Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
d attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e289988c-8bc1-4b2a-87a2-c94758d10e88?source=cve - https://plugins.trac.wordpress.org/browser/custom-404-pro/tags/3.12.0/admin/Helpers.php#L188
CVE ID: CVE-2025-9948 State: PUBLISHED Published: 2025-09-30T03:35:30.655Z Last Updated: 2025-09-30T15:32:03.468Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: paulq Products: Chat by Chatwee Problem Types: CWE-352 Description: The Chat by Chatwee plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.3. This is due to missing or incorrect nonce validation on the admin settings page. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: -
ed they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b9a4e0c1-7bbb-4ab0-948c-3d172717e5fe?source=cve - https://plugins.trac.wordpress.org/browser/chatwee/trunk/chatwee-admin.php#L41 - https://plugins.trac.wordpress.org/browser/chatwee/trunk/chatwee-admin.php#L10
CVE ID: CVE-2025-9949 State: PUBLISHED Published: 2025-09-20T04:27:56.609Z Last Updated: 2025-09-22T15:05:21.542Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: webraketen Products: Internal Links Manager Problem Types: CWE-352 Description: The Internal Links Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on the link deletion functionality in the process_bulk_action() function. This makes it possible for unauthenticated attackers to delete SEO links via a forged request granted they can trick a site administrator into performing an act
ed attackers to delete SEO links via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e0e5e143-c4de-4312-8c8b-acf7ef60e0d5?source=cve - https://wordpress.org/plugins/seo-automated-link-building/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3362770%40seo-automated-link-building&new=3362770%40seo-automated-link-building&sfp_email=&sfph_mail=
CVE ID: CVE-2025-9950 State: PUBLISHED Published: 2025-10-11T09:28:39.601Z Last Updated: 2025-10-14T18:45:27.147Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: bestwebsoft Products: Error Log Viewer by BestWebSoft Problem Types: CWE-22 Description: The Error Log Viewer by BestWebSoft plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.6 via the rrrlgvwr_get_file function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment:
bitrary files on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9455eccb-9f32-4e4e-8fe4-f345bf6e8da7?source=cve - https://plugins.trac.wordpress.org/browser/error-log-viewer/tags/1.1.6/error-log-viewer.php#L118
CVE ID: CVE-2025-9951 State: PUBLISHED Published: 2025-09-09T13:54:08.497Z Last Updated: 2025-09-10T03:56:06.671Z Vendors: FFmpeg Products: FFmpeg Problem Types: CWE-122 Description: A heap-buffer-overflow write exists in jpeg2000dec FFmpeg which allows an attacker to potentially gain remote code execution or cause denial of service via the channel definition cdef atom of JPEG2000. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/google/security-research/security/advisories/GHSA-39q3-f8jq-v6mg
CVE ID: CVE-2025-9952 State: PUBLISHED Published: 2025-10-04T03:33:30.641Z Last Updated: 2025-10-06T15:54:05.998Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: sergiotrinity Products: Trinity Audio – Text to Speech AI audio player to convert content into audio Problem Types: CWE-79 Description: The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'range-date' parameter in all versions up to, and including, 5.20.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip
put sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a68ca792-6870-4e28-b118-ee1125842955?source=cve - https://plugins.trac.wordpress.org/browser/trinity-audio/tags/5.20.1/admin/inc/post-management.php#L44 - https://plugins.trac.wordpress.org/browser/trinity-audio/tags/5.20.1/admin/inc/post-management.php#L37 - https://plugins.trac.wordpress.org/changeset/3371934/trinity-audio/trunk/admin/i
0.1/admin/inc/post-management.php#L37 - https://plugins.trac.wordpress.org/changeset/3371934/trinity-audio/trunk/admin/inc/post-management.php
CVE ID: CVE-2025-9954 State: PUBLISHED Published: 2025-10-29T23:12:41.751Z Last Updated: 2025-10-30T14:45:16.263Z Vendors: Drupal Products: Acquia DAM Problem Types: CWE-862 Description: Missing Authorization vulnerability in Drupal Acquia DAM allows Forceful Browsing.This issue affects Acquia DAM: from 0.0.0 before 1.1.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-105
