-269: Improper Privilege Management vulnerability exists that could cause a remote
code execution when the transfer command is used over the network.


Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: Schneider Electric
product: C-Bus Toolkit
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-10-04T17:59:59.273Z
CVE-2023-5403 
Server hostname translation to IP address manipulation which could lead to an attacker performing remote code execution or causing a failure.

See Honeywell Security Notification for recommendations on upgrading and versioning.


Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: Honeywell
product: Experion Server
default_status: unaffected
vendor: Honeywell
product: Experion Server
default_status: unaffected
vendor: Honeywell
product: Experion Server
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-04-17T16:43:54.036Z
CVE-2023-5404 
Server receiving a malformed message can cause a pointer to be overwritten which can result in a remote code execution or failure. See Honeywell Security Notification for recommendations on upgrading and versioning.
Problem types: cwe_id: CWE-122
description: CWE-122
Affected products: vendor: Honeywell
product: Experion Server
default_status: unaffected
vendor: Honeywell
product: Experion Server
default_status: unaffected
vendor: Honeywell
product: Experion Server
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-04-17T16:44:37.703Z
CVE-2023-5405 
Server information leak for the CDA Server process memory can occur when an error is generated in response to a specially crafted message. See Honeywell Security Notification for recommendations on upgrading and versioning.
Problem types: cwe_id: CWE-787
description: CWE-787
Affected products: vendor: Honeywell
product: Experion Server
default_status: unaffected
vendor: Honeywell
product: Experion Server
default_status: unaffected
vendor: Honeywell
product: Experion Server
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2024-04-17T16:46:29.950Z
CVE-2023-5406 
Server communication with a controller can lead to remote code execution using a specially crafted message from the controller. See Honeywell Security Notification for recommendations on upgrading and versioning.
Problem types: cwe_id: CWE-787
description: CWE-787
Affected products: vendor: Honeywell
product: Experion Server
default_status: unaffected
vendor: Honeywell
product: Experion Server
default_status: unaffected
vendor: Honeywell
product: Experion Server
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2024-04-17T16:47:50.336Z
CVE-2023-5407 
Controller denial of service due to improper handling of a specially crafted message received by the controller.

See Honeywell Security Notification for recommendations on upgrading and versioning.
Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: Honeywell
product: C300
default_status: unaffected
vendor: Honeywell
product: C300
default_status: unaffected
vendor: Honeywell
product: C300
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2024-04-17T16:49:16.900Z
CVE-2023-5408 Openshift: modification of node role labels
A privilege escalation flaw was found in the node restriction admission plugin of the kubernetes api server of OpenShift. A remote attacker who modifies the node role label could steer workloads from the control plane and etcd nodes onto different worker nodes and gain broader access to the cluster.
Problem types: cwe_id: CWE-269
description: Improper Privilege Management
Affected products: vendor: Red Hat
product: Red Hat OpenShift Container Platform 4.11
cpes: cpe:/a:redhat:openshift:4.11::el8
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4.12
cpes: cpe:/a:redhat:openshift:4.12::el8
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4.13
cpes: cpe:/a:redhat:openshift:4.13::el9
cpe:/a:redhat:openshift:4.13::el8
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4.14
cpes: cpe:/a:redhat:openshift:4.14::el8
cpe:/a:redhat:openshift:4.14::el9
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: This issue was discovered by Derek Carr (Red Hat) and Mrunal Patel (Red Hat).
Published: 2023-11-02T02:55:58.195Z
CVE-2023-5409 
HP is aware of a potential security vulnerability in HP t430 and t638 Thin Client PCs. These models may be susceptible to a physical attack, allowing an untrusted source to tamper with the system firmware using a publicly disclosed private key. HP is providing recommended guidance for customers to reduce exposure to the potential vulnerability.
Affected products: vendor: HP Inc.
product: HP t430 and t638 Thin Clients
default_status: affected
Published: 2023-10-13T16:15:34.743Z
CVE-2023-5410 
A potential security vulnerability has been reported in the system BIOS of certain HP PC products, which might allow memory tampering. HP is releasing mitigation for the potential vulnerability.
Affected products: vendor: HP Inc.
product: HP PC BIOS
default_status: unknown
Published: 2024-03-12T20:01:46.531Z
CVE-2023-5411 Funnelforms Free <= 3.4 - Missing Authorization to Post Modification
The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_save_post function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to modify certain post values. Note that the extent of modification is limited due to fixed values passed to the wp_update_post function.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: funnelforms
product: Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Alex Thomas
Published: 2023-11-22T15:33:30.215Z
CVE-2023-5412 Image horizontal reel scroll slideshow <= 13.2 -  Authenticated (Subscriber+) SQL Injection via Shortcode
The Image horizontal reel scroll slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 13.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: gopiplus
product: Image horizontal reel scroll slideshow
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: István Márton
Published: 2023-10-31T08:32:48.974Z
CVE-2023-5413 Image horizontal reel scroll slideshow <= 13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Image horizontal reel scroll slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'ihrss-gallery' shortcode in versions up to, and including, 13.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: gopiplus
product: Image horizontal reel scroll slideshow
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: István Márton
Published: 2023-12-19T03:09:40.040Z
CVE-2023-5414 Icegram Express <= 5.6.23 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Read
The Icegram Express plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 5.6.23 via the show_es_logs function. This allows administrator-level attackers to read the contents of arbitrary files on the server, which can contain sensitive information including those belonging to other sites, for example in shared hosting environments.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: icegram
product: Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
baseScore: 9.1
baseSeverity: CRITICAL
Credits: lang: en
value: Marco Wotschka
Published: 2023-10-20T06:35:19.665Z
CVE-2023-5415 Funnelforms Free <= 3.4 - Missing Authorization to New Category Creation
The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_add_category function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to add new categories.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: funnelforms
product: Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Alex Thomas
Published: 2023-11-22T15:33:26.588Z
CVE-2023-5416 Funnelforms Free <= 3.4 - Missing Authorization to Category Deletion
The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_delete_category function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete categories.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: funnelforms
product: Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Alex Thomas
Published: 2023-11-22T15:33:32.162Z
CVE-2023-5417 Funnelforms Free <= 3.4 - Missing Authorization to Category Update
The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_update_category function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to modify the Funnelforms category for a given post ID.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: funnelforms
product: Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Alex Thomas
Published: 2023-11-22T15:33:20.139Z
CVE-2023-5419 Funnelforms Free <= 3.4 - Missing Authorization to Test Email Sending
The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_test_mail function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to send test emails to an arbitrary email address.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: funnelforms
product: Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Alex Thomas
Published: 2023-11-22T15:33:25.228Z
CVE-2023-5421  Possible XSS execution in customer information 
An attacker who is logged into OTRS as an user with privileges to create and change customer user data may manipulate the CustomerID field to execute JavaScript code that runs 
immediatly after the data is saved.The issue onlyoccurs if the configuration for AdminCustomerUser::UseAutoComplete was changed before.
This issue affects OTRS: from 7.0.X before 7.0.47, from 8.0.X before 8.0.37; ((OTRS)) Community Edition: from 6.0.X through 6.0.34.


Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: OTRS AG
product: OTRS
default_status: affected
vendor: OTRS AG
product: ((OTRS)) Community Edition
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Special thanks to Tim Püttmanns for reporting these vulnerability.
Published: 2023-10-16T08:10:55.114Z
CVE-2023-5422 SSL Certificates are not checked for E-Mail Handling
The functions to fetch e-mail via POP3 or IMAP as well as sending e-mail via SMTP use OpenSSL for static SSL or TLS based communication. As the 
SSL_get_verify_result() function is not used the certificated is trusted always and it can not be ensured that the certificate 
satisfies all necessary security requirements.

This could allow an 
attacker to use an invalid certificate to claim to be a trusted host, 
use expired certificates, or conduct other attacks that could be 
detected if the certificate is properly validated.

This issue affects OTRS: from 7.0.X before 7.0.47, from 8.0.X before 8.0.37; ((OTRS)) Community Edition: from 6.0.X through 6.0.34.


Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: vendor: OTRS AG
product: OTRS
default_status: affected
vendor: OTRS AG
product: ((OTRS)) Community Edition
default_status: affected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Special thanks to Matthias Terlinde for reporting these vulnerability.
Published: 2023-10-16T08:10:35.192Z
CVE-2023-5423 SourceCodester Online Pizza Ordering System sql injection
A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/ajax.php?action=confirm_order. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The identifier of this vulnerability is VDB-241384.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: SourceCodester
product: Online Pizza Ordering System
CVSS v3.1: version: 3.1
baseScore: 4.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: simon.davis8080 (VulDB User)
Published: 2023-10-05T17:00:07.714Z
CVE-2023-5424 WS Form LITE <= 1.9.217 - Unauthenticated CSV Injection
The WS Form LITE plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.9.217. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
Problem types: cwe_id: CWE-1236
description: CWE-1236 Improper Neutralization of Formula Elements in a CSV File
Affected products: vendor: westguard
product: WS Form LITE – Drag & Drop Contact Form Builder
default_status: unaffected
vendor: WS Form
product: WS Form Pro
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
baseScore: 4.7
baseSeverity: MEDIUM
Credits: lang: en
value: Duc Manh
Published: 2024-06-07T09:33:35.882Z
CVE-2023-5425 Post Meta Data Manager <=1.2.0 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
The Post Meta Data Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmdm_wp_change_user_meta and pmdm_wp_change_post_meta functions in versions up to, and including, 1.2.0. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to gain elevated (e.g., administrator) privileges.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: gandhihitesh9
product: Post Meta Data Manager
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: Francesco Carlucci
Published: 2023-10-28T11:06:04.112Z
CVE-2023-5426 Post Meta Data Manager <=1.2.0 - Missing Authorization to User, Term, and Post Meta Deletion
The Post Meta Data Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmdm_wp_delete_user_meta,  pmdm_wp_delete_term_meta, and pmdm_wp_ajax_delete_meta functions in versions up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to delete user, term, and post meta belonging to arbitrary users.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: gandhihitesh9
product: Post Meta Data Manager
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
baseScore: 7.5
baseSeverity: HIGH
Credits: lang: en
value: Francesco Carlucci
Published: 2023-10-28T11:06:03.537Z
CVE-2023-5427 Mali GPU Kernel Driver allows improper GPU processing operations
Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r44p0 through r45p0; Valhall GPU Kernel Driver: from r44p0 through r45p0; Arm 5th Gen GPU Architecture Kernel Driver: from r44p0 through r45p0.
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: Arm Ltd
product: Bifrost GPU Kernel Driver
default_status: unaffected
vendor: Arm Ltd
product: Valhall GPU Kernel Driver
default_status: unaffected
vendor: Arm Ltd
product: Arm 5th Gen GPU Architecture Kernel  Driver
default_status: unaffected
Published: 2023-12-01T10:13:49.299Z
CVE-2023-5428 Image vertical reel scroll slideshow <= 9.0 -  Authenticated (Subscriber+) SQL Injection via Shortcode
The Image vertical reel scroll slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 9.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: gopiplus
product: Image vertical reel scroll slideshow
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: István Márton
Published: 2023-10-31T08:32:47.779Z