Krm1/CVE-2025 huggingface dataset:
CVE-2025-24371 (CWE-703)
CVSS 4.0 score: 7.1 (HIGH)
CometBFT is a distributed, Byzantine fault-tolerant, deterministic state machine replication engine. In the `blocksync` protocol peers send their `base` and `latest` heights when they connect to a new node (`A`), which is syncing to the tip of a network. `base` acts as a lower ground and informs `A` that the peer only has blocks starting from height `base`. `latest` height informs `A` about the latest block in a network. Normally, nodes would only report increasing heights. If `B` fails to provide the latest block, `B` is removed and the `latest` height (target height) is recalculated based on other nodes `latest` heights. The existing code however doesn't check for the case where `B` first reports `latest` height `X` and immediately after height `Y`, where `X > Y`. `A` will be trying to catch up to 2000 indefinitely. This condition requires the introduction of malicious code in the full node first reporting some non-existing `latest` height, then reporting lower `latest` height and nodes which are syncing using `blocksync` protocol. This issue has been patched in versions 1.0.1 and 0.38.17 and all users are advised to upgrade. Operators may attempt to ban malicious peers from the network as a workaround.
CVE-2025-24901 (CWE-89)
CVSS 4.0 score: 9.4 (CRITICAL)
WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `deletar_permissao.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to  or deletion of sensitive information. This issue has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2025-24902 (CWE-89)
CVSS 4.0 score: 9.4 (CRITICAL)
WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `salvar_cargo.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to  or deletion of sensitive information. This issue has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2025-24905 (CWE-89)
CVSS 4.0 score: 10.0 (CRITICAL)
WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `get_codigobarras_cobranca.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to  or deletion of sensitive information. This issue has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2025-24906 (CWE-89)
CVSS 4.0 score: 10.0 (CRITICAL)
WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `get_detalhes_cobranca.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to  or deletion of sensitive information. This issue has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2025-24957 (CWE-89)
CVSS 4.0 score: 10.0 (CRITICAL)
WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `get_detalhes_socio.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to  or deletion of sensitive information. This issue has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2025-24958 (CWE-89)
CVSS 4.0 score: 9.4 (CRITICAL)
WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `salvar_tag.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to  or deletion of sensitive information. This issue has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2025-0148 (CWE-549)
CVSS 3.1 score: 2.6 (LOW)
Missing password field masking in the Zoom Jenkins Marketplace plugin before version 1.6 may allow an unauthenticated user to conduct a disclosure of information via adjacent network access.
CVE-2025-1003 (CWE-273)
CVSS 4.0 score: 8.5 (HIGH)
A potential vulnerability has been identified in HP Anyware Agent for Linux which might allow for authentication bypass which may result in escalation of privilege. HP is releasing a software update to mitigate this potential vulnerability.
CVE-2025-22475 (CWE-1240, CWE-327)
CVSS 3.1 score: 3.7 (LOW)
Dell PowerProtect DD, versions prior to DDOS 8.3.0.0, 7.10.1.50, and 7.13.1.10 contains a use of a Cryptographic Primitive with a Risky Implementation vulnerability. A remote attacker could potentially exploit this vulnerability, leading to Information tampering.
CVE-2025-24982 (CWE-352)
CVSS 3.0 score: 4.3 (MEDIUM)
Cross-site request forgery vulnerability exists in Activity Log WinterLock versions prior to 1.2.5. If a user views a malicious page while logged in, the log data may be deleted.
CVE-2025-0368 (N/A)
CVSS 3.1 score: 6.1 (MEDIUM)
The Banner Garden Plugin for WordPress plugin through 0.1.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or unauthenticated users.
CVE-2025-0466 (N/A)
CVSS 3.1 score: 5.3 (MEDIUM)
The Sensei LMS  WordPress plugin before 4.24.4 does not properly protect some its REST API routes, allowing unauthenticated attackers to leak sensei_email and sensei_message Information.
CVE-2025-20881 (CWE-787)
CVSS 3.1 score: 7.0 (HIGH)
Out-of-bounds write in accessing buffer storing the decoded video frames in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to execute arbitrary code with privilege. User interaction is required for triggering this vulnerability.
CVE-2025-20882 (CWE-787)
CVSS 3.1 score: 7.0 (HIGH)
Out-of-bounds write in accessing uninitialized memory for svc1td in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to execute arbitrary code with privilege. User interaction is required for triggering this vulnerability.
