Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-2132 State: PUBLISHED Published: 2025-03-09T23:00:06.280Z Last Updated: 2025-03-10T17:38:58.551Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: n/a Products: ftcms Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in ftcms 2.1. Affected is an unknown function of the file /admin/index.php/web/ajax_all_lists of the component Search. The manipulation of the argument name leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA A
The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.299052 - https://vuldb.com/?ctiid.299052 - https://vuldb.com/?submit.511614 - https://github.com/ahieafe/zpp/issues/2
CVE ID: CVE-2025-2133 State: PUBLISHED Published: 2025-03-09T23:31:04.962Z Last Updated: 2025-03-10T17:24:28.102Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: n/a Products: ftcms Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic was found in ftcms 2.1. Affected by this vulnerability is an unknown functionality of the file /admin/index.php/news/edit. The manipulation of the argument title leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.
rameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.299053 - https://vuldb.com/?ctiid.299053 - https://vuldb.com/?submit.511627 - https://github.com/ahieafe/zpp/issues/3
CVE ID: CVE-2025-2135 State: PUBLISHED Published: 2025-03-10T20:39:17.029Z Last Updated: 2025-03-12T04:00:34.574Z Vendors: Google Products: Chrome Problem Types: CWE-843 Description: Type Confusion in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_10.html - https://issues.chromium.org/issues/400052777
CVE ID: CVE-2025-2136 State: PUBLISHED Published: 2025-03-10T20:39:17.258Z Last Updated: 2025-03-12T04:00:33.049Z Vendors: Google Products: Chrome Problem Types: CWE-416 Description: Use after free in Inspector in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_10.html - https://issues.chromium.org/issues/395032416
CVE ID: CVE-2025-2137 State: PUBLISHED Published: 2025-03-10T20:39:17.660Z Last Updated: 2025-03-12T04:00:37.149Z Vendors: Google Products: Chrome Problem Types: CWE-125 Description: Out of bounds read in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_10.html - https://issues.chromium.org/issues/398999390
CVE ID: CVE-2025-2138 State: PUBLISHED Published: 2025-10-12T13:37:02.296Z Last Updated: 2025-10-14T15:10:47.518Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: IBM Products: Engineering Requirements Management Doors Next Problem Types: CWE-602 Description: IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to delete comments from other users due to client-side enforcement of server-side security. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7247716
CVE ID: CVE-2025-2139 State: PUBLISHED Published: 2025-10-12T13:35:24.921Z Last Updated: 2025-10-14T14:48:18.322Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: IBM Products: Engineering Requirements Management Doors Next Problem Types: CWE-602 Description: IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to delete reviews from other users due to client-side enforcement of server-side security. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7247716
CVE ID: CVE-2025-2140 State: PUBLISHED Published: 2025-10-12T13:33:22.545Z Last Updated: 2025-10-14T14:53:08.219Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: IBM Products: Engineering Requirements Management Doors Next Problem Types: CWE-346 Description: IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to spoof email identity of the sender due to improper verification of source data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7247716
CVE ID: CVE-2025-2141 State: PUBLISHED Published: 2025-07-01T01:01:51.136Z Last Updated: 2025-08-24T11:34:35.439Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: System Storage Virtualization Engine TS7700 Problem Types: CWE-79 Description: IBM System Storage Virtualization Engine TS7700 3957 VED R5.4 8.54.2.17, R6.0 8.60.0.115, 3948 VED R5.4 8.54.2.17, R6.0 8.60.0.115, and 3948 VEF R6.0 8.60.0.115 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. A
eb UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7238556
