Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-31625 State: PUBLISHED Published: 2025-03-31T12:55:45.845Z Last Updated: 2025-03-31T14:30:36.175Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: ramanparashar Products: Useinfluence Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ramanparashar Useinfluence allows Stored XSS. This issue affects Useinfluence: from n/a through 1.0.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/useinfluence/vulnerability/wordpress-useinfluence-plugin-1-0-8-cross-site-request-forgery-csrf-vulnerability?_s_id
lugin/useinfluence/vulnerability/wordpress-useinfluence-plugin-1-0-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-31626 State: PUBLISHED Published: 2025-04-03T13:27:12.212Z Last Updated: 2025-04-03T14:19:45.580Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: M. Ali Saleem Products: Support Helpdesk Ticket System Lite Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in M. Ali Saleem Support Helpdesk Ticket System Lite allows Reflected XSS. This issue affects Support Helpdesk Ticket System Lite: from n/a through 4.5.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ticket-help-desk-system-lite/vulnerability
Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ticket-help-desk-system-lite/vulnerability/wordpress-support-helpdesk-ticket-system-lite-plugin-4-5-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-31627 State: PUBLISHED Published: 2025-03-31T12:55:46.365Z Last Updated: 2025-03-31T14:29:32.814Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: David Lingren Products: Media Library Assistant Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media Library Assistant allows Stored XSS. This issue affects Media Library Assistant: from n/a through 3.24. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/media-library-assistant/vulnerability/wordpress-media-library-assistant-plugin-3
atchstack.com/database/wordpress/plugin/media-library-assistant/vulnerability/wordpress-media-library-assistant-plugin-3-24-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-31628 State: PUBLISHED Published: 2025-04-01T20:58:14.920Z Last Updated: 2025-04-02T13:28:11.846Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SlicedInvoices Products: Sliced Invoices Problem Types: CWE-862 Description: Missing Authorization vulnerability in SlicedInvoices Sliced Invoices. This issue affects Sliced Invoices: from n/a through 3.9.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/sliced-invoices/vulnerability/wordpress-sliced-invoices-plugin-3-9-4-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-31629 State: PUBLISHED Published: 2025-03-31T12:55:46.901Z Last Updated: 2025-03-31T13:29:15.929Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Jacob Allred Products: Infusionsoft Web Form JavaScript Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacob Allred Infusionsoft Web Form JavaScript allows Stored XSS. This issue affects Infusionsoft Web Form JavaScript: from n/a through 1.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/infusionsoft-web-form-javascript/vulnerability/wordpre
t: References: - https://patchstack.com/database/wordpress/plugin/infusionsoft-web-form-javascript/vulnerability/wordpress-infusionsoft-web-form-javascript-plugin-1-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-31630 State: PUBLISHED Published: 2025-05-16T15:45:39.177Z Last Updated: 2025-05-16T16:44:08.366Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: themeton Products: The Business Problem Types: CWE-862 Description: Missing Authorization vulnerability in themeton The Business allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Business: from n/a through 1.6.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/nrgbusiness/vulnerability/wordpress-the-business-1-6-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-31631 State: PUBLISHED Published: 2025-05-23T12:44:05.860Z Last Updated: 2025-05-23T13:34:18.941Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: AncoraThemes Products: Fish House Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in AncoraThemes Fish House allows Object Injection. This issue affects Fish House: from n/a through 1.2.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/fish-house/vulnerability/wordpress-fish-house-1-2-7-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-31632 State: PUBLISHED Published: 2025-05-23T12:44:05.394Z Last Updated: 2025-05-23T13:34:40.867Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SpyroPress Products: La Boom Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SpyroPress La Boom allows PHP Local File Inclusion. This issue affects La Boom: from n/a through 2.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/laboom/vulnerability/wordpress-la-boom-2-7-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-31633 State: PUBLISHED Published: 2025-05-23T12:44:04.939Z Last Updated: 2025-05-23T13:34:59.116Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: gavias Products: Kiamo - Responsive Business Service WordPress Theme Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Kiamo - Responsive Business Service WordPress Theme allows PHP Local File Inclusion. This issue affects Kiamo - Responsive Business Service WordPress Theme: from n/a through 1.3.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/data
