Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
n/appointment-booking-calendar/vulnerability/wordpress-appointment-booking-calendar-plugin-1-3-92-csrf-to-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-46242 State: PUBLISHED Published: 2025-04-22T09:53:28.836Z Last Updated: 2025-04-22T16:51:38.447Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: Bob Products: Watu Quiz Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bob Watu Quiz allows SQL Injection. This issue affects Watu Quiz: from n/a through 3.4.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/watu/vulnerability/wordpress-watu-quiz-3-4-3-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-46243 State: PUBLISHED Published: 2025-04-22T09:53:29.407Z Last Updated: 2025-04-22T16:49:57.601Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: sonalsinha21 Products: Recover abandoned cart for WooCommerce Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in sonalsinha21 Recover abandoned cart for WooCommerce allows Cross Site Request Forgery. This issue affects Recover abandoned cart for WooCommerce: from n/a through 2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/recover-wc-abandoned-cart/vulnerability/wordpress-recover-abandoned-cart
ttps://patchstack.com/database/wordpress/plugin/recover-wc-abandoned-cart/vulnerability/wordpress-recover-abandoned-cart-for-woocommerce-2-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-46244 State: PUBLISHED Published: 2025-04-22T09:53:30.018Z Last Updated: 2025-04-22T16:33:47.797Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Dotstore Products: Advanced Linked Variations for Woocommerce Problem Types: CWE-862 Description: Missing Authorization vulnerability in Dotstore Advanced Linked Variations for Woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Advanced Linked Variations for Woocommerce: from n/a through 1.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/linked-variation/vulnerability/wordpress
DP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/linked-variation/vulnerability/wordpress-advanced-linked-variations-for-woocommerce-1-0-3-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-46245 State: PUBLISHED Published: 2025-04-22T09:53:30.649Z Last Updated: 2025-04-22T16:23:06.221Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: CreativeMindsSolutions Products: CM Ad Changer Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM Ad Changer allows Cross Site Request Forgery. This issue affects CM Ad Changer: from n/a through 2.0.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/cm-ad-changer/vulnerability/wordpress-cm-ad-changer-2-0-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-46246 State: PUBLISHED Published: 2025-04-22T09:53:31.292Z Last Updated: 2025-04-22T16:08:49.917Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: CreativeMindsSolutions Products: CM Answers Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM Answers allows Cross Site Request Forgery. This issue affects CM Answers: from n/a through 3.3.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/cm-answers/vulnerability/wordpress-cm-answers-3-3-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-46247 State: PUBLISHED Published: 2025-04-22T09:53:31.891Z Last Updated: 2025-04-22T16:06:28.234Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: codepeople Products: Appointment Booking Calendar Problem Types: CWE-862 Description: Missing Authorization vulnerability in codepeople Appointment Booking Calendar allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Appointment Booking Calendar: from n/a through 1.3.92. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/appointment-booking-calendar/vulnerability/wordpress-appointment-booking-calendar-1-3
tack.com/database/wordpress/plugin/appointment-booking-calendar/vulnerability/wordpress-appointment-booking-calendar-1-3-92-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-46248 State: PUBLISHED Published: 2025-04-24T16:08:28.641Z Last Updated: 2025-04-25T14:10:23.113Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: M A Vinoth Kumar Products: Frontend Dashboard Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in M A Vinoth Kumar Frontend Dashboard allows SQL Injection. This issue affects Frontend Dashboard: from n/a through 2.2.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/frontend-dashboard/vulnerability/wordpress-frontend-dashboard-2-2-5-sql-injection-v
hstack.com/database/wordpress/plugin/frontend-dashboard/vulnerability/wordpress-frontend-dashboard-2-2-5-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-46249 State: PUBLISHED Published: 2025-04-22T09:53:32.446Z Last Updated: 2025-04-22T13:48:33.963Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Michael Products: Simple calendar for Elementor Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Michael Simple calendar for Elementor allows Cross Site Request Forgery. This issue affects Simple calendar for Elementor: from n/a through 1.6.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/simple-calendar-for-elementor/vulnerability/wordpress-simple-calendar-for-elementor-1-6-4-cross-site-reques
