Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-46526 State: PUBLISHED Published: 2025-05-23T12:43:38.920Z Last Updated: 2025-05-23T15:34:42.366Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: janekniefeldt Products: My Custom Widgets Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in janekniefeldt My Custom Widgets allows Reflected XSS. This issue affects My Custom Widgets: from n/a through 2.0.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/mycustomwidget/vulnerability/wordpress-my-custom-widgets-plugin-2-0-5-reflected-cross-site-scrip
tabase/wordpress/plugin/mycustomwidget/vulnerability/wordpress-my-custom-widgets-plugin-2-0-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-46527 State: PUBLISHED Published: 2025-05-23T12:43:38.441Z Last Updated: 2025-05-23T15:49:14.821Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: LikeCoin Products: Web3Press Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in LikeCoin Web3Press allows Path Traversal. This issue affects Web3Press: from n/a through 3.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/likecoin/vulnerability/wordpress-web3press-decentralize-publishing-with-writing-nft-plugin-3-2-0-arbitrary-file-read-vulnerability?_s
erability/wordpress-web3press-decentralize-publishing-with-writing-nft-plugin-3-2-0-arbitrary-file-read-vulnerability?_s_id=cve
CVE ID: CVE-2025-46528 State: PUBLISHED Published: 2025-04-24T16:08:59.415Z Last Updated: 2025-04-24T18:27:26.920Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Steve Products: Availability Calendar Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Steve Availability Calendar allows Stored XSS. This issue affects Availability Calendar: from n/a through 0.2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/availability/vulnerability/wordpress-availability-calendar-0-2-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-46529 State: PUBLISHED Published: 2025-04-24T16:09:16.627Z Last Updated: 2025-04-24T20:01:10.197Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: StressFree Sites Products: Business Contact Widget Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StressFree Sites Business Contact Widget allows Stored XSS. This issue affects Business Contact Widget: from n/a through 2.7.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/business-contact-widget/vulnerability/wordpress-business-contact-widget-2
tps://patchstack.com/database/wordpress/plugin/business-contact-widget/vulnerability/wordpress-business-contact-widget-2-7-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-46530 State: PUBLISHED Published: 2025-04-24T16:09:00.348Z Last Updated: 2025-04-25T13:50:50.306Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: HuangYe WuDeng Products: Hacklog Remote Attachment Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in HuangYe WuDeng Hacklog Remote Attachment allows Stored XSS. This issue affects Hacklog Remote Attachment: from n/a through 1.3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/hacklog-remote-attachment/vulnerability/wordpress-hacklog-remote-attachment-1-3-2-cross-site-request-forgery-csrf-vulnerabi
klog-remote-attachment/vulnerability/wordpress-hacklog-remote-attachment-1-3-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-46531 State: PUBLISHED Published: 2025-04-24T16:09:24.176Z Last Updated: 2025-04-24T19:59:34.069Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Ankur Vishwakarma Products: WP AVCL Automation Helper (formerly WPFlyLeads) Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in Ankur Vishwakarma WP AVCL Automation Helper (formerly WPFlyLeads) allows Server Side Request Forgery. This issue affects WP AVCL Automation Helper (formerly WPFlyLeads): from n/a through 3.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/woozap/vulnerability/wordpress-wp
CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/woozap/vulnerability/wordpress-wp-avcl-automation-helper-formerly-wpflyleads-3-4-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-46532 State: PUBLISHED Published: 2025-04-24T16:09:00.993Z Last Updated: 2025-04-25T13:50:39.896Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Haris Zulfiqar Products: Tooltip Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Haris Zulfiqar Tooltip allows DOM-Based XSS. This issue affects Tooltip: from n/a through 1.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-tooltip/vulnerability/wordpress-tooltip-1-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-46533 State: PUBLISHED Published: 2025-04-24T16:09:17.200Z Last Updated: 2025-04-24T20:01:02.234Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: wpdrift.no Products: Landing pages and Domain aliases for WordPress Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdrift.no Landing pages and Domain aliases for WordPress allows Stored XSS. This issue affects Landing pages and Domain aliases for WordPress: from n/a through 0.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/landing-pages-and-
nalyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/landing-pages-and-domain-aliases/vulnerability/wordpress-landing-pages-and-domain-aliases-for-wordpress-0-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-46534 State: PUBLISHED Published: 2025-04-24T16:09:01.686Z Last Updated: 2025-04-25T13:50:30.923Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: DanielRiera Products: Image Style Hover Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DanielRiera Image Style Hover allows DOM-Based XSS. This issue affects Image Style Hover: from n/a through 1.0.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/image-content-show-hover/vulnerability/wordpress-image-style-hover-1-0-6-cross-site-scripting-xss-
base/wordpress/plugin/image-content-show-hover/vulnerability/wordpress-image-style-hover-1-0-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-46535 State: PUBLISHED Published: 2025-04-25T08:05:56.925Z Last Updated: 2025-04-25T14:28:59.120Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: AlphaEfficiencyTeam Products: Custom Login and Registration Problem Types: CWE-862 Description: Missing Authorization vulnerability in AlphaEfficiencyTeam Custom Login and Registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Login and Registration: from n/a through 1.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ms-registration/vulnerability/wordpress-custom-login-and-r
eferences: - https://patchstack.com/database/wordpress/plugin/ms-registration/vulnerability/wordpress-custom-login-and-registration-plugin-1-0-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-46536 State: PUBLISHED Published: 2025-04-24T16:09:02.349Z Last Updated: 2025-04-25T13:50:21.170Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: RichardHarrison Products: Carousel-of-post-images Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RichardHarrison Carousel-of-post-images allows DOM-Based XSS. This issue affects Carousel-of-post-images: from n/a through 1.07. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/carousel-of-post-images/vulnerability/wordpress-carousel-of-post-images-1
tps://patchstack.com/database/wordpress/plugin/carousel-of-post-images/vulnerability/wordpress-carousel-of-post-images-1-07-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-46537 State: PUBLISHED Published: 2025-05-23T12:43:37.977Z Last Updated: 2025-05-23T15:55:57.217Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: ctltwp Products: Section Widget Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ctltwp Section Widget allows Reflected XSS. This issue affects Section Widget: from n/a through 3.3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/section-widget/vulnerability/wordpress-section-widget-plugin-3-2-5-reflected-cross-site-scripting-xss-vulnerability?_s_
/section-widget/vulnerability/wordpress-section-widget-plugin-3-2-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-46538 State: PUBLISHED Published: 2025-04-24T16:09:03.118Z Last Updated: 2025-04-24T18:24:53.323Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: webplanetsoft Products: Inline Text Popup Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webplanetsoft Inline Text Popup allows DOM-Based XSS. This issue affects Inline Text Popup: from n/a through 1.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/inline-text-popup/vulnerability/wordpress-inline-text-popup-1-0-0-cross-site-scripting-xss-vul
database/wordpress/plugin/inline-text-popup/vulnerability/wordpress-inline-text-popup-1-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-46539 State: PUBLISHED Published: 2025-05-23T12:43:37.504Z Last Updated: 2025-05-23T15:56:33.621Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: WPFable Products: Fable Extra Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFable Fable Extra allows Blind SQL Injection. This issue affects Fable Extra: from n/a through 1.0.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/fable-extra/vulnerability/wordpress-fable-extra-1-0-6-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-46540 State: PUBLISHED Published: 2025-04-24T16:09:03.777Z Last Updated: 2025-04-24T18:14:42.238Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Chris Mok Products: GNA Search Shortcode Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris Mok GNA Search Shortcode allows Stored XSS. This issue affects GNA Search Shortcode: from n/a through 0.9.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/gna-search-shortcode/vulnerability/wordpress-gna-search-shortcode-0-9-5-cross-site-scripting-xss
