Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-51396 State: PUBLISHED Published: 2025-07-21T00:00:00.000Z Last Updated: 2025-07-22T13:44:35.496Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Telegram Bot Username parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dropbox.com/scl/fi/e6z9vidj3wnzm0guzqsax/2025-05-09-02-53-20.mp4?rlkey=s27ywh16uz5uqam0qzweo3p8w&st=eglxeohk&dl=0 - https://github.com/LiveHelperChat/livehelperchat/pull/2228/commits/2056503ad96e04467ec9af8d827109b9b9b46223 - https://github.
://github.com/LiveHelperChat/livehelperchat/pull/2228/commits/2056503ad96e04467ec9af8d827109b9b9b46223 - https://github.com/Thewhiteevil/CVE-2025-51396
CVE ID: CVE-2025-51397 State: PUBLISHED Published: 2025-07-21T00:00:00.000Z Last Updated: 2025-07-22T13:41:32.084Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the Facebook Chat module of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Surname parameter under the Recipient' Lists. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LiveHelperChat/livehelperchat/pull/2228/commits/2056503ad96e04467ec9af8d827109b9b9b46223 - https://www.dropbox.com/scl/fi/qrbtcv8bir2i8ielguyi3/2025-05-09-13-58-50.mp4?rlkey=thcbqxuzpm37o73j0yw
27109b9b9b46223 - https://www.dropbox.com/scl/fi/qrbtcv8bir2i8ielguyi3/2025-05-09-13-58-50.mp4?rlkey=thcbqxuzpm37o73j0ywsu3h3u&st=fhird68s&dl=0 - https://github.com/Thewhiteevil/CVE-2025-51397
CVE ID: CVE-2025-51398 State: PUBLISHED Published: 2025-07-21T00:00:00.000Z Last Updated: 2025-07-22T13:39:50.296Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the Facebook registration page of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LiveHelperChat/livehelperchat/pull/2228/commits/2056503ad96e04467ec9af8d827109b9b9b46223 - https://www.dropbox.com/scl/fi/ldtrdf1681gekt9922d4y/2025-05-09-03-09-00.mp4?rlkey=pq1enfkys429h2g3ut3hs4fqj&st=zxc9vuq0&dl=0
//www.dropbox.com/scl/fi/ldtrdf1681gekt9922d4y/2025-05-09-03-09-00.mp4?rlkey=pq1enfkys429h2g3ut3hs4fqj&st=zxc9vuq0&dl=0 - https://github.com/Thewhiteevil/CVE-2025-51398
CVE ID: CVE-2025-51400 State: PUBLISHED Published: 2025-07-21T00:00:00.000Z Last Updated: 2025-07-22T13:38:16.326Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the Personal Canned Messages of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LiveHelperChat/livehelperchat/pull/2228/commits/2056503ad96e04467ec9af8d827109b9b9b46223 - https://www.dropbox.com/scl/fi/4ojb61ilgmu4xmtqnfqed/2025-05-08-20-41-52.mp4?rlkey=cz03rl97pskdk7d6bvb9dbvs7&st=ixsqpy0v&dl=0 - https://github.com/Thewh
ojb61ilgmu4xmtqnfqed/2025-05-08-20-41-52.mp4?rlkey=cz03rl97pskdk7d6bvb9dbvs7&st=ixsqpy0v&dl=0 - https://github.com/Thewhiteevil/CVE-2025-51400
CVE ID: CVE-2025-51401 State: PUBLISHED Published: 2025-07-21T00:00:00.000Z Last Updated: 2025-07-22T13:35:12.779Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the chat transfer function of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the operator name parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LiveHelperChat/livehelperchat/pull/2228/commits/2056503ad96e04467ec9af8d827109b9b9b46223 - https://www.dropbox.com/scl/fi/efzjql0brniphfh5sgrzn/2025-05-09-14-26-26.mp4?rlkey=z4zpec6wsja5xo0ovq0g5g1tt&st=abbp3gtr&
ttps://www.dropbox.com/scl/fi/efzjql0brniphfh5sgrzn/2025-05-09-14-26-26.mp4?rlkey=z4zpec6wsja5xo0ovq0g5g1tt&st=abbp3gtr&dl=0 - https://github.com/Thewhiteevil/CVE-2025-51401
CVE ID: CVE-2025-51403 State: PUBLISHED Published: 2025-07-21T00:00:00.000Z Last Updated: 2025-07-21T19:40:01.470Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the department assignment editing module of of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Alias Nick parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LiveHelperChat/livehelperchat/pull/2228/commits/2056503ad96e04467ec9af8d827109b9b9b46223 - https://www.dropbox.com/scl/fi/w7mur1fo4jb3harpx6om9/2025-05-08-21-38-14.mp4?rlkey=cpf5omg95tikzwno2u99thf3
b9b9b46223 - https://www.dropbox.com/scl/fi/w7mur1fo4jb3harpx6om9/2025-05-08-21-38-14.mp4?rlkey=cpf5omg95tikzwno2u99thf3v&st=2xgfedgo&dl=0 - https://github.com/Thewhiteevil/CVE-2025-51403
