Auto-Update: 2023-12-04T23:00:18.346086+00:00

2025-07-09 16:05:11 +00:00 · 2023-12-04 23:00:21 +00:00 · 2023-12-04 23:00:21 +00:00 · 6e69013a9d
commit 6e69013a9d
parent cb66e815b9
21 changed files with 617 additions and 30 deletions
--- a/CVE-2023/CVE-2023-44xx/CVE-2023-4460.json
+++ b/CVE-2023/CVE-2023-44xx/CVE-2023-4460.json
@ -0,0 +1,20 @@
+{
+  "id": "CVE-2023-4460",
+  "sourceIdentifier": "contact@wpscan.com",
+  "published": "2023-12-04T22:15:07.557",
+  "lastModified": "2023-12-04T22:15:07.557",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "The Uploading SVG, WEBP and ICO files WordPress plugin through 1.2.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads."
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://wpscan.com/vulnerability/82f8d425-449a-471f-94df-8439924fd628",
+      "source": "contact@wpscan.com"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-471xx/CVE-2023-47106.json
+++ b/CVE-2023/CVE-2023-471xx/CVE-2023-47106.json
@ -0,0 +1,67 @@
+{
+  "id": "CVE-2023-47106",
+  "sourceIdentifier": "security-advisories@github.com",
+  "published": "2023-12-04T21:15:33.600",
+  "lastModified": "2023-12-04T21:15:33.600",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "Traefik is an open source HTTP reverse proxy and load balancer. When a request is sent to Traefik with a URL fragment, Traefik automatically URL encodes and forwards the fragment to the backend server. This violates RFC 7230 because in the origin-form the URL should only contain the absolute path and the query. When this is combined with another frontend proxy like Nginx, it can be used to bypass frontend proxy URI-based access control restrictions. This vulnerability has been addressed in versions 2.10.6 and 3.0.0-beta5. Users are advised to upgrade. There are no known workarounds for this vulnerability."
+    }
+  ],
+  "metrics": {
+    "cvssMetricV31": [
+      {
+        "source": "security-advisories@github.com",
+        "type": "Secondary",
+        "cvssData": {
+          "version": "3.1",
+          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
+          "attackVector": "NETWORK",
+          "attackComplexity": "HIGH",
+          "privilegesRequired": "NONE",
+          "userInteraction": "NONE",
+          "scope": "UNCHANGED",
+          "confidentialityImpact": "LOW",
+          "integrityImpact": "LOW",
+          "availabilityImpact": "NONE",
+          "baseScore": 4.8,
+          "baseSeverity": "MEDIUM"
+        },
+        "exploitabilityScore": 2.2,
+        "impactScore": 2.5
+      }
+    ]
+  },
+  "weaknesses": [
+    {
+      "source": "security-advisories@github.com",
+      "type": "Primary",
+      "description": [
+        {
+          "lang": "en",
+          "value": "CWE-20"
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "url": "https://datatracker.ietf.org/doc/html/rfc7230#section-5.3.1",
+      "source": "security-advisories@github.com"
+    },
+    {
+      "url": "https://github.com/traefik/traefik/releases/tag/v2.10.6",
+      "source": "security-advisories@github.com"
+    },
+    {
+      "url": "https://github.com/traefik/traefik/releases/tag/v3.0.0-beta5",
+      "source": "security-advisories@github.com"
+    },
+    {
+      "url": "https://github.com/traefik/traefik/security/advisories/GHSA-fvhj-4qfh-q2hm",
+      "source": "security-advisories@github.com"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-471xx/CVE-2023-47124.json
+++ b/CVE-2023/CVE-2023-471xx/CVE-2023-47124.json
@ -0,0 +1,79 @@
+{
+  "id": "CVE-2023-47124",
+  "sourceIdentifier": "security-advisories@github.com",
+  "published": "2023-12-04T21:15:33.850",
+  "lastModified": "2023-12-04T21:15:33.850",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "Traefik is an open source HTTP reverse proxy and load balancer. When Traefik is configured to use the `HTTPChallenge` to generate and renew the Let's Encrypt TLS certificates, the delay authorized to solve the challenge (50 seconds) can be exploited by attackers to achieve a `slowloris attack`. This vulnerability has been patch in version 2.10.6 and 3.0.0-beta5. Users are advised to upgrade. Users unable to upgrade should replace the `HTTPChallenge` with the `TLSChallenge` or the `DNSChallenge`."