CVE ID: CVE-2025-2146 State: PUBLISHED Published: 2025-05-25T23:36:36.024Z Last Updated: 2025-05-27T14:20:02.153Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Canon Inc. Products: Satera MF656Cdw, Satera MF654Cdw, Satera MF551dw, Satera MF457dw, Color imageCLASS MF656Cdw, Color imageCLASS MF654Cdw, Color imageCLASS MF653Cdw, Color imageCLASS MF652Cdw, Color imageCLASS LBP633Cdw, Color imageCLASS LBP632Cdw, imageCLASS MF455dw, imageCLASS MF453dw, imageCLASS MF452dw, imageCLASS MF451dw, imageCLASS LBP237dw, imageCLASS LBP236dw, imageCLASS X MF1238 II, imageCLASS X MF1643i II, imageCLASS X MF1643iF II, imageCLASS X LBP1238 II, i-SENSYS MF657Cdw, i-SENSYS M
S X MF1238 II, imageCLASS X MF1643i II, imageCLASS X MF1643iF II, imageCLASS X LBP1238 II, i-SENSYS MF657Cdw, i-SENSYS MF655Cdw, i-SENSYS MF651Cdw, i-SENSYS LBP633Cdw, i-SENSYS LBP631Cdw, i-SENSYS MF553dw, i-SENSYS MF552dw, i-SENSYS MF455dw, i-SENSYS MF453dw, i-SENSYS LBP236dw, i-SENSYS LBP233dw, imageRUNNER 1643iF II, imageRUNNER 1643i II, i-SENSYS X 1238iF II, i-SENSYS X 1238i II, i-SENSYS X 1238P II, i-SENSYS X 1238Pr II Problem Types: CWE-787 Description: Buffer overflow in WebService Authentication processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arb
which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera MF656Cdw/Satera MF654Cdw/Satera MF551dw/Satera MF457dw firmware v05.07 and earlier sold in Japan. Color imageCLASS MF656Cdw/Color imageCLASS MF654Cdw/Color imageCLASS MF653Cdw/Color imageCLASS MF652Cdw/Color imageCLASS LBP633Cdw/Color imageCLASS LBP632Cdw/imageCLASS MF455dw/imageCLASS MF453dw/imageCLASS MF452dw/imageCLASS MF451dw/imageCLASS LBP237dw/imageCLASS LBP236dw/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II/imageCLASS X LBP1238 II firmware v05.07 and earlier sold in US. i-SENSYS MF657Cdw/i-SENSYS MF655Cdw/i-SENSYS MF65
3iF II/imageCLASS X LBP1238 II firmware v05.07 and earlier sold in US. i-SENSYS MF657Cdw/i-SENSYS MF655Cdw/i-SENSYS MF651Cdw/i-SENSYS LBP633Cdw/i-SENSYS LBP631Cdw/i-SENSYS MF553dw/i-SENSYS MF552dw/i-SENSYS MF455dw/i-SENSYS MF453dw/i-SENSYS LBP236dw/i-SENSYS LBP233dw/imageRUNNER 1643iF II/imageRUNNER 1643i II/i-SENSYS X 1238iF II/i-SENSYS X 1238i II/i-SENSYS X 1238P II/i-SENSYS X 1238Pr II firmware v05.07 and earlier sold in Europe. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.canon/advisory-information/cp2025-001/ - https://canon.jp/support/support-info/250127vulnerability-response - https://www.usa.canon.com/support/canon-product-advisories/service-notice-r
/support-info/250127vulnerability-response - https://www.usa.canon.com/support/canon-product-advisories/service-notice-regarding-vulnerability-measure-against-buffer-overflow-for-laser-printers-and-small-office-multifunctional-printers - https://www.canon-europe.com/support/product-security/#news
CVE ID: CVE-2025-2147 State: PUBLISHED Published: 2025-03-10T11:00:07.615Z Last Updated: 2025-03-10T12:33:51.927Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Beijing Zhide Intelligent Internet Technology Products: Modern Farm Digital Integrated Management System Problem Types: CWE-552, CWE-425 Description: A vulnerability was found in Beijing Zhide Intelligent Internet Technology Modern Farm Digital Integrated Management System 1.0. It has been classified as problematic. Affected is an unknown function. The manipulation leads to files or directories accessible. It is possible to launch the attack remotely. The exploit has been disclosed to the public and
r directories accessible. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Multiple endpoints are affected. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.299058 - https://vuldb.com/?ctiid.299058 - https://vuldb.com/?submit.506593 - https://github.com/fubxx/CVE/blob/main/%E7%91%9E%E7%94%B0%E7%8E%B0%E4%BB%A3%E5%86%9C%E5%9C%BA%E6%95%B0%E5%AD%97%E5%8C%96%E7%BB%BC%E5%90%88%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F%E7%9B%AE%E5%BD%95%E9%81%8D%E5%8E%86.md
CVE ID: CVE-2025-2148 State: PUBLISHED Published: 2025-03-10T12:00:07.912Z Last Updated: 2025-03-10T14:10:36.958Z Severity: N/A (CVSS 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P) Vendors: n/a Products: PyTorch Problem Types: CWE-119 Description: A vulnerability was found in PyTorch 2.6.0+cu124. It has been declared as critical. Affected by this vulnerability is the function torch.ops.profiler._call_end_callbacks_on_jit_fut of the component Tuple Handler. The manipulation of the argument None leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
