stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2023-29863 (severity: CRITICAL, weakness: CWE-89)
Medical Systems Co. Medisys Weblab Products v19.4.03 was discovered to contain a SQL injection vulnerability via the tem:statement parameter in the WSDL files.
CVE-2023-29867 (severity: MEDIUM, weakness: CWE-346)
Zammad 5.3.x (Fixed 5.4.0) is vulnerable to Incorrect Access Control. An authenticated attacker could gain information about linked accounts of users involved in their tickets using the Zammad API.
CVE-2023-29868 (severity: MEDIUM, weakness: CWE-346)
Zammad 5.3.x (Fixed in 5.4.0) is vulnerable to Incorrect Access Control. An authenticated attacker with agent and customer roles could perform unauthorized changes on articles where they only have customer permissions.
CVE-2023-2987 (severity: CRITICAL, weakness: CWE-345)
The Wordapp plugin for WordPress is vulnerable to authorization bypass due to an use of insufficiently unique cryptographic signature on the 'wa_pdx_op_config_set' function in versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to the plugin to change the 'validation_token' in the plugin config, providing access to the plugin's remote control functionalities, such as creating an admin access URL, which can be used for privilege escalation.
CVE-2023-29881 (severity: MEDIUM, weakness: CWE-89)
phpok 6.4.003 is vulnerable to SQL injection in the function index_f() in phpok64/framework/api/call_control.php.
CVE-2023-29887 (severity: HIGH, weakness: CWE-22)
A Local File inclusion vulnerability in test.php in spreadsheet-reader 0.5.11 allows remote attackers to include arbitrary files via the File parameter.
CVE-2023-2989 (severity: CRITICAL, weakness: CWE-125)
Fortra Globalscape EFT versions before 8.1.0.16 suffer from an out of bounds memory read in their administration server, which can allow an attacker to crash the service or bypass authentication if successfully exploited
CVE-2023-2990 (severity: HIGH, weakness: CWE-400)
Fortra Globalscape EFT versions before 8.1.0.16 suffer from a denial of service vulnerability, where a compressed message that decompresses to itself can cause infinite recursion and crash the service
CVE-2023-29905 (severity: MEDIUM, weakness: CWE-787)
H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the UpdateSnat interface at /goform/aspForm.
CVE-2023-29906 (severity: MEDIUM, weakness: CWE-787)
H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the Edit_BasicSSID interface at /goform/aspForm.
CVE-2023-29907 (severity: MEDIUM, weakness: CWE-787)
H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the Edit_BasicSSID_5G interface at /goform/aspForm.
CVE-2023-29908 (severity: MEDIUM, weakness: CWE-787)
H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the SetMobileAPInfoById interface at /goform/aspForm.
CVE-2023-29909 (severity: MEDIUM, weakness: CWE-787)
H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the AddWlanMacList interface at /goform/aspForm.
CVE-2023-2991 (severity: MEDIUM, weakness: CWE-200)
Fortra Globalscape EFT's administration server suffers from an information disclosure vulnerability where the serial number of the harddrive that Globalscape is installed on can be remotely determined via a "trial extension request" message
CVE-2023-29910 (severity: MEDIUM, weakness: CWE-787)
H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the UpdateMacClone interface at /goform/aspForm.
CVE-2023-29911 (severity: MEDIUM, weakness: CWE-787)
H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the AddMacList interface at /goform/aspForm.
CVE-2023-29912 (severity: MEDIUM, weakness: CWE-787)
H3C Magic R200 R200V100R004 was discovered to contain a stack overflow via the DelvsList interface at /goform/aspForm.
CVE-2023-29913 (severity: MEDIUM, weakness: CWE-787)
H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the SetAPWifiorLedInfoById interface at /goform/aspForm.
CVE-2023-29914 (severity: MEDIUM, weakness: CWE-787)
H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the DeltriggerList interface at /goform/aspForm.
CVE-2023-29915 (severity: MEDIUM, weakness: CWE-787)
H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via CMD parameter at /goform/aspForm.
CVE-2023-29916 (severity: MEDIUM, weakness: CWE-787)
H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the UpdateWanParams interface at /goform/aspForm.
CVE-2023-29917 (severity: MEDIUM, weakness: CWE-787)
H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via go parameter at /goform/aspForm.
CVE-2023-29918 (severity: MEDIUM, weakness: CWE-1236)
RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module.
CVE-2023-29919 (severity: CRITICAL, weakness: CWE-276)
SolarView Compact <= 6.0 is vulnerable to Insecure Permissions. Any file on the server can be read or modified because texteditor.php is not restricted.
