Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ely. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321774 - https://vuldb.com/?ctiid.321774 - https://vuldb.com/?submit.636369 - https://github.com/zzb1388/cve/issues/51 - https://itsourcecode.com/
CVE ID: CVE-2025-9601 State: PUBLISHED Published: 2025-08-29T01:02:08.570Z Last Updated: 2025-08-29T14:29:22.489Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: Apartment Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was detected in itsourcecode Apartment Management System 1.0. This affects an unknown part of the file /setting/employee_salary_setup.php. The manipulation of the argument ddlEmpName results in sql injection. The attack may be launched remotely. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321775 - https://vuld
ay be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321775 - https://vuldb.com/?ctiid.321775 - https://vuldb.com/?submit.636370 - https://github.com/zzb1388/cve/issues/50 - https://itsourcecode.com/
CVE ID: CVE-2025-9602 State: PUBLISHED Published: 2025-08-29T01:02:10.988Z Last Updated: 2025-08-29T14:30:15.523Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Xinhu Products: RockOA Problem Types: CWE-285, CWE-266 Description: A vulnerability was found in Xinhu RockOA up to 2.6.9. Impacted is the function publicsaveAjax of the file /index.php. Performing manipulation results in improper authorization. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321778 - https://vuldb.com/?ctiid.321778 - https://vuldb.com/?submit.63
ulnrichment: References: - https://vuldb.com/?id.321778 - https://vuldb.com/?ctiid.321778 - https://vuldb.com/?submit.636383 - https://github.com/rainrocka/xinhu/issues/9 - https://github.com/rainrocka/xinhu/issues/9#issue-3327894144
CVE ID: CVE-2025-9603 State: PUBLISHED Published: 2025-08-29T01:32:05.620Z Last Updated: 2025-08-29T14:14:52.005Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Telesquare Products: TLR-2005KSH Problem Types: CWE-77, CWE-74 Description: A vulnerability was determined in Telesquare TLR-2005KSH 1.2.4. The affected element is an unknown function of the file /cgi-bin/internet.cgi?Command=lanCfg. Executing manipulation of the argument Hostname can lead to command injection. The attack may be performed from a remote location. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any w
ublicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321779 - https://vuldb.com/?ctiid.321779 - https://vuldb.com/?submit.636414 - https://github.com/lin-3-start/lin-cve/blob/main/Telesquare%20Tlr-2005Ksh/Telesquare%20Tlr-2005Ksh%E5%AD%98%E5%9C%A8%E5%91%BD%E4%BB%A4%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md - https://github.com/lin-3-start/lin-cve/blob/main/Telesquare%20Tlr-2005Ksh/Telesquare%20Tlr-2005Ksh%E5%AD%98%E5%9C%A8%E5%91%BD%E4%BB%A4%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md#3poc
CVE ID: CVE-2025-9604 State: PUBLISHED Published: 2025-08-29T01:32:09.045Z Last Updated: 2025-08-29T13:36:16.125Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C) Vendors: n/a Products: coze-studio Problem Types: CWE-321, CWE-320 Description: A vulnerability was identified in coze-studio up to 0.2.4. The impacted element is an unknown function of the file backend/domain/plugin/encrypt/aes.go. The manipulation of the argument AuthSecretKey/StateSecretKey/OAuthTokenSecretKey leads to use of hard-coded cryptographic key . It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitability is regarded as difficul
itiate the attack remotely. The attack is considered to have high complexity. The exploitability is regarded as difficult. To fix this issue, it is recommended to deploy a patch. The vendor replied to the GitHub issue (translated from simplified Chinese): "For scenarios requiring encryption, we will implement user-defined key management through configuration and optimize the use of encryption tools, such as random salt." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321780 - https://vuldb.com/?ctiid.321780 - https://vuldb.com/?submit.636417 - https://github.com/coze-dev/coze-studio/issues/505 - https://github.com/coze-dev/coze-studio/issues/505#issuec
