Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-22615 State: PUBLISHED Published: 2025-01-13T20:57:09.695Z Last Updated: 2025-01-14T15:40:06.899Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79 Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the `Cadastro_Atendido.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the `cpf` parameter. The application fails to validate and sanitize user inputs in the `cpf` parameter. This lack of validation permits the injection of malicious payloads, which are reflected back to th
the `cpf` parameter. This lack of validation permits the injection of malicious payloads, which are reflected back to the user's browser in the server's response and executed within the context of the victim's browser. This issue has been addressed in version 3.2.6 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-6q73-74pc-p3c8 - https://github.com/LabRedesCefetRJ/WeGIA/commit/61ae1c3bec3c76e039f5ef48bc46cea30562192e
CVE ID: CVE-2025-22616 State: PUBLISHED Published: 2025-01-13T20:54:46.800Z Last Updated: 2025-01-14T15:40:32.152Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79 Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `dependente_parentesco_adicionar.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the `descricao` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. The a
er and executed automatically whenever the affected page is accessed by users, posing a significant security risk. The application fails to properly validate and sanitize user inputs in the `dependente_parentesco_adicionar.php` parameter. This lack of validation allows attackers to inject malicious scripts, which are then stored on the server. Whenever the affected page is accessed, the malicious payload is executed in the victim's browser, potentially compromising the user's data and system. This issue has been addressed in version 3.2.6 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
e. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-xm3h-x3rv-whr5 - https://github.com/LabRedesCefetRJ/WeGIA/commit/1825e235aa4ab1b8b641a02c3ec8bc32ea7a8433
CVE ID: CVE-2025-22617 State: PUBLISHED Published: 2025-01-13T20:52:32.567Z Last Updated: 2025-01-14T15:41:00.815Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79 Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the `editar_socio.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the `socio` parameter. The application fails to validate and sanitize user inputs in the `socio` parameter. This lack of validation permits the injection of malicious payloads, which are reflected back to the
`socio` parameter. This lack of validation permits the injection of malicious payloads, which are reflected back to the user's browser in the server's response and executed within the context of the victim's browser. This issue has been addressed in version 3.2.7 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-8cp5-vr69-h8xx - https://github.com/LabRedesCefetRJ/WeGIA/commit/35d374736cec39082ed297bb3cd55fa6286050ad
CVE ID: CVE-2025-22618 State: PUBLISHED Published: 2025-01-13T20:50:30.664Z Last Updated: 2025-01-14T15:41:38.818Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79 Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `adicionar_cargo.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the `cargo` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. The application fails to
matically whenever the affected page is accessed by users, posing a significant security risk. The application fails to properly validate and sanitize user inputs in the `adicionar_cargo.php` parameter. This lack of validation allows attackers to inject malicious scripts, which are then stored on the server. Whenever the affected page is accessed, the malicious payload is executed in the victim's browser, potentially compromising the user's data and system. This issue has been addressed in release version 3.2.6 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRed
ounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-2775-42rh-535q - https://github.com/LabRedesCefetRJ/WeGIA/commit/f3b1cd90e33b790b6b2049c69d22c6d50fe965a1
CVE ID: CVE-2025-22619 State: PUBLISHED Published: 2025-01-13T20:47:26.312Z Last Updated: 2025-01-14T15:53:57.179Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79 Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the `editar_permissoes.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the `msg_c` parameter. The application fails to validate and sanitize user inputs in the `msg_c` parameter. This lack of validation permits the injection of malicious payloads, which are reflected back t
