Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-12508 State: PUBLISHED Published: 2025-10-31T15:49:54.429Z Last Updated: 2025-10-31T17:44:27.867Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: Bizerba Products: BRAIN2 Problem Types: CWE-319 Description: When using domain users as BRAIN2 users, communication with Active Directory services is unencrypted. This can lead to the interception of authentication data and compromise confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.bizerba.com/downloads/global/information-security/2025/bizerba-sa-2025-0006.pdf
CVE ID: CVE-2025-12509 State: PUBLISHED Published: 2025-10-31T15:51:25.120Z Last Updated: 2025-10-31T17:43:51.160Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: Bizerba Products: BRAIN2 Problem Types: CWE-829 Description: On a client with an admin user, a Global_Shipping script can be implemented. The script could later be executed on the BRAIN2 server with administrator rights. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.bizerba.com/downloads/global/information-security/2025/bizerba-sa-2025-0007.pdf
CVE ID: CVE-2025-12515 State: PUBLISHED Published: 2025-10-30T15:38:45.150Z Last Updated: 2025-10-30T17:27:30.155Z Vendors: Azure Access Technology Products: BLU-IC2, BLU-IC4 Problem Types: CWE-394 Description: Systemic Internal Server Errors - HTTP 500 ResponseThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://azure-access.com/security-advisories
CVE ID: CVE-2025-12516 State: PUBLISHED Published: 2025-10-30T15:42:21.656Z Last Updated: 2025-10-30T17:24:46.054Z Vendors: Azure Access Technology Products: BLU-IC2, BLU-IC4 Problem Types: CWE-394 Description: Lack of Graceful Error Handling - HTTP 5xx ErrorThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://azure-access.com/security-advisories
CVE ID: CVE-2025-12517 State: PUBLISHED Published: 2025-10-30T15:47:04.209Z Last Updated: 2025-10-30T16:24:57.181Z Vendors: Azure Access Technology Products: BLU-IC2, BLU-IC4 Problem Types: CWE-448 Description: Credits Page not Matching Versions in Use in the FirmwareThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://azure-access.com/security-advisories
CVE ID: CVE-2025-12520 State: PUBLISHED Published: 2025-11-07T05:29:57.900Z Last Updated: 2025-11-07T13:25:00.440Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: jgwhite33 Products: WP Airbnb Review Slider Problem Types: CWE-79 Description: The WP Airbnb Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.2 due to insufficient URL validation that allows users to pull in a malicious HTML file. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses
trator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6082f25f-b060-431b-a18c-65899851bf3b?source=cve - https://plugins.trac.wordpress.org/changeset?old_path=/wp-airbnb-review-slider/tags/4.2&new_path=/wp-airbnb-review-slider/tags/4.3&sfp_email=&sfph_mail= - https://cyberresearchhub.com/cve-2025-12520/ - https://cyberresearchhub.com/
CVE ID: CVE-2025-12521 State: PUBLISHED Published: 2025-10-31T13:48:35.882Z Last Updated: 2025-11-03T14:22:19.957Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Analytify Products: Analytify Pro Problem Types: CWE-200 Description: The Analytify Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.0.3 via the Analytify Tag HTML details. This makes it possible for unauthenticated attackers to extract usernames from source code. While we generally do not assign CVE IDs to username exposure issues, this vendor has specifically requested we consider it a vulnerability. Additional Analyst Notes: - CISA
xposure issues, this vendor has specifically requested we consider it a vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/47f57e90-94c9-4c9c-8700-bf591f6539ec?source=cve - https://analytify.io/
CVE ID: CVE-2025-12524 State: PUBLISHED Published: 2025-11-18T06:43:09.582Z Last Updated: 2025-11-18T16:35:04.840Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: johnjamesjacoby Products: Post Type Switcher Problem Types: CWE-639 Description: The Post Type Switcher plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.0 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to modify the post type of arbitrary posts and pages they do not own, including those created by administrators, which can lead to site disruption,
rbitrary posts and pages they do not own, including those created by administrators, which can lead to site disruption, broken navigation, and SEO impact. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d875514c-c7d3-4236-842b-6e772048448d?source=cve - https://plugins.trac.wordpress.org/browser/post-type-switcher/tags/4.0.0/post-type-switcher.php#L469 - https://plugins.trac.wordpress.org/browser/post-type-switcher/tags/4.0.0/post-type-switcher.php#L486 - https://cwe.mitre.org/data/definitions/639.html - https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/ - https://plugins.trac.wordp
