Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-5994 State: PUBLISHED Published: 2025-07-16T14:38:22.738Z Last Updated: 2025-11-03T18:13:56.352Z Vendors: NLnet Labs Products: Unbound Problem Types: CWE-349 Description: A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with ECS support, i.e., '--enable-subnet', AND configured to send ECS information along with queries to upstream name servers, i.e., at least one of the 'send-client-subnet', 'client-subnet-zone' or 'client-subnet-always-forward' options is used. Resolvers supporting ECS need to segregate outgoing queries to accommodat
client-subnet-always-forward' options is used. Resolvers supporting ECS need to segregate outgoing queries to accommodate for different outgoing ECS information. This re-opens up resolvers to a birthday paradox attack (Rebirthday Attack) that tries to match the DNS transaction ID in order to cache non-ECS poisonous replies. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://nlnetlabs.nl/downloads/unbound/CVE-2025-5994.txt
CVE ID: CVE-2025-5995 State: PUBLISHED Published: 2025-06-26T19:13:48.305Z Last Updated: 2025-06-26T19:33:44.616Z Vendors: Canon USA Inc. Products: Canon EOS Webcam Utility Pro Problem Types: CWE-732 Description: Canon EOS Webcam Utility Pro for MAC OS version 2.3d (2.3.29) and earlier contains an improper directory permissions vulnerability. Exploitation of this vulnerability requires administrator access by a malicious user. An attacker could modify the directory, potentially resulting in code execution and ultimately leading to privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usa.canon.com/about-us/to-our-customers/vulnerability-mitigation
tes: - CISA ADP Vulnrichment: References: - https://www.usa.canon.com/about-us/to-our-customers/vulnerability-mitigation-remediation-for-canon-eos-webcam-utility-pro-for-mac-os - https://www.canon-europe.com/psirt/advisory-information
CVE ID: CVE-2025-5996 State: PUBLISHED Published: 2025-06-12T10:02:15.206Z Last Updated: 2025-08-01T17:15:41.215Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-770 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 2.1.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. A lack of input validation in HTTP responses could allow an authenticated user to cause denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/476671 - https://gitlab.com/gitlab-org/gitlab/-/issues/483150 - https://gitlab.com/gi
lab.com/gitlab-org/gitlab/-/issues/476671 - https://gitlab.com/gitlab-org/gitlab/-/issues/483150 - https://gitlab.com/gitlab-org/gitlab/-/issues/479167 - https://gitlab.com/gitlab-org/gitlab/-/issues/483111 - https://gitlab.com/gitlab-org/gitlab/-/issues/498649
CVE ID: CVE-2025-5997 State: PUBLISHED Published: 2025-07-28T11:25:44.208Z Last Updated: 2025-07-28T13:52:33.840Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Beamsec Products: PhishPro Problem Types: CWE-648 Description: Incorrect Use of Privileged APIs vulnerability in Beamsec PhishPro allows Privilege Abuse.This issue affects PhishPro: before 7.5.4.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0181
CVE ID: CVE-2025-5998 State: PUBLISHED Published: 2025-08-14T08:48:54.861Z Last Updated: 2025-08-14T14:49:42.824Z Vendors: Unknown Products: PPWP – Password Protect Pages Problem Types: CWE-280 Improper Handling of Insufficient Permissions or Privileges Description: The PPWP – Password Protect Pages WordPress plugin before version 1.9.11 allows to put the site content behind a password authorization, however users with subscriber or greater roles can view content via the REST API. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/17bad181-6cea-445e-b91c-22415d90743e/
CVE ID: CVE-2025-5999 State: PUBLISHED Published: 2025-08-01T17:38:58.409Z Last Updated: 2025-08-01T18:08:59.605Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: HashiCorp Products: Vault, Vault Enterprise Problem Types: CWE-266 Description: A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s token privileges to Vault’s root policy. Fixed in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11 and 1.16.22. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2025-13-vault-root-namespace-operator-may-elevat
A ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2025-13-vault-root-namespace-operator-may-elevate-token-privileges/76032
CVE ID: CVE-2025-60000 State: PUBLISHED Published: 2025-10-09T16:16:35.897Z Last Updated: 2025-10-09T19:47:09.232Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Juniper Networks Products: Junos Space Problem Types: CWE-79 Description: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Generate Report page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. Additional Analyst Notes: -
CVE ID: CVE-2025-60001 State: PUBLISHED Published: 2025-10-09T16:17:11.512Z Last Updated: 2025-10-09T19:47:02.793Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Juniper Networks Products: Junos Space Problem Types: CWE-79 Description: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Generate Report page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. Additional Analyst Notes: -
