Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6a5cc21a-eb3a-429a-a0f9-0181d95a9eeb?source=cve - https://atviksecurity.com/yawave-wordpress-plugin-unauthenticated-sql-injection/ - https://plugins.trac.wordpress.org/browser/yawave/trunk/includes/shortcode.liveblog.php#L69
CVE ID: CVE-2025-1649 State: PUBLISHED Published: 2025-03-13T16:51:13.073Z Last Updated: 2025-08-19T13:11:40.994Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: AutoCAD, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, Civil 3D, Advance Steel, AutoCAD MAP 3D Problem Types: CWE-457 Description: A maliciously crafted CATPRODUCT file, when parsed through Autodesk AutoCAD, can force an Uninitialized Variable vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: -
CVE ID: CVE-2025-1650 State: PUBLISHED Published: 2025-03-13T16:51:22.108Z Last Updated: 2025-08-19T13:12:00.933Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: AutoCAD, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, Civil 3D, Advance Steel, AutoCAD MAP 3D Problem Types: CWE-457 Description: A maliciously crafted CATPRODUCT file, when parsed through Autodesk AutoCAD, can force an Uninitialized Variable vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: -
CVE ID: CVE-2025-1651 State: PUBLISHED Published: 2025-03-13T16:51:30.258Z Last Updated: 2025-08-19T13:12:23.282Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: AutoCAD, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, Civil 3D, Advance Steel, AutoCAD MAP 3D Problem Types: CWE-122 Description: A maliciously crafted MODEL file, when parsed through Autodesk AutoCAD, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP
CVE ID: CVE-2025-1652 State: PUBLISHED Published: 2025-03-13T16:51:36.291Z Last Updated: 2025-08-19T13:12:43.604Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: AutoCAD, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, Civil 3D, Advance Steel, AutoCAD MAP 3D Problem Types: CWE-125 Description: A maliciously crafted MODEL file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP
CVE ID: CVE-2025-1653 State: PUBLISHED Published: 2025-03-15T02:22:42.443Z Last Updated: 2025-03-17T21:28:43.240Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: stylemix Products: Directory Listings WordPress plugin – uListing Problem Types: CWE-266 Description: The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.1.7. This is due to the stm_listing_profile_edit AJAX action not having enough restriction on the user meta that can be updated. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to th
makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4181b26e-89c7-4020-a3d4-29bdc88d7438?source=cve - https://wordpress.org/plugins/ulisting/
CVE ID: CVE-2025-1656 State: PUBLISHED Published: 2025-04-15T20:56:30.567Z Last Updated: 2025-09-25T18:45:41.097Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: Revit, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD MAP 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, Civil 3D, Advance Steel Problem Types: CWE-122 Description: A maliciously crafted PDF file, when linked or imported into Autodesk applications, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. Addit
CVE ID: CVE-2025-1657 State: PUBLISHED Published: 2025-03-15T02:22:41.764Z Last Updated: 2025-03-17T21:28:49.471Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: stylemix Products: Directory Listings WordPress plugin – uListing Problem Types: CWE-862 Description: The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to unauthorized modification of data and PHP Object Injection due to a missing capability check on the stm_listing_ajax AJAX action in all versions up to, and including, 2.1.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to update post meta data and inject PHP Objects t
e for authenticated attackers, with subscriber-level access and above, to update post meta data and inject PHP Objects that may be unserialized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0e70184f-94b6-4742-b99b-6eec9d28f17c?source=cve - https://wordpress.org/plugins/ulisting/
CVE ID: CVE-2025-1658 State: PUBLISHED Published: 2025-04-01T12:27:24.602Z Last Updated: 2025-08-19T13:13:21.792Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: Navisworks Freedom, Navisworks Simulate, Navisworks Manage Problem Types: CWE-125 Description: A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/products/autodesk-access/ov
s. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0002
CVE ID: CVE-2025-1659 State: PUBLISHED Published: 2025-04-01T12:28:06.627Z Last Updated: 2025-08-19T13:13:38.044Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: Navisworks Freedom, Navisworks Simulate, Navisworks Manage Problem Types: CWE-125 Description: A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/products/autodesk-access/ov
CVE ID: CVE-2025-1660 State: PUBLISHED Published: 2025-04-01T12:29:20.944Z Last Updated: 2025-08-19T13:14:04.769Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: Navisworks Freedom, Navisworks Simulate, Navisworks Manage Problem Types: CWE-120 Description: A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/trust/s
ulnrichment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0002
