stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2022-44610 (severity: HIGH, weakness: CWE-287)
Improper authentication in the Intel(R) DCM software before version 5.1 may allow an authenticated user to potentially enable escalation of privilege via network access.
CVE-2022-44611 (severity: HIGH, weakness: CWE-20)
Improper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via adjacent access.
CVE-2022-44612 (severity: MEDIUM, weakness: CWE-798)
Use of hard-coded credentials in some Intel(R) Unison(TM) software before version 10.12 may allow an authenticated user user to potentially enable information disclosure via local access.
CVE-2022-44617 (severity: HIGH, weakness: CWE-20)
A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in the application linked to the library.
CVE-2022-44619 (severity: HIGH, weakness: CWE-922)
Insecure storage of sensitive information in the Intel(R) DCM software before version 5.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2022-4462 (severity: MEDIUM, weakness: NVD-CWE-Other)
An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. This vulnerability could allow a user to unmask the Discord Webhook URL through viewing the raw API response.
CVE-2022-44620 (severity: HIGH, weakness: CWE-287)
Improper authentication vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings.
CVE-2022-44621 (severity: CRITICAL, weakness: CWE-77)
Diagnosis Controller miss parameter validation, so user may attacked by command injection via HTTP Request.
CVE-2022-44622 (severity: MEDIUM, weakness: CWE-284)
In JetBrains TeamCity version between 2021.2 and 2022.10 access permissions for secure token health items were excessive
CVE-2022-44623 (severity: HIGH, weakness: CWE-538)
In JetBrains TeamCity version before 2022.10, Project Viewer could see scrambled secure values in the MetaRunner settings
CVE-2022-44624 (severity: HIGH, weakness: CWE-532)
In JetBrains TeamCity version before 2022.10, Password parameters could be exposed in the build log if they contained special characters
CVE-2022-44625 (severity: MEDIUM, weakness: CWE-79)
Auth. (admin+) Stored Cross-Site Scripting') vulnerability in Zephilou Cyklodev WP Notify plugin <= 1.2.1 versions.
CVE-2022-44626 (severity: MEDIUM, weakness: CWE-862)
Missing Authorization vulnerability in Squirrly SEO Plugin by Squirrly SEO.This issue affects SEO Plugin by Squirrly SEO: from n/a through 12.1.20.
CVE-2022-44627 (severity: MEDIUM, weakness: CWE-352)
Cross-Site Request Forgery (CSRF) vulnerability in David Cole Simple SEO plugin <= 1.8.12 on WordPress allows attackers to create or delete sitemaps.
CVE-2022-44628 (severity: MEDIUM, weakness: CWE-79)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in JumpDEMAND Inc. 4ECPS Web Forms plugin <= 0.2.17 on WordPress.
CVE-2022-44629 (severity: MEDIUM, weakness: CWE-79)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Catalyst Connect Catalyst Connect Zoho CRM Client Portal plugin <= 2.0.0 versions.
CVE-2022-44631 (severity: MEDIUM, weakness: CWE-79)
Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in 1app Technologies, Inc 1app Business Forms plugin <= 1.0.0 versions.
CVE-2022-44632 (severity: MEDIUM, weakness: CWE-79)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Denis Buka Content Repeater – Custom Posts Simplified plugin <= 1.1.13 versions.
CVE-2022-44633 (severity: MEDIUM, weakness: CWE-862)
Missing Authorization vulnerability in YITH YITH WooCommerce Gift Cards Premium.This issue affects YITH WooCommerce Gift Cards Premium: from n/a through 3.23.1.
CVE-2022-44634 (severity: MEDIUM, weakness: CWE-552)
Auth. (admin+) Arbitrary File Read vulnerability in S2W – Import Shopify to WooCommerce plugin <= 1.1.12 on WordPress.
CVE-2022-44635 (severity: HIGH, weakness: CWE-22)
Apache Fineract allowed an authenticated user to perform remote code execution due to a path traversal vulnerability in a file upload component of Apache Fineract, allowing an attacker to run remote code. This issue affects Apache Fineract version 1.8.0 and prior versions. We recommend users to upgrade to 1.8.1.
CVE-2022-44636 (severity: MEDIUM, weakness: CWE-290)
The Samsung TV (2021 and 2022 model) smart remote control allows attackers to enable microphone access via Bluetooth spoofing when a user is activating remote control by pressing a button. This is fixed in xxx72510, E9172511 for 2021 models, xxxA1000, 4x2A0200 for 2022 models.
