Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-0328 State: PUBLISHED Published: 2025-01-09T04:31:06.588Z Last Updated: 2025-01-09T16:22:00.573Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: KaiYuanTong Products: ECT Platform Problem Types: CWE-77, CWE-74 Description: A vulnerability, which was classified as critical, has been found in KaiYuanTong ECT Platform up to 2.0.0. Affected by this issue is some unknown functionality of the file /public/server/runCode.php of the component HTTP POST Request Handler. The manipulation of the argument code leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about th
launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290792 - https://vuldb.com/?ctiid.290792 - https://vuldb.com/?submit.470601 - https://note.zhaoj.in/share/ASPsoVCrLqKK
CVE ID: CVE-2025-0329 State: PUBLISHED Published: 2025-05-15T20:07:24.900Z Last Updated: 2025-05-20T19:12:24.053Z Vendors: Unknown Products: AI ChatBot for WordPress Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The AI ChatBot for WordPress WordPress plugin before 6.2.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/db101819-4404-46c9-a02e-b1b1b7ace11e/
CVE ID: CVE-2025-0330 State: PUBLISHED Published: 2025-03-20T10:09:34.164Z Last Updated: 2025-03-20T18:37:28.101Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: berriai Products: berriai/litellm Problem Types: CWE-1230 Description: In berriai/litellm version v1.52.1, an issue in proxy_server.py causes the leakage of Langfuse API keys when an error occurs while parsing team settings. This vulnerability exposes sensitive information, including langfuse_secret and langfuse_public_key, which can provide full access to the Langfuse project storing all requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/661b388a-44d
g all requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/661b388a-44d8-4ad5-862b-4dc5b80be30a
CVE ID: CVE-2025-0331 State: PUBLISHED Published: 2025-01-09T04:31:09.870Z Last Updated: 2025-01-09T16:12:00.853Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: n/a Products: YunzMall Problem Types: CWE-640 Description: A vulnerability, which was classified as critical, has been found in YunzMall up to 2.4.2. This issue affects the function changePwd of the file /app/platform/controllers/ResetpwdController.php of the component HTTP POST Request Handler. The manipulation of the argument pwd leads to weak password recovery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about
initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290819 - https://vuldb.com/?ctiid.290819 - https://vuldb.com/?submit.471663 - https://note.zhaoj.in/share/DsijzdQDJSAp
CVE ID: CVE-2025-0332 State: PUBLISHED Published: 2025-02-12T15:15:31.166Z Last Updated: 2025-02-12T15:31:36.602Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Progress Software Products: Progress® Telerik® UI for WinForms Problem Types: CWE-22 Description: In Progress® Telerik® UI for WinForms, versions prior to 2025 Q1 (2025.1.211), using the improper limitation of a target path can lead to decompressing an archive's content into a restricted directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.telerik.com/devtools/winforms/knowledge-base/kb-security-path-traversal-cve-2025-0332
CVE ID: CVE-2025-0333 State: PUBLISHED Published: 2025-01-09T05:00:12.824Z Last Updated: 2025-01-09T16:11:05.108Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: leiyuxi Products: cy-fast Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in leiyuxi cy-fast 1.0. Affected is the function listData of the file /sys/role/listData. The manipulation of the argument order leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290820 - https://vuldb.com/?ctiid.290820 - http
lyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290820 - https://vuldb.com/?ctiid.290820 - https://vuldb.com/?submit.475297 - https://github.com/d3do-23/cvelist/blob/main/cy-fast/sqli1.md
CVE ID: CVE-2025-0334 State: PUBLISHED Published: 2025-01-09T06:00:07.480Z Last Updated: 2025-01-09T15:36:50.298Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: leiyuxi Products: cy-fast Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in leiyuxi cy-fast 1.0 and classified as critical. Affected by this vulnerability is the function listData of the file /sys/user/listData. The manipulation of the argument order leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290821 - https://vuldb.com/?ctiid.290
