Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-3057 State: PUBLISHED Published: 2025-03-31T21:33:30.184Z Last Updated: 2025-04-01T13:29:23.644Z Vendors: Drupal Products: Drupal core Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-core-2025-001
CVE ID: CVE-2025-3058 State: PUBLISHED Published: 2025-04-24T08:23:47.679Z Last Updated: 2025-04-24T15:22:57.254Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: jauharixelion Products: Xelion Webchat Problem Types: CWE-862 Description: The Xelion Webchat plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the xwc_save_settings() function in all versions up to, and including, 9.1.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default
-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/250202d5-3a0d-494c-8386-1f4cd015ad7e?source=cve - https://plugins.trac.wordpress.org/browser/xelion-webchat/trunk//includes/class-xelion-webchat-ajax-admin.php#L119
CVE ID: CVE-2025-3059 State: PUBLISHED Published: 2025-03-31T22:21:16.972Z Last Updated: 2025-04-29T15:14:46.992Z Vendors: Drupal Products: Profile Private Description: Vulnerability in Drupal Profile Private.This issue affects Profile Private: *.*. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-002
CVE ID: CVE-2025-3060 State: PUBLISHED Published: 2025-03-31T22:21:41.748Z Last Updated: 2025-04-09T14:56:02.708Z Vendors: Drupal Products: Flattern – Multipurpose Bootstrap Business Profile Description: Vulnerability in Drupal Flattern – Multipurpose Bootstrap Business Profile.This issue affects Flattern – Multipurpose Bootstrap Business Profile: *.*. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-005
CVE ID: CVE-2025-3061 State: PUBLISHED Published: 2025-03-31T22:22:02.658Z Last Updated: 2025-04-04T20:22:13.611Z Vendors: Drupal Products: Material Admin Description: Vulnerability in Drupal Material Admin.This issue affects Material Admin: *.*. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-006
CVE ID: CVE-2025-3062 State: PUBLISHED Published: 2025-03-31T22:22:22.245Z Last Updated: 2025-04-01T17:35:27.388Z Vendors: Drupal Products: Drupal Admin LTE theme Description: Vulnerability in Drupal Drupal Admin LTE theme.This issue affects Drupal Admin LTE theme: *.*. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-010
CVE ID: CVE-2025-3063 State: PUBLISHED Published: 2025-04-02T09:21:45.582Z Last Updated: 2025-04-02T14:03:20.932Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: shopperapprovedapp Products: Shopper Approved Reviews Problem Types: CWE-862 Description: The Shopper Approved Reviews plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the ajax_callback_update_sa_option() function in versions 2.0 to 2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to up
, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c042b347-2884-436d-abd3-6931548f18d6?source=cve - https://plugins.trac.wordpress.org/browser/shopperapproved-reviews/trunk/shopperapproved.php#L154
CVE ID: CVE-2025-3064 State: PUBLISHED Published: 2025-04-08T08:22:09.698Z Last Updated: 2025-04-08T13:40:51.320Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: syammohanm Products: WPFront User Role Editor Problem Types: CWE-352 Description: The WPFront User Role Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.1. This is due to missing or incorrect nonce validation on the whitelist_options() function. This makes it possible for unauthenticated attackers to update the default role option that can be leveraged for privilege escalation via a forged request granted they can trick a site administra
role option that can be leveraged for privilege escalation via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This is only exploitable on multisite instances. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/efc7ad9f-714e-474c-87e8-ecbbdfabd550?source=cve - https://plugins.trac.wordpress.org/browser/wpfront-user-role-editor/trunk/includes/users/class-user-profile.php#L104 - https://plugins.trac.wordpress.org/browser/wpfront-user-role-editor/trunk/includes/users/class-user-profile.php#L399 - https://wordpress.org/plugins/wpfront-user-role-editor/#develo
editor/trunk/includes/users/class-user-profile.php#L399 - https://wordpress.org/plugins/wpfront-user-role-editor/#developers - https://plugins.trac.wordpress.org/changeset/3266542/#file142
CVE ID: CVE-2025-3065 State: PUBLISHED Published: 2025-04-24T08:23:47.060Z Last Updated: 2025-04-24T15:23:05.816Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: neoslab Products: Database Toolset Problem Types: CWE-22 Description: The Database Toolset plugin is vulnerable to arbitrary file deletion due to insufficient file path validation in a function in all versions up to, and including, 1.8.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - h
en the right file is deleted (such as wp-config.php). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0e656123-cae4-4e0c-a80a-98526be293a8?source=cve - https://plugins.trac.wordpress.org/browser/database-toolset/trunk/admin/class-database-toolset-admin.php#L109 - https://wordpress.org/plugins/database-toolset/
CVE ID: CVE-2025-3066 State: PUBLISHED Published: 2025-04-02T00:42:10.030Z Last Updated: 2025-04-08T19:24:33.989Z Vendors: Google Products: Chrome Problem Types: CWE-416 Description: Use after free in Site Isolation in Google Chrome prior to 135.0.7049.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/405140652
