Krm1/CVE-2025 huggingface dataset:
CVE-2025-24786 (CWE-22)
CVSS 3.1 score: 10.0 (CRITICAL)
WhoDB is an open source database management tool. While the application only displays Sqlite3 databases present in the directory `/db`, there is no path traversal prevention in place. This allows an unauthenticated attacker to open any Sqlite3 database present on the host machine that the application is running on. Affected versions of WhoDB allow users to connect to Sqlite3 databases. By default, the databases must be present in `/db/` (or alternatively `./tmp/` if development mode is enabled).  If no databases are present in the default directory, the UI indicates that the user is unable to open any databases. The database file is an user-controlled value. This value is used in `.Join()` with the default directory, in order to get the full path of the database file to open. No checks are performed whether the database file that is eventually opened actually resides in the default directory `/db`. This allows an attacker to use path traversal (`../../`) in order to open any Sqlite3 database present on the system. This issue has been addressed in version 0.45.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2025-24787 (CWE-943)
CVSS 3.1 score: 8.6 (HIGH)
WhoDB is an open source database management tool. In affected versions the application is vulnerable to parameter injection in database connection strings, which allows an attacker to read local files on the machine the application is running on. The application uses string concatenation to build database connection URIs which are then passed to corresponding libraries responsible for setting up the database connections. This string concatenation is done unsafely and without escaping or encoding the user input. This allows an user, in many cases, to inject arbitrary parameters into the URI string. These parameters can be potentially dangerous depending on the libraries used. One of these dangerous parameters is `allowAllFiles` in the library `github.com/go-sql-driver/mysql`. Should this be set to `true`, the library enables running the `LOAD DATA LOCAL INFILE` query on any file on the host machine (in this case, the machine that WhoDB is running on). By injecting `&allowAllFiles=true` into the connection URI and connecting to any MySQL server (such as an attacker-controlled one), the attacker is able to read local files. This issue has been addressed in version 0.45.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2025-22936 (CWE-1391)
CVSS 3.1 score: 5.7 (MEDIUM)
An issue in Smartcom Bulgaria AD Smartcom Ralink CPE/WiFi router SAM-4G1G-TT-W-VC, SAM-4F1F-TT-W-A1 allows a remote attacker to obtain sensitive information via the Weak default WiFi password generation algorithm in WiFi routers.
CVE-2025-23093 (CWE-269)
CVSS 3.1 score: 8.8 (HIGH)
The Platform component of Mitel OpenScape 4000 and OpenScape 4000 Manager through V10 R1.54.1 and V11 through R0.22.1 could allow an authenticated attacker to conduct a privilege escalation attack due to the execution of a resource with unnecessary privileges. A successful exploit could allow an attacker to execute arbitrary commands with elevated privileges.
CVE-2025-0158 (CWE-248)
CVSS 3.1 score: 5.5 (MEDIUM)
IBM EntireX 11.1 could allow a local user to cause a denial of service due to an unhandled error and fault isolation.
CVE-2025-1004 (CWE-241)
CVSS 4.0 score: 6.9 (MEDIUM)
Certain HP LaserJet Pro printers may potentially
experience a denial of service when a user sends a raw JPEG file to the printer
via IPP (Internet Printing Protocol).
CVE-2025-1081 (CWE-1391)
CVSS 4.0 score: 2.3 (LOW)
A vulnerability was found in Bharti Airtel Xstream Fiber up to 20250123. It has been rated as problematic. This issue affects some unknown processing of the component WiFi Password Handler. The manipulation leads to use of weak credentials. The attack needs to be done within the local network. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-23094 (CWE-77)
CVSS 3.1 score: 7.3 (HIGH)
The Platform component of Mitel OpenScape 4000 and OpenScape 4000 Manager V11 R0.22.0 through V11 R0.22.1, V10 R1.54.0 through V10 R1.54.1, and V10 R1.42.6 and earlier could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. A successful exploit could allow an attacker to execute arbitrary commands within the same privilege level as the web access process.
