Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
e uploaded file is written directly to disk without adequate sanitization or extension restrictions, a spreadsheet file followed by PHP code can be uploaded and executed on the server, leading to arbitrary code execution. This is due to insufficient mitigation of CVE-2025-22133. This issue has been patched in version 3.4.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-wj2c-237g-cgqp
CVE ID: CVE-2025-58160 State: PUBLISHED Published: 2025-08-29T21:28:22.563Z Last Updated: 2025-09-02T14:08:42.323Z Vendors: tokio-rs Products: tracing Problem Types: CWE-150 Description: tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to manipulate terminal title bars, clear screens or modify terminal display, and potentially mislead users through terminal manipulation. tracing-subscriber ver
screens or modify terminal display, and potentially mislead users through terminal manipulation. tracing-subscriber version 0.3.20 fixes this vulnerability by escaping ANSI control characters when writing events to destinations that may be printed to the terminal. A workaround involves avoiding printing logs to terminal emulators without escaping ANSI control sequences. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/tokio-rs/tracing/security/advisories/GHSA-xwfj-jgwm-7wp5
CVE ID: CVE-2025-58161 State: PUBLISHED Published: 2025-09-02T00:45:49.996Z Last Updated: 2025-09-02T19:25:49.966Z Vendors: MobSF Products: Mobile-Security-Framework-MobSF Problem Types: CWE-22 Description: MobSF is a mobile application security testing tool used. In version 4.4.0, the GET /download/ route uses string path verification via os.path.commonprefix, which allows an authenticated user to download files outside the DWD_DIR download directory from "neighboring" directories whose absolute paths begin with the same prefix as DWD_DIR (e.g., .../downloads_bak, .../downloads.old). This is a Directory Traversal (escape) leading to a data leak. This issue has been patched in version 4.4.1.
loads.old). This is a Directory Traversal (escape) leading to a data leak. This issue has been patched in version 4.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-ccc3-fvfx-mw3v - https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/7f3bc086c028c1b50889cab8a15f7b59b7abdaf9 - https://github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.4.1
CVE ID: CVE-2025-58162 State: PUBLISHED Published: 2025-09-02T00:46:06.864Z Last Updated: 2025-09-02T13:29:01.717Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) Vendors: MobSF Products: Mobile-Security-Framework-MobSF Problem Types: CWE-22 Description: MobSF is a mobile application security testing tool used. In version 4.4.0, an authenticated user who uploaded a specially prepared one.a, can write arbitrary files to any directory writable by the user of the MobSF process. This issue has been patched in version 4.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-9g
ISA ADP Vulnrichment: References: - https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-9gh8-9r95-3fc3 - https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/7f3bc086c028c1b50889cab8a15f7b59b7abdaf9 - https://github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.4.1
CVE ID: CVE-2025-58163 State: PUBLISHED Published: 2025-09-03T01:34:16.404Z Last Updated: 2025-09-03T15:44:39.509Z Vendors: freescout-help-desk Products: freescout Problem Types: CWE-502 Description: FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Versions 1.8.185 and earlier contain a deserialization of untrusted data vulnerability that allows authenticated attackers with knowledge of the application's APP_KEY to achieve remote code execution. The vulnerability is exploited via endpoint, e.g.: `/help/{mailbox_id}/auth/{customer_id}/{hash}/{timestamp}` where the `customer_id` and `timestamp` parameters are processed through the decrypt function in `app/Help
/{timestamp}` where the `customer_id` and `timestamp` parameters are processed through the decrypt function in `app/Helper.php` without proper validation. The code decrypts using Laravel's built-in encryption functions, which subsequently deserialize the decrypted payload without sanitization, allowing attackers to craft malicious serialized PHP objects using classes to trigger arbitrary command execution. This is fixed in version 1.8.186. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-j94w-q9gj-c37g - https://github.com/freescout-help-desk/freescout/commit/e2de65f3f32f825b4ec5558643ed81438c9a6bc6 - h
SA-j94w-q9gj-c37g - https://github.com/freescout-help-desk/freescout/commit/e2de65f3f32f825b4ec5558643ed81438c9a6bc6 - https://github.com/freescout-help-desk/freescout/releases/tag/1.8.186
CVE ID: CVE-2025-58164 State: REJECTED Published: N/A Last Updated: 2025-09-03T02:37:08.587Z Description: No description available.
CVE ID: CVE-2025-58165 State: REJECTED Published: N/A Last Updated: 2025-09-03T02:39:33.655Z Description: No description available.
CVE ID: CVE-2025-58166 State: REJECTED Published: N/A Last Updated: 2025-09-03T02:40:46.088Z Description: No description available.
CVE ID: CVE-2025-58167 State: REJECTED Published: N/A Last Updated: 2025-09-03T02:42:05.166Z Description: No description available.