rather high. The exploitation appears to be difficult. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.299059 - https://vuldb.com/?ctiid.299059 - https://vuldb.com/?submit.505959 - https://github.com/pytorch/pytorch/issues/147722
CVE ID: CVE-2025-2149 State: PUBLISHED Published: 2025-03-10T12:31:04.788Z Last Updated: 2025-03-10T14:08:14.533Z Severity: LOW (CVSS 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: n/a Products: PyTorch Problem Types: CWE-665 Description: A vulnerability was found in PyTorch 2.6.0+cu124. It has been rated as problematic. Affected by this issue is the function nnq_Sigmoid of the component Quantized Sigmoid Module. The manipulation of the argument scale/zero_point leads to improper initialization. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be u
ack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.299060 - https://vuldb.com/?ctiid.299060 - https://vuldb.com/?submit.506563 - https://github.com/pytorch/pytorch/issues/147818 - https://github.com/pytorch/pytorch/issues/147818#issue-2877301660
CVE ID: CVE-2025-2150 State: PUBLISHED Published: 2025-03-10T07:12:22.552Z Last Updated: 2025-03-10T15:34:31.590Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: HGiga Products: C&Cm@il Problem Types: CWE-79 Description: The C&Cm@il from HGiga has a Stored Cross-Site Scripting (XSS) vulnerability, allowing remote attackers with regular privileges to send emails containing malicious JavaScript code, which will be executed in the recipient's browser when they view the email. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10004-99474-1.html - https://www.twcert.org.tw/en/cp-139-10005-05e0f-2.html
CVE ID: CVE-2025-2151 State: PUBLISHED Published: 2025-03-10T13:00:07.622Z Last Updated: 2025-03-21T08:51:59.842Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Open Asset Import Library Products: Assimp Problem Types: CWE-121, CWE-119 Description: A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assimp::GetNextLine in the library ParsingUtils.h of the component File Handler. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.299062 - https://vuldb.com/?ctiid.299062 - https://vuldb.com/?submit.510582 - https://github.com/assimp/assimp/issues/6016 - https://github.com/assimp/assimp/issues/6026 - https://github.com/sae-as-me/Crashes/raw/refs/heads/main/assimp/assimp_crash_1
CVE ID: CVE-2025-2152 State: PUBLISHED Published: 2025-03-10T13:31:04.159Z Last Updated: 2025-05-12T15:35:15.861Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Open Asset Import Library Products: Assimp Problem Types: CWE-122, CWE-119 Description: A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function Assimp::BaseImporter::ConvertToUTF8 of the file BaseImporter.cpp of the component File Handler. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichm
d remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.299063 - https://vuldb.com/?ctiid.299063 - https://vuldb.com/?submit.510818 - https://github.com/assimp/assimp/issues/6027 - https://github.com/assimp/assimp/issues/6027#issue-2877629241
CVE ID: CVE-2025-2153 State: PUBLISHED Published: 2025-03-10T14:00:09.524Z Last Updated: 2025-05-12T15:35:33.596Z Severity: N/A (CVSS 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P) Vendors: n/a Products: HDF5 Problem Types: CWE-122, CWE-119 Description: A vulnerability, which was classified as critical, was found in HDF5 1.14.6. Affected is the function H5SM_delete of the file H5SM.c of the component h5 File Handler. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnric
be difficult. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.299064 - https://vuldb.com/?ctiid.299064 - https://vuldb.com/?submit.510819 - https://github.com/HDFGroup/hdf5/issues/5329 - https://github.com/sae-as-me/Crashes/raw/refs/heads/main/hdf5/h5_extended_crash.h5
CVE ID: CVE-2025-2156 State: REJECTED Published: N/A Last Updated: 2025-04-30T17:09:30.085Z Description: No description available.
