Krm1/CVE-2025 huggingface dataset:
CVE-2025-25387 (CWE-89)
CVSS 3.1 score: 7.2 (HIGH)
A SQL Injection vulnerability was found in /admin/manage-propertytype.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the propertytype POST request parameter.
CVE-2025-25388 (CWE-89)
CVSS 3.1 score: 9.8 (CRITICAL)
A SQL Injection vulnerability was found in /admin/edit-propertytype.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the editid GET request parameter.
CVE-2025-25389 (CWE-89)
CVSS 3.1 score: 9.8 (CRITICAL)
A SQL Injection vulnerability was found in /admin/forgot-password.php in Phpgurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the contactno POST request parameter.
CVE-2025-24888 (CWE-22)
CVSS 3.1 score: 8.1 (HIGH)
The SecureDrop Client is a desktop application for journalists to communicate with sources and work with submissions on the SecureDrop Workstation. Prior to version 0.14.1, a malicious SecureDrop Server could obtain code execution on the SecureDrop Client virtual machine (`sd-app`). SecureDrop Server itself has multiple layers of built-in hardening, and is a dedicated physical machine exposed on the internet only via Tor hidden services for the Source and Journalist interfaces, and optionally via remote SSH access over another Tor hidden service. A newsroom's SecureDrop Workstation communicates only with its own dedicated SecureDrop Server.

The SecureDrop Client runs in a dedicated Qubes virtual machine, named `sd-app`, as part of the SecureDrop Workstation. The private OpenPGP key used to decrypt submissions and replies is stored in a separate virtual machine and never accessed directly. The vulnerability lies in the code responsible for downloading replies. The filename of the reply is obtained from the `Content-Disposition` HTTP header and used to write the encrypted reply on disk. Note that filenames are generated and sanitized server-side, and files are downloaded in an encrypted format, so a remote attacker who has not achieved server compromise, such as one posing as a source, could not craft the HTTP response necessary for this attack.

While the filename is later checked to guard against path traversal before being moved into the Client’s data storage directory, the file has already been written to a potentially arbitrary location. In this case, `safe_move()` would detect the path traversal and fail, leaving the original downloaded file in the attacker-chosen directory. Code execution can be gained by writing an autostart file in `/home/user/.config/autostart/`.

Version 0.14.1 fixes the issue. As of time of publication, there is no known evidence of exploitation in the wild. This attack requires a previously compromised SecureDrop Server.
CVE-2025-24889 (CWE-22)
CVSS 3.1 score: 4.5 (MEDIUM)
The SecureDrop Client is a desktop application for journalists to communicate with sources and work with submissions on the SecureDrop Workstation. Prior to versions 0.14.1 and 1.0.1, an attacker who has already gained code execution in a virtual machine on the SecureDrop Workstation could gain code execution in the `sd-log` virtual machine by sending a specially crafted log entry. The vulnerability is not exploitable remotely and requires an attacker to already have code execution on one of the other virtual machines (VMs) of the system. Due to the Workstation's underlying usage of Qubes for strong isolation, the vulnerability would have allowed lateral movement between any log-enabled VM and the `sd-log` VM, but no further. The SecureDrop workstation collects logs centrally in an isolated virtual machine named `sd-log` for easy export for support and debugging purposes. The `sd-log`  VM is completely isolated from the internet and ingests logs via a narrow Qubes RPC policy that allows for specific inter-VM communication via the Xen vchan protocol used by Qubes's qrexec mechanism. A path traversal bug was found in the logic used to choose where to write the log file for a specific VM: the VM name, used unsanitized in the destination path in `sd-log`, is supplied by the logging VM itself instead of being read from a trusted source, such as the Qubes environment variable `QREXEC_REMOTE_DOMAIN` that is used in the fixed implementation. An attacker could provide an arbitrary source VM name, possibly overwriting logs of other VMs, or writing a file named `syslog.log`, with attacker-controlled content, in arbitrary directories as a low-privileged user. A successful attack could potentially overwrite or add configuration to software that loads configuration files from a directory. This is exploitable to achieve code execution by setting the target directory to `/home/user/.config/autostart/` and letting it write `syslog.log`, because XFCE treats any file in that directory as a `.desktop` file regardless of its extension. Versions 0.14.1 and 1.0.1 contain a patch for this issue.