CVE-2023-2992 (severity: HIGH, weakness: CWE-405)
An unauthenticated denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which can be triggered under crafted conditions. Rebooting SMM or FPC will restore access to the management web server.
CVE-2023-29921 (severity: MEDIUM, weakness: CWE-284)
PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create app interface.
CVE-2023-29922 (severity: MEDIUM, weakness: CWE-284)
PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create user/save interface.
CVE-2023-29923 (severity: MEDIUM, weakness: CWE-276)
PowerJob V4.3.1 is vulnerable to Insecure Permissions. via the list job interface.
CVE-2023-29924 (severity: CRITICAL, weakness: CWE-284)
PowerJob V4.3.1 is vulnerable to Incorrect Access Control that allows for remote code execution.
CVE-2023-29926 (severity: CRITICAL, weakness: NVD-CWE-Other)
PowerJob V4.3.2 has unauthorized interface that causes remote code execution.
CVE-2023-29927 (severity: MEDIUM, weakness: CWE-863)
Versions of Sage 300 through 2022 implement role-based access controls that are only enforced client-side. Low-privileged Sage users, particularly those on a workstation setup in the "Windows Peer-to-Peer Network" or "Client Server Network" Sage 300 configurations, could recover the SQL connection strings being used by Sage 300 and interact directly with the underlying database(s) to create, update, and delete all company records, bypassing the program’s role-based access controls.
CVE-2023-29929 (severity: HIGH, weakness: CWE-787)
Buffer Overflow vulnerability found in Kemptechnologies Loadmaster before v.7.2.60.0 allows a remote attacker to casue a denial of service via the libkemplink.so, isreverse library.
CVE-2023-2993 (severity: MEDIUM, weakness: CWE-281)
A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands on SMM v1, SMM v2, and FPC that the user does not normally have sufficient privileges to execute.
CVE-2023-29930 (severity: HIGH, weakness: CWE-434)
An issue was found in Genesys CIC Polycom phone provisioning TFTP Server all version allows a remote attacker to execute arbitrary code via the login crednetials to the TFTP server configuration page.
CVE-2023-29931 (severity: CRITICAL, weakness: CWE-552)
laravel-s 3.7.35 is vulnerable to Local File Inclusion via /src/Illuminate/Laravel.php.
CVE-2023-29932 (severity: MEDIUM, weakness: CWE-119)
llvm-project commit fdbc55a5 was discovered to contain a segmentation fault via the component mlir::IROperand<mlir::OpOperand.
CVE-2023-29933 (severity: MEDIUM, weakness: CWE-125)
llvm-project commit bd456297 was discovered to contain a segmentation fault via the component mlir::Block::getArgument.
CVE-2023-29934 (severity: MEDIUM, weakness: CWE-125)
llvm-project commit 6c01b5c was discovered to contain a segmentation fault via the component mlir::Type::getDialect().
CVE-2023-29935 (severity: MEDIUM, weakness: CWE-617)
llvm-project commit a0138390 was discovered to contain an assertion failure at !replacements.count(op) && "operation was already replaced.
CVE-2023-29939 (severity: MEDIUM, weakness: CWE-125)
llvm-project commit a0138390 was discovered to contain a segmentation fault via the component mlir::spirv::TargetEnv::TargetEnv(mlir::spirv::TargetEnvAttr).
CVE-2023-29941 (severity: MEDIUM, weakness: CWE-125)
llvm-project commit a0138390 was discovered to contain a segmentation fault via the component matchAndRewriteSortOp<mlir::sparse_tensor::SortOp>(mlir::sparse_tensor::SortOp.
CVE-2023-29942 (severity: MEDIUM, weakness: CWE-125)
llvm-project commit a0138390 was discovered to contain a segmentation fault via the component mlir::Type::isa<mlir::LLVM::LLVMVoidType.
CVE-2023-29944 (severity: CRITICAL, weakness: CWE-78)
Metersphere v1.20.20-lts-79d354a6 is vulnerable to Remote Command Execution. The system command reverse-shell can be executed at the custom code snippet function of the metersphere system workbench
CVE-2023-2995 (severity: MEDIUM, weakness: NVD-CWE-Other)
The Leyka WordPress plugin before 3.30.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2023-29950 (severity: MEDIUM, weakness: CWE-787)
swfrender v0.9.2 was discovered to contain a heap buffer overflow in the function enumerateUsedIDs_fillstyle at modules/swftools.c
CVE-2023-2996 (severity: HIGH, weakness: NVD-CWE-Other)
The Jetpack WordPress plugin before 12.1.1 does not validate uploaded files, allowing users with author roles or above to manipulate existing files on the site, deleting arbitrary files, and in rare cases achieve Remote Code Execution via phar deserialization.
