Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-12846 State: PUBLISHED Published: 2025-11-11T11:03:46.642Z Last Updated: 2025-11-14T15:29:19.575Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: creativethemeshq Products: Blocksy Companion Problem Types: CWE-434 Description: The Blocksy Companion plugin for WordPress is vulnerable to authenticated arbitrary file upload in all versions up to, and including, 2.1.19. This is due to insufficient file type validation detecting SVG files, allowing double extension files to bypass sanitization while being accepted as a valid SVG file. This makes it possible for authenticated attackers, with author level access and above, to upload arbitrary files o
ile. This makes it possible for authenticated attackers, with author level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f8615422-5db7-495d-9956-7d6f658f42bf?source=cve - https://plugins.trac.wordpress.org/changeset/3391933/blocksy-companion/trunk/framework/features/svg.php
CVE ID: CVE-2025-12847 State: PUBLISHED Published: 2025-11-15T05:45:32.963Z Last Updated: 2025-11-17T18:42:46.195Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: smub Products: All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic Problem Types: CWE-862 Description: The All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to unauthorized arbitrary media attachment deletion due to a missing authorization check in all versions up to, and including, 4.8.9. This is due to the REST API endpoint `/wp-json/aioseo/v1/ai/image-generator` only verifying that users have the `edit_posts
s is due to the REST API endpoint `/wp-json/aioseo/v1/ai/image-generator` only verifying that users have the `edit_posts` capability (Contributors and above) without checking if they own or have permission to delete the specific media attachments. This makes it possible for authenticated attackers, with Contributor-level access and above, to permanently delete arbitrary media attachments by ID via the REST API, granted they can determine valid attachment IDs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/05abc09f-903b-45a9-8cde-1bf8fd5d7d44?source=cve - https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/
ies/id/05abc09f-903b-45a9-8cde-1bf8fd5d7d44?source=cve - https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/4.8.9/app/Common/Api/Api.php#L192 - https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/4.8.9/app/Common/Api/Ai.php#L542 - https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/4.8.9/app/Common/Ai/Image.php#L192 - https://plugins.trac.wordpress.org/browser/all-in-one-seo-pack/tags/4.8.9/app/Common/Utils/Access.php#L184 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3393820%40all-in-one-seo-pack&old=3384131%40all-in-one-seo-pack&sfp_email=&sfph_mail=#file1387
CVE ID: CVE-2025-12849 State: PUBLISHED Published: 2025-11-15T06:41:31.470Z Last Updated: 2025-11-17T19:01:33.905Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: contest-gallery Products: Contest Gallery – Upload, Vote & Sell with PayPal and Stripe Problem Types: CWE-862 Description: The Contest Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 28.0.2. This is due to the plugin registering the `cg_check_wp_admin_upload_v10` AJAX action for both authenticated and unauthenticated users without implementing capability checks or nonce verification. This makes it possible for unauthenticated attackers to inj
ithout implementing capability checks or nonce verification. This makes it possible for unauthenticated attackers to inject arbitrary WordPress media attachments into galleries and manipulate gallery metadata via the `cg_check_wp_admin_upload_v10` action. It does not enable an attacker to move or upload files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e000c4ad-43ec-4ad0-89f9-74e9e6d8b917?source=cve - https://plugins.trac.wordpress.org/browser/contest-gallery/tags/28.0.2/v10/include-functions-v10.php#L42 - https://plugins.trac.wordpress.org/browser/contest-gallery/tags/28.0.2/v10/include-functions-v10.php#L47 - h
0.php#L42 - https://plugins.trac.wordpress.org/browser/contest-gallery/tags/28.0.2/v10/include-functions-v10.php#L47 - https://plugins.trac.wordpress.org/browser/contest-gallery/tags/28.0.2/v10/include-functions-v10.php#L64 - https://plugins.trac.wordpress.org/browser/contest-gallery/tags/28.0.2/v10/v10-admin/gallery/wp-uploader.php#L15 - https://plugins.trac.wordpress.org/browser/contest-gallery/tags/28.0.2/v10/v10-admin/gallery/wp-uploader.php#L173 - https://wordpress.org/plugins/contest-gallery/#developers