+    }
+  ],
+  "metrics": {
+    "cvssMetricV31": [
+      {
+        "source": "security-advisories@github.com",
+        "type": "Secondary",
+        "cvssData": {
+          "version": "3.1",
+          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
+          "attackVector": "NETWORK",
+          "attackComplexity": "HIGH",
+          "privilegesRequired": "NONE",
+          "userInteraction": "NONE",
+          "scope": "UNCHANGED",
+          "confidentialityImpact": "NONE",
+          "integrityImpact": "NONE",
+          "availabilityImpact": "HIGH",
+          "baseScore": 5.9,
+          "baseSeverity": "MEDIUM"
+        },
+        "exploitabilityScore": 2.2,
+        "impactScore": 3.6
+      }
+    ]
+  },
+  "weaknesses": [
+    {
+      "source": "security-advisories@github.com",
+      "type": "Primary",
+      "description": [
+        {
+          "lang": "en",
+          "value": "CWE-772"
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "url": "https://doc.traefik.io/traefik/https/acme/#dnschallenge",
+      "source": "security-advisories@github.com"
+    },
+    {
+      "url": "https://doc.traefik.io/traefik/https/acme/#httpchallenge",
+      "source": "security-advisories@github.com"
+    },
+    {
+      "url": "https://doc.traefik.io/traefik/https/acme/#tlschallenge",
+      "source": "security-advisories@github.com"
+    },
+    {
+      "url": "https://github.com/traefik/traefik/releases/tag/v2.10.6",
+      "source": "security-advisories@github.com"
+    },
+    {
+      "url": "https://github.com/traefik/traefik/releases/tag/v3.0.0-beta5",
+      "source": "security-advisories@github.com"
+    },
+    {
+      "url": "https://github.com/traefik/traefik/security/advisories/GHSA-8g85-whqh-cr2f",
+      "source": "security-advisories@github.com"
+    },
+    {
+      "url": "ttps://www.cloudflare.com/learning/ddos/ddos-attack-tools/slowloris/",
+      "source": "security-advisories@github.com"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-476xx/CVE-2023-47633.json
+++ b/CVE-2023/CVE-2023-476xx/CVE-2023-47633.json
@ -0,0 +1,63 @@
+{
+  "id": "CVE-2023-47633",
+  "sourceIdentifier": "security-advisories@github.com",
+  "published": "2023-12-04T21:15:34.063",
+  "lastModified": "2023-12-04T21:15:34.063",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "Traefik is an open source HTTP reverse proxy and load balancer. The traefik docker container uses 100% CPU when it serves as its own backend, which is an automatically generated route resulting from the Docker integration in the default configuration. This issue has been addressed in versions 2.10.6 and 3.0.0-beta5. Users are advised to upgrade. There are no known workarounds for this vulnerability."
