Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-1616 State: PUBLISHED Published: 2025-02-24T04:00:11.947Z Last Updated: 2025-02-24T11:37:09.537Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: FiberHome Products: AN5506-01A ONU GPON Problem Types: CWE-78, CWE-77 Description: A vulnerability, which was classified as critical, has been found in FiberHome AN5506-01A ONU GPON RP2511. Affected by this issue is some unknown functionality of the component Diagnosis. The manipulation of the argument Destination Address leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respon
as been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.296606 - https://vuldb.com/?ctiid.296606 - https://vuldb.com/?submit.501483
CVE ID: CVE-2025-1617 State: PUBLISHED Published: 2025-02-24T04:00:13.873Z Last Updated: 2025-02-24T12:59:28.476Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: Netis Products: WF2780 Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, was found in Netis WF2780 2.1.41925. This affects an unknown part of the component Wireless 2.4G Menu. The manipulation of the argument SSID leads to cross site scripting. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.296607 - http
respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.296607 - https://vuldb.com/?ctiid.296607 - https://vuldb.com/?submit.501472
CVE ID: CVE-2025-1618 State: PUBLISHED Published: 2025-02-24T04:31:04.303Z Last Updated: 2025-03-03T06:38:54.934Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: vTiger Products: CRM Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in vTiger CRM 6.4.0/6.5.0 and classified as problematic. This vulnerability affects unknown code of the file /modules/Mobile/index.php. The manipulation of the argument _operation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0 is able to address this issue. It is recommended to upgrade the affected component. Additional A
pgrading to version 7.0 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.296608 - https://vuldb.com/?ctiid.296608 - https://vuldb.com/?submit.501840 - https://www.vtiger.com/
CVE ID: CVE-2025-1619 State: PUBLISHED Published: 2025-03-16T06:00:07.989Z Last Updated: 2025-03-17T15:16:38.813Z Vendors: Unknown Products: GDPR Cookie Compliance Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ae9bc19d-1634-4501-a258-8c56b2afee88/
CVE ID: CVE-2025-1620 State: PUBLISHED Published: 2025-03-16T06:00:08.619Z Last Updated: 2025-03-17T15:16:09.220Z Vendors: Unknown Products: GDPR Cookie Compliance Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/923db805-92e7-4489-8e57-374a19f817d7/
CVE ID: CVE-2025-1621 State: PUBLISHED Published: 2025-03-16T06:00:09.013Z Last Updated: 2025-03-17T15:15:41.274Z Vendors: Unknown Products: GDPR Cookie Compliance Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c30b9631-2024-4081-9cc5-8294a77c5ebb/
CVE ID: CVE-2025-1622 State: PUBLISHED Published: 2025-03-16T06:00:09.461Z Last Updated: 2025-03-17T18:13:24.301Z Vendors: Unknown Products: GDPR Cookie Compliance Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7a903d61-2792-4fe0-a26b-f400f4a3124b/
CVE ID: CVE-2025-1623 State: PUBLISHED Published: 2025-03-16T06:00:09.918Z Last Updated: 2025-03-17T18:09:26.639Z Vendors: Unknown Products: GDPR Cookie Compliance Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The GDPR Cookie Compliance WordPress plugin before 4.15.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/40288fa0-50c6-4e13-9b92-968b060d3bf5/
CVE ID: CVE-2025-1624 State: PUBLISHED Published: 2025-03-16T06:00:10.301Z Last Updated: 2025-03-17T18:08:47.195Z Vendors: Unknown Products: GDPR Cookie Compliance Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The GDPR Cookie Compliance WordPress plugin before 4.15.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2f4a402a-97f6-4638-9ce0-456ccd5606e9/
CVE ID: CVE-2025-1625 State: PUBLISHED Published: 2025-05-19T06:00:03.540Z Last Updated: 2025-05-19T14:24:20.669Z Vendors: Unknown Products: Qi Blocks Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its Counter block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/288208c4-e9ca-4b79-88e7-fb415a726fce/
CVE ID: CVE-2025-1626 State: PUBLISHED Published: 2025-05-19T06:00:04.417Z Last Updated: 2025-05-19T14:19:03.214Z Vendors: Unknown Products: Qi Blocks Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its Countdown block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f00d86f1-7ff9-4001-af16-989358d811a8/
CVE ID: CVE-2025-1627 State: PUBLISHED Published: 2025-05-19T06:00:04.814Z Last Updated: 2025-05-19T13:56:07.562Z Vendors: Unknown Products: Qi Blocks Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/31b2292b-1ea7-4d63-ad65-0366e2c05dd3/
CVE ID: CVE-2025-1628 State: REJECTED Published: N/A Last Updated: 2025-03-19T22:15:46.492Z Description: No description available.