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290821 - https://vuldb.com/?ctiid.290821 - https://vuldb.com/?submit.475302 - https://github.com/d3do-23/cvelist/blob/main/cy-fast/sqli2.md
CVE ID: CVE-2025-0335 State: PUBLISHED Published: 2025-01-09T06:00:10.578Z Last Updated: 2025-01-09T15:33:42.638Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Online Bike Rental System Problem Types: CWE-434, CWE-284 Description: A vulnerability was found in code-projects Online Bike Rental System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the component Change Image Handler. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other endpoints might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichmen
the public and may be used. Other endpoints might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290822 - https://vuldb.com/?ctiid.290822 - https://vuldb.com/?submit.475365 - https://github.com/Huandtx/cve/blob/main/cve/Online%20Bike%20Rental%20System/File_upload1.md - https://code-projects.org/
CVE ID: CVE-2025-0336 State: PUBLISHED Published: 2025-01-09T06:31:04.821Z Last Updated: 2025-01-09T15:32:12.036Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Codezips Products: Project Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Codezips Project Management System 1.0. It has been classified as critical. This affects an unknown part of the file /pages/forms/teacher.php. The manipulation of the argument name leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290823
he public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290823 - https://vuldb.com/?ctiid.290823 - https://vuldb.com/?submit.475493 - https://github.com/fuulof/CVE/issues/1
CVE ID: CVE-2025-0337 State: PUBLISHED Published: 2025-03-06T16:29:12.094Z Last Updated: 2025-03-06T16:41:58.850Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: ServiceNow Products: Now Platform Problem Types: CWE-639 Description: ServiceNow has addressed an authorization bypass vulnerability that was identified in the Washington release of the Now Platform. This vulnerability, if exploited, potentially could enable an authenticated user to access unauthorized data stored within the Now Platform that the user otherwise would not be entitled to access. This issue is addressed in the listed patches and family release, which have been made available to hosted
d to access. This issue is addressed in the listed patches and family release, which have been made available to hosted and self-hosted customers, as well as partners. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1948695
CVE ID: CVE-2025-0339 State: PUBLISHED Published: 2025-01-09T07:00:12.725Z Last Updated: 2025-01-09T15:45:47.626Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: code-projects Products: Online Bike Rental Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic has been found in code-projects Online Bike Rental 1.0. Affected is an unknown function of the file /vehical-details.php of the component HTTP GET Request Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290826 - https://vuldb.com/?ctiid.290826 - https://vul
tes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290826 - https://vuldb.com/?ctiid.290826 - https://vuldb.com/?submit.475731 - https://code-projects.org/
CVE ID: CVE-2025-0340 State: PUBLISHED Published: 2025-01-09T07:00:14.298Z Last Updated: 2025-01-09T15:45:10.558Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: code-projects Products: Cinema Seat Reservation System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in code-projects Cinema Seat Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/deleteBooking.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290827 - https://vuldb.com/?ctiid.290827 - https://vuldb.com/?submit.476707 - https://code-projects.org/
CVE ID: CVE-2025-0341 State: PUBLISHED Published: 2025-01-09T07:31:05.715Z Last Updated: 2025-01-09T15:24:23.618Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: CampCodes Products: Computer Laboratory Management System Problem Types: CWE-434, CWE-284 Description: A vulnerability, which was classified as critical, has been found in CampCodes Computer Laboratory Management System 1.0. Affected by this issue is some unknown functionality of the file /class/edit/edit. The manipulation of the argument e_photo leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichme
remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290828 - https://vuldb.com/?ctiid.290828 - https://vuldb.com/?submit.476884 - https://github.com/shaturo1337/POCs/blob/main/Remote%20Code%20Execution%20via%20Arbitrary%20File%20Upload%20in%20Computer%20Laboratory%20Management%20System.md - https://www.campcodes.com/