CVE-2025-20883 (NVD-CWE-Other)
CVSS 3.1 score: 4.6 (MEDIUM)
Improper access control in SoundPicker prior to SMR Jan-2025 Release 1 allows physical attackers to access data across multiple user profiles.
CVE-2025-20884 (NVD-CWE-Other)
CVSS 3.1 score: 4.6 (MEDIUM)
Improper access control in Samsung Message prior to SMR Jan-2025 Release 1 allows physical attackers to access data across multiple user profiles.
CVE-2025-20885 (CWE-787)
CVSS 3.1 score: 6.4 (MEDIUM)
Out-of-bounds write in softsim TA prior to SMR Jan-2025 Release 1 allows local privileged attackers to cause memory corruption.
CVE-2025-20886 (CWE-922)
CVSS 3.1 score: 4.1 (MEDIUM)
Inclusion of sensitive information in test code in softsim TA prior to SMR Jan-2025 Release 1 allows local privileged attackers to get test key.
CVE-2025-20887 (CWE-125)
CVSS 3.1 score: 5.3 (MEDIUM)
Out-of-bounds read in accessing table used for svp8t in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to read arbitrary memory. User interaction is required for triggering this vulnerability.
CVE-2025-20888 (CWE-787)
CVSS 3.1 score: 7.0 (HIGH)
Out-of-bounds write in handling the block size for smp4vtd in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to execute arbitrary code with privilege. User interaction is required for triggering this vulnerability.
CVE-2025-20889 (CWE-787)
CVSS 3.1 score: 5.3 (MEDIUM)
Out-of-bounds read in decoding malformed bitstream for smp4vtd in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to read arbitrary memory. User interaction is required for triggering this vulnerability.
CVE-2025-20890 (CWE-787)
CVSS 3.1 score: 7.0 (HIGH)
Out-of-bounds write in decoding frame buffer in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to execute arbitrary code with privilege. User interaction is required for triggering this vulnerability.
CVE-2025-20891 (CWE-125)
CVSS 3.1 score: 5.3 (MEDIUM)
Out-of-bounds read in decoding malformed bitstream of video thumbnails in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to read arbitrary memory. User interaction is required for triggering this vulnerability.
CVE-2025-20892 (NVD-CWE-noinfo)
CVSS 3.1 score: 5.9 (MEDIUM)
Protection Mechanism Failure in bootloader prior to SMR Jan-2025 Release 1 allows physical attackers to allow to execute fastboot command. User interaction is required for triggering this vulnerability.
CVE-2025-20893 (NVD-CWE-Other)
CVSS 3.1 score: 5.1 (MEDIUM)
Improper access control in NotificationManager prior to SMR Jan-2025 Release 1 allows local attackers to change the configuration of notifications.
CVE-2025-20894 (N/A)
CVSS 3.1 score: 4.6 (MEDIUM)
Improper access control in Samsung Email prior to version 6.1.97.1 allows physical attackers to access data across multiple user profiles.
CVE-2025-20895 (N/A)
CVSS 3.1 score: 3.2 (LOW)
Authentication Bypass Using an Alternate Path in Galaxy Store prior to version 4.5.87.6 allows physical attackers to install arbitrary applications to bypass restrictions of Setupwizard.
CVE-2025-20896 (N/A)
CVSS 3.1 score: 4.0 (MEDIUM)
Use of implicit intent for sensitive communication in EasySetup prior to version 11.1.18 allows local attackers to access sensitive information.
CVE-2025-20897 (N/A)
CVSS 3.1 score: 6.8 (MEDIUM)
Improper access control in Secure Folder prior to version 1.9.20.50 in Android 14, 1.8.11.0 in Android 13, and 1.7.04.0 in Android 12 allows local attacker to access data in Secure Folder.
CVE-2025-20898 (N/A)
CVSS 3.1 score: 4.6 (MEDIUM)
Improper input validation in Samsung Members prior to version 5.2.00.12 allows physical attackers to access data across multiple user profiles.
CVE-2025-20899 (N/A)
CVSS 3.1 score: 4.0 (MEDIUM)
Improper access control in PushNotification prior to version 13.0.00.15 in Android 12, 14.0.00.7 in Android 13, and 15.1.00.5 in Android 14 allows local attackers to access sensitive information.
