Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-25152 State: PUBLISHED Published: 2023-06-22T01:49:51.293Z Last Updated: 2024-10-30T13:03:54.359Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: TYCHE, tychesoftwares Products: Abandoned Cart Pro for WooCommerce, Abandoned Cart Lite for WooCommerce Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 5.1.3 and 7.12.0 respectively, due to insufficient input sanitization and ou
arameters in versions up to, and including, 5.1.3 and 7.12.0 respectively, due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in user input that will execute on the admin dashboard. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a9cc5c6d-4396-4ebf-8788-f01dd9e9cfbc?source=cve - https://www.wordfence.com/blog/2019/03/xss-flaw-in-abandoned-cart-plugin-leads-to-wordpress-site-takeovers/ - https://plugins.trac.wordpress.org/changeset/2033212 - https://wpscan.com/vulnerability/9229
CVE ID: CVE-2019-25154 State: PUBLISHED Published: 2024-07-16T22:30:25.237Z Last Updated: 2024-11-21T15:35:19.072Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in iframe in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/40094752
CVE ID: CVE-2019-25155 State: PUBLISHED Published: 2023-10-31T00:00:00 Last Updated: 2024-09-06T18:24:28.619Z Vendors: n/a Products: n/a Problem Types: n/a Description: DOMPurify before 1.0.11 allows reverse tabnabbing in demos/hooks-target-blank-demo.html because links lack a 'rel="noopener noreferrer"' attribute. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cure53/DOMPurify/pull/337/files - https://github.com/cure53/DOMPurify/compare/1.0.10...1.0.11
CVE ID: CVE-2019-25156 State: PUBLISHED Published: 2023-11-07T05:31:03.672Z Last Updated: 2024-09-04T18:53:26.328Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: dstar2018 Products: Agency Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in dstar2018 Agency up to 61. Affected by this vulnerability is an unknown functionality of the file search.php. The manipulation of the argument QSType/QuickSearch leads to cross site scripting. The attack can be launched remotely. The patch is named 975b56953efabb434519d9feefcc53685fb8d0ab. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-244495. A
. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-244495. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.244495 - https://vuldb.com/?ctiid.244495 - https://github.com/dstar2018/agency-code-repo/commit/975b56953efabb434519d9feefcc53685fb8d0ab
CVE ID: CVE-2019-25157 State: PUBLISHED Published: 2023-12-19T02:00:06.151Z Last Updated: 2024-08-05T03:00:19.291Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Ethex Products: Contracts Problem Types: CWE-284 Description: A vulnerability was found in Ethex Contracts. It has been classified as critical. This affects an unknown part of the file EthexJackpot.sol of the component Monthly Jackpot Handler. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named 6b8664b698d3d953e16c28
his is why information about affected and unaffected releases are unavailable. The patch is named 6b8664b698d3d953e16c284fadc6caeb9e58e3db. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-248271. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.248271 - https://vuldb.com/?ctiid.248271 - https://bitcointalk.org/index.php?topic=5120151.msg50827730#msg50827730 - https://github.com/ethex-bet/ethex-contracts/commit/6b8664b698d3d953e16c284fadc6caeb9e58e3db
CVE ID: CVE-2019-25158 State: PUBLISHED Published: 2023-12-19T13:00:06.070Z Last Updated: 2024-08-05T03:00:19.426Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: pedroetb Products: tts-api Problem Types: CWE-78 Description: A vulnerability has been found in pedroetb tts-api up to 2.1.4 and classified as critical. This vulnerability affects the function onSpeechDone of the file app.js. The manipulation leads to os command injection. Upgrading to version 2.2.0 is able to address this issue. The patch is identified as 29d9c25415911ea2f8b6de247cb5c4607d13d434. It is recommended to upgrade the affected component. VDB-248278 is the identifier assigned to this vul
7cb5c4607d13d434. It is recommended to upgrade the affected component. VDB-248278 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.248278 - https://vuldb.com/?ctiid.248278 - https://github.com/pedroetb/tts-api/commit/29d9c25415911ea2f8b6de247cb5c4607d13d434 - https://github.com/pedroetb/tts-api/releases/tag/v2.2.0