l - https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3391983%40post-type-switcher%2Ftrunk&old=3331072%40post-type-switcher%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2025-12525 State: PUBLISHED Published: 2025-11-25T07:28:22.250Z Last Updated: 2025-11-25T07:28:22.250Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: appglut Products: Locker Content Problem Types: CWE-200 Description: The Locker Content plugin for WordPress is vulnerable to Sensitive Information Exposure in version 1.0.0 via the 'lockerco_submit_post' AJAX endpoint. This makes it possible for unauthenticated attackers to extract content from posts that has been protected by the plugin. References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/927f94b0-2a5d-4d17-a05b-7940d7976158?source=cve - https://wordpress.org/plugins/locker-co
hreat-intel/vulnerabilities/id/927f94b0-2a5d-4d17-a05b-7940d7976158?source=cve - https://wordpress.org/plugins/locker-content/
CVE ID: CVE-2025-12526 State: PUBLISHED Published: 2025-11-11T03:30:45.346Z Last Updated: 2025-11-12T20:05:56.989Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: michielve Products: Private Google Calendars Problem Types: CWE-862 Description: The Private Google Calendars plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pgc_remove' action in all versions up to, and including, 20250811. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the plugin's settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.c
to reset the plugin's settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/900294ef-dedb-49d3-b544-eae64399ea03?source=cve - https://wordpress.org/plugins/private-google-calendars/
CVE ID: CVE-2025-12527 State: PUBLISHED Published: 2025-11-07T05:29:58.432Z Last Updated: 2025-11-07T13:22:13.626Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: yydevelopment Products: Page & Post Notes Problem Types: CWE-862 Description: The Page & Post Notes plugin for WordPress is vulnerable to unauthorized modification of notes due to a missing capability check on the 'yydev_notes_save_dashboard_data' function in all versions up to, and including, 1.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify notes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/t
and above, to modify notes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/93dadc33-cabf-4701-97ca-861ad90597fb?source=cve - https://plugins.trac.wordpress.org/browser/page-post-notes/trunk/index.php#L85 - https://plugins.trac.wordpress.org/browser/page-post-notes/trunk/include/insert-to-db.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3389236%40page-post-notes&new=3389236%40page-post-notes&sfp_email=&sfph_mail=
CVE ID: CVE-2025-12528 State: PUBLISHED Published: 2025-11-18T08:27:31.375Z Last Updated: 2025-11-18T16:03:31.200Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: genetechproducts Products: Pie Forms — Drag & Drop Form Builder Problem Types: CWE-434 Description: The Pie Forms for WP plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6 via the format_classic function. This is due to insufficient file type validation where the validate_classic method validates file extensions and sets error messages but does not prevent the file upload process from continuing. This makes it possible for unauthenticated attackers t
ges but does not prevent the file upload process from continuing. This makes it possible for unauthenticated attackers to upload files with dangerous extensions such as PHP, which makes remote code execution possible. In order to exploit this vulnerability, the attacker needs to guess the directory in which the file is placed (which is a somewhat predictable hash). In addition to that, the file name is generated using a secure hash method, limiting the exploitability of this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4941a0ce-67f1-430d-bbad-3c97a4ed449e?source=cve - https://plugins.trac.wordpress.o
e.com/threat-intel/vulnerabilities/id/4941a0ce-67f1-430d-bbad-3c97a4ed449e?source=cve - https://plugins.trac.wordpress.org/browser/pie-forms-for-wp/tags/1.6/includes/fields/fileupload.php#L331 - https://plugins.trac.wordpress.org/browser/pie-forms-for-wp/tags/1.6/includes/fields/fileupload.php#L475 - https://plugins.trac.wordpress.org/browser/pie-forms-for-wp/tags/1.6/includes/fields/fileupload.php#L18
CVE ID: CVE-2025-12531 State: PUBLISHED Published: 2025-11-03T19:47:40.992Z Last Updated: 2025-11-03T20:15:28.986Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H) Vendors: IBM Products: InfoSphere Information Server Problem Types: CWE-611 Description: IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7249881