press/plugin/simple-calendar-for-elementor/vulnerability/wordpress-simple-calendar-for-elementor-1-6-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-46250 State: PUBLISHED Published: 2025-04-22T09:53:33.170Z Last Updated: 2025-04-22T13:42:18.574Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Vikas Ratudi Products: VForm Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vikas Ratudi VForm allows Stored XSS. This issue affects VForm: from n/a through 3.1.14. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/v-form/vulnerability/wordpress-vform-3-1-14-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-46251 State: PUBLISHED Published: 2025-04-22T09:53:33.910Z Last Updated: 2025-04-22T13:40:45.588Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: e4jvikwp Products: VikRestaurants Table Reservations and Take-Away Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikRestaurants Table Reservations and Take-Away allows Cross Site Request Forgery. This issue affects VikRestaurants Table Reservations and Take-Away: from n/a through 1.3.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/vikrestaurants/vulnerability/wordpress-vikrestaurants
nt: References: - https://patchstack.com/database/wordpress/plugin/vikrestaurants/vulnerability/wordpress-vikrestaurants-table-reservations-and-take-away-plugin-1-3-3-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-46252 State: PUBLISHED Published: 2025-04-22T09:53:34.550Z Last Updated: 2025-04-22T13:39:23.124Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: kofimokome Products: Message Filter for Contact Form 7 Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kofimokome Message Filter for Contact Form 7 allows SQL Injection. This issue affects Message Filter for Contact Form 7: from n/a through 1.6.3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/cf7-message-filter/vulnerability/wordpress-message-f
ent: References: - https://patchstack.com/database/wordpress/plugin/cf7-message-filter/vulnerability/wordpress-message-filter-for-contact-form-7-plugin-1-6-3-2-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-46253 State: PUBLISHED Published: 2025-04-22T09:53:35.152Z Last Updated: 2025-04-22T13:34:28.763Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Ataur R Products: GutenKit Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ataur R GutenKit allows Stored XSS. This issue affects GutenKit: from n/a through 2.2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/gutenkit-blocks-addon/vulnerability/wordpress-gutenkit-plugin-2-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-46254 State: PUBLISHED Published: 2025-04-22T09:53:35.769Z Last Updated: 2025-04-22T13:28:53.272Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Visual Composer Products: Visual Composer Website Builder Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visual Composer Visual Composer Website Builder allows Stored XSS. This issue affects Visual Composer Website Builder: from n/a through 45.10.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/visualcomposer/vulnerability/wordpress-visual-com
chment: References: - https://patchstack.com/database/wordpress/plugin/visualcomposer/vulnerability/wordpress-visual-composer-website-builder-plugin-45-10-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-46257 State: PUBLISHED Published: 2025-06-05T17:35:20.616Z Last Updated: 2025-06-05T17:53:05.827Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: BdThemes Products: Element Pack Pro Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in BdThemes Element Pack Pro allows Cross Site Request Forgery.This issue affects Element Pack Pro: from n/a before 8.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/bdthemes-element-pack/vulnerability/wordpress-element-pack-pro-plugin-7-18-12-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-46258 State: PUBLISHED Published: 2025-06-05T17:36:05.036Z Last Updated: 2025-06-05T17:50:45.267Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: BdThemes Products: Element Pack Pro Problem Types: CWE-862 Description: Missing Authorization vulnerability in BdThemes Element Pack Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Element Pack Pro: from n/a before 8.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/bdthemes-element-pack/vulnerability/wordpress-element-pack-pro-plugin-7-18-12-broken-access-control-vulnerability?_s_id=
