Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-5239 State: PUBLISHED Published: 2025-06-06T11:13:16.706Z Last Updated: 2025-06-06T16:08:02.833Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themeatelier Products: Domain For Sale, Domain appraisal, Domain auction, Domain marketplace – Best Domain For sale Plugin for WordPress Problem Types: CWE-79 Description: The Domain For Sale plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class_name’ parameter in all versions up to, and including, 3.0.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitra
escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cdb4cb5e-38ea-430e-b6ae-3712b3607a25?source=cve - https://plugins.trac.wordpress.org/browser/domain-for-sale/trunk/src/Admin/GutenbergBlock/Gutenberg_Block_Init.php#L278 - https://wordpress.org/plugins/domain-for-sale/#developers - https://plugins.trac.wordpress.org/changeset/3306141/
CVE ID: CVE-2025-5240 State: PUBLISHED Published: 2025-07-22T01:44:27.426Z Last Updated: 2025-07-22T20:01:17.163Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: vcita Products: CRM and Lead Management by vcita Problem Types: CWE-79 Description: The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in all versions up to, and including, 2.7.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected
-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3643c741-559b-438b-9a39-518b9a6dfbf4?source=cve - https://plugins.trac.wordpress.org/browser/crm-customer-relationship-management-by-vcita/trunk/vcita-widgets-functions.php#L180 - https://wordpress.org/plugins/crm-customer-relationship-management-by-vcita/#developers - https://plugins.trac.wordpress.org/changeset/3256449/
CVE ID: CVE-2025-5241 State: PUBLISHED Published: 2025-07-11T00:16:43.275Z Last Updated: 2025-07-11T13:34:05.817Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Mitsubishi Electric Corporation Products: MELSEC iQ-F Series FX5U-32MT/ES, MELSEC iQ-F Series FX5U-32MT/DS, MELSEC iQ-F Series FX5U-32MT/ESS, MELSEC iQ-F Series FX5U-32MT/DSS, MELSEC iQ-F Series FX5U-32MR/ES, MELSEC iQ-F Series FX5U-32MR/DS, MELSEC iQ-F Series FX5U-64MT/ES, MELSEC iQ-F Series FX5U-64MT/DS, MELSEC iQ-F Series FX5U-64MT/ESS, MELSEC iQ-F Series FX5U-64MT/DSS, MELSEC iQ-F Series FX5U-64MR/ES, MELSEC iQ-F Series FX5U-64MR/DS, MELSEC iQ-F Series FX5U-80MT/ES, MELSEC iQ-F Series FX5U-80MT/
Q-F Series FX5U-64MR/ES, MELSEC iQ-F Series FX5U-64MR/DS, MELSEC iQ-F Series FX5U-80MT/ES, MELSEC iQ-F Series FX5U-80MT/DS, MELSEC iQ-F Series FX5U-80MT/ESS, MELSEC iQ-F Series FX5U-80MT/DSS, MELSEC iQ-F Series FX5U-80MR/ES, MELSEC iQ-F Series FX5U-80MR/DS, MELSEC iQ-F Series FX5UC-32MT/D, MELSEC iQ-F Series FX5UC-32MT/DSS, MELSEC iQ-F Series FX5UC-64MT/D, MELSEC iQ-F Series FX5UC-64MT/DSS, MELSEC iQ-F Series FX5UC-96MT/D, MELSEC iQ-F Series FX5UC-96MT/DSS, MELSEC iQ-F Series FX5UC-32MT/DS-TS, MELSEC iQ-F Series FX5UC-32MT/DSS-TS, MELSEC iQ-F Series FX5UC-32MR/DS-TS, MELSEC iQ-F Series FX5UJ-24MT/ES, MELSEC iQ-F Series FX5UJ-24MT/DS, MELSEC iQ-F Series FX5UJ-24MT/ESS, MELSEC iQ-F Series FX5U