CVE-2025-20900 (N/A)
CVSS 3.1 score: 6.3 (MEDIUM)
Out-of-bounds write in Blockchain Keystore prior to version 1.3.16.5 allows local privileged attackers to write out-of-bounds memory.
CVE-2025-20901 (N/A)
CVSS 3.1 score: 4.4 (MEDIUM)
Out-of-bounds read in Blockchain Keystore prior to version 1.3.16.5 allows local privileged attackers to read out-of-bounds memory.
CVE-2025-20902 (N/A)
CVSS 3.1 score: 5.1 (MEDIUM)
Improper access control in Media Controller prior to version 1.0.24.5282 allows local attacker to launch activities in MediaController's privilege.
CVE-2025-20904 (CWE-787)
CVSS 3.1 score: 6.3 (MEDIUM)
Out-of-bounds write in mPOS TUI trustlet prior to SMR Feb-2025 Release 1 allows local privileged attackers to cause memory corruption.
CVE-2025-20905 (CWE-125)
CVSS 3.1 score: 6.3 (MEDIUM)
Out-of-bounds read and write in mPOS TUI trustlet prior to SMR Feb-2025 Release 1 allows local privileged attackers to read and write out-of-bounds memory.
CVE-2025-20906 (N/A)
CVSS 3.1 score: 5.5 (MEDIUM)
Improper Export of Android Application Components in Settings prior to SMR Feb-2025 Release 1 allows local attackers to enable ADB.
CVE-2025-20907 (NVD-CWE-noinfo)
CVSS 3.1 score: 6.0 (MEDIUM)
Improper privilege management in Samsung Find prior to SMR Feb-2025 Release 1 allows local privileged attackers to disable Samsung Find.
CVE-2025-22204 (CWE-94)
CVSS 3.1 score: 9.8 (CRITICAL)
Improper control of generation of code in the sourcerer extension for Joomla in versions before 11.0.0 lead to a remote code execution vulnerability.
CVE-2025-22205 (CWE-35)
CVSS 3.1 score: 7.5 (HIGH)
Improper handling of input variables lead to multiple path traversal vulnerabilities in the Admiror Gallery extension for Joomla in version branch 4.x.
CVE-2025-23015 (CWE-267)
CVSS 3.1 score: 8.8 (HIGH)
Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser within a targeted Cassandra cluster via unsafe actions to a system resource. Operators granting data MODIFY permission on all keyspaces on affected versions should review data access rules for potential breaches.

This issue affects Apache Cassandra through 3.0.30, 3.11.17, 4.0.15, 4.1.7, 5.0.2.

Users are recommended to upgrade to versions 3.0.31, 3.11.18, 4.0.16, 4.1.8, 5.0.3, which fixes the issue.
CVE-2025-0890 (CWE-287)
CVSS 3.1 score: 9.8 (CRITICAL)
**UNSUPPORTED WHEN ASSIGNED**
Insecure default credentials for the Telnet function in the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an attacker to log in to the management interface if the administrators have the option to change the default credentials but fail to do so.
CVE-2025-24860 (CWE-863)
CVSS 3.1 score: 5.4 (MEDIUM)
Incorrect Authorization vulnerability in Apache Cassandra allowing users to access a datacenter or IP/CIDR groups they should not be able to when using CassandraNetworkAuthorizer or CassandraCIDRAuthorizer.

Users with restricted data center access can update their own permissions via data control language (DCL) statements on affected versions.




This issue affects Apache Cassandra: from 4.0.0 through 4.0.15 and from 4.1.0 through 4.1.7 for CassandraNetworkAuthorizer, and from 5.0.0 through 5.0.2 for both CassandraNetworkAuthorizer and CassandraCIDRAuthorizer.




Operators using CassandraNetworkAuthorizer or CassandraCIDRAuthorizer on affected versions should review data access rules for potential breaches. Users are recommended to upgrade to versions 4.0.16, 4.1.8, 5.0.3, which fixes the issue.
CVE-2025-0510 (NVD-CWE-noinfo, CWE-345)
CVSS 3.1 score: 6.5 (MEDIUM)
Thunderbird displayed an incorrect sender address if the From field of an email used the invalid group name syntax that is described in CVE-2024-49040. This vulnerability affects Thunderbird < 128.7 and Thunderbird < 135.