CVE ID: CVE-2025-9955 State: PUBLISHED Published: 2025-10-16T12:14:56.477Z Last Updated: 2025-10-16T13:29:14.882Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: WSO2 Products: WSO2 Enterprise Integrator, WSO2 Enterprise Service Bus, org.wso2.carbon:org.wso2.carbon.base, org.wso2.carbon:org.wso2.carbon.server.admin Description: An improper access control vulnerability exists in WSO2 Enterprise Integrator product due to insufficient permission restrictions on internal SOAP admin services related to system logs and user-store configuration. A low-privileged user can access log data and user-store configuration details that are not intended to be exposed at tha
low-privileged user can access log data and user-store configuration details that are not intended to be exposed at that privilege level. While no credentials or sensitive user information are exposed, this vulnerability may allow unauthorized visibility into internal operational details, which could aid in further exploitation or reconnaissance. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4526/
CVE ID: CVE-2025-9958 State: PUBLISHED Published: 2025-09-26T09:04:41.537Z Last Updated: 2025-11-06T17:30:27.285Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-201 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1, that could have allowed Guest users to access sensitive information stored in virtual registry configurations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/567777 - https://hackerone.com/reports/3323573
CVE ID: CVE-2025-9959 State: PUBLISHED Published: 2025-09-03T16:53:46.304Z Last Updated: 2025-09-03T18:48:11.974Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L) Problem Types: CWE-94 Description: Incomplete validation of dunder attributes allows an attacker to escape from the Local Python execution environment sandbox, enforced by smolagents. The attack requires a Prompt Injection in order to trick the agent to create malicious code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://research.jfrog.com/vulnerabilities/smolagents-local-python-sandbox-escape-jfsa-2025-001434277/ - https://github.com/huggingface/smolagents/pull/1551
CVE ID: CVE-2025-9960 State: PUBLISHED Published: 2025-09-22T18:35:34.895Z Last Updated: 2025-09-23T20:34:44.217Z Vendors: is-localhost-ip Products: is-localhost-ip Problem Types: CWE-918 Description: A restriction bypass vulnerability in is-localhost-ip could allow attackers to perform Server-Side Request Forgery (SSRF). This issue affects is-localhost-ip: 2.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/registrada - https://github.com/tinovyatkin/is-localhost-ip
CVE ID: CVE-2025-9961 State: PUBLISHED Published: 2025-09-06T06:50:59.558Z Last Updated: 2025-09-09T03:55:19.062Z Vendors: TP-Link Systems Inc. Products: AX10 V1/V1.2/V2/V2.6/V3/V3.6, AX1500 V1/V1.20/V1.26/V1.60/V1.80/V2.60/V3.6 Problem Types: CWE-120 Description: An authenticated attacker may remotely execute arbitrary code via the CWMP binary on the devices AX10 and AX1500. The exploit can only be conducted via a Man-In-The-Middle (MITM) attack. This issue affects AX10 V1/V1.2/V2/V2.6/V3/V3.6: before 1.2.1; AX1500 V1/V1.20/V1.26/V1.60/V1.80/V2.60/V3.6: before 1.3.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://blog.byteray.co.uk/zero-day-alert-automated-discove
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://blog.byteray.co.uk/zero-day-alert-automated-discovery-of-critical-cwmp-stack-overflow-in-tp-link-routers-0bc495a08679 - https://www.tp-link.com/us/support/faq/4647/ - https://www.tp-link.com/us/support/download/archer-ax10/ - https://www.tp-link.com/us/support/download/archer-ax1500/
CVE ID: CVE-2025-9962 State: PUBLISHED Published: 2025-09-23T11:02:13.795Z Last Updated: 2025-11-03T18:14:22.855Z Vendors: Novakon Products: P series Problem Types: CWE-120 Description: A buffer overflow vulnerability in Novakon P series allows attackers to gain root permission without prior authentication.This issue affects P series: P – V2001.A.C518o2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cyberdanube.com/security-research/multiple-vulnerabilities-in-novakon-hmi-series/
CVE ID: CVE-2025-9963 State: PUBLISHED Published: 2025-09-23T11:11:14.251Z Last Updated: 2025-11-03T18:14:23.795Z Vendors: Novakon Products: P series Problem Types: CWE-22 Description: A path traversal vulnerability in Novakon P series allows to expose the root file system "/" and modify all files with root permissions. This way the system can also be compromized.This issue affects P series: P – V2001.A.C518o2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cyberdanube.com/security-research/multiple-vulnerabilities-in-novakon-hmi-series/
CVE ID: CVE-2025-9964 State: PUBLISHED Published: 2025-09-23T11:33:13.872Z Last Updated: 2025-11-03T18:14:24.756Z Vendors: Novakon Products: P series Problem Types: CWE-521 Description: No password for the root user is set in Novakon P series. This allows phyiscal attackers to enter the console easily. This issue affects P series: P – V2001.A.C518o2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cyberdanube.com/security-research/multiple-vulnerabilities-in-novakon-hmi-series/