tabase/wordpress/plugin/gna-search-shortcode/vulnerability/wordpress-gna-search-shortcode-0-9-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-46541 State: PUBLISHED Published: 2025-04-24T16:09:17.735Z Last Updated: 2025-04-24T18:12:19.966Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: elrata_ Products: WP-reCAPTCHA-bp Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in elrata_ WP-reCAPTCHA-bp allows Stored XSS. This issue affects WP-reCAPTCHA-bp: from n/a through 4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-recaptcha-bp/vulnerability/wordpress-wp-recaptcha-bp-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-46542 State: PUBLISHED Published: 2025-04-24T16:09:04.346Z Last Updated: 2025-04-24T18:14:00.609Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: ThemeXpert Products: Xpert Tab Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeXpert Xpert Tab allows Stored XSS. This issue affects Xpert Tab: from n/a through 1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/xpert-tab/vulnerability/wordpress-xpert-tab-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-46543 State: PUBLISHED Published: 2025-05-19T17:04:06.073Z Last Updated: 2025-05-20T14:04:11.542Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Charly Leetham Products: Enhanced Paypal Shortcodes Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Charly Leetham Enhanced Paypal Shortcodes allows Stored XSS.This issue affects Enhanced Paypal Shortcodes: from n/a through 0.5a. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/enhanced-paypal-shortcodes/vulnerability/wordpress-enhanced-paypal-sho
https://patchstack.com/database/wordpress/plugin/enhanced-paypal-shortcodes/vulnerability/wordpress-enhanced-paypal-shortcodes-plugin-0-5a-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-46544 State: PUBLISHED Published: 2025-04-25T00:00:00.000Z Last Updated: 2025-04-25T15:28:45.903Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Sherpa Products: Orchestrator Problem Types: CWE-863 Description: In Sherpa Orchestrator 141851, a low-privileged user can elevate their privileges by creating new users and roles. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sherparpa.com - https://twitter.com/ArtyomBrylev - https://deiteriy.com - https://gist.github.com/ArtemBrylev/a258f920a6556470951c9a483fcf194a
CVE ID: CVE-2025-46545 State: PUBLISHED Published: 2025-04-25T00:00:00.000Z Last Updated: 2025-04-25T15:28:12.367Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: Sherpa Products: Orchestrator Problem Types: CWE-79 Description: In Sherpa Orchestrator 141851, the functionality for adding or updating licenses allows for stored XSS attacks by an administrator through the name parameter. The XSS payload can execute when the license expires. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sherparpa.com - https://twitter.com/ArtyomBrylev - https://deiteriy.com - https://gist.github.com/ArtemBrylev/5a0c76285d5fa9daf4ec753034185de7
CVE ID: CVE-2025-46546 State: PUBLISHED Published: 2025-04-25T00:00:00.000Z Last Updated: 2025-04-25T14:29:53.040Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: Sherpa Products: Orchestrator Problem Types: CWE-89 Description: In Sherpa Orchestrator 141851, multiple time-based blind SQL injections can be performed by an authenticated user. This affects api/gui/asset/list, /api/gui/files/export/csv/, /api/gui/files/list, /api/gui/process/export/csv, /api/gui/process/export/xlsx, /api/gui/process/listAll, /api/gui/processVersion/export/csv/, /api/gui/processVersion/export/xlsx/, /api/gui/processVersion/list/, /api/gui/robot/list/, /api/gui/task/export/csv/, /api
pi/gui/processVersion/export/xlsx/, /api/gui/processVersion/list/, /api/gui/robot/list/, /api/gui/task/export/csv/, /api/gui/task/export/xlsx/, and /api/gui/task/list/. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sherparpa.com - https://twitter.com/ArtyomBrylev - https://deiteriy.com - https://gist.github.com/ArtemBrylev/59b4c0825a988f39a58b79e4e8d2f378
CVE ID: CVE-2025-46547 State: PUBLISHED Published: 2025-04-25T00:00:00.000Z Last Updated: 2025-04-25T16:58:36.946Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: Sherpa Products: Orchestrator Problem Types: CWE-352 Description: In Sherpa Orchestrator 141851, the web application lacks protection against CSRF attacks, with resultant effects of an attacker conducting XSS attacks, adding a new user or role, or exploiting a SQL injection issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sherparpa.com - https://twitter.com/ArtyomBrylev - https://deiteriy.com - https://gist.github.com/ArtemBrylev/9af206c46d7505db03ad6fcd9fc46f7f
CVE ID: CVE-2025-46548 State: PUBLISHED Published: 2025-06-03T14:45:32.890Z Last Updated: 2025-06-11T17:44:23.190Z Vendors: Apache Software Foundation, Lightbend Products: Apache Pekko Management, Akka Management Problem Types: CWE-287 Description: If you enable Basic Authentication in Pekko Management using the Java DSL, the authenticator may not be properly applied. Users that rely on authentication instead of making sure the Management API ports are only available to trusted users are recommended to upgrade to version 1.1.1, which fixes this issue. Akka was affected by the same issue and has released the fix in version 1.6.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP V
he same issue and has released the fix in version 1.6.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/pekko-management/pull/418 - https://github.com/akka/akka-management/pull/1385 - https://lists.apache.org/thread/tnd84hj9w0ggjcft6cp12q67d5jzhp66