CVE-2025-1082 (CWE-79)
CVSS 4.0 score: 5.1 (MEDIUM)
A vulnerability classified as problematic has been found in Mindskip xzs-mysql 学之思开源考试系统 3.9.0. Affected is an unknown function of the file /api/admin/question/edit of the component Exam Edit Handler. The manipulation of the argument title/content leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-1083 (CWE-346)
CVSS 4.0 score: 2.3 (LOW)
A vulnerability classified as problematic was found in Mindskip xzs-mysql 学之思开源考试系统 3.9.0. Affected by this vulnerability is an unknown functionality of the component CORS Handler. The manipulation leads to permissive cross-domain policy with untrusted domains. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-21177 (CWE-918)
CVSS 3.1 score: 8.7 (HIGH)
Server-Side Request Forgery (SSRF) in Microsoft Dynamics 365 Sales allows an authorized attacker to elevate privileges over a network.
CVE-2025-21253 (CWE-451, NVD-CWE-noinfo)
CVSS 3.1 score: 5.3 (MEDIUM)
Microsoft Edge for IOS and Android Spoofing Vulnerability
CVE-2025-21267 (CWE-358, NVD-CWE-noinfo)
CVSS 3.1 score: 4.4 (MEDIUM)
Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2025-21279 (CWE-843, NVD-CWE-noinfo)
CVSS 3.1 score: 6.5 (MEDIUM)
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2025-21283 (CWE-1222, NVD-CWE-noinfo)
CVSS 3.1 score: 6.5 (MEDIUM)
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2025-21342 (CWE-843, NVD-CWE-noinfo)
CVSS 3.1 score: 8.8 (HIGH)
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2025-21404 (CWE-449, NVD-CWE-noinfo, CWE-451)
CVSS 3.1 score: 4.3 (MEDIUM)
Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2025-21408 (CWE-843, NVD-CWE-noinfo)
CVSS 3.1 score: 8.8 (HIGH)
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2025-0674 (CWE-288)
CVSS 4.0 score: 9.3 (CRITICAL)
Multiple Elber products are affected by an authentication bypass 
vulnerability which allows unauthorized access to the password 
management functionality. Attackers can exploit this issue by 
manipulating the endpoint to overwrite any user's password within the 
system. This grants them unauthorized administrative access to protected
 areas of the application, compromising the device's system security.
CVE-2025-0675 (CWE-912)
CVSS 4.0 score: 8.7 (HIGH)
Multiple Elber products suffer from an unauthenticated device configuration and client-side hidden functionality disclosure.
CVE-2025-1084 (CWE-352)
CVSS 4.0 score: 5.3 (MEDIUM)
A vulnerability, which was classified as problematic, has been found in Mindskip xzs-mysql 学之思开源考试系统 3.9.0. Affected by this issue is some unknown functionality. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Multiple endpoints are affected. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-1085 (CWE-79)
CVSS 4.0 score: 5.3 (MEDIUM)
A vulnerability, which was classified as problematic, was found in Animati PACS up to 1.24.12.09.03. This affects an unknown part of the file /login. The manipulation of the argument p leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-1061 (CWE-288)
CVSS 3.1 score: 9.8 (CRITICAL)
The Nextend Social Login Pro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.1.16. This is due to insufficient verification on the user being supplied during the Apple OAuth authenticate request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
CVE-2025-1086 (CWE-23)
CVSS 4.0 score: 6.9 (MEDIUM)
A vulnerability has been found in Safetytest Cloud-Master Server up to 1.1.1 and classified as critical. This vulnerability affects unknown code of the file /static/. The manipulation leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-22402 (CWE-80)
CVSS 3.1 score: 2.6 (LOW)
Dell Update Manager Plugin, version(s) 1.5.0 through 1.6.0, contain(s) an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.
