Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-22232 State: PUBLISHED Published: 2025-04-10T17:26:56.755Z Last Updated: 2025-04-10T18:08:28.560Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Spring Products: Spring Cloud Config Problem Types: CWE-287 Description: Spring Cloud Config Server may not use Vault token sent by clients using a X-CONFIG-TOKEN header when making requests to Vault. Your application may be affected by this if the following are true: * You have Spring Vault on the classpath of your Spring Cloud Config Server and * You are using the X-CONFIG-TOKEN header to send a Vault token to the Spring Cloud Config Server for the Config Server to use when making requests to Vau
header to send a Vault token to the Spring Cloud Config Server for the Config Server to use when making requests to Vault and * You are using the default Spring Vault SessionManager implementation LifecycleAwareSessionManager or a SessionManager implementation that persists the Vault token such as SimpleSessionManager. In this case the SessionManager persists the first token it retrieves and will continue to use that token even if client requests to the Spring Cloud Config Server include a X-CONFIG-TOKEN header with a different value. Affected Spring Products and Versions Spring Cloud Config: * 2.2.1.RELEASE - 4.2.1 Mitigation Users of affected versions should upgrade to the corresponding f
Spring Cloud Config: * 2.2.1.RELEASE - 4.2.1 Mitigation Users of affected versions should upgrade to the corresponding fixed version. Affected version(s)Fix versionAvailability4.2.x4.2.2OSS4.1.x4.1.6OSS4.0.x4.0.10Commercial3.1.x3.1.10Commercial3.0.x4.1.6OSS2.2.x4.1.6OSS NOTE: Spring Cloud Config 3.0.x and 2.2.x are no longer under open source or commercial support. Users of these versions are encouraged to upgrade to a supported version. No other mitigation steps are necessary. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://spring.io/security/cve-2025-22232
CVE ID: CVE-2025-22233 State: PUBLISHED Published: 2025-05-16T19:14:07.500Z Last Updated: 2025-05-17T02:37:03.191Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Spring Products: Spring Framework Problem Types: CWE-20 Description: CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patterns and for request parameter names. However, there are still cases where it is possible to bypass the disallowedFields checks. Affected Spring Products and Versions Spring Framework: * 6.2.0 - 6.2.6 * 6.1.0 - 6.1.19 * 6.0.0 - 6.0.27 * 5.3.0 - 5.3.42 * Older, unsupported versions are also affected Mitigation Users of affected
- 6.1.19 * 6.0.0 - 6.0.27 * 5.3.0 - 5.3.42 * Older, unsupported versions are also affected Mitigation Users of affected versions should upgrade to the corresponding fixed version. Affected version(s)Fix Version Availability 6.2.x 6.2.7 OSS6.1.x 6.1.20 OSS6.0.x 6.0.28 Commercial https://enterprise.spring.io/ 5.3.x 5.3.43 Commercial https://enterprise.spring.io/ No further mitigation steps are necessary. Generally, we recommend using a dedicated model object with properties only for data binding, or using constructor binding since constructor arguments explicitly declare what to bind together with turning off setter binding through the declarativeBinding flag. See the Model Design section in
t to bind together with turning off setter binding through the declarativeBinding flag. See the Model Design section in the reference documentation. For setting binding, prefer the use of allowedFields (an explicit list) over disallowedFields. Credit This issue was responsibly reported by the TERASOLUNA Framework Development Team from NTT DATA Group Corporation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N&version=3.1
CVE ID: CVE-2025-22235 State: PUBLISHED Published: 2025-04-28T07:10:35.370Z Last Updated: 2025-05-16T23:03:06.227Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Spring Products: Spring Boot Problem Types: CWE-20 Description: EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed. Your application may be affected by this if all the following conditions are met: * You use Spring Security * EndpointRequest.to() has been used in a Spring Security chain configuration * The endpoint which EndpointRequest references is disabled or not exposed via web * Your application
ain configuration * The endpoint which EndpointRequest references is disabled or not exposed via web * Your application handles requests to /null and this path needs protection You are not affected if any of the following is true: * You don't use Spring Security * You don't use EndpointRequest.to() * The endpoint which EndpointRequest.to() refers to is enabled and is exposed * Your application does not handle requests to /null or this path does not need protection Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://spring.io/security/cve-2025-22235
CVE ID: CVE-2025-22236 State: PUBLISHED Published: 2025-06-13T06:53:04.233Z Last Updated: 2025-06-13T14:00:25.435Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L) Vendors: VMware Products: SALT Description: Minion event bus authorization bypass. An attacker with access to a minion key can craft a message which may be able to execute a job on other minions (>= 3007.0). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.saltproject.io/en/3006/topics/releases/3006.12.html - https://docs.saltproject.io/en/3007/topics/releases/3007.4.html