n the `msg_c` parameter. This lack of validation permits the injection of malicious payloads, which are reflected back to the user's browser in the server's response and executed within the context of the victim's browser. This issue has been addressed in release version 3.2.6. All users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-jfjj-7rgc-6j2m - https://github.com/LabRedesCefetRJ/WeGIA/commit/f1233c30f00398f7a02fd9dd9cd46fb35098f2a4
CVE ID: CVE-2025-22620 State: PUBLISHED Published: 2025-01-20T15:38:32.388Z Last Updated: 2025-01-21T14:54:25.544Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N) Vendors: GitoxideLabs Products: gitoxide Problem Types: CWE-281, CWE-687 Description: gitoxide is an implementation of git written in Rust. Prior to 0.17.0, gix-worktree-state specifies 0777 permissions when checking out executable files, intending that the umask will restrict them appropriately. But one of the strategies it uses to set permissions is not subject to the umask. This causes files in a repository to be world-writable in some situations. This vulnerability is fixed in 0.17.0. Additional Analyst N
les in a repository to be world-writable in some situations. This vulnerability is fixed in 0.17.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-fqmf-w4xh-33rh
CVE ID: CVE-2025-22621 State: PUBLISHED Published: 2025-01-07T16:48:32.866Z Last Updated: 2025-02-28T11:03:57.914Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: Splunk Products: Splunk App for SOAR Problem Types: CWE-269 Description: In versions 1.0.67 and lower of the Splunk App for SOAR, the Splunk documentation for that app recommended adding the `admin_all_objects` capability to the `splunk_app_soar` role. This addition could lead to improper access control for a low-privileged user that does not hold the "admin" Splunk roles. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://advisory.splunk.com/advisories/SVD-2025-0101
CVE ID: CVE-2025-22622 State: PUBLISHED Published: 2025-02-19T03:51:33.892Z Last Updated: 2025-02-19T15:08:18.689Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Age Checker Products: Age Verification Problem Types: CWE-79 Description: Age Verification for your checkout page. Verify your customer's identity 1.20.0 was found to be vulnerable. The web application dynamically generates web content without validating the source of the potentially untrusted data in myapp/class-wc-integration-agechecker-integration.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/skims-5/ - https://wordpress.org/plugins/age
- CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/skims-5/ - https://wordpress.org/plugins/agecheckernet/#developers
CVE ID: CVE-2025-22623 State: PUBLISHED Published: 2025-03-06T05:08:55.161Z Last Updated: 2025-03-06T20:17:47.574Z Vendors: Ad Inserter Products: Ad Inserter Problem Types: CWE-79 Description: Ad Inserter - Ad Manager and AdSense Ads 2.8.0 was found to be vulnerable. The web application dynamically generates web content without validating the source of the potentially untrusted data in myapp/includes/dst/dst.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/skims-8/ - https://wordpress.org/plugins/ad-inserter/#developers
CVE ID: CVE-2025-22624 State: PUBLISHED Published: 2025-02-27T18:26:27.030Z Last Updated: 2025-07-10T20:08:23.570Z Vendors: bradvin Products: FooGallery - Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel Problem Types: CWE-79 Description: FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry and Carousel 2.4.29 was found to be vulnerable. The web application dynamically generates web content without validating the source of the potentially untrusted data in myapp/extensions/albums/admin/class-meta boxes.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/skims-10/ - https://wordpress.org/plugins/foog
CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/skims-10/ - https://wordpress.org/plugins/foogallery/
CVE ID: CVE-2025-22628 State: PUBLISHED Published: 2025-03-27T15:30:24.693Z Last Updated: 2025-03-27T16:13:59.379Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Foliovision Products: Filled In Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Foliovision Filled In allows Stored XSS.This issue affects Filled In: from n/a through 1.9.