CVE ID: CVE-2025-1661 State: PUBLISHED Published: 2025-03-11T03:22:19.063Z Last Updated: 2025-03-11T13:53:44.484Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: realmag777 Products: HUSKY – Products Filter Professional for WooCommerce Problem Types: CWE-22 Description: The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.6.5 via the 'template' parameter of the woof_text_search AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. Thi
tackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9ae7b6fc-2120-4573-8b1b-d5422d435fa5?source=cve - https://plugins.trac.wordpress.org/browser/woocommerce-products-filter/trunk/ext/by_text/index.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3253169%40woocommerce-products-filter&new=3253169%40woo
trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3253169%40woocommerce-products-filter&new=3253169%40woocommerce-products-filter&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3249621%40woocommerce-products-filter&new=3249621%40woocommerce-products-filter&sfp_email=&sfph_mail=
CVE ID: CVE-2025-1662 State: PUBLISHED Published: 2025-02-28T08:23:18.201Z Last Updated: 2025-02-28T14:48:17.084Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: apprhyme Products: URL Media Uploader Problem Types: CWE-918 Description: The URL Media Uploader plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.0 via the 'url_media_uploader_url_upload' action. This makes it possible for authenticated attackers, with author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Addition
ns originating from the web application and can be used to query and modify information from internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ae8f1852-2d67-4ed9-ab3d-5b3bf4083e06?source=cve - https://wordpress.org/plugins/url-media-uploader/
CVE ID: CVE-2025-1663 State: PUBLISHED Published: 2025-04-03T07:21:22.849Z Last Updated: 2025-04-03T13:30:15.900Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: unitecms Products: Unlimited Elements For Elementor Problem Types: CWE-79 Description: The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 1.5.142 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected
-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d07c43e0-783a-499b-b172-d058583d0749?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3258648%40unlimited-elements-for-elementor&new=3258648%40unlimited-elements-for-elementor&sfp_email=&sfph_mail=
CVE ID: CVE-2025-1664 State: PUBLISHED Published: 2025-03-08T11:16:40.491Z Last Updated: 2025-03-11T16:07:15.795Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpdevteam Products: Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates Problem Types: CWE-79 Description: The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Parallax slider in all versions up to, and including, 5.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitr
escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6abfa01b-e2ec-412c-a17d-e8bd1f5ac228?source=cve - https://plugins.trac.wordpress.org/changeset/3250957/essential-blocks/tags/5.3.2/assets/blocks/parallax-slider/frontend.js
CVE ID: CVE-2025-1665 State: PUBLISHED Published: 2025-04-01T05:22:46.268Z Last Updated: 2025-04-01T13:30:23.788Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themefusion Products: Avada (Fusion) Builder Problem Types: CWE-79 Description: The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's shortcodes in all versions up to, and including, 3.11.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenev
ed attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/94e373fb-b3f5-4c1b-9eaa-89747af4dc30?source=cve - https://avada.com
CVE ID: CVE-2025-1666 State: PUBLISHED Published: 2025-03-06T11:11:01.970Z Last Updated: 2025-03-06T16:18:52.928Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: cookiebot Products: Cookie banner plugin for WordPress – Cookiebot CMP by Usercentrics Problem Types: CWE-862 Description: The Cookie banner plugin for WordPress – Cookiebot CMP by Usercentrics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the send_uninstall_survey() function in all versions up to, and including, 4.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to submit the uninstall sur
This makes it possible for authenticated attackers, with Subscriber-level access and above, to submit the uninstall survey on behalf of a website. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d2e5fca6-363c-4875-9eb8-44e080d99650?source=cve - https://plugins.trac.wordpress.org/browser/cookiebot/tags/4.4.1/src/lib/Cookiebot_Review.php#L135 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3251089%40cookiebot&new=3251089%40cookiebot&sfp_email=&sfph_mail=
CVE ID: CVE-2025-1667 State: PUBLISHED Published: 2025-03-15T03:23:25.085Z Last Updated: 2025-03-17T21:27:58.697Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: jdsofttech Products: School Management System – WPSchoolPress Problem Types: CWE-639 Description: The School Management System – WPSchoolPress plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the wpsp_UpdateTeacher() function in all versions up to, and including, 2.2.16. This makes it possible for authenticated attackers, with teacher-level access and above, to update arbitrary user details including email which makes it possible to request a password res
