Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-27779 State: PUBLISHED Published: 2025-03-19T20:42:11.182Z Last Updated: 2025-03-20T19:12:44.185Z Vendors: IAHispano Products: Applio Problem Types: CWE-502 Description: Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to unsafe deserialization in `model_blender.py` lines 20 and 21. `model_fusion_a` and `model_fusion_b` from voice_blender.py take user-supplied input (e.g. a path to a model) and pass that value to the `run_model_blender_script` and later to `model_blender` function, which loads these two models with `torch.load` in `model_blender.py (on lines 20-21 in 3.2.8-bugfix), which is vulnerable to unsafe deserialization. The issue can
ad` in `model_blender.py (on lines 20-21 in 3.2.8-bugfix), which is vulnerable to unsafe deserialization. The issue can lead to remote code execution. A patch is available on the `main` branch of the Applio repository. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2024-341_GHSL-2024-353_Applio/ - https://github.com/IAHispano/Applio/commit/11d139508d615a6db4d48b76634a443c66170dda - https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/rvc/train/process/model_blender.py#L20-L21 - https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/voice_blender/voice_blender.py#L39-L
ps://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/voice_blender/voice_blender.py#L39-L56
CVE ID: CVE-2025-27780 State: PUBLISHED Published: 2025-03-19T20:16:31.324Z Last Updated: 2025-03-20T19:24:28.444Z Vendors: IAHispano Products: Applio Problem Types: CWE-502 Description: Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to unsafe deserialization in model_information.py. `model_name` in model_information.py takes user-supplied input (e.g. a path to a model) and pass that value to the `run_model_information_script` and later to `model_information` function, which loads that model with `torch.load` in rvc/train/process/model_information.py (on line 16 in 3.2.8-bugfix), which is vulnerable to unsafe deserialization. The issue can lead to remote co
ormation.py (on line 16 in 3.2.8-bugfix), which is vulnerable to unsafe deserialization. The issue can lead to remote code execution. A patch is available in the `main` branch of the repository. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2024-341_GHSL-2024-353_Applio/ - https://github.com/IAHispano/Applio/commit/11d139508d615a6db4d48b76634a443c66170dda - https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/rvc/train/process/model_information.py#L16 - https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/extra/model_information.py#L11-L16
CVE ID: CVE-2025-27781 State: PUBLISHED Published: 2025-03-19T20:22:38.448Z Last Updated: 2025-03-19T20:48:03.243Z Vendors: IAHispano Products: Applio Problem Types: CWE-502 Description: Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to unsafe deserialization in inference.py. `model_file` in inference.py as well as `model_file` in tts.py take user-supplied input (e.g. a path to a model) and pass that value to the `change_choices` and later to `get_speakers_id` function, which loads that model with `torch.load` in inference.py (line 326 in 3.2.8-bugfix), which is vulnerable to unsafe deserialization. The issue can lead to remote code execution. A patch is av
3.2.8-bugfix), which is vulnerable to unsafe deserialization. The issue can lead to remote code execution. A patch is available on the `main` branch of the repository. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2024-341_GHSL-2024-353_Applio/ - https://github.com/IAHispano/Applio/commit/eb21d9dd349a6ae1a28c440b30d306eafba65097 - https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/inference/inference.py#L325 - https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/inference/inference.py#L338-L345 - https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51
9ccffcc632dfb2973/tabs/inference/inference.py#L338-L345 - https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/tts/tts.py#L50-L57
CVE ID: CVE-2025-27782 State: PUBLISHED Published: 2025-03-19T20:41:51.084Z Last Updated: 2025-03-20T19:13:36.391Z Vendors: IAHispano Products: Applio Problem Types: CWE-22 Description: Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file write in inference.py. This issue may lead to writing arbitrary files on the Applio server. It can also be used in conjunction with an unsafe deserialization to achieve remote code execution. As of time of publication, no known patches are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2024-341_GHSL-2024-353_Applio/ - https://github.com