CVE ID: CVE-2025-22237 State: PUBLISHED Published: 2025-06-13T06:55:39.704Z Last Updated: 2025-06-14T03:56:05.071Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: VMware Products: SALT Description: An attacker with access to a minion key can exploit the 'on demand' pillar functionality with a specially crafted git url which could cause and arbitrary command to be run on the master with the same privileges as the master process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.saltproject.io/en/3006/topics/releases/3006.12.html - https://docs.saltproject.io/en/3007/topics/releases/3007.4.html
CVE ID: CVE-2025-22238 State: PUBLISHED Published: 2025-06-13T06:58:19.550Z Last Updated: 2025-06-13T13:55:43.520Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N) Vendors: VMware Products: SALT Description: Directory traversal attack in minion file cache creation. The master's default cache is vulnerable to a directory traversal attack. Which could be leveraged to write or overwrite 'cache' files outside of the cache directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.saltproject.io/en/3006/topics/releases/3006.12.html - https://docs.saltproject.io/en/3007/topics/releases/3007.4.html
CVE ID: CVE-2025-22239 State: PUBLISHED Published: 2025-06-13T07:00:53.681Z Last Updated: 2025-06-13T13:53:14.907Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L) Vendors: VMware Products: SALT Description: Arbitrary event injection on Salt Master. The master's "_minion_event" method can be used by and authorized minion to send arbitrary events onto the master's event bus. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.saltproject.io/en/3006/topics/releases/3006.12.html - https://docs.saltproject.io/en/3007/topics/releases/3007.4.html
CVE ID: CVE-2025-22240 State: PUBLISHED Published: 2025-06-13T07:03:35.139Z Last Updated: 2025-06-13T13:42:42.561Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: VMware Products: SALT Description: Arbitrary directory creation or file deletion. In the find_file method of the GitFS class, a path is created using os.path.join using unvalidated input from the “tgt_env” variable. This can be exploited by an attacker to delete any file on the Master's process has permissions to. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.saltproject.io/en/3006/topics/releases/3006.12.html - https://docs.saltproject.io/en/3007/topics/releases/300
tps://docs.saltproject.io/en/3006/topics/releases/3006.12.html - https://docs.saltproject.io/en/3007/topics/releases/3007.4.html
CVE ID: CVE-2025-22241 State: PUBLISHED Published: 2025-06-13T07:04:38.695Z Last Updated: 2025-06-17T17:26:12.653Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N) Vendors: VMware Products: SALT Description: File contents overwrite the VirtKey class is called when “on-demand pillar” data is requested and uses un-validated input to create paths to the “pki directory”. The functionality is used to auto-accept Minion authentication keys based on a pre-placed “authorization file” at a specific location and is present in the default configuration. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.saltproject.io/en/3006/topics/releases/3006.12.ht
nal Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.saltproject.io/en/3006/topics/releases/3006.12.html - https://docs.saltproject.io/en/3007/topics/releases/3007.4.html
CVE ID: CVE-2025-22242 State: PUBLISHED Published: 2025-06-13T07:08:12.518Z Last Updated: 2025-06-17T17:25:29.513Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:H) Vendors: VMware Products: SALT Description: Worker process denial of service through file read operation. .A vulnerability exists in the Master's “pub_ret” method which is exposed to all minions. The un-sanitized input value “jid” is used to construct a path which is then opened for reading. An attacker could exploit this vulnerabilities by attempting to read from a filename that will not return any data, e.g. by targeting a pipe node on the proc file system. Additional Analyst Notes: - CISA ADP Vulnrichmen
return any data, e.g. by targeting a pipe node on the proc file system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.saltproject.io/en/3006/topics/releases/3006.12.html - https://docs.saltproject.io/en/3007/topics/releases/3007.4.html
CVE ID: CVE-2025-22243 State: PUBLISHED Published: 2025-06-04T19:31:36.548Z Last Updated: 2025-06-04T20:04:02.081Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:H) Vendors: VMware Products: VMware NSX Problem Types: Stored Cross-Site Scripting (XSS) vulnerability in Manager-UI Description: VMware NSX Manager UI is vulnerable to a stored Cross-Site Scripting (XSS) attack due to improper input validation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25738