CVE ID: CVE-2025-1629 State: PUBLISHED Published: 2025-02-24T05:00:11.687Z Last Updated: 2025-02-24T11:35:35.486Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Excitel Broadband Private Products: my Excitel App Problem Types: CWE-307, CWE-799 Description: A vulnerability was found in Excitel Broadband Private my Excitel App 3.13.0 on Android. It has been classified as problematic. Affected is an unknown function of the component One-Time Password Handler. The manipulation leads to improper restriction of excessive authentication attempts. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP
e vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.296610 - https://vuldb.com/?ctiid.296610 - https://vuldb.com/?submit.501868
CVE ID: CVE-2025-1631 State: REJECTED Published: N/A Last Updated: 2025-07-05T22:16:38.043Z Description: No description available.
CVE ID: CVE-2025-1632 State: PUBLISHED Published: 2025-02-24T13:31:08.871Z Last Updated: 2025-02-24T14:25:32.542Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: libarchive Problem Types: CWE-476, CWE-404 Description: A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP
he vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.296619 - https://vuldb.com/?ctiid.296619 - https://vuldb.com/?submit.496460 - https://github.com/Ekkosun/pocs/blob/main/bsdunzip-poc
CVE ID: CVE-2025-1634 State: PUBLISHED Published: 2025-02-26T16:56:23.869Z Last Updated: 2025-11-11T15:32:39.268Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Build of Apache Camel 4.8 for Quarkus 3.15, Red Hat build of Quarkus 3.15.3.SP1, Red Hat build of Quarkus 3.8.6.SP3, Streams for Apache Kafka 2.9.1, Streams for Apache Kafka 3.0.0 Problem Types: CWE-401 Description: A flaw was found in the quarkus-resteasy extension, which causes memory leaks when client requests with low timeouts are made. If a client request times out, a buffer is not released correctly, leading to increased memory usage and eventual application crash due t
st times out, a buffer is not released correctly, leading to increased memory usage and eventual application crash due to OutOfMemoryError. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:12511 - https://access.redhat.com/errata/RHSA-2025:1884 - https://access.redhat.com/errata/RHSA-2025:1885 - https://access.redhat.com/errata/RHSA-2025:2067 - https://access.redhat.com/errata/RHSA-2025:9922 - https://access.redhat.com/security/cve/CVE-2025-1634 - https://bugzilla.redhat.com/show_bug.cgi?id=2347319
CVE ID: CVE-2025-1635 State: PUBLISHED Published: 2025-03-13T12:47:06.016Z Last Updated: 2025-03-18T16:30:09.958Z Vendors: Devolutions Products: Remote Desktop Manager Problem Types: CWE-200 Description: Exposure of sensitive information in hub data source export feature in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows allows a user exporting a hub data source to include his authenticated session in the export due to faulty business logic. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2025-0004/
CVE ID: CVE-2025-1636 State: PUBLISHED Published: 2025-03-13T12:47:13.034Z Last Updated: 2025-03-18T16:20:55.598Z Vendors: Devolutions Products: Remote Desktop Manager Problem Types: CWE-200 Description: Exposure of sensitive information in My Personal Credentials password history component in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows allows an authenticated user to inadvertently leak the My Personal Credentials in a shared vault via the clear history feature due to faulty business logic. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2025-0004/
CVE ID: CVE-2025-1638 State: PUBLISHED Published: 2025-03-01T07:24:04.067Z Last Updated: 2025-03-03T20:56:57.878Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Edge-Themes Products: Alloggio Membership Problem Types: CWE-288 Description: The Alloggio Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.2. This is due to the plugin not properly validating a user's identity through the alloggio_membership_init_rest_api_facebook_login and alloggio_membership_init_rest_api_google_login functions. This makes it possible for unauthenticated attackers to log in as any user, including administrators, wi