chment: References: - https://securitylab.github.com/advisories/GHSL-2024-341_GHSL-2024-353_Applio/ - https://github.com/IAHispano/Applio/blob/d7d685fefd0c58e29e1d84d668613056791544a7/tabs/inference/inference.py#L1632-L1645 - https://github.com/IAHispano/Applio/blob/d7d685fefd0c58e29e1d84d668613056791544a7/tabs/inference/inference.py#L295 - https://github.com/IAHispano/Applio/blob/d7d685fefd0c58e29e1d84d668613056791544a7/tabs/inference/inference.py#L989-L1002 - https://github.com/IAHispano/Applio/blob/d7d685fefd0c58e29e1d84d668613056791544a7/tabs/tts/tts.py#L309-L322
CVE ID: CVE-2025-27783 State: PUBLISHED Published: 2025-03-19T20:41:41.214Z Last Updated: 2025-03-20T19:14:06.314Z Vendors: IAHispano Products: Applio Problem Types: CWE-22 Description: Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file write in train.py. This issue may lead to writing arbitrary files on the Applio server. It can also be used in conjunction with an unsafe deserialization to achieve remote code execution. As of time of publication, no known patches are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2024-341_GHSL-2024-353_Applio/ - https://github.com/IAH
nt: References: - https://securitylab.github.com/advisories/GHSL-2024-341_GHSL-2024-353_Applio/ - https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/train/train.py#L212-L225 - https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/train/train.py#L484-L491 - https://github.com/IAHispano/Applio/blob/d7d685fefd0c58e29e1d84d668613056791544a7/tabs/inference/inference.py#L295
CVE ID: CVE-2025-27784 State: PUBLISHED Published: 2025-03-19T20:41:32.140Z Last Updated: 2025-03-20T19:14:46.029Z Vendors: IAHispano Products: Applio Problem Types: CWE-200 Description: Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file read in train.py's `export_pth` function. This issue may lead to reading arbitrary files on the Applio server. It can also be used in conjunction with blind server-side request forgery to read files from servers on the internal network that the Applio server has access to. As of time of publication, no known patches are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securit
cation, no known patches are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2024-341_GHSL-2024-353_Applio/ - https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/train/train.py#L267 - https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/train/train.py#L801
CVE ID: CVE-2025-27785 State: PUBLISHED Published: 2025-03-19T20:35:10.662Z Last Updated: 2025-03-19T20:47:30.839Z Vendors: IAHispano Products: Applio Problem Types: CWE-200, CWE-22 Description: Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file read in train.py's `export_index` function. This issue may lead to reading arbitrary files on the Applio server. It can also be used in conjunction with blind server-side request forgery to read files from servers on the internal network that the Applio server has access to. As of time of publication, no known patches are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https
e of publication, no known patches are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2024-341_GHSL-2024-353_Applio/ - https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/train/train.py#L273 - https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/train/train.py#L816
CVE ID: CVE-2025-27786 State: PUBLISHED Published: 2025-03-19T20:37:35.307Z Last Updated: 2025-03-20T19:15:29.694Z Vendors: IAHispano Products: Applio Problem Types: CWE-22 Description: Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file removal in core.py. `output_tts_path` in tts.py takes arbitrary user input and passes it to `run_tts_script` function in core.py, which checks if the path in `output_tts_path` exists, and if yes, removes that path, which leads to arbitrary file removal. As of time of publication, no known patches are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advis
hes are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2024-341_GHSL-2024-353_Applio/ - https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/core.py#L329 - https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/tts/tts.py#L133