CVE ID: CVE-2025-12535 State: PUBLISHED Published: 2025-11-19T06:45:25.984Z Last Updated: 2025-11-19T18:51:17.329Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: brainstormforce Products: SureForms – Contact Form, Custom Form Builder, Calculator & More Problem Types: CWE-352 Description: The SureForms plugin for WordPress is vulnerable to Cross-Site Request Forgery Bypass in all versions up to, and including, 1.13.1. This is due to the plugin distributing generic WordPress REST API nonces (wp_rest) to unauthenticated users via the 'wp_ajax_nopriv_rest-nonce' action. While the plugin legitimately needs to support unauthenticated form submissions, it incorrec
_nopriv_rest-nonce' action. While the plugin legitimately needs to support unauthenticated form submissions, it incorrectly uses generic REST nonces instead of form-specific nonces. This makes it possible for unauthenticated attackers to bypass CSRF protection on REST API endpoints that rely solely on nonce verification without additional authentication checks, allowing them to trigger unauthorized actions such as the plugin's own post-submission hooks and potentially other plugins' REST endpoints. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b083cf9d-bcfe-4234-a816-2d216da28b57?source=cve - https://plugins.trac.wo
.wordfence.com/threat-intel/vulnerabilities/id/b083cf9d-bcfe-4234-a816-2d216da28b57?source=cve - https://plugins.trac.wordpress.org/browser/sureforms/tags/1.13.1/inc/background-process.php#L74 - https://plugins.trac.wordpress.org/browser/sureforms/tags/1.13.1/inc/admin-ajax.php#L45 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3391762%40sureforms%2Ftrunk&old=3382423%40sureforms%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2025-12536 State: PUBLISHED Published: 2025-11-13T03:27:39.017Z Last Updated: 2025-11-13T14:34:11.893Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: brainstormforce Products: SureForms – Contact Form, Custom Form Builder, Calculator & More Problem Types: CWE-359 Description: The SureForms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.1 via the '_srfm_email_notification' post meta registration. This is due to setting the 'auth_callback' parameter to '__return_true', which allows unauthenticated access to the metadata. This makes it possible for unauthenticated attackers to extract
e', which allows unauthenticated access to the metadata. This makes it possible for unauthenticated attackers to extract sensitive data including email notification configurations, which frequently contain vendor-provided CRM/help desk dropbox addresses, CC/BCC recipients, and notification templates that can be abused to inject malicious data into downstream systems. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9e8e239a-0ddf-479e-b94b-7844ff6e9e81?source=cve - https://plugins.trac.wordpress.org/browser/sureforms/tags/1.13.1/inc/post-types.php#L892 - https://plugins.trac.wordpress.org/changeset/3391762/sureforms/tru
owser/sureforms/tags/1.13.1/inc/post-types.php#L892 - https://plugins.trac.wordpress.org/changeset/3391762/sureforms/trunk/inc/post-types.php
CVE ID: CVE-2025-12538 State: PUBLISHED Published: 2025-11-11T03:30:36.625Z Last Updated: 2025-11-12T20:08:11.549Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: iworks Products: Fleet Manager Problem Types: CWE-79 Description: The Fleet Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site instal
ry web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3e72644c-138d-4733-bcca-a8305273d1a0?source=cve - https://it.wordpress.org/plugins/fleet/
CVE ID: CVE-2025-12539 State: PUBLISHED Published: 2025-11-11T11:03:44.429Z Last Updated: 2025-11-14T15:29:41.682Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: leopardhost Products: TNC Toolbox: Web Performance Problem Types: CWE-922 Description: The TNC Toolbox: Web Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.2. This is due to the plugin storing cPanel API credentials (hostname, username, and API key) in files within the web-accessible wp-content directory without adequate protection in the "Tnc_Wp_Toolbox_Settings::save_settings" function. This makes it possible for unauthen
ithout adequate protection in the "Tnc_Wp_Toolbox_Settings::save_settings" function. This makes it possible for unauthenticated attackers to retrieve these credentials and use them to interact with the cPanel API, which can lead to arbitrary file uploads, remote code execution, and full compromise of the hosting environment. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2eaa5a5c-c11f-40d0-be69-c3ec8029a819?source=cve - https://github.com/The-Network-Crew/TNC-Toolbox-for-WordPress/commit/31bb3040b22c84e2d6dfd3210fe0ad045ff4ddf6
CVE ID: CVE-2025-12541 State: REJECTED Published: N/A Last Updated: 2025-11-22T22:24:46.919Z Description: No description available.
CVE ID: CVE-2025-12542 State: REJECTED Published: N/A Last Updated: 2025-11-10T22:19:39.662Z Description: No description available.