CVE ID: CVE-2019-25159 State: PUBLISHED Published: 2024-02-04T06:00:06.098Z Last Updated: 2025-05-15T19:48:28.439Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: mpedraza2020 Products: Intranet del Monterroso Problem Types: CWE-89 Description: A vulnerability was found in mpedraza2020 Intranet del Monterroso up to 4.50.0. It has been classified as critical. This affects an unknown part of the file config/cargos.php. The manipulation of the argument dni_profe leads to sql injection. Upgrading to version 4.51.0 is able to address this issue. The identifier of the patch is 678190bee1dfd64b54a2b0e88abfd009e78adce8. It is recommended to upgrade the affected comp
The identifier of the patch is 678190bee1dfd64b54a2b0e88abfd009e78adce8. It is recommended to upgrade the affected component. The identifier VDB-252717 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.252717 - https://vuldb.com/?ctiid.252717 - https://github.com/mpedraza2020/IESMONTEROSOINTRANET/commit/678190bee1dfd64b54a2b0e88abfd009e78adce8 - https://github.com/mpedraza2020/IESMONTEROSOINTRANET/releases/tag/v4.51.0
CVE ID: CVE-2019-25160 State: PUBLISHED Published: 2024-02-26T17:20:19.490Z Last Updated: 2025-05-04T06:58:16.017Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: netlabel: fix out-of-bounds memory accesses There are two array out-of-bounds memory accesses, one in cipso_v4_map_lvl_valid(), the other in netlbl_bitmap_walk(). Both errors are embarassingly simple, and the fixes are straightforward. As a FYI for anyone backporting this patch to kernels prior to v4.8, you'll want to apply the netlbl_bitmap_walk() patch to cipso_v4_bitmap_walk() as netlbl_bitmap_walk() doesn't exist before Linux v4.8. Additional Analyst Notes: - CISA
tch to cipso_v4_bitmap_walk() as netlbl_bitmap_walk() doesn't exist before Linux v4.8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/97bc3683c24999ee621d847c9348c75d2fe86272 - https://git.kernel.org/stable/c/c61d01faa5550e06794dcf86125ccd325bfad950 - https://git.kernel.org/stable/c/dc18101f95fa6e815f426316b8b9a5cee28a334e - https://git.kernel.org/stable/c/1c973f9c7cc2b3caae93192fdc8ecb3f0b4ac000 - https://git.kernel.org/stable/c/fcfe700acdc1c72eab231300e82b962bac2b2b2c - https://git.kernel.org/stable/c/e3713abc4248aa6bcc11173d754c418b02a62cbb - https://git.kernel.org/stable/c/fbf9578919d6c91100ec63acf2cba641383f6c78
e/c/e3713abc4248aa6bcc11173d754c418b02a62cbb - https://git.kernel.org/stable/c/fbf9578919d6c91100ec63acf2cba641383f6c78 - https://git.kernel.org/stable/c/5578de4834fe0f2a34fedc7374be691443396d1f
CVE ID: CVE-2019-25161 State: REJECTED Published: 2024-02-26T17:20:20.190Z Last Updated: 2024-02-27T09:57:13.593Z Description: No description available.
CVE ID: CVE-2019-25162 State: PUBLISHED Published: 2024-02-26T17:20:20.846Z Last Updated: 2025-05-04T06:58:17.077Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: i2c: Fix a potential use after free Free the adap structure only after we are done using it. This patch just moves the put_device() down a bit to avoid the use after free. [wsa: added comment to the code, added Fixes tag] Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/e6412ba3b6508bdf9c074d310bf4144afa6aec1a - https://git.kernel.org/stable/c/23a191b132cd87f746c62f3dc27da33683d85829 - https://git
6508bdf9c074d310bf4144afa6aec1a - https://git.kernel.org/stable/c/23a191b132cd87f746c62f3dc27da33683d85829 - https://git.kernel.org/stable/c/871a1e94929a27bf6e2cd99523865c840bbc2d87 - https://git.kernel.org/stable/c/81cb31756888bb062e92d2dca21cd629d77a46a9 - https://git.kernel.org/stable/c/35927d7509ab9bf41896b7e44f639504eae08af7 - https://git.kernel.org/stable/c/e8e1a046cf87c8b1363e5de835114f2779e2aaf4 - https://git.kernel.org/stable/c/12b0606000d0828630c033bf0c74c748464fe87d - https://git.kernel.org/stable/c/e4c72c06c367758a14f227c847f9d623f1994ecf
CVE ID: CVE-2019-25163 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:04:53.129Z Description: No description available.
CVE ID: CVE-2019-25164 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:34:46.351Z Description: No description available.
CVE ID: CVE-2019-25165 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:34:47.627Z Description: No description available.
CVE ID: CVE-2019-25166 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:34:48.863Z Description: No description available.
CVE ID: CVE-2019-25167 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:34:50.055Z Description: No description available.
CVE ID: CVE-2019-25168 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:34:51.230Z Description: No description available.
CVE ID: CVE-2019-25169 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:34:52.422Z Description: No description available.