CVE ID: CVE-2025-27787 State: PUBLISHED Published: 2025-03-19T20:41:09.755Z Last Updated: 2025-03-20T20:41:28.191Z Vendors: IAHispano Products: Applio Problem Types: CWE-74, CWE-22 Description: Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to denial of service (DoS) in restart.py. `model_name` in train.py takes user input, and passes it to the `stop_train` function in restart.py, which uses it construct a path to a folder with `config.json`. That `config.json` is opened and the list of values under "process_pids" are read. Next all the process IDs listed in the JSON are killed. Using one of the arbitrary file writes, one can write to `logs/foobar` a `confi
ocess IDs listed in the JSON are killed. Using one of the arbitrary file writes, one can write to `logs/foobar` a `config.json` file, which contains a list of process IDs. Then one can access this endpoint to kill these processes. Since an attacker can't know what process is running on which process ID, they can send a list of hundreds of process IDs, which can kill the process that applio is using to run, as well as other, potentially important processes, which leads to DoS. Note that constructing a path with user input also enables path traversal. For example, by supplying "../../" in `model_name` one can access `config.json` freom locations two folders down on the server. As of time of pu
g "../../" in `model_name` one can access `config.json` freom locations two folders down on the server. As of time of publication, no known patches are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2024-354_Applio/ - https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/settings/sections/restart.py#L9 - https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/train/train.py#L306
CVE ID: CVE-2025-27788 State: PUBLISHED Published: 2025-03-12T13:51:53.348Z Last Updated: 2025-03-12T14:04:35.186Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ruby Products: json Problem Types: CWE-125 Description: JSON is a JSON implementation for Ruby. Starting in version 2.10.0 and prior to version 2.10.2, a specially crafted document could cause an out of bound read, most likely resulting in a crash. Versions prior to 2.10.0 are not vulnerable. Version 2.10.2 fixes the problem. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ruby/json/security/advisories/GHSA-9m3q-rhmv-5q44 - https
tes: - CISA ADP Vulnrichment: References: - https://github.com/ruby/json/security/advisories/GHSA-9m3q-rhmv-5q44 - https://github.com/ruby/json/commit/c56db31f800d5d508389793e69682f99749dbadf - https://github.com/ruby/json/releases/tag/v2.10.2
CVE ID: CVE-2025-27789 State: PUBLISHED Published: 2025-03-11T19:09:28.146Z Last Updated: 2025-03-11T19:53:42.811Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: babel Products: babel Problem Types: CWE-1333 Description: Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel will generate a polyfill for the `.replace` method that has quadratic complexity on some specific replacement pattern strings (i.e. the second argument passed to `.replace`). Generated code is vulnerable if all the following conditions are true: Using Babel t
ond argument passed to `.replace`). Generated code is vulnerable if all the following conditions are true: Using Babel to compile regular expression named capturing groups, using the `.replace` method on a regular expression that contains named capturing groups, and the code using untrusted strings as the second argument of `.replace`. This problem has been fixed in `@babel/helpers` and `@babel/runtime` 7.26.10 and 8.0.0-alpha.17. It's likely that individual users do not directly depend on `@babel/helpers`, and instead depend on `@babel/core` (which itself depends on `@babel/helpers`). Upgrading to `@babel/core` 7.26.10 is not required, but it guarantees use of a new enough `@babel/helpers`
l/helpers`). Upgrading to `@babel/core` 7.26.10 is not required, but it guarantees use of a new enough `@babel/helpers` version. Note that just updating Babel dependencies is not enough; one will also need to re-compile the code. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/babel/babel/security/advisories/GHSA-968p-4wvh-cqc8 - https://github.com/babel/babel/pull/17173
