Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-31085 State: PUBLISHED Published: 2025-04-01T20:58:09.158Z Last Updated: 2025-04-02T14:21:07.383Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Michel - xiligroup dev Products: xili-language Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michel - xiligroup dev xili-language allows Reflected XSS. This issue affects xili-language: from n/a through 2.21.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/xili-language/vulnerability/wordpress-xili-language-plugin-2-21-2-reflected-cross-site-sc
.com/database/wordpress/plugin/xili-language/vulnerability/wordpress-xili-language-plugin-2-21-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-31086 State: PUBLISHED Published: 2025-04-01T20:58:09.334Z Last Updated: 2025-04-02T14:20:58.752Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Nick McReynolds Products: Product Table by WBW Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nick McReynolds Product Table by WBW allows Reflected XSS. This issue affects Product Table by WBW: from n/a through 2.1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/woo-product-tables/vulnerability/wordpress-product-table-by-wbw-plugin-2-1-4-reflec
hstack.com/database/wordpress/plugin/woo-product-tables/vulnerability/wordpress-product-table-by-wbw-plugin-2-1-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-31087 State: PUBLISHED Published: 2025-04-01T05:31:42.090Z Last Updated: 2025-04-01T13:39:58.311Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: silverplugins217 Products: Multiple Shipping And Billing Address For Woocommerce Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in silverplugins217 Multiple Shipping And Billing Address For Woocommerce allows Object Injection. This issue affects Multiple Shipping And Billing Address For Woocommerce: from n/a through 1.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/different-shipping-and-bill
tes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/different-shipping-and-billing-address-for-woocommerce/vulnerability/wordpress-multiple-shipping-and-billing-address-for-woocommerce-1-5-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-31088 State: PUBLISHED Published: 2025-03-28T09:39:54.682Z Last Updated: 2025-03-28T14:18:19.361Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Cozmoslabs Products: Paid Member Subscriptions Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs Paid Member Subscriptions allows Stored XSS. This issue affects Paid Member Subscriptions: from n/a through 2.14.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/paid-member-subscriptions/vulnerability/wordpress-paid-member-subscriptions-2-
/patchstack.com/database/wordpress/plugin/paid-member-subscriptions/vulnerability/wordpress-paid-member-subscriptions-2-14-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-31089 State: PUBLISHED Published: 2025-04-01T20:58:09.502Z Last Updated: 2025-04-02T14:20:51.649Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: Fahad Mahmood Products: Order Splitter for WooCommerce Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Fahad Mahmood Order Splitter for WooCommerce allows SQL Injection. This issue affects Order Splitter for WooCommerce: from n/a through 5.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/woo-order-splitter/vulnerability/wordpress-order-splitter
References: - https://patchstack.com/database/wordpress/plugin/woo-order-splitter/vulnerability/wordpress-order-splitter-for-woocommerce-5-3-0-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-31090 State: PUBLISHED Published: 2025-03-28T09:39:53.973Z Last Updated: 2025-03-28T14:19:11.322Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: alordiel Products: Dropdown Multisite selector Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in alordiel Dropdown Multisite selector allows Stored XSS. This issue affects Dropdown Multisite selector: from n/a through n/a. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/dropdown-multisite-selector/vulnerability/wordpress-dropdown-multisite-selector
patchstack.com/database/wordpress/plugin/dropdown-multisite-selector/vulnerability/wordpress-dropdown-multisite-selector-0-9-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-31091 State: PUBLISHED Published: 2025-04-03T13:27:09.308Z Last Updated: 2025-04-03T15:09:18.049Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: CreativeMindsSolutions Products: CM Header and Footer Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Header and Footer allows Stored XSS. This issue affects CM Header and Footer: from n/a through 1.2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/cm-header-footer-script-loader/vulnerability/wordpress-cm-header-and-f