CVE-2022-44637 (severity: MEDIUM, weakness: CWE-79)
Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization in Redcloth3 Textile-formatted fields. Depending on the configuration, this may require login as a registered user.
CVE-2022-44638 (severity: HIGH, weakness: CWE-190)
In libpixman in Pixman before 0.42.2, there is an out-of-bounds write (aka heap-based buffer overflow) in rasterize_edges_8 due to an integer overflow in pixman_sample_floor_y.
CVE-2022-4464 (severity: MEDIUM, weakness: NVD-CWE-Other)
Themify Portfolio Post WordPress plugin before 1.2.1 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high privileged users such as admin.
CVE-2022-44640 (severity: CRITICAL, weakness: CWE-415)
Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the ASN.1 codec used by the Key Distribution Center (KDC).
CVE-2022-44641 (severity: MEDIUM, weakness: CWE-776)
In Linaro Automated Validation Architecture (LAVA) before 2022.11, users with valid credentials can submit crafted XMLRPC requests that cause a recursive XML entity expansion, leading to excessive use of memory on the server and a Denial of Service.
CVE-2022-44643 (severity: HIGH, weakness: CWE-284)
A vulnerability in the label-based access control of Grafana Labs Grafana Enterprise Metrics allows an attacker more access than intended. If an access policy which has label selector restrictions also has been granted access to all tenants in the system, the label selector restrictions will not be applied when using this policy with the affected versions of the software. This issue affects: Grafana Labs Grafana Enterprise Metrics GEM 1.X versions prior to 1.7.1 on AMD64; GEM 2.X versions prior to 2.3.1 on AMD64.
CVE-2022-44644 (severity: MEDIUM, weakness: CWE-20)
In Apache Linkis <=1.3.0 when used with the MySQL Connector/J in the data source module, an authenticated attacker could read arbitrary local files by connecting a rogue MySQL server, By adding allowLoadLocalInfile to true in the JDBC parameter. Therefore, the parameters in the JDBC URL should be blacklisted. Versions of Apache Linkis <= 1.3.0 will be affected. We recommend users upgrade the version of Linkis to version 1.3.1
CVE-2022-44645 (severity: HIGH, weakness: CWE-502)
In Apache Linkis <=1.3.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attacker has write access to a database and configures new datasource with a MySQL data source and malicious parameters. Therefore, the parameters in the jdbc url should be blacklisted. Versions of Apache Linkis <= 1.3.0 will be affected. We recommend users to upgrade the version of Linkis to version 1.3.1.
CVE-2022-44646 (severity: MEDIUM, weakness: CWE-223)
In JetBrains TeamCity version before 2022.10, no audit items were added upon editing a user's settings
CVE-2022-44647 (severity: MEDIUM, weakness: CWE-125)
An Out-of-bounds read vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to disclose sensitive information on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This is similar to, but not the same as CVE-2022-44648.
CVE-2022-44648 (severity: MEDIUM, weakness: CWE-125)
An Out-of-bounds read vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to disclose sensitive information on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This is similar to, but not the same as CVE-2022-44647.
CVE-2022-44649 (severity: HIGH, weakness: CWE-787)
An out-of-bounds access vulnerability in the Unauthorized Change Prevention service of Trend Micro Apex One and Apex One as a Service could allow a local attacker to elevate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVE-2022-4465 (severity: MEDIUM, weakness: NVD-CWE-Other)
The WP Video Lightbox WordPress plugin before 1.9.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
CVE-2022-44650 (severity: HIGH, weakness: CWE-787)
A memory corruption vulnerability in the Unauthorized Change Prevention service of Trend Micro Apex One and Apex One as a Service could allow a local attacker to elevate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVE-2022-44651 (severity: HIGH, weakness: CWE-367)
A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVE-2022-44652 (severity: HIGH, weakness: CWE-755)
An improper handling of exceptional conditions vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVE-2022-44653 (severity: HIGH, weakness: CWE-22)
A security agent directory traversal vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVE-2022-44654 (severity: HIGH, weakness: CWE-122)
Affected builds of Trend Micro Apex One and Apex One as a Service contain a monitor engine component that is complied without the /SAFESEH memory protection mechanism which helps to monitor for malicious payloads. The affected component's memory protection mechanism has been updated to enhance product security.