CVE ID: CVE-2025-58168 State: REJECTED Published: N/A Last Updated: 2025-09-03T02:47:43.156Z Description: No description available.
CVE ID: CVE-2025-58169 State: REJECTED Published: N/A Last Updated: 2025-09-03T02:49:57.445Z Description: No description available.
CVE ID: CVE-2025-58170 State: REJECTED Published: N/A Last Updated: 2025-09-03T02:50:44.634Z Description: No description available.
CVE ID: CVE-2025-58171 State: REJECTED Published: N/A Last Updated: 2025-09-03T22:41:46.166Z Description: No description available.
CVE ID: CVE-2025-58172 State: PUBLISHED Published: 2025-09-15T16:43:19.368Z Last Updated: 2025-09-15T17:29:08.348Z Vendors: plait-board Products: drawnix Problem Types: CWE-79 Description: drawnix is an all in one open-source whiteboard tool. In drawnix versions through 0.2.1, a cross-site scripting (XSS) vulnerability exists in the debug logging functionality. User controlled content is inserted directly into the DOM via innerHTML without sanitization when the global function __drawnix__web__console is invoked, as shown in apps/web/src/app/app.tsx where div.innerHTML = value is executed. This can allow arbitrary JavaScript execution in the context of the application if an attacker can cause
ue is executed. This can allow arbitrary JavaScript execution in the context of the application if an attacker can cause untrusted data to be passed to the debug logger (for example via a malicious extension or other injection vector), potentially exposing user data or enabling unauthorized actions. The issue is fixed in version 0.3.0. Updating to 0.3.0 or later is recommended. No known workarounds exist. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/plait-board/drawnix/security/advisories/GHSA-cq57-q8hg-xhxf - https://github.com/plait-board/drawnix/commit/92536e63c1adcc509ac51fdd439d4794c8081c58
CVE ID: CVE-2025-58174 State: PUBLISHED Published: 2025-09-16T16:29:37.615Z Last Updated: 2025-09-16T18:26:38.482Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: LDAPAccountManager Products: lam Problem Types: CWE-79 Description: LDAP Account Manager (LAM) is a webfrontend for managing entries stored in an LDAP directory. LAM before 9.3 allows stored cross-site scripting in the Profile section via the profile name field, which renders untrusted input as HTML and executes a supplied script (for example a script element). An authenticated user with permission to create or edit a profile can insert a script payload into the profile name and have it executed wh
er with permission to create or edit a profile can insert a script payload into the profile name and have it executed when the profile data is viewed in a browser. This issue is fixed in version 9.3. No known workarounds are mentioned. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-6gqg-wm9x-5x3m
CVE ID: CVE-2025-58176 State: PUBLISHED Published: 2025-09-03T03:52:56.545Z Last Updated: 2025-09-03T15:44:22.816Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: OpenAgentPlatform Products: Dive Problem Types: CWE-94 Description: Dive is an open-source MCP Host Desktop Application that enables integration with function-calling LLMs. In versions 0.9.0 through 0.9.3, there is a one-click Remote Code Execution vulnerability triggered through a custom url value, `transport` in the JSON object. An attacker can exploit the vulnerability in the following two scenarios: a victim visits a malicious website controlled by the attacker and the website redirect to the URL
lowing two scenarios: a victim visits a malicious website controlled by the attacker and the website redirect to the URL automatically, or a victim clicks on such a crafted link embedded on a legitimate website (e.g., in user-generated content). In both cases, the browser invokes Dive's custom URL handler (dive:), which launches the Dive app and processes the crafted URL, leading to arbitrary code execution on the victim’s machine. This vulnerability is caused by improper processing of custom url. This is fixed in version 0.9.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/OpenAgentPlatform/Dive/security/advisories/GHSA-2r34-7pgx-vvrc - https://github.c
ment: References: - https://github.com/OpenAgentPlatform/Dive/security/advisories/GHSA-2r34-7pgx-vvrc - https://github.com/OpenAgentPlatform/Dive/commit/acae6d40354d380f69f8241e9122a43ff64cff11
CVE ID: CVE-2025-58177 State: PUBLISHED Published: 2025-09-15T16:49:06.949Z Last Updated: 2025-09-15T17:27:13.707Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: n8n-io Products: n8n Problem Types: CWE-79 Description: n8n is an open source workflow automation platform. From 1.24.0 to before 1.107.0, there is a stored cross-site scripting (XSS) vulnerability in @n8n/n8n-nodes-langchain.chatTrigger. An authorized user can configure the LangChain Chat Trigger node with malicious JavaScript in the initialMessages field and enable public access so that the payload is executed in the browser of any user who visits the resulting public chat URL. This can be used f
