Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-8064 State: PUBLISHED Published: 2025-08-21T09:26:02.544Z Last Updated: 2025-08-21T13:50:33.314Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: aicwebtech Products: Bible SuperSearch Problem Types: CWE-79 Description: The Bible SuperSearch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘selector_height’ parameter in all versions up to, and including, 6.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additio
and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1ada39db-b316-4270-ac9c-3770b473d6a8?source=cve - https://plugins.trac.wordpress.org/browser/biblesupersearch/trunk/wp/class.shortcodes.php#L270 - https://wordpress.org/plugins/biblesupersearch/#developers - https://plugins.trac.wordpress.org/changeset/3345278/ - https://github.com/aicwebtech/Bible-SuperSearch-WordPress-Plugin/commit/535e1a48a6d6135020209adfd9881a0c1878b741#diff-e60090bad955f035bce7cebd3a9a1e9555f5692fa74c17a24a31cfc1557d04d6
CVE ID: CVE-2025-8066 State: PUBLISHED Published: 2025-08-15T16:10:41.570Z Last Updated: 2025-08-25T22:45:43.890Z Vendors: Bunkerity Products: Bunker Web Problem Types: CWE-601 Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Bunkerity Bunker Web on Linux allows Phishing.This issue affects Bunker Web: 1.6.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/cypress - https://github.com/bunkerity/bunkerweb - https://github.com/bunkerity/bunkerweb/releases/tag/v1.6.4
CVE ID: CVE-2025-8067 State: PUBLISHED Published: 2025-08-28T14:47:08.578Z Last Updated: 2025-11-06T21:11:05.872Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services
e Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Enterprise Linux 6 Problem Types: CWE-125 Description: A flaw was found in the Udisks daemon, where it allows unprivileged users to create loop devices using the D-BUS system. This is achieved via the loop device ha
here it allows unprivileged users to create loop devices using the D-BUS system. This is achieved via the loop device handler, which handles requests sent through the D-BUS interface. As two of the parameters of this handle, it receives the file descriptor list and index specifying the file where the loop device should be backed. The function itself validates the index value to ensure it isn't bigger than the maximum value allowed. However, it fails to validate the lower bound, allowing the index parameter to be a negative value. Under these circumstances, an attacker can cause the UDisks daemon to crash or perform a local privilege escalation by gaining access to files owned by privileged u
ause the UDisks daemon to crash or perform a local privilege escalation by gaining access to files owned by privileged users. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2025:15017 - https://access.redhat.com/errata/RHSA-2025:15018 - https://access.redhat.com/errata/RHSA-2025:15020 - https://access.redhat.com/errata/RHSA-2025:15956 - https://access.redhat.com/errata/RHSA-2025:16021 - https://access.redhat.com/errata/RHSA-2025:16090 - https://access.redhat.com/errata/RHSA-2025:16106 - https://access.redhat.com/errata/RHSA-2025:16121 - https://access.redhat.com/errata/RHSA-2025:16122 - https://access.redhat.com
/access.redhat.com/errata/RHSA-2025:16121 - https://access.redhat.com/errata/RHSA-2025:16122 - https://access.redhat.com/errata/RHSA-2025:16125 - https://access.redhat.com/errata/RHSA-2025:16130 - https://access.redhat.com/security/cve/CVE-2025-8067 - https://bugzilla.redhat.com/show_bug.cgi?id=2388623
CVE ID: CVE-2025-8068 State: PUBLISHED Published: 2025-07-31T11:19:13.164Z Last Updated: 2025-07-31T13:41:25.600Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: devitemsllc Products: HT Mega – Absolute Addons For Elementor Problem Types: CWE-863 Description: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to unauthorized modification and loss of data due to an improper capability check on the 'ajax_trash_templates' function in all versions up to, and including, 2.9.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary attachment files, and move arbitrary posts, page
attackers, with Contributor-level access and above, to delete arbitrary attachment files, and move arbitrary posts, pages, and templates to the Trash. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d9cf6dae-572f-4eaa-8e8a-bca9e74fe738?source=cve - https://plugins.trac.wordpress.org/browser/ht-mega-for-elementor/tags/2.9.0/admin/include/class.theme-builder.php#L625 - https://plugins.trac.wordpress.org/changeset/3336533/