ogin functions. This makes it possible for unauthenticated attackers to log in as any user, including administrators, without knowing a password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/60405e54-e869-4623-892c-0821014f887b?source=cve - https://themeforest.net/item/alloggio-hotel-booking-theme/26775539
CVE ID: CVE-2025-1639 State: PUBLISHED Published: 2025-03-04T03:38:00.282Z Last Updated: 2025-03-04T15:34:00.258Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: crowdyTheme Products: Animation Addons for Elementor Pro Problem Types: CWE-862 Description: The Animation Addons for Elementor Pro plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the install_elementor_plugin_handler() function in all versions up to, and including, 1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate arbitrary plugins which can be leveraged to furth
ckers, with Subscriber-level access and above, to install and activate arbitrary plugins which can be leveraged to further infect a victim when Elementor is not activated on a vulnerable site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fb310bdb-fc74-47b2-9371-3d10abd287fb?source=cve - https://themeforest.net/item/arolax-creative-digital-agency-theme/53547630
CVE ID: CVE-2025-1640 State: PUBLISHED Published: 2025-02-25T00:00:11.297Z Last Updated: 2025-02-25T14:21:11.433Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Benner Products: ModernaNet Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Benner ModernaNet up to 1.1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /Home/JS_CarregaCombo?formName=DADOS_PESSOAIS_PLANO&additionalCondition=&insideParameters=&elementToReturn=DADOS_PESSOAIS_PLANO&ordenarPelaDescricao=true&direcaoOrdenacao=asc&_=1739290047295. The manipulation leads to sql injection. The attack may be launched remotely. Upgrading to version 1.1.1 is ab
90047295. The manipulation leads to sql injection. The attack may be launched remotely. Upgrading to version 1.1.1 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.296690 - https://vuldb.com/?ctiid.296690 - https://vuldb.com/?submit.499115 - https://github.com/yago3008/CVES
CVE ID: CVE-2025-1641 State: PUBLISHED Published: 2025-02-25T00:00:13.300Z Last Updated: 2025-02-25T14:16:48.411Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Benner Products: ModernaNet Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Benner ModernaNet up to 1.1.0. It has been classified as critical. This affects an unknown part of the file /AGE0000700/GetHorariosDoDia?idespec=0&idproced=1103&data=2025-02-25+19%3A25&agserv=0&convenio=1&localatend=1&idplano=5&pesfis=01&idprofissional=0&target=.horarios--dia--d0&_=1739371223797. The manipulation leads to sql injection. It is possible to initiate the attack remotely. Upgrading to version 1.1.1 is able to
ipulation leads to sql injection. It is possible to initiate the attack remotely. Upgrading to version 1.1.1 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.296691 - https://vuldb.com/?ctiid.296691 - https://vuldb.com/?submit.499875 - https://github.com/yago3008/cves
CVE ID: CVE-2025-1642 State: PUBLISHED Published: 2025-02-25T00:31:04.569Z Last Updated: 2025-02-25T14:38:09.789Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Benner Products: ModernaNet Problem Types: CWE-99 Description: A vulnerability was found in Benner ModernaNet up to 1.1.0. It has been declared as critical. This vulnerability affects unknown code of the file /AGE0000700/GetImageMedico?fooId=1. The manipulation of the argument fooId leads to improper control of resource identifiers. The attack can be initiated remotely. Upgrading to version 1.1.1 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst N