CVE-2025-1127 (CWE-22)
CVSS 3.1 score: 9.1 (CRITICAL)
The vulnerability can be leveraged by an attacker to execute arbitrary code as an unprivileged user and/or modify the contents of any data on the filesystem.
CVE-2025-1283 (CWE-288)
CVSS 4.0 score: 9.3 (CRITICAL)
The Dingtian DT-R0 Series is vulnerable to an exploit that allows 
attackers to bypass login requirements by directly navigating to the 
main page.
CVE-2025-20615 (CWE-359)
CVSS 3.1 score: 6.2 (MEDIUM)
The Qardio Arm iOS application exposes sensitive data such as usernames 
and passwords in a plist file. This allows an attacker to log in to 
production-level development accounts and access an engineering backdoor
 in the application. The engineering backdoor allows the attacker to 
send hex-based commands over a UI-based terminal.
CVE-2025-22896 (CWE-312)
CVSS 4.0 score: 9.2 (CRITICAL)
mySCADA myPRO Manager


stores credentials in cleartext, which could allow an attacker to obtain sensitive information.
CVE-2025-23411 (CWE-352)
CVSS 4.0 score: 5.1 (MEDIUM)
mySCADA myPRO Manager
 is vulnerable to cross-site request forgery (CSRF), which could allow 
an attacker to obtain sensitive information. An attacker would need to 
trick the victim in to visiting an attacker-controlled website.
CVE-2025-23421 (CWE-552)
CVSS 4.0 score: 6.9 (MEDIUM)
An attacker could obtain firmware files and reverse engineer their 
intended use leading to loss of confidentiality and integrity of the 
hardware devices enabled by the Qardio iOS and Android applications.
CVE-2025-24836 (CWE-248)
CVSS 4.0 score: 6.1 (MEDIUM)
With a specially crafted Python script, an attacker could send 
continuous startMeasurement commands over an unencrypted Bluetooth 
connection to the affected device. This would prevent the device from 
connecting to a clinician's app to take patient readings and ostensibly 
flood it with requests, resulting in a denial-of-service condition.
CVE-2025-24861 (CWE-77)
CVSS 4.0 score: 8.7 (HIGH)
An attacker may inject commands via specially-crafted post requests.
CVE-2025-24865 (CWE-306)
CVSS 4.0 score: 10.0 (CRITICAL)
The administrative web interface of 
mySCADA myPRO Manager

can be accessed without authentication 
which could allow an unauthorized attacker to retrieve sensitive 
information and upload files without the associated password.
CVE-2025-25067 (CWE-78)
CVSS 4.0 score: 9.3 (CRITICAL)
mySCADA myPRO Manager
 
is vulnerable to an OS command injection which could allow a remote attacker to execute arbitrary OS commands.
CVE-2025-25195 (CWE-200)
CVSS 3.1 score: 4.3 (MEDIUM)
Zulip is an open source team chat application. A weekly cron job (added in 50256f48314250978f521ef439cafa704e056539) demotes channels to being "inactive" after they have not received traffic for 180 days.  However, upon doing so, an event was sent to all users in the organization, not just users in the channel.  This event contained the name of the private channel. Similarly, the same commit (50256f48314250978f521ef439cafa704e056539) added functionality to notify clients when channels stopped being "inactive."  The first message sent to a private channel which had not previously had any messages for over 180 days (and were thus already marked "inactive") would leak an event to all users in the organization; this event also contained the name of the private channel. Commits 75be449d456d29fef27e9d1828bafa30174284b4 and a2a1a7f8d152296c8966f1380872c0ac69e5c87e fixed the issue. This vulnerability only existed in `main`, and was not part of any published versions.
CVE-2025-25281 (CWE-200)
CVSS 4.0 score: 8.7 (HIGH)
An attacker may modify the URL to discover sensitive information about the target network.
CVE-2025-26473 (CWE-598)
CVSS 4.0 score: 8.7 (HIGH)
The Mojave Inverter uses the GET method for sensitive information.
CVE-2025-22960 (N/A)
CVSS N/A score: N/A (N/A)
A session hijacking vulnerability exists in the web-based management interface of GatesAir Maxiva UAXT, VAXT transmitters. Unauthenticated attackers can access exposed log files (/logs/debug/xteLog*), potentially revealing sensitive session-related information such as session IDs (sess_id) and authentication success tokens (user_check_password OK). Exploiting this flaw could allow attackers to hijack active sessions, gain unauthorized access, and escalate privileges on affected devices.