CVE ID: CVE-2025-8069 State: PUBLISHED Published: 2025-07-23T15:41:40.310Z Last Updated: 2025-10-14T17:56:39.471Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: AWS Products: Client VPN Problem Types: CWE-276 Description: During the AWS Client VPN client installation on Windows devices, the install process references the C:\usr\local\windows-x86_64-openssl-localbuild\ssl directory location to fetch the OpenSSL configuration file. As a result, a non-admin user could place arbitrary code in the configuration file. If an admin user starts the AWS Client VPN client installation process, that code could be executed with root-level privileges. This issue does not a
WS Client VPN client installation process, that code could be executed with root-level privileges. This issue does not affect Linux or Mac devices. We recommend users discontinue any new installations of AWS Client VPN on Windows prior to version 5.2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://aws.amazon.com/security/security-bulletins/AWS-2025-014/ - https://docs.aws.amazon.com/vpn/latest/clientvpn-user/client-vpn-connect-windows-release-notes.html
CVE ID: CVE-2025-8070 State: PUBLISHED Published: 2025-07-23T07:26:03.531Z Last Updated: 2025-07-23T14:10:47.430Z Vendors: ASUSTOR Products: ABP and AES Problem Types: CWE-428 Description: The Windows service configuration of ABP and AES contains an unquoted ImagePath registry value vulnerability. This allows a local attacker to execute arbitrary code by placing a malicious executable in a predictable location such as C:\Program.exe. If the service runs with elevated privileges, exploitation results in privilege escalation to SYSTEM level. This vulnerability arises from an unquoted service path affecting systems where the executable resides in a path containing spaces. Affected products and
unquoted service path affecting systems where the executable resides in a path containing spaces. Affected products and versions include: ABP 2.0.7.6130 and earlier as well as AES 1.0.6.6133 and earlier. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.asustor.com/security/security_advisory_detail?id=47
CVE ID: CVE-2025-8071 State: PUBLISHED Published: 2025-07-24T09:22:17.365Z Last Updated: 2025-07-24T13:36:07.444Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: 995525477-1 Products: Video and Audio Player for WordPress – Mine CloudVod LMS Problem Types: CWE-79 Description: Mine CloudVod plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘audio’ parameter in all versions up to, and including, 2.1.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an
ntributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5f3cd194-3fb8-4dd9-905e-051d5de68b66?source=cve - https://wordpress.org/plugins/mine-cloudvod/#developers - https://plugins.trac.wordpress.org/browser/mine-cloudvod/tags/2.1.10/build/audioplayer/render.php#L66
CVE ID: CVE-2025-8073 State: PUBLISHED Published: 2025-08-28T06:42:34.857Z Last Updated: 2025-08-28T14:48:29.272Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: plugincy Products: Dynamic AJAX Product Filters for WooCommerce Problem Types: CWE-79 Description: The Dynamic AJAX Product Filters for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 1.3.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever
attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/23554f8a-9df4-483f-a929-4c5d76644cc2?source=cve - https://plugins.trac.wordpress.org/browser/dynamic-ajax-product-filters-for-woocommerce/tags/1.2.3/includes/filter-template.php#L1032 - https://wordpress.org/plugins/dynamic-ajax-product-filters-for-woocommerce/#developers - https://plugins.trac.wordpress.org/changeset/3350071/
CVE ID: CVE-2025-8076 State: PUBLISHED Published: 2025-11-18T07:16:57.968Z Last Updated: 2025-11-19T04:55:25.868Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: SMCI Products: MBD-X13SEDW-F Problem Types: CWE-121 Description: There is a vulnerability in the Supermicro BMC web function at Supermicro MBD-X13SEDW-F. After logging into the BMC Web server, an attacker can use a specially crafted payload to trigger the Stack buffer overflow vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.supermicro.com/zh_tw/support/security_BMC_IPMI_Nov_2025
CVE ID: CVE-2025-8077 State: PUBLISHED Published: 2025-09-17T12:33:37.904Z Last Updated: 2025-09-18T03:55:12.546Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SUSE Products: neuvector Problem Types: CWE-1393 Description: A vulnerability exists in NeuVector versions up to and including 5.4.5, where a fixed string is used as the default password for the built-in `admin` account. If this password is not changed immediately after deployment, any workload with network access within the cluster could use the default credentials to obtain an authentication token. This token can then be used to perform any operation via NeuVector APIs. Additional Analyst Notes:
authentication token. This token can then be used to perform any operation via NeuVector APIs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-8077 - https://github.com/neuvector/neuvector/security/advisories/GHSA-8pxw-9c75-6w56
CVE ID: CVE-2025-8078 State: PUBLISHED Published: 2025-10-21T01:49:29.266Z Last Updated: 2025-10-22T03:55:11.600Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Zyxel Products: ATP series firmware, USG FLEX series firmware, USG FLEX 50(W) series firmware, USG20(W)-VPN series firmware Problem Types: CWE-78 Description: A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from V4.50 through V5.40, USG FLEX 50(W) series firmware versions from V4.16 through V5.40, and USG20(W)-VPN series firmware versions from V4.16 through V5.40 could allow an authenticated attacke
6 through V5.40, and USG20(W)-VPN series firmware versions from V4.16 through V5.40 could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on the affected device by passing a crafted string as an argument to a CLI command. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-and-missing-authorization-vulnerabilities-in-zld-firewalls-10-21-2025
CVE ID: CVE-2025-8079 State: PUBLISHED Published: 2025-09-22T08:45:19.523Z Last Updated: 2025-09-22T13:35:37.336Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Akıllı Ticaret Software Technologies Ltd. Co. Products: Smart Trade E-Commerce Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akıllı Ticaret Software Technologies Ltd. Co. Smart Trade E-Commerce allows Reflected XSS.This issue affects Smart Trade E-Commerce: before 4.5.0.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0283
CVE ID: CVE-2025-8080 State: PUBLISHED Published: 2025-08-15T08:25:39.831Z Last Updated: 2025-08-15T16:14:19.665Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: alobaidi Products: Alobaidi Captcha Problem Types: CWE-79 Description: The Alobaidi Captcha plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affect
, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/44f6048b-7de6-4ec9-af89-cd08c43d0aaa?source=cve - https://plugins.trac.wordpress.org/browser/alobaidi-captcha/trunk/login-form.php#L26 - https://plugins.trac.wordpress.org/browser/alobaidi-captcha/trunk/login-form.php#L41 - https://plugins.trac.wordpress.org/browser/alobaidi-captcha/trunk/login-form.php#L63
CVE ID: CVE-2025-8081 State: PUBLISHED Published: 2025-08-12T05:27:09.305Z Last Updated: 2025-08-12T13:58:18.633Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: elemntor Products: Elementor Website Builder – More Than Just a Page Builder Problem Types: CWE-22 Description: The Elementor plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.30.2 via the Import_Images::import() function due to insufficient controls on the filename specified. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive
dministrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/13929b51-b32e-401c-a642-49f7cd2d07bf?source=cve - https://plugins.trac.wordpress.org/browser/elementor/tags/3.30.2/includes/template-library/classes/class-import-images.php#L111 - https://github.com/elementor/elementor/commit/6af3551ee4213fb4003338743e22f41aa2a09c01 - https://plugins.trac.wordpress.org/changeset/3332233/elementor/trunk/includes/template-library/classes/class-import-images.php
CVE ID: CVE-2025-8084 State: PUBLISHED Published: 2025-11-18T12:29:48.352Z Last Updated: 2025-11-18T20:30:32.391Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: tigroumeow Products: AI Engine Problem Types: CWE-918 Description: The AI Engine plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.8 via the rest_helpers_create_images function. This makes it possible for authenticated attackers, with Editor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. On Cloud instances, this is
the web application and can be used to query and modify information from internal services. On Cloud instances, this issue allows for metadata retrieving. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3b497bc0-bf47-43c7-9d5f-8e130dd0bab2?source=cve - https://plugins.trac.wordpress.org/browser/ai-engine/tags/2.9.5/classes/rest.php#L742 - https://plugins.trac.wordpress.org/browser/ai-engine/tags/2.9.5/classes/services/image.php#L89
CVE ID: CVE-2025-8085 State: PUBLISHED Published: 2025-09-08T06:00:04.914Z Last Updated: 2025-09-08T18:17:25.816Z Vendors: Unknown Products: Ditty Problem Types: CWE-918 Server-Side Request Forgery (SSRF) Description: The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f42c37bb-1ae0-49ab-bd81-7864dff0fcff/
CVE ID: CVE-2025-8086 State: REJECTED Published: N/A Last Updated: 2025-08-06T22:20:41.339Z Description: No description available.