CVE ID: CVE-2025-2157 State: PUBLISHED Published: 2025-03-15T06:35:52.221Z Last Updated: 2025-11-21T07:08:05.036Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Red Hat Products: Satellite Server, Red Hat Satellite 6 Problem Types: CWE-922 Description: A flaw was found in Foreman/Red Hat Satellite. Improper file permissions allow low-privileged OS users to monitor and access temporary files under /var/tmp, exposing sensitive command outputs, such as /etc/shadow. This issue can lead to information disclosure and privilege escalation if exploited effectively. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/
ed effectively. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-2157 - https://bugzilla.redhat.com/show_bug.cgi?id=2351092
CVE ID: CVE-2025-2158 State: PUBLISHED Published: 2025-05-10T09:23:00.814Z Last Updated: 2025-05-12T13:20:18.527Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: mythemeshop Products: WordPress Review Plugin: The Ultimate Solution for Building a Review Website Problem Types: CWE-22 Description: The WordPress Review Plugin: The Ultimate Solution for Building a Review Website plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.3.5 via the Post custom fields. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the
attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP file types can be uploaded and included, or pearcmd is enabled on a server with register_argc_argv also enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a058e6bf-109f-4985-8aad-08858553c4c3?source=cve - https://plugins.trac.wordpress.org/browser/wp-review/tags/5.3.5/includes/shortcodes.php - https://plugins.trac.wordpress.org/browser/wp-revi
.wordpress.org/browser/wp-review/tags/5.3.5/includes/shortcodes.php - https://plugins.trac.wordpress.org/browser/wp-review/tags/5.3.5/includes/functions.php
CVE ID: CVE-2025-2159 State: PUBLISHED Published: 2025-04-04T06:06:48.568Z Last Updated: 2025-04-04T14:38:05.474Z Vendors: M-Files Corporation Products: M-Files Admin Problem Types: CWE-79 Description: Stored XSS in Desktop UI in M-Files Server Admin tool before version 25.3.14681.7 on Windows allows authenticated local user to run scripts via UI Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://product.m-files.com/security-advisories/cve-2025-2159/
CVE ID: CVE-2025-2160 State: PUBLISHED Published: 2025-04-14T14:16:34.517Z Last Updated: 2025-04-14T14:32:12.589Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Pegasystems Products: Pega Infinity Problem Types: CWE-79 Description: Pega Platform versions 8.4.3 to Infinity 24.2.1 are affected by an XSS issue with Mashup Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.pega.com/support-doc/pega-security-advisory-d25-vulnerability-remediation-note
CVE ID: CVE-2025-2161 State: PUBLISHED Published: 2025-04-14T14:19:37.824Z Last Updated: 2025-04-14T14:32:37.786Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) Vendors: Pegasystems Products: Pega Infinity Problem Types: CWE-79 Description: Pega Platform versions 7.2.1 to Infinity 24.2.1 are affected by an XSS issue with Mashup Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.pega.com/support-doc/pega-security-advisory-d25-vulnerability-remediation-note
CVE ID: CVE-2025-2162 State: PUBLISHED Published: 2025-04-18T06:00:08.243Z Last Updated: 2025-04-18T12:00:29.424Z Vendors: Unknown Products: MapPress Maps for WordPress Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The MapPress Maps for WordPress plugin before 2.94.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/06063788-7ab8-49cc-9911-1d9926fcf99d/
CVE ID: CVE-2025-2163 State: PUBLISHED Published: 2025-03-15T03:23:23.156Z Last Updated: 2025-03-17T21:28:30.044Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: zoorum Products: Zoorum Comments Problem Types: CWE-79 Description: The Zoorum Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9. This is due to missing or incorrect nonce validation on the zoorum_set_options() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a
scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2b58fb0f-c7ac-4ee6-84f1-ac14617a7c2b?source=cve - https://plugins.trac.wordpress.org/browser/zoorum-comments/tags/0.9/zoorum-comments-admin.php#L18 - https://plugins.trac.wordpress.org/browser/zoorum-comments/tags/0.9/zoorum-comments-admin.php#L38 - https://wordpress.org/plugins/zoorum-comments/
CVE ID: CVE-2025-2164 State: PUBLISHED Published: 2025-03-15T03:23:23.563Z Last Updated: 2025-03-17T21:28:24.538Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: pixelstats Products: pixelstats Problem Types: CWE-79 Description: The pixelstats plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post_id' and 'sortby' parameters in all versions up to, and including, 0.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Addition
pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8683bc00-1136-42c4-a256-84b2cac1d575?source=cve - https://plugins.trac.wordpress.org/browser/pixelstats/tags/0.8.2/pixelstats.php#L331 - https://plugins.trac.wordpress.org/browser/pixelstats/tags/0.8.2/pixelstats.php#L664 - https://wordpress.org/plugins/pixelstats/