Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-58459 State: PUBLISHED Published: 2025-09-03T15:02:26.867Z Last Updated: 2025-11-04T21:13:44.654Z Vendors: Jenkins Project Products: Jenkins global-build-stats Plugin Description: Jenkins global-build-stats Plugin 322.v22f4db_18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing attackers with Overall/Read permission to enumerate graph IDs. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-09-03/#SECURITY-3535
CVE ID: CVE-2025-58460 State: PUBLISHED Published: 2025-09-03T15:02:27.580Z Last Updated: 2025-11-04T21:13:45.952Z Vendors: Jenkins Project Products: Jenkins OpenTelemetry Plugin Description: A missing permission check in Jenkins OpenTelemetry Plugin 3.1543.v8446b_92b_cd64 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-09-03/#SECURITY-3602
CVE ID: CVE-2025-58462 State: PUBLISHED Published: 2025-09-09T21:09:48.098Z Last Updated: 2025-09-12T13:41:28.535Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: OPEXUS Products: FOIAXpress Public Access Link (PAL) Problem Types: CWE-89 Description: OPEXUS FOIAXpress Public Access Link (PAL) before version 11.13.1.0 allows SQL injection via SearchPopularDocs.aspx. A remote, unauthenticated attacker could read, write, or delete any content in the underlying database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.opexustech.com/docs/foiaxpress/11.13.0/FOIAXpress_Release_Notes_11.13.1.0.pdf - https://www.cve.org/CVERecord?id=C
/docs.opexustech.com/docs/foiaxpress/11.13.0/FOIAXpress_Release_Notes_11.13.1.0.pdf - https://www.cve.org/CVERecord?id=CVE-2025-58462 - https://github.com/cisagov/CSAF/blob/develop/csaf_files/IT/white/2025/va-25-252-01.json
CVE ID: CVE-2025-58463 State: PUBLISHED Published: 2025-11-07T15:10:42.856Z Last Updated: 2025-11-07T16:11:30.915Z Vendors: QNAP Systems Inc. Products: Download Station Problem Types: CWE-23 Description: A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following versions: Download Station 5.10.0.305 ( 2025/09/16 ) and later Download Station 5.10.0.304 ( 2025/09/08 ) and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/e
0.0.304 ( 2025/09/08 ) and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-37
CVE ID: CVE-2025-58464 State: PUBLISHED Published: 2025-11-07T15:10:10.396Z Last Updated: 2025-11-07T16:11:39.344Z Vendors: QNAP Systems Inc. Products: QuMagie Problem Types: CWE-23 Description: A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: QuMagie 2.7.3 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-43
CVE ID: CVE-2025-58465 State: PUBLISHED Published: 2025-11-07T15:09:31.301Z Last Updated: 2025-11-07T15:47:03.235Z Vendors: QNAP Systems Inc. Products: Download Station Problem Types: CWE-79 Description: A cross-site scripting (XSS) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following versions: Download Station 5.10.0.305 ( 2025/09/16 ) and later Download Station 5.10.0.304 ( 2025/09/08 ) and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/securi
( 2025/09/08 ) and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-37
CVE ID: CVE-2025-58469 State: PUBLISHED Published: 2025-11-07T15:08:56.159Z Last Updated: 2025-11-07T15:48:30.618Z Vendors: QNAP Systems Inc. Products: QuLog Center Problem Types: CWE-352 Description: A cross-site request forgery (CSRF) vulnerability has been reported to affect QuLog Center. The remote attackers can then exploit the vulnerability to gain privileges or hijack user identities. We have already fixed the vulnerability in the following version: QuLog Center 1.8.2.927 ( 2025/09/17 ) and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-42
CVE ID: CVE-2025-58473 State: PUBLISHED Published: 2025-09-23T22:21:06.164Z Last Updated: 2025-09-24T14:07:48.727Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: AutomationDirect Products: CLICK PLUS C0-0x CPU firmware, CLICK PLUS C0-1x CPU firmware, CLICK PLUS C2-x CPU firmware Problem Types: CWE-404 Description: An improper resource shutdown or release vulnerability has been identified in the Click Plus C2-03CPU-2 device running firmware version 3.60. The vulnerability allows an unauthenticated attacker to perform a denial-of-service attack by exhausting all available device sessions of the Click Programming Software. Additional Analyst Notes: - CISA ADP
ack by exhausting all available device sessions of the Click Programming Software. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-266-01 - https://www.automationdirect.com/support/software-downloads
CVE ID: CVE-2025-58474 State: PUBLISHED Published: 2025-10-15T13:55:43.347Z Last Updated: 2025-10-16T03:56:40.663Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: F5 Products: BIG-IP, NGINX App Protect WAF Problem Types: CWE-770 Description: When BIG-IP Advanced WAF is configured on a virtual server with Server-Side Request Forgery (SSRF) protection or when an NGINX server is configured with App Protect Bot Defense, undisclosed requests can disrupt new client requests. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/articl
S) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000148512
CVE ID: CVE-2025-58578 State: PUBLISHED Published: 2025-10-06T06:47:30.899Z Last Updated: 2025-10-06T12:21:55.069Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L) Vendors: SICK AG Products: Enterprise Analytics Problem Types: CWE-770 Description: A user with the appropriate authorization can create any number of user accounts via an API endpoint using a POST request. There are no quotas, checking mechanisms or restrictions to limit the creation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf - https://ww