CVE-2023-29961 (severity: CRITICAL, weakness: CWE-787)
D-Link DIR-605L firmware version 1.17B01 BETA is vulnerable to stack overflow via /goform/formTcpipSetup,
CVE-2023-29962 (severity: MEDIUM, weakness: CWE-22)
S-CMS v5.0 was discovered to contain an arbitrary file read vulnerability.
CVE-2023-29963 (severity: HIGH, weakness: CWE-94)
S-CMS v5.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /admin/ajax.php.
CVE-2023-29973 (severity: MEDIUM, weakness: CWE-770)
Pfsense CE version 2.6.0 is vulnerable to No rate limit which can lead to an attacker creating multiple malicious users in firewall.
CVE-2023-29974 (severity: CRITICAL, weakness: CWE-521)
An issue discovered in Pfsense CE version 2.6.0 allows attackers to compromise user accounts via weak password requirements.
CVE-2023-29975 (severity: HIGH, weakness: CWE-287)
An issue discovered in Pfsense CE version 2.6.0 allows attackers to change the password of any user without verification.
CVE-2023-2998 (severity: MEDIUM, weakness: CWE-79)
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.14.
CVE-2023-29983 (severity: MEDIUM, weakness: CWE-79)
Cross Site Scripting vulnerability found in Maximilian Vogt cmaps v.8.0 allows a remote attacker to execute arbitrary code via the auditlog tab in the admin panel.
CVE-2023-29984 (severity: HIGH, weakness: CWE-476)
Null pointer dereference vulnerability exists in multiple vendors MFPs and printers which implement Debut web server 1.2 or 1.3. Processing a specially crafted request may lead an affected product to a denial-of-service (DoS) condition. As for the affected products/models/versions, see the detailed information provided by each vendor.
CVE-2023-29985 (severity: CRITICAL, weakness: CWE-89)
Sourcecodester Student Study Center Desk Management System v1.0 admin\reports\index.php#date_from has a SQL Injection vulnerability.
CVE-2023-29986 (severity: MEDIUM, weakness: CWE-22)
spring-boot-actuator-logview 0.2.13 allows Directory Traversal to sibling directories via LogViewEndpoint.view.
CVE-2023-2999 (severity: MEDIUM, weakness: CWE-79)
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.14.
CVE-2023-29994 (severity: HIGH, weakness: CWE-787)
In NanoMQ v0.15.0-0, Heap overflow occurs in read_byte function of mqtt_code.c.
CVE-2023-29995 (severity: HIGH, weakness: CWE-787)
In NanoMQ v0.15.0-0, a Heap overflow occurs in copyn_utf8_str function of mqtt_parser.c
CVE-2023-29996 (severity: HIGH, weakness: CWE-476)
In NanoMQ v0.15.0-0, segment fault with Null Pointer Dereference occurs in the process of decoding subinfo_decode and unsubinfo_decode.
CVE-2023-29998 (severity: MEDIUM, weakness: CWE-79)
A Cross-site scripting (XSS) vulnerability in the content editor in Gis3W g3w-suite 3.5 allows remote authenticated users to inject arbitrary web script or HTML and gain privileges via the description parameter.
CVE-2023-3000 (severity: CRITICAL, weakness: CWE-89)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Erikoglu Technology ErMon allows Command Line Execution through SQL Injection, Authentication Bypass.This issue affects ErMon: before 230602.
CVE-2023-3001 (severity: HIGH, weakness: CWE-502)
A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious payload data, potentially leading to remote code execution when an attacker gets the user to open a malicious file.
CVE-2023-30013 (severity: CRITICAL, weakness: CWE-78)
TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg. This vulnerability allows an attacker to execute arbitrary commands through the "command" parameter.
CVE-2023-30014 (severity: CRITICAL, weakness: CWE-89)
SQL Injection vulnerability in oretnom23 Judging Management System v1.0, allows remote attackers to execute arbitrary code and obtain sensitive information via sub_event_id parameter in sub_event_stat_update.php.
CVE-2023-30015 (severity: CRITICAL, weakness: CWE-89)
SQL Injection vulnerability in oretnom23 Judging Management System v1.0, allows remote attackers to execute arbitrary code and obtain sensitive information via txtsearch parameter in review_search.php.