me: from n/a through 1.3.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/kiamo/vulnerability/wordpress-kiamo-responsive-business-service-wordpress-theme-1-3-3-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-31634 State: PUBLISHED Published: 2025-10-22T14:32:05.043Z Last Updated: 2025-11-13T10:33:39.834Z Vendors: designthemes Products: Insurance Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in designthemes Insurance insurance allows Object Injection.This issue affects Insurance: from n/a through <= 3.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/insurance/vulnerability/wordpress-insurance-3-5-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-31635 State: PUBLISHED Published: 2025-06-09T15:56:36.111Z Last Updated: 2025-06-09T17:23:00.644Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: LambertGroup Products: CLEVER Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in LambertGroup CLEVER allows Path Traversal. This issue affects CLEVER: from n/a through 2.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/lbg-audio11-html5-shoutcast_history/vulnerability/wordpress-clever-2-6-arbitrary-file-download-vulnerability?_s_id=cve
CVE ID: CVE-2025-31636 State: PUBLISHED Published: 2025-05-23T12:44:04.482Z Last Updated: 2025-05-23T13:35:17.082Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: SaurabhSharma Products: WP Post Modules for Elementor Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SaurabhSharma WP Post Modules for Elementor allows Reflected XSS. This issue affects WP Post Modules for Elementor: from n/a through 2.5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-post-modules-el/vulnerability/wordpress-wp-post-modules-f
erences: - https://patchstack.com/database/wordpress/plugin/wp-post-modules-el/vulnerability/wordpress-wp-post-modules-for-elementor-plugin-2-5-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-31637 State: PUBLISHED Published: 2025-05-16T15:45:38.696Z Last Updated: 2025-05-16T16:44:16.152Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: LambertGroup Products: SHOUT Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup SHOUT allows SQL Injection. This issue affects SHOUT: from n/a through 3.5.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/lbg-audio8-html5-radio_ads/vulnerability/wordpress-shout-3-5-3-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-31638 State: PUBLISHED Published: 2025-06-09T15:56:35.343Z Last Updated: 2025-06-10T13:35:29.405Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: themeton Products: Spare Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeton Spare allows Reflected XSS. This issue affects Spare: from n/a through 1.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/spare/vulnerability/wordpress-spare-1-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-31639 State: PUBLISHED Published: 2025-05-16T15:45:38.188Z Last Updated: 2025-05-16T16:44:23.164Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: themeton Products: Spare Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in themeton Spare allows Cross Site Request Forgery. This issue affects Spare: from n/a through 1.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/spare/vulnerability/wordpress-spare-1-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-31640 State: PUBLISHED Published: 2025-05-16T15:45:37.673Z Last Updated: 2025-05-16T16:45:09.704Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: LambertGroup Products: Magic Responsive Slider and Carousel WordPress Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Magic Responsive Slider and Carousel WordPress allows SQL Injection. This issue affects Magic Responsive Slider and Carousel WordPress: from n/a through 1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/magic-carouse
nal Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/magic-carousel/vulnerability/wordpress-magic-responsive-slider-and-carousel-wordpress-1-4-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-31641 State: PUBLISHED Published: 2025-05-16T15:45:37.174Z Last Updated: 2025-05-16T16:45:17.941Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: LambertGroup Products: UberSlider Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup UberSlider allows SQL Injection. This issue affects UberSlider: from n/a through 2.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/uber-classic/vulnerability/wordpress-uberslider-2-3-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-31644 State: PUBLISHED Published: 2025-05-07T22:04:10.938Z Last Updated: 2025-05-15T04:01:14.897Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: F5 Products: BIG-IP Problem Types: CWE-77 Description: When running in Appliance mode, a command injection vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command which may allow an authenticated attacker with administrator role privileges to execute arbitrary system commands. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes:
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000148591
CVE ID: CVE-2025-31645 State: PUBLISHED Published: 2025-11-11T16:50:44.422Z Last Updated: 2025-11-14T15:29:13.770Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: System Event Log Viewer Utility software Problem Types: Escalation of Privilege, CWE-427 Description: Uncontrolled search path for some System Event Log Viewer Utility software for all versions within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present wi
able escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01380.html
