Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323206 - https://vuldb.com/?ctiid.323206 - https://vuldb.com/?submit.636789 - https://github.com/Aur0r3-zy/cve/blob/main/CVE.md
CVE ID: CVE-2025-10172 State: PUBLISHED Published: 2025-09-09T23:02:06.954Z Last Updated: 2025-09-10T13:07:03.557Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: UTT Products: 750W Problem Types: CWE-120, CWE-119 Description: A flaw has been found in UTT 750W up to 3.2.2-191225. This issue affects some unknown processing of the file /goform/formPictureUrl. Executing manipulation of the argument importpictureurl can lead to buffer overflow. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
ted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323207 - https://vuldb.com/?ctiid.323207 - https://vuldb.com/?submit.639030 - https://github.com/cymiao1978/cve/blob/main/1.md
CVE ID: CVE-2025-10173 State: PUBLISHED Published: 2025-09-26T03:25:33.813Z Last Updated: 2025-09-26T19:31:31.061Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) Vendors: roxnor Products: ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution Problem Types: CWE-862 Description: The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to unauthorized access due to an incorrect capability check on the post_save() function in all versions up to, and including, 4.8.3. This makes it possible for authenticated attackers, with Editor-level access and above, to update the plugin's settings
This makes it possible for authenticated attackers, with Editor-level access and above, to update the plugin's settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2d8b816f-815a-4109-b34b-06e806c765e8?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3365569%40shopengine&new=3365569%40shopengine&sfp_email=&sfph_mail=
CVE ID: CVE-2025-10175 State: PUBLISHED Published: 2025-10-11T09:28:40.878Z Last Updated: 2025-10-14T18:45:09.872Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: rico-macchi Products: WP Links Page Problem Types: CWE-89 Description: The WP Links Page plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 4.9.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used t
ith Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cb753b29-ca8c-4044-97ff-3b7e57d5de61?source=cve - https://plugins.svn.wordpress.org/wp-links-page/trunk/wp-links-page-free.php - https://wordpress.org/plugins/wp-links-page/
CVE ID: CVE-2025-10176 State: PUBLISHED Published: 2025-09-12T21:25:25.732Z Last Updated: 2025-09-15T15:11:05.349Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: tvcnet Products: The Hack Repair Guy's Plugin Archiver Problem Types: CWE-22 Description: The The Hack Repair Guy's Plugin Archiver plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the prepare_items function in all versions up to, and including, 2.0.4. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the rig
l access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d449a285-34f5-41ed-acfd-2a9acfb04271?source=cve - https://plugins.trac.wordpress.org/browser/hackrepair-plugin-archiver/tags/2.0.4/includes/list.php#L39
CVE ID: CVE-2025-10178 State: PUBLISHED Published: 2025-09-26T01:47:26.676Z Last Updated: 2025-09-26T19:22:59.183Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: creativemindssolutions Products: CM Business Directory – Optimise and showcase local business Problem Types: CWE-79 Description: The CM Business Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cmbd_featured_image' shortcode in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to injec
pplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2c1ecd71-57ed-44ba-a007-3b96b98d3bf7?source=cve - https://plugins.trac.wordpress.org/browser/cm-business-directory/trunk/frontend/cm-business-directory-business-page-sc.php#L289 - https://wordpress.org/plugins/cm-business-directory/ - https://plugins.trac.wordpress.org/browser/cm-business-directory/trunk/frontend/cm-business-directory-business-page-sc.php?rev=3
plugins.trac.wordpress.org/browser/cm-business-directory/trunk/frontend/cm-business-directory-business-page-sc.php?rev=3364840#L280 - https://plugins.trac.wordpress.org/browser/cm-business-directory/tags/1.5.2/frontend/cm-business-directory-business-page-sc.php#L289
CVE ID: CVE-2025-10179 State: PUBLISHED Published: 2025-09-30T03:35:24.745Z Last Updated: 2025-09-30T13:24:52.116Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: myaskai Products: My AskAI Problem Types: CWE-79 Description: The My AskAI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'myaskai' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page
l access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2eaebf25-905c-4a57-96d4-5c3ebbd77b98?source=cve - https://plugins.trac.wordpress.org/browser/my-askai/trunk/myaskai.php#L40
CVE ID: CVE-2025-10180 State: PUBLISHED Published: 2025-09-26T06:43:29.077Z Last Updated: 2025-09-26T19:52:01.102Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: jhoppe Products: Markdown Shortcode Problem Types: CWE-79 Description: The Markdown Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'markdown' shortcode in all versions up to, and including, 0.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user acces