CVE ID: CVE-2025-22244 State: PUBLISHED Published: 2025-06-04T19:32:17.006Z Last Updated: 2025-06-04T20:04:30.570Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N) Vendors: VMware Products: VMware NSX Problem Types: Stored Cross-Site Scripting (XSS) vulnerability in gateway firewall Description: VMware NSX contains a stored Cross-Site Scripting (XSS) vulnerability in the gateway firewall due to improper input validation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25738
CVE ID: CVE-2025-22245 State: PUBLISHED Published: 2025-06-04T19:32:42.328Z Last Updated: 2025-06-04T20:05:24.144Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: VMware Products: VMware NSX Problem Types: Stored Cross-Site Scripting (XSS) vulnerability in router port Description: VMware NSX contains a stored Cross-Site Scripting (XSS) vulnerability in the router port due to improper input validation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25738
CVE ID: CVE-2025-22246 State: PUBLISHED Published: 2025-05-13T05:14:40.968Z Last Updated: 2025-05-13T13:49:09.193Z Severity: LOW (CVSS 3 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N) Vendors: Cloud Foundry Products: UAA, CF deployment Description: Cloud Foundry UAA release versions from v77.21.0 to v7.31.0 are vulnerable to a private key exposure in logs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cloudfoundry.org/blog/cve-2025-22246-uaa-private-key-exposure/
CVE ID: CVE-2025-22247 State: PUBLISHED Published: 2025-05-12T10:46:36.155Z Last Updated: 2025-11-18T20:05:36.855Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) Vendors: n/a Products: VMware Tools Problem Types: CWE-59 Description: VMware Tools contains an insecure file handling vulnerability. A malicious actor with non-administrative privileges on a guest VM may tamper the local files to trigger insecure file operations within that VM. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25683
CVE ID: CVE-2025-22248 State: PUBLISHED Published: 2025-05-13T09:13:30.613Z Last Updated: 2025-05-13T13:10:31.070Z Vendors: VMware Products: Bitnami Description: The bitnami/pgpool Docker image, and the bitnami/postgres-ha k8s chart, under default configurations, comes with an 'repmgr' user that allows unauthenticated access to the database inside the cluster. The PGPOOL_SR_CHECK_USER is the user that Pgpool itself uses to perform streaming replication checks against nodes, and should not be at trust level. This allows to log into a PostgreSQL database using the repgmr user without authentication. If Pgpool is exposed externally, a potential attacker could use this user to get access to the
without authentication. If Pgpool is exposed externally, a potential attacker could use this user to get access to the service. This is also present within the bitnami/postgres-ha Kubernetes Helm chart. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/bitnami/charts/security/advisories/GHSA-mx38-x658-5fwj
CVE ID: CVE-2025-22249 State: PUBLISHED Published: 2025-05-13T05:08:03.265Z Last Updated: 2025-05-13T13:49:59.998Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) Vendors: VMware Products: Vmware Aria Automation, VMware Cloud Foundation, VMware Telco Cloud Platform Description: VMware Aria automation contains a DOM based Cross-Site Scripting (XSS) vulnerability. A malicious actor may exploit this issue to steal the access token of a logged in user of VMware Aria automation appliance by tricking the user into clicking a malicious crafted payload URL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-not
dditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25711
CVE ID: CVE-2025-22251 State: PUBLISHED Published: 2025-06-10T16:36:12.689Z Last Updated: 2025-06-10T19:40:04.946Z Severity: LOW (CVSS 3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiOS Problem Types: CWE-923 Description: An improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow an unauthenticated attacker to inject unauthorized sessions via crafted FGSP session synchronization packets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-287
CVE ID: CVE-2025-22252 State: PUBLISHED Published: 2025-05-28T07:55:49.946Z Last Updated: 2025-05-29T03:55:46.210Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C) Vendors: Fortinet Products: FortiProxy, FortiSwitchManager, FortiOS Problem Types: CWE-306 Description: A missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager version 7.2.5, and FortiOS versions 7.4.4 through 7.4.6 and version 7.6.0 may allow an attacker with knowledge of an existing admin account to access the device as a valid admin via an authentication bypass. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
evice as a valid admin via an authentication bypass. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-472
CVE ID: CVE-2025-22254 State: PUBLISHED Published: 2025-06-10T16:36:17.127Z Last Updated: 2025-10-16T09:43:38.067Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:H/RL:W/RC:C) Vendors: Fortinet Products: FortiWeb, FortiProxy, FortiOS Problem Types: CWE-269 Description: An Improper Privilege Management vulnerability [CWE-269] affecting Fortinet FortiOS version 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16 and before 6.4.15, FortiProxy version 7.6.0 through 7.6.1 and before 7.4.7 & FortiWeb version 7.6.0 through 7.6.1 and before 7.4.6 allows an authenticated attacker with at least read-only admin permissions to gain super-admin p