so that the payload is executed in the browser of any user who visits the resulting public chat URL. This can be used for phishing or to steal cookies or other sensitive data from users accessing the public chat link. The issue is fixed in version 1.107.0. Updating to 1.107.0 or later is recommended. As a workaround, the affected chatTrigger node can be disabled. No other workarounds are known. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/n8n-io/n8n/security/advisories/GHSA-mvh4-2cm2-6hpg - https://github.com/n8n-io/n8n/pull/18148 - https://github.com/n8n-io/n8n/commit/d4ef191be0b39b65efa68559a3b8d5dad2e102b2
CVE ID: CVE-2025-58178 State: PUBLISHED Published: 2025-09-02T00:51:24.579Z Last Updated: 2025-09-02T16:07:45.743Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SonarSource Products: sonarqube-scan-action Problem Types: CWE-77 Description: SonarQube Server and Cloud is a static analysis solution for continuous code quality and security inspection. In versions 4 to 5.3.0, a command injection vulnerability was discovered in the SonarQube Scan GitHub Action that allows untrusted input arguments to be processed without proper sanitization. Arguments sent to the action are treated as shell expressions, allowing potential execution of arbitrary commands. A fix has
ments sent to the action are treated as shell expressions, allowing potential execution of arbitrary commands. A fix has been released in SonarQube Scan GitHub Action 5.3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SonarSource/sonarqube-scan-action/security/advisories/GHSA-f79p-9c5r-xg88 - https://github.com/SonarSource/sonarqube-scan-action/pull/200 - https://github.com/SonarSource/sonarqube-scan-action/commit/016cabf33a6b7edf0733e179a03ad408ad4e88ba - https://community.sonarsource.com/t/security-advisory-sonarqube-scanner-github-action/147696 - https://sonarsource.atlassian.net/browse/SQSCANGHA-101
CVE ID: CVE-2025-58179 State: PUBLISHED Published: 2025-09-04T23:36:44.393Z Last Updated: 2025-09-05T14:53:29.299Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: withastro Products: astro Problem Types: CWE-918 Description: Astro is a web framework for content-driven websites. Versions 11.0.3 through 12.6.5 are vulnerable to SSRF when using Astro's Cloudflare adapter. When configured with output: 'server' while using the default imageService: 'compile', the generated image optimization endpoint doesn't check the URLs it receives, allowing content from unauthorized third-party domains to be served. a A bug in impacted versions of the @astrojs/cloudflare adapte
ntent from unauthorized third-party domains to be served. a A bug in impacted versions of the @astrojs/cloudflare adapter for deployment on Cloudflare’s infrastructure, allows an attacker to bypass the third-party domain restrictions and serve any content from the vulnerable origin. This issue is fixed in version 12.6.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/withastro/astro/security/advisories/GHSA-qpr4-c339-7vq8 - https://github.com/withastro/astro/commit/9ecf3598e2b29dd74614328fde3047ea90e67252
CVE ID: CVE-2025-58180 State: PUBLISHED Published: 2025-09-09T19:34:14.765Z Last Updated: 2025-09-10T13:59:11.561Z Vendors: OctoPrint Products: OctoPrint Problem Types: CWE-78 Description: OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.11.2 contain a vulnerability that allows an authenticated attacker to upload a file under a specially crafted filename that will allow arbitrary command execution if said filename becomes included in a command defined in a system event handler and said event gets triggered. If no event handlers executing system commands with uploaded filenames as parameters have been configured, this vulnera
If no event handlers executing system commands with uploaded filenames as parameters have been configured, this vulnerability does not have an impact. The vulnerability is patched in version 1.11.3. As a workaround, OctoPrint administrators who have event handlers configured that include any kind of filename based placeholders should disable those by setting their `enabled` property to `False` or unchecking the "Enabled" checkbox in the GUI based Event Manager. Alternatively, OctoPrint administrators should set `feature.enforceReallyUniversalFilenames` to `true` in `config.yaml` and restart OctoPrint, then vet the existing uploads and make sure to delete any suspicious looking files. As alw
.yaml` and restart OctoPrint, then vet the existing uploads and make sure to delete any suspicious looking files. As always, OctoPrint administrators are advised to not expose OctoPrint on hostile networks like the public internet, and to vet who has access to their instance. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-49mj-x8jp-qvfc - https://github.com/OctoPrint/OctoPrint/commit/be4201ef58d9a7c03593252398c16eada90a258b - https://github.com/OctoPrint/OctoPrint/commit/c3a940962f4658a8e035a00388781b1cbd768841 - https://github.com/OctoPrint/OctoPrint/releases/tag/1.11.3
CVE ID: CVE-2025-58181 State: PUBLISHED Published: 2025-11-19T20:33:42.795Z Last Updated: 2025-11-20T17:14:59.856Z Vendors: golang.org/x/crypto Products: golang.org/x/crypto/ssh Problem Types: CWE-1284 Description: SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA - https://go.dev/cl/721961 - https://go.dev/issue/76363 - https://pkg.go.dev/vuln/GO-2025-4134