iQ-F Series FX5UJ-24MT/ES, MELSEC iQ-F Series FX5UJ-24MT/DS, MELSEC iQ-F Series FX5UJ-24MT/ESS, MELSEC iQ-F Series FX5UJ-24MT/DSS, MELSEC iQ-F Series FX5UJ-24MR/ES, MELSEC iQ-F Series FX5UJ-24MR/DS, MELSEC iQ-F Series FX5UJ-40MT/ES, MELSEC iQ-F Series FX5UJ-40MT/DS, MELSEC iQ-F Series FX5UJ-40MT/ESS, MELSEC iQ-F Series FX5UJ-40MT/DSS, MELSEC iQ-F Series FX5UJ-40MR/ES, MELSEC iQ-F Series FX5UJ-40MR/DS, MELSEC iQ-F Series FX5UJ-60MT/ES, MELSEC iQ-F Series FX5UJ-60MT/DS, MELSEC iQ-F Series FX5UJ-60MT/ESS, MELSEC iQ-F Series FX5UJ-60MT/DSS, MELSEC iQ-F Series FX5UJ-60MR/ES, MELSEC iQ-F Series FX5UJ-60MR/DS, MELSEC iQ-F Series FX5UJ-24MT/ES-A, MELSEC iQ-F Series FX5UJ-24MR/ES-A, MELSEC iQ-F Seri
LSEC iQ-F Series FX5UJ-60MR/DS, MELSEC iQ-F Series FX5UJ-24MT/ES-A, MELSEC iQ-F Series FX5UJ-24MR/ES-A, MELSEC iQ-F Series FX5UJ-40MT/ES-A, MELSEC iQ-F Series FX5UJ-40MR/ES-A, MELSEC iQ-F Series FX5UJ-60MT/ES-A, MELSEC iQ-F Series FX5UJ-60MR/ES-A, MELSEC iQ-F Series FX5S-30MT/ES, MELSEC iQ-F Series FX5S-30MT/ESS, MELSEC iQ-F Series FX5S-30MR/ES, MELSEC iQ-F Series FX5S-40MT/ES, MELSEC iQ-F Series FX5S-40MT/ESS, MELSEC iQ-F Series FX5S-40MR/ES, MELSEC iQ-F Series FX5S-60MT/ES, MELSEC iQ-F Series FX5S-60MT/ESS, MELSEC iQ-F Series FX5S-60MR/ES, MELSEC iQ-F Series FX5S-80MT/ES, MELSEC iQ-F Series FX5S-80MT/ESS, MELSEC iQ-F Series FX5S-80MR/ES, MELSEC iQ-F Series FX5S-30MT/DS, MELSEC iQ-F Series
MELSEC iQ-F Series FX5S-80MT/ESS, MELSEC iQ-F Series FX5S-80MR/ES, MELSEC iQ-F Series FX5S-30MT/DS, MELSEC iQ-F Series FX5S-30MT/DSS, MELSEC iQ-F Series FX5S-30MR/DS, MELSEC iQ-F Series FX5S-40MT/DS, MELSEC iQ-F Series FX5S-40MT/DSS, MELSEC iQ-F Series FX5S-40MR/DS, MELSEC iQ-F Series FX5S-60MT/DS, MELSEC iQ-F Series FX5S-60MT/DSS, MELSEC iQ-F Series FX5S-60MR/DS, MELSEC iQ-F Series FX5-CCLGN-MS Problem Types: CWE-645 Description: Overly Restrictive Account Lockout Mechanism vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series allows a remote unauthenticated attacker to lockout legitimate users for a certain period by repeatedly attempting to login with incorrect passwords. T
attacker to lockout legitimate users for a certain period by repeatedly attempting to login with incorrect passwords. The legitimate users will be unable to login until a certain period has passed after the lockout or until the product is reset. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-005_en.pdf - https://www.cisa.gov/news-events/ics-advisories/icsa-25-184-04
CVE ID: CVE-2025-5242 State: REJECTED Published: N/A Last Updated: 2025-06-07T22:16:26.510Z Description: No description available.