https://patchstack.com/database/wordpress/plugin/cm-header-footer-script-loader/vulnerability/wordpress-cm-header-and-footer-1-2-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-31092 State: PUBLISHED Published: 2025-03-27T23:21:01.638Z Last Updated: 2025-03-28T15:20:57.717Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Ninja Team Products: Click to Chat – WP Support All-in-One Floating Widget Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ninja Team Click to Chat – WP Support All-in-One Floating Widget allows Stored XSS. This issue affects Click to Chat – WP Support All-in-One Floating Widget: from n/a through 2.3.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/pl
ugh 2.3.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/support-chat/vulnerability/wordpress-click-to-chat-wp-support-all-in-one-floating-widget-plugin-2-3-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-31093 State: PUBLISHED Published: 2025-03-28T09:39:53.311Z Last Updated: 2025-03-28T14:20:30.262Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: redpixelstudios Products: RPS Include Content Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in redpixelstudios RPS Include Content allows DOM-Based XSS. This issue affects RPS Include Content: from n/a through 1.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/rps-include-content/vulnerability/wordpress-rps-include-content-1-2-1-cross-site-scr
stack.com/database/wordpress/plugin/rps-include-content/vulnerability/wordpress-rps-include-content-1-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-31094 State: PUBLISHED Published: 2025-03-28T09:39:52.591Z Last Updated: 2025-03-28T14:22:25.638Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: teastudio.pl Products: WP Posts Carousel Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in teastudio.pl WP Posts Carousel allows Stored XSS. This issue affects WP Posts Carousel: from n/a through 1.3.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-posts-carousel/vulnerability/wordpress-wp-posts-carousel-1-3-8-cross-site-scripting-xss-vulnerab
ase/wordpress/plugin/wp-posts-carousel/vulnerability/wordpress-wp-posts-carousel-1-3-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-31095 State: PUBLISHED Published: 2025-04-01T05:31:42.244Z Last Updated: 2025-04-01T13:39:29.834Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ho3einie Products: Material Dashboard Problem Types: CWE-288 Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in ho3einie Material Dashboard allows Authentication Bypass. This issue affects Material Dashboard: from n/a through 1.4.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/material-dashboard/vulnerability/wordpress-material-dashboard-1-4-5-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2025-31096 State: PUBLISHED Published: 2025-03-28T09:39:51.761Z Last Updated: 2025-03-28T14:24:21.497Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: WPXPO Products: PostX Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPXPO PostX allows DOM-Based XSS. This issue affects PostX: from n/a through 4.1.25. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ultimate-post/vulnerability/wordpress-postx-4-1-25-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-31097 State: PUBLISHED Published: 2025-04-01T20:58:09.663Z Last Updated: 2025-04-03T12:54:34.568Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ho3einie Products: Material Dashboard Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ho3einie Material Dashboard allows PHP Local File Inclusion. This issue affects Material Dashboard: from n/a through 1.4.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/material-dashboard/vulnerability/wordpress-material-dashboard-1-4-5-local
tps://patchstack.com/database/wordpress/plugin/material-dashboard/vulnerability/wordpress-material-dashboard-1-4-5-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-31098 State: PUBLISHED Published: 2025-04-03T13:27:09.485Z Last Updated: 2025-04-03T15:09:05.514Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: debounce Products: DeBounce Email Validator Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in debounce DeBounce Email Validator allows PHP Local File Inclusion. This issue affects DeBounce Email Validator: from n/a through 5.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/debounce-io-email-validator/vulnerability/wordpress-debou
References: - https://patchstack.com/database/wordpress/plugin/debounce-io-email-validator/vulnerability/wordpress-debounce-email-validator-5-7-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-31099 State: PUBLISHED Published: 2025-03-28T09:39:51.111Z Last Updated: 2025-03-28T14:25:29.703Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: bestwebsoft Products: Slider by BestWebSoft Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bestwebsoft Slider by BestWebSoft allows SQL Injection. This issue affects Slider by BestWebSoft: from n/a through 1.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/slider-bws/vulnerability/wordpress-slider-by-bestwebsoft-1-1-0-sql-injection-vulnerabili