CVE-2025-22961 (N/A)
CVSS N/A score: N/A (N/A)
A critical information disclosure vulnerability exists in the web-based management interface of GatesAir Maxiva UAXT, VAXT transmitters due to Incorrect Access Control (CWE-284). Unauthenticated attackers can directly access sensitive database backup files (snapshot_users.db) via publicly exposed URLs (/logs/devcfg/snapshot/ and /logs/devcfg/user/). Exploiting this vulnerability allows retrieval of sensitive user data, including login credentials, potentially leading to full system compromise.
CVE-2025-22962 (CWE-77)
CVSS 3.1 score: 7.2 (HIGH)
A critical remote code execution (RCE) vulnerability exists in the web-based management interface of GatesAir Maxiva UAXT, VAXT transmitters when debugging mode is enabled. An attacker with a valid session ID (sess_id) can send specially crafted POST requests to the /json endpoint, enabling arbitrary command execution on the underlying system. This vulnerability can lead to full system compromise, including unauthorized access, privilege escalation, and potentially full device takeover.
CVE-2025-1053 (CWE-1295)
CVSS 4.0 score: 8.6 (HIGH)
Under certain error conditions at time of SANnav installation or upgrade, the encryption key can be written into and obtained from a Brocade SANnav supportsave.  An attacker with privileged access to the Brocade SANnav database could use the encryption key to obtain passwords used by Brocade SANnav.
CVE-2025-26519 (CWE-787)
CVSS 3.1 score: 8.1 (HIGH)
musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.
CVE-2025-23406 (CWE-125)
CVSS 3.0 score: 5.3 (MEDIUM)
Out-of-bounds read vulnerability caused by improper checking of TCP MSS option values exists in Cente middleware TCP/IP Network Series, which may lead to processing a specially crafted packet to cause the affected product crashed.
CVE-2025-22630 (CWE-77)
CVSS 3.1 score: 9.9 (CRITICAL)
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in MarketingFire Widget Options allows OS Command Injection.This issue affects Widget Options: from n/a through 4.1.0.
CVE-2025-1298 (CWE-287)
CVSS 3.1 score: 9.8 (CRITICAL)
Logic vulnerability in the mobile application (com.transsion.carlcare) may lead to the risk of account takeover.
CVE-2025-26788 (CWE-639)
CVSS 3.1 score: 8.4 (HIGH)
StrongKey FIDO Server before 4.15.1 treats a non-discoverable (namedcredential) flow as a discoverable transaction.
CVE-2025-26789 (CWE-1336)
CVSS 4.0 score: 6.9 (MEDIUM)
An issue was discovered in Logpoint AgentX before 1.5.0. A vulnerability caused by limited access controls allowed li-admin users to access sensitive information about AgentX Manager in a Logpoint deployment.
CVE-2025-26791 (CWE-79)
CVSS 3.1 score: 4.5 (MEDIUM)
DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).
CVE-2025-0821 (CWE-89)
CVSS 3.1 score: 6.5 (MEDIUM)
Bit Assist plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVE-2025-26522 (CWE-302)
CVSS 4.0 score: 7.5 (HIGH)
This vulnerability exists in RupeeWeb trading platform due to improper implementation of OTP validation mechanism in certain API endpoints. A remote attacker with valid credentials could exploit this vulnerability by manipulating API responses.  

Successful exploitation of this vulnerability could allow the attacker to bypass Two-Factor Authentication (2FA) for other user accounts.
CVE-2025-26523 (CWE-266)
CVSS 4.0 score: 7.4 (HIGH)
This vulnerability exists in RupeeWeb trading platform due to insufficient authorization controls on certain API endpoints handling addition and deletion operations. Successful exploitation of this vulnerability could allow an authenticated remote attacker to modify information belonging to other user accounts.
CVE-2025-26524 (CWE-799)
CVSS 4.0 score: 5.1 (MEDIUM)
This vulnerability exists in RupeeWeb trading platform due to missing rate limiting on OTP requests in certain API endpoints. An authenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoints which could lead to the OTP bombing/ flooding on the targeted system.
CVE-2025-0867 (CWE-522)
CVSS 3.1 score: 9.9 (CRITICAL)
The standard user uses the run as function to start the MEAC applications with administrative privileges. To ensure that the system can startup on its own, the credentials of the administrator were stored. Consequently, the EPC2 user can execute any command with administrative privileges. This allows a privilege escalation to the administrative level.
