Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-22353 State: PUBLISHED Published: 2025-01-07T10:48:38.270Z Last Updated: 2025-01-07T16:09:47.957Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Balcom-Vetillo Design, Inc. Products: BVD Easy Gallery Manager Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Balcom-Vetillo Design, Inc. BVD Easy Gallery Manager allows Reflected XSS.This issue affects BVD Easy Gallery Manager: from n/a through 1.0.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/bvd-easy-gallery-manager/vulnerability/wordpress
ichment: References: - https://patchstack.com/database/wordpress/plugin/bvd-easy-gallery-manager/vulnerability/wordpress-bvd-easy-gallery-manager-plugin-1-0-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22354 State: PUBLISHED Published: 2025-01-07T16:52:52.863Z Last Updated: 2025-01-07T17:53:27.148Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Code Themes Products: Digi Store Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Code Themes Digi Store allows DOM-Based XSS.This issue affects Digi Store: from n/a through 1.1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/digi-store/vulnerability/wordpress-digi-store-theme-1-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22355 State: PUBLISHED Published: 2025-01-07T10:48:37.480Z Last Updated: 2025-01-07T16:10:01.321Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: kiKx Products: Kikx Simple Post Author Filter Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kiKx Kikx Simple Post Author Filter allows Reflected XSS.This issue affects Kikx Simple Post Author Filter: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/sa-post-author-filter/vulnerability/wordpress-kikx-simple-post-author-filter-p
/patchstack.com/database/wordpress/plugin/sa-post-author-filter/vulnerability/wordpress-kikx-simple-post-author-filter-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22356 State: PUBLISHED Published: 2025-03-28T15:12:25.213Z Last Updated: 2025-03-28T15:58:49.230Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Stencies Products: Stencies Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stencies Stencies allows Reflected XSS. This issue affects Stencies: from n/a through 0.58. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/stencies/vulnerability/wordpress-stencies-plugin-0-58-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22357 State: PUBLISHED Published: 2025-01-07T10:48:36.708Z Last Updated: 2025-01-07T16:10:15.793Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Simple Plugins Products: Target Notifications Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simple Plugins Target Notifications allows Reflected XSS.This issue affects Target Notifications: from n/a through 1.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/target-notifications/vulnerability/wordpress-target-notifications-plugin-1-1-1-reflect
ack.com/database/wordpress/plugin/target-notifications/vulnerability/wordpress-target-notifications-plugin-1-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22358 State: PUBLISHED Published: 2025-01-07T10:48:35.934Z Last Updated: 2025-01-07T16:10:26.813Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Marcon Simone Products: Wp advertising management Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcon Simone Wp advertising management allows Reflected XSS.This issue affects Wp advertising management: from n/a through 1.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/advertising-management/vulnerability/wordpress-wp-advertising-management-
tps://patchstack.com/database/wordpress/plugin/advertising-management/vulnerability/wordpress-wp-advertising-management-plugin-1-0-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22359 State: PUBLISHED Published: 2025-01-07T10:48:35.128Z Last Updated: 2025-01-07T16:10:39.993Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: PJFC Products: SyncFields Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PJFC SyncFields allows Reflected XSS.This issue affects SyncFields: from n/a through 2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/syncfields/vulnerability/wordpress-syncfields-plugin-2-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22360 State: PUBLISHED Published: 2025-03-28T15:12:25.404Z Last Updated: 2025-03-28T15:58:24.447Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: NotFound Products: WP Azure offload Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound WP Azure offload allows Reflected XSS. This issue affects WP Azure offload: from n/a through 2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-azure-offload/vulnerability/wordpress-wp-azure-offload-plugin-2-0-reflected-cross-site-scripting-xss-vulnera