om/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.json - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.pdf
CVE ID: CVE-2025-58579 State: PUBLISHED Published: 2025-10-06T07:09:09.074Z Last Updated: 2025-10-06T17:34:13.760Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SICK AG Products: Baggage Analytics, Tire Analytics, Package Analytics, Logistic Diagnostic Analytics, Enterprise Analytics Problem Types: CWE-497 Description: Due to a lack of authentication, it is possible for an unauthenticated user to request data from this endpoint, making the application vulnerable for user enumeration. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guideline
rences: - https://sick.com/psirt - https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.json - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.pdf
CVE ID: CVE-2025-58580 State: PUBLISHED Published: 2025-10-06T06:49:27.619Z Last Updated: 2025-10-06T12:21:24.059Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: SICK AG Products: Enterprise Analytics Problem Types: CWE-117 Description: An API endpoint allows arbitrary log entries to be created via POST request. Without sufficient validation of the input data, an attacker can create manipulated log entries and thus falsify or dilute logs, for example. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im01067
https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.json - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.pdf
CVE ID: CVE-2025-58581 State: PUBLISHED Published: 2025-10-06T06:50:12.186Z Last Updated: 2025-10-06T12:18:57.605Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SICK AG Products: Enterprise Analytics Problem Types: CWE-200 Description: When an error occurs in the application a full stacktrace is provided to the user. The stacktrace lists class and method names as well as other internal information. An attacker can thus obtain information about the technology used and the structure of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://www.sick.com/media/docs/9/19/719/special_information_sick_op
ulnrichment: References: - https://sick.com/psirt - https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.json - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.pdf
CVE ID: CVE-2025-58582 State: PUBLISHED Published: 2025-10-06T06:50:56.953Z Last Updated: 2025-10-06T12:18:15.680Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: SICK AG Products: Enterprise Analytics Problem Types: CWE-770 Description: If a user tries to login but the provided credentials are incorrect a log is created. The data for this POST requests is not validated and it’s possible to send giant payloads which are then logged. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf - https://www
m/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.json - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.pdf
CVE ID: CVE-2025-58583 State: PUBLISHED Published: 2025-10-06T06:52:03.916Z Last Updated: 2025-10-06T16:56:06.556Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SICK AG Products: Enterprise Analytics Problem Types: CWE-497 Description: The application provides access to a login protected H2 database for caching purposes. The username is prefilled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org
sick_en_im0106719.pdf - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.json - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.pdf
CVE ID: CVE-2025-58584 State: PUBLISHED Published: 2025-10-06T07:01:04.945Z Last Updated: 2025-10-06T16:37:23.793Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SICK AG Products: Baggage Analytics, Tire Analytics, Package Analytics, Logistic Diagnostic Analytics, Enterprise Analytics Problem Types: CWE-598 Description: In the HTTP request, the username and password are transferred directly in the URL as parameters. However, URLs can be stored in various systems such as server logs, browser histories or proxy servers. As a result, there is a high risk that this sensitive data will be disclosed unintentionally. Additional Analyst Notes: - CISA ADP Vulnrichme
a high risk that this sensitive data will be disclosed unintentionally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.json - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.pdf
CVE ID: CVE-2025-58585 State: PUBLISHED Published: 2025-10-06T07:01:46.210Z Last Updated: 2025-10-06T16:36:07.632Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SICK AG Products: Baggage Analytics, Tire Analytics, Package Analytics, Logistic Diagnostic Analytics Problem Types: CWE-497 Description: Multiple endpoints with sensitive information do not require authentication, making the application susceptible to information gathering. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf - https://w
com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.json - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.pdf