CVE ID: CVE-2025-12852 State: PUBLISHED Published: 2025-11-19T01:01:46.374Z Last Updated: 2025-11-19T17:13:10.642Z Vendors: NEC Corporation Products: RakurakuMusen Start EX Problem Types: CWE-427 Description: DLL Loading vulnerability in NEC Corporation RakurakuMusen Start EX All Verisons allows a attacker to manipulate the PC environment to cause unintended operations on the user's device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jpn.nec.com/security-info/secinfo/nv25-007_en.html
CVE ID: CVE-2025-12853 State: PUBLISHED Published: 2025-11-07T12:32:07.272Z Last Updated: 2025-11-07T13:07:26.074Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Best House Rental Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was determined in SourceCodester Best House Rental Management System 1.0. This affects the function delete_house of the file /admin_class.php. Executing manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:/
as been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.331499 - https://vuldb.com/?ctiid.331499 - https://vuldb.com/?submit.679152 - https://github.com/Cashbeebee/CVE/issues/2 - https://www.sourcecodester.com/
CVE ID: CVE-2025-12854 State: PUBLISHED Published: 2025-11-07T12:32:09.758Z Last Updated: 2025-11-07T13:04:37.110Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R) Vendors: n/a Products: newbee-mall-plus Problem Types: CWE-639, CWE-285 Description: A vulnerability was identified in newbee-mall-plus up to 2.4.1. This vulnerability affects the function executeSeckill of the file /seckillExecution/. The manipulation of the argument userid leads to authorization bypass. It is possible to initiate the attack remotely. The attack is considered to have high complexity. It is stated that the exploitability is difficult. The exploit is publicly available and might b
o have high complexity. It is stated that the exploitability is difficult. The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.331500 - https://vuldb.com/?ctiid.331500 - https://vuldb.com/?submit.679281 - https://github.com/Hwwg/cve/issues/4
CVE ID: CVE-2025-12855 State: PUBLISHED Published: 2025-11-07T13:32:06.643Z Last Updated: 2025-11-07T15:57:29.740Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Responsive Hotel Site Problem Types: CWE-89, CWE-74 Description: A security flaw has been discovered in code-projects Responsive Hotel Site 1.0. This issue affects some unknown processing of the file /admin/newsletterdel.php. The manipulation of the argument eid results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.co
ed to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.331501 - https://vuldb.com/?ctiid.331501 - https://vuldb.com/?submit.679743 - https://github.com/AmengDream/CVE/blob/main/Responsive_Hotel_Site/newsletterdel-sql-injection/report.md - https://code-projects.org/
CVE ID: CVE-2025-12856 State: PUBLISHED Published: 2025-11-07T13:32:08.786Z Last Updated: 2025-11-07T17:19:51.164Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Responsive Hotel Site Problem Types: CWE-89, CWE-74 Description: A weakness has been identified in code-projects Responsive Hotel Site 1.0. Impacted is an unknown function of the file /admin/reservation.php. This manipulation of the argument email causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.331502 - http
could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.331502 - https://vuldb.com/?ctiid.331502 - https://vuldb.com/?submit.679744 - https://github.com/AmengDream/CVE/blob/main/Responsive_Hotel_Site/reservation-sql-injection/report.md - https://code-projects.org/
CVE ID: CVE-2025-12857 State: PUBLISHED Published: 2025-11-07T14:02:06.372Z Last Updated: 2025-11-07T14:45:22.090Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Responsive Hotel Site Problem Types: CWE-89, CWE-74 Description: A security vulnerability has been detected in code-projects Responsive Hotel Site 1.0. The affected element is an unknown function of the file /admin/roombook.php. Such manipulation of the argument rid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.331503 - h
licly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.331503 - https://vuldb.com/?ctiid.331503 - https://vuldb.com/?submit.679745 - https://github.com/AmengDream/CVE/blob/main/Responsive_Hotel_Site/roombook-sql-injection/report.md - https://code-projects.org/
CVE ID: CVE-2025-12858 State: REJECTED Published: N/A Last Updated: 2025-11-07T18:03:35.198Z Description: No description available.
