Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.293911 - https://vuldb.com/?ctiid.293911 - https://vuldb.com/?submit.483340 - https://github.com/Rain1er/report/blob/main/CDG/appDetail_1.md
CVE ID: CVE-2025-0788 State: PUBLISHED Published: 2025-01-28T22:31:04.084Z Last Updated: 2025-01-29T14:19:39.278Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: ESAFENET Products: CDG Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in ESAFENET CDG V5. It has been rated as critical. Affected by this issue is some unknown functionality of the file /content_top.jsp. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
cted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.293912 - https://vuldb.com/?ctiid.293912 - https://vuldb.com/?submit.483341 - https://github.com/Rain1er/report/blob/main/CDG/content_top.md
CVE ID: CVE-2025-0789 State: PUBLISHED Published: 2025-01-28T23:00:15.836Z Last Updated: 2025-01-29T14:18:57.964Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: ESAFENET Products: CDG Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in ESAFENET CDG V5. This affects an unknown part of the file /doneDetail.jsp. The manipulation of the argument flowId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
out this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.293913 - https://vuldb.com/?ctiid.293913 - https://vuldb.com/?submit.483342 - https://github.com/Rain1er/report/blob/main/CDG/doneDetail.md
CVE ID: CVE-2025-0790 State: PUBLISHED Published: 2025-01-28T23:31:04.373Z Last Updated: 2025-01-29T14:18:13.535Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: ESAFENET Products: CDG Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic was found in ESAFENET CDG V5. This vulnerability affects unknown code of the file /doneDetail.jsp. The manipulation of the argument curpage leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
ly about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.293914 - https://vuldb.com/?ctiid.293914 - https://vuldb.com/?submit.483343 - https://github.com/Rain1er/report/blob/main/CDG/doneDetail_1.md
CVE ID: CVE-2025-0791 State: PUBLISHED Published: 2025-01-28T23:31:05.919Z Last Updated: 2025-01-29T14:17:25.182Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: ESAFENET Products: CDG Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in ESAFENET CDG V5. This issue affects some unknown processing of the file /sdDoneDetail.jsp. The manipulation of the argument flowId leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment:
contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.293915 - https://vuldb.com/?ctiid.293915 - https://vuldb.com/?submit.483344 - https://github.com/Rain1er/report/blob/main/CDG/sdDoneDetail.md
CVE ID: CVE-2025-0792 State: PUBLISHED Published: 2025-01-29T00:00:16.765Z Last Updated: 2025-01-29T14:11:54.150Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: ESAFENET Products: CDG Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in ESAFENET CDG V5. Affected is an unknown function of the file /sdTodoDetail.jsp. The manipulation of the argument flowId leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
d early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.293916 - https://vuldb.com/?ctiid.293916 - https://vuldb.com/?submit.483345 - https://github.com/Rain1er/report/blob/main/CDG/sdTodoDetail.md
CVE ID: CVE-2025-0793 State: PUBLISHED Published: 2025-01-29T00:31:04.067Z Last Updated: 2025-01-29T14:02:29.518Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: ESAFENET Products: CDG Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in ESAFENET CDG V5 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /todoDetail.jsp. The manipulation of the argument flowId leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrich
was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.293917 - https://vuldb.com/?ctiid.293917 - https://vuldb.com/?submit.483346 - https://github.com/Rain1er/report/blob/main/CDG/todoDetail.md
CVE ID: CVE-2025-0794 State: PUBLISHED Published: 2025-01-29T00:31:05.612Z Last Updated: 2025-02-12T20:41:36.489Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: ESAFENET Products: CDG Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in ESAFENET CDG V5 and classified as problematic. Affected by this issue is some unknown functionality of the file /todoDetail.jsp. The manipulation of the argument curpage leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichme
as contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.293918 - https://vuldb.com/?ctiid.293918 - https://vuldb.com/?submit.483347 - https://github.com/Rain1er/report/blob/main/CDG/todoDetail_1.md
CVE ID: CVE-2025-0795 State: PUBLISHED Published: 2025-01-29T01:00:16.263Z Last Updated: 2025-02-12T19:51:16.189Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: ESAFENET Products: CDG Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in ESAFENET CDG V5. It has been classified as problematic. This affects an unknown part of the file /todolistjump.jsp. The manipulation of the argument flowId leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment:
contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.293919 - https://vuldb.com/?ctiid.293919 - https://vuldb.com/?submit.483349 - https://github.com/Rain1er/report/blob/main/CDG/todolistjump.md