CVE ID: CVE-2025-51411 State: PUBLISHED Published: 2025-07-25T00:00:00.000Z Last Updated: 2025-07-25T13:27:22.783Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability exists in Institute-of-Current-Students v1.0 via the email parameter in the /postquerypublic endpoint. The application fails to properly sanitize user input before reflecting it in the HTML response. This allows unauthenticated attackers to inject and execute arbitrary JavaScript code in the context of the victim's browser by tricking them into visiting a crafted URL or submitting a malicious form. Successful exploitation may lead to session hijacking, credential theft
ng a crafted URL or submitting a malicious form. Successful exploitation may lead to session hijacking, credential theft, or other client-side attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/tansique-17/CVE-2025-51411/
CVE ID: CVE-2025-51451 State: PUBLISHED Published: 2025-08-13T00:00:00.000Z Last Updated: 2025-08-14T14:53:51.892Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TOTOLINK EX1200T firmware 4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/204/ids/36.html - http://n200re.com - https://gist.github.com/lin-3-start/e42344d5caea881e5429fdd40fad1fd8
CVE ID: CVE-2025-51452 State: PUBLISHED Published: 2025-08-13T00:00:00.000Z Last Updated: 2025-08-14T13:45:57.792Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TOTOLINK A7000R firmware 9.1.0u.6115_B20201022, an attacker can bypass login by sending a specific request through formLoginAuth.htm. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/171/ids/36.html - http://a7000rfirmware.com - https://gist.github.com/lin-3-start/5b20f6fbe3aa0c3fc75f320cd589182a
CVE ID: CVE-2025-51458 State: PUBLISHED Published: 2025-07-22T00:00:00.000Z Last Updated: 2025-07-22T20:09:21.425Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection in editor_sql_run and query_ex in eosphoros-ai DB-GPT 0.7.0 allows remote attackers to execute arbitrary SQL statements via crafted input passed to the /v1/editor/sql/run or /v1/editor/chart/run endpoints, interacting with api_editor_v1.editor_sql_run, editor_chart_run, and datasource.rdbms.base.query_ex. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/eosphoros-ai/DB-GPT/pull/2650 - https://www.gecko.security/blog/cve-2025-51458
CVE ID: CVE-2025-51459 State: PUBLISHED Published: 2025-07-22T00:00:00.000Z Last Updated: 2025-07-22T20:17:24.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: File Upload vulnerability in agent.hub.controller.refresh_plugins in eosphoros-ai DB-GPT 0.7.0 allows remote attackers to execute arbitrary code via a malicious plugin ZIP file uploaded to the /v1/personal/agent/upload endpoint, interacting with plugin_hub._sanitize_filename and plugins_util.scan_plugins. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/eosphoros-ai/DB-GPT/pull/2649 - https://www.gecko.security/blog/cve-2025-51459
CVE ID: CVE-2025-51462 State: PUBLISHED Published: 2025-07-22T00:00:00.000Z Last Updated: 2025-07-22T20:31:02.399Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stored Cross-site Scripting (XSS) vulnerability in api.apps.dialog_app.set_dialog in RAGFlow 0.17.2 allows remote attackers to execute arbitrary JavaScript via crafted input to the assistant greeting field, which is stored unsanitised and rendered using a markdown component with rehype-raw. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/infiniflow/ragflow - https://github.com/infiniflow/ragflow/pull/7250 - https://www.gecko.security/blog/cve-2025-51462
CVE ID: CVE-2025-51463 State: PUBLISHED Published: 2025-07-22T00:00:00.000Z Last Updated: 2025-07-22T17:40:21.597Z Vendors: n/a Products: n/a Problem Types: n/a Description: Path Traversal in restore_run_backup() in AIM 3.28.0 allows remote attackers to write arbitrary files to the server's filesystem via a crafted backup tar file submitted to the run_instruction API, which is extracted without path validation during restoration. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/aimhubio/aim - https://github.com/aimhubio/aim/pull/3327 - https://www.gecko.security/blog/cve-2025-51463