CVE-2025-22698 (CWE-862)
CVSS 3.1 score: 6.3 (MEDIUM)
Missing Authorization vulnerability in Ability, Inc Accessibility Suite by Online ADA allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Accessibility Suite by Online ADA: from n/a through 4.16.
CVE-2025-22702 (CWE-862)
CVSS 3.1 score: 6.3 (MEDIUM)
Missing Authorization vulnerability in EPC Photography. This issue affects Photography: from n/a through 7.5.2.
CVE-2025-22705 (CWE-352)
CVSS 3.1 score: 7.1 (HIGH)
Cross-Site Request Forgery (CSRF) vulnerability in godthor Disqus Popular Posts allows Reflected XSS. This issue affects Disqus Popular Posts: from n/a through 2.1.1.
CVE-2025-23428 (CWE-79)
CVSS 3.1 score: 7.1 (HIGH)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound QMean – WordPress Did You Mean allows Reflected XSS. This issue affects QMean – WordPress Did You Mean: from n/a through 2.0.
CVE-2025-23431 (CWE-79)
CVSS 3.1 score: 7.1 (HIGH)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Envato Affiliater allows Reflected XSS. This issue affects Envato Affiliater: from n/a through 1.2.4.
CVE-2025-23474 (CWE-79)
CVSS 3.1 score: 7.1 (HIGH)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mike Martel Live Dashboard allows Reflected XSS. This issue affects Live Dashboard: from n/a through 0.3.3.
CVE-2025-23492 (CWE-79)
CVSS 3.1 score: 7.1 (HIGH)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CantonBolo WordPress 淘宝客插件 allows Reflected XSS. This issue affects WordPress 淘宝客插件: from n/a through 1.1.2.
CVE-2025-23523 (CWE-79)
CVSS 3.1 score: 7.1 (HIGH)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hoststreamsell HSS Embed Streaming Video allows Reflected XSS. This issue affects HSS Embed Streaming Video: from n/a through 3.23.
CVE-2025-23525 (CWE-79)
CVSS 3.1 score: 7.1 (HIGH)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kvvaradha Kv Compose Email From Dashboard allows Reflected XSS. This issue affects Kv Compose Email From Dashboard: from n/a through 1.1.
CVE-2025-23534 (CWE-862)
CVSS 3.1 score: 6.5 (MEDIUM)
Missing Authorization vulnerability in Mark Winiarski WPLingo allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WPLingo: from n/a through 1.1.2.
CVE-2025-23568 (CWE-79)
CVSS 3.1 score: 7.1 (HIGH)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fredsted WP Login Attempt Log allows Reflected XSS. This issue affects WP Login Attempt Log: from n/a through 1.3.
CVE-2025-23571 (CWE-79)
CVSS 3.1 score: 7.1 (HIGH)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Internal Links Generator allows Reflected XSS. This issue affects Internal Links Generator: from n/a through 3.51.
CVE-2025-23598 (CWE-79)
CVSS 3.1 score: 7.1 (HIGH)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in craig.edmunds@gmail.com Recip.ly allows Reflected XSS. This issue affects Recip.ly: from n/a through 1.1.8.
CVE-2025-23646 (CWE-79)
CVSS 3.1 score: 7.1 (HIGH)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matt Brooks Library Instruction Recorder allows Reflected XSS. This issue affects Library Instruction Recorder: from n/a through 1.1.4.
CVE-2025-23647 (CWE-79)
CVSS 3.1 score: 7.1 (HIGH)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ariagle WP-Clap allows Reflected XSS. This issue affects WP-Clap: from n/a through 1.5.
CVE-2025-23648 (CWE-79)
CVSS 3.1 score: 7.1 (HIGH)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wjharil AdsMiddle allows Reflected XSS. This issue affects AdsMiddle: from n/a through 1.0.
CVE-2025-23650 (CWE-79)
CVSS 3.1 score: 7.1 (HIGH)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in razvypp Tidy.ro allows Reflected XSS. This issue affects Tidy.ro: from n/a through 1.3.
CVE-2025-23651 (CWE-79)
CVSS 3.1 score: 7.1 (HIGH)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Scroll Top allows Reflected XSS. This issue affects Scroll Top: from n/a through 1.3.3.
CVE-2025-23652 (CWE-79)
CVSS 3.1 score: 7.1 (HIGH)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Add custom content after post allows Reflected XSS. This issue affects Add custom content after post: from n/a through 1.0.
