Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
at.com/errata/RHSA-2025:11662 - https://access.redhat.com/errata/RHSA-2025:12275 - https://access.redhat.com/errata/RHSA-2025:13335 - https://access.redhat.com/errata/RHSA-2025:14988 - https://access.redhat.com/errata/RHSA-2025:14989 - https://access.redhat.com/errata/RHSA-2025:14990 - https://access.redhat.com/errata/RHSA-2025:14991 - https://access.redhat.com/security/cve/CVE-2025-4373 - https://bugzilla.redhat.com/show_bug.cgi?id=2364265 - https://gitlab.gnome.org/GNOME/glib/-/issues/3677
CVE ID: CVE-2025-4374 State: PUBLISHED Published: 2025-05-06T14:49:28.660Z Last Updated: 2025-11-06T23:57:23.962Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Red Hat Products: Red Hat Quay 3 Problem Types: CWE-266 Description: A flaw was found in Quay. When an organization acts as a proxy cache, and a user or robot pulls an image that hasn't been mirrored yet, they are granted "Admin" permissions on the newly created repository. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-4374 - https://bugzilla.redhat.com/show_bug.cgi?id=2364267
CVE ID: CVE-2025-4375 State: PUBLISHED Published: 2025-05-09T05:12:48.610Z Last Updated: 2025-05-09T13:24:21.744Z Vendors: Sparx Systems Products: Pro Cloud Server Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Sparx Systems Pro Cloud Server allows Cross-Site Request Forgery to perform Session Hijacking. Cross-Site Request Forgery is present at the whole application but it can be used to change the Pro Cloud Server Configuration password. This issue affects Pro Cloud Server: earlier than 6.0.165. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sparxsystems.com/products/procloudserver/6.1/
CVE ID: CVE-2025-4376 State: PUBLISHED Published: 2025-05-09T05:12:54.145Z Last Updated: 2025-05-09T13:23:45.927Z Vendors: Sparx Systems Products: Pro Cloud Server Problem Types: CWE-20 Description: Improper Input Validation vulnerability in Sparx Systems Pro Cloud Server's WebEA model search field allows Cross-Site Scripting (XSS). This issue affects Pro Cloud Server: earlier than 6.0.165. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sparxsystems.com/products/procloudserver/6.1/
CVE ID: CVE-2025-4377 State: PUBLISHED Published: 2025-05-09T05:12:59.487Z Last Updated: 2025-05-09T13:22:16.817Z Vendors: Sparx Systems Products: Pro Cloud Server Problem Types: CWE-22, CWE-20 Description: Improper Limitation of a Pathname caused a Path Traversal vulnerability in Sparx Systems Pro Cloud Server. This vulnerability is present in logview.php and it allows reading arbitrary files on the filesystem. Logview is accessible on Pro Cloud Server Configuration interface. This issue affects Pro Cloud Server: earlier than 6.0.165. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sparxsystems.com/products/procloudserver/6.1/
CVE ID: CVE-2025-4378 State: PUBLISHED Published: 2025-06-24T16:27:02.988Z Last Updated: 2025-06-25T13:40:57.665Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L) Vendors: Ataturk University Products: ATA-AOF Mobile Application Problem Types: CWE-319, CWE-798 Description: Cleartext Transmission of Sensitive Information, Use of Hard-coded Credentials vulnerability in Ataturk University ATA-AOF Mobile Application allows Authentication Abuse, Authentication Bypass.This issue affects ATA-AOF Mobile Application: before 20.06.2025. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0135
CVE ID: CVE-2025-4379 State: PUBLISHED Published: 2025-05-23T10:00:10.396Z Last Updated: 2025-05-23T12:13:45.256Z Vendors: Studio Fabryka Products: DobryCMS Problem Types: CWE-79 Description: DobryCMS in versions 2.* and lower is vulnerable to Reflected Cross-Site Scripting (XSS). Improper input validation in szukaj parameter allows arbitrary JavaScript to be executed on victim's browser when specially crafted URL is opened. A hotfix for affected versions was released on 29.04.2025. It removes the vulnerability without incrementing the version. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/posts/2025/05/CVE-2025-4379 - https://cert.pl/en/posts/2025/05/CVE-2
ISA ADP Vulnrichment: References: - https://cert.pl/posts/2025/05/CVE-2025-4379 - https://cert.pl/en/posts/2025/05/CVE-2025-4379 - https://studiofabryka.pl/Systemy_CMS.html
CVE ID: CVE-2025-4380 State: PUBLISHED Published: 2025-07-02T03:47:23.155Z Last Updated: 2025-07-02T13:11:09.034Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: scripteo Products: Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager Problem Types: CWE-98 Description: The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.89 via the 'bsa_template' parameter of the `bsa_preview_callback` function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in th
thenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases .php files can can be uploaded and included, or already exist on the site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3078861b-3a16-4e93-a4f6-5ae885bc0747?source=cve - https://codecanyon.net/item/ads-pro-plugin-multipurpose-wordpress-advertising-manager/10275010
CVE ID: CVE-2025-4381 State: PUBLISHED Published: 2025-07-02T03:47:21.971Z Last Updated: 2025-07-02T13:19:06.036Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: scripteo Products: Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager Problem Types: CWE-89 Description: The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the ‘$id’ variable of the getSpace() function in all versions up to, and including, 4.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to app
nd lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0605bc15-3a97-46f4-8244-29220ed5ab31?source=cve - https://codecanyon.net/item/ads-pro-plugin-multipurpose-wordpress-advertising-manager/10275010
CVE ID: CVE-2025-4382 State: PUBLISHED Published: 2025-05-09T11:59:33.176Z Last Updated: 2025-11-20T20:48:56.923Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 Problem Types: CWE-306 Description: A flaw was found in systems utilizing LUKS-encrypted disks with GRUB configured for TPM-based auto-decryption. When GRUB is set to automatically decrypt disks using keys stored in the TPM, it reads the decryption key into system memory. If an attacker with physical access can corrupt the underlyin
n the TPM, it reads the decryption key into system memory. If an attacker with physical access can corrupt the underlying filesystem superblock, GRUB will fail to locate a valid filesystem and enter rescue mode. At this point, the disk is already decrypted, and the decryption key remains loaded in system memory. This scenario may allow an attacker with physical access to access the unencrypted data without any further authentication, thereby compromising data confidentiality. Furthermore, the ability to force this state through filesystem corruption also presents a data integrity concern. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/
egrity concern. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-4382 - https://bugzilla.redhat.com/show_bug.cgi?id=2364416 - https://gitweb.git.savannah.gnu.org/gitweb/?p=grub.git;a=blobdiff;f=grub-core/kern/rescue_reader.c;h=a71ada8fb7da2eae6ee7135fe234fb1755ca78b0;hp=4259857ba9eea45446bc40ea13c3de4ab1b88ffd;hb=c448f511e74cb7c776b314fcb7943f98d3f22b6d;hpb=4abac0ad5a7914dd3cdfff08aaac06588bf98d80
CVE ID: CVE-2025-4383 State: PUBLISHED Published: 2025-06-24T15:18:21.211Z Last Updated: 2025-06-24T15:39:09.628Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H) Vendors: Art-in Bilişim Teknolojileri ve Yazılım Hizm. Tic. Ltd. Şti. Products: Wi-Fi Cloud Hotspot Problem Types: CWE-307 Description: Improper Restriction of Excessive Authentication Attempts vulnerability in Art-in Bilişim Teknolojileri ve Yazılım Hizm. Tic. Ltd. Şti. Wi-Fi Cloud Hotspot allows Authentication Abuse, Authentication Bypass.This issue affects Wi-Fi Cloud Hotspot: before 30.05.2025. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0134
CVE ID: CVE-2025-4384 State: PUBLISHED Published: 2025-05-06T15:59:27.839Z Last Updated: 2025-09-05T16:38:07.518Z Vendors: arcinfo Products: PcVue Problem Types: CWE-298 Description: The MQTT add-on of PcVue fails to verify that a remote device’s certificate has not already expired or has not yet become valid. This allows malicious devices to present certificates that are not rejected properly. The use of a client certificate reduces the risk for random devices to take advantage of this flaw. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.pcvue.com/security/#SB2025-3
CVE ID: CVE-2025-4387 State: PUBLISHED Published: 2025-06-10T03:41:37.630Z Last Updated: 2025-06-10T14:10:01.687Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Tyche Softwares Products: Abandoned Cart Pro for WooCommerce Problem Types: CWE-434 Description: The Abandoned Cart Pro for WooCommerce plugin contains an authenticated arbitrary file upload vulnerability due to missing file type validation in the wcap_add_to_cart_popup_upload_files function in all versions up to, and including, 9.16.0. This makes it possible for an authenticated attacker, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may allow f
acker, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may allow for either remote or local code execution depending on the server configuration. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5d2f07bb-89b3-41d4-b606-9722deecf816?source=cve - https://www.tychesoftwares.com/products/woocommerce-abandoned-cart-pro-plugin/ - https://www.tychesoftwares.com/docs/docs/abandoned-cart-pro-for-woocommerce-new/changelog-abandoned-cart-pro/#changelog-abandon-cart-pro-for-woocommerce-9-17-0-release-date-m