CVE ID: CVE-2025-60002 State: PUBLISHED Published: 2025-10-09T16:17:42.287Z Last Updated: 2025-10-09T19:46:56.781Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Juniper Networks Products: Junos Space Problem Types: CWE-79 Description: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Template Definitions page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. Additional Analyst Note
sions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA103140
CVE ID: CVE-2025-60004 State: PUBLISHED Published: 2025-10-09T16:18:27.118Z Last Updated: 2025-10-09T19:46:51.236Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Juniper Networks Products: Junos OS, Junos OS Evolved Problem Types: CWE-754 Description: An Improper Check for Unusual or Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial-Of-Service (DoS). When an affected system receives a specific BGP EVPN update message over an established BGP session, this causes an rpd crash and restart. A BGP EVPN configuration is not n
update message over an established BGP session, this causes an rpd crash and restart. A BGP EVPN configuration is not necessary to be vulnerable. If peers are not configured to send BGP EVPN updates to a vulnerable device, then this issue can't occur. This issue affects iBGP and eBGP, over IPv4 and IPv6. This issue affects: Junos OS: * 23.4 versions from 23.4R2-S3 before 23.4R2-S5, * 24.2 versions from 24.2R2 before 24.2R2-S1, * 24.4 versions before 24.4R1-S3, 24.4R2; Junos OS Evolved: * 23.4-EVO versions from 23.4R2-S2-EVO before 23.4R2-S5-EVO, * 24.2-EVO versions from 24.2R2-EVO before 24.2R2-S1-EVO, * 24.4-EVO versions before 24.4R1-S3-EVO, 24.4R2-EVO. Additional Analyst Notes: - CISA AD
.2R2-EVO before 24.2R2-S1-EVO, * 24.4-EVO versions before 24.4R1-S3-EVO, 24.4R2-EVO. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA103165
CVE ID: CVE-2025-60006 State: PUBLISHED Published: 2025-10-09T16:18:55.227Z Last Updated: 2025-10-10T03:55:26.824Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Juniper Networks Products: Junos OS Evolved Problem Types: CWE-78 Description: Multiple instances of an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the CLI of Juniper Networks Junos OS Evolved could be used to elevate privileges and/or execute unauthorized commands. When an attacker executes crafted CLI commands, the options are processed via a script in some cases. These scripts are not hardened so injected commands might be executed
options are processed via a script in some cases. These scripts are not hardened so injected commands might be executed via the shell, which allows an attacker to perform operations, which they should not be able to do according to their assigned permissions. This issue affects Junos OS Evolved: * 24.2 versions before 24.2R2-S2-EVO, * 24.4 versions before 24.4R2-EVO. This issue does not affect Junos OS Evolved versions earlier than 24.2R1-EVO. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA103163
CVE ID: CVE-2025-60009 State: PUBLISHED Published: 2025-10-09T16:19:53.583Z Last Updated: 2025-10-09T19:46:40.931Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Juniper Networks Products: Junos Space Problem Types: CWE-79 Description: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the CLI Configlet page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. Additional Analyst Notes: - CI
CVE ID: CVE-2025-60010 State: PUBLISHED Published: 2025-10-09T16:20:28.121Z Last Updated: 2025-10-09T19:46:35.043Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Juniper Networks Products: Junos OS, Junos OS Evolved Problem Types: CWE-262 Description: A password aging vulnerability in the RADIUS client of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated, network-based attacker to access the device without enforcing the required password change. Affected devices allow logins by users for whom the RADIUS server has responded with a reject and required the user to change the password as their password was expired. Therefore the policy man
onded with a reject and required the user to change the password as their password was expired. Therefore the policy mandating the password change is not enforced. This does not allow users to login with a wrong password, but only with the correct but expired one. This issue affects: Junos OS: * all versions before 22.4R3-S8, * 23.2 versions before 23.2R2-S4, * 23.4 versions before 23.4R2-S5, * 24.2 versions before 24.2R2-S1, * 24.4 versions before 24.4R1-S3, 24.4R2; Junos OS Evolved: * all versions before 22.4R3-S8-EVO, * 23.2 versions before 23.2R2-S4-EVO, * 23.4 versions before 23.4R2-S5-EVO, * 24.2 versions before 24.2R2-S1-EVO, * 24.4 versions before 24.4R1-S3-EVO, 24.4R2-EVO. Additiona
before 23.4R2-S5-EVO, * 24.2 versions before 24.2R2-S1-EVO, * 24.4 versions before 24.4R1-S3-EVO, 24.4R2-EVO. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA103168
CVE ID: CVE-2025-60013 State: PUBLISHED Published: 2025-10-15T13:55:50.753Z Last Updated: 2025-10-16T03:56:42.914Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L) Vendors: F5 Products: F5OS - Appliance Problem Types: CWE-78 Description: When a user attempts to initialize the rSeries FIPS module using a password with special shell metacharacters, the FIPS hardware security module (HSM) may fail to initialize. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000154661