CVE ID: CVE-2025-0796 State: PUBLISHED Published: 2025-02-18T04:21:13.763Z Last Updated: 2025-02-18T15:17:09.681Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: kevin-brent Products: Mortgage Lead Capture System Problem Types: CWE-352 Description: The Mortgage Lead Capture System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.2.10. This is due to missing or incorrect nonce validation on the 'wprequal_reset_defaults' action. This makes it possible for unauthenticated attackers to reset the plugin's settings via a forged request granted they can trick a site administrator into performing an action such
et the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/316b807c-06ca-4448-acb9-80766a07258a?source=cve - https://wordpress.org/plugins/wprequal/
CVE ID: CVE-2025-0797 State: PUBLISHED Published: 2025-01-29T01:00:17.874Z Last Updated: 2025-02-12T19:51:16.070Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: MicroWorld Products: eScan Antivirus Problem Types: CWE-276, CWE-266 Description: A vulnerability was found in MicroWorld eScan Antivirus 7.0.32 on Linux. It has been declared as problematic. This vulnerability affects unknown code of the file /var/Microworld/ of the component Quarantine Handler. The manipulation leads to incorrect default permissions. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this discl
d locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.293920 - https://vuldb.com/?ctiid.293920 - https://vuldb.com/?submit.484329 - https://github.com/dmknght/FIS_RnD/blob/main/escan_av_incorrect_default_perms_leads_to_malware_evasion.md
CVE ID: CVE-2025-0798 State: PUBLISHED Published: 2025-01-29T01:31:03.976Z Last Updated: 2025-02-12T19:51:15.958Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: MicroWorld Products: eScan Antivirus Problem Types: CWE-78, CWE-77 Description: A vulnerability was found in MicroWorld eScan Antivirus 7.0.32 on Linux. It has been rated as critical. This issue affects some unknown processing of the file rtscanner of the component Quarantine Handler. The manipulation leads to os command injection. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public an
of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.293921 - https://vuldb.com/?ctiid.293921 - https://vuldb.com/?submit.484718 - https://github.com/dmknght/FIS_RnD/blob/main/escan_rtscanner_rce.md
CVE ID: CVE-2025-0799 State: PUBLISHED Published: 2025-02-06T00:24:40.878Z Last Updated: 2025-02-22T22:16:23.189Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: IBM Products: IBM App Connect Enterprise Problem Types: CWE-22 Description: IBM App Connect enterprise 12.0.1.0 through 12.0.12.10 and 13.0.1.0 through 13.0.2.1 could allow an authenticated user to write to an arbitrary file on the system during bar configuration deployment due to improper pathname limitations on restricted directories. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7182418
CVE ID: CVE-2025-0800 State: PUBLISHED Published: 2025-01-29T01:31:05.836Z Last Updated: 2025-02-12T19:51:15.855Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: SourceCodester Products: Online Courseware Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic has been found in SourceCodester Online Courseware 1.0. Affected is an unknown function of the file /pcci/admin/saveeditt.php of the component Edit Teacher. The manipulation of the argument fname leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.293922 - https://vuldb.com/?ctiid.293922 - https://vuldb.com/?submit.484935 - https://www.sourcecodester.com/
CVE ID: CVE-2025-0801 State: PUBLISHED Published: 2025-02-28T04:21:57.065Z Last Updated: 2025-02-28T15:14:01.351Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: ratemyagent Products: RateMyAgent Official Problem Types: CWE-352 Description: The RateMyAgent Official plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This is due to missing or incorrect nonce validation on the 'rma-settings-wizard'. This makes it possible for unauthenticated attackers to update the plugin's API key via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Addi
a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b559017c-f1d2-4f18-bfb6-e52f05910e34?source=cve - https://wordpress.org/plugins/ratemyagent-official/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3244718%40ratemyagent-official&new=3244718%40ratemyagent-official&sfp_email=&sfph_mail=
CVE ID: CVE-2025-0802 State: PUBLISHED Published: 2025-01-29T02:00:14.351Z Last Updated: 2025-02-12T19:51:15.628Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Best Employee Management System Problem Types: CWE-284, CWE-266 Description: A vulnerability classified as critical was found in SourceCodester Best Employee Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/View_user.php of the component Administrative Endpoint. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA A
n be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.293923 - https://vuldb.com/?ctiid.293923 - https://vuldb.com/?submit.485005 - https://github.com/theanm0l/VulnDB/blob/main/Improper%20Authorization.md - https://www.sourcecodester.com/