CVE ID: CVE-2025-4388 State: PUBLISHED Published: 2025-05-06T18:01:18.908Z Last Updated: 2025-05-06T19:38:35.218Z Vendors: Liferay Products: Portal, DXP Problem Types: CWE-79 Description: A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the modules/apps/marketplace/marketplace-app-manager-web. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-4388
CVE ID: CVE-2025-4389 State: PUBLISHED Published: 2025-05-17T05:30:33.140Z Last Updated: 2025-05-19T16:58:58.435Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: CodeRevolution Products: Crawlomatic Multipage Scraper Post Generator Problem Types: CWE-434 Description: The Crawlomatic Multipage Scraper Post Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the crawlomatic_generate_featured_image() function in all versions up to, and including, 2.6.8.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution pos
authenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1283e839-8588-4a76-9c1e-61562526166d?source=cve - https://codecanyon.net/item/crawlomatic-multisite-scraper-post-generator-plugin-for-wordpress/20476010
CVE ID: CVE-2025-4390 State: PUBLISHED Published: 2025-08-12T02:24:46.766Z Last Updated: 2025-08-13T20:19:11.933Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: nimeshrmr Products: WP Private Content Plus Problem Types: CWE-200 Description: The WP Private Content Plus plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the 'validate_restrictions' function. This makes it possible for unauthenticated attackers to extract sensitive data including the content of resticted posts on archive and feed pages. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/thr
n archive and feed pages. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4c305546-1548-4b77-a484-d7c51d829792?source=cve - https://plugins.trac.wordpress.org/browser/wp-private-content-plus/trunk/classes/class-wppcp-private-posts-pages.php#L138 - https://plugins.trac.wordpress.org/browser/wp-private-content-plus/trunk/classes/class-wppcp-private-posts-pages.php#L211
CVE ID: CVE-2025-4391 State: PUBLISHED Published: 2025-05-17T05:30:33.888Z Last Updated: 2025-05-19T15:43:30.931Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: CodeRevolution Products: Echo RSS Feed Post Generator Problem Types: CWE-434 Description: The Echo RSS Feed Post Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the echo_generate_featured_image() function in all versions up to, and including, 5.4.8.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA
rary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/72de9f64-f3e0-4705-adc1-6c22076b382f?source=cve - https://codecanyon.net/item/echo-rss-feed-post-generator-plugin-for-wordpress/19486974
CVE ID: CVE-2025-4392 State: PUBLISHED Published: 2025-06-03T09:22:03.896Z Last Updated: 2025-06-03T13:53:45.351Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: anssilaitila Products: Shared Files – Frontend File Upload Form & Secure File Sharing Problem Types: CWE-79 Description: The Shared Files – Frontend File Upload Form & Secure File Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via html File uploads in all versions up to, and including, 1.7.48 due to insufficient input sanitization and output escaping within the sanitize_file() function. This makes it possible for unauthenticated attackers to bypass the plugin’s MIME-only che
the sanitize_file() function. This makes it possible for unauthenticated attackers to bypass the plugin’s MIME-only checks and inject arbitrary web scripts in pages that will execute whenever a user accesses the html file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/469a9c8a-0708-4c93-99d8-e9157a1f91f5?source=cve - https://github.com/anssilaitila/shared-files/blob/master/admin/class-sf-admin-allow-more-file-types.php - https://wordpress.org/plugins/shared-files/#developers - https://plugins.trac.wordpress.org/changeset/3304053/
CVE ID: CVE-2025-4393 State: PUBLISHED Published: 2025-07-24T03:22:20.208Z Last Updated: 2025-07-24T14:33:18.381Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H) Vendors: Medtronic Products: MyCareLink Patient Monitor 24950, MyCareLink Patient Monitor 24952 Problem Types: CWE-502 Description: Medtronic MyCareLink Patient Monitor has an internal service that deserializes data, which allows a local attacker to interact with the service by crafting a binary payload to crash the service or elevate privileges. This issue affects MyCareLink Patient Monitor models 24950 and 24952: before June 25, 2025 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