CVE ID: CVE-2025-5243 State: PUBLISHED Published: 2025-07-24T12:45:22.450Z Last Updated: 2025-07-24T13:36:01.931Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: SMG Software Products: Information Portal Problem Types: CWE-434, CWE-78 Description: Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SMG Software Information Portal allows Code Injection, Upload a Web Shell to a Web Server, Code Inclusion.This issue affects Information Portal: before 13.06.2025. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildiri
tal: before 13.06.2025. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0174
CVE ID: CVE-2025-5244 State: PUBLISHED Published: 2025-05-27T13:00:14.904Z Last Updated: 2025-05-27T13:32:03.140Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: GNU Products: Binutils Problem Types: CWE-119 Description: A vulnerability was found in GNU Binutils up to 2.44. It has been rated as critical. Affected by this issue is the function elf_gc_sweep of the file bfd/elflink.c of the component ld. The manipulation leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 2.45 is able to address this issue. It is recommended to upgrade the affected component. Addi
used. Upgrading to version 2.45 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310346 - https://vuldb.com/?ctiid.310346 - https://vuldb.com/?submit.584634 - https://sourceware.org/bugzilla/show_bug.cgi?id=32858 - https://sourceware.org/bugzilla/attachment.cgi?id=16010 - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=d1458933830456e54223d9fc61f0d9b3a19256f5 - https://www.gnu.org/
CVE ID: CVE-2025-5245 State: PUBLISHED Published: 2025-05-27T14:31:12.173Z Last Updated: 2025-05-27T15:20:54.076Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: GNU Products: Binutils Problem Types: CWE-119 Description: A vulnerability classified as critical has been found in GNU Binutils up to 2.44. This affects the function debug_type_samep of the file /binutils/debug.c of the component objdump. The manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: Re
may be used. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310347 - https://vuldb.com/?ctiid.310347 - https://vuldb.com/?submit.584635 - https://sourceware.org/bugzilla/show_bug.cgi?id=32829 - https://sourceware.org/bugzilla/attachment.cgi?id=16004 - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=6c3458a8b7ee7d39f070c7b2350851cb2110c65a - https://www.gnu.org/
CVE ID: CVE-2025-5246 State: PUBLISHED Published: 2025-05-27T14:31:14.497Z Last Updated: 2025-05-27T15:19:25.326Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Campcodes Products: Online Hospital Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in Campcodes Online Hospital Management System 1.0. This vulnerability affects unknown code of the file /hms/admin/query-details.php. The manipulation of the argument adminremark leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vul
en disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310348 - https://vuldb.com/?ctiid.310348 - https://vuldb.com/?submit.584718 - https://github.com/snkercyber/CVE/issues/5 - https://www.campcodes.com/
CVE ID: CVE-2025-5247 State: PUBLISHED Published: 2025-05-27T15:00:09.293Z Last Updated: 2025-05-27T15:18:02.146Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Gowabby Products: HFish Problem Types: CWE-287 Description: A vulnerability, which was classified as critical, has been found in Gowabby HFish 0.1. This issue affects the function LoadUrl of the file \view\url.go. The manipulation of the argument r leads to improper authentication. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310349 - https://vuldb.com/?ctiid.310349 - https://vuld
es: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310349 - https://vuldb.com/?ctiid.310349 - https://vuldb.com/?submit.584798 - https://github.com/A7cc/cve/issues/5
CVE ID: CVE-2025-5248 State: PUBLISHED Published: 2025-05-27T16:00:07.504Z Last Updated: 2025-05-27T16:34:30.142Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Company Visitor Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in PHPGurukul Company Visitor Management System 1.0. Affected is an unknown function of the file /bwdates-reports-details.php. The manipulation of the argument fromdate/todate leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310350 - https://vuldb.com/?ctiid.310350 - https://vuldb.com/?submit.584823 - https://github.com/zzb1388/zzb1/issues/8 - https://phpgurukul.com/