+    }
+  ],
+  "metrics": {
+    "cvssMetricV31": [
+      {
+        "source": "security-advisories@github.com",
+        "type": "Secondary",
+        "cvssData": {
+          "version": "3.1",
+          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+          "attackVector": "NETWORK",
+          "attackComplexity": "LOW",
+          "privilegesRequired": "NONE",
+          "userInteraction": "NONE",
+          "scope": "UNCHANGED",
+          "confidentialityImpact": "NONE",
+          "integrityImpact": "NONE",
+          "availabilityImpact": "HIGH",
+          "baseScore": 7.5,
+          "baseSeverity": "HIGH"
+        },
+        "exploitabilityScore": 3.9,
+        "impactScore": 3.6
+      }
+    ]
+  },
+  "weaknesses": [
+    {
+      "source": "security-advisories@github.com",
+      "type": "Primary",
+      "description": [
+        {
+          "lang": "en",
+          "value": "CWE-400"
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "url": "https://github.com/traefik/traefik/releases/tag/v2.10.6",
+      "source": "security-advisories@github.com"
+    },
+    {
+      "url": "https://github.com/traefik/traefik/releases/tag/v3.0.0-beta5",
+      "source": "security-advisories@github.com"
+    },
+    {
+      "url": "https://github.com/traefik/traefik/security/advisories/GHSA-6fwg-jrfw-ff7p",
+      "source": "security-advisories@github.com"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-490xx/CVE-2023-49080.json
+++ b/CVE-2023/CVE-2023-490xx/CVE-2023-49080.json
@ -0,0 +1,59 @@
+{
+  "id": "CVE-2023-49080",
+  "sourceIdentifier": "security-advisories@github.com",
+  "published": "2023-12-04T21:15:34.273",
+  "lastModified": "2023-12-04T21:15:34.273",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. Unhandled errors in API requests coming from an authenticated user include traceback information, which can include path information. There is no known mechanism by which to trigger these errors without authentication, so the paths revealed are not considered particularly sensitive, given that the requesting user has arbitrary execution permissions already in the same environment. A fix has been introduced in commit `0056c3aa52` which no longer includes traceback information in JSON error responses. For compatibility, the traceback field is present, but always empty. This commit has been included in version 2.11.2. Users are advised to upgrade. There are no known workarounds for this vulnerability."
+    }
+  ],
+  "metrics": {
+    "cvssMetricV31": [
+      {
+        "source": "security-advisories@github.com",
+        "type": "Secondary",
+        "cvssData": {
+          "version": "3.1",
+          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
+          "attackVector": "NETWORK",
+          "attackComplexity": "LOW",
+          "privilegesRequired": "LOW",
+          "userInteraction": "REQUIRED",
+          "scope": "UNCHANGED",
+          "confidentialityImpact": "LOW",
+          "integrityImpact": "NONE",
+          "availabilityImpact": "NONE",
+          "baseScore": 3.5,
+          "baseSeverity": "LOW"
+        },
+        "exploitabilityScore": 2.1,
+        "impactScore": 1.4
+      }
+    ]
+  },
+  "weaknesses": [
+    {
+      "source": "security-advisories@github.com",
+      "type": "Primary",
+      "description": [
+        {
+          "lang": "en",
+          "value": "CWE-209"
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "url": "https://github.com/jupyter-server/jupyter_server/commit/0056c3aa52cbb28b263a7a609ae5f17618b36652",
+      "source": "security-advisories@github.com"
+    },
+    {
+      "url": "https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-h56g-gq9v-vc8r",
+      "source": "security-advisories@github.com"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-51xx/CVE-2023-5105.json
+++ b/CVE-2023/CVE-2023-51xx/CVE-2023-5105.json
@ -0,0 +1,20 @@
+{
+  "id": "CVE-2023-5105",
+  "sourceIdentifier": "contact@wpscan.com",
+  "published": "2023-12-04T22:15:07.620",
+  "lastModified": "2023-12-04T22:15:07.620",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "The Frontend File Manager Plugin WordPress plugin before 22.6 has a vulnerability that allows an Editor+ user to bypass the file download logic and download files such as `wp-config.php`"
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://wpscan.com/vulnerability/d40c7108-bad6-4ed3-8539-35c0f57e62cc",
+      "source": "contact@wpscan.com"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-51xx/CVE-2023-5108.json
+++ b/CVE-2023/CVE-2023-51xx/CVE-2023-5108.json
@ -0,0 +1,20 @@
+{
+  "id": "CVE-2023-5108",
+  "sourceIdentifier": "contact@wpscan.com",
+  "published": "2023-12-04T22:15:07.667",
+  "lastModified": "2023-12-04T22:15:07.667",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "The Easy Newsletter Signups WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin"
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://wpscan.com/vulnerability/1b277929-e88b-4ab6-9190-526e75f5ce7a",
+      "source": "contact@wpscan.com"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-51xx/CVE-2023-5137.json
+++ b/CVE-2023/CVE-2023-51xx/CVE-2023-5137.json
@ -0,0 +1,20 @@
+{
+  "id": "CVE-2023-5137",
+  "sourceIdentifier": "contact@wpscan.com",
+  "published": "2023-12-04T22:15:07.713",
+  "lastModified": "2023-12-04T22:15:07.713",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "The Simply Excerpts WordPress plugin through 1.4 does not sanitize and escape some fields in the plugin settings, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup)."
