rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-44690 
Inadequate encryption strength in mycli 1.27.0 allows attackers to view sensitive information via /mycli/config.py
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-19T00:00:00.000Z
CVE-2023-44693 
D-Link Online behavior audit gateway DAR-7000 V31R02B1413C is vulnerable to SQL Injection via /importexport.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-17T00:00:00.000Z
CVE-2023-44694 
D-Link Online behavior audit gateway DAR-7000 V31R02B1413C is vulnerable to SQL Injection via /log/mailrecvview.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-17T00:00:00.000Z
CVE-2023-44709 
PlutoSVG commit 336c02997277a1888e6ccbbbe674551a0582e5c4 and before was discovered to contain an integer overflow via the component plutosvg_load_from_memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-14T00:00:00.000Z
CVE-2023-44752 
An issue in Student Study Center Desk Management System v1.0 allows attackers to bypass authentication via a crafted GET request to /php-sscdms/admin/login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-22T00:00:00.000Z
CVE-2023-44753 
A stored cross-site scripting (XSS) vulnerability fin Student Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email parameter on the profile.php page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-22T00:00:00.000Z
CVE-2023-44755 
Sacco Management system v1.0 was discovered to contain a SQL injection vulnerability via the password parameter at /sacco/ajax.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-22T00:00:00.000Z
CVE-2023-44758 
GDidees CMS 3.0 is affected by a Cross-Site Scripting (XSS) vulnerability that allows attackers to execute arbitrary code via a crafted payload to the Page Title.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-06T00:00:00.000Z
CVE-2023-44760 
Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS v.9.2.1 allow an attacker to execute arbitrary code via a crafted script to the Header and Footer Tracking Codes of the SEO & Statistics. NOTE: the vendor disputes this because these header/footer changes can only be made by an admin, and allowing an admin to place JavaScript there is an intentional customization feature. Also, the exploitation method claimed by "sromanhu" does not provide any access to a Concrete CMS session, because the Concrete CMS session cookie is configured as HttpOnly.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-23T00:00:00.000Z
CVE-2023-44761 
Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS versions affected to 8.5.13 and below, and 9.0.0 through 9.2.1 allow a local attacker to execute arbitrary code via a crafted script to the Forms of the Data objects.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-06T00:00:00.000Z
CVE-2023-44762 
A Cross Site Scripting (XSS) vulnerability in Concrete CMS from versions 9.2.0 to 9.2.2 allows an attacker to execute arbitrary code via a crafted script to the Tags from Settings - Tags.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-06T00:00:00.000Z
CVE-2023-44763 
Concrete CMS v9.2.1 is affected by an Arbitrary File Upload vulnerability via a Thumbnail file upload, which allows Cross-Site Scripting (XSS). NOTE: the vendor's position is that a customer is supposed to know that "pdf" should be excluded from the allowed file types, even though pdf is one of the allowed file types in the default configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-10T00:00:00.000Z
CVE-2023-44764 
A Cross Site Scripting (XSS) vulnerability in Concrete CMS before 9.2.3 exists via the Name parameter during installation (aka Site of Installation or Settings).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-06T00:00:00.000Z
CVE-2023-44765 
A Cross Site Scripting (XSS) vulnerability in Concrete CMS versions 8.5.12 and below, and 9.0 through 9.2.1 allows an attacker to execute arbitrary code via a crafted script to Plural Handle of the Data Objects from System & Settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-06T00:00:00.000Z
CVE-2023-44766 
A Cross Site Scripting (XSS) vulnerability in Concrete CMS v.9.2.1 allows an attacker to execute arbitrary code via a crafted script to the SEO - Extra from Page Settings. NOTE: the vendor disputes this because this SEO-related header change can only be made by an admin, and allowing an admin to place JavaScript there is an intentional customization feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-06T00:00:00.000Z
CVE-2023-44767 
A File upload vulnerability in RiteCMS 3.0 allows a local attacker to upload a SVG file with XSS content.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-24T00:00:00.000Z
CVE-2023-44769 
A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted script to the Spare aliases from Alias.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-24T00:00:00.000Z
CVE-2023-44770 
A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows an attacker to execute arbitrary code via a crafted script to the Organizer - Spare alias.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-06T00:00:00.000Z
CVE-2023-44771 
A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted script to the Page Layout.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-06T00:00:00.000Z
CVE-2023-44794 
An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to escalate privileges via a crafted payload to the URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-44796 
Cross Site Scripting (XSS) vulnerability in LimeSurvey before version 6.2.9-230925 allows a remote attacker to escalate privileges via a crafted script to the _generaloptions_panel.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-17T00:00:00.000Z
CVE-2023-44807 
D-Link DIR-820L 1.05B03 has a stack overflow vulnerability in the cancelPing function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-06T00:00:00.000Z
CVE-2023-44808 