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/filled-in/vulnerability/wordpress-filled-in-plugin-1-9-1-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22629 State: PUBLISHED Published: 2025-03-27T15:29:06.104Z Last Updated: 2025-03-27T16:14:16.643Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: iNET Products: iNET Webkit Problem Types: CWE-862 Description: Missing Authorization vulnerability in iNET iNET Webkit allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects iNET Webkit: from n/a through 1.2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/inet-webkit/vulnerability/wordpress-inet-webkit-plugin-1-2-2-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-22630 State: PUBLISHED Published: 2025-02-14T07:10:21.622Z Last Updated: 2025-02-14T15:46:06.040Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: MarketingFire Products: Widget Options Problem Types: CWE-77 Description: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in MarketingFire Widget Options allows OS Command Injection.This issue affects Widget Options: from n/a through 4.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/widget-options/vulnerability/wordpress-widget-options-plugin-4-1-0-arbitrary-code-execution-vuln
tabase/wordpress/plugin/widget-options/vulnerability/wordpress-widget-options-plugin-4-1-0-arbitrary-code-execution-vulnerability?_s_id=cve
CVE ID: CVE-2025-22631 State: PUBLISHED Published: 2025-02-23T22:55:06.174Z Last Updated: 2025-02-24T11:58:35.091Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: vbout Products: Marketing Automation Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vbout Marketing Automation allows Reflected XSS. This issue affects Marketing Automation: from n/a through 1.2.6.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/marketing-automation/vulnerability/wordpress-marketing-automation-plugin-1-2-6-8-reflected-cross-site
e/wordpress/plugin/marketing-automation/vulnerability/wordpress-marketing-automation-plugin-1-2-6-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22632 State: PUBLISHED Published: 2025-02-23T22:55:06.392Z Last Updated: 2025-02-24T11:55:57.635Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: totalsoft Products: WooCommerce Pricing – Product Pricing Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in totalsoft WooCommerce Pricing – Product Pricing allows Stored XSS. This issue affects WooCommerce Pricing – Product Pricing: from n/a through 1.0.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/woo-pricing-table/vulnerability/wordpress-wooco
richment: References: - https://patchstack.com/database/wordpress/plugin/woo-pricing-table/vulnerability/wordpress-woocommerce-pricing-product-pricing-plugin-1-0-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22633 State: PUBLISHED Published: 2025-02-23T22:55:06.569Z Last Updated: 2025-02-24T11:53:56.088Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: Matt Cromwell Products: Give – Divi Donation Modules Problem Types: CWE-538 Description: Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Matt Cromwell Give – Divi Donation Modules allows Retrieve Embedded Sensitive Data. This issue affects Give – Divi Donation Modules: from n/a through 2.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/give-donation-modules-for-divi/vulnerability/w
nrichment: References: - https://patchstack.com/database/wordpress/plugin/give-donation-modules-for-divi/vulnerability/wordpress-give-divi-donation-modules-plugin-2-0-0-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2025-22634 State: PUBLISHED Published: 2025-03-27T15:27:43.481Z Last Updated: 2025-03-27T16:15:09.542Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: MD Abu Jubayer Hossain Products: Easy Booked – Appointment Booking and Scheduling Management System for WordPress Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in MD Abu Jubayer Hossain Easy Booked – Appointment Booking and Scheduling Management System for WordPress allows Cross Site Request Forgery.This issue affects Easy Booked – Appointment Booking and Scheduling Management System for WordPress: from n/a through 2.4.5. Additional Analyst Notes: - CISA ADP Vu
Booking and Scheduling Management System for WordPress: from n/a through 2.4.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/easy-booked/vulnerability/wordpress-easy-booked-plugin-2-4-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-22635 State: PUBLISHED Published: 2025-02-23T22:55:06.748Z Last Updated: 2025-02-24T14:30:45.321Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Jyothis Joy Products: Eventer Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jyothis Joy Eventer allows Reflected XSS. This issue affects Eventer: from n/a through n/a. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/eventer/vulnerability/wordpress-eventer-wordpress-event-booking-manager-plugin-plugin-3-9-9-reflected-cross-site-scripting-xss-vulne