CVE ID: CVE-2025-58183 State: PUBLISHED Published: 2025-10-29T22:10:14.376Z Last Updated: 2025-11-04T21:13:32.834Z Vendors: Go standard library Products: archive/tar Problem Types: CWE-400: Uncontrolled Resource Consumption Description: tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - ht
esult in large allocations. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://go.dev/cl/709861 - https://go.dev/issue/75677 - https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI - https://pkg.go.dev/vuln/GO-2025-4014
CVE ID: CVE-2025-58185 State: PUBLISHED Published: 2025-10-29T22:10:13.682Z Last Updated: 2025-11-04T21:13:34.163Z Vendors: Go standard library Products: encoding/asn1 Problem Types: CWE-400: Uncontrolled Resource Consumption Description: Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://go.dev/issue/75671 - https://go.dev/cl/709856 - https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI - https://pkg.go.dev/vuln/GO-2025-4011
CVE ID: CVE-2025-58186 State: PUBLISHED Published: 2025-10-29T22:10:13.912Z Last Updated: 2025-11-04T21:13:35.468Z Vendors: Go standard library Products: net/http Problem Types: CWE-400: Uncontrolled Resource Consumption Description: Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as "a=;", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://go.dev/issue/75672 - https://go.dev/cl/709855 - https://groups.google.com/g/golang-announce/
iner: References: - https://go.dev/issue/75672 - https://go.dev/cl/709855 - https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI - https://pkg.go.dev/vuln/GO-2025-4012
CVE ID: CVE-2025-58187 State: PUBLISHED Published: 2025-10-29T22:10:12.624Z Last Updated: 2025-11-20T22:23:47.179Z Vendors: Go standard library Products: crypto/x509 Problem Types: CWE-407: Inefficient Algorithmic Complexity Description: Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://go.dev/issue/75681 - https://go.dev/cl/709854 - https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI - https://pkg.go.dev/vuln/GO-20
1 - https://go.dev/cl/709854 - https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI - https://pkg.go.dev/vuln/GO-2025-4007
CVE ID: CVE-2025-58188 State: PUBLISHED Published: 2025-10-29T22:10:14.143Z Last Updated: 2025-11-04T21:13:38.109Z Vendors: Go standard library Products: crypto/x509 Problem Types: CWE-248: Uncaught Exception Description: Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method. This affects programs which validate arbitrary certificate chains. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://go.dev/cl/709853 - https://go.dev/issue/75675 - https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI - https://pkg.go.dev/vuln/GO-2025-4013
CVE ID: CVE-2025-58189 State: PUBLISHED Published: 2025-10-29T22:10:12.947Z Last Updated: 2025-11-04T21:13:39.428Z Vendors: Go standard library Products: crypto/tls Problem Types: CWE-117: Improper Output Neutralization for Logs Description: When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://go.dev/cl/707776 - https://go.dev/issue/75652 - https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI - https://pkg.go.dev/vuln/GO-2025-4008
CVE ID: CVE-2025-58192 State: PUBLISHED Published: 2025-08-27T17:45:38.564Z Last Updated: 2025-08-27T18:35:25.066Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Xylus Themes Products: WP Bulk Delete Problem Types: CWE-862 Description: Missing Authorization vulnerability in Xylus Themes WP Bulk Delete allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Bulk Delete: from n/a through 1.3.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-bulk-delete/vulnerability/wordpress-wp-bulk-delete-plugin-1-3-6-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-58193 State: PUBLISHED Published: 2025-08-27T17:45:39.273Z Last Updated: 2025-08-27T18:53:40.989Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Uncanny Owl Products: Uncanny Automator Problem Types: CWE-862 Description: Missing Authorization vulnerability in Uncanny Owl Uncanny Automator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Uncanny Automator: from n/a through 6.7.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/uncanny-automator/vulnerability/wordpress-uncanny-automator-plugin-6-7-0-1-broken-access-control-vulnerabil
press/plugin/uncanny-automator/vulnerability/wordpress-uncanny-automator-plugin-6-7-0-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-58194 State: PUBLISHED Published: 2025-08-27T17:45:39.929Z Last Updated: 2025-08-27T18:37:47.539Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: boldthemes Products: Bold Page Builder Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder allows Stored XSS. This issue affects Bold Page Builder: from n/a through 5.4.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/bold-page-builder/vulnerability/wordpress-bold-page-builder-plugin-5-4-3-cross-site-scripting-xss-vulne
wordpress/plugin/bold-page-builder/vulnerability/wordpress-bold-page-builder-plugin-5-4-3-cross-site-scripting-xss-vulnerability?_s_id=cve