CVE ID: CVE-2025-9965 State: PUBLISHED Published: 2025-09-23T11:36:35.285Z Last Updated: 2025-11-03T18:14:25.691Z Vendors: Novakon Products: P series Problem Types: CWE-287 Description: Improper authentication vulnerability in Novakon P series allows unauthenticated attackers to upload and download any application from/to the device.This issue affects P series: P – V2001.A.C518o2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cyberdanube.com/security-research/multiple-vulnerabilities-in-novakon-hmi-series/
CVE ID: CVE-2025-9966 State: PUBLISHED Published: 2025-09-23T11:41:19.444Z Last Updated: 2025-11-03T18:14:26.665Z Vendors: Novakon Products: P series Problem Types: CWE-269 Description: Improper privilege management vulnerability in Novakon P series allows attackers to gain root privileges if one service is compromized.This issue affects P series: P – V2001.A.C518o2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cyberdanube.com/security-research/multiple-vulnerabilities-in-novakon-hmi-series/
CVE ID: CVE-2025-9967 State: PUBLISHED Published: 2025-10-15T08:26:00.449Z Last Updated: 2025-10-15T14:54:19.871Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: gsayed786 Products: Orion SMS OTP Verification Problem Types: CWE-288 Description: The Orion SMS OTP Verification plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.7. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's password to a one-time password if the attacker knows the user's phone number Add
d attackers to change arbitrary user's password to a one-time password if the attacker knows the user's phone number Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b121fdb4-93a8-400c-89c2-3195cb40e03c?source=cve - https://plugins.trac.wordpress.org/browser/orion-sms-otp-verification/trunk/vendor/js/reset-password.js
CVE ID: CVE-2025-9968 State: PUBLISHED Published: 2025-10-13T08:13:33.300Z Last Updated: 2025-10-21T03:55:20.713Z Vendors: ASUS Products: Armoury Crate Problem Types: CWE-59 Description: A link following vulnerability exists in the UnifyScanner component of Armoury Crate. This vulnerability may be triggered by creating a specially crafted junction, potentially leading to local privilege escalation. For more information, please refer to section 'Security Update for Armoury Crate App' in the ASUS Security Advisory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.asus.com/security-advisory/
CVE ID: CVE-2025-9969 State: PUBLISHED Published: 2025-09-19T11:26:08.081Z Last Updated: 2025-09-19T13:07:43.706Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) Vendors: Vizly Web Design Products: Real Estate Packages Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Vizly Web Design Real Estate Packages allows Content Spoofing, CAPEC - 593 - Session Hijacking, CAPEC - 591 - Reflected XSS.This issue affects Real Estate Packages: before 5.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0278
CVE ID: CVE-2025-9970 State: PUBLISHED Published: 2025-10-08T16:32:55.889Z Last Updated: 2025-10-08T17:21:31.635Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:H) Vendors: ABB Products: MConfig Problem Types: CWE-316 Description: Cleartext Storage of Sensitive Information in Memory vulnerability in ABB MConfig.This issue affects MConfig: through 1.4.9.21. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=4TZ00000006008&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2025-9971 State: PUBLISHED Published: 2025-09-17T06:48:32.697Z Last Updated: 2025-09-17T12:55:54.586Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Planet Technology Products: ICG-2510WG-LTE (EU/US), ICG-2510W-LTE (EU/US) Problem Types: CWE-306 Description: Certain models of Industrial Cellular Gateway developed by Planet Technology have a Missing Authentication vulnerability, allowing unauthenticated remote attackers to manipulate the device via a specific functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10389-265a3-1.html - https://www.twcert.org.tw/en/cp-139-10390-7ce12-2.h
ferences: - https://www.twcert.org.tw/tw/cp-132-10389-265a3-1.html - https://www.twcert.org.tw/en/cp-139-10390-7ce12-2.html - https://www.planet.com.tw/en/support/security-advisory/8
CVE ID: CVE-2025-9972 State: PUBLISHED Published: 2025-09-17T07:01:52.453Z Last Updated: 2025-09-23T04:26:58.640Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Planet Technology Products: ICG-2510WG-LTE (EU/US), ICG-2510W-LTE (EU/US) Problem Types: CWE-78 Description: Certain models of Industrial Cellular Gateway developed by Planet Technology have an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10389-265a3-1.html - https://www.twcert.org.tw/en/cp-139-10390-7c
