Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-12475 State: PUBLISHED Published: 2025-10-30T04:26:01.452Z Last Updated: 2025-10-30T13:54:22.488Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: creativethemeshq Products: Blocksy Companion Problem Types: CWE-79 Description: The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'blocksy_newsletter_subscribe' shortcode in all versions up to, and including, 2.1.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will
or authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dd13eb67-3bd5-41c4-a47f-5f55656ea5b9?source=cve - https://plugins.trac.wordpress.org/changeset/3371878/blocksy-companion/trunk/framework/extensions/newsletter-subscribe/helpers.php
CVE ID: CVE-2025-12476 State: PUBLISHED Published: 2025-10-29T16:31:47.306Z Last Updated: 2025-10-29T17:37:32.134Z Vendors: Azure Access Technology Products: BLU-IC2, BLU-IC4 Problem Types: CWE-306 Description: Resource Lacking AuthN.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://azure-access.com/security-advisories
CVE ID: CVE-2025-12477 State: PUBLISHED Published: 2025-10-29T16:33:48.232Z Last Updated: 2025-10-29T17:37:03.798Z Vendors: Azure Access Technology Products: BLU-IC2, BLU-IC4 Problem Types: CWE-306 Description: Server Version Disclosure.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://azure-access.com/security-advisories
CVE ID: CVE-2025-12478 State: PUBLISHED Published: 2025-10-29T16:37:47.165Z Last Updated: 2025-10-29T19:37:55.616Z Vendors: Azure Access Technology Products: BLU-IC2, BLU-IC4 Problem Types: CWE-326 Description: Non-Compliant TLS Configuration.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://azure-access.com/security-advisories
CVE ID: CVE-2025-12479 State: PUBLISHED Published: 2025-10-29T16:50:08.991Z Last Updated: 2025-10-29T18:04:45.220Z Vendors: Azure Access Technology Products: BLU-IC2, BLU-IC4 Problem Types: CWE-352 Description: Systemic Lack of Cross-Site Request Forgery (CSRF) Token Implementation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://azure-access.com/security-advisories
CVE ID: CVE-2025-12480 State: PUBLISHED Published: 2025-11-10T14:20:40.677Z Last Updated: 2025-11-12T17:20:24.201Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: TrioFox Products: TrioFox Problem Types: CWE-284 Description: Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is complete. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2025/MNDT-2025-0008.md - https://www.triofox.com/ - https://access.triofox.com/releases_history/ - https://cloud.google.com/blog/topics/threat
- https://www.triofox.com/ - https://access.triofox.com/releases_history/ - https://cloud.google.com/blog/topics/threat-intelligence/triofox-vulnerability-cve-2025-12480
CVE ID: CVE-2025-12481 State: PUBLISHED Published: 2025-11-18T09:27:38.298Z Last Updated: 2025-11-18T21:02:09.424Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: ninjateam Products: WP Duplicate Page Problem Types: CWE-862 Description: The WP Duplicate Page plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.7. This is due to the plugin not properly verifying that a user is authorized to perform an action in the 'saveSettings' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to modify plugin settings that control role capabilities, and subsequently exploit
Contributor-level access and above, to modify plugin settings that control role capabilities, and subsequently exploit the misconfigured capabilities to duplicate and view password-protected posts containing sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/61105f6a-1bd7-415d-9481-a1c2c310f778?source=cve - https://plugins.trac.wordpress.org/browser/wp-duplicate-page/tags/1.6/includes/Page/Settings.php#L92 - https://plugins.trac.wordpress.org/browser/wp-duplicate-page/tags/1.6/includes/Classes/ButtonDuplicate.php#L137 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&n
cludes/Classes/ButtonDuplicate.php#L137 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3394773%40wp-duplicate-page%2Ftrunk&old=3386144%40wp-duplicate-page%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2025-12482 State: PUBLISHED Published: 2025-11-16T04:17:30.278Z Last Updated: 2025-11-17T18:48:12.735Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: ameliabooking Products: Booking for Appointments and Events Calendar – Amelia Problem Types: CWE-89 Description: The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to SQL Injection via the ‘search’ parameter in all versions up to, and including, 1.2.35 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries in