D-Link DIR-820L 1.05B03 has a stack overflow vulnerability in the sub_4507CC function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-16T00:00:00.000Z
CVE-2023-44809 
D-Link device DIR-820L 1.05B03 is vulnerable to Insecure Permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-16T00:00:00.000Z
CVE-2023-44811 
Cross Site Request Forgery (CSRF) vulnerability in MooSocial v.3.1.8 allows a remote attacker to execute arbitrary code and obtain sensitive information via the admin Password Change Function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-09T00:00:00.000Z
CVE-2023-44812 
Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to the admin_redirect_url parameter of the user login function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-09T00:00:00.000Z
CVE-2023-44813 
Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to the mode parameter of the invite friend login function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-09T00:00:00.000Z
CVE-2023-44821 
Gifsicle through 1.94, if deployed in a way that allows untrusted input to affect Gif_Realloc calls, might allow a denial of service (memory consumption). NOTE: this has been disputed by multiple parties because the Gifsicle code is not commonly used for unattended operation in which new input arrives for a long-running process, does not ship with functionality to link it into another application as a library, and does not have realistic use cases in which an adversary controls the entire command line.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-09T00:00:00.000Z
CVE-2023-44824 
An issue in Expense Management System v.1.0 allows a local attacker to execute arbitrary code via a crafted file uploaded to the sign-up.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-17T00:00:00.000Z
CVE-2023-44826 
Cross Site Scripting vulnerability in ZenTaoPMS v.18.6 allows a local attacker to obtain sensitive information via a crafted script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-10T00:00:00.000Z
CVE-2023-44827 
An issue in ZenTao Community Edition v.18.6 and before, ZenTao Biz v.8.6 and before, ZenTao Max v.4.7 and before allows an attacker to execute arbitrary code via a crafted script to the Office Conversion Settings function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-10T00:00:00.000Z
CVE-2023-44828 
D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the CurrentPassword parameter in the CheckPasswdSettings function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-05T00:00:00.000Z
CVE-2023-44829 
D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the AdminPassword parameter in the SetDeviceSettings function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-05T00:00:00.000Z
CVE-2023-44830 
D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the EndTime parameter in the SetParentsControlInfo function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-05T00:00:00.000Z
CVE-2023-44831 
D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the Type parameter in the SetWLanRadioSettings function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-05T00:00:00.000Z
CVE-2023-44832 
D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the MacAddress parameter in the SetWanSettings function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-05T00:00:00.000Z
CVE-2023-44833 
D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the GuardInt parameter in the SetWLanRadioSettings function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-05T00:00:00.000Z
CVE-2023-44834 
D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the StartTime parameter in the SetParentsControlInfo function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-05T00:00:00.000Z
CVE-2023-44835 
D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the Mac parameter in the SetParentsControlInfo function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-05T00:00:00.000Z
CVE-2023-44836 
D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the SSID parameter in the SetWLanRadioSettings function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-05T00:00:00.000Z
CVE-2023-44837 
D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the Password parameter in the SetWanSettings function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-05T00:00:00.000Z
CVE-2023-44838 
D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the TXPower parameter in the SetWLanRadioSettings function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-05T00:00:00.000Z
CVE-2023-44839 
D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the Encryption parameter in the SetWLanRadioSecurity function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-05T00:00:00.000Z
CVE-2023-44846 
An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin_ notify.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-10T00:00:00.000Z
CVE-2023-44847 
An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin_ Weixin.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-10T00:00:00.000Z
CVE-2023-44848 
An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin_template.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-10T00:00:00.000Z
CVE-2023-44852 
Cross Site Scripting (XSS) vulnerability in Cobham SAILOR VSAT Ku v.164B019, allows a remote attacker to execute arbitrary code via a crafted script to the c_set_traps_decode function in the acu_web file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-12T00:00:00.000Z
CVE-2023-44853 
\An issue was discovered in Cobham SAILOR VSAT Ku v.164B019, allows a remote attacker to execute arbitrary code via a crafted script to the sub_219C4 function in the acu_web file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-12T00:00:00.000Z
CVE-2023-44854 
Cross Site Scripting (XSS) vulnerability in Cobham SAILOR VSAT Ku v.164B019, allows a remote attacker to execute arbitrary code via a crafted script to the c_set_rslog_decode function in the acu_web file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-12T00:00:00.000Z