.636417 - https://github.com/coze-dev/coze-studio/issues/505 - https://github.com/coze-dev/coze-studio/issues/505#issuecomment-3148568862 - https://github.com/coze-dev/coze-studio/pull/533
CVE ID: CVE-2025-9605 State: PUBLISHED Published: 2025-08-29T02:02:08.778Z Last Updated: 2025-08-29T13:31:06.430Z Severity: N/A (CVSS 10 AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: AC21, AC23 Problem Types: CWE-121, CWE-119 Description: A security vulnerability has been detected in Tenda AC21 and AC23 16.03.08.16. Affected is the function GetParentControlInfo of the file /goform/GetParentControlInfo. Such manipulation of the argument mac leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321783 - htt
cly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321783 - https://vuldb.com/?ctiid.321783 - https://vuldb.com/?submit.636545 - https://vuldb.com/?submit.636548 - https://github.com/XXRicardo/iot-cve/blob/main/Tenda/AC21/AC21V1.0re_V16.03.08.16.md - https://github.com/XXRicardo/iot-cve/blob/main/Tenda/AC23/Stack-Based%20Buffer%20Overflow%20in%20Tenda%20Wi-Fi%205%20Router%20AC23%EF%BC%88AC23V1.0re_V16.03.07.52%EF%BC%89.md - https://www.tenda.com.cn/
CVE ID: CVE-2025-9606 State: PUBLISHED Published: 2025-08-29T02:32:07.548Z Last Updated: 2025-08-29T12:35:01.215Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Educar Problem Types: CWE-89, CWE-74 Description: A vulnerability was detected in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/agenda_preferencias.php. Performing manipulation of the argument cod_agenda results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321784 - https://vu
may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321784 - https://vuldb.com/?ctiid.321784 - https://vuldb.com/?submit.636577 - https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-9606.md - https://github.com/marcelomulder/CVE/blob/main/i-educar/SQL%20Injection%20(Blind%20Time-Based)%20Vulnerability%20in%20cod_agenda%20Parameter%20on%20agenda_preferencias.php%20Endpoint.md#poc
CVE ID: CVE-2025-9607 State: PUBLISHED Published: 2025-08-29T03:02:06.871Z Last Updated: 2025-08-29T13:38:59.335Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Educar Problem Types: CWE-89, CWE-74 Description: A flaw has been found in Portabilis i-Educar up to 2.10. Affected by this issue is some unknown functionality of the file /module/TabelaArredondamento/view of the component Tabelas de Arredondamento Page. Executing manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vu
exploit has been published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321785 - https://vuldb.com/?ctiid.321785 - https://vuldb.com/?submit.636578 - https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-9607.md - https://github.com/marcelomulder/CVE/blob/main/i-educar/SQL%20Injection%20(Blind%20Time-Based)%20Vulnerability%20in%20%60id%60%20Parameter%20on%20%60.module.TabelaArredondamento.view%60%20Endpoint.md#poc
CVE ID: CVE-2025-9608 State: PUBLISHED Published: 2025-08-29T03:02:09.426Z Last Updated: 2025-08-29T13:39:43.556Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Educar Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/FormulaMedia/view of the component Formula de Cálculo de Média Page. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.co
sclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321786 - https://vuldb.com/?ctiid.321786 - https://vuldb.com/?submit.636579 - https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-9608.md - https://github.com/marcelomulder/CVE/blob/main/i-educar/SQL%20Injection%20(Blind%20Time-Based)%20Vulnerability%20in%20%60id%60%20Parameter%20on%20%60.module.FormulaMedia.view%60%20Endpoint%201.md#poc
CVE ID: CVE-2025-9609 State: PUBLISHED Published: 2025-08-29T03:32:06.181Z Last Updated: 2025-08-29T13:40:26.786Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Educar Problem Types: CWE-285, CWE-266 Description: A vulnerability was found in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /educacenso/consulta. The manipulation results in improper authorization. The attack can be executed remotely. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321787 - https://vuldb.com/?ctiid.321787 - https://vuldb.com/?submit.