CVE-2022-4466 (severity: MEDIUM, weakness: CWE-79)
The WordPress Infinite Scroll WordPress plugin before 5.6.0.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVE-2022-44666 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Contacts Remote Code Execution Vulnerability
CVE-2022-44667 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Media Remote Code Execution Vulnerability
CVE-2022-44668 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Media Remote Code Execution Vulnerability
CVE-2022-44669 (severity: HIGH, weakness: CWE-362)
Windows Error Reporting Elevation of Privilege Vulnerability
CVE-2022-4467 (severity: MEDIUM, weakness: NVD-CWE-Other)
The Search & Filter WordPress plugin before 1.2.16 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
CVE-2022-44670 (severity: HIGH, weakness: CWE-367)
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
CVE-2022-44671 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Graphics Component Elevation of Privilege Vulnerability
CVE-2022-44673 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability
CVE-2022-44674 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Bluetooth Driver Information Disclosure Vulnerability
CVE-2022-44675 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Bluetooth Driver Elevation of Privilege Vulnerability
CVE-2022-44676 (severity: HIGH, weakness: CWE-362)
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
CVE-2022-44677 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Projected File System Elevation of Privilege Vulnerability
CVE-2022-44678 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Print Spooler Elevation of Privilege Vulnerability
CVE-2022-44679 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Graphics Component Information Disclosure Vulnerability
CVE-2022-4468 (severity: MEDIUM, weakness: NVD-CWE-Other)
The WP Recipe Maker WordPress plugin before 8.6.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
CVE-2022-44680 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Graphics Component Elevation of Privilege Vulnerability
CVE-2022-44681 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Print Spooler Elevation of Privilege Vulnerability
CVE-2022-44682 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Hyper-V Denial of Service Vulnerability
CVE-2022-44683 (severity: HIGH, weakness: CWE-416)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2022-44684 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Local Session Manager (LSM) Denial of Service Vulnerability
CVE-2022-44687 (severity: HIGH, weakness: NVD-CWE-Other)
Raw Image Extension Remote Code Execution Vulnerability
CVE-2022-44688 (severity: MEDIUM, weakness: NVD-CWE-Other)
Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2022-44689 (severity: HIGH, weakness: CWE-269)
Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability
CVE-2022-4469 (severity: MEDIUM, weakness: NVD-CWE-Other)
The Simple Membership WordPress plugin before 4.2.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
CVE-2022-44690 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2022-44691 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Office OneNote Remote Code Execution Vulnerability
CVE-2022-44692 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Office Graphics Remote Code Execution Vulnerability
CVE-2022-44693 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2022-44694 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Office Visio Remote Code Execution Vulnerability
CVE-2022-44695 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Office Visio Remote Code Execution Vulnerability
CVE-2022-44696 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Office Visio Remote Code Execution Vulnerability
CVE-2022-44697 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Graphics Component Elevation of Privilege Vulnerability
CVE-2022-44698 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows SmartScreen Security Feature Bypass Vulnerability
CVE-2022-44699 (severity: MEDIUM, weakness: NVD-CWE-Other)
Azure Network Watcher Agent Security Feature Bypass Vulnerability
CVE-2022-4470 (severity: MEDIUM, weakness: NVD-CWE-Other)
The Widgets for Google Reviews WordPress plugin before 9.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVE-2022-44702 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Terminal Remote Code Execution Vulnerability
CVE-2022-44704 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Windows System Monitor (Sysmon) Elevation of Privilege Vulnerability
CVE-2022-44707 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Kernel Denial of Service Vulnerability
CVE-2022-44708 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2022-4471 (severity: MEDIUM, weakness: NVD-CWE-Other)
The YARPP WordPress plugin before 5.30.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVE-2022-44710 (severity: HIGH, weakness: NVD-CWE-Other)
DirectX Graphics Kernel Elevation of Privilege Vulnerability
CVE-2022-44713 (severity: HIGH, weakness: CWE-290)
Microsoft Outlook for Mac Spoofing Vulnerability
CVE-2022-44715 (severity: HIGH, weakness: CWE-732)
Improper File Permissions in NetScout nGeniusONE 6.3.2 build 904 allows authenticated remote users to gain permissions via a crafted payload.
CVE-2022-44717 (severity: LOW, weakness: CWE-601)
An issue was discovered in NetScout nGeniusONE 6.3.2 build 904. Open Redirection can occur (issue 1 of 2). After successful login, an attacker must visit the vulnerable parameter and inject a crafted payload to successfully redirect to an unknown host. The attack vector is Network, and the Attack Complexity required is High. Privileges required are administrator, User Interaction is required, and Scope is unchanged. The user must visit the vulnerable parameter and inject a crafted payload to successfully redirect to an unknown host.