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://wpscan.com/vulnerability/79b79e9c-ea4f-4188-a1b5-61dda0b5d434",
+      "source": "contact@wpscan.com"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-51xx/CVE-2023-5141.json
+++ b/CVE-2023/CVE-2023-51xx/CVE-2023-5141.json
@ -0,0 +1,20 @@
+{
+  "id": "CVE-2023-5141",
+  "sourceIdentifier": "contact@wpscan.com",
+  "published": "2023-12-04T22:15:07.767",
+  "lastModified": "2023-12-04T22:15:07.767",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "The BSK Contact Form 7 Blacklist WordPress plugin through 1.0.1 does not sanitise and escape the inserted_count parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin"
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://wpscan.com/vulnerability/9997fe8d-8027-4ae0-9885-a1f5565f2d1a",
+      "source": "contact@wpscan.com"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-52xx/CVE-2023-5210.json
+++ b/CVE-2023/CVE-2023-52xx/CVE-2023-5210.json
@ -0,0 +1,20 @@
+{
+  "id": "CVE-2023-5210",
+  "sourceIdentifier": "contact@wpscan.com",
+  "published": "2023-12-04T22:15:07.813",
+  "lastModified": "2023-12-04T22:15:07.813",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "The AMP+ Plus WordPress plugin through 3.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin"
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://wpscan.com/vulnerability/1c3ff47a-12a5-49c1-a166-2c57e5c0d0aa",
+      "source": "contact@wpscan.com"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-57xx/CVE-2023-5762.json
+++ b/CVE-2023/CVE-2023-57xx/CVE-2023-5762.json
@ -0,0 +1,20 @@
+{
+  "id": "CVE-2023-5762",
+  "sourceIdentifier": "contact@wpscan.com",
+  "published": "2023-12-04T22:15:07.867",
+  "lastModified": "2023-12-04T22:15:07.867",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "The Filr WordPress plugin before 1.2.3.6 is vulnerable from an RCE (Remote Code Execution) vulnerability, which allows the operating system to execute commands and fully compromise the server on behalf of a user with Author-level privileges."
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://wpscan.com/vulnerability/6ad99725-eccc-4b61-bce2-668b62619deb",
+      "source": "contact@wpscan.com"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-58xx/CVE-2023-5809.json
+++ b/CVE-2023/CVE-2023-58xx/CVE-2023-5809.json
@ -0,0 +1,20 @@
+{
+  "id": "CVE-2023-5809",
+  "sourceIdentifier": "contact@wpscan.com",
+  "published": "2023-12-04T22:15:07.920",
+  "lastModified": "2023-12-04T22:15:07.920",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)"
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://wpscan.com/vulnerability/f1eb05e8-1b7c-45b1-912d-f668bd68e265",
+      "source": "contact@wpscan.com"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-58xx/CVE-2023-5874.json
+++ b/CVE-2023/CVE-2023-58xx/CVE-2023-5874.json
@ -0,0 +1,20 @@
+{
+  "id": "CVE-2023-5874",
+  "sourceIdentifier": "contact@wpscan.com",
+  "published": "2023-12-04T22:15:07.970",
+  "lastModified": "2023-12-04T22:15:07.970",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)"
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://wpscan.com/vulnerability/ebe3e873-1259-43b9-a027-daa4dbd937f3",
+      "source": "contact@wpscan.com"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-58xx/CVE-2023-5884.json
+++ b/CVE-2023/CVE-2023-58xx/CVE-2023-5884.json
@ -0,0 +1,20 @@
+{
+  "id": "CVE-2023-5884",
+  "sourceIdentifier": "contact@wpscan.com",
+  "published": "2023-12-04T22:15:08.020",
+  "lastModified": "2023-12-04T22:15:08.020",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "The Word Balloon WordPress plugin before 4.20.3 does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to trick a logged in user to delete arbitrary avatars by clicking a link."