CVE ID: CVE-2025-12859 State: PUBLISHED Published: 2025-11-07T15:02:06.353Z Last Updated: 2025-11-07T20:42:21.782Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: n/a Products: DedeBIZ Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in DedeBIZ up to 6.3.2. This impacts an unknown function of the file /admin/templets_one_edit.php. The manipulation of the argument ids leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.331506 - https://vuldb.com/?ctiid.331506 - https://vul
tes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.331506 - https://vuldb.com/?ctiid.331506 - https://vuldb.com/?submit.679106 - https://github.com/ZZCTD/zz_test/issues/1
CVE ID: CVE-2025-12860 State: PUBLISHED Published: 2025-11-07T15:02:08.895Z Last Updated: 2025-11-07T20:42:56.659Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: n/a Products: DedeBIZ Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in DedeBIZ up to 6.3.2. Affected is an unknown function of the file /admin/freelist_main.php. The manipulation of the argument orderby results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.331507 - https://vuldb.com/?ctiid.331507 - https://vuldb.com/?submit.679111 -
ment: References: - https://vuldb.com/?id.331507 - https://vuldb.com/?ctiid.331507 - https://vuldb.com/?submit.679111 - https://github.com/ZZCTD/zz_test/issues/2
CVE ID: CVE-2025-12861 State: PUBLISHED Published: 2025-11-07T16:02:05.050Z Last Updated: 2025-11-07T19:25:27.663Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: n/a Products: DedeBIZ Problem Types: CWE-89, CWE-74 Description: A vulnerability was determined in DedeBIZ up to 6.3.2. Affected by this vulnerability is an unknown functionality of the file /admin/spec_add.php. This manipulation of the argument flags[] causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.331508 - https://vuldb.com/?cti
. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.331508 - https://vuldb.com/?ctiid.331508 - https://vuldb.com/?submit.679692 - https://github.com/ZZCTD/zz_test/issues/3
CVE ID: CVE-2025-12862 State: PUBLISHED Published: 2025-11-07T16:32:06.297Z Last Updated: 2025-11-07T19:16:42.717Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: projectworlds Products: Online Notes Sharing Platform Problem Types: CWE-434, CWE-284 Description: A vulnerability was identified in projectworlds Online Notes Sharing Platform 1.0. Affected by this issue is some unknown functionality of the file /dashboard/userprofile.php. Such manipulation of the argument image leads to unrestricted upload. The attack may be performed from remote. The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.331509 - https://vuldb.com/?ctiid.331509 - https://vuldb.com/?submit.679802 - https://github.com/K1nakoo/cve/blob/main/tmp74/report.md
CVE ID: CVE-2025-12863 State: REJECTED Published: 2025-11-07T20:59:35.021Z Last Updated: 2025-11-20T12:11:37.790Z Description: No description available.
CVE ID: CVE-2025-12864 State: PUBLISHED Published: 2025-11-10T02:15:04.569Z Last Updated: 2025-11-10T16:44:10.324Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: e-Excellence Products: U-Office Force Problem Types: CWE-89 Description: U-Office Force developed by e-Excellence has a SQL Injection vulnerability, allowing authenticated remote attacker to inject arbitrary SQL commands to read, modify, and delete database contents. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10488-2df22-1.html - https://www.twcert.org.tw/en/cp-139-10489-a5a6d-2.html
CVE ID: CVE-2025-12865 State: PUBLISHED Published: 2025-11-10T02:19:00.552Z Last Updated: 2025-11-10T16:32:32.423Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: e-Excellence Products: U-Office Force Problem Types: CWE-89 Description: U-Office Force developed by e-Excellence has a SQL Injection vulnerability, allowing authenticated remote attacker to inject arbitrary SQL commands to read, modify, and delete database contents. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10488-2df22-1.html - https://www.twcert.org.tw/en/cp-139-10489-a5a6d-2.html
CVE ID: CVE-2025-12866 State: PUBLISHED Published: 2025-11-10T02:45:26.739Z Last Updated: 2025-11-12T16:50:58.724Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hundred Plus Products: EIP Plus Problem Types: CWE-640 Description: EIP Plus developed by Hundred Plus has a Weak Password Recovery Mechanism vulnerability, allowing unauthenticated remote attacker to predict or brute-force the 'forgot password' link, thereby successfully resetting any user's password. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-10490-2534b-1.html - https://www.twcert.org.tw/en/cp-139-10491-004b0-2.