CVE ID: CVE-2019-25170 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:34:53.706Z Description: No description available.
CVE ID: CVE-2019-25171 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:34:54.948Z Description: No description available.
CVE ID: CVE-2019-25172 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:34:56.356Z Description: No description available.
CVE ID: CVE-2019-25173 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:34:57.548Z Description: No description available.
CVE ID: CVE-2019-25174 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:34:58.727Z Description: No description available.
CVE ID: CVE-2019-25175 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:34:59.937Z Description: No description available.
CVE ID: CVE-2019-25176 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:35:01.148Z Description: No description available.
CVE ID: CVE-2019-25177 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:35:02.400Z Description: No description available.
CVE ID: CVE-2019-25178 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:35:03.987Z Description: No description available.
CVE ID: CVE-2019-25179 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:35:05.514Z Description: No description available.
CVE ID: CVE-2019-25180 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:35:06.735Z Description: No description available.
CVE ID: CVE-2019-25181 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:35:07.953Z Description: No description available.
CVE ID: CVE-2019-25182 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:35:09.314Z Description: No description available.
CVE ID: CVE-2019-25183 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:35:10.807Z Description: No description available.
CVE ID: CVE-2019-25184 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:35:12.356Z Description: No description available.
CVE ID: CVE-2019-25185 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:35:13.727Z Description: No description available.
CVE ID: CVE-2019-25186 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:35:15.165Z Description: No description available.
CVE ID: CVE-2019-25187 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:35:16.595Z Description: No description available.
CVE ID: CVE-2019-25188 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:35:17.955Z Description: No description available.
CVE ID: CVE-2019-25189 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:35:19.331Z Description: No description available.
CVE ID: CVE-2019-25190 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:35:20.743Z Description: No description available.
CVE ID: CVE-2019-25191 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:35:22.113Z Description: No description available.
CVE ID: CVE-2019-25192 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:35:23.434Z Description: No description available.
CVE ID: CVE-2019-25193 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:35:24.742Z Description: No description available.
CVE ID: CVE-2019-25194 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:35:26.263Z Description: No description available.
CVE ID: CVE-2019-25195 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:35:27.619Z Description: No description available.
CVE ID: CVE-2019-25196 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:35:28.918Z Description: No description available.
CVE ID: CVE-2019-25197 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:35:30.344Z Description: No description available.
CVE ID: CVE-2019-25198 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:35:31.661Z Description: No description available.
CVE ID: CVE-2019-25199 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:35:32.966Z Description: No description available.
CVE ID: CVE-2019-25200 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:35:34.385Z Description: No description available.
CVE ID: CVE-2019-25201 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:35:35.920Z Description: No description available.
CVE ID: CVE-2019-25202 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:35:37.209Z Description: No description available.
CVE ID: CVE-2019-25203 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:35:38.535Z Description: No description available.
CVE ID: CVE-2019-25204 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:35:39.883Z Description: No description available.
CVE ID: CVE-2019-25205 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:35:41.220Z Description: No description available.
CVE ID: CVE-2019-25206 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:35:42.620Z Description: No description available.
CVE ID: CVE-2019-25207 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:35:44.037Z Description: No description available.
CVE ID: CVE-2019-25208 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:35:45.388Z Description: No description available.
CVE ID: CVE-2019-25209 State: REJECTED Published: N/A Last Updated: 2025-09-16T15:35:46.698Z Description: No description available.