CVE ID: CVE-2025-5249 State: PUBLISHED Published: 2025-05-27T16:31:05.401Z Last Updated: 2025-05-27T18:56:02.414Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: News Portal Project Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in PHPGurukul News Portal Project 4.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/add-category.php. The manipulation of the argument Category leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/
losed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310351 - https://vuldb.com/?ctiid.310351 - https://vuldb.com/?submit.584903 - https://github.com/Schatten-42/MyCVE/issues/9 - https://phpgurukul.com/
CVE ID: CVE-2025-5250 State: PUBLISHED Published: 2025-05-27T17:00:13.390Z Last Updated: 2025-05-27T17:48:04.655Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: News Portal Project Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul News Portal Project 4.1 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/edit-category.php. The manipulation of the argument Category leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310352
he public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310352 - https://vuldb.com/?ctiid.310352 - https://vuldb.com/?submit.584911 - https://github.com/Schatten-42/MyCVE/issues/10 - https://phpgurukul.com/
CVE ID: CVE-2025-5251 State: PUBLISHED Published: 2025-05-27T17:00:16.425Z Last Updated: 2025-05-27T17:43:22.674Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: News Portal Project Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul News Portal Project 4.1. It has been classified as critical. This affects an unknown part of the file /admin/edit-subcategory.php. The manipulation of the argument Category leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310353
e public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310353 - https://vuldb.com/?ctiid.310353 - https://vuldb.com/?submit.584922 - https://github.com/Schatten-42/MyCVE/issues/11 - https://phpgurukul.com/
CVE ID: CVE-2025-5252 State: PUBLISHED Published: 2025-05-27T17:31:05.877Z Last Updated: 2025-05-27T17:42:58.884Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: News Portal Project Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul News Portal Project 4.1. It has been declared as critical. This vulnerability affects unknown code of the file /admin/edit-subadmin.php. The manipulation of the argument emailid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310354 - htt
lic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310354 - https://vuldb.com/?ctiid.310354 - https://vuldb.com/?submit.584923 - https://github.com/Schatten-42/MyCVE/issues/12 - https://phpgurukul.com/
CVE ID: CVE-2025-5253 State: PUBLISHED Published: 2025-07-25T11:27:41.281Z Last Updated: 2025-07-25T11:41:35.641Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Kron Technologies Products: Kron PAM Problem Types: CWE-770, CWE - 406 Insufficient Control of Network Message Volume (Network Amplification) Description: Allocation of Resources Without Limits or Throttling vulnerability in Kron Technologies Kron PAM allows HTTP DoS.This issue affects Kron PAM: before 3.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0178
CVE ID: CVE-2025-5254 State: PUBLISHED Published: 2025-07-25T11:30:28.763Z Last Updated: 2025-08-04T18:32:07.332Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N) Vendors: Kron Technologies Products: Kron PAM Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kron Technologies Kron PAM allows Stored XSS.This issue affects Kron PAM: before 3.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0178
CVE ID: CVE-2025-5255 State: PUBLISHED Published: 2025-06-20T10:01:42.561Z Last Updated: 2025-06-20T13:29:49.912Z Vendors: Core.ai Products: Phoenix Code Problem Types: CWE-276 Description: The Phoenix Code's configuration on macOS, specifically the presence of entitlements: "com.apple.security.cs.allow-dyld-environment-variables" and "com.apple.security.cs.disable-library-validation" allows for Dynamic Library (Dylib) injection. A local attacker with unprivileged access can use environment variables like DYLD_INSERT_LIBRARIES to successfully inject code in application's context and bypass Transparency, Consent, and Control (TCC). Acquired resource access is limited to previously granted per