CVE-2025-1072 (CWE-770)
CVSS 3.1 score: 6.5 (MEDIUM)
A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all versions starting from 7.14.1 prior to 17.3.7, 17.4 prior to 17.4.4, and 17.5 prior to 17.5.2. A denial of service could occur upon importing maliciously crafted content using the Fogbugz importer.
CVE-2025-23085 (CWE-401)
CVSS 3.0 score: 5.3 (MEDIUM)
A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could lead to increased memory consumption and potential denial of service under certain conditions.

This vulnerability affects HTTP/2 Server users on Node.js v18.x, v20.x, v22.x and v23.x.
CVE-2025-22880 (CWE-122)
CVSS 3.1 score: 7.8 (HIGH)
Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to execute code in the context of the current process.
CVE-2025-1077 (CWE-20)
CVSS 4.0 score: 9.5 (CRITICAL)
A security vulnerability has been identified in the IBL Software Engineering Visual Weather and derived products (NAMIS, Aero Weather, Satellite Weather). The vulnerability is present in the Product Delivery Service (PDS) component in specific server configurations where the PDS pipeline utilizes the IPDS pipeline with Message Editor Output Filters enabled.

A remote unauthenticated

attacker can exploit this vulnerability to send unauthenticated requests to execute the IPDS pipeline with specially crafted Form Properties, enabling remote execution of arbitrary Python code. This vulnerability could lead to a full system compromise of the affected server, particularly if Visual Weather services are run under a privileged user account—contrary to the documented installation best practices.



Upgrade to the patched versions 7.3.10 (or higher), 8.6.0 (or higher).
CVE-2025-0302 (CWE-190)
CVSS 3.1 score: 5.5 (MEDIUM)
in OpenHarmony v4.1.2 and prior versions allow a local attacker cause DOS through integer overflow.
CVE-2025-0303 (CWE-120)
CVSS 3.1 score: 8.8 (HIGH)
in OpenHarmony v4.1.2 and prior versions allow a local attacker cause the common permission is upgraded to root and sensitive information leak through buffer overflow.
CVE-2025-0304 (CWE-416)
CVSS 3.1 score: 8.8 (HIGH)
in OpenHarmony v4.1.2 and prior versions allow a local attacker cause the common permission is upgraded to root and sensitive information leak through use after free.
CVE-2025-25071 (CWE-352)
CVSS 3.1 score: 7.1 (HIGH)
Cross-Site Request Forgery (CSRF) vulnerability in topplugins Vignette Ads allows Stored XSS. This issue affects Vignette Ads: from n/a through 0.2.
CVE-2025-25072 (CWE-352)
CVSS 3.1 score: 7.1 (HIGH)
Cross-Site Request Forgery (CSRF) vulnerability in thunderbax WP Admin Custom Page allows Stored XSS. This issue affects WP Admin Custom Page: from n/a through 1.5.0.
CVE-2025-25073 (CWE-79)
CVSS 3.1 score: 5.9 (MEDIUM)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vasilis Triantafyllou Easy WP Tiles allows Stored XSS. This issue affects Easy WP Tiles: from n/a through 1.
CVE-2025-25074 (CWE-352)
CVSS 3.1 score: 7.1 (HIGH)
Cross-Site Request Forgery (CSRF) vulnerability in Nirmal Kumar Ram WP Social Stream allows Stored XSS. This issue affects WP Social Stream: from n/a through 1.1.
CVE-2025-25075 (CWE-352)
CVSS 3.1 score: 7.1 (HIGH)
Cross-Site Request Forgery (CSRF) vulnerability in Venugopal Show notice or message on admin area allows Stored XSS. This issue affects Show notice or message on admin area: from n/a through 2.0.
CVE-2025-25076 (CWE-79)
CVSS 3.1 score: 6.5 (MEDIUM)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicholaswilson Graceful Email Obfuscation allows Stored XSS. This issue affects Graceful Email Obfuscation: from n/a through 0.2.2.