CVE ID: CVE-2025-27791 State: PUBLISHED Published: 2025-04-15T19:09:18.774Z Last Updated: 2025-04-15T20:27:04.827Z Vendors: CollaboraOnline Products: online Problem Types: CWE-23 Description: Collabora Online is a collaborative online office suite based on LibreOffice technology. In versions prior to 24.04.12.4, 23.05.19, and 22.05.25, there is a path traversal flaw in handling the CheckFileInfo BaseFileName field returned from WOPI servers. This allows for a file to be written anywhere the uid running Collabora Online can write, if such a response was supplied by a malicious WOPI server. By combining this flaw with a Time of Check, Time of Use DNS lookup issue with a WOPI server address und
us WOPI server. By combining this flaw with a Time of Check, Time of Use DNS lookup issue with a WOPI server address under attacker control, it is possible to present such a response to be processed by a Collabora Online instance. This issue has been patched in versions 24.04.13.1, 23.05.19, and 22.05.25. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/CollaboraOnline/online/security/advisories/GHSA-9j32-gg3j-8w25
CVE ID: CVE-2025-27792 State: PUBLISHED Published: 2025-03-11T21:49:51.188Z Last Updated: 2025-03-12T13:52:10.401Z Vendors: obiba Products: opal Problem Types: CWE-352 Description: Opal is OBiBa’s core database application for biobanks or epidemiological studies. Prior to version 5.1.1, the protections against cross-site request forgery (CSRF) were insufficient application-wide. The referrer header is checked, and if it is invalid, the server returns 403. However, the referrer header can be dropped from CSRF requests using `<meta name="referrer" content="never">`, effectively bypassing this protection. Version 5.1.1 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnric
ly bypassing this protection. Version 5.1.1 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/obiba/opal/security/advisories/GHSA-27vw-29rq-c358
CVE ID: CVE-2025-27793 State: PUBLISHED Published: 2025-03-27T14:07:52.264Z Last Updated: 2025-03-27T15:17:18.354Z Vendors: vega Products: vega Problem Types: CWE-87, CWE-79 Description: Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In Vega prior to version 5.32.0, corresponding to vega-functions prior to version 5.17.0, users running Vega/Vega-lite JSON definitions could run unexpected JavaScript code when drawing graphs, unless the library was used with the `vega-interpreter`. Vega version 5.32.0 and vega-functions version 5.17.0 fix the issue. As a workaround, use `vega` with expression interpreter. Additional An
and vega-functions version 5.17.0 fix the issue. As a workaround, use `vega` with expression interpreter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vega/vega/security/advisories/GHSA-963h-3v39-3pqf - https://github.com/vega/vega/commit/694560c0aa576df8b6c5f0f7d202ac82233e6966 - https://github.com/vega/vega/releases/tag/v5.32.0 - https://vega.github.io/vega/usage/interpreter
CVE ID: CVE-2025-27794 State: PUBLISHED Published: 2025-03-12T14:00:21.862Z Last Updated: 2025-03-12T15:29:21.831Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: flarum Products: framework Problem Types: CWE-74 Description: Flarum is open-source forum software. A session hijacking vulnerability exists in versions prior to 1.8.10 when an attacker-controlled authoritative subdomain under a parent domain (e.g., `subdomain.host.com`) sets cookies scoped to the parent domain (`.host.com`). This allows session token replacement for applications hosted on sibling subdomains (e.g., `community.host.com`) if session tokens aren't rotated post-authentication. Key Cons
hosted on sibling subdomains (e.g., `community.host.com`) if session tokens aren't rotated post-authentication. Key Constraints are that the attacker must control any subdomain under the parent domain (e.g., `evil.host.com` or `x.y.host.com`), and the parent domain must not be on the Public Suffix List. Due to non-existent session token rotation after authenticating we can theoretically reproduce the vulnerability by using browser dev tools, but due to the browser's security measures this does not seem to be exploitable as described. Version 1.8.10 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/flarum/framework/security/adv
issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/flarum/framework/security/advisories/GHSA-hg9j-64wp-m9px - https://github.com/flarum/framework/commit/a05aaea3ee1e0a8b870935183193cd6052f1d402 - https://github.com/flarum/framework/releases/tag/v1.8.10