ntext and bypass Transparency, Consent, and Control (TCC). Acquired resource access is limited to previously granted permissions by the user. Access to other resources beyond granted-permissions requires user interaction with a system prompt asking for permission. This issue was fixed in commit 0c75fb57f89d0b7d9b180026bc2624b7dcf807da Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/06/tcc-bypass/ - https://phcode.dev/ - https://github.com/phcode-dev/phoenix-desktop/pull/623/commits/0c75fb57f89d0b7d9b180026bc2624b7dcf807da
CVE ID: CVE-2025-5256 State: PUBLISHED Published: 2025-05-28T17:47:05.674Z Last Updated: 2025-05-28T17:57:39.395Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Mautic Products: Mautic Problem Types: CWE-601 Description: SummaryThis advisory addresses an Open Redirection vulnerability in Mautic's user unlocking endpoint. This vulnerability could be exploited by an attacker to redirect legitimate users to malicious websites, potentially leading to phishing attacks or the delivery of exploit kits. Open Redirection via returnUrl Parameter: An Open Redirection vulnerability exists in the /s/action/unlock/user.user/0 endpoint. The returnUrl parameter, intended f
Open Redirection vulnerability exists in the /s/action/unlock/user.user/0 endpoint. The returnUrl parameter, intended for post-action redirection, is not properly validated. This allows an attacker to craft a URL that, when clicked by a user, redirects them to an arbitrary external website controlled by the attacker. MitigationUpdate Mautic to a version that properly validates or sanitizes the returnUrl parameter to ensure that redirects only occur to trusted, internal URLs or explicitly whitelisted domains. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mautic/mautic/security/advisories/GHSA-6vx9-9r2g-8373
CVE ID: CVE-2025-5257 State: PUBLISHED Published: 2025-05-28T16:17:54.013Z Last Updated: 2025-05-28T23:43:08.966Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: Mautic Products: Mautic Problem Types: CWE-1284 Description: SummaryThis advisory addresses a security vulnerability in Mautic where unpublished page previews could be accessed by unauthenticated users and potentially indexed by search engines. This could lead to the unintended disclosure of draft content or sensitive information. Unauthorized Access to Unpublished Page Previews: The page preview functionality for unpublished content, accessible via predictable URLs (e.g., /page/preview/1, /page/pre
he page preview functionality for unpublished content, accessible via predictable URLs (e.g., /page/preview/1, /page/preview/2), lacked proper authorization checks. This allowed any unauthenticated user to view content that was not yet intended for public release, and allowed search engines to index these private preview URLs, making the content publicly discoverable. MitigationMautic has patched this vulnerability by enforcing proper permission checks on preview pages. Users should upgrade to the patched version of Mautic or later. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mautic/mautic/security/advisories/GHSA-cqx4-9vqf-q3m8
CVE ID: CVE-2025-5258 State: PUBLISHED Published: 2025-06-24T07:24:56.851Z Last Updated: 2025-06-24T14:20:05.491Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: swift Products: Conference Scheduler Problem Types: CWE-79 Description: The Conference Scheduler plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including, 2.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional A
bove, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0d0a03e5-b09c-430d-aa65-8ef9e01cf241?source=cve - https://plugins.trac.wordpress.org/browser/conference-scheduler/trunk/conf-scheduler.php#L1703 - https://wordpress.org/plugins/conference-scheduler/#developers - https://plugins.trac.wordpress.org/changeset/3316436/
CVE ID: CVE-2025-5259 State: PUBLISHED Published: 2025-05-30T05:23:19.589Z Last Updated: 2025-05-30T22:00:42.885Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: gonzomir Products: Minimal Share Buttons Problem Types: CWE-79 Description: The Minimal Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ parameter in all versions up to, and including, 1.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional
above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7ac2ac7a-4cb5-4051-bec7-a22693c50915?source=cve - https://plugins.trac.wordpress.org/browser/minimal-share-buttons/trunk/inc/class-minimal-share-buttons.php#L67 - https://wordpress.org/plugins/minimal-share-buttons/#developers - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3302704%40minimal-share-buttons&old=3074272%40minimal-share-buttons&sfp_email=&sfph_mail=