tion on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cacf2e32-12cf-41a9-a57f-1135c165494c?source=cve - https://plugins.trac.wordpress.org/changeset/3390245/ameliabooking/tags/1.2.36/src/Infrastructure/Repository/Booking/Event/EventRepository.php
CVE ID: CVE-2025-12484 State: PUBLISHED Published: 2025-11-19T07:46:07.439Z Last Updated: 2025-11-19T18:15:43.641Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: smub Products: Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers Problem Types: CWE-79 Description: The Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple social media username parameters in all versions up to, and including, 1.12.19 due to insufficient input sanitization and output escaping. This makes it possibl
versions up to, and including, 1.12.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7cda6aad-36e1-45c7-af46-a7b90bb2d339?source=cve - https://plugins.trac.wordpress.org/browser/rafflepress/tags/1.12.19/app/rafflepress.php#L539 - https://plugins.trac.wordpress.org/browser/rafflepress/tags/1.12.19/app/rafflepress.php#L543 - https://plugins.trac.wordpress.org/browser/rafflepress/tags/1.12.19/app/rafflepress
s/1.12.19/app/rafflepress.php#L543 - https://plugins.trac.wordpress.org/browser/rafflepress/tags/1.12.19/app/rafflepress.php#L547 - https://plugins.trac.wordpress.org/browser/rafflepress/tags/1.12.19/app/rafflepress.php#L551 - https://plugins.trac.wordpress.org/browser/rafflepress/tags/1.12.19/app/rafflepress.php#L555 - https://plugins.trac.wordpress.org/browser/rafflepress/tags/1.12.19/app/rafflepress.php#L559 - https://plugins.trac.wordpress.org/browser/rafflepress/tags/1.12.19/app/rafflepress.php#L563 - https://plugins.trac.wordpress.org/browser/rafflepress/tags/1.12.19/app/entry.php#L110 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3398188%40rafflepr
app/entry.php#L110 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3398188%40rafflepress&old=3346436%40rafflepress&sfp_email=&sfph_mail=
CVE ID: CVE-2025-12485 State: PUBLISHED Published: 2025-11-06T16:37:14.546Z Last Updated: 2025-11-07T14:07:04.358Z Vendors: Devolutions Products: Server Problem Types: CWE-269 Description: Improper privilege management during pre-MFA cookie handling in Devolutions Server allows a low-privileged authenticated user to impersonate another account by replaying the pre-MFA cookie.This does not bypass the target account MFA verification step. This issue affects the following versions : * Devolutions Server 2025.3.2.0 through 2025.3.5.0 * Devolutions Server 2025.2.15.0 and earlier Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2025-
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2025-0016
CVE ID: CVE-2025-12486 State: PUBLISHED Published: 2025-11-06T20:12:54.400Z Last Updated: 2025-11-06T20:26:19.171Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Heimdall Data Products: Database Proxy Problem Types: CWE-79 Description: Heimdall Data Database Proxy Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Heimdall Data Database Proxy. Minimal user interaction is required to exploit this vulnerability. The specific flaw exists within the handling of the database event logs. The issue results from the lack of proper validation of user-supplied data,
hin the handling of the database event logs. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of arbitrary script. An attacker can leverage this vulnerability to interact with the application in the context of the target user. Was ZDI-CAN-24755. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-980/
CVE ID: CVE-2025-12487 State: PUBLISHED Published: 2025-11-06T20:12:07.187Z Last Updated: 2025-11-06T20:29:38.307Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: oobabooga Products: text-generation-webui Problem Types: CWE-807 Description: oobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of oobabooga text-generation-webui. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the trust_remote_code parameter provided to the join endpoint. The
lity. The specific flaw exists within the handling of the trust_remote_code parameter provided to the join endpoint. The issue results from the lack of proper validation of a user-supplied argument before using it to load a model. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-26681. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-982/ - https://github.com/oobabooga/text-generation-webui/commit/b5a6904c4ac4049823396090360b6f566f4e4603