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://wpscan.com/vulnerability/f4a7937c-6f4b-49dd-b88a-67ebe718ad19",
+      "source": "contact@wpscan.com"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-59xx/CVE-2023-5951.json
+++ b/CVE-2023/CVE-2023-59xx/CVE-2023-5951.json
@ -0,0 +1,20 @@
+{
+  "id": "CVE-2023-5951",
+  "sourceIdentifier": "contact@wpscan.com",
+  "published": "2023-12-04T22:15:08.063",
+  "lastModified": "2023-12-04T22:15:08.063",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "The Welcart e-Commerce WordPress plugin before 2.9.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin"
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://wpscan.com/vulnerability/81dc093a-545d-4bcd-ab85-ee9472d709e5",
+      "source": "contact@wpscan.com"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-59xx/CVE-2023-5952.json
+++ b/CVE-2023/CVE-2023-59xx/CVE-2023-5952.json
@ -0,0 +1,20 @@
+{
+  "id": "CVE-2023-5952",
+  "sourceIdentifier": "contact@wpscan.com",
+  "published": "2023-12-04T22:15:08.117",
+  "lastModified": "2023-12-04T22:15:08.117",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "The Welcart e-Commerce WordPress plugin before 2.9.5 unserializes user input from cookies, which could allow unautehtniacted users to perform PHP Object Injection when a suitable gadget is present on the blog"
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://wpscan.com/vulnerability/0acd613e-dbd6-42ae-9f3d-6d6e77a4c1b7",
+      "source": "contact@wpscan.com"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-59xx/CVE-2023-5953.json
+++ b/CVE-2023/CVE-2023-59xx/CVE-2023-5953.json
@ -0,0 +1,20 @@
+{
+  "id": "CVE-2023-5953",
+  "sourceIdentifier": "contact@wpscan.com",
+  "published": "2023-12-04T22:15:08.170",
+  "lastModified": "2023-12-04T22:15:08.170",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "The Welcart e-Commerce WordPress plugin before 2.9.5 does not validate files to be uploaded, as well as does not have authorisation and CSRF in an AJAX action handling such upload. As a result, any authenticated users, such as subscriber could upload arbitrary files, such as PHP on the server"
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://wpscan.com/vulnerability/6d29ba12-f14a-4cee-baae-a6049d83bce6",
+      "source": "contact@wpscan.com"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-59xx/CVE-2023-5979.json
+++ b/CVE-2023/CVE-2023-59xx/CVE-2023-5979.json
@ -0,0 +1,20 @@
+{
+  "id": "CVE-2023-5979",
+  "sourceIdentifier": "contact@wpscan.com",
+  "published": "2023-12-04T22:15:08.220",
+  "lastModified": "2023-12-04T22:15:08.220",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "The eCommerce Product Catalog Plugin for WordPress plugin before 3.3.26 does not have CSRF checks in some of its admin pages, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks, such as delete all products"
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://wpscan.com/vulnerability/936934c3-5bfe-416e-b6aa-47bed4db05c4",
+      "source": "contact@wpscan.com"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-59xx/CVE-2023-5990.json
+++ b/CVE-2023/CVE-2023-59xx/CVE-2023-5990.json
@ -0,0 +1,20 @@
+{
+  "id": "CVE-2023-5990",
+  "sourceIdentifier": "contact@wpscan.com",
+  "published": "2023-12-04T22:15:08.293",
+  "lastModified": "2023-12-04T22:15:08.293",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor WordPress plugin before 3.4.2 does not have CSRF checks on some of its form actions such as deletion and duplication, which could allow attackers to make logged in admin perform such actions via CSRF attacks"
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://wpscan.com/vulnerability/0a615ce3-93da-459d-a33f-a2a6e74a2f94",
+      "source": "contact@wpscan.com"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-60xx/CVE-2023-6063.json
+++ b/CVE-2023/CVE-2023-60xx/CVE-2023-6063.json
@ -0,0 +1,24 @@
+{
+  "id": "CVE-2023-6063",
+  "sourceIdentifier": "contact@wpscan.com",
+  "published": "2023-12-04T22:15:08.337",
+  "lastModified": "2023-12-04T22:15:08.337",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "The WP Fastest Cache WordPress plugin before 1.2.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users."