CVE-2023-30016 (severity: CRITICAL, weakness: CWE-89)
SQL Injection vulnerability in oretnom23 Judging Management System v1.0, allows remote attackers to execute arbitrary code and obtain sensitive information via sub_event_id parameter in sub_event_details_edit.php.
CVE-2023-30018 (severity: CRITICAL, weakness: CWE-89)
Judging Management System v1.0 is vulnerable to SQL Injection. via /php-jms/review_se_result.php?mainevent_id=.
CVE-2023-30019 (severity: MEDIUM, weakness: CWE-918)
imgproxy <=3.14.0 is vulnerable to Server-Side Request Forgery (SSRF) due to a lack of sanitization of the imageURL parameter.
CVE-2023-30024 (severity: MEDIUM, weakness: CWE-269)
The MagicJack device, a VoIP solution for internet phone calls, contains a hidden NAND flash memory partition allowing unauthorized read/write access. Attackers can exploit this by replacing the original software with a malicious version, leading to ransomware deployment on the host computer. Affected devices have firmware versions prior to magicJack A921 USB Phone Jack Rev 3.0 V1.4.
CVE-2023-3003 (severity: CRITICAL, weakness: CWE-89)
A vulnerability classified as critical was found in SourceCodester Train Station Ticketing System 1.0. Affected by this vulnerability is an unknown functionality of the file manage_prices.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-230347.
CVE-2023-3004 (severity: CRITICAL, weakness: CWE-89)
A vulnerability, which was classified as critical, has been found in SourceCodester Simple Chat System 1.0. Affected by this issue is some unknown functionality of the file /ajax.php?action=read_msg of the component POST Parameter Handler. The manipulation of the argument convo_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-230348.
CVE-2023-3005 (severity: MEDIUM, weakness: CWE-79)
A vulnerability, which was classified as problematic, was found in SourceCodester Local Service Search Engine Management System 1.0. This affects an unknown part of the file /admin/ajax.php?action=save_area of the component POST Parameter Handler. The manipulation of the argument area with the input <script>alert(document.cookie)</script> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-230349 was assigned to this vulnerability.
CVE-2023-30053 (severity: CRITICAL, weakness: CWE-78)
TOTOLINK A7100RU V7.4cu.2313_B20191024 is vulnerable to Command Injection.
CVE-2023-30054 (severity: CRITICAL, weakness: CWE-78)
TOTOLINK A7100RU V7.4cu.2313_B20191024 has a Command Injection vulnerability. An attacker can obtain a stable root shell through a specially constructed payload.
CVE-2023-30056 (severity: HIGH, weakness: CWE-384)
A session takeover vulnerability exists in FICO Origination Manager Decision Module 4.8.1 due to insufficient protection of the JSESSIONID cookie.
CVE-2023-30057 (severity: MEDIUM, weakness: CWE-79)
Multiple stored cross-site scripting (XSS) vulnerabilities in FICO Origination Manager Decision Module 4.8.1 allow attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVE-2023-30058 (severity: CRITICAL, weakness: CWE-89)
novel-plus 3.6.2 is vulnerable to SQL Injection.
CVE-2023-3006 (severity: MEDIUM, weakness: CWE-226)
A known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, becomes actual again for the new hw AmpereOne. Spectre-BHB is similar to Spectre v2, except that malicious code uses the shared branch history (stored in the CPU Branch History Buffer, or BHB) to influence mispredicted branches within the victim's hardware context. Once that occurs, speculation caused by the mispredicted branches can cause cache allocation. This issue leads to obtaining information that should not be accessible.
CVE-2023-30061 (severity: HIGH, weakness: CWE-287)
D-Link DIR-879 v105A1 is vulnerable to Authentication Bypass via phpcgi.
CVE-2023-30063 (severity: HIGH, weakness: CWE-287)
D-Link DIR-890L FW1.10 A1 is vulnerable to Authentication bypass.
CVE-2023-30065 (severity: HIGH, weakness: NVD-CWE-Other)
MitraStar GPT-2741GNAC-N2 with firmware BR_g5.9_1.11(WVK.0)b32 was discovered to contain a remote code execution (RCE) vulnerability in the ping function.
CVE-2023-3007 (severity: CRITICAL, weakness: CWE-640)
A vulnerability was found in ningzichun Student Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file resetPassword.php of the component Password Reset Handler. The manipulation of the argument sid leads to weak password recovery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-230354 is the identifier assigned to this vulnerability.