Vulnrichment: References: - https://vuldb.com/?id.321787 - https://vuldb.com/?ctiid.321787 - https://vuldb.com/?submit.636580 - https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-9609.md - https://github.com/marcelomulder/CVE/blob/main/i-educar/Broken%20Access%20Control%20%E2%80%93%20Missing%20Function-Level%20Access%20Control%20in%20%60.educacenso.consulta%60%20Endpoint.md#poc
CVE ID: CVE-2025-9610 State: PUBLISHED Published: 2025-08-29T03:32:08.500Z Last Updated: 2025-08-29T13:41:29.311Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Online Event Judging System Problem Types: CWE-89, CWE-74 Description: A vulnerability was determined in code-projects Online Event Judging System 1.0. This issue affects some unknown processing of the file /create_account.php. This manipulation of the argument fname causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP
ublicly disclosed and may be utilized. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321788 - https://vuldb.com/?ctiid.321788 - https://vuldb.com/?submit.636622 - https://github.com/yihaofuweng/cve/issues/15 - https://code-projects.org/
CVE ID: CVE-2025-9616 State: PUBLISHED Published: 2025-09-04T09:22:24.265Z Last Updated: 2025-09-04T14:26:54.162Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: alobaidi Products: PopAd Problem Types: CWE-352 Description: The PopAd plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to missing or incorrect nonce validation on the PopAd_reset_cookie_time function. This makes it possible for unauthenticated attackers to reset cookie time settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: -
ed they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/842f3cb4-857e-4e9c-b84e-9a47ec65db0d?source=cve - https://plugins.trac.wordpress.org/browser/popad/trunk/admin/admin.php#L548
CVE ID: CVE-2025-9617 State: PUBLISHED Published: 2025-09-11T07:25:00.969Z Last Updated: 2025-09-11T14:37:30.951Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: evidentlycube Products: Publish approval Problem Types: CWE-352 Description: The Publish approval plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the publish_save_option function. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional
ged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e34ac4aa-65c5-43d7-9b77-d4c6068722f1?source=cve - https://plugins.trac.wordpress.org/browser/publish-approval/trunk/src/actions/HandleOptionsSave.php#L6
CVE ID: CVE-2025-9618 State: PUBLISHED Published: 2025-08-30T01:45:53.167Z Last Updated: 2025-09-02T19:26:00.498Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: wpdreams Products: Related Posts Lite Problem Types: CWE-352 Description: The Related Posts Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12. This is due to missing or incorrect nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additiona
rged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ec3667ac-1d1f-4faf-923c-7e55c03db3da?source=cve - https://plugins.trac.wordpress.org/browser/related-posts-lite/tags/1.12/backend/settings.php#L114
CVE ID: CVE-2025-9619 State: PUBLISHED Published: 2025-08-29T04:02:06.330Z Last Updated: 2025-08-29T16:24:40.171Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:X/RC:C) Vendors: E4 Sistemas Products: Mercatus ERP Problem Types: CWE-99 Description: A security flaw has been discovered in E4 Sistemas Mercatus ERP 2.00.019. The affected element is an unknown function of the file /basico/webservice/imprimir-danfe/id/. Performing manipulation results in improper control of resource identifiers. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vuln
ndor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321790 - https://vuldb.com/?ctiid.321790 - https://vuldb.com/?submit.636623
CVE ID: CVE-2025-9620 State: PUBLISHED Published: 2025-09-11T07:24:59.771Z Last Updated: 2025-09-11T14:37:48.357Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: edsteep Products: Seo Monster Problem Types: CWE-352 Description: The Seo Monster plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.3. This is due to missing or incorrect nonce validation on the check_integration() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link
ts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d224151c-0fe2-4032-a847-39628cc2f520?source=cve - https://plugins.trac.wordpress.org/browser/seo-monster/trunk/tpl/integration.php#L42 - https://plugins.trac.wordpress.org/browser/seo-monster/trunk/inc/class_seo_monster_ui.php#L69
CVE ID: CVE-2025-9621 State: PUBLISHED Published: 2025-10-11T09:28:36.133Z Last Updated: 2025-10-14T20:18:12.444Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: widgetpack Products: WidgetPack Comment System Problem Types: CWE-352 Description: The WidgetPack Comment System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.1. This is due to missing or incorrect nonce validation on the wpcmt_sync action in the wpcmt_request_handler function. This makes it possible for unauthenticated attackers to trigger comment synchronization events via a forged request granted they can trick a site administrator into