CVE ID: CVE-2019-25210 State: PUBLISHED Published: 2024-03-03T00:00:00 Last Updated: 2024-09-04T17:38:48.040Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm through 3.13.3. It displays values of secrets when the --dry-run flag is used. This is a security concern in some use cases, such as a --dry-run call by a CI/CD tool. NOTE: the vendor's position is that this behavior was introduced intentionally, and cannot be removed without breaking backwards compatibility (some users may be relying on these values). Also, it is not the Helm Project's responsibility if a user decides to use --dry-run within a CI/CD env
n these values). Also, it is not the Helm Project's responsibility if a user decides to use --dry-run within a CI/CD environment whose output is visible to unauthorized persons. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/helm/helm/issues/7275 - https://www.cncf.io/projects/helm/ - https://helm.sh/blog/response-cve-2019-25210/
CVE ID: CVE-2019-25211 State: PUBLISHED Published: 2024-06-28T00:00:00.000Z Last Updated: 2025-11-03T18:07:54.695Z Vendors: n/a Products: n/a Problem Types: n/a Description: parseWildcardRules in Gin-Gonic CORS middleware before 1.6.0 mishandles a wildcard at the end of an origin string, e.g., https://example.community/* is allowed when the intention is that only https://example.com/* should be allowed, and http://localhost.example.com/* is allowed when the intention is that only http://localhost/* should be allowed. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/gin-contrib/cors/pull/57 - https://github.com/gin-contrib/cors/pull/
Program Container: References: - https://github.com/gin-contrib/cors/pull/57 - https://github.com/gin-contrib/cors/pull/106 - https://github.com/gin-contrib/cors/compare/v1.5.0...v1.6.0 - https://github.com/gin-contrib/cors/releases/tag/v1.6.0 - https://github.com/gin-contrib/cors/commit/27b723a473efd80d5a498fa9f5933c80204c850d
CVE ID: CVE-2019-25212 State: PUBLISHED Published: 2024-09-11T08:31:04.386Z Last Updated: 2024-09-11T14:59:25.179Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: nik00726 Products: video carousel slider with lightbox Problem Types: CWE-89 Description: The video carousel slider with lightbox plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries in
it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/85e70be3-3ed7-4ce1-a20c-046fb7c4ec31?source=cve - https://wordpress.org/plugins/wp-responsive-video-gallery-with-lightbox - https://plugins.trac.wordpress.org/changeset?old_path=/wp-responsive-video-gallery-with-lightbox/tags/1.0.6&new_path=/wp-responsive-video-gallery-with-lightbox/tags/1.0.7&sfp_email=&sfph_mail=#file41
CVE ID: CVE-2019-25213 State: PUBLISHED Published: 2024-10-16T06:43:32.214Z Last Updated: 2024-10-16T18:05:50.381Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: vasyltech Products: Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More Problem Types: CWE-22 Description: The Advanced Access Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read in versions up to, and including, 5.9.8.1 due to insufficient validation on the aam-media parameter. This allows unauthenticated attackers to read any file on the server, including sensitive files such as wp-config.php Additional Analyst Notes: - CISA ADP
rs to read any file on the server, including sensitive files such as wp-config.php Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/55e0f0df-7be2-4e18-988c-2cc558768eff?source=cve - https://plugins.trac.wordpress.org/changeset/2098838/advanced-access-manager/trunk/application/Core/Media.php?old=2151316&old_path=advanced-access-manager%2Ftrunk%2Fapplication%2FCore%2FMedia.php
CVE ID: CVE-2019-25214 State: PUBLISHED Published: 2024-10-16T06:43:43.143Z Last Updated: 2024-10-16T18:03:06.895Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: andrewmrobbins Products: ShopWP Problem Types: CWE-862 Description: The ShopWP plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several REST API routes in versions up to, and including, 2.0.4. This makes it possible for unauthenticated attackers to call the endpoints and perform unauthorized actions such as updating the plugin's settings and injecting malicious scripts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfenc
s and injecting malicious scripts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d04f11b4-ee58-428b-aaa2-dc7d9f3e68e3?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2132502%40wpshopify&new=2132502%40wpshopify&sfp_email=&sfph_mail=
CVE ID: CVE-2019-25215 State: PUBLISHED Published: 2024-10-16T06:43:34.069Z Last Updated: 2024-10-16T18:05:18.848Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: arisoft Products: ARI Adminer – WordPress Database Manager Problem Types: CWE-862 Description: The ARI-Adminer plugin for WordPress is vulnerable to authorization bypass due to a lack of file access controls in nearly every file of the plugin in versions up to, and including, 1.1.14. This makes it possible for unauthenticated attackers to call the files directly and perform a wide variety of unauthorized actions such as accessing a site's database and making changes. Additional Analyst Notes: - CISA
ariety of unauthorized actions such as accessing a site's database and making changes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/67ad04d4-49ef-4bc4-b3b0-f2752566145e?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2065317%40ari-adminer&new=2065317%40ari-adminer&sfp_email=&sfph_mail=
CVE ID: CVE-2019-25216 State: PUBLISHED Published: 2024-10-16T06:43:44.093Z Last Updated: 2024-10-16T13:00:15.117Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: starfishwp Products: Rich Reviews by Starfish Problem Types: CWE-79 Description: The Rich Review plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the POST body 'update' parameter in versions up to, and including, 1.7.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment:
in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/db701ad3-10fd-4a40-b239-139fbc95ab61?source=cve - https://www.wordfence.com/blog/2019/09/rich-reviews-plugin-vulnerability-exploited-in-the-wild/ - https://wordpress.org/support/topic/plugin-not-supported-open-to-malware-uninstall-now/ - https://wpscan.com/vulnerability/81bdc004-9b9c-49e2-b337-35a6d8395c5d