CVE ID: CVE-2025-0342 State: PUBLISHED Published: 2025-01-09T07:31:07.686Z Last Updated: 2025-01-09T15:13:22.417Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: CampCodes Products: Computer Laboratory Management System Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, was found in CampCodes Computer Laboratory Management System 1.0. This affects an unknown part of the file /class/edit/edit. The manipulation of the argument s_lname leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst No
loit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290829 - https://vuldb.com/?ctiid.290829 - https://vuldb.com/?submit.476897 - https://github.com/shaturo1337/POCs/blob/main/Stored%20XSS%20Vulnerability%20in%20Computer%20Laboratory%20Management%20System.md - https://www.campcodes.com/
CVE ID: CVE-2025-0343 State: PUBLISHED Published: 2025-01-15T00:48:07.959Z Last Updated: 2025-03-24T16:07:03.833Z Vendors: Swift Project Products: Swift ASN1 Problem Types: CWE-228: Improper Handling of Syntactically Invalid Structure Description: Swift ASN.1 can be caused to crash when parsing certain BER/DER constructions. This crash is caused by a confusion in the ASN.1 library itself which assumes that certain objects can only be provided in either constructed or primitive forms, and will trigger a preconditionFailure if that constraint isn't met. Importantly, these constraints are actually required to be true in DER, but that correctness wasn't enforced on the early node parser side so
straints are actually required to be true in DER, but that correctness wasn't enforced on the early node parser side so it was incorrect to rely on it later on in decoding, which is what the library did. These crashes can be triggered when parsing any DER/BER format object. There is no memory-safety issue here: the crash is a graceful one from the Swift runtime. The impact of this is that it can be used as a denial-of-service vector when parsing BER/DER data from unknown sources, e.g. when parsing TLS certificates. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/apple/swift-asn1/security/advisories/GHSA-w8xv-rwgf-4fwh
CVE ID: CVE-2025-0344 State: PUBLISHED Published: 2025-01-09T08:00:11.451Z Last Updated: 2025-01-09T15:19:34.410Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: leiyuxi Products: cy-fast Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in leiyuxi cy-fast 1.0 and classified as critical. Affected by this vulnerability is the function listData of the file /commpara/listData. The manipulation of the argument order leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290857 - https://vuldb.com/?ctiid.290
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290857 - https://vuldb.com/?ctiid.290857 - https://vuldb.com/?submit.475747 - https://github.com/d3do-23/cvelist/blob/main/cy-fast/sqli3.md
CVE ID: CVE-2025-0345 State: PUBLISHED Published: 2025-01-09T08:31:04.947Z Last Updated: 2025-01-09T15:04:50.856Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: leiyuxi Products: cy-fast Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in leiyuxi cy-fast 1.0 and classified as critical. Affected by this issue is the function listData of the file /sys/menu/listData. The manipulation of the argument order leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290858 - https://vuldb.com/?ctiid.290858 - https:/
t Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290858 - https://vuldb.com/?ctiid.290858 - https://vuldb.com/?submit.475748 - https://github.com/d3do-23/cvelist/blob/main/cy-fast/sqli4.md
CVE ID: CVE-2025-0346 State: PUBLISHED Published: 2025-01-09T09:00:14.484Z Last Updated: 2025-01-09T15:03:37.213Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: code-projects Products: Content Management System Problem Types: CWE-434, CWE-284 Description: A vulnerability was found in code-projects Content Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/publishnews.php of the component Publish News Page. The manipulation of the argument image leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vuln
attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290859 - https://vuldb.com/?ctiid.290859 - https://vuldb.com/?submit.476728 - https://gist.github.com/Lytes/266e5fa6eb4506fe2c7e35166664249a - https://code-projects.org/