bdthemes-element-pack/vulnerability/wordpress-element-pack-pro-plugin-7-18-12-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-46259 State: PUBLISHED Published: 2025-07-01T19:10:23.281Z Last Updated: 2025-07-01T19:35:27.142Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: POSIMYTH Innovation Products: The Plus Addons for Elementor Pro Problem Types: CWE-862 Description: Missing Authorization vulnerability in POSIMYTH Innovation The Plus Addons for Elementor Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Plus Addons for Elementor Pro: from n/a before 6.3.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/theplus_elementor_addon/vulnerability/wordpress
richment: References: - https://patchstack.com/database/wordpress/plugin/theplus_elementor_addon/vulnerability/wordpress-the-plus-addons-for-elementor-pro-plugin-6-1-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-46260 State: PUBLISHED Published: 2025-04-24T16:08:28.044Z Last Updated: 2025-04-25T14:10:30.503Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: wowDevs Products: Sky Addons for Elementor Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wowDevs Sky Addons for Elementor allows Stored XSS. This issue affects Sky Addons for Elementor: from n/a through 3.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/sky-elementor-addons/vulnerability/wordpress-sky-addons-for-elementor-plugin-3-0-1-cross
k.com/database/wordpress/plugin/sky-elementor-addons/vulnerability/wordpress-sky-addons-for-elementor-plugin-3-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-46261 State: PUBLISHED Published: 2025-04-24T16:08:27.421Z Last Updated: 2025-04-25T14:10:37.418Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Craig Hewitt Products: Seriously Simple Podcasting Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Craig Hewitt Seriously Simple Podcasting allows Stored XSS. This issue affects Seriously Simple Podcasting: from n/a through 3.9.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/seriously-simple-podcasting/vulnerability/wordpress-seriously-simple-
- https://patchstack.com/database/wordpress/plugin/seriously-simple-podcasting/vulnerability/wordpress-seriously-simple-podcasting-plugin-3-9-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-46262 State: PUBLISHED Published: 2025-05-19T17:06:23.877Z Last Updated: 2025-05-20T13:12:27.848Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Zack Katz Products: Mad Mimi for WordPress Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zack Katz Mad Mimi for WordPress allows Stored XSS.This issue affects Mad Mimi for WordPress: from n/a through 1.5.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/mad-mimi/vulnerability/wordpress-mad-mimi-for-wordpress-plugin-1-5-1-cross-site-scripting-x
om/database/wordpress/plugin/mad-mimi/vulnerability/wordpress-mad-mimi-for-wordpress-plugin-1-5-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-46263 State: PUBLISHED Published: 2025-05-19T17:05:18.843Z Last Updated: 2025-05-20T13:12:45.226Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Lloyd Saunders Products: Author Box After Posts Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lloyd Saunders Author Box After Posts allows Stored XSS.This issue affects Author Box After Posts: from n/a through 1.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/author-box-after-posts/vulnerability/wordpress-author-box-after-posts-plugin-1-6-cr
hstack.com/database/wordpress/plugin/author-box-after-posts/vulnerability/wordpress-author-box-after-posts-plugin-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-46264 State: PUBLISHED Published: 2025-04-24T16:08:30.311Z Last Updated: 2025-04-25T13:57:34.553Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Angelo Mandato Products: PowerPress Podcasting Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Angelo Mandato PowerPress Podcasting allows Upload a Web Shell to a Web Server. This issue affects PowerPress Podcasting: from n/a through 11.12.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/powerpress/vulnerability/wordpress-powerpress-podcasting-11-12-7-arbitrary-file-upload-vuln
om/database/wordpress/plugin/powerpress/vulnerability/wordpress-powerpress-podcasting-11-12-7-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2025-46265 State: PUBLISHED Published: 2025-05-07T22:04:08.759Z Last Updated: 2025-05-08T12:59:36.892Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: F5 Products: F5OS - Appliance, F5OS - Chassis Problem Types: CWE-863 Description: On F5OS, an improper authorization vulnerability exists where remotely authenticated users (LDAP, RADIUS, TACACS+) may be authorized with higher privilege F5OS roles. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000139503