CVE ID: CVE-2025-60015 State: PUBLISHED Published: 2025-10-15T13:55:56.293Z Last Updated: 2025-10-16T03:56:44.432Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: F5OS - Appliance, F5OS - Chassis Problem Types: CWE-787 Description: An out-of-bounds write vulnerability exists in F5OS-A and F5OS-C that could lead to memory corruption. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000156796
CVE ID: CVE-2025-60016 State: PUBLISHED Published: 2025-10-15T13:55:44.110Z Last Updated: 2025-10-16T03:56:24.906Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP, BIG-IP Next SPK, BIG-IP Next CNF Problem Types: CWE-119 Description: When Diffie-Hellman (DH) group Elliptic Curve Cryptography (ECC) Brainpool curves are configured in an SSL profile's Cipher Rule or Cipher Group, and that profile is applied to a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vuln
versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000139514
CVE ID: CVE-2025-60017 State: PUBLISHED Published: 2025-09-26T00:00:00.000Z Last Updated: 2025-09-26T19:17:06.504Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H) Vendors: Unitree Products: Go2, G1, H1, B2 Problem Types: CWE-78 Description: Unitree Go2, G1, H1, and B2 devices through 2025-09-20 allow root OS command injection via the hostapd_restart.sh wifi_ssid or wifi_pass parameter (within restart_wifi_ap and restart_wifi_sta). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://spectrum.ieee.org/unitree-robot-exploit - https://github.com/Bin4ry/UniPwn - https://news.ycombinator.com/item?id=45381590
CVE ID: CVE-2025-60018 State: PUBLISHED Published: 2025-09-25T15:52:57.588Z Last Updated: 2025-11-21T07:34:25.553Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-125 Description: glib-networking's OpenSSL backend fails to properly check the return value of a call to BIO_write(), resulting in an out of bounds read. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-60018 - https://bugzilla.redhat.com/show_bug.cgi?id=2398135
eferences: - https://access.redhat.com/security/cve/CVE-2025-60018 - https://bugzilla.redhat.com/show_bug.cgi?id=2398135 - https://gitlab.gnome.org/GNOME/glib-networking/-/issues/226
CVE ID: CVE-2025-60019 State: PUBLISHED Published: 2025-09-25T15:53:02.569Z Last Updated: 2025-11-21T07:34:34.672Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-476 Description: glib-networking's OpenSSL backend fails to properly check the return value of memory allocation routines. An out of memory condition could potentially result in writing to an invalid memory location. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025
cation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-60019 - https://bugzilla.redhat.com/show_bug.cgi?id=2398140 - https://gitlab.gnome.org/GNOME/glib-networking/-/issues/227
CVE ID: CVE-2025-60020 State: PUBLISHED Published: 2025-09-24T00:00:00.000Z Last Updated: 2025-09-24T14:05:06.978Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: NNCP Products: NNCP Problem Types: CWE-23 Description: nncp before 8.12.0 allows path traversal (for reading or writing) during freqing and file saving via a crafted path in packet data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://www.nncpgo.org/Release-8_005f12_005f0.html - http://lists.cypherpunks.su/archive/nncp-devel/CAO-d-4riai9EZx4gVfekow-BCtTn07k8BB1ZdsopPVw=scWD1A@mail.gmail.com/T/#md678a00df1020bb811f47f42ef33c54b789cddd7
CVE ID: CVE-2025-60022 State: PUBLISHED Published: 2025-11-17T05:51:23.460Z Last Updated: 2025-11-17T16:36:39.305Z Severity: MEDIUM (CVSS 4.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: KDDI CORPORATION Products: 'デジラアプリ' App for iOS Problem Types: CWE-295 Description: Improper certificate validation vulnerability exists in 'デジラアプリ' App for iOS prior to ver.80.10.00. If this vulnerability is exploited, a man-in-the-middle attack may allow an attacker to eavesdrop on and/or tamper with an encrypted communication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jvn.jp/en/jp/JVN54005037/
CVE ID: CVE-2025-60023 State: PUBLISHED Published: 2025-10-23T22:21:05.084Z Last Updated: 2025-10-24T14:27:12.716Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: AutomationDirect Products: Productivity Suite, Productivity 3000 P3-622 CPU, Productivity 3000 P3-550E CPU, Productivity 3000 P3-530 CPU, Productivity 2000 P2-622 CPU, Productivity 2000 P2-550 CPU, Productivity 1000 P1-550 CPU, Productivity 1000 P1-540 CPU Problem Types: CWE-23 Description: A relative path traversal vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allows an unauthenticated remote attacker to interact with the ProductivityService PLC simu
4.4.1.19. The vulnerability allows an unauthenticated remote attacker to interact with the ProductivityService PLC simulator and delete arbitrary directories on the target machine. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-296-01 - https://www.automationdirect.com/support/software-downloads - https://support.automationdirect.com/docs/securityconsiderations.pdf - https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-296-01.json
CVE ID: CVE-2025-60026 State: REJECTED Published: N/A Last Updated: 2025-09-26T02:55:09.365Z Description: No description available.