CVE ID: CVE-2025-8088 State: PUBLISHED Published: 2025-08-08T11:11:41.842Z Last Updated: 2025-10-21T22:45:21.069Z Vendors: win.rar GmbH Products: WinRAR Problem Types: CWE-35 Description: A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=283&cHash=a64b4a8f662d3639dec8d65f47bc93c5
CVE ID: CVE-2025-8089 State: PUBLISHED Published: 2025-08-16T06:39:22.690Z Last Updated: 2025-08-18T13:33:31.171Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: mdempfle Products: Advanced iFrame Problem Types: CWE-79 Description: The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'additional' parameter in version less than, or equal to, 2025.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst N
inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/97985b75-6ac9-4aba-8f76-5633418e7907?source=cve - https://plugins.trac.wordpress.org/browser/advanced-iframe/trunk/advanced-iframe.php#L1831 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3344404%40advanced-iframe&new=3344404%40advanced-iframe&sfp_email=&sfph_mail=
CVE ID: CVE-2025-8091 State: PUBLISHED Published: 2025-08-15T08:25:39.468Z Last Updated: 2025-08-15T11:49:43.811Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: ashanjay Products: EventON – Events Calendar Problem Types: CWE-200 Description: The EventON Lite plugin for WordPress is vulnerable to Information Exposure in all versions less than, or equal to, 2.4.6 via the add_single_eventon and add_eventon shortcodes due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to. Additional Analyst Notes: -
t data from password protected, private, or draft posts that they should not have access to. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/421fcee2-a05d-4486-837e-ddee3d73d737?source=cve - https://wordpress.org/plugins/eventon-lite/ - https://plugins.trac.wordpress.org/browser/eventon-lite/trunk/includes/class-evo-shortcodes.php#L81 - https://plugins.trac.wordpress.org/browser/eventon-lite/trunk/includes/class-evo-shortcodes.php#L32 - https://plugins.trac.wordpress.org/browser/eventon-lite/trunk/includes/calendar/class-calendar_generator.php#L954 - https://plugins.trac.wordpress.org/browser/eventon-lite/trunk/includ
cludes/calendar/class-calendar_generator.php#L954 - https://plugins.trac.wordpress.org/browser/eventon-lite/trunk/includes/class-event.php#L39
CVE ID: CVE-2025-8092 State: PUBLISHED Published: 2025-08-15T16:26:27.480Z Last Updated: 2025-08-15T18:13:13.999Z Vendors: Drupal Products: COOKiES Consent Management Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting (XSS).This issue affects COOKiES Consent Management: from 0.0.0 before 1.2.16. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-092
CVE ID: CVE-2025-8093 State: PUBLISHED Published: 2025-10-10T22:23:57.718Z Last Updated: 2025-10-15T13:44:54.979Z Vendors: Drupal Products: Authenticator Login Problem Types: CWE-288 Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login allows Authentication Bypass.This issue affects Authenticator Login: from 0.0.0 before 2.1.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-098
CVE ID: CVE-2025-8097 State: PUBLISHED Published: 2025-07-26T06:43:22.481Z Last Updated: 2025-07-28T15:51:51.746Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: xTemos Products: Woodmart Problem Types: CWE-20 Description: The WoodMart theme for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 8.2.6. This is due to insufficient validation of the qty parameter in the woodmart_update_cart_item function. This makes it possible for unauthenticated attackers to manipulate cart quantities using fractional values, allowing them to obtain products for free by setting extremely small quantities (e.g., 0.00001) that round cart