CVE ID: CVE-2025-27795 State: PUBLISHED Published: 2025-03-07T00:00:00.000Z Last Updated: 2025-03-07T19:37:31.065Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L) Vendors: GraphicsMagick Products: GraphicsMagick Problem Types: CWE-770 Description: ReadJXLImage in JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://www.graphicsmagick.org/NEWS.html - https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/9bbae7314e3c3b19b830591010ed90bb136b9c42 - https://issues.oss-fuzz.com/issues/42536330#comment6 - https://github.com/libjxl/libjxl/issues/3793#issuecomment-23348432
ttps://issues.oss-fuzz.com/issues/42536330#comment6 - https://github.com/libjxl/libjxl/issues/3793#issuecomment-2334843280 - https://github.com/libjxl/libjxl/issues/3792#issuecomment-2330978387
CVE ID: CVE-2025-27796 State: PUBLISHED Published: 2025-03-07T00:00:00.000Z Last Updated: 2025-03-07T21:32:29.800Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L) Vendors: GraphicsMagick Products: GraphicsMagick Problem Types: CWE-908 Description: ReadWPGImage in WPG in GraphicsMagick before 1.3.46 mishandles palette buffer allocation, resulting in out-of-bounds access to heap memory in ReadBlob. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/883ebf8cae6dfa5873d975fe3476b1a188ef3f9f - http://www.graphicsmagick.org/NEWS.html - https://sourceforge.net/p/graphicsmagick/bugs/750/
CVE ID: CVE-2025-27797 State: PUBLISHED Published: 2025-04-09T09:03:29.067Z Last Updated: 2025-04-09T14:57:13.725Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Inaba Denki Sangyo Co., Ltd. Products: AC-WPS-11ac, AC-WPS-11ac-P, AC-WPSM-11ac, AC-WPSM-11ac-P, AC-PD-WPS-11ac, AC-PD-WPS-11ac-P Problem Types: CWE-78 Description: OS command injection vulnerability in the specific service exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, an arbitrary OS command may be executed by a remote attacker who can log in to the product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.inaba.co.jp/abaniact/news/security_20250404.pdf
ional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.inaba.co.jp/abaniact/news/security_20250404.pdf - https://jvn.jp/en/vu/JVNVU93925742/
CVE ID: CVE-2025-27800 State: PUBLISHED Published: 2025-07-28T08:33:24.304Z Last Updated: 2025-11-03T19:46:24.615Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Optimizely Products: Episerver Content Management System (CMS) Problem Types: CWE-79 Description: The Episerver Content Management System (CMS) by Optimizely was affected by multiple Stored Cross-Site Scripting (XSS) vulnerabilities. This allowed an authenticated attacker to execute malicious JavaScript code in the victim's browser. The Admin dashboard offered the functionality to add gadgets to the dashboard. This included the "Notes" gadget. An authenticated attacker with the corresponding access
add gadgets to the dashboard. This included the "Notes" gadget. An authenticated attacker with the corresponding access rights (such as "WebAdmin") that was impersonating the victim could insert malicious JavaScript code in these notes that would be executed if the victim visited the dashboard. Affected products: Version 11.X: EPiServer.CMS.Core (<11.21.4) with EPiServer.CMS.UI (<11.37.5), Version 12.X: EPiServer.CMS.Core (<12.22.1) with EPiServer.CMS.UI (<11.37.3) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://api.nuget.optimizely.com/packages/episerver.cms.core/11.21.4# - https://api.nuget.optimizely.com/packages/episerver.cms.core/12.22.
ptimizely.com/packages/episerver.cms.core/11.21.4# - https://api.nuget.optimizely.com/packages/episerver.cms.core/12.22.1# - https://r.sec-consult.com/optimizely
CVE ID: CVE-2025-27801 State: PUBLISHED Published: 2025-07-28T08:40:15.815Z Last Updated: 2025-11-03T19:46:25.984Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Optimizely Products: Episerver Content Management System (CMS) Problem Types: CWE-79 Description: The Episerver Content Management System (CMS) by Optimizely was affected by multiple Stored Cross-Site Scripting (XSS) vulnerabilities. This allowed an authenticated attacker to execute malicious JavaScript code in the victim's browser. ContentReference properties, which could be used in the "Edit" section of the CMS, offered an upload functionality for documents. These documents could later be used as