Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-4171 State: PUBLISHED Published: 2025-05-07T07:21:40.292Z Last Updated: 2025-05-07T14:01:03.102Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ajay Products: WZ Followed Posts – Display what visitors are reading Problem Types: CWE-79 Description: The WZ Followed Posts – Display what visitors are reading plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wfp' shortcode in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrar
ributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2b27a7b1-6fee-433f-8102-4a3745a8dfed?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3287192%40where-did-they-go-from-here&new=3287192%40where-did-they-go-from-here&sfp_email=&sfph_mail=
CVE ID: CVE-2025-4172 State: PUBLISHED Published: 2025-05-03T01:43:04.847Z Last Updated: 2025-05-05T14:58:37.498Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: katzwebdesign Products: VerticalResponse Newsletter Widget Problem Types: CWE-79 Description: The VerticalResponse Newsletter Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'verticalresponse' shortcode in all versions up to, and including, 1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in p
s it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0565cdf1-55fe-4676-8529-8c79be5e8b01?source=cve - https://wordpress.org/plugins/vertical-response-newsletter-widget/
CVE ID: CVE-2025-4173 State: PUBLISHED Published: 2025-05-01T17:00:07.175Z Last Updated: 2025-05-02T18:03:38.347Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Eyewear Shop Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in SourceCodester Online Eyewear Shop 1.0. Affected by this vulnerability is the function delete_cart of the file /oews/classes/Master.php?f=delete_cart. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vu
een disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306793 - https://vuldb.com/?ctiid.306793 - https://vuldb.com/?submit.561737 - https://github.com/huashuocc/cve/blob/main/sql.md - https://www.sourcecodester.com/
CVE ID: CVE-2025-4174 State: PUBLISHED Published: 2025-05-01T19:00:06.456Z Last Updated: 2025-05-02T12:46:07.899Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: COVID19 Testing Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in PHPGurukul COVID19 Testing Management System 1.0. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument Username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - h
oit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306794 - https://vuldb.com/?ctiid.306794 - https://vuldb.com/?submit.561746 - https://github.com/FLYFISH567/CVE/issues/1 - https://phpgurukul.com/
CVE ID: CVE-2025-4175 State: PUBLISHED Published: 2025-05-01T20:31:04.139Z Last Updated: 2025-05-10T05:19:41.378Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: AlanBinu007 Products: Spring-Boot-Advanced-Projects Problem Types: CWE-22 Description: A vulnerability, which was classified as critical, was found in AlanBinu007 Spring-Boot-Advanced-Projects up to 3.1.3. This affects the function uploadUserProfileImage of the file /Spring-Boot-Advanced-Projects-main/Project-4.SpringBoot-AWS-S3/backend/src/main/java/com/urunov/profile/UserProfileController.java of the component Upload Profile API Endpoint. The manipulation of the argument File leads to path traversal. It is possible to
component Upload Profile API Endpoint. The manipulation of the argument File leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306795 - https://vuldb.com/?ctiid.306795 - https://vuldb.com/?submit.561760 - https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250418-01.md
CVE ID: CVE-2025-4176 State: PUBLISHED Published: 2025-05-01T21:31:05.159Z Last Updated: 2025-05-02T17:29:13.481Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Blood Bank & Donor Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in PHPGurukul Blood Bank & Donor Management System 2.4 and classified as critical. This vulnerability affects unknown code of the file /admin/request-received-bydonar.php. The manipulation of the argument searchdata leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Re
ely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306796 - https://vuldb.com/?ctiid.306796 - https://vuldb.com/?submit.561764 - https://github.com/bluechips-zhao/myCVE/issues/5 - https://phpgurukul.com/
CVE ID: CVE-2025-4177 State: PUBLISHED Published: 2025-05-02T01:43:36.565Z Last Updated: 2025-05-02T17:27:11.361Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: v1rustyle Products: Flynax Bridge Problem Types: CWE-862 Description: The Flynax Bridge plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the deleteUser() function in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to delete arbitrary users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dcb33d02-d384-4dff-91e1-c49e86b97d6e?sour
hment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dcb33d02-d384-4dff-91e1-c49e86b97d6e?source=cve - https://plugins.trac.wordpress.org/browser/flynax-bridge/trunk/src/API.php#L386
CVE ID: CVE-2025-4178 State: PUBLISHED Published: 2025-05-01T22:00:06.975Z Last Updated: 2025-05-02T17:25:28.741Z Severity: N/A (CVSS 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P) Vendors: xiaowei1118 Products: java_server Problem Types: CWE-22 Description: A vulnerability was found in xiaowei1118 java_server up to 11a5bac8f4ba1c17e4bc1b27cad6d24868500e3a on Windows and classified as critical. This issue affects some unknown processing of the file /src/main/java/com/changyu/foryou/controller/FoodController.java of the component File Upload API. The manipulation leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product takes th
he attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306797 - https://vuldb.com/?ctiid.306797 - https://vuldb.com/?submit.561794 - https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250418-02.md
CVE ID: CVE-2025-4179 State: PUBLISHED Published: 2025-05-02T01:43:35.815Z Last Updated: 2025-05-02T17:37:18.152Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: v1rustyle Products: Flynax Bridge Problem Types: CWE-862 Description: The Flynax Bridge plugin for WordPress is vulnerable to limited Privilege Escalation due to a missing capability check on the registerUser() function in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to register new user accounts as authors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a2447cf4-0261-4ef2-98ec
- CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a2447cf4-0261-4ef2-98ec-98fa02dc8b87?source=cve - https://plugins.trac.wordpress.org/browser/flynax-bridge/trunk/src/API.php#L288
CVE ID: CVE-2025-4180 State: PUBLISHED Published: 2025-05-01T22:00:08.446Z Last Updated: 2025-05-02T17:24:10.680Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PCMan Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in PCMan FTP Server 2.0.7. It has been classified as critical. Affected is an unknown function of the component TRACE Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306798 - https://vuldb.com/?ctiid.306798 - https://vul
tes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306798 - https://vuldb.com/?ctiid.306798 - https://vuldb.com/?submit.561035 - https://fitoxs.com/exploit/exploit-25d55ad283aa400af464c76d713c07ad.txt
CVE ID: CVE-2025-4181 State: PUBLISHED Published: 2025-05-01T22:31:03.813Z Last Updated: 2025-05-02T17:21:34.429Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PCMan Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in PCMan FTP Server 2.0.7. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component SEND Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306799 - https://vuldb.com/?ctiid.30679
onal Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306799 - https://vuldb.com/?ctiid.306799 - https://vuldb.com/?submit.561139 - https://fitoxs.com/exploit/exploit-202cb962ac59075b964b07152d234b70.txt
CVE ID: CVE-2025-4182 State: PUBLISHED Published: 2025-05-01T23:00:05.923Z Last Updated: 2025-05-02T14:05:33.687Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PCMan Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in PCMan FTP Server 2.0.7. It has been rated as critical. Affected by this issue is some unknown functionality of the component BELL Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306800 - https://vuldb.com/?ctiid.306800 - https
yst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306800 - https://vuldb.com/?ctiid.306800 - https://vuldb.com/?submit.561141 - https://fitoxs.com/exploit/exploit-e99a18c428cb38d5f260853678922e03.txt
CVE ID: CVE-2025-4183 State: PUBLISHED Published: 2025-05-01T23:00:07.509Z Last Updated: 2025-05-02T14:37:50.794Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PCMan Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7. This affects an unknown part of the component RECV Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306801 - https://vuldb.com/?ctiid.306801 - https://vuldb.com/?su
A ADP Vulnrichment: References: - https://vuldb.com/?id.306801 - https://vuldb.com/?ctiid.306801 - https://vuldb.com/?submit.561144 - https://fitoxs.com/exploit/exploit-d8578edf8458ce06fbc5bb76a58c5ca4.txt
CVE ID: CVE-2025-4184 State: PUBLISHED Published: 2025-05-01T23:31:03.128Z Last Updated: 2025-05-02T14:33:11.361Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PCMan Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability classified as critical was found in PCMan FTP Server 2.0.7. This vulnerability affects unknown code of the component QUOTE Command Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306802 - https://vuldb.com/?ctiid.306802 - https://vuldb.com/?submi
DP Vulnrichment: References: - https://vuldb.com/?id.306802 - https://vuldb.com/?ctiid.306802 - https://vuldb.com/?submit.561145 - https://fitoxs.com/exploit/exploit-81dc9bdb52d04dc20036dbd8313ed055.txt
CVE ID: CVE-2025-4185 State: PUBLISHED Published: 2025-05-01T23:31:06.704Z Last Updated: 2025-05-02T13:42:30.377Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Wangshen Products: SecGate 3600 Problem Types: CWE-22 Description: A vulnerability, which was classified as critical, has been found in Wangshen SecGate 3600 2024. This issue affects some unknown processing of the file ?g=obj_area_export_save. The manipulation of the argument file_name leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306803 - https://vuldb.com
used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306803 - https://vuldb.com/?ctiid.306803 - https://vuldb.com/?submit.561803 - https://flowus.cn/share/6bd8ca39-bad2-4567-b0e1-9407991ad943?code=G8A6P3
CVE ID: CVE-2025-4186 State: PUBLISHED Published: 2025-05-02T00:00:08.627Z Last Updated: 2025-05-02T12:44:32.542Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Wangshen Products: SecGate 3600 Problem Types: CWE-22 Description: A vulnerability, which was classified as critical, was found in Wangshen SecGate 3600 2024. Affected is an unknown function of the file /?g=route_ispinfo_export_save. The manipulation of the argument file_name leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306804 - https://vuldb.com/?