CVE-2023-44855 
Cross Site Scripting (XSS) vulnerability in Cobham SAILOR VSAT Ku v.164B019 allows a remote attacker to execute arbitrary code via a crafted script to the rdiag, sender, and recipients parameters of the sub_219C4 function in the acu_web file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-12T00:00:00.000Z
CVE-2023-44856 
Cross Site Scripting (XSS) vulnerability in Cobham SAILOR VSAT Ku v.164B019, allows a remote attacker to execute arbitrary code via a crafted script to the rstat, sender, and recipients' parameters of the sub_21D24 function in the acu_web file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-12T00:00:00.000Z
CVE-2023-44857 
An issue in Cobham SAILOR VSAT Ku v.164B019, allows a remote attacker to execute arbitrary code via a crafted script to the sub_21D24 function in the acu_web component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-12T00:00:00.000Z
CVE-2023-44860 
An issue in NETIS SYSTEMS N3Mv2 v.1.0.1.865 allows a remote attacker to cause a denial of service via the authorization component in the HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-06T00:00:00.000Z
CVE-2023-44915 
A cross-site scripting (XSS) vulnerability in the component /Login.php of c3crm up to v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the login_error parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-25T00:00:00.000Z
CVE-2023-44954 
Cross Site Scripting vulnerability in BigTree CMS v.4.5.7 allows a remote attacker to execute arbitrary code via the ID parameter in the Developer Settings functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-01T00:00:00.000Z
CVE-2023-44959 
An issue found in D-Link DSL-3782 v.1.03 and before allows remote authenticated users to execute arbitrary code as root via the Router IP Address fields of the network settings page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-10T00:00:00.000Z
CVE-2023-44961 
SQL Injection vulnerability in Koha Library Software 23.0.5.04 and before allows a remote attacker to obtain sensitive information via the intranet/cgi bin/cataloging/ysearch.pl. component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-11T00:00:00.000Z
CVE-2023-44962 
File Upload vulnerability in Koha Library Software 23.05.04 and before allows a remote attacker to read arbitrary files via the upload-cover-image.pl component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-11T00:00:00.000Z
CVE-2023-44973 
An arbitrary file upload vulnerability in the component /content/templates/ of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-03T00:00:00.000Z
CVE-2023-44974 
An arbitrary file upload vulnerability in the component /admin/plugin.php of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-03T00:00:00.000Z
CVE-2023-44976 
Hangzhou Shunwang Rentdrv2 before 2024-12-24 allows local users to terminate EDR processes and possibly have unspecified other impact via DeviceIoControl with control code 0x22E010, as exploited in the wild in October 2023.
Problem types: cwe_id: CWE-782
description: CWE-782 Exposed IOCTL with Insufficient Access Control
Affected products: vendor: Hangzhou Shunwang
product: Rentdrv2
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 3.2
baseSeverity: LOW
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L
Published: 2025-08-01T00:00:00.000Z
CVE-2023-44981 Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication
Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper (quorum.auth.enableSasl=true), the authorization is done by verifying that the instance part in SASL authentication ID is listed in zoo.cfg server list. The instance part in SASL auth ID is optional and if it's missing, like 'eve@EXAMPLE.COM', the authorization check will be skipped. As a result an arbitrary endpoint could join the cluster and begin propagating counterfeit changes to the leader, essentially giving it complete read-write access to the data tree. Quorum Peer authentication is not enabled by default.

Users are recommended to upgrade to version 3.9.1, 3.8.3, 3.7.2, which fixes the issue.

Alternately ensure the ensemble election/quorum communication is protected by a firewall as this will mitigate the issue.

See the documentation for more details on correct cluster administration.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: Apache Software Foundation
product: Apache ZooKeeper
default_status: unaffected
Credits: lang: en
value: Damien Diederen <ddiederen@apache.org>
Published: 2023-10-11T11:55:47.925Z
CVE-2023-44982 WordPress WP Retina 2x Plugin <= 6.4.5 is vulnerable to Sensitive Data Exposure
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jordy Meow Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina).This issue affects Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina): from n/a through 6.4.5.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Jordy Meow
product: Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Joshua Chan (Patchstack Alliance)
Published: 2023-12-19T00:03:30.190Z
CVE-2023-44983 WordPress Aruba HiSpeed Cache Plugin <= 2.0.6 is vulnerable to Sensitive Data Exposure
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Aruba.It Aruba HiSpeed Cache.This issue affects Aruba HiSpeed Cache: from n/a through 2.0.6.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Aruba.it
product: Aruba HiSpeed Cache
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Joshua Chan (Patchstack Alliance)
Published: 2023-12-19T15:29:33.268Z
CVE-2023-44984 WordPress bbp style pack Plugin <= 5.6.7 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Robin Wilson bbp style pack plugin <= 5.6.7 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Robin Wilson
product: bbp style pack
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: NGÔ THIÊN AN / ancorn_ from VNPT-VCI (Patchstack Alliance)
Published: 2023-10-16T10:41:37.562Z