Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
5. This makes it possible for unauthenticated attackers to delete arbitrary posts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/96bd997f-63d5-47a7-b433-486c1113b44b?source=cve - https://plugins.trac.wordpress.org/changeset/3398056/idonate/trunk/src/Helpers/IDonateAjaxHandler.php?old=3372718&old_path=idonate%2Ftags%2F2.1.13%2Fsrc%2FHelpers%2FIDonateAjaxHandler.php - https://plugins.trac.wordpress.org/changeset/3400306/idonate/trunk/src/Helpers/IDonateAjaxHandler.php?old=3372718&old_path=idonate%2Ftags%2F2.1.13%2Fsrc%2FHelpers%2FIDonateAjaxHandler.php
CVE ID: CVE-2025-12878 State: PUBLISHED Published: 2025-11-19T05:45:13.633Z Last Updated: 2025-11-19T20:28:42.804Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: amans2k Products: FunnelKit – Funnel Builder for WooCommerce Checkout Problem Types: CWE-79 Description: The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `wfop_phone` shortcode in all versions up to, and including, 3.13.1.2. This is due to insufficient input sanitization and output escaping on the user-supplied `default` attribute. This makes it possible for authenticated attackers, with Contributor-level access and ab
r-supplied `default` attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6f54053e-30ff-449b-b696-92d503011a4d?source=cve - https://wordpress.org/plugins/funnel-builder - https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.13.1.2/modules/optins/merge-tags/class-bwf-optin-tags.php#L30 - https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.13.1.2/modules/optins/merge-tags/class-bwf-optin-tags.php#L
s://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.13.1.2/modules/optins/merge-tags/class-bwf-optin-tags.php#L96 - https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.13.1.2/modules/optins/merge-tags/class-bwf-optin-tags.php#L101 - https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.13.1.2/modules/optins/merge-tags/class-bwf-optin-tags.php#L116 - https://plugins.trac.wordpress.org/changeset/3397106/funnel-builder/tags/3.13.1.3/merge-tags/class-bwf-contact-tags.php
CVE ID: CVE-2025-12880 State: PUBLISHED Published: 2025-11-11T03:30:36.265Z Last Updated: 2025-11-12T20:08:17.689Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: jobayer534 Products: Progress Bar Blocks for Gutenberg Problem Types: CWE-79 Description: The Progress Bar Blocks for Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file
level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3bc48d4d-eeee-47f7-be5e-0d6a43473aa0?source=cve - https://wordpress.org/plugins/progressmatify-blocks/
CVE ID: CVE-2025-12881 State: PUBLISHED Published: 2025-11-21T07:31:53.213Z Last Updated: 2025-11-24T18:03:55.985Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: wpswings Products: Return Refund and Exchange For WooCommerce Problem Types: CWE-639 Description: The Return Refund and Exchange For WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.5 via the wps_rma_fetch_order_msgs() due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read other user's order messages. Additional Analyst Notes: -
ated attackers, with Subscriber-level access and above, to read other user's order messages. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9c159237-1a3a-4d42-9a2e-fbd6ca98f38e?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3394215%40woo-refund-and-exchange-lite&new=3394215%40woo-refund-and-exchange-lite&sfp_email=&sfph_mail=
CVE ID: CVE-2025-12888 State: PUBLISHED Published: 2025-11-21T22:50:30.510Z Last Updated: 2025-11-24T15:44:21.038Z Vendors: wolfSSL Products: wolfSSL Problem Types: CWE-203 Description: Vulnerability in X25519 constant-time cryptographic implementations due to timing side channels introduced by compiler optimizations and CPU architecture limitations, specifically with the Xtensa-based ESP32 chips. If targeting Xtensa it is recommended to use the low memory implementations of X25519, which is now turned on as the default for Xtensa. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://https://github.com/wolfSSL/wolfssl/pull/9275
CVE ID: CVE-2025-12889 State: PUBLISHED Published: 2025-11-21T23:06:59.827Z Last Updated: 2025-11-24T17:56:22.999Z Vendors: wolfSSL Products: wolfSSL Problem Types: CWE-20 Description: With TLS 1.2 connections a client can use any digest, specifically a weaker digest that is supported, rather than those in the CertificateRequest. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wolfSSL/wolfssl/pull/9395
CVE ID: CVE-2025-12890 State: PUBLISHED Published: 2025-11-07T18:40:56.266Z Last Updated: 2025-11-10T20:19:47.939Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: zephyrproject-rtos Products: Zephyr Problem Types: CWE-703 Description: Improper handling of malformed Connection Request with the interval set to be 1 (which supposed to be illegal) and the chM 0x7CFFFFFFFF triggers a crash. The peripheral will not be connectable after it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-8hrf-pfww-83v9
