Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
y. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316127 - https://vuldb.com/?ctiid.316127 - https://vuldb.com/?submit.610439 - https://github.com/y2xsec324/cve/issues/14 - https://code-projects.org/
CVE ID: CVE-2025-7478 State: PUBLISHED Published: 2025-07-12T15:02:06.132Z Last Updated: 2025-07-15T13:32:09.402Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Modern Bag Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in code-projects Modern Bag 1.0. Affected is an unknown function of the file /admin/category-list.php. The manipulation of the argument idCate leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316128
he public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316128 - https://vuldb.com/?ctiid.316128 - https://vuldb.com/?submit.610505 - https://github.com/Gemileo/CVE/issues/4 - https://code-projects.org/
CVE ID: CVE-2025-7479 State: PUBLISHED Published: 2025-07-12T15:32:06.334Z Last Updated: 2025-07-15T13:26:07.197Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Vehicle Parking Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in PHPGurukul Vehicle Parking Management System 1.13 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /users/view--detail.php. The manipulation of the argument viewid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP V
launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316129 - https://vuldb.com/?ctiid.316129 - https://vuldb.com/?submit.610567 - https://github.com/f1rstb100d/myCVE/issues/109 - https://phpgurukul.com/
CVE ID: CVE-2025-7480 State: PUBLISHED Published: 2025-07-12T16:02:06.782Z Last Updated: 2025-07-15T13:19:30.338Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Vehicle Parking Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Vehicle Parking Management System 1.13 and classified as critical. Affected by this issue is some unknown functionality of the file /users/signup.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316130 - https://vuldb.com/?ctiid.316130 - https://vuldb.com/?submit.610568 - https://github.com/f1rstb100d/myCVE/issues/110 - https://phpgurukul.com/
CVE ID: CVE-2025-7481 State: PUBLISHED Published: 2025-07-12T16:32:06.399Z Last Updated: 2025-07-14T16:17:46.739Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Vehicle Parking Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Vehicle Parking Management System 1.13. It has been classified as critical. This affects an unknown part of the file /users/profile.php. The manipulation of the argument firstname leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional
y. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316131 - https://vuldb.com/?ctiid.316131 - https://vuldb.com/?submit.610569 - https://github.com/f1rstb100d/myCVE/issues/111 - https://phpgurukul.com/
CVE ID: CVE-2025-7482 State: PUBLISHED Published: 2025-07-12T17:02:06.682Z Last Updated: 2025-07-14T16:17:20.488Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Vehicle Parking Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Vehicle Parking Management System 1.13. It has been declared as critical. This vulnerability affects unknown code of the file /users/print.php. The manipulation of the argument vid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
ploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316132 - https://vuldb.com/?ctiid.316132 - https://vuldb.com/?submit.610570 - https://vuldb.com/?submit.610575 - https://github.com/f1rstb100d/myCVE/issues/112 - https://phpgurukul.com/
CVE ID: CVE-2025-7483 State: PUBLISHED Published: 2025-07-12T17:32:06.887Z Last Updated: 2025-07-14T16:16:44.628Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Vehicle Parking Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Vehicle Parking Management System 1.13. It has been rated as critical. This issue affects some unknown processing of the file /users/forgot-password.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: R
tely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316133 - https://vuldb.com/?ctiid.316133 - https://vuldb.com/?submit.610571 - https://vuldb.com/?submit.610581 - https://github.com/f1rstb100d/myCVE/issues/114 - https://phpgurukul.com/
CVE ID: CVE-2025-7484 State: PUBLISHED Published: 2025-07-12T18:02:06.159Z Last Updated: 2025-07-14T16:16:07.159Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Vehicle Parking Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in PHPGurukul Vehicle Parking Management System 1.13. Affected is an unknown function of the file /admin/view-outgoingvehicle-detail.php. The manipulation of the argument viewid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrich
ck remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316134 - https://vuldb.com/?ctiid.316134 - https://vuldb.com/?submit.610572 - https://github.com/f1rstb100d/myCVE/issues/115 - https://phpgurukul.com/