CVE ID: CVE-2025-3067 State: PUBLISHED Published: 2025-04-02T00:42:10.385Z Last Updated: 2025-09-07T23:09:21.322Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform privilege escalation via a crafted app. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/376491759
CVE ID: CVE-2025-3068 State: PUBLISHED Published: 2025-04-02T00:42:10.660Z Last Updated: 2025-04-03T13:24:13.755Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Intents in Google Chrome on Android prior to 135.0.7049.52 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/401823929
CVE ID: CVE-2025-3069 State: PUBLISHED Published: 2025-04-02T00:42:10.880Z Last Updated: 2025-04-03T13:23:55.391Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Extensions in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/40060076
CVE ID: CVE-2025-3070 State: PUBLISHED Published: 2025-04-02T00:42:11.093Z Last Updated: 2025-04-03T17:49:50.852Z Vendors: Google Products: Chrome Problem Types: CWE-20 Description: Insufficient validation of untrusted input in Extensions in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/40086360
CVE ID: CVE-2025-3071 State: PUBLISHED Published: 2025-04-02T00:42:11.389Z Last Updated: 2025-04-10T20:23:14.209Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Navigations in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/40051596
CVE ID: CVE-2025-3072 State: PUBLISHED Published: 2025-04-02T00:42:11.694Z Last Updated: 2025-04-15T14:06:22.324Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Custom Tabs in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/362545037
CVE ID: CVE-2025-3073 State: PUBLISHED Published: 2025-04-02T00:42:11.920Z Last Updated: 2025-04-15T14:07:34.371Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Autofill in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/388680893
CVE ID: CVE-2025-3074 State: PUBLISHED Published: 2025-04-02T00:42:12.119Z Last Updated: 2025-04-15T14:09:17.281Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Downloads in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/392818696
CVE ID: CVE-2025-3075 State: PUBLISHED Published: 2025-07-29T04:23:45.381Z Last Updated: 2025-07-29T14:03:55.782Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: elemntor Products: Elementor Website Builder – More Than Just a Page Builder Problem Types: CWE-79 Description: The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'elementor-element' shortcode in all versions up to, and including, 3.29.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access an
caping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only impacts sites with 'Element Caching' enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/639693b6-369e-457e-a37e-30bdb8ea7275?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3302102%40elementor&new=3302102%40elementor&sfp_email=&sfph_mail=
CVE ID: CVE-2025-3076 State: PUBLISHED Published: 2025-06-10T04:23:09.744Z Last Updated: 2025-06-10T14:43:29.802Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: https://elementor.com/ Products: Elementor Website Builder Pro Problem Types: CWE-79 Description: The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘button_text’ parameter in all versions up to, and including, 3.29.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user a
s, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0c796ee7-5394-40f3-9158-1a006efbf085?source=cve - https://elementor.com/pro/changelog/
CVE ID: CVE-2025-3077 State: PUBLISHED Published: 2025-04-16T07:31:09.016Z Last Updated: 2025-04-16T14:34:53.820Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: MuffinGroup Products: Betheme Problem Types: CWE-79 Description: The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button shortcode and Custom CSS field in all versions up to, and including, 28.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user access
th contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7a0a281d-840f-488f-b9ef-c0df8514b47c?source=cve - https://themeforest.net/item/betheme-responsive-multipurpose-wordpress-theme/7758048 - https://support.muffingroup.com/changelog/
CVE ID: CVE-2025-3078 State: PUBLISHED Published: 2025-05-19T23:43:28.456Z Last Updated: 2025-05-20T14:07:58.852Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: Canon Inc. Products: imageRUNNER ADVANCE Series, imageRUNNER Series, imagePRESS V Series, imagePRESS Series, imageCLASS Series Problem Types: CWE-522 Description: A passback vulnerability which relates to production printers and office multifunction printers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.canon/advisory-information/cp2025-004/ - https://canon.jp/support/support-info/250519vulnerability-response - https://www.usa.canon.com/about-us/to-our-customers/cp202
//canon.jp/support/support-info/250519vulnerability-response - https://www.usa.canon.com/about-us/to-our-customers/cp2025-004-vulnerability-mitigation-remediation-for-production-printers-office-small-office-multifunction-printers-laser-printers - https://www.canon-europe.com/support/product-security - https://psirt.canon/hardening/ - https://corporate.jp.canon/caution/160106
CVE ID: CVE-2025-3079 State: PUBLISHED Published: 2025-05-19T23:44:42.145Z Last Updated: 2025-05-20T14:06:58.460Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: Canon Inc. Products: imageRUNNER Series, imageCLASS Series, i-sensys Series, Satera Series Problem Types: CWE-522 Description: A passback vulnerability which relates to office/small office multifunction printers and laser printers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.canon/advisory-information/cp2025-004/ - https://canon.jp/support/support-info/250519vulnerability-response - https://www.usa.canon.com/about-us/to-our-customers/cp2025-004-vulnerability-mitigati