CVE ID: CVE-2025-0347 State: PUBLISHED Published: 2025-01-09T09:31:05.072Z Last Updated: 2025-01-09T15:01:19.822Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: code-projects Products: Admission Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Admission Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file index.php of the component Login. The manipulation of the argument u_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:/
s been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290860 - https://vuldb.com/?ctiid.290860 - https://vuldb.com/?submit.476898 - https://github.com/Curious-L/-/issues/3 - https://code-projects.org/
CVE ID: CVE-2025-0348 State: PUBLISHED Published: 2025-01-09T10:00:09.600Z Last Updated: 2025-01-09T14:59:54.376Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: CampCodes Products: DepEd Equipment Inventory System Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in CampCodes DepEd Equipment Inventory System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /data/add_employee.php. The manipulation of the argument data leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:/
s been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290861 - https://vuldb.com/?ctiid.290861 - https://vuldb.com/?submit.476908 - https://github.com/shaturo1337/POCs/blob/main/Stored%20XSS%20Vulnerability%20in%20DepEd%20Equipment%20Inventory%20System.md - https://www.campcodes.com/
CVE ID: CVE-2025-0349 State: PUBLISHED Published: 2025-01-09T10:31:07.078Z Last Updated: 2025-03-22T08:18:34.282Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: AC6 Problem Types: CWE-121, CWE-119 Description: A vulnerability classified as critical has been found in Tenda AC6 15.03.05.16. Affected is the function GetParentControlInfo of the file /goform/GetParentControlInfo. The manipulation of the argument src/mac leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290862 - https://vuldb.com/?ctiid.290862 - https://vuldb.com/?submit.477048 - https://github.com/wy876/cve/issues/5 - https://www.tenda.com.cn/
CVE ID: CVE-2025-0350 State: PUBLISHED Published: 2025-01-25T09:22:46.301Z Last Updated: 2025-01-27T15:32:58.279Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: badhonrocks Products: Carousel Maker for Divi Problem Types: CWE-79 Description: The Divi Carousel Maker – Image, Logo, Testimonial, Post Carousel & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Carousel and Logo Carousel in all versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject
plied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9e57a85b-3ea8-46df-ab60-ce835268b1f6?source=cve - https://plugins.trac.wordpress.org/browser/wow-carousel-for-divi-lite/trunk/includes/divi4/modules/ImageCarouselChild/ImageCarouselChild.php#L327 - https://plugins.trac.wordpress.org/browser/wow-carousel-for-divi-lite/trunk/includes/divi4/modules/LogoCarouselChild/LogoCarouselChild.php#L168 - https://wordpress.or
-carousel-for-divi-lite/trunk/includes/divi4/modules/LogoCarouselChild/LogoCarouselChild.php#L168 - https://wordpress.org/plugins/wow-carousel-for-divi-lite/#developers - https://plugins.trac.wordpress.org/changeset/3226742/
CVE ID: CVE-2025-0351 State: REJECTED Published: N/A Last Updated: 2025-11-19T09:35:35.461Z Description: No description available.
CVE ID: CVE-2025-0352 State: PUBLISHED Published: 2025-02-20T19:15:26.524Z Last Updated: 2025-02-20T20:24:19.657Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Rapid Response Monitoring Products: My Security Account App API Problem Types: CWE-639 Description: Rapid Response Monitoring My Security Account App utilizes an API that could be exploited by an attacker to modify request data, potentially causing the API to return information about other users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-051-05 - https://www.rrms.com/contact-us/
CVE ID: CVE-2025-0353 State: PUBLISHED Published: 2025-01-29T11:10:03.278Z Last Updated: 2025-02-12T19:51:14.571Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: badhonrocks Products: Divi Torque Lite Problem Types: CWE-79 Description: The Divi Torque Lite – Best Divi Addon, Extensions, Modules & Social Modules plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages t
ossible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d5810757-1866-4788-809f-2c68e16a5156?source=cve - https://plugins.trac.wordpress.org/browser/addons-for-divi/trunk/includes/modules/divi-4/VideoModal/VideoModal.php#L593 - https://plugins.trac.wordpress.org/browser/addons-for-divi/trunk/includes/modules/divi-4/ImageCarouselChild/ImageCarouselChild.php#L507 - https://plugins.trac.wordpress.org/browser/addons-for-divi/trunk/includes/modules/divi-