vel access and above, to update arbitrary user details including email which makes it possible to request a password reset and access arbitrary user accounts, including administrators. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e54f98bc-c538-4f3c-b24a-6e778a3748ef?source=cve - https://plugins.trac.wordpress.org/browser/wpschoolpress/tags/2.2.16/lib/wpsp-ajaxworks-teacher.php#L544
CVE ID: CVE-2025-1668 State: PUBLISHED Published: 2025-03-15T03:23:25.806Z Last Updated: 2025-03-17T16:57:07.982Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: jdsofttech Products: School Management System – WPSchoolPress Problem Types: CWE-862 Description: The School Management System – WPSchoolPress plugin for WordPress is vulnerable to arbitrary user deletion due to a missing capability check on the wpsp_DeleteUser() function in all versions up to, and including, 2.2.16. This makes it possible for authenticated attackers, with teacher-level access and above, to delete arbitrary user accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References
level access and above, to delete arbitrary user accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fd5638b6-134d-4386-af40-6ac961a915d7?source=cve - https://plugins.trac.wordpress.org/browser/wpschoolpress/tags/2.2.16/lib/wpsp-ajaxworks.php#L22
CVE ID: CVE-2025-1669 State: PUBLISHED Published: 2025-03-15T03:23:24.332Z Last Updated: 2025-03-17T21:28:10.575Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: jdsofttech Products: School Management System – WPSchoolPress Problem Types: CWE-89 Description: The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'addNotify' action in all versions up to, and including, 2.2.16 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with teacher-level access and above, to append additional SQL qu
ry. This makes it possible for authenticated attackers, with teacher-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b7413d90-aed1-4f78-a17c-bed76efb48f8?source=cve - https://plugins.trac.wordpress.org/browser/wpschoolpress/tags/2.2.16/lib/wpsp-ajaxworks.php#L4304
CVE ID: CVE-2025-1670 State: PUBLISHED Published: 2025-03-15T03:23:25.455Z Last Updated: 2025-03-17T16:58:03.606Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: jdsofttech Products: School Management System – WPSchoolPress Problem Types: CWE-89 Description: The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'cid' parameter in all versions up to, and including, 2.2.16 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Custom-level access and above, to append additional SQL querie
This makes it possible for authenticated attackers, with Custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f38c28f4-e73a-4eb2-8bbd-73c849385c4e?source=cve - https://plugins.trac.wordpress.org/browser/wpschoolpress/tags/2.2.16/pages/wpsp-exams.php#L186
CVE ID: CVE-2025-1671 State: PUBLISHED Published: 2025-03-01T07:24:04.682Z Last Updated: 2025-03-03T20:56:52.336Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Elated-Themes Products: Academist Membership Problem Types: CWE-288 Description: The Academist Membership plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.6. This is due to the academist_membership_check_facebook_user() function not properly verifying a user's identity prior to authenticating them. This makes it possible for unauthenticated attackers to log in as any user, including site administrators. Additional Analyst Notes: - CISA ADP Vulnri
uthenticated attackers to log in as any user, including site administrators. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/911a9550-1f62-4f28-9d8c-00d9769949c9?source=cve - https://themeforest.net/item/academist-a-modern-learning-management-system-and-education-theme/22376830
CVE ID: CVE-2025-1672 State: PUBLISHED Published: 2025-03-06T09:21:19.616Z Last Updated: 2025-03-06T16:24:45.481Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: ninjateam Products: Notibar – Notification Bar for WordPress Problem Types: CWE-79 Description: The Notibar – Notification Bar for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user
th administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9985627d-9ba4-4a5b-94fb-06bcc769acfd?source=cve - https://wordpress.org/plugins/notibar/#developers - https://plugins.trac.wordpress.org/changeset/3246799/
CVE ID: CVE-2025-1673 State: PUBLISHED Published: 2025-02-25T07:12:13.455Z Last Updated: 2025-02-28T17:04:42.244Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: zephyrproject-rtos Products: Zephyr Problem Types: CWE-125 Description: A malicious or malformed DNS packet without a payload can cause an out-of-bounds read, resulting in a crash (denial of service) or an incorrect computation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-jjhx-rrh4-j8mx
CVE ID: CVE-2025-1674 State: PUBLISHED Published: 2025-02-25T07:18:52.323Z Last Updated: 2025-02-28T17:04:15.741Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) Vendors: zephyrproject-rtos Products: Zephyr Problem Types: CWE-125 Description: A lack of input validation allows for out of bounds reads caused by malicious or malformed packets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-x975-8pgf-qh66