CVE ID: CVE-2025-12488 State: PUBLISHED Published: 2025-11-06T20:11:52.136Z Last Updated: 2025-11-06T20:30:32.724Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: oobabooga Products: text-generation-webui Problem Types: CWE-807 Description: oobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of oobabooga text-generation-webui. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the trust_remote_code parameter provided to the load endpoint. The
lity. The specific flaw exists within the handling of the trust_remote_code parameter provided to the load endpoint. The issue results from the lack of proper validation of a user-supplied argument before using it to load a model. An attacker can leverage this vulnerability to execute code in the context of the service account. . Was ZDI-CAN-26680. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-981/ - https://github.com/oobabooga/text-generation-webui/commit/b5a6904c4ac4049823396090360b6f566f4e4603
CVE ID: CVE-2025-12489 State: PUBLISHED Published: 2025-11-06T20:11:32.632Z Last Updated: 2025-11-06T20:43:33.002Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: evernote-mcp-server Products: evernote-mcp-server Problem Types: CWE-78 Description: evernote-mcp-server openBrowser Command Injection Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of evernote-mcp-server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the openBrowser function. The issue results from the
der to exploit this vulnerability. The specific flaw exists within the openBrowser function. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-27913. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-983/ - https://github.com/brentmid/evernote-mcp-server/commit/1e66c78c4ce6ea294ac6b0eb289a9eae9c5e9579
CVE ID: CVE-2025-12490 State: PUBLISHED Published: 2025-11-06T20:10:57.257Z Last Updated: 2025-11-06T20:44:02.067Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Netgate Products: pfSense Problem Types: CWE-22 Description: Netgate pfSense CE Suricata Path Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of Netgate pfSense. Authentication is required to exploit this vulnerability. The specific flaw exists within the Suricata package. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can levera
from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create files in the context of root. Was ZDI-CAN-28085. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-979/ - https://github.com/pfsense/FreeBSD-ports/commit/36b2303dfca35a1183d76f26bcc6ce26d4ea682d
CVE ID: CVE-2025-12493 State: PUBLISHED Published: 2025-11-04T11:19:27.403Z Last Updated: 2025-11-04T20:13:56.143Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: devitemsllc Products: ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution (formerly WooLentor) Problem Types: CWE-22 Description: The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the 'load_template' function. This makes it possible for unauthenticated attackers to include and execute
ing, 3.2.5 via the 'load_template' function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/12bb4bb9-e908-43ad-8fb1-59418580f5e1?source=cve - https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/includes/addons/product-grid/base/class.product-grid-base.php#L378 - https://plugins.trac.wordp
r/woolentor-addons/trunk/includes/addons/product-grid/base/class.product-grid-base.php#L378 - https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/classes/class.ajax_actions.php#L241 - https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/classes/class.ajax_actions.php#L213 - https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/classes/class.ajax_actions.php#L42 - https://plugins.trac.wordpress.org/changeset/3388234/
CVE ID: CVE-2025-12494 State: PUBLISHED Published: 2025-11-15T05:45:34.066Z Last Updated: 2025-11-17T18:46:19.807Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: wpchill Products: Image Gallery – Photo Grid & Video Gallery Problem Types: CWE-285 Description: The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ajax_import_file function in all versions up to, and including, 2.12.28. This makes it possible for authenticated attackers, with author-level access and above, to move arbitrary image files on the server. Additional Analyst Notes: - CISA ADP Vulnri