CVE-2025-23653 (CWE-79)
CVSS 3.1 score: 7.1 (HIGH)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Form To Online Booking allows Reflected XSS. This issue affects Form To Online Booking: from n/a through 1.0.
CVE-2025-23655 (CWE-79)
CVSS 3.1 score: 7.1 (HIGH)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Contact Form 7 – Paystack Add-on allows Reflected XSS. This issue affects Contact Form 7 – Paystack Add-on: from n/a through 1.2.3.
CVE-2025-23657 (CWE-79)
CVSS 3.1 score: 7.1 (HIGH)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound WordPress-to-candidate for Salesforce CRM allows Reflected XSS. This issue affects WordPress-to-candidate for Salesforce CRM: from n/a through 1.0.1.
CVE-2025-23658 (CWE-79)
CVSS 3.1 score: 7.1 (HIGH)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tauhidul Alam Advanced Angular Contact Form allows Reflected XSS. This issue affects Advanced Angular Contact Form: from n/a through 1.1.0.
CVE-2025-23742 (CWE-79)
CVSS 3.1 score: 7.1 (HIGH)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Podamibe Nepal Podamibe Twilio Private Call allows Reflected XSS. This issue affects Podamibe Twilio Private Call: from n/a through 1.0.1.
CVE-2025-23748 (CWE-79)
CVSS 3.1 score: 7.1 (HIGH)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Singsys -Awesome Gallery allows Reflected XSS. This issue affects Singsys -Awesome Gallery: from n/a through 1.0.
CVE-2025-23750 (CWE-79)
CVSS 3.1 score: 7.1 (HIGH)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devbunchuk Custom Widget Creator allows Reflected XSS. This issue affects Custom Widget Creator: from n/a through 1.0.5.
CVE-2025-23751 (CWE-79)
CVSS 3.1 score: 7.1 (HIGH)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 Data Dash allows Reflected XSS. This issue affects Data Dash: from n/a through 1.2.3.
CVE-2025-23766 (CWE-862)
CVSS 3.1 score: 6.5 (MEDIUM)
Missing Authorization vulnerability in ashamil OPSI Israel Domestic Shipments allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects OPSI Israel Domestic Shipments: from n/a through 2.6.6.
CVE-2025-23771 (CWE-862)
CVSS 3.1 score: 6.5 (MEDIUM)
Missing Authorization vulnerability in Murali Push Notification for Post and BuddyPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Push Notification for Post and BuddyPress: from n/a through 2.11.
CVE-2025-23786 (CWE-79)
CVSS 3.1 score: 7.1 (HIGH)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DuoGeek Email to Download allows Reflected XSS. This issue affects Email to Download: from n/a through 3.1.0.
CVE-2025-23787 (CWE-79)
CVSS 3.1 score: 7.1 (HIGH)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Easy Bet allows Reflected XSS. This issue affects Easy Bet: from n/a through 1.0.7.
CVE-2025-23788 (CWE-79)
CVSS 3.1 score: 7.1 (HIGH)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Easy Filter allows Reflected XSS. This issue affects Easy Filter: from n/a through 1.10.
CVE-2025-23789 (CWE-79)
CVSS 3.1 score: 7.1 (HIGH)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tahminajannat URL Shortener | Conversion Tracking  | AB Testing  | WooCommerce allows Reflected XSS. This issue affects URL Shortener | Conversion Tracking  | AB Testing  | WooCommerce: from n/a through 9.0.2.
CVE-2025-23790 (CWE-79)
CVSS 3.1 score: 7.1 (HIGH)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wassereimer Easy Code Placement allows Reflected XSS. This issue affects Easy Code Placement: from n/a through 18.11.
CVE-2025-23851 (CWE-79)
CVSS 3.1 score: 7.1 (HIGH)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Coronavirus (COVID-19) Outbreak Data Widgets allows Reflected XSS. This issue affects Coronavirus (COVID-19) Outbreak Data Widgets: from n/a through 1.1.1.
CVE-2025-23853 (CWE-79)
CVSS 3.1 score: 7.1 (HIGH)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in michelem NoFollow Free allows Reflected XSS. This issue affects NoFollow Free: from n/a through 1.6.3.
CVE-2025-23857 (CWE-79)
CVSS 3.1 score: 7.1 (HIGH)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Essential WP Real Estate allows Reflected XSS. This issue affects Essential WP Real Estate: from n/a through 1.1.3.