Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
y be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310311 - https://vuldb.com/?ctiid.310311 - https://vuldb.com/?submit.582935 - https://github.com/xiaobor123/vul-dlink-dcs5020l - https://github.com/xiaobor123/vul-dlink-dcs5020l#poc - https://www.dlink.com/
CVE ID: CVE-2025-5216 State: PUBLISHED Published: 2025-05-27T00:31:05.500Z Last Updated: 2025-05-27T13:42:28.070Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Student Record System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in PHPGurukul Student Record System 3.20. This vulnerability affects unknown code of the file /login.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310312 - https://vuldb.com/?ctiid.310
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310312 - https://vuldb.com/?ctiid.310312 - https://vuldb.com/?submit.582936 - https://github.com/y7syeu/CVE/issues/1 - https://phpgurukul.com/
CVE ID: CVE-2025-5217 State: PUBLISHED Published: 2025-05-27T00:31:06.752Z Last Updated: 2025-05-27T13:41:28.326Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: FreeFloat Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0.0. This issue affects some unknown processing of the component RMDIR Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310313 - https://vuldb.com/?ctiid.31031
onal Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310313 - https://vuldb.com/?ctiid.310313 - https://vuldb.com/?submit.582963 - https://fitoxs.com/exploit/exploit-11a137f0dc647e7b9dc59c6aa449c7d086bcd152f6167cf531d3eec5ebce5bc7.txt
CVE ID: CVE-2025-5218 State: PUBLISHED Published: 2025-05-27T01:00:09.362Z Last Updated: 2025-05-27T14:04:36.799Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: FreeFloat Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0.0. Affected is an unknown function of the component LITERAL Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310314 - https://vuldb.com/?ctiid.310314 - ht
nalyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310314 - https://vuldb.com/?ctiid.310314 - https://vuldb.com/?submit.582965 - https://fitoxs.com/exploit/exploit-f66cb45bc43c5d8d4240ce755cfd9a7be5b31de1e85f92ccf8e1c607b849bb5a.txt
CVE ID: CVE-2025-5219 State: PUBLISHED Published: 2025-05-27T01:00:10.787Z Last Updated: 2025-05-27T13:40:31.776Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: FreeFloat Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability has been found in FreeFloat FTP Server 1.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the component ASCII Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310315 - https://vuldb.com/?ctii
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310315 - https://vuldb.com/?ctiid.310315 - https://vuldb.com/?submit.582968 - https://fitoxs.com/exploit/exploit-c4b40241c6bfa9b9e13cbb33e1bd5a471e8855e7eaf2eb12a997c72cb5de7611.txt
CVE ID: CVE-2025-5220 State: PUBLISHED Published: 2025-05-27T01:31:04.369Z Last Updated: 2025-05-27T19:38:06.669Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: FreeFloat Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in FreeFloat FTP Server 1.0.0 and classified as critical. Affected by this issue is some unknown functionality of the component GET Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310316 - https://vuldb.com/?ctiid.310316 - ht
nalyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310316 - https://vuldb.com/?ctiid.310316 - https://vuldb.com/?submit.582970 - https://fitoxs.com/exploit/exploit-1c5dc6c9823d6c734b7dd46458c5196ad7a8c902542c54c7465d38de84bc3ee2.txt
CVE ID: CVE-2025-5221 State: PUBLISHED Published: 2025-05-27T02:00:07.796Z Last Updated: 2025-05-27T19:56:21.964Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: FreeFloat Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in FreeFloat FTP Server 1.0.0. It has been classified as critical. This affects an unknown part of the component QUOTE Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310317 - https://vuldb.com/?ctiid.310317 - http
lyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310317 - https://vuldb.com/?ctiid.310317 - https://vuldb.com/?submit.582971 - https://fitoxs.com/exploit/exploit-62e89ab8b510813fd7e0a3a5fbc6e6b7f7e3ec7dd7c8f6244c82cf82dc11d51c.txt
CVE ID: CVE-2025-5222 State: PUBLISHED Published: 2025-05-27T20:51:50.958Z Last Updated: 2025-11-20T21:09:57.229Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat OpenShift Container Platform 4 Problem Types: CWE-120 Description: A stack buffer overflow was found in Internationl components for unicode (ICU ). While runni
Types: CWE-120 Description: A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2025:11888 - https://access.redhat.com/errata/RHSA-2025:12083 - https://access.redhat.com/errata/RHSA-2025:12331 - https://access.redhat.com/errata/RHSA-2025:12332 - https://access.redhat.com/errata/RHSA-2025:12333 - https://access.redhat.com/security/cve/CVE-2025-5222 - https://bugzilla.r
s://access.redhat.com/errata/RHSA-2025:12333 - https://access.redhat.com/security/cve/CVE-2025-5222 - https://bugzilla.redhat.com/show_bug.cgi?id=2368600
CVE ID: CVE-2025-5223 State: REJECTED Published: N/A Last Updated: 2025-06-07T22:16:26.323Z Description: No description available.