CVE ID: CVE-2025-12545 State: PUBLISHED Published: 2025-11-18T13:54:50.617Z Last Updated: 2025-11-18T14:27:27.545Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: alekv Products: Pixel Manager for WooCommerce – Track Conversions and Analytics, Google Ads, TikTok and more Problem Types: CWE-200 Description: The Pixel Manager for WooCommerce – Track Conversions and Analytics, Google Ads, TikTok and more plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.49.2 via the ajax_pmw_get_product_ids() function due to insufficient restrictions on which products can be included. This makes it possible for unauthenticated at
nction due to insufficient restrictions on which products can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft products that they should not have access to. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9babb946-4033-4e66-8f59-b73185ffcd49?source=cve - https://plugins.trac.wordpress.org/browser/woocommerce-google-adwords-conversion-tracking-tag/tags/1.49.2/includes/pixels/class-pixel-manager.php#L343 - https://plugins.trac.wordpress.org/browser/woocommerce-google-adwords-conversion-tracking-tag/tags/1.49.2/includes/pixels/class-pixel-manager
wordpress.org/browser/woocommerce-google-adwords-conversion-tracking-tag/tags/1.49.2/includes/pixels/class-pixel-manager.php#L1235
CVE ID: CVE-2025-12546 State: PUBLISHED Published: 2025-10-31T18:32:05.885Z Last Updated: 2025-10-31T18:59:31.730Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: LogicalDOC Products: Community Edition Problem Types: CWE-79, CWE-94 Description: A vulnerability was determined in LogicalDOC Community Edition up to 9.2.1. This affects an unknown part of the component API Key creation UI. This manipulation causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnri
or was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330806 - https://vuldb.com/?ctiid.330806 - https://vuldb.com/?submit.677170 - https://gist.github.com/thezeekhan/fa0dcfda4f1f915c625d3f89f8ec0529
CVE ID: CVE-2025-12547 State: PUBLISHED Published: 2025-10-31T18:32:08.209Z Last Updated: 2025-10-31T18:55:56.744Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: LogicalDOC Products: Community Edition Problem Types: CWE-307, CWE-799 Description: A vulnerability was identified in LogicalDOC Community Edition up to 9.2.1. This vulnerability affects unknown code of the file /login.jsp of the component Admin Login Page. Such manipulation leads to improper restriction of excessive authentication attempts. The attack can be executed remotely. This attack is characterized by high complexity. It is stated that the exploitability is difficult. The exploit
emotely. This attack is characterized by high complexity. It is stated that the exploitability is difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330807 - https://vuldb.com/?ctiid.330807 - https://vuldb.com/?submit.677172 - https://gist.github.com/thezeekhan/869aeb01bd981667c35dcac3e72c2bfa
CVE ID: CVE-2025-12552 State: PUBLISHED Published: 2025-10-31T15:43:44.961Z Last Updated: 2025-10-31T18:24:19.770Z Vendors: Azure Access Technology Products: BLU-IC2, BLU-IC4 Problem Types: CWE-521 Description: Insufficient Password Policy.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://azure-access.com/security-advisories
CVE ID: CVE-2025-12553 State: PUBLISHED Published: 2025-10-31T15:48:29.402Z Last Updated: 2025-10-31T18:36:54.940Z Vendors: Azure Access Technology Products: BLU-IC2, BLU-IC4 Problem Types: CWE-599 Description: Email Server Certificate Verification Disabled.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://azure-access.com/security-advisories
CVE ID: CVE-2025-12554 State: PUBLISHED Published: 2025-10-31T15:52:29.049Z Last Updated: 2025-10-31T17:43:18.158Z Vendors: Azure Access Technology Products: BLU-IC2, BLU-IC4 Problem Types: CWE-693 Description: Missing Security Headers.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://azure-access.com/security-advisories
CVE ID: CVE-2025-12556 State: PUBLISHED Published: 2025-11-06T15:35:58.447Z Last Updated: 2025-11-06T15:47:08.878Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: IDIS Products: ICM Viewer Problem Types: CWE-88 Description: An argument injection vulnerability exists in the affected product that could allow an attacker to execute arbitrary code within the context of the host machine. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-308-05
CVE ID: CVE-2025-12560 State: PUBLISHED Published: 2025-11-06T05:31:24.932Z Last Updated: 2025-11-06T15:40:57.868Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: pr-gateway Products: Blog2Social: Social Media Auto Post & Scheduler Problem Types: CWE-918 Description: The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 8.6.0 via the getFullContent() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and