CVE ID: CVE-2025-46549 State: PUBLISHED Published: 2025-04-29T20:40:26.765Z Last Updated: 2025-04-30T13:19:03.612Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: YesWiki Products: yeswiki Problem Types: CWE-79 Description: YesWiki is a wiki system written in PHP. Prior to version 4.5.4, an attacker can use a reflected cross-site scripting attack to steal cookies from an authenticated user by having them click on a malicious link. Stolen cookies allow the attacker to take over the user’s session. This vulnerability may also allow attackers to deface the website or embed malicious content. This issue has been patched in version 4.5.4. Additional Analyst Notes
to deface the website or embed malicious content. This issue has been patched in version 4.5.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/YesWiki/yeswiki/security/advisories/GHSA-r9gv-qffm-xw6f - https://github.com/YesWiki/yeswiki/commit/107d43056adebaa0c731230f9fd010898e88f3f5
CVE ID: CVE-2025-46550 State: PUBLISHED Published: 2025-04-29T20:41:01.879Z Last Updated: 2025-04-30T13:18:28.094Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: YesWiki Products: yeswiki Problem Types: CWE-79 Description: YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the `/?BazaR` endpoint and `idformulaire` parameter are vulnerable to cross-site scripting. An attacker can use a reflected cross-site scripting attack to steal cookies from an authenticated user by having them click on a malicious link. Stolen cookies allow the attacker to take over the user’s session. This vulnerability may also allow attackers to deface the website or emb
w the attacker to take over the user’s session. This vulnerability may also allow attackers to deface the website or embed malicious content. This issue has been patched in version 4.5.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/YesWiki/yeswiki/security/advisories/GHSA-ggqx-43h2-55jp - https://github.com/YesWiki/yeswiki/commit/4e9e51d80cd024ed2ac5c12c820817e6d8c2655a
CVE ID: CVE-2025-46551 State: PUBLISHED Published: 2025-05-07T16:12:23.771Z Last Updated: 2025-05-07T20:17:32.055Z Vendors: jruby Products: jruby-openssl Problem Types: CWE-295 Description: JRuby-OpenSSL is an add-on gem for JRuby that emulates the Ruby OpenSSL native library. Starting in JRuby-OpenSSL version 0.12.1 and prior to version 0.15.4 (corresponding to JRuby versions starting in 9.3.4.0 prior to 9.4.12.1 and 10.0.0.0 prior to 10.0.0.1), when verifying SSL certificates, JRuby-OpenSSL does not verify that the hostname presented in the certificate matches the one the user tries to connect to. This means a man-in-the-middle could just present any valid cert for a completely different d
user tries to connect to. This means a man-in-the-middle could just present any valid cert for a completely different domain they own, and JRuby would accept the cert. Anybody using JRuby to make requests of external APIs, or scraping the web, that depends on https to connect securely. JRuby-OpenSSL version 0.15.4 contains a fix for the issue. This fix is included in JRuby versions 10.0.0.1 and 9.4.12.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/jruby/jruby-openssl/security/advisories/GHSA-72qj-48g4-5xgx - https://github.com/jruby/jruby-openssl/commit/31a56d690ce9b8af47af09aaaf809081949ed285
CVE ID: CVE-2025-46552 State: PUBLISHED Published: 2025-04-29T22:13:37.746Z Last Updated: 2025-04-30T17:40:07.561Z Vendors: Krypto-Hashers-Community Products: KHC-INVITATION-AUTOMATION Problem Types: CWE-200, CWE-284 Description: KHC-INVITATION-AUTOMATION is a GitHub automation script that automatically invites followers of a bot account to join your organization. In some commits on version 1.2, a vulnerability was identified where user data, including email addresses and Discord usernames, were exposed in API responses without proper access controls. This allowed unauthorized users to access sensitive user information by directly calling specific endpoints. This issue has been patched in a
zed users to access sensitive user information by directly calling specific endpoints. This issue has been patched in a later commit on version 1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Krypto-Hashers-Community/KHC-INVITATION-AUTOMATION/security/advisories/GHSA-7mpf-6gg2-2fjp - https://github.com/Krypto-Hashers-Community/KHC-INVITATION-AUTOMATION/commit/bc908a4ef538b24d4543ae95a413be6afa308bf5
CVE ID: CVE-2025-46553 State: PUBLISHED Published: 2025-05-05T18:28:50.216Z Last Updated: 2025-05-05T18:50:42.815Z Vendors: misskey-dev Products: summaly Problem Types: CWE-693, CWE-601, CWE-665, CWE-669 Description: @misskey-dev/summaly is a tool for getting a summary of a web page. Starting in version 3.0.1 and prior to version 5.2.1, a logic error in the main `summaly` function causes the `allowRedirects` option to never be passed to any plugins, and as a result, isn't enforced. Misskey will follow redirects, despite explicitly requesting not to. Version 5.2.1 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/misskey-dev/su
patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/misskey-dev/summaly/security/advisories/GHSA-7899-w6c4-vqc4 - https://github.com/misskey-dev/summaly/commit/45153b4f08a772c395a13f7a25399dd87ed022ed