CVE ID: CVE-2025-12891 State: PUBLISHED Published: 2025-11-13T04:28:00.744Z Last Updated: 2025-11-14T16:53:33.943Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: ays-pro Products: Survey Maker Problem Types: CWE-862 Description: The Survey Maker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ays_survey_show_results' AJAX endpoint in all versions up to, and including, 5.1.9.4. This makes it possible for unauthenticated attackers to view all survey submissions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/835353e7-871d-4da
otes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/835353e7-871d-4daf-9ed4-86321daf2366?source=cve - https://plugins.trac.wordpress.org/changeset/3394078/survey-maker/tags/5.1.9.5/admin/class-survey-maker-admin.php?old=3389474&old_path=survey-maker%2Ftags%2F5.1.9.4%2Fadmin%2Fclass-survey-maker-admin.php
CVE ID: CVE-2025-12892 State: PUBLISHED Published: 2025-11-13T03:27:38.242Z Last Updated: 2025-11-13T14:34:24.665Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: ays-pro Products: Survey Maker Problem Types: CWE-862 Description: The Survey Maker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deactivate_plugin_option() function in all versions up to, and including, 5.1.9.4. This makes it possible for unauthenticated attackers to update the ays_survey_maker_upgrade_plugin option. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilit
on. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6abc7605-2daa-44a9-8f2f-cbaacbea9348?source=cve - https://plugins.trac.wordpress.org/changeset/3394078/survey-maker/tags/5.1.9.5/admin/class-survey-maker-admin.php?old=3389474&old_path=survey-maker%2Ftags%2F5.1.9.4%2Fadmin%2Fclass-survey-maker-admin.php
CVE ID: CVE-2025-12893 State: PUBLISHED Published: 2025-11-25T05:07:17.878Z Last Updated: 2025-11-25T05:08:41.827Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: MongoDB Inc. Products: MongoDB Server Problem Types: CWE-295 Description: Clients may successfully perform a TLS handshake with a MongoDB server despite presenting a client certificate not aligning with the documented Extended Key Usage (EKU) requirements. A certificate that specifies extendedKeyUsage but is missing extendedKeyUsage = clientAuth may still be successfully authenticated via the TLS handshake as a client. This issue is specific to MongoDB servers running on Windows or Apple as the exp
ated via the TLS handshake as a client. This issue is specific to MongoDB servers running on Windows or Apple as the expected validation behavior functions correctly on Linux systems. Additionally, MongoDB servers may successfully establish egress TLS connections with servers that present server certificates not aligning with the documented Extended Key Usage (EKU) requirements. A certificate that specifies extendedKeyUsage but is missing extendedKeyUsage = serverAuth may still be successfully authenticated via the TLS handshake as a server. This issue is specific to MongoDB servers running on Apple as the expected validation behavior functions correctly on both Linux and Windows systems. Th
B servers running on Apple as the expected validation behavior functions correctly on both Linux and Windows systems. This vulnerability affects MongoDB Server v7.0 versions prior to 7.0.26, MongoDB Server v8.0 versions prior to 8.0.16 and MongoDB Server v8.2 versions prior to 8.2.2 References: - https://jira.mongodb.org/browse/SERVER-105783
CVE ID: CVE-2025-12894 State: PUBLISHED Published: 2025-11-21T07:31:49.157Z Last Updated: 2025-11-21T14:57:01.592Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: jcollings Products: Import WP – Export and Import CSV and XML files to WordPress Problem Types: CWE-552 Description: The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.14.17 via the import/export functionality and a lack of .htaccess protection. This makes it possible for unauthenticated attackers to extract sensitive data from exports stored in /exportwp and import data stored
possible for unauthenticated attackers to extract sensitive data from exports stored in /exportwp and import data stored in /importwp. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/28ca9590-dc0b-40c9-9de6-1480094ea8be?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3394624%40jc-importer&new=3394624%40jc-importer&sfp_email=&sfph_mail=
CVE ID: CVE-2025-12896 State: PUBLISHED Published: 2025-11-07T20:24:11.186Z Last Updated: 2025-11-07T20:40:07.108Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Solidigm™ Products: D5-P5316, D7-P5510, D7-P5520/D7-P5620, D5-P5430, D5-P5336 Problem Types: CWE-307 Description: Improper resource management in firmware of some Solidigm DC Products may allow an attacker with local or physical access to gain un-authorized access to a locked storage device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.solidigm.com/support-page/support-security.html
CVE ID: CVE-2025-12897 State: REJECTED Published: N/A Last Updated: 2025-11-14T17:07:30.707Z Description: No description available.