CVE-2025-25077 (CWE-79)
CVSS 3.1 score: 6.5 (MEDIUM)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dugbug Easy Chart Builder for WordPress allows Stored XSS. This issue affects Easy Chart Builder for WordPress: from n/a through 1.3.
CVE-2025-25078 (CWE-79)
CVSS 3.1 score: 6.5 (MEDIUM)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andrew Norcross Google Earth Embed allows Stored XSS. This issue affects Google Earth Embed: from n/a through 1.0.
CVE-2025-25079 (CWE-79)
CVSS 3.1 score: 6.5 (MEDIUM)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Garrett Grimm Simple Select All Text Box allows Stored XSS. This issue affects Simple Select All Text Box: from n/a through 3.2.
CVE-2025-25080 (CWE-79)
CVSS 3.1 score: 6.5 (MEDIUM)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gubbigubbi Kona Gallery Block allows Stored XSS. This issue affects Kona Gallery Block: from n/a through 1.7.
CVE-2025-25081 (CWE-862)
CVSS 3.1 score: 4.2 (MEDIUM)
Missing Authorization vulnerability in DeannaS Embed RSS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Embed RSS: from n/a through 3.1.
CVE-2025-25082 (CWE-79)
CVSS 3.1 score: 6.5 (MEDIUM)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Max Chirkov FlexIDX Home Search allows Stored XSS. This issue affects FlexIDX Home Search: from n/a through 2.1.2.
CVE-2025-25085 (CWE-79)
CVSS 3.1 score: 6.5 (MEDIUM)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in matt_mcbrien WP SimpleWeather allows Stored XSS. This issue affects WP SimpleWeather: from n/a through 0.2.5.
CVE-2025-25088 (CWE-352)
CVSS 3.1 score: 7.1 (HIGH)
Cross-Site Request Forgery (CSRF) vulnerability in blackus3r WP Keyword Monitor allows Stored XSS. This issue affects WP Keyword Monitor: from n/a through 1.0.5.
CVE-2025-25091 (CWE-79)
CVSS 3.1 score: 6.5 (MEDIUM)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zackdesign NextGen Cooliris Gallery allows Stored XSS. This issue affects NextGen Cooliris Gallery: from n/a through 0.7.
CVE-2025-25093 (CWE-352)
CVSS 3.1 score: 6.1 (MEDIUM)
Cross-Site Request Forgery (CSRF) vulnerability in paulswarthout Child Themes Helper allows Path Traversal. This issue affects Child Themes Helper: from n/a through 2.2.7.
CVE-2025-25094 (CWE-79)
CVSS 3.1 score: 6.5 (MEDIUM)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amitythemes.com Breaking News Ticker allows Stored XSS. This issue affects Breaking News Ticker: from n/a through 2.4.4.
CVE-2025-25095 (CWE-79)
CVSS 3.1 score: 6.5 (MEDIUM)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reverbnationdev ReverbNation Widgets allows Stored XSS. This issue affects ReverbNation Widgets: from n/a through 2.1.
CVE-2025-25096 (CWE-79)
CVSS 3.1 score: 6.5 (MEDIUM)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in titusbicknell RSS in Page allows Stored XSS. This issue affects RSS in Page: from n/a through 2.9.1.
CVE-2025-25097 (CWE-79)
CVSS 3.1 score: 6.5 (MEDIUM)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kwiliarty External Video For Everybody allows Stored XSS. This issue affects External Video For Everybody: from n/a through 2.1.1.
CVE-2025-25098 (CWE-79)
CVSS 3.1 score: 6.5 (MEDIUM)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zack Katz Links in Captions allows Stored XSS. This issue affects Links in Captions: from n/a through 1.2.