r models 24950 and 24952: before June 25, 2025 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://global.medtronic.com/xg-en/product-security/security-bulletins.html
CVE ID: CVE-2025-4394 State: PUBLISHED Published: 2025-07-24T03:26:06.706Z Last Updated: 2025-07-24T13:19:47.565Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Medtronic Products: MyCareLink Patient Monitor 24950, MyCareLink Patient Monitor 24952 Problem Types: CWE-312 Description: Medtronic MyCareLink Patient Monitor uses an unencrypted filesystem on internal storage, which allows an attacker with physical access to read and modify files. This issue affects MyCareLink Patient Monitor models 24950 and 24952: before June 25, 2025 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://global.medtronic.com/xg-en/product-security/security-bul
l Analyst Notes: - CISA ADP Vulnrichment: References: - https://global.medtronic.com/xg-en/product-security/security-bulletins.html
CVE ID: CVE-2025-4395 State: PUBLISHED Published: 2025-07-24T03:30:24.185Z Last Updated: 2025-07-24T13:18:56.146Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Medtronic Products: MyCareLink Patient Monitor 24950, MyCareLink Patient Monitor 24952 Problem Types: CWE-258 Description: Medtronic MyCareLink Patient Monitor has a built-in user account with an empty password, which allows an attacker with physical access to log in with no password and access modify system functionality. This issue affects MyCareLink Patient Monitor models 24950 and 24952: before June 25, 2025 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://global.medtroni
and 24952: before June 25, 2025 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://global.medtronic.com/xg-en/product-security/security-bulletins.html
CVE ID: CVE-2025-4396 State: PUBLISHED Published: 2025-05-13T03:21:29.625Z Last Updated: 2025-05-13T13:57:36.925Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Relevanssi, msaari Products: Relevanssi – A Better Search (Pro), Relevanssi – A Better Search Problem Types: CWE-89 Description: The Relevanssi – A Better Search plugin for WordPress is vulnerable to time-based SQL Injection via the cats and tags query parameters in all versions up to, and including, 4.24.4 (Free) and <= 2.27.4 (Premium) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated a
ied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries to already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/197be163-4504-4caa-b729-c3293463cfb5?source=cve - https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.24.4/lib/search-tax-query.php#L409 - https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.24.4/lib/search.php#L982 - https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.24.4/lib/search.php#L
ssi/tags/4.24.4/lib/search.php#L982 - https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.24.4/lib/search.php#L1016 - https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.24.4/lib/search-tax-query.php#L371
CVE ID: CVE-2025-4403 State: PUBLISHED Published: 2025-05-09T08:24:05.915Z Last Updated: 2025-05-09T14:44:30.717Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: glenwpcoder Products: Drag and Drop Multiple File Upload for WooCommerce Problem Types: CWE-434 Description: The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.1.6 due to accepting a user‐supplied supported_type string and the uploaded filename without enforcing real extension or MIME checks within the upload() function. This makes it possible for unauthenticated attackers to upload arbitrary f
or MIME checks within the upload() function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/933dd704-5a31-42a9-9b87-bf14a9d4ffa9?source=cve - https://wordpress.org/plugins/drag-and-drop-multiple-file-upload-for-woocommerce/#developers - https://plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-for-woocommerce/tags/1.1.6/inc/class-dnd-upload-wc.php#L360 - https://plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-for-woocomme
lass-dnd-upload-wc.php#L360 - https://plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-for-woocommerce/tags/1.1.6/inc/class-dnd-upload-wc.php#L158 - https://plugins.trac.wordpress.org/changeset/3289478/
CVE ID: CVE-2025-4404 State: PUBLISHED Published: 2025-06-17T13:39:17.945Z Last Updated: 2025-11-06T21:03:41.016Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Telecommunications
ervice, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Enterprise Linux 6 Problem Types: CWE-1220 Description: A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the `krbCanonicalName` for the admin account by default, allowing users to crea