CVE ID: CVE-2025-12901 State: PUBLISHED Published: 2025-11-12T04:29:09.846Z Last Updated: 2025-11-14T15:26:59.022Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: asgaros Products: Asgaros Forum Problem Types: CWE-352 Description: The Asgaros Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due to missing nonce validation on the set_subscription_level() function. This makes it possible for unauthenticated attackers to modify the subscription settings of authenticated users via a forged request granted they can trick a logged-in user into performing an action such as clicking on a link
users via a forged request granted they can trick a logged-in user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/75625e6e-f75b-4e11-acd8-7388efb12b29?source=cve - https://plugins.trac.wordpress.org/browser/asgaros-forum/tags/3.2.1/includes/forum-notifications.php#L606 - https://plugins.trac.wordpress.org/browser/asgaros-forum/tags/3.2.1/includes/forum-notifications.php#L605 - https://github.com/Asgaros/asgaros-forum/commit/92305fb8ba4ec0a6c65256915d0a32e5553b74f3 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3392004%40asgaros
6915d0a32e5553b74f3 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3392004%40asgaros-forum&new=3392004%40asgaros-forum&sfp_email=&sfph_mail=
CVE ID: CVE-2025-12902 State: PUBLISHED Published: 2025-11-07T20:18:02.836Z Last Updated: 2025-11-07T20:41:26.017Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Solidigm™ Products: D5-P5316, D5-P5430, D7-P5520/D7-P5620, D5-P5336 Problem Types: CWE-665 Description: Improper resource management in firmware of some Solidigm DC Products may allow an attacker with local or physical access to gain un-authorized access to a locked Storage Device or create a Denial of Service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.solidigm.com/support-page/support-security.html
CVE ID: CVE-2025-12903 State: PUBLISHED Published: 2025-11-12T08:28:04.669Z Last Updated: 2025-11-12T14:39:14.500Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: mrclayton Products: Payment Plugins Braintree For WooCommerce Problem Types: CWE-639 Description: The Payment Plugins Braintree For WooCommerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wc-braintree/v1/3ds/vaulted_nonce REST API endpoint in all versions up to, and including, 3.2.78. This is due to the endpoint being registered with permission_callback set to __return_true and processing user-supplied token IDs without verifying ownership or au
d with permission_callback set to __return_true and processing user-supplied token IDs without verifying ownership or authentication. This makes it possible for unauthenticated attackers to retrieve payment method nonces for any stored payment token in the system, which can be used to create fraudulent transactions, charge customer credit cards, or attach payment methods to other subscriptions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/89cd5429-39a0-441f-ba69-dea111eae5ed?source=cve - https://plugins.trac.wordpress.org/browser/woo-payment-gateway/tags/3.2.78/includes/api/class-wc-braintree-controller-3ds.php#L23
lugins.trac.wordpress.org/browser/woo-payment-gateway/tags/3.2.78/includes/api/class-wc-braintree-controller-3ds.php#L23 - https://plugins.trac.wordpress.org/browser/woo-payment-gateway/tags/3.2.78/includes/api/class-wc-braintree-controller-3ds.php#L35 - https://plugins.trac.wordpress.org/browser/woo-payment-gateway/tags/3.2.78/includes/api/class-wc-braintree-controller-3ds.php#L41 - https://developer.wordpress.org/rest-api/using-the-rest-api/authentication/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3392259%40woo-payment-gateway&new=3392259%40woo-payment-gateway&sfp_email=&sfph_mail=
CVE ID: CVE-2025-12904 State: PUBLISHED Published: 2025-11-14T02:24:19.144Z Last Updated: 2025-11-14T15:23:37.371Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: otacke Products: SNORDIAN's H5PxAPIkatchu Problem Types: CWE-79 Description: The SNORDIAN's H5PxAPIkatchu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'insert_data' AJAX endpoint in all versions up to, and including, 0.4.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP
web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/90552d5a-6103-48c7-ad44-52ee8ecac114?source=cve - https://plugins.trac.wordpress.org/changeset/3392176/h5pxapikatchu