ent: References: - https://www.twcert.org.tw/tw/cp-132-10389-265a3-1.html - https://www.twcert.org.tw/en/cp-139-10390-7ce12-2.html - https://www.planet.com.tw/en/support/security-advisory/8
CVE ID: CVE-2025-9975 State: PUBLISHED Published: 2025-10-11T09:28:37.954Z Last Updated: 2025-10-14T18:45:50.544Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: rico-macchi Products: WP Scraper Problem Types: CWE-918 Description: The WP Scraper plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.8.1 via the wp_scraper_extract_content function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. On Cloud instance
ating from the web application and can be used to query and modify information from internal services. On Cloud instances, this issue allows for metadata retrieving. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4c72abf9-f63d-4460-8c9b-10e3f65b71ba?source=cve - https://plugins.trac.wordpress.org/browser/wp-scraper/tags/5.8.1/wp-scraper.php#L688
CVE ID: CVE-2025-9976 State: PUBLISHED Published: 2025-10-13T07:33:15.695Z Last Updated: 2025-10-14T13:15:34.207Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Dassault Systèmes Products: Station Launcher App in 3DEXPERIENCE platform Problem Types: CWE-78 Description: An OS Command Injection vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x could allow an attacker to execute arbitrary code on the user's machine. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.3ds.com/trust-center/security/security-advisories/cve-2025-9976
CVE ID: CVE-2025-9977 State: PUBLISHED Published: 2025-11-18T15:46:21.408Z Last Updated: 2025-11-18T20:43:40.022Z Vendors: Times Software Products: E-Payroll Problem Types: CWE-89, CWE-209 Description: Value provided in one of POST parameters sent during the process of logging in to Times Software E-Payroll is not sanitized properly, which allows an unauthenticated attacker to perform DoS attacks. SQL injection attacks might also be feasible, although so far creating a working exploit has been prevented probably by backend filtering mechanisms. Additionally, command injection attempts cause the application to return extensive error messages disclosing some information about the internal infr
on attempts cause the application to return extensive error messages disclosing some information about the internal infrastructure. Patching status is unknown because the vendor has not replied to messages sent by the CNA. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/11/CVE-2025-9977 - https://www.timesoftsg.com.sg/payroll-software/
CVE ID: CVE-2025-9978 State: PUBLISHED Published: 2025-10-24T06:00:09.729Z Last Updated: 2025-10-24T13:26:31.708Z Vendors: Unknown Products: Jeg Kit for Elementor Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Jeg Kit for Elementor WordPress plugin before 2.7.0 does not sanitize SVG file contents when uploaded via xmlrpc.php, leading to a cross site scripting vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/cef78a77-c66d-4d62-8d49-140ca2d04d5b/
CVE ID: CVE-2025-9979 State: PUBLISHED Published: 2025-09-10T06:38:47.461Z Last Updated: 2025-09-10T16:12:35.377Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: yonifre Products: Maspik – Ultimate Spam Protection Problem Types: CWE-862 Description: The Maspik plugin for WordPress is vulnerable to Missing Authorization in version 2.5.6 and prior. This is due to missing capability checks on the Maspik_spamlog_download_csv function. This makes it possible for authenticated attackers, with subscriber-level access and above, to export and download the spam log database containing blocked submission attempts, which may include misclassified but legitimate submiss
oad the spam log database containing blocked submission attempts, which may include misclassified but legitimate submissions with sensitive data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7ee68705-cbb3-44b8-8223-4cecd678bcab?source=cve - https://plugins.trac.wordpress.org/browser/contact-forms-anti-spam/trunk/includes/functions.php#L1482 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3357602%40contact-forms-anti-spam&new=3357602%40contact-forms-anti-spam&sfp_email=&sfph_mail=
CVE ID: CVE-2025-9980 State: PUBLISHED Published: 2025-10-23T09:37:33.430Z Last Updated: 2025-10-23T14:53:59.344Z Vendors: OpenSolution Products: QuickCMS Problem Types: CWE-79 Description: QuickCMS is vulnerable to multiple Stored XSS in page editor functionality (pages-form). Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. By default admin user is not able to add JavaScript into the website. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other ver
details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/posts/2025/10/CVE-2025-9980 - https://opensolution.org/cms-system-quick-cms.html