k.com/database/wordpress/plugin/slider-bws/vulnerability/wordpress-slider-by-bestwebsoft-1-1-0-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-31100 State: PUBLISHED Published: 2025-08-31T03:48:27.965Z Last Updated: 2025-09-02T20:45:44.061Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Mojoomla Products: School Management Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Mojoomla School Management allows Upload a Web Shell to a Web Server.This issue affects School Management: from n/a through 1.93.1 (02-07-2025). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/school-management/vulnerability/wordpress-school-management-plugin-1-93-1-02-07-2025-arbitrary-file-uplo
ordpress/plugin/school-management/vulnerability/wordpress-school-management-plugin-1-93-1-02-07-2025-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2025-31101 State: PUBLISHED Published: 2025-03-27T22:25:04.290Z Last Updated: 2025-03-28T15:21:55.779Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Vault Group Pty Ltd Products: VaultRE Contact Form 7 Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vault Group Pty Ltd VaultRE Contact Form 7 allows Stored XSS.This issue affects VaultRE Contact Form 7: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-plugin-contact-form-7/vulnerability/wordpress-vaultre-contact-form-7-p
tps://patchstack.com/database/wordpress/plugin/wp-plugin-contact-form-7/vulnerability/wordpress-vaultre-contact-form-7-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-31102 State: PUBLISHED Published: 2025-03-28T09:39:50.430Z Last Updated: 2025-03-28T14:26:13.110Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Bob Products: Hostel Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Hostel allows Reflected XSS. This issue affects Hostel: from n/a through 1.1.5.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/hostel/vulnerability/wordpress-hostel-plugin-1-1-5-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-31103 State: PUBLISHED Published: 2025-03-31T04:54:03.868Z Last Updated: 2025-03-31T12:59:20.794Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: appleple inc. Products: a-blog cms (Ver.3.1.x series), a-blog cms (Ver.3.0.x series), a-blog cms (Ver.2.11.x series), a-blog cms (Ver.2.10.x series), a-blog cms (Ver.2.9.x series), a-blog cms (Ver. 2.8.x series) Problem Types: CWE-502 Description: Untrusted data deserialization vulnerability exists in a-blog cms. Processing a specially crafted request may store arbitrary files on the server where the product is running. This can be leveraged to execute an arbitrary script on the server. Additional An
e server where the product is running. This can be leveraged to execute an arbitrary script on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://developer.a-blogcms.jp/blog/news/security-update202503.html - https://developer.a-blogcms.jp/blog/news/entry-4197.html - https://jvn.jp/en/jp/JVN66982699/
CVE ID: CVE-2025-31104 State: PUBLISHED Published: 2025-06-10T16:36:13.131Z Last Updated: 2025-06-11T04:01:45.873Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C) Vendors: Fortinet Products: FortiADC Problem Types: CWE-78 Description: An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiADC 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, 7.2.0 through 7.2.7, 7.1.0 through 7.1.4, 7.0 all versions, 6.2 all versions, 6.1 all versions may allow an authenticated attacker to execute unauthorized code via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:/
te unauthorized code via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-25-099
CVE ID: CVE-2025-31105 State: REJECTED Published: N/A Last Updated: 2025-03-27T03:55:08.620Z Description: No description available.
CVE ID: CVE-2025-31106 State: REJECTED Published: N/A Last Updated: 2025-03-27T03:55:08.111Z Description: No description available.
CVE ID: CVE-2025-31107 State: REJECTED Published: N/A Last Updated: 2025-03-27T03:55:07.529Z Description: No description available.
CVE ID: CVE-2025-31108 State: REJECTED Published: N/A Last Updated: 2025-03-27T03:55:07.061Z Description: No description available.
CVE ID: CVE-2025-31109 State: REJECTED Published: N/A Last Updated: 2025-03-27T03:55:06.572Z Description: No description available.
CVE ID: CVE-2025-31110 State: REJECTED Published: N/A Last Updated: 2025-03-27T03:55:05.997Z Description: No description available.
CVE ID: CVE-2025-31111 State: REJECTED Published: N/A Last Updated: 2025-03-27T03:55:05.523Z Description: No description available.
CVE ID: CVE-2025-31112 State: REJECTED Published: N/A Last Updated: 2025-03-27T03:55:04.974Z Description: No description available.
CVE ID: CVE-2025-31113 State: REJECTED Published: N/A Last Updated: 2025-03-27T03:55:04.399Z Description: No description available.