CVE-2025-25101 (CWE-352)
CVSS 3.1 score: 9.6 (CRITICAL)
Cross-Site Request Forgery (CSRF) vulnerability in MetricThemes Munk Sites allows Cross Site Request Forgery. This issue affects Munk Sites: from n/a through 1.0.7.
CVE-2025-25103 (CWE-352)
CVSS 3.1 score: 4.3 (MEDIUM)
Cross-Site Request Forgery (CSRF) vulnerability in bnielsen Indeed API allows Cross Site Request Forgery. This issue affects Indeed API: from n/a through 0.5.
CVE-2025-25104 (CWE-352)
CVSS 3.1 score: 7.1 (HIGH)
Cross-Site Request Forgery (CSRF) vulnerability in mraliende URL-Preview-Box allows Cross Site Request Forgery. This issue affects URL-Preview-Box: from n/a through 1.20.
CVE-2025-25105 (CWE-79)
CVSS 3.1 score: 5.9 (MEDIUM)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in coffeestudios Pop Up allows Stored XSS. This issue affects Pop Up: from n/a through 0.1.
CVE-2025-25106 (CWE-352)
CVSS 3.1 score: 9.6 (CRITICAL)
Cross-Site Request Forgery (CSRF) vulnerability in FancyWP Starter Templates by FancyWP allows Cross Site Request Forgery. This issue affects Starter Templates by FancyWP: from n/a through 2.0.0.
CVE-2025-25107 (CWE-352)
CVSS 3.1 score: 9.6 (CRITICAL)
Cross-Site Request Forgery (CSRF) vulnerability in sainwp OneStore Sites allows Cross Site Request Forgery. This issue affects OneStore Sites: from n/a through 0.1.1.
CVE-2025-25110 (CWE-862)
CVSS 3.1 score: 5.4 (MEDIUM)
Missing Authorization vulnerability in Metagauss Event Kikfyre allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Event Kikfyre: from n/a through 2.1.8.
CVE-2025-25111 (CWE-352)
CVSS 3.1 score: 5.4 (MEDIUM)
Cross-Site Request Forgery (CSRF) vulnerability in WP Spell Check WP Spell Check allows Cross Site Request Forgery. This issue affects WP Spell Check: from n/a through 9.21.
CVE-2025-25116 (CWE-89)
CVSS 3.1 score: 7.6 (HIGH)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in sudipto Link to URL / Post allows Blind SQL Injection. This issue affects Link to URL / Post: from n/a through 1.3.
CVE-2025-25117 (CWE-79)
CVSS 3.1 score: 6.5 (MEDIUM)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alex Polonski Smart Countdown FX allows Stored XSS. This issue affects Smart Countdown FX: from n/a through 1.5.5.
CVE-2025-25120 (CWE-862)
CVSS 3.1 score: 4.3 (MEDIUM)
Missing Authorization vulnerability in Melodic Media Slide Banners allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Slide Banners: from n/a through 1.3.
CVE-2025-25123 (CWE-352)
CVSS 3.1 score: 7.1 (HIGH)
Cross-Site Request Forgery (CSRF) vulnerability in xdark Easy Related Posts allows Stored XSS. This issue affects Easy Related Posts: from n/a through 2.0.2.
CVE-2025-25125 (CWE-352)
CVSS 3.1 score: 7.1 (HIGH)
Cross-Site Request Forgery (CSRF) vulnerability in CyrilG Fyrebox Quizzes allows Stored XSS. This issue affects Fyrebox Quizzes: from n/a through 2.7.
CVE-2025-25126 (CWE-352)
CVSS 3.1 score: 7.1 (HIGH)
Cross-Site Request Forgery (CSRF) vulnerability in zmseo ZMSEO allows Stored XSS. This issue affects ZMSEO: from n/a through 1.14.1.
CVE-2025-25128 (CWE-352)
CVSS 3.1 score: 7.1 (HIGH)
Cross-Site Request Forgery (CSRF) vulnerability in orlandolac Facilita Form Tracker allows Stored XSS. This issue affects Facilita Form Tracker: from n/a through 1.0.