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://wpscan.com/blog/unauthenticated-sql-injection-vulnerability-addressed-in-wp-fastest-cache-1-2-2/",
+      "source": "contact@wpscan.com"
+    },
+    {
+      "url": "https://wpscan.com/vulnerability/30a74105-8ade-4198-abe2-1c6f2967443e",
+      "source": "contact@wpscan.com"
+    }
+  ]
+}
--- a/README.md
+++ b/README.md
@ -9,13 +9,13 @@ Repository synchronizes with the NVD every 2 hours.
 ### Last Repository Update

 ```plain
-2023-12-04T21:00:18.770109+00:00
+2023-12-04T23:00:18.346086+00:00
 ```

 ### Most recent CVE Modification Timestamp synchronized with NVD

 ```plain
-2023-12-04T19:59:51.297000+00:00
+2023-12-04T22:15:08.337000+00:00
 ```

 ### Last Data Feed Release
@ -29,44 +29,39 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/
 ### Total Number of included CVEs

 ```plain
-232143
+232163
 ```

 ### CVEs added in the last Commit

-Recently added CVEs: `0`
+Recently added CVEs: `20`

+* [CVE-2023-47106](CVE-2023/CVE-2023-471xx/CVE-2023-47106.json) (`2023-12-04T21:15:33.600`)
+* [CVE-2023-47124](CVE-2023/CVE-2023-471xx/CVE-2023-47124.json) (`2023-12-04T21:15:33.850`)
+* [CVE-2023-47633](CVE-2023/CVE-2023-476xx/CVE-2023-47633.json) (`2023-12-04T21:15:34.063`)
+* [CVE-2023-49080](CVE-2023/CVE-2023-490xx/CVE-2023-49080.json) (`2023-12-04T21:15:34.273`)
+* [CVE-2023-4460](CVE-2023/CVE-2023-44xx/CVE-2023-4460.json) (`2023-12-04T22:15:07.557`)
+* [CVE-2023-5105](CVE-2023/CVE-2023-51xx/CVE-2023-5105.json) (`2023-12-04T22:15:07.620`)
+* [CVE-2023-5108](CVE-2023/CVE-2023-51xx/CVE-2023-5108.json) (`2023-12-04T22:15:07.667`)
+* [CVE-2023-5137](CVE-2023/CVE-2023-51xx/CVE-2023-5137.json) (`2023-12-04T22:15:07.713`)
+* [CVE-2023-5141](CVE-2023/CVE-2023-51xx/CVE-2023-5141.json) (`2023-12-04T22:15:07.767`)
+* [CVE-2023-5210](CVE-2023/CVE-2023-52xx/CVE-2023-5210.json) (`2023-12-04T22:15:07.813`)
+* [CVE-2023-5762](CVE-2023/CVE-2023-57xx/CVE-2023-5762.json) (`2023-12-04T22:15:07.867`)
+* [CVE-2023-5809](CVE-2023/CVE-2023-58xx/CVE-2023-5809.json) (`2023-12-04T22:15:07.920`)
+* [CVE-2023-5874](CVE-2023/CVE-2023-58xx/CVE-2023-5874.json) (`2023-12-04T22:15:07.970`)
+* [CVE-2023-5884](CVE-2023/CVE-2023-58xx/CVE-2023-5884.json) (`2023-12-04T22:15:08.020`)
+* [CVE-2023-5951](CVE-2023/CVE-2023-59xx/CVE-2023-5951.json) (`2023-12-04T22:15:08.063`)
+* [CVE-2023-5952](CVE-2023/CVE-2023-59xx/CVE-2023-5952.json) (`2023-12-04T22:15:08.117`)
+* [CVE-2023-5953](CVE-2023/CVE-2023-59xx/CVE-2023-5953.json) (`2023-12-04T22:15:08.170`)
+* [CVE-2023-5979](CVE-2023/CVE-2023-59xx/CVE-2023-5979.json) (`2023-12-04T22:15:08.220`)