CVE ID: CVE-2025-31115 State: PUBLISHED Published: 2025-04-03T16:57:05.488Z Last Updated: 2025-04-03T20:03:09.458Z Vendors: tukaani-project Products: xz Problem Types: CWE-366, CWE-416, CWE-476, CWE-826 Description: XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after free and writing to an address based on the null pointer plus an offset. Applications and libraries that use the lzma_stream_decoder_mt function are affected. The bug has been fixed in XZ Utils 5.8.1, and the fix has been commit
the lzma_stream_decoder_mt function are affected. The bug has been fixed in XZ Utils 5.8.1, and the fix has been committed to the v5.4, v5.6, v5.8, and master branches in the xz Git repository. No new release packages will be made from the old stable branches, but a standalone patch is available that applies to all affected releases. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/tukaani-project/xz/security/advisories/GHSA-6cc8-p5mm-29w2 - https://github.com/tukaani-project/xz/commit/d5a2ffe41bb77b918a8c96084885d4dbe4bf6480 - https://tukaani.org/xz/xz-cve-2025-31115.patch
CVE ID: CVE-2025-31116 State: PUBLISHED Published: 2025-03-31T16:42:42.618Z Last Updated: 2025-03-31T18:16:45.085Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L) Vendors: MobSF Products: Mobile-Security-Framework-MobSF Problem Types: CWE-918 Description: Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. The mitigation for CVE-2024-29190 in valid_host() uses socket.gethostbyname(), which is vulnerable to SSRF abuse using DNS rebinding technique. This vulnerability is fixed in 4.3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com
his vulnerability is fixed in 4.3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-fcfq-m8p6-gw56 - https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/4b8bab5a9858c69fe13be4631b82d82186e0d3bd
CVE ID: CVE-2025-31117 State: PUBLISHED Published: 2025-03-31T16:49:14.739Z Last Updated: 2025-03-31T18:04:16.352Z Vendors: openemr Products: openemr Problem Types: CWE-918 Description: OpenEMR is a free and open source electronic health records and medical practice management application. An Out-of-Band Server-Side Request Forgery (OOB SSRF) vulnerability was identified in OpenEMR, allowing an attacker to force the server to make unauthorized requests to external or internal resources. this attack does not return a direct response but can be exploited through DNS or HTTP interactions to exfiltrate sensitive information. This vulnerability is fixed in 7.0.3.1. Additional Analyst Notes: - CIS
nteractions to exfiltrate sensitive information. This vulnerability is fixed in 7.0.3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/openemr/openemr/security/advisories/GHSA-2pvv-ph3x-2f9h - https://github.com/openemr/openemr/commit/aa6f50efb2971285633fa77ea7a50949408cab12
CVE ID: CVE-2025-31118 State: PUBLISHED Published: 2025-04-18T15:52:36.923Z Last Updated: 2025-04-18T16:02:09.007Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: NamelessMC Products: Nameless Problem Types: CWE-400 Description: NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, forum quick reply feature (view_topic.php) does not implement any spam prevention mechanism. This allows authenticated users to continuously post replies without any time restriction, resulting in an uncontrolled surge of posts that can disrupt normal operations. This issue has been patched in version 2.2.0. Additional Analy
rolled surge of posts that can disrupt normal operations. This issue has been patched in version 2.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/NamelessMC/Nameless/security/advisories/GHSA-jhvp-mwj4-922m - https://github.com/NamelessMC/Nameless/commit/51e9d93aaa28d40f060b807533d22b768abea207 - https://github.com/NamelessMC/Nameless/releases/tag/v2.2.0
CVE ID: CVE-2025-31119 State: PUBLISHED Published: 2025-04-03T19:11:44.091Z Last Updated: 2025-04-03T19:45:22.621Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: jhipster Products: generator-jhipster-entity-audit Problem Types: CWE-470 Description: generator-jhipster-entity-audit is a JHipster module to enable entity audit and audit log page. Prior to 5.9.1, generator-jhipster-entity-audit allows unsafe reflection when having Javers selected as Entity Audit Framework. If an attacker manages to place some malicious classes into the classpath and also has access to these REST interface for calling the mentioned REST endpoints, using these lines of code can lead
and also has access to these REST interface for calling the mentioned REST endpoints, using these lines of code can lead to unintended remote code execution. This vulnerability is fixed in 5.9.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/jhipster/generator-jhipster-entity-audit/security/advisories/GHSA-7rmp-3g9f-cvq8 - https://github.com/jhipster/generator-jhipster-entity-audit/blob/e21e83135d10c77d92203c89cb0b0063914e8fe0/generators/spring-boot-javers/templates/src/main/java/_package_/web/rest/JaversEntityAuditResource.java.ejs#L88