CVE ID: CVE-2025-31647 State: PUBLISHED Published: 2025-11-11T16:50:46.422Z Last Updated: 2025-11-13T04:55:36.359Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Graphics Software Problem Types: Escalation of Privilege, CWE-427 Description: Uncontrolled search path for some Intel(R) Graphics Software before version 25.22.1502.2 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special int
f privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01356.html
CVE ID: CVE-2025-31649 State: PUBLISHED Published: 2025-11-17T22:55:15.912Z Last Updated: 2025-11-19T04:55:26.513Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L) Vendors: Broadcom, Dell Products: BCM5820X, ControlVault3, ControlVault3 Plus Problem Types: CWE-908 Description: A hard-coded password vulnerability exists in the ControlVault WBDI Driver functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.47. A specially crafted ControlVault API call can lead to execute priviledged operation. An attacker can issue an api call to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichm
issue an api call to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000326061/dsa-2025-228 - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2173
CVE ID: CVE-2025-31650 State: PUBLISHED Published: 2025-04-28T19:14:31.107Z Last Updated: 2025-11-03T19:53:11.497Z Vendors: Apache Software Foundation Products: Apache Tomcat Problem Types: CWE-459 Description: Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. The following versions were EOL at the time the CVE was
2, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.90 though 8.5.100. Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/j6zzk0y3yym9pzfzkq5vcyxzz0yzh826
CVE ID: CVE-2025-31651 State: PUBLISHED Published: 2025-04-28T19:17:21.721Z Last Updated: 2025-11-03T19:53:12.871Z Vendors: Apache Software Foundation Products: Apache Tomcat Problem Types: CWE-116 Description: Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102. The following versions were EOL
1.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/list.html?announce@tomcat.apache.org
CVE ID: CVE-2025-31654 State: PUBLISHED Published: 2025-04-15T21:07:32.609Z Last Updated: 2025-04-16T15:09:04.278Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Growatt Products: Cloud portal Problem Types: CWE-639 Description: An attacker can get information about the groups of the smart home devices for arbitrary users (i.e., "rooms"). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04
CVE ID: CVE-2025-31672 State: PUBLISHED Published: 2025-04-09T11:59:33.900Z Last Updated: 2025-05-23T13:11:07.642Z Vendors: Apache Software Foundation Products: Apache POI Problem Types: CWE-20 Description: Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are basically zip files and it is possible for malicious users to add zip entries with duplicate names (including the path) in the zip. In this case, products reading the affected file could read different data because 1 of the zip entries with the duplicate name is selected over another but different products may choose a different zip en
of the zip entries with the duplicate name is selected over another but different products may choose a different zip entry. This issue affects Apache POI poi-ooxml before 5.4.0. poi-ooxml 5.4.0 has a check that throws an exception if zip entries with duplicate file names are found in the input file. Users are recommended to upgrade to version poi-ooxml 5.4.0, which fixes the issue. Please read https://poi.apache.org/security.html for recommendations about how to use the POI libraries securely. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bz.apache.org/bugzilla/show_bug.cgi?id=69620 - https://lists.apache.org/thread/k14w8vcjqy4h34hh5kzldko
rences: - https://bz.apache.org/bugzilla/show_bug.cgi?id=69620 - https://lists.apache.org/thread/k14w8vcjqy4h34hh5kzldko78kpylkq5
CVE ID: CVE-2025-31673 State: PUBLISHED Published: 2025-03-31T21:34:16.118Z Last Updated: 2025-04-29T15:47:25.459Z Vendors: Drupal Products: Drupal core Problem Types: CWE-863 Description: Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-core-2025-002
CVE ID: CVE-2025-31674 State: PUBLISHED Published: 2025-03-31T21:34:53.144Z Last Updated: 2025-04-03T17:18:14.624Z Vendors: Drupal Products: Drupal core Problem Types: CWE-915 Description: Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-core-2025-003
CVE ID: CVE-2025-31675 State: PUBLISHED Published: 2025-03-31T21:35:20.059Z Last Updated: 2025-04-29T15:45:10.519Z Vendors: Drupal Products: Drupal core Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-core-2025-004
CVE ID: CVE-2025-31676 State: PUBLISHED Published: 2025-03-31T21:36:58.560Z Last Updated: 2025-06-19T22:42:50.725Z Vendors: Drupal Products: Email TFA Problem Types: CWE-1390 Description: Weak Authentication vulnerability in Drupal Email TFA allows Brute Force.This issue affects Email TFA: from 0.0.0 before 2.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-001
CVE ID: CVE-2025-31677 State: PUBLISHED Published: 2025-03-31T21:37:27.837Z Last Updated: 2025-04-29T15:42:17.877Z Vendors: Drupal Products: AI (Artificial Intelligence) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Drupal AI (Artificial Intelligence) allows Cross Site Request Forgery.This issue affects AI (Artificial Intelligence): from 1.0.0 before 1.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-003