CVE-2022-44718 (severity: LOW, weakness: CWE-601)
An issue was discovered in NetScout nGeniusONE 6.3.2 build 904. Open Redirection can occur (issue 2 of 2). After successful login, an attacker must visit the vulnerable parameter and inject a crafted payload to successfully redirect to an unknown host. The attack vector is Network, and the Attack Complexity required is High. Privileges required are administrator, User Interaction is required, and Scope is unchanged. The user must visit the vulnerable parameter and inject a crafted payload to successfully redirect to an unknown host.
CVE-2022-44719 (severity: HIGH, weakness: CWE-732)
An issue was discovered in Weblib Ucopia before 6.0.13. The SSH Server has Insecure Permissions.
CVE-2022-4472 (severity: MEDIUM, weakness: NVD-CWE-Other)
The Simple Sitemap WordPress plugin before 3.5.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVE-2022-44720 (severity: CRITICAL, weakness: CWE-78)
An issue was discovered in Weblib Ucopia before 6.0.13. OS Command Injection injection can occur, related to chroot.
CVE-2022-44724 (severity: MEDIUM, weakness: CWE-79)
The Handy Tip macro in Stiltsoft Handy Macros for Confluence Server/Data Center 3.x before 3.5.5 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability.
CVE-2022-44725 (severity: HIGH, weakness: CWE-732)
OPC Foundation Local Discovery Server (LDS) through 1.04.403.478 uses a hard-coded file path to a configuration file. This allows a normal user to create a malicious file that is loaded by LDS (running as a high-privilege user).
CVE-2022-44726 (severity: MEDIUM, weakness: CWE-79)
The TouchDown Timesheet tracking component 4.1.4 for Jira allows XSS in the calendar view.
CVE-2022-44727 (severity: CRITICAL, weakness: CWE-89)
The EU Cookie Law GDPR (Banner + Blocker) module before 2.1.3 for PrestaShop allows SQL Injection via a cookie ( lgcookieslaw or __lglaw ).
CVE-2022-44729 (severity: HIGH, weakness: CWE-918)
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.
CVE-2022-4473 (severity: MEDIUM, weakness: NVD-CWE-Other)
The Widget Shortcode WordPress plugin through 0.3.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVE-2022-44730 (severity: MEDIUM, weakness: CWE-918)
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. A malicious SVG can probe user profile / data and send it directly as parameter to a URL.
CVE-2022-44731 (severity: MEDIUM, weakness: CWE-88)
A vulnerability has been identified in SIMATIC WinCC OA V3.15 (All versions < V3.15 P038), SIMATIC WinCC OA V3.16 (All versions < V3.16 P035), SIMATIC WinCC OA V3.17 (All versions < V3.17 P024), SIMATIC WinCC OA V3.18 (All versions < V3.18 P014). The affected component allows to inject custom arguments to the Ultralight Client backend application under certain circumstances. This could allow an authenticated remote attacker to inject arbitrary parameters when starting the client via the web interface (e.g., open attacker chosen panels with the attacker's credentials or start a Ctrl script).
CVE-2022-44732 (severity: HIGH, weakness: CWE-269)
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39900.
CVE-2022-44733 (severity: HIGH, weakness: CWE-269)
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39900.
CVE-2022-44734 (severity: MEDIUM, weakness: CWE-79)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in BestWebSoft Car Rental by BestWebSoft plugin <= 1.1.2 versions.
CVE-2022-44735 (severity: MEDIUM, weakness: CWE-79)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gus Sevilla WP Clictracker plugin <= 1.0.5 versions.
CVE-2022-44736 (severity: MEDIUM, weakness: CWE-79)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Chameleon plugin <= 1.4.3 on WordPress.
CVE-2022-44737 (severity: HIGH, weakness: CWE-352)
Multiple Cross-Site Request Forgery vulnerabilities in All-In-One Security (AIOS) – Security and Firewall (WordPress plugin) <= 5.1.0 on WordPress.
CVE-2022-44738 (severity: HIGH, weakness: CWE-1236)
Improper Neutralization of Formula Elements in a CSV File vulnerability in Patrick Robrecht Posts and Users Stats.This issue affects Posts and Users Stats: from n/a through 1.1.3.