7.6.1 and before 7.4.6 allows an authenticated attacker with at least read-only admin permissions to gain super-admin privileges via crafted requests to Node.js websocket module. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-25-006
CVE ID: CVE-2025-22256 State: PUBLISHED Published: 2025-06-10T16:36:15.866Z Last Updated: 2025-06-10T19:39:51.038Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiPAM, FortiSRA Problem Types: CWE-280 Description: A improper handling of insufficient permissions or privileges in Fortinet FortiPAM 1.4.0 through 1.4.1, 1.3.0, 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSRA 1.4.0 through 1.4.1 allows attacker to improper access control via specially crafted HTTP requests Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-25-008
CVE ID: CVE-2025-22258 State: PUBLISHED Published: 2025-10-14T15:22:56.720Z Last Updated: 2025-10-17T03:55:17.164Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H/E:P/RL:W/RC:R) Vendors: Fortinet Products: FortiSRA, FortiSwitchManager, FortiProxy, FortiOS, FortiPAM Problem Types: CWE-122 Description: A heap-based buffer overflow in Fortinet FortiSRA 1.5.0, 1.4.0 through 1.4.2, FortiPAM 1.5.0, 1.4.0 through 1.4.2, 1.3.0 through 1.3.1, 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiProxy 7.6.0 through 7.6.1, 7.4.0 through 7.4.7, FortiOS 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.2 through 7.0.16, FortiSwitchManager 7.2.1 through 7.2.5 all
rough 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.2 through 7.0.16, FortiSwitchManager 7.2.1 through 7.2.5 allows attackers to escalate their privilege via specially crafted http requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-546
CVE ID: CVE-2025-22260 State: PUBLISHED Published: 2025-02-03T14:23:50.454Z Last Updated: 2025-02-03T15:58:18.091Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Pixelite Products: Meta Tag Manager Problem Types: CWE-862 Description: Missing Authorization vulnerability in Pixelite Meta Tag Manager. This issue affects Meta Tag Manager: from n/a through 3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/meta-tag-manager/vulnerability/wordpress-meta-tag-manager-plugin-3-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-22261 State: PUBLISHED Published: 2025-01-07T10:49:06.496Z Last Updated: 2025-02-26T14:59:13.698Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Pixelite Products: WP FullCalendar Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite WP FullCalendar wp-fullcalendar allows Stored XSS.This issue affects WP FullCalendar: from n/a through 1.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-fullcalendar/vulnerability/wordpress-wp-fullcalendar-plugin-1-5-cross-site-scripting-xss-vulnerab
se/wordpress/plugin/wp-fullcalendar/vulnerability/wordpress-wp-fullcalendar-plugin-1-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22262 State: PUBLISHED Published: 2025-01-21T13:57:33.967Z Last Updated: 2025-01-21T14:26:30.245Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: NotFound Products: Bonjour Bar Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Bonjour Bar allows Stored XSS. This issue affects Bonjour Bar: from n/a through 1.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/bonjour-bar/vulnerability/wordpress-bonjour-bar-plugin-1-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22263 State: PUBLISHED Published: 2025-04-15T21:53:09.352Z Last Updated: 2025-04-16T15:07:29.961Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: NotFound Products: Global Gallery Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Global Gallery allows Reflected XSS. This issue affects Global Gallery: from n/a through 8.8.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/global-gallery/vulnerability/wordpress-global-gallery-plugin-8-8-0-reflected-cross-site-scripting-xss-vulnerability
ugin/global-gallery/vulnerability/wordpress-global-gallery-plugin-8-8-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22264 State: PUBLISHED Published: 2025-01-23T15:29:38.873Z Last Updated: 2025-02-12T20:41:26.396Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Tarak Patel Products: WP Query Creator Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tarak Patel WP Query Creator allows Reflected XSS. This issue affects WP Query Creator: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-query-creator/vulnerability/wordpress-wp-query-creator-plugin-1-0-reflected-cross-site-scripting-xss-v
rdpress/plugin/wp-query-creator/vulnerability/wordpress-wp-query-creator-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22265 State: PUBLISHED Published: 2025-01-31T08:23:54.604Z Last Updated: 2025-01-31T19:33:41.107Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: mgplugin Products: EMI Calculator Problem Types: CWE-862 Description: Missing Authorization vulnerability in mgplugin EMI Calculator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects EMI Calculator: from n/a through 1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/emi-calculator/vulnerability/wordpress-emi-calculator-plugin-1-1-settings-change-vulnerability?_s_id=cve