CVE-2023-30076 (severity: CRITICAL, weakness: CWE-89)
Sourcecodester Judging Management System v1.0 is vulnerable to SQL Injection via /php-jms/print_judges.php?print_judges.php=&se_name=&sub_event_id=.
CVE-2023-30077 (severity: CRITICAL, weakness: CWE-89)
Judging Management System v1.0 by oretnom23 was discovered to vulnerable to SQL injection via /php-jms/review_result.php?mainevent_id=, mainevent_id.
CVE-2023-3008 (severity: CRITICAL, weakness: CWE-89)
A vulnerability classified as critical has been found in ningzichun Student Management System 1.0. This affects an unknown part of the file login.php. The manipulation of the argument user/pass leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-230355.
CVE-2023-30082 (severity: HIGH, weakness: CWE-1284)
A denial of service attack might be launched against the server if an unusually lengthy password (more than 10000000 characters) is supplied using the osTicket application. This can cause the website to go down or stop responding. When a long password is entered, this procedure will consume all available CPU and memory.
CVE-2023-30083 (severity: MEDIUM, weakness: CWE-120)
Buffer Overflow vulnerability found in Libming swftophp v.0.4.8 allows a local attacker to cause a denial of service via the newVar_N in util/decompile.c.
CVE-2023-30084 (severity: MEDIUM, weakness: CWE-125)
An issue found in libming swftophp v.0.4.8 allows a local attacker to cause a denial of service via the stackVal function in util/decompile.c.
CVE-2023-30085 (severity: MEDIUM, weakness: CWE-120)
Buffer Overflow vulnerability found in Libming swftophp v.0.4.8 allows a local attacker to cause a denial of service via the cws2fws function in util/decompile.c.
CVE-2023-30086 (severity: MEDIUM, weakness: CWE-787)
Buffer Overflow vulnerability found in Libtiff V.4.0.7 allows a local attacker to cause a denial of service via the tiffcp function in tiffcp.c.
CVE-2023-30087 (severity: MEDIUM, weakness: CWE-787)
Buffer Overflow vulnerability found in Cesanta MJS v.1.26 allows a local attacker to cause a denial of service via the mjs_mk_string function in mjs.c.
CVE-2023-30088 (severity: MEDIUM, weakness: CWE-119)
An issue found in Cesanta MJS v.1.26 allows a local attacker to cause a denial of service via the mjs_execute function in mjs.c.
CVE-2023-3009 (severity: HIGH, weakness: CWE-79)
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
CVE-2023-30090 (severity: CRITICAL, weakness: CWE-434)
Semcms Shop v4.2 was discovered to contain an arbitrary file uplaod vulnerability via the component SEMCMS_Upfile.php. This vulnerability allows attackers to execute arbitrary code via uploading a crafted PHP file.
CVE-2023-30092 (severity: CRITICAL, weakness: CWE-89)
SourceCodester Online Pizza Ordering System v1.0 is vulnerable to SQL Injection via the QTY parameter.
CVE-2023-30093 (severity: MEDIUM, weakness: CWE-79)
A cross-site scripting (XSS) vulnerability in Open Networking Foundation ONOS from version v1.9.0 to v2.7.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the url parameter of the API documentation dashboard.
CVE-2023-30094 (severity: MEDIUM, weakness: CWE-79)
A stored cross-site scripting (XSS) vulnerability in TotalJS Flow v10 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the platform name field in the settings module.
CVE-2023-30095 (severity: MEDIUM, weakness: CWE-79)
A stored cross-site scripting (XSS) vulnerability in TotalJS messenger commit b6cf1c9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the channel description field.
CVE-2023-30096 (severity: MEDIUM, weakness: CWE-79)
A stored cross-site scripting (XSS) vulnerability in TotalJS messenger commit b6cf1c9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the user information field.
CVE-2023-30097 (severity: MEDIUM, weakness: CWE-79)
A stored cross-site scripting (XSS) vulnerability in TotalJS messenger commit b6cf1c9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the private task field.
CVE-2023-3010 (severity: MEDIUM, weakness: CWE-79)
Grafana is an open-source platform for monitoring and observability. The WorldMap panel plugin, versions before 1.0.4 contains a DOM XSS vulnerability.
CVE-2023-30106 (severity: MEDIUM, weakness: CWE-79)
Sourcecodester Medicine Tracker System in PHP 1.0.0 is vulnerable to Cross Site Scripting (XSS) via page=about.