CVE ID: CVE-2025-58586 State: PUBLISHED Published: 2025-10-06T07:02:47.270Z Last Updated: 2025-10-06T18:32:52.715Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SICK AG Products: Baggage Analytics, Tire Analytics, Package Analytics, Logistic Diagnostic Analytics, Enterprise Analytics Problem Types: CWE-204 Description: For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existing username. This allows an attacker to guess usernames until they find an existing one. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https:
y find an existing one. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.json - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.pdf
CVE ID: CVE-2025-58587 State: PUBLISHED Published: 2025-10-06T07:03:15.540Z Last Updated: 2025-10-06T18:21:04.170Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: SICK AG Products: Baggage Analytics, Tire Analytics, Package Analytics, Logistic Diagnostic Analytics, Enterprise Analytics Problem Types: CWE-307 Description: The application does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it possible for an attacker to guess user credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://www.sick.com/media/docs/9/19/719/special_informati
CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.json - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.pdf
CVE ID: CVE-2025-58589 State: PUBLISHED Published: 2025-10-06T07:03:41.488Z Last Updated: 2025-10-06T18:19:55.909Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: SICK AG Products: Baggage Analytics, Tire Analytics, Package Analytics, Logistic Diagnostic Analytics Problem Types: CWE-200 Description: When an error occurs in the application a full stacktrace is provided to the user. The stacktrace lists class and method names as well as other internal information. An attacker thus receives information about the technology used and the structure of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://ww
of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.json - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.pdf
CVE ID: CVE-2025-58590 State: PUBLISHED Published: 2025-10-06T07:06:26.315Z Last Updated: 2025-10-06T17:42:15.992Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: SICK AG Products: Baggage Analytics, Tire Analytics, Package Analytics, Logistic Diagnostic Analytics Problem Types: CWE-22 Description: It's possible to brute force folders and files, what can be used by an attacker to steal sensitve information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf - https://www.cisa.gov/resources-tools/
ial_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.json - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.pdf
CVE ID: CVE-2025-58591 State: PUBLISHED Published: 2025-10-06T07:07:30.103Z Last Updated: 2025-10-06T17:37:34.792Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: SICK AG Products: Baggage Analytics, Tire Analytics, Package Analytics, Logistic Diagnostic Analytics Problem Types: CWE-22 Description: A remote, unauthorized attacker can brute force folders and files and read them like private keys or configurations, making the application vulnerable for gathering sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_c
ces: - https://sick.com/psirt - https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.json - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.pdf
CVE ID: CVE-2025-58592 State: PUBLISHED Published: 2025-11-06T15:54:20.550Z Last Updated: 2025-11-13T10:33:42.640Z Vendors: Cozmoslabs Products: TranslatePress Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Object Injection.This issue affects TranslatePress: from n/a through <= 2.10.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/translatepress-multilingual/vulnerability/wordpress-translatepress-plugin-2-10-2-deserialization-of-untrusted-data-vulnerability?_s_id=cve
CVE ID: CVE-2025-58593 State: PUBLISHED Published: 2025-09-03T14:36:36.291Z Last Updated: 2025-09-03T17:51:58.771Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Themeisle Products: Orbit Fox by ThemeIsle Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Orbit Fox by ThemeIsle allows Stored XSS. This issue affects Orbit Fox by ThemeIsle: from n/a through 3.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/themeisle-companion/vulnerability/wordpress-orbit-fox-by-themeisle-plugin-3-0-0-cross-site
com/database/wordpress/plugin/themeisle-companion/vulnerability/wordpress-orbit-fox-by-themeisle-plugin-3-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-58594 State: PUBLISHED Published: 2025-09-03T14:36:36.858Z Last Updated: 2025-09-03T17:51:51.538Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: themefusecom Products: Brizy Problem Types: CWE-862 Description: Missing Authorization vulnerability in themefusecom Brizy allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Brizy: from n/a through 2.7.12. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/brizy/vulnerability/wordpress-brizy-plugin-2-7-12-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-58595 State: PUBLISHED Published: 2025-11-06T15:54:21.774Z Last Updated: 2025-11-13T10:33:42.641Z Vendors: Saad Iqbal Products: All In One Login Problem Types: CWE-290 Description: Authentication Bypass by Spoofing vulnerability in Saad Iqbal All In One Login change-wp-admin-login allows Identity Spoofing.This issue affects All In One Login: from n/a through <= 2.0.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/change-wp-admin-login/vulnerability/wordpress-all-in-one-login-plugin-2-0-8-bypass-vulnerability-vulnerability?_s_id=cve