CVE ID: CVE-2025-60027 State: REJECTED Published: N/A Last Updated: 2025-09-26T02:55:08.842Z Description: No description available.
CVE ID: CVE-2025-60028 State: REJECTED Published: N/A Last Updated: 2025-09-26T02:55:08.364Z Description: No description available.
CVE ID: CVE-2025-60029 State: REJECTED Published: N/A Last Updated: 2025-09-26T02:55:07.855Z Description: No description available.
CVE ID: CVE-2025-60030 State: REJECTED Published: N/A Last Updated: 2025-09-26T02:55:07.356Z Description: No description available.
CVE ID: CVE-2025-60031 State: REJECTED Published: N/A Last Updated: 2025-09-26T02:55:06.856Z Description: No description available.
CVE ID: CVE-2025-60032 State: REJECTED Published: N/A Last Updated: 2025-09-26T02:55:06.400Z Description: No description available.
CVE ID: CVE-2025-60033 State: REJECTED Published: N/A Last Updated: 2025-09-26T02:55:05.894Z Description: No description available.
CVE ID: CVE-2025-60039 State: PUBLISHED Published: 2025-10-22T14:32:39.926Z Last Updated: 2025-11-13T10:33:43.659Z Vendors: rascals Products: Noisa Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in rascals Noisa noisa allows Object Injection.This issue affects Noisa: from n/a through <= 2.6.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/noisa/vulnerability/wordpress-noisa-theme-2-6-0-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-60040 State: PUBLISHED Published: 2025-09-26T08:31:15.616Z Last Updated: 2025-09-29T16:35:00.517Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: fkrauthan Products: wp-mpdf Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fkrauthan wp-mpdf allows Stored XSS. This issue affects wp-mpdf: from n/a through 3.9.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-mpdf/vulnerability/wordpress-wp-mpdf-plugin-3-9-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-60041 State: PUBLISHED Published: 2025-10-22T14:32:40.107Z Last Updated: 2025-11-13T10:33:44.534Z Vendors: Iulia Cazan Products: Emails Catch All Problem Types: CWE-288 Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in Iulia Cazan Emails Catch All emails-catch-all allows Password Recovery Exploitation.This issue affects Emails Catch All: from n/a through <= 3.5.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/emails-catch-all/vulnerability/wordpress-emails-catch-all-plugin-3-5-3-broken-authentication-vulnerability?_s_id=cve
CVE ID: CVE-2025-60073 State: PUBLISHED Published: 2025-11-06T15:54:42.201Z Last Updated: 2025-11-17T16:11:04.447Z Vendors: Processby Products: Responsive Sidebar Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Processby Responsive Sidebar responsive-sidebar allows PHP Local File Inclusion.This issue affects Responsive Sidebar: from n/a through <= 1.2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/responsive-sidebar/vulnerability/wordpress-responsive-sidebar-plugin-1-2-2-local-file-inclusion-vulnerability?_s_id=c
in/responsive-sidebar/vulnerability/wordpress-responsive-sidebar-plugin-1-2-2-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-60074 State: PUBLISHED Published: 2025-11-06T15:54:43.533Z Last Updated: 2025-11-13T10:33:44.488Z Vendors: Processby Products: Lazy Load Optimizer Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Processby Lazy Load Optimizer lazy-load-optimizer allows PHP Local File Inclusion.This issue affects Lazy Load Optimizer: from n/a through <= 1.4.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/lazy-load-optimizer/vulnerability/wordpress-lazy-load-optimizer-plugin-1-4-7-local-file-inclusion-vulnerability?_
Plugin/lazy-load-optimizer/vulnerability/wordpress-lazy-load-optimizer-plugin-1-4-7-local-file-inclusion-vulnerability?_s_id=cve