nfo/250519vulnerability-response - https://www.usa.canon.com/about-us/to-our-customers/cp2025-004-vulnerability-mitigation-remediation-for-production-printers-office-small-office-multifunction-printers-laser-printers - https://www.canon-europe.com/support/product-security/ - https://psirt.canon/hardening/ - https://corporate.jp.canon/caution/160106
CVE ID: CVE-2025-3082 State: PUBLISHED Published: 2025-04-01T11:08:06.589Z Last Updated: 2025-04-01T15:14:39.348Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: MongoDB Inc Products: MongoDB Server Problem Types: CWE-284 Description: A user authorized to access a view may be able to alter the intended collation, allowing them to access to a different or unintended view of underlying data. This issue affects MongoDB Server v5.0 version prior to 5.0.31, MongoDB Server v6.0 version prior to 6.0.20, MongoDB Server v7.0 version prior to 7.0.14 and MongoDB Server v7.3 versions prior to 7.3.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://j
MongoDB Server v7.3 versions prior to 7.3.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jira.mongodb.org/browse/SERVER-103151
CVE ID: CVE-2025-3083 State: PUBLISHED Published: 2025-04-01T11:12:31.268Z Last Updated: 2025-04-01T13:18:48.632Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: MongoDB Inc Products: MongoDB Server Problem Types: CWE-248 Description: Specifically crafted MongoDB wire protocol messages can cause mongos to crash during command validation. This can occur without using an authenticated connection. This issue affects MongoDB v5.0 versions prior to 5.0.31, MongoDB v6.0 versions prior to 6.0.20 and MongoDB v7.0 versions prior to 7.0.16 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jira.mongodb.org/browse/SERVER-103152
CVE ID: CVE-2025-3084 State: PUBLISHED Published: 2025-04-01T11:14:19.784Z Last Updated: 2025-04-01T13:10:04.793Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: MongoDB Inc Products: MongoDB Server Problem Types: CWE-703 Description: When run on commands with certain arguments set, explain may fail to validate these arguments before using them. This can lead to crashes in router servers. This affects MongoDB Server v5.0 prior to 5.0.31, MongoDB Server v6.0 prior to 6.0.20, MongoDB Server v7.0 prior to 7.0.16 and MongoDB Server v8.0 prior to 8.0.4 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jira.mongodb.org/browse/SERVER-103153
CVE ID: CVE-2025-3085 State: PUBLISHED Published: 2025-04-01T12:05:05.401Z Last Updated: 2025-04-01T13:03:02.701Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: MongoDB Inc Products: MongoDB Server Problem Types: CWE-299 Description: A MongoDB server under specific conditions running on Linux with TLS and CRL revocation status checking enabled, fails to check the revocation status of the intermediate certificates in the peer's certificate chain. In cases of MONGODB-X509, which is not enabled by default, this may lead to improper authentication. This issue may also affect intra-cluster authentication. This issue affects MongoDB Server v5.0 versions prior to 5.
on. This issue may also affect intra-cluster authentication. This issue affects MongoDB Server v5.0 versions prior to 5.0.31, MongoDB Server v6.0 versions prior to 6.0.20, MongoDB Server v7.0 versions prior to 7.0.16 and MongoDB Server v8.0 versions prior to 8.0.4. Required Configuration : MongoDB Server must be running on Linux Operating Systems and CRL revocation status checking must be enabled Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jira.mongodb.org/browse/SERVER-95445
CVE ID: CVE-2025-3086 State: PUBLISHED Published: 2025-04-04T06:37:42.901Z Last Updated: 2025-04-04T13:25:05.573Z Vendors: M-Files Corporation Products: M-Files Server Problem Types: CWE-653 Description: Improper isolation of users in M-Files Server version before 25.3.14549 allows anonymous user to affect other anonymous users views and possibly cause a denial of service Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://product.m-files.com/security-advisories/cve-2025-3086/
CVE ID: CVE-2025-3087 State: PUBLISHED Published: 2025-04-04T06:40:07.210Z Last Updated: 2025-04-04T13:24:00.708Z Vendors: M-Files Corporation Products: M-Files Web Problem Types: CWE-79 Description: Stored XSS in M-Files Web versions from 25.1.14445.5 to 25.2.14524.4 allows an authenticated user to run scripts Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://product.m-files.com/security-advisories/cve-2025-3087/
CVE ID: CVE-2025-3089 State: PUBLISHED Published: 2025-08-12T16:06:39.883Z Last Updated: 2025-08-12T18:17:15.832Z Vendors: ServiceNow Products: ServiceNow AI Platform Problem Types: CWE-639 Description: ServiceNow has addressed a Broken Access Control vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could allow a low privileged user to bypass access controls and perform a limited set of actions typically reserved for higher privileged users, potentially leading to unauthorized data modifications. This issue is addressed in the listed patches and family releases, which have been made available to hosted and self-hosted customers, as well as partners. Additio
es and family releases, which have been made available to hosted and self-hosted customers, as well as partners. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2264930