CVE ID: CVE-2025-7485 State: PUBLISHED Published: 2025-07-12T18:32:07.219Z Last Updated: 2025-07-14T16:15:20.711Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C) Vendors: n/a Products: Open5GS Problem Types: CWE-617 Description: A vulnerability classified as problematic was found in Open5GS up to 2.7.3. Affected by this vulnerability is the function ngap_recv_handler/s1ap_recv_handler/recv_handler of the component SCTP Partial Message Handler. The manipulation leads to reachable assertion. The attack needs to be approached locally. The patch is named cfa44575020f3fb045fd971358442053c8684d3d. It is recommended to apply a patch to fix this issue. Additional
tch is named cfa44575020f3fb045fd971358442053c8684d3d. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316135 - https://vuldb.com/?ctiid.316135 - https://vuldb.com/?submit.610601 - https://github.com/open5gs/open5gs/issues/3878/ - https://github.com/open5gs/open5gs/issues/3878#issuecomment-2853775136 - https://github.com/open5gs/open5gs/commit/cfa44575020f3fb045fd971358442053c8684d3d
CVE ID: CVE-2025-7486 State: PUBLISHED Published: 2025-07-21T22:21:58.221Z Last Updated: 2025-07-23T16:16:15.765Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: motovnet Products: Ebook Store Problem Types: CWE-79 Description: The Ebook Store plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Order Details in all versions up to, and including, 5.8012 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations
scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/20e0e651-8330-4062-8fb4-f0545befcb1a?source=cve - https://plugins.trac.wordpress.org/browser/ebook-store/trunk/functions.php#L230 - https://plugins.trac.wordpress.org/changeset/3328355
CVE ID: CVE-2025-7487 State: PUBLISHED Published: 2025-07-12T19:02:05.776Z Last Updated: 2025-07-14T16:11:57.435Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: JoeyBling Products: SpringBoot_MyBatisPlus Problem Types: CWE-434, CWE-284 Description: A vulnerability, which was classified as critical, was found in JoeyBling SpringBoot_MyBatisPlus up to a6a825513bd688f717dbae3a196bc9c9622fea26. This affects the function SysFileController of the file /file/upload. The manipulation of the argument portraitFile leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product takes
ssible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316137 - https://vuldb.com/?ctiid.316137 - https://vuldb.com/?submit.609342 - https://github.com/JoeyBling/SpringBoot_MyBatisPlus/issues/19
CVE ID: CVE-2025-7488 State: PUBLISHED Published: 2025-07-12T19:32:05.595Z Last Updated: 2025-07-14T16:11:26.282Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: JoeyBling Products: SpringBoot_MyBatisPlus Problem Types: CWE-22 Description: A vulnerability has been found in JoeyBling SpringBoot_MyBatisPlus up to a6a825513bd688f717dbae3a196bc9c9622fea26 and classified as critical. This vulnerability affects the function Download of the file /file/download. The manipulation of the argument Name leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolli
can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316138 - https://vuldb.com/?ctiid.316138 - https://vuldb.com/?submit.609343 - https://github.com/JoeyBling/SpringBoot_MyBatisPlus/issues/18
CVE ID: CVE-2025-7489 State: PUBLISHED Published: 2025-07-12T20:02:06.445Z Last Updated: 2025-07-14T16:10:53.285Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Vehicle Parking Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Vehicle Parking Management System 1.13 and classified as critical. This issue affects some unknown processing of the file /admin/search-vehicle.php. The manipulation of the argument searchdata leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: R
tely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316139 - https://vuldb.com/?ctiid.316139 - https://vuldb.com/?submit.610573 - https://github.com/f1rstb100d/myCVE/issues/116 - https://phpgurukul.com/
CVE ID: CVE-2025-7490 State: PUBLISHED Published: 2025-07-12T20:32:06.518Z Last Updated: 2025-07-14T16:10:19.180Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Vehicle Parking Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Vehicle Parking Management System 1.13. It has been classified as critical. Affected is an unknown function of the file /admin/reg-users.php. The manipulation of the argument del leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316140 - https://vuldb.com/?ctiid.316140 - https://vuldb.com/?submit.610574 - https://github.com/f1rstb100d/myCVE/issues/117 - https://phpgurukul.com/
CVE ID: CVE-2025-7491 State: PUBLISHED Published: 2025-07-12T21:02:06.181Z Last Updated: 2025-07-15T19:54:50.487Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Vehicle Parking Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Vehicle Parking Management System 1.13. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/manage-outgoingvehicle.php. The manipulation of the argument del leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - C
ck can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316141 - https://vuldb.com/?ctiid.316141 - https://vuldb.com/?submit.610576 - https://github.com/f1rstb100d/myCVE/issues/119 - https://phpgurukul.com/
CVE ID: CVE-2025-7492 State: PUBLISHED Published: 2025-07-12T21:32:06.610Z Last Updated: 2025-07-15T19:54:44.000Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Vehicle Parking Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Vehicle Parking Management System 1.13. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/manage-incomingvehicle.php. The manipulation of the argument del leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP V
launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316142 - https://vuldb.com/?ctiid.316142 - https://vuldb.com/?submit.610577 - https://github.com/f1rstb100d/myCVE/issues/120 - https://phpgurukul.com/
CVE ID: CVE-2025-7493 State: PUBLISHED Published: 2025-09-30T15:06:46.836Z Last Updated: 2025-11-06T21:10:49.216Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Servi
pdate Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Enterprise Linux 6 Problem Types: CWE-1220 Description: A privilege escalation flaw from host to domain administrator was found in FreeIPA. This vulnerability is similar to CVE-2025-4404, where it fails to valid
st to domain administrator was found in FreeIPA. This vulnerability is similar to CVE-2025-4404, where it fails to validate the uniqueness of the krbCanonicalName. While the previously released version added validations for the admin@REALM credential, FreeIPA still does not validate the root@REALM canonical name, which can also be used as the realm administrator's name. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2025:17084 - https://access.redhat.com/errata/RHSA-20
ram Container: References: - https://access.redhat.com/errata/RHSA-2025:17084 - https://access.redhat.com/errata/RHSA-2025:17085 - https://access.redhat.com/errata/RHSA-2025:17086 - https://access.redhat.com/errata/RHSA-2025:17087 - https://access.redhat.com/errata/RHSA-2025:17088 - https://access.redhat.com/errata/RHSA-2025:17129 - https://access.redhat.com/errata/RHSA-2025:17645 - https://access.redhat.com/errata/RHSA-2025:17646 - https://access.redhat.com/errata/RHSA-2025:17647 - https://access.redhat.com/errata/RHSA-2025:17648 - https://access.redhat.com/errata/RHSA-2025:17649 - https://access.redhat.com/security/cve/CVE-2025-7493 - https://bugzilla.redhat.com/show_bug.cgi?id=2389448
CVE ID: CVE-2025-7495 State: PUBLISHED Published: 2025-07-22T04:25:07.143Z Last Updated: 2025-07-22T16:32:00.644Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: cbutlerjr Products: WP-Members Membership Plugin Problem Types: CWE-79 Description: The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpmem_login_link' shortcode in all versions up to, and including, 3.5.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that wi
e for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/942df4bc-2a17-4add-9664-60d77319b93a?source=cve - https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.4.1/includes/class-wp-members-shortcodes.php#L1092 - https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.4.1/includes/api/api.php#L144 - https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.4.1/includes/vendor/rocketgeek-utilities/includes/utilities.php#L259 - https://
ordpress.org/browser/wp-members/tags/3.5.4.1/includes/vendor/rocketgeek-utilities/includes/utilities.php#L259 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3331571%40wp-members&new=3331571%40wp-members&sfp_email=&sfph_mail=
CVE ID: CVE-2025-7496 State: PUBLISHED Published: 2025-08-19T03:39:03.934Z Last Updated: 2025-08-19T19:22:06.334Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpclever Products: WPC Smart Compare for WooCommerce Problem Types: CWE-79 Description: The WPC Smart Compare for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via DOM elements in all versions up to, and including, 6.4.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected pa
vel access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c01f7892-5ca2-4bc8-91c2-dfebb685aff8?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3340004%40woo-smart-compare&new=3340004%40woo-smart-compare&sfp_email=&sfph_mail=
CVE ID: CVE-2025-7497 State: PUBLISHED Published: 2025-07-29T17:57:13.572Z Last Updated: 2025-08-19T13:22:46.904Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: Shared Components Problem Types: CWE-787 Description: A maliciously crafted PRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com
CVE ID: CVE-2025-7498 State: PUBLISHED Published: 2025-08-06T03:41:00.255Z Last Updated: 2025-08-06T19:28:24.067Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: timstrifler Products: Exclusive Addons for Elementor Problem Types: CWE-79 Description: The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown Widget in all versions up to, and including, 2.7.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an inje
utor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/51d3d738-5c82-4f6b-b8f3-d5af5391b6f6?source=cve - https://plugins.trac.wordpress.org/browser/exclusive-addons-for-elementor/trunk/assets/vendor/js/jquery.countdown.min.js - https://plugins.trac.wordpress.org/browser/exclusive-addons-for-elementor/trunk/assets/js/exad-scripts.js#L187 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3326867%40exclusive-addons-for-elementor&new=3326867%40exclusive-addons-for-ele
eset?sfp_email=&sfph_mail=&reponame=&old=3326867%40exclusive-addons-for-elementor&new=3326867%40exclusive-addons-for-elementor&sfp_email=&sfph_mail=