ttackers to trigger comment synchronization events via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/01996a4c-0ad8-4da8-bfa7-3442c5a67679?source=cve - https://plugins.trac.wordpress.org/browser/widgetpack-comment-system/tags/1.6.1/wpcmt.php#L295 - https://plugins.trac.wordpress.org/browser/widgetpack-comment-system/tags/1.6.1/wpcmt.php#L419
CVE ID: CVE-2025-9622 State: PUBLISHED Published: 2025-09-10T06:38:49.546Z Last Updated: 2025-09-10T20:31:46.155Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: wpblast Products: WP Blast | SEO & Performance Booster Problem Types: CWE-352 Description: The WP Blast | SEO & Performance Booster plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.6. This is due to missing or incorrect nonce validation on multiple administrative actions in the Settings class. This makes it possible for unauthenticated attackers to trigger cache purging, sitemap clearing, plugin data purging, and score resetting operations vi
thenticated attackers to trigger cache purging, sitemap clearing, plugin data purging, and score resetting operations via forged requests granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b8954061-cb8f-49fc-84d9-50851f7f48a2?source=cve - https://plugins.trac.wordpress.org/browser/wpblast/tags/1.8.6/src/Smartfire/Wordpress/WPBlast/Settings.php#L914 - https://plugins.trac.wordpress.org/browser/wpblast/tags/1.8.6/src/Smartfire/Wordpress/WPBlast/Settings.php#L906 - https://plugins.trac.wordpress.org/browser/wpblast/tags/1.8.6/s
.8.6/src/Smartfire/Wordpress/WPBlast/Settings.php#L906 - https://plugins.trac.wordpress.org/browser/wpblast/tags/1.8.6/src/Smartfire/Wordpress/WPBlast/Settings.php#L922 - https://plugins.trac.wordpress.org/browser/wpblast/tags/1.8.6/src/Smartfire/Wordpress/WPBlast/Settings.php#L930 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3357450%40wpblast&new=3357450%40wpblast&sfp_email=&sfph_mail=
CVE ID: CVE-2025-9623 State: PUBLISHED Published: 2025-09-11T07:24:57.574Z Last Updated: 2025-09-11T14:38:35.681Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: dontcare Products: Admin in English with Switch Problem Types: CWE-352 Description: The Admin in English with Switch plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the enable_eng function. This makes it possible for unauthenticated attackers to modify administrator language settings via a forged request granted they can trick a site administrator into performing an action such as clic
anguage settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9ffb0980-75f8-4f6b-a0ed-2f65bc5aa103?source=cve - https://plugins.trac.wordpress.org/browser/admin-in-english-with-switch/tags/1.1/admin-in-english-with-switch.php#L106 - https://plugins.trac.wordpress.org/browser/admin-in-english-with-switch/tags/1.1/admin-in-english-with-switch.php#L113
CVE ID: CVE-2025-9625 State: PUBLISHED Published: 2025-11-18T08:27:31.753Z Last Updated: 2025-11-18T15:42:27.177Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: interledger Products: Coil Web Monetization Problem Types: CWE-352 Description: The Coil Web Monetization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the coil-get-css-selector parameter handling in the maybe_restrict_content function. This makes it possible for unauthenticated attackers to trigger CSS selector detection functionality via a forged request granted they can trick a
unauthenticated attackers to trigger CSS selector detection functionality via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4aa4cb93-7af3-4427-a17f-160b27fcebb8?source=cve - https://plugins.trac.wordpress.org/browser/coil-web-monetization/tags/2.0.2/includes/functions.php#L48 - https://plugins.trac.wordpress.org/browser/coil-web-monetization/tags/2.0.2/includes/gating/functions.php#L202 - https://plugins.trac.wordpress.org/browser/coil-web-monetization/tags/2.0.2/includes/gating/functions.php#L195
CVE ID: CVE-2025-9626 State: PUBLISHED Published: 2025-10-11T09:28:38.732Z Last Updated: 2025-10-14T18:45:38.046Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: softwud Products: Page Blocks Problem Types: CWE-352 Description: The Page Blocks plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing or incorrect nonce validation on the admin_process_widget_page_change function. This makes it possible for unauthenticated attackers to modify widget page block configurations via a forged request granted they can trick a site administrator into performing an action such as clicking on a
ations via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/794d1149-5c6a-4e92-bbc9-00d718799df9?source=cve - https://plugins.trac.wordpress.org/browser/page-blocks/trunk/classes/page_blocks.php#L705 - https://plugins.trac.wordpress.org/browser/page-blocks/trunk/classes/page_blocks.php#L710 - https://plugins.trac.wordpress.org/browser/page-blocks/trunk/page_blocks_plugin.php#L96