author-level access and above, to move arbitrary image files on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ca423309-d8bd-46a4-9e88-9534d9c60b4a?source=cve - https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/2.12.26/includes/admin/class-modula-gallery-upload.php#L554 - https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/2.12.26/includes/admin/class-modula-gallery-upload.php#L567 - https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/2.12.26/includes/admin/class-modula-gallery-upload.php#L589 - https://plugins.trac.wordpress.org/browser/mo
gallery/tags/2.12.26/includes/admin/class-modula-gallery-upload.php#L589 - https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/2.12.26/includes/admin/class-modula-gallery-upload.php#L597 - https://research.cleantalk.org/cve-2025-12494/ - https://plugins.trac.wordpress.org/changeset/3391790/modula-best-grid-gallery/trunk?contextall=1&old=3390878&old_path=%2Fmodula-best-grid-gallery%2Ftrunk
CVE ID: CVE-2025-12497 State: PUBLISHED Published: 2025-11-05T11:24:40.177Z Last Updated: 2025-11-05T15:03:20.522Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: averta Products: Premium Portfolio Features for Phlox theme Problem Types: CWE-98 Description: The Premium Portfolio Features for Phlox theme plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.3.10 via the 'args[extra_template_path]' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, o
iles on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/518abad2-d3cc-4d15-83d2-8fd99d30500c?source=cve - https://plugins.trac.wordpress.org/changeset/3388727/auxin-portfolio
CVE ID: CVE-2025-12498 State: PUBLISHED Published: 2025-11-08T06:39:56.156Z Last Updated: 2025-11-10T18:32:07.128Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: metagauss Products: EventPrime – Events Calendar, Bookings and Tickets Problem Types: CWE-862 Description: The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized booking note creation due to a missing capability check on the 'booking_add_notes' function in all versions up to, and including, 4.2.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add a note to the backend view of any booking. Additiona
enticated attackers, with Subscriber-level access and above, to add a note to the backend view of any booking. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d32f7e98-8203-400e-bc26-4556ddba2510?source=cve - https://plugins.trac.wordpress.org/browser/eventprime-event-calendar-management/trunk/includes/class-ep-ajax.php#L638 - https://plugins.trac.wordpress.org/changeset/3389496/
CVE ID: CVE-2025-12501 State: PUBLISHED Published: 2025-10-31T14:10:19.919Z Last Updated: 2025-10-31T14:53:19.356Z Vendors: Opera Norway AS Products: GameMaker IDE Problem Types: Integer Overflow Description: Integer overflow in GameMaker IDE below 2024.14.0 version can lead to can lead to application crashes through denial-of-service attacks (DoS). GameMaker users who use the network_create_server() function in their projects are urged to update and recompile immediately. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://blogs.opera.com/security/2025/10/gamemaker-security-update-cve-2025-12501/
CVE ID: CVE-2025-12502 State: PUBLISHED Published: 2025-11-20T06:00:02.985Z Last Updated: 2025-11-20T14:32:54.501Z Vendors: Unknown Products: attention-bar Problem Types: CWE-89 SQL Injection Description: The attention-bar WordPress plugin through 0.7.2.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing high privilege users such as administrator to perform SQL injection attacks Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/75e63134-4c8a-45fd-b7fc-db40644ddb8c/
CVE ID: CVE-2025-12503 State: PUBLISHED Published: 2025-11-03T06:51:55.994Z Last Updated: 2025-11-03T13:48:19.281Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Digiwin Products: EasyFlow .NET, EasyFlow AiNet Problem Types: CWE-89 Description: EasyFlow .NET and EasyFlow AiNet developed by Digiwin has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10475-01c6d-1.html - https://www.twcert.org.tw/en/cp-139-10476-c8448-2.html
CVE ID: CVE-2025-12507 State: PUBLISHED Published: 2025-10-31T15:48:36.371Z Last Updated: 2025-10-31T18:17:20.171Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Bizerba Products: _connect.BRAIN Problem Types: CWE-428 Description: The service Bizerba Communication Server (BCS) has an unquoted service path. Due to the way Windows searches the executable for the BCS service, malicious programs can be executed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.bizerba.com/downloads/global/information-security/2025/bizerba-sa-2025-0005.pdf