CVE ID: CVE-2025-12905 State: PUBLISHED Published: 2025-11-07T23:23:36.585Z Last Updated: 2025-11-10T15:47:11.093Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Downloads in Google Chrome on Windows prior to 140.0.7339.80 allowed a remote attacker to bypass Mark of the Web via a crafted HTML page. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/431309019
CVE ID: CVE-2025-12906 State: PUBLISHED Published: 2025-11-07T23:23:37.150Z Last Updated: 2025-11-10T15:42:15.733Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Permissions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/428455319
CVE ID: CVE-2025-12907 State: PUBLISHED Published: 2025-11-07T23:23:37.805Z Last Updated: 2025-11-14T04:55:40.593Z Vendors: Google Products: Chrome Problem Types: CWE-20 Description: Insufficient validation of untrusted input in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to execute arbitrary code via user action in Devtools. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/427367145
CVE ID: CVE-2025-12908 State: PUBLISHED Published: 2025-11-07T23:23:38.329Z Last Updated: 2025-11-10T15:38:24.057Z Vendors: Google Products: Chrome Problem Types: CWE-20 Description: Insufficient validation of untrusted input in Downloads in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/421511847
CVE ID: CVE-2025-12909 State: PUBLISHED Published: 2025-11-07T23:23:38.684Z Last Updated: 2025-11-10T15:41:18.696Z Vendors: Google Products: Chrome Problem Types: Insufficient policy enforcement Description: Insufficient policy enforcement in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to leak cross-origin data via Devtools. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/361116749
CVE ID: CVE-2025-12910 State: PUBLISHED Published: 2025-11-07T23:23:39.074Z Last Updated: 2025-11-10T15:54:34.867Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Passkeys in Google Chrome prior to 140.0.7339.80 allowed a local attacker to obtain potentially sensitive information via debug logs. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/434977743
CVE ID: CVE-2025-12911 State: PUBLISHED Published: 2025-11-07T23:23:39.451Z Last Updated: 2025-11-10T15:52:10.342Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Permissions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/423670839
CVE ID: CVE-2025-12913 State: PUBLISHED Published: 2025-11-08T20:02:06.080Z Last Updated: 2025-11-10T18:13:08.275Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Responsive Hotel Site Problem Types: CWE-89, CWE-74 Description: A flaw has been found in code-projects Responsive Hotel Site 1.0. This affects an unknown part of the file /admin/roomdel.php. Executing manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.331631 - https://vuldb.com/?ctiid.331631
nal Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.331631 - https://vuldb.com/?ctiid.331631 - https://vuldb.com/?submit.681061 - https://github.com/HoyaAm/cve-hoya/blob/main/report.md - https://code-projects.org/
CVE ID: CVE-2025-12914 State: PUBLISHED Published: 2025-11-08T21:32:06.077Z Last Updated: 2025-11-10T17:59:49.677Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: aaPanel Products: BaoTa Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in aaPanel BaoTa up to 11.1.0. This vulnerability affects unknown code of the file /database?action=GetDatabaseAccess of the component Backend. The manipulation of the argument Name leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analys
and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.331632 - https://vuldb.com/?ctiid.331632 - https://vuldb.com/?submit.678237 - https://github.com/coolcj-stack/BaoTa-Panel-Backstage-SQL-injection-vulnerability/blob/main/README.md
CVE ID: CVE-2025-12915 State: PUBLISHED Published: 2025-11-08T23:02:06.006Z Last Updated: 2025-11-13T21:44:36.268Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R) Vendors: 70mai Products: X200 Problem Types: CWE-73 Description: A vulnerability was found in 70mai X200 up to 20251019. This issue affects some unknown processing of the component Init Script Handler. The manipulation results in file inclusion. The attack requires a local approach. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did