eferences: - https://www.twcert.org.tw/tw/cp-132-10490-2534b-1.html - https://www.twcert.org.tw/en/cp-139-10491-004b0-2.html
CVE ID: CVE-2025-12867 State: PUBLISHED Published: 2025-11-10T03:02:49.313Z Last Updated: 2025-11-12T16:50:21.071Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hundred Plus Products: EIP Plus Problem Types: CWE-434 Description: EIP Plus developed by Hundred Plus has an Arbitrary File Uplaod vulnerability, allowing privileged remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-10490-2534b-1.html - https://www.twcert.org.tw/en/cp-139-10491-004b0-2.html
CVE ID: CVE-2025-12868 State: PUBLISHED Published: 2025-11-10T03:14:28.560Z Last Updated: 2025-11-10T21:42:11.552Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: CyberTutor Products: New Site Server Problem Types: CWE-603 Description: New Site Server developed by CyberTutor has a Use of Client-Side Authentication vulnerability, allowing unauthenticated remote attackers to modify the frontend code to gain administrator privileges on the website. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10493-bf807-1.html - https://www.twcert.org.tw/en/cp-139-10492-84a10-2.html
CVE ID: CVE-2025-12869 State: PUBLISHED Published: 2025-11-12T07:30:18.298Z Last Updated: 2025-11-12T16:24:25.239Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: aEnrich Products: a+HRD Problem Types: CWE-79 Description: The a+HRD developed by aEnrich has a Stored Cross-Site Scripting vulnerability, allowing remote attackers with administrator privileges to inject persistent JavaScript codes that are executed in users' browsers upon page load. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10486-a3459-1.html - https://www.twcert.org.tw/en/cp-139-10487-12a32-2.html
CVE ID: CVE-2025-12870 State: PUBLISHED Published: 2025-11-12T07:35:43.207Z Last Updated: 2025-11-12T17:02:29.442Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: aEnrich Products: a+HRD Problem Types: CWE-1390 Description: The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to send crafted packets to obtain administrator access tokens and use them to access the system with elevated privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-10486-a3459-1.html - https://www.twcert.org.tw/en/cp-139-10487-12a32-2.html
CVE ID: CVE-2025-12871 State: PUBLISHED Published: 2025-11-12T07:38:30.394Z Last Updated: 2025-11-12T17:01:46.367Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: aEnrich Products: a+HRD Problem Types: CWE-1390 Description: The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to craft administrator access tokens and use them to access the system with elevated privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-10486-a3459-1.html - https://www.twcert.org.tw/en/cp-139-10487-12a32-2.html
CVE ID: CVE-2025-12872 State: PUBLISHED Published: 2025-11-12T07:47:11.458Z Last Updated: 2025-11-12T14:48:29.059Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: aEnrich Products: a+HRD, a+HCM Problem Types: CWE-79 Description: The a+HRD and a+HCM developed by aEnrich has a Stored Cross-Site Scripting vulnerability, allowing authenticated remote attackers to upload files containing malicious JavaScript code, which will execute on the client side when a user is tricked into visiting a specific URL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10486-a3459-1.html - https://www.twcert.org.tw/en/cp-139-1048
ichment: References: - https://www.twcert.org.tw/tw/cp-132-10486-a3459-1.html - https://www.twcert.org.tw/en/cp-139-10487-12a32-2.html
CVE ID: CVE-2025-12873 State: PUBLISHED Published: 2025-11-07T18:02:07.310Z Last Updated: 2025-11-07T18:27:05.910Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: School File Management Problem Types: CWE-89, CWE-74 Description: A security flaw has been discovered in Campcodes School File Management 1.0. This affects an unknown part of the file /admin/update_user.php. Performing manipulation of the argument user_id results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.331
public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.331510 - https://vuldb.com/?ctiid.331510 - https://vuldb.com/?submit.680854 - https://github.com/YYYGdd/CVE/issues/1 - https://www.campcodes.com/
CVE ID: CVE-2025-12875 State: PUBLISHED Published: 2025-11-07T20:32:07.100Z Last Updated: 2025-11-13T14:14:24.271Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C) Vendors: n/a Products: mruby Problem Types: CWE-787, CWE-119 Description: A weakness has been identified in mruby 3.4.0. This vulnerability affects the function ary_fill_exec of the file mrbgems/mruby-array-ext/src/array.c. Executing manipulation of the argument start/length can lead to out-of-bounds write. The attack needs to be launched locally. The exploit has been made available to the public and could be exploited. This patch is called 93619f06dd378db6766666b30c08978311c7ec94. It is best
ailable to the public and could be exploited. This patch is called 93619f06dd378db6766666b30c08978311c7ec94. It is best practice to apply a patch to resolve this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.331511 - https://vuldb.com/?ctiid.331511 - https://vuldb.com/?submit.680879 - https://github.com/mruby/mruby/issues/6650 - https://github.com/mruby/mruby/issues/6650#event-20443453808 - https://github.com/mruby/mruby/issues/6650#issuecomment-3430851605 - https://github.com/makesoftwaresafe/mruby/commit/93619f06dd378db6766666b30c08978311c7ec94
CVE ID: CVE-2025-12877 State: PUBLISHED Published: 2025-11-22T07:29:20.354Z Last Updated: 2025-11-24T19:33:38.865Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: themeatelier Products: IDonate – Blood Donation, Request And Donor Management System Problem Types: CWE-862 Description: The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized modification od data due to a missing capability check on the panding_blood_request_action() function in all versions up to, and including, 2.1.15. This makes it possible for unauthenticated attackers to delete arbitrary posts. Additional Analyst Notes: - CISA ADP