CVE ID: CVE-2025-51464 State: PUBLISHED Published: 2025-07-22T00:00:00.000Z Last Updated: 2025-07-22T18:18:12.170Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site Scripting (XSS) in aimhubio Aim 3.28.0 allows remote attackers to execute arbitrary JavaScript in victims browsers via malicious Python code submitted to the /api/reports endpoint, which is interpreted and executed by Pyodide when the report is viewed. No sanitisation or sandbox restrictions prevent JavaScript execution via pyodide.code.run_js(). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/aimhubio/aim - https://github.com/aimhubio/aim/pull/3333 - https://www.gecko.secur
ent: References: - https://github.com/aimhubio/aim - https://github.com/aimhubio/aim/pull/3333 - https://www.gecko.security/blog/cve-2025-51464
CVE ID: CVE-2025-51471 State: PUBLISHED Published: 2025-07-22T00:00:00.000Z Last Updated: 2025-10-17T17:49:49.480Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Domain Token Exposure in server.auth.getAuthorizationToken in Ollama 0.6.7 allows remote attackers to steal authentication tokens and bypass access controls via a malicious realm value in a WWW-Authenticate header returned by the /api/pull endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ollama/ollama - https://github.com/ollama/ollama/pull/10750 - https://www.gecko.security/blog/cve-2025-51471 - https://huntr.com/bounties/94eea285-fd65-4e01-a035-f533575ebdc2
CVE ID: CVE-2025-51472 State: PUBLISHED Published: 2025-07-22T00:00:00.000Z Last Updated: 2025-07-22T20:22:04.283Z Vendors: n/a Products: n/a Problem Types: n/a Description: Code Injection in AgentTemplate.eval_agent_config in TransformerOptimus SuperAGI 0.0.14 allows remote attackers to execute arbitrary Python code via malicious values in agent template configurations such as the goal, constraints, or instruction field, which are evaluated using eval() without validation during template loading or updates. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TransformerOptimus/SuperAGI - https://github.com/TransformerOptimus/SuperAGI/pull/1461 - https://www.g
ttps://github.com/TransformerOptimus/SuperAGI - https://github.com/TransformerOptimus/SuperAGI/pull/1461 - https://www.gecko.security/blog/cve-2025-51472
CVE ID: CVE-2025-51475 State: PUBLISHED Published: 2025-07-22T00:00:00.000Z Last Updated: 2025-07-22T19:55:08.329Z Vendors: n/a Products: n/a Problem Types: n/a Description: Arbitrary File Overwrite (AFO) in superagi.controllers.resources.upload in TransformerOptimus SuperAGI 0.0.14 allows remote attackers to overwrite arbitrary files via unsanitised filenames submitted to the file upload endpoint, due to improper handling of directory traversal in os.path.join() and lack of path validation in get_root_input_dir(). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TransformerOptimus/SuperAGI - https://github.com/TransformerOptimus/SuperAGI/pull/1463 - https:
es: - https://github.com/TransformerOptimus/SuperAGI - https://github.com/TransformerOptimus/SuperAGI/pull/1463 - https://www.gecko.security/blog/cve-2025-51475
CVE ID: CVE-2025-51479 State: PUBLISHED Published: 2025-07-22T00:00:00.000Z Last Updated: 2025-07-22T20:06:38.585Z Vendors: n/a Products: n/a Problem Types: n/a Description: Authorization bypass in update_user_group in onyx-dot-app Onyx Enterprise Edition 0.27.0 allows remote authenticated attackers to modify arbitrary user groups via crafted PATCH requests to the /api/manage/admin/user-group/id endpoint, bypassing intended curator-group assignment checks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/onyx-dot-app/onyx - https://github.com/onyx-dot-app/onyx/pull/4714 - https://www.gecko.security/blog/cve-2025-51479
CVE ID: CVE-2025-51480 State: PUBLISHED Published: 2025-07-22T00:00:00.000Z Last Updated: 2025-07-22T17:47:27.497Z Vendors: n/a Products: n/a Problem Types: n/a Description: Path Traversal vulnerability in onnx.external_data_helper.save_external_data in ONNX 1.17.0 allows attackers to overwrite arbitrary files by supplying crafted external_data.location paths containing traversal sequences, bypassing intended directory restrictions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/onnx/onnx - https://github.com/onnx/onnx/pull/6959 - https://github.com/advisories/GHSA-6rq9-53c3-f7vj - https://github.com/onnx/onnx/pull/7040 - https://www.gecko.security/blog/c
//github.com/advisories/GHSA-6rq9-53c3-f7vj - https://github.com/onnx/onnx/pull/7040 - https://www.gecko.security/blog/cve-2025-51480