CVE ID: CVE-2025-0803 State: PUBLISHED Published: 2025-01-29T02:00:16.161Z Last Updated: 2025-02-12T19:51:15.520Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Codezips Products: Gym Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in Codezips Gym Management System 1.0. Affected by this issue is some unknown functionality of the file /dashboard/admin/submit_plan_new.php. The manipulation of the argument planid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https
has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.293924 - https://vuldb.com/?ctiid.293924 - https://vuldb.com/?submit.485218 - https://github.com/alc9700jmo/CVE/issues/8
CVE ID: CVE-2025-0804 State: PUBLISHED Published: 2025-01-29T03:21:23.753Z Last Updated: 2025-02-12T19:51:15.237Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: flowdee Products: ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages Problem Types: CWE-79 Description: The ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via link titles in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level
ient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bf41b5e1-610e-4159-9325-f7a694380050?source=cve - https://plugins.trac.wordpress.org/changeset/3219341/clickwhale/tags/2.4.2/includes/admin/links/Clickwhale_Links_List_Table.php
CVE ID: CVE-2025-0805 State: PUBLISHED Published: 2025-02-18T04:21:11.384Z Last Updated: 2025-02-18T15:18:51.271Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: mlcalc Products: Mortgage Calculator / Loan Calculator Problem Types: CWE-79 Description: The Mortgage Calculator / Loan Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mlcalc' shortcode in all versions up to, and including, 1.5.20 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages tha
sible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1a8ca426-34cd-4c98-ae24-f3f31a7fcae5?source=cve - https://plugins.trac.wordpress.org/browser/mortgage-loan-calculator/tags/1.5.20/mlcalc.php#L62 - https://plugins.trac.wordpress.org/browser/mortgage-loan-calculator/tags/1.5.20/en/forms.inc.php
CVE ID: CVE-2025-0806 State: PUBLISHED Published: 2025-01-29T02:31:04.245Z Last Updated: 2025-02-12T19:51:15.369Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: code-projects Products: Job Recruitment Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in code-projects Job Recruitment 1.0. It has been rated as problematic. This issue affects some unknown processing of the file _call_job_search_ajax.php. The manipulation of the argument job_type leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.2939
the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.293903 - https://vuldb.com/?ctiid.293903 - https://vuldb.com/?submit.490056 - https://github.com/1337g/CVE-2025-X/blob/main/xss-1_27.md - https://code-projects.org/
CVE ID: CVE-2025-0807 State: PUBLISHED Published: 2025-03-22T06:41:10.272Z Last Updated: 2025-03-24T15:13:36.626Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: ashikcse Products: CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts Problem Types: CWE-352 Description: The CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2. This is due to missing or incorrect nonce validation on the cits_settings_tab() function. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request
ab() function. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3772ddad-4960-48c8-904e-2457d12bd01c?source=cve - https://plugins.trac.wordpress.org/browser/cits-support-svg-webp-media-upload/trunk/includes/cits-custom-fonts.php
CVE ID: CVE-2025-0808 State: PUBLISHED Published: 2025-02-12T03:21:38.857Z Last Updated: 2025-02-12T15:03:49.701Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: propertyhive Products: Houzez Property Feed Problem Types: CWE-352 Description: The Houzez Property Feed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.21. This is due to missing or incorrect nonce validation on the "deleteexport" action. This makes it possible for unauthenticated attackers to delete property feed exports via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. A
via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6fd866ac-6094-4f76-9fba-69494381214c?source=cve - https://plugins.trac.wordpress.org/changeset/3235031/houzez-property-feed/trunk/includes/class-houzez-property-feed-export.php
CVE ID: CVE-2025-0809 State: PUBLISHED Published: 2025-01-31T05:22:33.470Z Last Updated: 2025-01-31T16:50:44.759Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: kpgraham Products: Link Fixer Problem Types: CWE-79 Description: The Link Fixer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via broken links in all versions up to, and including, 3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence
a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/37198f2f-2b45-40d3-b4ae-aa94213996bd?source=cve - https://wordpress.org/plugins/permalink-finder/
CVE ID: CVE-2025-0810 State: PUBLISHED Published: 2025-04-05T01:44:44.158Z Last Updated: 2025-04-07T14:12:32.633Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: edmonparker Products: Read More & Accordion Problem Types: CWE-352 Description: The Read More & Accordion plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.4.5. This is due to missing or incorrect nonce validation on the addNewButtons() function. This makes it possible for unauthenticated attackers to include and execute arbitrary PHP files via a forged request granted they can trick a site administrator into performing an action such as clicking