CVE-2025-1009 (CWE-416, CWE-416)
CVSS 3.1 score: 9.8 (CRITICAL)
An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash. This vulnerability affects Firefox < 135, Firefox ESR < 115.20, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.
CVE-2025-1010 (CWE-416, CWE-416)
CVSS 3.1 score: 8.8 (HIGH)
An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially exploitable crash. This vulnerability affects Firefox < 135, Firefox ESR < 115.20, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.
CVE-2025-1011 (NVD-CWE-noinfo, CWE-94)
CVSS 3.1 score: 8.8 (HIGH)
A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker to leverage this to achieve code execution. This vulnerability affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.
CVE-2025-1012 (CWE-416, CWE-416)
CVSS 3.1 score: 7.5 (HIGH)
A race during concurrent delazification could have led to a use-after-free. This vulnerability affects Firefox < 135, Firefox ESR < 115.20, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.
CVE-2025-1013 (CWE-362)
CVSS 3.1 score: 6.5 (MEDIUM)
A race condition could have led to private browsing tabs being opened in normal browsing windows. This could have resulted in a potential privacy leak. This vulnerability affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.
CVE-2025-1014 (CWE-295, CWE-295)
CVSS 3.1 score: 8.8 (HIGH)
Certificate length was not properly checked when added to a certificate store. In practice only trusted data was processed. This vulnerability affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.
CVE-2025-1015 (NVD-CWE-noinfo, CWE-79)
CVSS 3.1 score: 5.4 (MEDIUM)
The Thunderbird Address Book URI fields contained unsanitized links. This could be used by an attacker to create and export an address book containing a malicious payload in a field. For example, in the “Other” field of the Instant Messaging section. If another user imported the address book, clicking on the link could result in opening a web page inside Thunderbird, and that page could execute (unprivileged) JavaScript. This vulnerability affects Thunderbird < 128.7.
CVE-2025-1016 (CWE-787, CWE-787)
CVSS 3.1 score: 9.8 (CRITICAL)
Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 135, Firefox ESR < 115.20, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.
CVE-2025-1017 (CWE-787, CWE-787)
CVSS 3.1 score: 9.8 (CRITICAL)
Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.
CVE-2025-1018 (CWE-1021, CWE-1021)
CVSS 3.1 score: 5.3 (MEDIUM)
The fullscreen notification is prematurely hidden when fullscreen is re-requested quickly by the user. This could have been leveraged to perform a potential spoofing attack. This vulnerability affects Firefox < 135 and Thunderbird < 135.
CVE-2025-1019 (CWE-1021, CWE-1021)
CVSS 3.1 score: 4.3 (MEDIUM)
The z-order of the browser windows could be manipulated to hide the fullscreen notification. This could potentially be leveraged to perform a spoofing attack. This vulnerability affects Firefox < 135 and Thunderbird < 135.
CVE-2025-1020 (CWE-787, CWE-787)
CVSS 3.1 score: 9.8 (CRITICAL)
Memory safety bugs present in Firefox 134 and Thunderbird 134. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 135 and Thunderbird < 135.
CVE-2025-0825 (CWE-113)
CVSS 4.0 score: 6.9 (MEDIUM)
cpp-httplib version v0.17.3 through v0.18.3 fails to filter CRLF characters ("\r\n") when those are prefixed with a null byte. This enables attackers to exploit CRLF injection that could further lead to HTTP Response Splitting, XSS, and more.
CVE-2025-22206 (CWE-89)
CVSS 3.1 score: 4.7 (MEDIUM)
A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.2 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands via the 'fieldfor' parameter in the GDPR Field feature.
CVE-2025-22641 (CWE-79)
CVSS 3.1 score: 5.9 (MEDIUM)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Prem Tiwari FM Notification Bar allows Stored XSS. This issue affects FM Notification Bar: from n/a through 1.0.2.
CVE-2025-22642 (CWE-79)
CVSS 3.1 score: 6.5 (MEDIUM)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RTO GmbH Dynamic Conditions allows Stored XSS. This issue affects Dynamic Conditions: from n/a through 1.7.4.