CVE ID: CVE-2025-51481 State: PUBLISHED Published: 2025-07-22T00:00:00.000Z Last Updated: 2025-07-22T18:13:15.486Z Vendors: n/a Products: n/a Problem Types: n/a Description: Local File Inclusion in dagster._grpc.impl.get_notebook_data in Dagster 1.10.14 allows attackers with access to the gRPC server to read arbitrary files by supplying path traversal sequences in the notebook_path field of ExternalNotebookData requests, bypassing the intended extension-based check. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dagster-io/dagster - https://github.com/dagster-io/dagster/pull/30002 - https://www.gecko.security/blog/cve-2025-51481
CVE ID: CVE-2025-51482 State: PUBLISHED Published: 2025-07-22T00:00:00.000Z Last Updated: 2025-07-22T17:54:13.905Z Vendors: n/a Products: n/a Problem Types: n/a Description: Remote Code Execution in letta.server.rest_api.routers.v1.tools.run_tool_from_source in letta-ai Letta 0.7.12 allows remote attackers to execute arbitrary Python code and system commands via crafted payloads to the /v1/tools/run endpoint, bypassing intended sandbox restrictions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/letta-ai/letta - https://github.com/letta-ai/letta/pull/2630 - https://www.gecko.security/blog/cve-2025-51482
CVE ID: CVE-2025-51487 State: PUBLISHED Published: 2025-08-19T00:00:00.000Z Last Updated: 2025-08-20T18:58:58.652Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-Site Scripting (XSS) vulnerability exists in MoonShine version < 3.12.5, allowing to execute arbitrary JavaScript by using "javascript:" payload, instead of the expected HTTPS protocol, in the CutCode Link parameter when creating/updating a new Article. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/moonshine-software/moonshine - https://github.com/GiacoLenzo2109/MoonShine_Software_PoCs
CVE ID: CVE-2025-51488 State: PUBLISHED Published: 2025-08-19T00:00:00.000Z Last Updated: 2025-08-20T19:00:39.734Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-Site Scripting (XSS) vulnerability exists in MoonShine version < 3.12.4, allowing remote attackers to store and execute arbitrary JavaScript by including a malicious HTML payload in the Name parameter when creating a new Admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/moonshine-software/moonshine - https://github.com/GiacoLenzo2109/MoonShine_Software_PoCs
CVE ID: CVE-2025-51489 State: PUBLISHED Published: 2025-08-19T00:00:00.000Z Last Updated: 2025-08-20T19:08:11.138Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-Site Scripting (XSS) vulnerability exists in MoonShine version < 3.12.5, allowing remote attackers to upload a malicious SVG file when creating/updating an Article and correctly execute arbitrary JavaScript when the file link is opened. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/moonshine-software/moonshine - https://github.com/GiacoLenzo2109/MoonShine_Software_PoCs
CVE ID: CVE-2025-51495 State: PUBLISHED Published: 2025-09-29T00:00:00.000Z Last Updated: 2025-10-01T15:21:21.511Z Vendors: n/a Products: n/a Problem Types: n/a Description: An integer overflow vulnerability exists in the WebSocket component of Mongoose 7.5 thru 7.17. By sending a specially crafted WebSocket request, an attacker can cause the application to crash. If downstream vendors integrate this component improperly, the issue may lead to a buffer overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cesanta/mongoose - https://github.com/cesanta/mongoose/pull/3131 - https://github.com/cainiao159357/CVE-2025-51495
CVE ID: CVE-2025-51497 State: PUBLISHED Published: 2025-07-17T00:00:00.000Z Last Updated: 2025-07-24T20:17:51.963Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in AdGuard plugin before 1.11.22 for Safari on MacOS. AdGaurd verbosely logged each url that Safari accessed when the plugin was active. These logs went into the MacOS general logs for any unsandboxed process to read. This may be disabled in version 1.11.22. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://adguard.com/en/adguard-safari/overview.html - https://github.com/AdguardTeam/AdGuardForSafari - https://www.mcrich23.com/post/adguard-messed-up-their-logging