+* [CVE-2023-5990](CVE-2023/CVE-2023-59xx/CVE-2023-5990.json) (`2023-12-04T22:15:08.293`)
+* [CVE-2023-6063](CVE-2023/CVE-2023-60xx/CVE-2023-6063.json) (`2023-12-04T22:15:08.337`)


 ### CVEs modified in the last Commit

-Recently modified CVEs: `25`
+Recently modified CVEs: `0`

-* [CVE-2022-41678](CVE-2022/CVE-2022-416xx/CVE-2022-41678.json) (`2023-12-04T19:08:39.233`)
-* [CVE-2023-45286](CVE-2023/CVE-2023-452xx/CVE-2023-45286.json) (`2023-12-04T19:01:33.467`)
-* [CVE-2023-42502](CVE-2023/CVE-2023-425xx/CVE-2023-42502.json) (`2023-12-04T19:01:54.147`)
-* [CVE-2023-49314](CVE-2023/CVE-2023-493xx/CVE-2023-49314.json) (`2023-12-04T19:02:47.373`)
-* [CVE-2023-49313](CVE-2023/CVE-2023-493xx/CVE-2023-49313.json) (`2023-12-04T19:04:54.647`)
-* [CVE-2023-48848](CVE-2023/CVE-2023-488xx/CVE-2023-48848.json) (`2023-12-04T19:05:42.390`)
-* [CVE-2023-6239](CVE-2023/CVE-2023-62xx/CVE-2023-6239.json) (`2023-12-04T19:06:20.213`)
-* [CVE-2023-46589](CVE-2023/CVE-2023-465xx/CVE-2023-46589.json) (`2023-12-04T19:11:01.663`)
-* [CVE-2023-41264](CVE-2023/CVE-2023-412xx/CVE-2023-41264.json) (`2023-12-04T19:17:54.180`)
-* [CVE-2023-29060](CVE-2023/CVE-2023-290xx/CVE-2023-29060.json) (`2023-12-04T19:20:46.467`)
-* [CVE-2023-48121](CVE-2023/CVE-2023-481xx/CVE-2023-48121.json) (`2023-12-04T19:25:28.723`)
-* [CVE-2023-6201](CVE-2023/CVE-2023-62xx/CVE-2023-6201.json) (`2023-12-04T19:29:50.227`)
-* [CVE-2023-45539](CVE-2023/CVE-2023-455xx/CVE-2023-45539.json) (`2023-12-04T19:32:37.217`)
-* [CVE-2023-46944](CVE-2023/CVE-2023-469xx/CVE-2023-46944.json) (`2023-12-04T19:39:27.447`)
-* [CVE-2023-5981](CVE-2023/CVE-2023-59xx/CVE-2023-5981.json) (`2023-12-04T19:40:21.277`)
-* [CVE-2023-49062](CVE-2023/CVE-2023-490xx/CVE-2023-49062.json) (`2023-12-04T19:46:20.953`)
-* [CVE-2023-42004](CVE-2023/CVE-2023-420xx/CVE-2023-42004.json) (`2023-12-04T19:46:40.343`)
-* [CVE-2023-29061](CVE-2023/CVE-2023-290xx/CVE-2023-29061.json) (`2023-12-04T19:52:25.550`)
-* [CVE-2023-29062](CVE-2023/CVE-2023-290xx/CVE-2023-29062.json) (`2023-12-04T19:55:58.290`)
-* [CVE-2023-6151](CVE-2023/CVE-2023-61xx/CVE-2023-6151.json) (`2023-12-04T19:56:17.810`)
-* [CVE-2023-6150](CVE-2023/CVE-2023-61xx/CVE-2023-6150.json) (`2023-12-04T19:56:53.050`)
-* [CVE-2023-29063](CVE-2023/CVE-2023-290xx/CVE-2023-29063.json) (`2023-12-04T19:57:56.117`)
-* [CVE-2023-34055](CVE-2023/CVE-2023-340xx/CVE-2023-34055.json) (`2023-12-04T19:58:14.227`)
-* [CVE-2023-34054](CVE-2023/CVE-2023-340xx/CVE-2023-34054.json) (`2023-12-04T19:59:30.713`)
-* [CVE-2023-34053](CVE-2023/CVE-2023-340xx/CVE-2023-34053.json) (`2023-12-04T19:59:51.297`)


 ## Download and Usage