CVE ID: CVE-2025-5224 State: PUBLISHED Published: 2025-05-27T02:00:10.152Z Last Updated: 2025-05-27T19:57:26.566Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Campcodes Products: Online Hospital Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in Campcodes Online Hospital Management System 1.0. Affected is an unknown function of the file /admin/add-doctor.php. The manipulation of the argument Doctorspecialization leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310320 - https://vuldb.com/?ctiid.310320 - https://vuldb.com/?submit.583029 - https://github.com/kkive/cve/issues/1 - https://www.campcodes.com/
CVE ID: CVE-2025-5225 State: PUBLISHED Published: 2025-05-27T02:31:05.363Z Last Updated: 2025-05-27T19:58:12.826Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Campcodes Products: Advanced Online Voting System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in Campcodes Advanced Online Voting System 1.0. This affects an unknown part of the file /index.php. The manipulation of the argument voter leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310323 - h
ublic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310323 - https://vuldb.com/?ctiid.310323 - https://vuldb.com/?submit.583397 - https://github.com/bleakTS/myCVE/issues/16 - https://www.campcodes.com/
CVE ID: CVE-2025-5226 State: PUBLISHED Published: 2025-05-27T02:31:08.292Z Last Updated: 2025-05-27T13:37:33.454Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Small CRM Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in PHPGurukul Small CRM 3.0 and classified as critical. This vulnerability affects unknown code of the file /admin/change-password.php. The manipulation of the argument oldpass leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vu
Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310324 - https://vuldb.com/?ctiid.310324 - https://vuldb.com/?submit.583408 - https://github.com/bleakTS/myCVE/issues/17 - https://phpgurukul.com/
CVE ID: CVE-2025-5227 State: PUBLISHED Published: 2025-05-27T03:00:09.751Z Last Updated: 2025-05-27T13:36:11.669Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Small CRM Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Small CRM 3.0 and classified as critical. This issue affects some unknown processing of the file /admin/manage-tickets.php. The manipulation of the argument aremark leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb
her parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310325 - https://vuldb.com/?ctiid.310325 - https://vuldb.com/?submit.583423 - https://github.com/bleakTS/myCVE/issues/18 - https://phpgurukul.com/
CVE ID: CVE-2025-5228 State: PUBLISHED Published: 2025-05-27T03:00:11.847Z Last Updated: 2025-05-27T13:33:20.348Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DI-8100 Problem Types: CWE-121, CWE-119 Description: A vulnerability was found in D-Link DI-8100 up to 20250523. It has been classified as critical. Affected is the function httpd_get_parm of the file /login.cgi of the component jhttpd. The manipulation of the argument notify leads to stack-based buffer overflow. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Re
ork. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310326 - https://vuldb.com/?ctiid.310326 - https://vuldb.com/?submit.583430 - https://github.com/xubeining/Cve_report/blob/main/The%20D-Link%20DI-8100%20contains%20a%20binary%20vulnerability.md - https://www.dlink.com/
CVE ID: CVE-2025-5229 State: PUBLISHED Published: 2025-05-27T03:31:04.508Z Last Updated: 2025-05-27T19:58:56.568Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Campcodes Products: Online Hospital Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Campcodes Online Hospital Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/view-patient.php. The manipulation of the argument viewid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - h
oit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310328 - https://vuldb.com/?ctiid.310328 - https://vuldb.com/?submit.583490 - https://github.com/sarryi/cve/issues/1 - https://www.campcodes.com/
CVE ID: CVE-2025-5230 State: PUBLISHED Published: 2025-05-27T04:00:13.773Z Last Updated: 2025-05-27T20:00:15.469Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Online Nurse Hiring System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in PHPGurukul Online Nurse Hiring System 1.0. This affects an unknown part of the file /admin/bwdates-report-details.php. The manipulation of the argument fromdate/todate leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vu
een disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310329 - https://vuldb.com/?ctiid.310329 - https://vuldb.com/?submit.584042 - https://github.com/webzzaa/CVE-/issues/1 - https://phpgurukul.com/
CVE ID: CVE-2025-5231 State: PUBLISHED Published: 2025-05-27T04:31:06.177Z Last Updated: 2025-05-27T20:01:40.463Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Company Visitor Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in PHPGurukul Company Visitor Management System 1.0. This vulnerability affects unknown code of the file /forgot-password.php. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.3
to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310330 - https://vuldb.com/?ctiid.310330 - https://vuldb.com/?submit.584438 - https://github.com/zzb1388/zzb1/issues/2 - https://phpgurukul.com/
