Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
itiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311213 - https://vuldb.com/?ctiid.311213 - https://vuldb.com/?submit.588323 - https://github.com/K-mxredo/MXdocument/blob/K-mxredo-blob/%E9%BB%84%E9%87%91%E9%80%9Astorageworkrent-tcCustDeferPosiQuery.md
CVE ID: CVE-2025-5698 State: PUBLISHED Published: 2025-06-05T22:00:17.240Z Last Updated: 2025-06-09T14:51:33.609Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Brilliance Products: Golden Link Secondary System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in Brilliance Golden Link Secondary System up to 20250424. Affected is an unknown function of the file /sysframework/logSelect.htm. The manipulation of the argument nodename leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
loit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311214 - https://vuldb.com/?ctiid.311214 - https://vuldb.com/?submit.588324 - https://github.com/K-mxredo/MXdocument/blob/K-mxredo-blob/%E9%BB%84%E9%87%91%E9%80%9Asysframework-logSelect.htm.md
CVE ID: CVE-2025-5699 State: PUBLISHED Published: 2025-06-06T06:42:50.236Z Last Updated: 2025-06-06T16:09:27.917Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: gsaraiva Products: Developer Formatter Problem Types: CWE-79 Description: The Developer Formatter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom CSS in all versions up to, and including, 2015.0.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-s
ct arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/63192a95-778b-452b-9081-cf20dc7f7ec1?source=cve - https://plugins.trac.wordpress.org/browser/devformatter/trunk/devinterface.php - https://wordpress.org/plugins/devformatter/#developers - https://plugins.trac.wordpress.org/browser/devformatter/trunk/devfmt_css.php
CVE ID: CVE-2025-5700 State: PUBLISHED Published: 2025-06-17T11:23:35.980Z Last Updated: 2025-06-17T14:13:52.737Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: tvledesign Products: Simple Logo Carousel Problem Types: CWE-79 Description: The Simple Logo Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.9.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Ana
ve, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b25f939c-1dfe-4d4f-a27a-1f9022da6965?source=cve - https://plugins.trac.wordpress.org/browser/simple-logo-carousel/trunk/includes/Base/Shortcode.php#L40 - https://wordpress.org/plugins/simple-logo-carousel/#developers - https://github.com/idesolutions/simple-logo-carousel/commit/d995b5d35e0fdc0a59307ce664e4ce1158b69bff - https://plugins.trac.wordpress.org/changeset/3312693/
CVE ID: CVE-2025-5701 State: PUBLISHED Published: 2025-06-05T11:15:05.674Z Last Updated: 2025-06-05T14:29:15.185Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: siteheart Products: HyperComments Problem Types: CWE-862 Description: The HyperComments plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the hc_request_handler function in all versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and
ry options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/07fd6bee-5b00-4fc1-9f7a-3857fd35c763?source=cve - https://plugins.trac.wordpress.org/browser/hypercomments/trunk/hypercomments.php
CVE ID: CVE-2025-5702 State: PUBLISHED Published: 2025-06-05T18:23:57.872Z Last Updated: 2025-06-05T20:21:44.764Z Vendors: The GNU C Library Products: glibc Description: The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sourceware.org/bugzilla
r parts of the program. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=33056
CVE ID: CVE-2025-5703 State: PUBLISHED Published: 2025-06-06T06:42:50.630Z Last Updated: 2025-06-06T16:09:22.919Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: malcolm-oph Products: StageShow Problem Types: CWE-79 Description: The StageShow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘anchor’ parameter in all versions up to, and including, 10.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CI
bitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6543b8ad-e3f3-43c7-93f9-23f7df07e391?source=cve - https://plugins.trac.wordpress.org/browser/stageshow/trunk/include/stageshowlib_salesplugin.php#L424 - https://wordpress.org/plugins/stageshow/#developers
CVE ID: CVE-2025-5704 State: PUBLISHED Published: 2025-06-05T23:00:19.816Z Last Updated: 2025-06-09T14:45:02.782Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Real Estate Property Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Real Estate Property Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /Admin/User.php. The manipulation of the argument txtUserName leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichm
d remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311225 - https://vuldb.com/?ctiid.311225 - https://vuldb.com/?submit.590429 - https://github.com/kingmamalv/cve/issues/2 - https://code-projects.org/
CVE ID: CVE-2025-5705 State: PUBLISHED Published: 2025-06-05T23:31:05.096Z Last Updated: 2025-06-09T14:44:32.387Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Real Estate Property Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Real Estate Property Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /Admin/Property.php. The manipulation of the argument cmbCat leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vuln
attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311226 - https://vuldb.com/?ctiid.311226 - https://vuldb.com/?submit.590432 - https://github.com/kingmamalv/cve/issues/3 - https://code-projects.org/
CVE ID: CVE-2025-5706 State: PUBLISHED Published: 2025-06-06T00:00:19.058Z Last Updated: 2025-06-09T14:44:05.542Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Human Metapneumovirus Testing Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /new-user-testing.php. The manipulation of the argument state leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parame
jection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311227 - https://vuldb.com/?ctiid.311227 - https://vuldb.com/?submit.590461 - https://github.com/f1rstb100d/myCVE/issues/55 - https://phpgurukul.com/
CVE ID: CVE-2025-5707 State: PUBLISHED Published: 2025-06-06T00:31:07.174Z Last Updated: 2025-06-09T14:43:36.756Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Human Metapneumovirus Testing Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /registered-user-testing.php. The manipulation of the argument testtype leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other param
njection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311228 - https://vuldb.com/?ctiid.311228 - https://vuldb.com/?submit.590473 - https://github.com/f1rstb100d/myCVE/issues/56 - https://phpgurukul.com/
CVE ID: CVE-2025-5708 State: PUBLISHED Published: 2025-06-06T01:00:21.501Z Last Updated: 2025-06-09T14:43:07.765Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Real Estate Property Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in code-projects Real Estate Property Management System 1.0. This affects an unknown part of the file /Admin/NewsReport.php. The manipulation of the argument txtFrom leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichme
remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311229 - https://vuldb.com/?ctiid.311229 - https://vuldb.com/?submit.590495 - https://vuldb.com/?submit.590652 - https://github.com/YanHanQihomework/cve/issues/1 - https://code-projects.org/
CVE ID: CVE-2025-5709 State: PUBLISHED Published: 2025-06-06T01:31:06.575Z Last Updated: 2025-06-09T14:09:30.960Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Real Estate Property Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in code-projects Real Estate Property Management System 1.0. This vulnerability affects unknown code of the file /Admin/InsertCategory.php. The manipulation of the argument txtCategoryName leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vu
nitiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311230 - https://vuldb.com/?ctiid.311230 - https://vuldb.com/?submit.590501 - https://github.com/YanHanQihomework/cve/issues/2 - https://code-projects.org/
CVE ID: CVE-2025-5710 State: PUBLISHED Published: 2025-06-06T01:31:08.347Z Last Updated: 2025-06-09T13:51:58.015Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Real Estate Property Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in code-projects Real Estate Property Management System 1.0. This issue affects some unknown processing of the file /Admin/InsertState.php. The manipulation of the argument txtStateName leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes:
ttack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311231 - https://vuldb.com/?ctiid.311231 - https://vuldb.com/?submit.590505 - https://github.com/YanHanQihomework/cve/issues/3 - https://code-projects.org/
CVE ID: CVE-2025-5711 State: PUBLISHED Published: 2025-06-06T02:00:16.523Z Last Updated: 2025-06-09T13:40:18.563Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Real Estate Property Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in code-projects Real Estate Property Management System 1.0. Affected is an unknown function of the file /Admin/InsertCity.php. The manipulation of the argument cmbState leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP V
he attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311232 - https://vuldb.com/?ctiid.311232 - https://vuldb.com/?submit.590522 - https://github.com/kingmamalv/cve/issues/4 - https://code-projects.org/
CVE ID: CVE-2025-5712 State: PUBLISHED Published: 2025-06-06T02:31:07.348Z Last Updated: 2025-06-09T13:39:37.173Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Open Source Clinic Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in SourceCodester Open Source Clinic Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /appointment.php. The manipulation of the argument patient leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CIS
can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311233 - https://vuldb.com/?ctiid.311233 - https://vuldb.com/?submit.590530 - https://github.com/mysq13/CVE/issues/2 - https://www.sourcecodester.com/