sed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306804 - https://vuldb.com/?ctiid.306804 - https://vuldb.com/?submit.561814 - https://flowus.cn/share/0f982f99-ecd5-4e35-88f0-c27093743385?code=G8A6P3
CVE ID: CVE-2025-4187 State: PUBLISHED Published: 2025-06-14T08:23:23.478Z Last Updated: 2025-06-17T18:39:32.980Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: n/a Products: UserPro - Community and User Profile WordPress Plugin Problem Types: CWE-22 Description: The UserPro - Community and User Profile WordPress Plugin plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 5.1.10 via the userpro_fbconnect() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: Re
rary files on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2745a40c-b011-4fe5-b2f7-d97ee6972568?source=cve - https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681
CVE ID: CVE-2025-4188 State: PUBLISHED Published: 2025-05-03T01:43:05.768Z Last Updated: 2025-05-05T14:58:18.443Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: balasahebbhise Products: Advanced Reorder Image Text Slider Problem Types: CWE-352 Description: The Advanced Reorder Image Text Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the 'reorder-simple-image-text-slider-setting' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a s
henticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7eb8a509-9acd-457c-8cb9-725f615148ce?source=cve - https://plugins.trac.wordpress.org/browser/abundatrade-plugin/tags/1.8.02/abundatrade_pugin.php - https://wordpress.org/plugins/advanced-reorder-image-text-slider/
CVE ID: CVE-2025-4189 State: PUBLISHED Published: 2025-05-17T03:24:49.951Z Last Updated: 2025-05-19T15:39:36.478Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: naicuoctavian Products: Audio Comments Plugin Problem Types: CWE-352 Description: The Audio Comments Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to missing or incorrect nonce validation on the 'audio-comments/audior-settings.php' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performi
settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/89b12c36-e115-4f67-86e6-647dfc9fd25b?source=cve - https://plugins.trac.wordpress.org/browser/audio-comments/trunk/audior-settings.php
CVE ID: CVE-2025-4190 State: PUBLISHED Published: 2025-05-17T06:00:03.776Z Last Updated: 2025-05-19T15:24:11.947Z Vendors: Unknown Products: CSV Mass Importer Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The CSV Mass Importer WordPress plugin through 1.2 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e525ece5-6e03-4aee-bf5b-6ae0b961f027/
CVE ID: CVE-2025-4191 State: PUBLISHED Published: 2025-05-02T00:00:11.860Z Last Updated: 2025-06-06T07:08:22.481Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Employee Record Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in PHPGurukul Employee Record Management System 1.3 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /editmyeducation.php. The manipulation of the argument coursepg/yophsc leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affecte
an be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306805 - https://vuldb.com/?ctiid.306805 - https://vuldb.com/?submit.561816 - https://vuldb.com/?submit.591204 - https://github.com/ideal-valli/myCVE/issues/3 - https://phpgurukul.com/
CVE ID: CVE-2025-4192 State: PUBLISHED Published: 2025-05-02T00:31:05.242Z Last Updated: 2025-05-02T12:41:31.099Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: itsourcecode Products: Restaurant Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in itsourcecode Restaurant Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/category_save.php. The manipulation of the argument Category leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vu
een disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306807 - https://vuldb.com/?ctiid.306807 - https://vuldb.com/?submit.561838 - https://github.com/ARPANET-cybersecurity/vuldb/issues/4 - https://itsourcecode.com/
CVE ID: CVE-2025-4193 State: PUBLISHED Published: 2025-05-02T01:00:06.456Z Last Updated: 2025-05-02T12:07:56.669Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: itsourcecode Products: Restaurant Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in itsourcecode Restaurant Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/category_update.php. The manipulation of the argument Category leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306806 - https://vuldb.com/?ctiid.306806 - https://vuldb.com/?submit.561849 - https://github.com/ARPANET-cybersecurity/vuldb/issues/5 - https://itsourcecode.com/
CVE ID: CVE-2025-4194 State: PUBLISHED Published: 2025-05-17T03:24:50.522Z Last Updated: 2025-05-19T15:39:09.725Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: alti5 Products: AlT Monitoring Problem Types: CWE-352 Description: The AlT Monitoring plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing or incorrect nonce validation on the 'ALT_Monitoring_edit' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a li
ipts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b7290317-418d-4e5c-85fa-f931cc4a865b?source=cve - https://wordpress.org/plugins/alt-monitoring/