CVE ID: CVE-2025-5232 State: PUBLISHED Published: 2025-05-27T05:00:13.133Z Last Updated: 2025-05-27T14:15:33.610Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: PHPGurukul Products: Student Study Center Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in PHPGurukul Student Study Center Management System 1.0. This issue affects some unknown processing of the file /admin/report.php. The manipulation of the argument fromdate/todate leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment:
otely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310331 - https://vuldb.com/?ctiid.310331 - https://vuldb.com/?submit.584508 - https://github.com/6BXK6/cve/issues/11 - https://phpgurukul.com/
CVE ID: CVE-2025-5233 State: PUBLISHED Published: 2025-06-13T01:47:49.330Z Last Updated: 2025-06-13T14:02:46.495Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: thatdevgirl Products: Color Palette Problem Types: CWE-79 Description: The Color Palette plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘hex’ parameter in all versions up to, and including, 4.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes:
t arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bd352c95-6e76-478f-943b-938a96b372f4?source=cve - https://plugins.trac.wordpress.org/browser/color-palette/trunk/source/blocks/color/register.php#L62 - https://wordpress.org/plugins/color-palette/#developers
CVE ID: CVE-2025-5234 State: PUBLISHED Published: 2025-06-19T09:23:48.419Z Last Updated: 2025-06-20T13:11:28.042Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: jegstudio Products: Gutenverse News – Advanced News Magazine Blog Gutenberg Blocks Addons Problem Types: CWE-79 Description: The Gutenverse News plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘elementId’ parameter in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute wheneve
d attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e8b1f60a-3a13-4679-af3e-d6f95fd83cea?source=cve - https://plugins.trac.wordpress.org/browser/gutenverse-news/tags/1.0.4/include/class/block/class-grab.php#L71 - https://wordpress.org/plugins/gutenverse-news/#developers - https://plugins.trac.wordpress.org/changeset/3313123/gutenverse-news/trunk/include/class/block/class-grab.php - https://plugins.trac.wordpress.org/changeset/3313123/
CVE ID: CVE-2025-5235 State: PUBLISHED Published: 2025-05-30T09:22:07.408Z Last Updated: 2025-05-30T12:51:12.386Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: opensheetmusicdisplay Products: OpenSheetMusicDisplay Problem Types: CWE-79 Description: The OpenSheetMusicDisplay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected
level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a45417ce-d5dd-4706-adbb-d44670de6eb7?source=cve - https://plugins.trac.wordpress.org/browser/opensheetmusicdisplay/trunk/opensheetmusicdisplay.php#L473 - https://wordpress.org/plugins/opensheetmusicdisplay/#developers - https://plugins.trac.wordpress.org/changeset/3301757/ - https://plugins.trac.wordpress.org/changeset/3301757/#file48 - https://github.com/opensheetmusicdisplay/opensheetmusicdisplay/blob/develop/CHANGELOG.md
CVE ID: CVE-2025-5236 State: PUBLISHED Published: 2025-05-30T07:23:41.129Z Last Updated: 2025-05-30T13:55:53.939Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ninjateam Products: NinjaTeam Chat for Telegram Problem Types: CWE-79 Description: The NinjaTeam Chat for Telegram plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘username’ parameter in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected pag
el access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/725feb15-aa9b-4c00-bb95-ee0616000a14?source=cve - https://plugins.trac.wordpress.org/browser/ninjateam-telegram/trunk/blocks/src/init.php#L130 - https://wordpress.org/plugins/ninjateam-telegram/#developers - https://plugins.trac.wordpress.org/changeset/3302588/
CVE ID: CVE-2025-5237 State: PUBLISHED Published: 2025-06-18T09:21:31.553Z Last Updated: 2025-06-18T13:39:38.657Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: sovica Products: Target Video Easy Publish Problem Types: CWE-79 Description: The Target Video Easy Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to, and including, 3.8.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Addit
s and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b10333f8-fd90-43a7-8404-71954ee29e47?source=cve - https://plugins.trac.wordpress.org/browser/brid-video-easy-publish/trunk/lib/BridShortcode.php#L221 - https://wordpress.org/plugins/brid-video-easy-publish/#developers - https://plugins.trac.wordpress.org/changeset/3309639/
CVE ID: CVE-2025-5238 State: PUBLISHED Published: 2025-06-14T09:23:34.023Z Last Updated: 2025-06-17T18:38:22.243Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: yithemes Products: YITH WooCommerce Wishlist Problem Types: CWE-79 Description: The YITH WooCommerce Wishlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additi
and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6d4b0434-61ca-47b1-9119-7208283f916f?source=cve - https://plugins.svn.wordpress.org/yith-woocommerce-wishlist/tags/4.5.0/assets/js/unminified/jquery.yith-wcwl.js - https://docs.yithemes.com/yith-woocommerce-wishlist/changelog/changelog-free-version/ - https://wordpress.org/plugins/yith-woocommerce-wishlist/#description - https://plugins.trac.wordpress.org/changeset/3310555/