ith contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4e9563b8-7e1b-4e87-8b56-17b75adb66c3?source=cve - https://plugins.trac.wordpress.org/browser/markdown-shortcode/trunk/markdown-shortcode.php#L40 - https://github.com/JohannesHoppe/markdown-shortcode/releases/tag/v0.2.3 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3365425%40markdown-shortcode&new=3365425%40markdown-shortcode&sfp_email=&sfph_mail=
CVE ID: CVE-2025-10181 State: PUBLISHED Published: 2025-09-20T04:27:54.770Z Last Updated: 2025-09-22T15:11:51.386Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: dartiss Products: Draft List Problem Types: CWE-79 Description: The Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'drafts' shortcode in all versions up to, and including, 2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected pag
el access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/12a750c6-85b6-48fc-b006-adf0121610dc?source=cve - https://github.com/dartiss/draft-list/blob/master/inc/create-lists.php - https://wordpress.org/plugins/simple-draft-list/ - https://plugins.trac.wordpress.org/browser/simple-draft-list/tags/2.6/inc/create-lists.php#L339 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3363488%40simple-draft-list&new=3363488%40simple-draft-list&sfp_email=&sfph_mail=
CVE ID: CVE-2025-10182 State: PUBLISHED Published: 2025-09-30T03:35:30.092Z Last Updated: 2025-09-30T15:31:35.693Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: john-ackers Products: dbview Problem Types: CWE-79 Description: The dbview plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dbview' shortcode in all versions up to, and including, 0.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/acf69e07-884c-4eaf-8b58-c1fd3810e086?source=cve - https://plugins.trac.wordpress.org/browser/dbview/trunk/DBView.class.php#L459
CVE ID: CVE-2025-10183 State: PUBLISHED Published: 2025-09-09T14:50:22.152Z Last Updated: 2025-09-09T15:14:59.774Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) Vendors: TecCom Products: TecConnect Problem Types: CWE-611 Description: A blind XML External Entity (XXE) injection in the OpenMessaging webservice in TecCom TecConnect 4.1 allows an unauthenticated attacker to exfiltrate arbitrary files to an attacker-controlled server. TecConnect 4.1 is considered end-of-life as of December 2023. Users are advised to upgrade to TecCom Connect 5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://blog.blacklanternsecurity.com/p/teccom-tecconnect-41
ional Analyst Notes: - CISA ADP Vulnrichment: References: - https://blog.blacklanternsecurity.com/p/teccom-tecconnect-41-xml-external
CVE ID: CVE-2025-10184 State: PUBLISHED Published: 2025-09-23T13:02:47.366Z Last Updated: 2025-09-23T13:26:55.804Z Vendors: OnePlus Products: OxygenOS Problem Types: CWE-862, CWE-89 Description: The vulnerability allows any application installed on the device to read SMS/MMS data and metadata from the system-provided Telephony provider without permission, user interaction, or consent. The user is also not notified that SMS data is being accessed. This could lead to sensitive information disclosure and could effectively break the security provided by SMS-based Multi-Factor Authentication (MFA) checks. The root cause is a combination of missing permissions for write operations in several conte
uthentication (MFA) checks. The root cause is a combination of missing permissions for write operations in several content providers (com.android.providers.telephony.PushMessageProvider, com.android.providers.telephony.PushShopProvider, com.android.providers.telephony.ServiceNumberProvider), and a blind SQL injection in the update method of those providers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rapid7.com/blog/post/cve-2025-10184-oneplus-oxygenos-telephony-provider-permission-bypass-not-fixed/ - https://assets.contentstack.io/v3/assets/blte4f029e766e6b253/bltd4b7439a28b6c866/68d168a6930d015d43a6b588/CVE-2025-10184_PoC.zip
CVE ID: CVE-2025-10185 State: PUBLISHED Published: 2025-10-11T07:25:58.079Z Last Updated: 2025-10-14T14:11:54.230Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: webaways Products: NEX-Forms – Ultimate Forms Plugin for WordPress Problem Types: CWE-89 Description: The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in the action nf_load_form_entries in all versions up to, and including, 9.1.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrat
f sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This may be exploitable by lower-level users if access is granted by a site administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e68d47e7-9a42-4a77-aefa-fe130500cbd3?source=cve - https://plugins.svn.wordpress.org/nex-forms-express-wp-form-builder/tags/9.1.4/includes/classes/class.db.php#2527 - https://plugins.trac.wordpress.org/change
-forms-express-wp-form-builder/tags/9.1.4/includes/classes/class.db.php#2527 - https://plugins.trac.wordpress.org/changeset/3365585/nex-forms-express-wp-form-builder/trunk/includes/classes/class.db.php
CVE ID: CVE-2025-10186 State: PUBLISHED Published: 2025-10-15T08:25:53.665Z Last Updated: 2025-10-15T19:44:08.368Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: jjlemstra Products: WhyDonate – FREE Donate button – Crowdfunding – Fundraising Problem Types: CWE-862 Description: The WhyDonate – FREE Donate button – Crowdfunding – Fundraising plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the remove_row function in all versions up to, and including, 4.0.14. This makes it possible for unauthenticated attackers to delete rows from the wp_wdplugin_style table. Additional Analyst Notes: - CISA ADP Vulnrichment:
henticated attackers to delete rows from the wp_wdplugin_style table. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3c6f30bb-dec0-4776-b255-bb88c9d003c2?source=cve - https://wordpress.org/plugins/wp-whydonate/
CVE ID: CVE-2025-10187 State: PUBLISHED Published: 2025-10-18T06:42:45.183Z Last Updated: 2025-10-20T18:55:31.797Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: creative-solutions-1 Products: GSpeech TTS – WordPress Text To Speech Plugin Problem Types: CWE-89 Description: The GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulnerable to SQL Injection via the 'field' parameter in all versions up to, and including, 3.17.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above,
the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/484dded3-dbe7-4a11-877a-a19504d30206?source=cve - https://plugins.trac.wordpress.org/browser/gspeech/trunk/includes/gspeech_backend.php#L109 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3376552%40gspeech&new=3376552%40gspeech&sfp_email=&sfph_mail=
CVE ID: CVE-2025-10188 State: PUBLISHED Published: 2025-09-17T04:01:14.880Z Last Updated: 2025-09-17T12:45:45.413Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: tvcnet Products: The Hack Repair Guy's Plugin Archiver Problem Types: CWE-352 Description: The The Hack Repair Guy's Plugin Archiver plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.4. This is due to missing or incorrect nonce validation on the bulk_remove() function. This makes it possible for unauthenticated attackers to arbitrary directory deletion in /wp-content via a forged request granted they can trick a site administrator into perfor
arbitrary directory deletion in /wp-content via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/51810981-5d2b-471b-b602-35809e281a0b?source=cve - https://plugins.trac.wordpress.org/browser/hackrepair-plugin-archiver/tags/3.1.1/includes/bulk.php
CVE ID: CVE-2025-10189 State: PUBLISHED Published: 2025-09-30T03:35:31.851Z Last Updated: 2025-09-30T15:36:06.187Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: mrwulf Products: BP Direct Menus Problem Types: CWE-79 Description: The BP Direct Menus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bpdm_login' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses
contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c97c0191-1ef4-4a37-a93d-bceb2be298b4?source=cve - https://plugins.trac.wordpress.org/browser/bp-direct-menus/trunk/inc/frontend-noajax.inc.php#L175
CVE ID: CVE-2025-10190 State: PUBLISHED Published: 2025-10-11T09:28:38.343Z Last Updated: 2025-10-14T18:45:43.723Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: husainahmedqureshi Products: WP Easy Toggles Problem Types: CWE-79 Description: The WP Easy Toggles plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'toggles' shortcode in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user
rs, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5a9db562-6810-4da1-9e5f-6f6eadca76ac?source=cve - https://plugins.trac.wordpress.org/browser/wp-easy-toggles/trunk/wp-easy-toggles.php#L31 - https://wordpress.org/plugins/wp-easy-toggles
CVE ID: CVE-2025-10191 State: PUBLISHED Published: 2025-09-30T03:35:28.922Z Last Updated: 2025-09-30T15:29:32.467Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: fusedsoftware Products: Big Post Shipping for WooCommerce Problem Types: CWE-79 Description: The Big Post Shipping for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wooboigpost_shipping_status' shortcode in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web
s. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9cad27cd-b4cc-4f34-8588-130e1ba997f9?source=cve - https://plugins.trac.wordpress.org/browser/woo-bigpost-shipping/trunk/includes/class-woobigpost-shortcodes.php#L36 - https://wordpress.org/plugins/woo-bigpost-shipping
CVE ID: CVE-2025-10192 State: PUBLISHED Published: 2025-10-03T11:17:13.137Z Last Updated: 2025-10-03T18:11:14.235Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: muhammad-rehman Products: WP Photo Effects Problem Types: CWE-79 Description: The WP Photo Effects plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wppe_effect' shortcode in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a us
ckers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/634e5c33-cd24-46ab-aac0-161eeb28aaff?source=cve - https://plugins.trac.wordpress.org/browser/wp-photo-effects/trunk/photo-effect.php#L132 - https://wordpress.org/plugins/wp-photo-effects
CVE ID: CVE-2025-10193 State: PUBLISHED Published: 2025-09-11T14:05:30.592Z Last Updated: 2025-09-12T03:56:13.888Z Vendors: neo4j Products: neo4j-cypher MCP server Problem Types: CWE-346 Description: DNS rebinding vulnerability in Neo4j Cypher MCP server allows malicious websites to bypass Same-Origin Policy protections and execute unauthorised tool invocations against locally running Neo4j MCP instances. The attack relies on the user being enticed to visit a malicious website and spend sufficient time there for DNS rebinding to succeed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://neo4j.com/security/cve-2025-10193 - https://github.com/neo4j-contrib/mcp-neo4j/secu
Vulnrichment: References: - https://neo4j.com/security/cve-2025-10193 - https://github.com/neo4j-contrib/mcp-neo4j/security/advisories/GHSA-vcqx-v2mg-7chx - https://github.com/neo4j-contrib/mcp-neo4j/releases/tag/mcp-neo4j-cypher-v0.4.0