CVE-2025-22643 (CWE-862)
CVSS 3.1 score: 4.3 (MEDIUM)
Missing Authorization vulnerability in FameThemes OnePress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects OnePress: from n/a through 2.3.11.
CVE-2025-22653 (CWE-79)
CVSS 3.1 score: 6.5 (MEDIUM)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in templaza Music Press Pro allows Stored XSS. This issue affects Music Press Pro: from n/a through 1.4.6.
CVE-2025-22662 (CWE-79)
CVSS 3.1 score: 6.5 (MEDIUM)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SendPulse SendPulse Email Marketing Newsletter allows Stored XSS. This issue affects SendPulse Email Marketing Newsletter: from n/a through 2.1.5.
CVE-2025-22664 (CWE-79)
CVSS 3.1 score: 5.9 (MEDIUM)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Survey Maker team Survey Maker allows Stored XSS. This issue affects Survey Maker: from n/a through 5.1.3.5.
CVE-2025-22674 (CWE-79)
CVSS 3.1 score: 6.5 (MEDIUM)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Get Bowtied Product Blocks for WooCommerce allows Stored XSS. This issue affects Product Blocks for WooCommerce: from n/a through 1.9.1.
CVE-2025-22675 (CWE-79)
CVSS 3.1 score: 6.5 (MEDIUM)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Alert Box Block – Display notice/alerts in the front end allows Stored XSS. This issue affects Alert Box Block – Display notice/alerts in the front end: from n/a through 1.1.0.
CVE-2025-22696 (CWE-862)
CVSS 3.1 score: 5.4 (MEDIUM)
Missing Authorization vulnerability in EmbedPress Document Block – Upload & Embed Docs. This issue affects Document Block – Upload & Embed Docs: from n/a through 1.1.0.
CVE-2025-22697 (CWE-79)
CVSS 3.1 score: 6.5 (MEDIUM)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberChimps Responsive Blocks allows Reflected XSS. This issue affects Responsive Blocks: from n/a through 1.9.9.
CVE-2025-22699 (CWE-89)
CVSS 3.1 score: 9.0 (CRITICAL)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NotFound Traveler Code. This issue affects Traveler Code: from n/a through 3.1.0.
CVE-2025-22700 (CWE-89)
CVSS 3.1 score: 8.5 (HIGH)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NotFound Traveler Code. This issue affects Traveler Code: from n/a through 3.1.0.
CVE-2025-22730 (CWE-862)
CVSS 3.1 score: 6.5 (MEDIUM)
Missing Authorization vulnerability in Ksher Ksher allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ksher: from n/a through 1.1.2.
CVE-2025-22794 (CWE-79)
CVSS 3.1 score: 7.1 (HIGH)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Landoweb Programador World Cup Predictor allows Reflected XSS. This issue affects World Cup Predictor: from n/a through 1.9.6.
CVE-2025-23645 (CWE-79)
CVSS 3.1 score: 7.1 (HIGH)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Optimize Worldwide Find Content IDs allows Reflected XSS. This issue affects Find Content IDs: from n/a through 1.0.
CVE-2025-24598 (CWE-79)
CVSS 3.1 score: 7.1 (HIGH)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brandtoss WP Mailster allows Reflected XSS. This issue affects WP Mailster: from n/a through 1.8.17.0.
CVE-2025-24599 (CWE-79)
CVSS 3.1 score: 7.1 (HIGH)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Newsletters allows Reflected XSS. This issue affects Newsletters: from n/a through 4.9.9.6.
CVE-2025-24602 (CWE-79)
CVSS 3.1 score: 7.1 (HIGH)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP24 WP24 Domain Check allows Reflected XSS. This issue affects WP24 Domain Check: from n/a through 1.10.14.
CVE-2025-24648 (CWE-266)
CVSS 3.1 score: 7.5 (HIGH)
Incorrect Privilege Assignment vulnerability in wpase.com Admin and Site Enhancements (ASE) allows Privilege Escalation. This issue affects Admin and Site Enhancements (ASE): from n/a through 7.6.2.1.
CVE-2025-24677 (CWE-94)
CVSS 3.1 score: 9.9 (CRITICAL)
Improper Control of Generation of Code ('Code Injection') vulnerability in WPSpins Post/Page Copying Tool allows Remote Code Inclusion. This issue affects Post/Page Copying Tool: from n/a through 2.0.3.