CVE-2025-25135 (CWE-352)
CVSS 3.1 score: 7.1 (HIGH)
Cross-Site Request Forgery (CSRF) vulnerability in Victor Barkalov Custom Links On Admin Dashboard Toolbar allows Stored XSS. This issue affects Custom Links On Admin Dashboard Toolbar: from n/a through 3.3.
CVE-2025-25136 (CWE-79)
CVSS 3.1 score: 6.5 (MEDIUM)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shujahat21 Optimate Ads allows Stored XSS. This issue affects Optimate Ads: from n/a through 1.0.3.
CVE-2025-25138 (CWE-352)
CVSS 3.1 score: 7.1 (HIGH)
Cross-Site Request Forgery (CSRF) vulnerability in Rishi On Page SEO + Whatsapp Chat Button allows Stored XSS. This issue affects On Page SEO + Whatsapp Chat Button: from n/a through 2.0.0.
CVE-2025-25139 (CWE-352)
CVSS 3.1 score: 7.1 (HIGH)
Cross-Site Request Forgery (CSRF) vulnerability in Cynob IT Consultancy WP Custom Post RSS Feed allows Stored XSS. This issue affects WP Custom Post RSS Feed: from n/a through 1.0.0.
CVE-2025-25140 (CWE-352)
CVSS 3.1 score: 7.1 (HIGH)
Cross-Site Request Forgery (CSRF) vulnerability in Scriptonite Simple User Profile allows Stored XSS. This issue affects Simple User Profile: from n/a through 1.9.
CVE-2025-25141 (CWE-98)
CVSS 3.1 score: 7.5 (HIGH)
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in zankover Fami Sales Popup allows PHP Local File Inclusion. This issue affects Fami Sales Popup: from n/a through 2.0.0.
CVE-2025-25143 (CWE-352)
CVSS 3.1 score: 4.3 (MEDIUM)
Cross-Site Request Forgery (CSRF) vulnerability in ibasit GlobalQuran allows Cross Site Request Forgery. This issue affects GlobalQuran: from n/a through 1.0.
CVE-2025-25144 (CWE-79)
CVSS 3.1 score: 7.1 (HIGH)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in theasys Theasys allows Stored XSS. This issue affects Theasys: from n/a through 1.0.1.
CVE-2025-25145 (CWE-352)
CVSS 3.1 score: 5.4 (MEDIUM)
Cross-Site Request Forgery (CSRF) vulnerability in jordan.hatch Infusionsoft Analytics allows Cross Site Request Forgery. This issue affects Infusionsoft Analytics: from n/a through 2.0.
CVE-2025-25146 (CWE-352)
CVSS 3.1 score: 4.3 (MEDIUM)
Cross-Site Request Forgery (CSRF) vulnerability in saleandro Songkick Concerts and Festivals allows Cross Site Request Forgery. This issue affects Songkick Concerts and Festivals: from n/a through 0.9.7.
CVE-2025-25147 (CWE-352)
CVSS 3.1 score: 7.1 (HIGH)
Cross-Site Request Forgery (CSRF) vulnerability in Phillip.Gooch Auto SEO allows Stored XSS. This issue affects Auto SEO: from n/a through 2.5.6.
CVE-2025-25148 (CWE-352)
CVSS 3.1 score: 7.1 (HIGH)
Cross-Site Request Forgery (CSRF) vulnerability in ElbowRobo Read More Copy Link allows Stored XSS. This issue affects Read More Copy Link: from n/a through 1.0.2.
CVE-2025-25149 (CWE-352)
CVSS 3.1 score: 7.1 (HIGH)
Cross-Site Request Forgery (CSRF) vulnerability in Danillo Nunes Login-box allows Stored XSS. This issue affects Login-box: from n/a through 2.0.4.