CVE ID: CVE-2025-5713 State: PUBLISHED Published: 2025-06-06T02:31:09.851Z Last Updated: 2025-06-09T13:39:05.961Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C) Vendors: SoluçõesCoop Products: iSoluçõesWEB Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in SoluçõesCoop iSoluçõesWEB up to 20250519 and classified as problematic. Affected by this issue is some unknown functionality of the file /fluxos-dashboard of the component Flow Handler. The manipulation of the argument Descrição da solicitação leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade
ack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311234 - https://vuldb.com/?ctiid.311234 - https://vuldb.com/?submit.579504 - https://github.com/lfparizzi/CVE-SolucoesCoop - https://github.com/lfparizzi/CVE-SolucoesCoop#stored-xss
CVE ID: CVE-2025-5714 State: PUBLISHED Published: 2025-06-06T03:00:17.750Z Last Updated: 2025-06-09T13:38:37.319Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C) Vendors: SoluçõesCoop Products: iSoluçõesWEB Problem Types: CWE-22 Description: A vulnerability was found in SoluçõesCoop iSoluçõesWEB up to 20250516. It has been classified as problematic. This affects an unknown part of the file /sys/up.upload.php of the component Profile Information Update. The manipulation of the argument nomeArquivo leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to upg
to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311235 - https://vuldb.com/?ctiid.311235 - https://vuldb.com/?submit.579509 - https://github.com/lfparizzi/CVE-SolucoesCoop - https://github.com/lfparizzi/CVE-SolucoesCoop?tab=readme-ov-file#path-traversal-and-forced-navigation-abuse
CVE ID: CVE-2025-5715 State: PUBLISHED Published: 2025-06-06T03:00:20.411Z Last Updated: 2025-06-09T13:48:12.498Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: Signal Products: App Problem Types: CWE-304 Description: A vulnerability was found in Signal App 7.41.4 on Android. It has been declared as problematic. This vulnerability affects unknown code of the component Biometric Authentication Handler. The manipulation leads to missing critical step in authentication. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to th
e complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311236 - https://vuldb.com/?ctiid.311236 - https://vuldb.com/?submit.585069 - https://drive.google.com/file/d/1tI0bC8X8546ActlzGlmSU-AhCdD950y4/view?usp=drivesdk
CVE ID: CVE-2025-5716 State: PUBLISHED Published: 2025-06-06T03:31:06.026Z Last Updated: 2025-06-09T13:41:44.350Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Open Source Clinic Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in SourceCodester Open Source Clinic Management System 1.0. Affected is an unknown function of the file /login.php. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References
exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311238 - https://vuldb.com/?ctiid.311238 - https://vuldb.com/?submit.590566 - https://github.com/mysq13/CVE/issues/3 - https://www.sourcecodester.com/
CVE ID: CVE-2025-5717 State: PUBLISHED Published: 2025-09-23T16:05:19.923Z Last Updated: 2025-10-31T15:06:22.088Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: WSO2 Products: WSO2 API Manager, WSO2 Open Banking AM, WSO2 Traffic Manager, WSO2 API Control Plane, Siddhi Extension Evaluate Scripts Problem Types: CWE-94 Description: An authenticated remote code execution (RCE) vulnerability exists in multiple WSO2 products due to improper input validation in the event processor admin service. A user with administrative access to the SOAP admin services can exploit this flaw by deploying a Siddhi execution plan containing malicious Java code, resulting in arbitr
services can exploit this flaw by deploying a Siddhi execution plan containing malicious Java code, resulting in arbitrary code execution on the server. Exploitation of this vulnerability requires a valid user account with administrative privileges, limiting the attack surface to authenticated but potentially malicious users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4119/
CVE ID: CVE-2025-5718 State: PUBLISHED Published: 2025-11-11T06:52:33.565Z Last Updated: 2025-11-12T04:57:44.205Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Axis Communications AB Products: AXIS OS Problem Types: CWE-59 Description: The ACAP Application framework could allow privilege escalation through a symlink attack. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axis.com/dam/public/3c/a4/6a/cve-2025-5718pdf-en-
onal Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axis.com/dam/public/3c/a4/6a/cve-2025-5718pdf-en-US-504214.pdf
CVE ID: CVE-2025-5719 State: PUBLISHED Published: 2025-06-06T03:40:33.310Z Last Updated: 2025-06-09T13:37:49.781Z Vendors: vivo Products: Wallet Problem Types: CWE-306 Description: The wallet has an authentication bypass vulnerability that allows access to specific pages. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.vivo.com/en/support/security-advisory-detail?id=18
CVE ID: CVE-2025-5720 State: PUBLISHED Published: 2025-07-31T04:26:20.602Z Last Updated: 2025-07-31T18:13:27.322Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ivole Products: Customer Reviews for WooCommerce Problem Types: CWE-79 Description: The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘author’ parameter in all versions up to, and including, 5.80.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CI