CVE ID: CVE-2025-51501 State: PUBLISHED Published: 2025-08-01T00:00:00.000Z Last Updated: 2025-08-01T17:56:46.842Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reflected Cross-Site Scripting (XSS) in the id parameter of the live_edit.module_settings API endpoint in Microweber CMS2.0 allows execution of arbitrary JavaScript. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/progprnv/CVE-Reports/blob/main/MICROWEBER%20%5BAdmin%20Panel%5D%20Reflected%20XSS%20on%20id%20parameter.md - https://github.com/progprnv/CVE-Reports - https://github.com/progprnv/CVE-Reports/blob/main/CVE-2025-51501
CVE ID: CVE-2025-51502 State: PUBLISHED Published: 2025-08-01T00:00:00.000Z Last Updated: 2025-08-01T18:01:25.783Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reflected Cross-Site Scripting (XSS) in Microweber CMS 2.0 via the layout parameter on the /admin/page/create page allows arbitrary JavaScript execution in the context of authenticated admin users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/progprnv/CVE-Reports/blob/main/MICROWEBER%20%5BAdmin%20Panel%5D%20Reflected%20XSS%20on%20layout%20parameter.md - https://github.com/progprnv/CVE-Reports - https://github.com/progprnv/CVE-Reports/blob/main/CVE-2025-51502
CVE ID: CVE-2025-51503 State: PUBLISHED Published: 2025-07-31T00:00:00.000Z Last Updated: 2025-07-31T18:40:48.081Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-Site Scripting (XSS) vulnerability in Microweber CMS 2.0 allows attackers to inject malicious scripts into user profile fields, leading to arbitrary JavaScript execution in admin browsers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/progprnv/CVE-Reports/blob/main/MICROWEBER%20%5BAdmin%20Panel%5D%20Stored%20XSS%20in%20profile%20path.md - https://github.com/progprnv/CVE-Reports - https://github.com/progprnv/CVE-Reports/blob/main/CVE-2025-51503
CVE ID: CVE-2025-51504 State: PUBLISHED Published: 2025-08-01T00:00:00.000Z Last Updated: 2025-08-01T17:08:32.776Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microweber CMS 2.0 is vulnerable to Cross Site Scripting (XSS)in the /projects/profile, homepage endpoint via the last name field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/progprnv/CVE-Reports/blob/main/MICROWEBER%20%5BLive%20Panel%5D%20Stored%20XSS%20in%20profile%20path.md - https://github.com/progprnv/CVE-Reports - https://github.com/progprnv/CVE-Reports/blob/main/CVE-2025-51504
CVE ID: CVE-2025-51506 State: PUBLISHED Published: 2025-08-19T00:00:00.000Z Last Updated: 2025-08-19T20:00:09.130Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the smartLibrary component of the HRForecast Suite 0.4.3, a SQL injection vulnerability was discovered in the valueKey parameter. This flaw enables any authenticated user to execute arbitrary SQL queries, via crafted payloads to valueKey to the api/smartlibrary/v2/en/dictionaries/options/lookup endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hrforecast.com/ - https://hrforecast.com/smartlibrary-job-architecture/ - https://github.com/MVRC-ITSEC/CVEs/blob/main/CVE-2025-51506
CVE ID: CVE-2025-51510 State: PUBLISHED Published: 2025-08-19T00:00:00.000Z Last Updated: 2025-08-20T19:10:24.940Z Vendors: n/a Products: n/a Problem Types: n/a Description: MoonShine was discovered to contain a SQL injection vulnerability under the Blog -> Categories page when using the moonshine-tree-resource (version < 2.0.2) component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/moonshine-software/moonshine - https://github.com/GiacoLenzo2109/MoonShine_Software_PoCs - https://github.com/lee-to/moonshine-tree-resource
CVE ID: CVE-2025-51529 State: PUBLISHED Published: 2025-08-19T00:00:00.000Z Last Updated: 2025-08-19T19:53:13.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect Access Control in the AJAX endpoint functionality in jonkastonka Cookies and Content Security Policy plugin through version 2.29 allows remote attackers to cause a denial of service (database server resource exhaustion) via unlimited database write operations to the wp_ajax_nopriv_cacsp_insert_consent_data endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://cookies.com - http://johan.com - https://gist.github.com/piotrmaciejbednarski/f738145c0ab24a110649dc16907e395b - https://githu
s.com - http://johan.com - https://gist.github.com/piotrmaciejbednarski/f738145c0ab24a110649dc16907e395b - https://github.com/piotrmaciejbednarski/CVE-2025-51529