erability/wordpress-eventer-wordpress-event-booking-manager-plugin-plugin-3-9-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22636 State: PUBLISHED Published: 2025-04-17T15:17:20.978Z Last Updated: 2025-04-17T15:44:17.110Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:L) Vendors: Vicente Ruiz Gálvez Products: VR-Frases Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vicente Ruiz Gálvez VR-Frases allows Reflected XSS. This issue affects VR-Frases: from n/a through 3.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/vr-frases/vulnerability/wordpress-vr-frases-plugin-3-0-1-reflected-xss-to-sql-injection-vulnerability?_s_id=
ress/plugin/vr-frases/vulnerability/wordpress-vr-frases-plugin-3-0-1-reflected-xss-to-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-22637 State: PUBLISHED Published: 2025-03-27T15:26:52.811Z Last Updated: 2025-03-27T16:15:25.553Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: verkkovaraani Products: Print PDF Generator and Publisher Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in verkkovaraani Print PDF Generator and Publisher allows Cross Site Request Forgery.This issue affects Print PDF Generator and Publisher: from n/a through 1.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/nopeamedia/vulnerability/wordpress-print-pdf-generator-and-publisher-plugin-1-2-0-cr
stack.com/database/wordpress/plugin/nopeamedia/vulnerability/wordpress-print-pdf-generator-and-publisher-plugin-1-2-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-22638 State: PUBLISHED Published: 2025-03-27T15:13:20.282Z Last Updated: 2025-03-27T17:59:42.389Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Acowebs Products: Product Table For WooCommerce Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Acowebs Product Table For WooCommerce allows Stored XSS.This issue affects Product Table For WooCommerce: from n/a through 1.2.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/product-table-for-woocommerce/vulnerability/wordpress-product-table-for-wo
ps://patchstack.com/database/wordpress/plugin/product-table-for-woocommerce/vulnerability/wordpress-product-table-for-woocommerce-plugin-1-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22639 State: PUBLISHED Published: 2025-02-18T19:54:27.732Z Last Updated: 2025-02-18T20:21:55.168Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: NotFound Products: Distance Rate Shipping for WooCommerce Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NotFound Distance Rate Shipping for WooCommerce allows Blind SQL Injection. This issue affects Distance Rate Shipping for WooCommerce: from n/a through 1.3.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/distance-rate-shipping-for-woocommerc
A ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/distance-rate-shipping-for-woocommerce-pro/vulnerability/wordpress-distance-rate-shipping-for-woocommerce-plugin-1-3-4-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-22640 State: PUBLISHED Published: 2025-03-27T15:12:24.012Z Last Updated: 2025-03-27T18:06:39.991Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Paytm Products: Paytm Payment Donation Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paytm Paytm Payment Donation allows Stored XSS.This issue affects Paytm Payment Donation: from n/a through 2.3.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/paytm-donation/vulnerability/wordpress-paytm-payment-donation-plugin-2-3-2-cross-site-scripting-xss
ase/wordpress/plugin/paytm-donation/vulnerability/wordpress-paytm-payment-donation-plugin-2-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22641 State: PUBLISHED Published: 2025-02-04T14:21:57.010Z Last Updated: 2025-02-04T15:06:39.932Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Prem Tiwari Products: FM Notification Bar Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Prem Tiwari FM Notification Bar allows Stored XSS. This issue affects FM Notification Bar: from n/a through 1.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/fm-notification-bar/vulnerability/wordpress-fm-notification-bar-plugin-1-0-2-cross-site-scripti
atabase/wordpress/plugin/fm-notification-bar/vulnerability/wordpress-fm-notification-bar-plugin-1-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22642 State: PUBLISHED Published: 2025-02-04T14:21:57.154Z Last Updated: 2025-02-18T18:26:14.714Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: RTO GmbH Products: Dynamic Conditions Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RTO GmbH Dynamic Conditions allows Stored XSS. This issue affects Dynamic Conditions: from n/a through 1.7.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/dynamicconditions/vulnerability/wordpress-dynamic-conditions-plugin-1-7-4-cross-site-scripting-xss-vulne
ordpress/plugin/dynamicconditions/vulnerability/wordpress-dynamic-conditions-plugin-1-7-4-cross-site-scripting-xss-vulnerability?_s_id=cve