o version 1.1.1 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.296692 - https://vuldb.com/?ctiid.296692 - https://vuldb.com/?submit.499877 - https://github.com/yago3008/cves
CVE ID: CVE-2025-1643 State: PUBLISHED Published: 2025-02-25T00:31:05.724Z Last Updated: 2025-02-25T14:38:03.431Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: Benner Products: ModernaNet Problem Types: CWE-352, CWE-862 Description: A vulnerability was found in Benner ModernaNet up to 1.1.0. It has been rated as problematic. This issue affects some unknown processing of the file /DadosPessoais/SG_AlterarSenha. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.1.1 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https
is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.296693 - https://vuldb.com/?ctiid.296693 - https://vuldb.com/?submit.500574 - https://github.com/yago3008/cves
CVE ID: CVE-2025-1644 State: PUBLISHED Published: 2025-02-25T01:31:04.262Z Last Updated: 2025-02-25T14:37:56.241Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: Benner Products: ModernaNet Problem Types: CWE-352, CWE-862 Description: A vulnerability classified as problematic has been found in Benner ModernaNet up to 1.2.0. Affected is an unknown function of the file /DadosPessoais/SG_Gravar. The manipulation of the argument idItAg leads to cross-site request forgery. It is possible to launch the attack remotely. Upgrading to version 1.2.1 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.296694 - https://vuldb.com/?ctiid.296694 - https://vuldb.com/?submit.500575 - https://github.com/yago3008/cves
CVE ID: CVE-2025-1645 State: PUBLISHED Published: 2025-02-25T02:00:09.016Z Last Updated: 2025-02-25T14:37:49.897Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Benner Products: Connecta Problem Types: CWE-99 Description: A vulnerability classified as critical was found in Benner Connecta 1.0.5330. Affected by this vulnerability is an unknown functionality of the file /Usuarios/Usuario/EditarLogado/. The manipulation of the argument Handle leads to improper control of resource identifiers. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
ut this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.296695 - https://vuldb.com/?ctiid.296695 - https://vuldb.com/?submit.501406 - https://github.com/yago3008/cves
CVE ID: CVE-2025-1646 State: PUBLISHED Published: 2025-02-25T02:31:04.429Z Last Updated: 2025-02-25T13:58:20.247Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Lumsoft Products: ERP Problem Types: CWE-434, CWE-284 Description: A vulnerability, which was classified as critical, has been found in Lumsoft ERP 8. Affected by this issue is some unknown functionality of the file /Api/TinyMce/UploadAjaxAPI.ashx of the component ASPX File Handler. The manipulation of the argument file leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond i
been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.296696 - https://vuldb.com/?ctiid.296696 - https://vuldb.com/?submit.500501 - https://github.com/Rain1er/report/blob/main/Lserp/fileUpload_3.md
CVE ID: CVE-2025-1647 State: PUBLISHED Published: 2025-05-15T16:26:07.587Z Last Updated: 2025-06-01T11:02:28.106Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Bootstrap Products: Bootstrap Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Bootstrap allows Cross-Site Scripting (XSS).This issue affects Bootstrap: from 3.4.1 before 4.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.herodevs.com/vulnerability-directory/cve-2025-1647
CVE ID: CVE-2025-1648 State: PUBLISHED Published: 2025-02-25T06:58:30.828Z Last Updated: 2025-02-25T14:14:38.363Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: yawaveadmin Products: Yawave Problem Types: CWE-89 Description: The Yawave plugin for WordPress is vulnerable to SQL Injection via the 'lbid' parameter in all versions up to, and including, 2.9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Add