CVE ID: CVE-2025-46267 State: PUBLISHED Published: 2025-07-22T09:30:21.865Z Last Updated: 2025-07-22T19:52:13.258Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) Vendors: ELECOM CO.,LTD. Products: WRC-BE36QS-B, WRC-W701-B Problem Types: CWE-912 Description: Hidden functionality issue exists in WRC-BE36QS-B and WRC-W701-B. If exploited, the product's hidden debug function may be enabled by a remote attacker who can log in to WebGUI. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.elecom.co.jp/news/security/20250722-01/ - https://jvn.jp/en/vu/JVNVU91615135/
CVE ID: CVE-2025-46269 State: PUBLISHED Published: 2025-08-18T21:11:06.067Z Last Updated: 2025-08-19T13:27:38.912Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Ashlar-Vellum Products: Cobalt, Xenon, Argon, Lithium, Cobalt Share Problem Types: CWE-122 Description: In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplied data when parsing VC6 files. This could lead to a heap-based buffer overflow. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichmen
bility to execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-224-01
CVE ID: CVE-2025-46271 State: PUBLISHED Published: 2025-04-24T22:53:51.447Z Last Updated: 2025-04-25T16:02:24.642Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Planet Technology Products: UNI-NMS-Lite Problem Types: CWE-78 Description: UNI-NMS-Lite is vulnerable to a command injection attack that could allow an unauthenticated attacker to read or manipulate device data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-114-06
CVE ID: CVE-2025-46272 State: PUBLISHED Published: 2025-04-24T22:56:13.381Z Last Updated: 2025-04-25T15:59:56.581Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Planet Technology Products: WGS-804HPT-V2, WGS-4215-8T2S Problem Types: CWE-78 Description: WGS-80HPT-V2 and WGS-4215-8T2S are vulnerable to a command injection attack that could allow an unauthenticated attacker to execute OS commands on the host system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-114-06
CVE ID: CVE-2025-46273 State: PUBLISHED Published: 2025-04-24T22:57:21.868Z Last Updated: 2025-04-25T15:57:47.239Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Planet Technology Products: UNI-NMS-Lite Problem Types: CWE-798 Description: UNI-NMS-Lite uses hard-coded credentials that could allow an unauthenticated attacker to gain administrative privileges to all UNI-NMS managed devices. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-114-06
CVE ID: CVE-2025-46274 State: PUBLISHED Published: 2025-04-24T22:57:55.619Z Last Updated: 2025-04-25T15:24:43.875Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Planet Technology Products: UNI-NMS-Lite Problem Types: CWE-798 Description: UNI-NMS-Lite uses hard-coded credentials that could allow an unauthenticated attacker to read, manipulate and create entries in the managed database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-114-06
CVE ID: CVE-2025-46275 State: PUBLISHED Published: 2025-04-24T22:58:52.561Z Last Updated: 2025-04-25T16:02:47.621Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Planet Technology Products: WGS-804HPT-V2, WGS-4215-8T2S Problem Types: CWE-306 Description: WGS-80HPT-V2 and WGS-4215-8T2S are missing authentication that could allow an attacker to create an administrator account without knowing any existing credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-114-06
CVE ID: CVE-2025-46326 State: PUBLISHED Published: 2025-04-28T22:33:01.627Z Last Updated: 2025-04-29T13:42:11.360Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: snowflakedb Products: snowflake-connector-net Problem Types: CWE-367 Description: snowflake-connector-net is the Snowflake Connector for .NET. Versions starting from 2.1.2 to before 4.4.1, are vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition. When using the Easy Logging feature on Linux and macOS, the Connector reads logging configuration from a user-provided file. On Linux and macOS, the Connector verifies that the configuration file can be written to only by its owner. That check
. On Linux and macOS, the Connector verifies that the configuration file can be written to only by its owner. That check was vulnerable to a TOCTOU race condition and failed to verify that the file owner matches the user running the Connector. This could allow a local attacker with write access to the configuration file or the directory containing it to overwrite the configuration and gain control over logging level and output location. This issue has been patched in version 4.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/snowflakedb/snowflake-connector-net/security/advisories/GHSA-c82r-c9f7-f5mj - https://github.com/snowflakedb/snowflake-connector-
db/snowflake-connector-net/security/advisories/GHSA-c82r-c9f7-f5mj - https://github.com/snowflakedb/snowflake-connector-net/commit/393aad3cfa81045a05dd488944db45256e861bff - https://github.com/snowflakedb/snowflake-connector-net/releases/tag/v4.4.1