s/plugin/wp-azure-offload/vulnerability/wordpress-wp-azure-offload-plugin-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22361 State: PUBLISHED Published: 2025-01-09T15:39:29.947Z Last Updated: 2025-01-10T20:38:54.904Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Opentracker Products: Opentracker Analytics Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Opentracker Opentracker Analytics allows Reflected XSS.This issue affects Opentracker Analytics: from n/a through 1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/opentracker-analytics/vulnerability/wordpress-opentracker-analytics-plugin-1-3-reflected-cr
om/database/wordpress/plugin/opentracker-analytics/vulnerability/wordpress-opentracker-analytics-plugin-1-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22362 State: PUBLISHED Published: 2025-01-07T10:48:34.316Z Last Updated: 2025-01-07T16:10:51.230Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Powerfusion Products: WPAchievements Free Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Powerfusion WPAchievements Free allows Stored XSS.This issue affects WPAchievements Free: from n/a through 1.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wpachievements-free/vulnerability/wordpress-wpachievements-free-plugin-1-2-0-cross-site-scriptin
tabase/wordpress/plugin/wpachievements-free/vulnerability/wordpress-wpachievements-free-plugin-1-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22363 State: PUBLISHED Published: 2025-01-07T16:57:15.195Z Last Updated: 2025-01-07T17:37:12.733Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: ORION Products: Allada T-shirt Designer for Woocommerce Problem Types: CWE-862 Description: Missing Authorization vulnerability in ORION Allada T-shirt Designer for Woocommerce.This issue affects Allada T-shirt Designer for Woocommerce: from n/a through 1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/allada-tshirt-designer-for-woocommerce/vulnerability/wordpress-allada-t-shirt-designer-for-woocommerce-plugin-1-1-broken-access-co
irt-designer-for-woocommerce/vulnerability/wordpress-allada-t-shirt-designer-for-woocommerce-plugin-1-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-22364 State: PUBLISHED Published: 2025-01-07T10:48:33.442Z Last Updated: 2025-01-07T16:11:01.517Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Service Shogun Products: Ach Invoice App Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Service Shogun Ach Invoice App allows PHP Local File Inclusion.This issue affects Ach Invoice App: from n/a through 1.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ach-invoice-app/vulnerability/wordpress-ach-invoice-app-plugin-1-0-1-lo
https://patchstack.com/database/wordpress/plugin/ach-invoice-app/vulnerability/wordpress-ach-invoice-app-plugin-1-0-1-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-22365 State: PUBLISHED Published: 2025-01-07T16:51:15.500Z Last Updated: 2025-01-07T17:54:36.617Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Eric McNiece Products: EMC2 Alert Boxes Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eric McNiece EMC2 Alert Boxes allows Stored XSS.This issue affects EMC2 Alert Boxes: from n/a through 1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/emc2-alert-boxes/vulnerability/wordpress-emc2-alert-boxes-plugin-1-3-cross-site-scripting-xss-vulnerabili
rdpress/plugin/emc2-alert-boxes/vulnerability/wordpress-emc2-alert-boxes-plugin-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22366 State: PUBLISHED Published: 2025-03-11T13:40:23.659Z Last Updated: 2025-04-01T04:47:47.110Z Vendors: Mennekes Products: Smart / Premium charging stations Problem Types: CWE-78, CWE-250, OWASP-A03 Description: The authenticated firmware update capability of the firmware for Mennekes Smart / Premium Chargingpoints can be abused for command execution because OS command are improperly neutralized when certain fields are passed to the underlying OS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://csirt.divd.nl/CVE-2025-22366 - https://csirt.divd.nl/DIVD-2025-00003 - https://www.mennekes.nl/fileadmin/MEN-Deutschland/emobility/04_software/06_smart_pre
s://csirt.divd.nl/DIVD-2025-00003 - https://www.mennekes.nl/fileadmin/MEN-Deutschland/emobility/04_software/06_smart_premium/Release_Notes_for_2.15_06.03.2025.pdf
CVE ID: CVE-2025-22367 State: PUBLISHED Published: 2025-03-11T13:40:21.388Z Last Updated: 2025-04-01T04:47:44.127Z Vendors: Mennekes Products: Smart / Premium charging stations Problem Types: CWE-78, CWE-250, OWASP-A03 Description: The authenticated time setting capability of the firmware for Mennekes Smart / Premium Chargingpoints can be abused for command execution because OS command are improperly neutralized when certain fields are passed to the underlying OS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://csirt.divd.nl/CVE-2025-22367 - https://csirt.divd.nl/DIVD-2025-00003 - https://www.mennekes.nl/fileadmin/MEN-Deutschland/emobility/04_software/06_smart_premiu
/csirt.divd.nl/DIVD-2025-00003 - https://www.mennekes.nl/fileadmin/MEN-Deutschland/emobility/04_software/06_smart_premium/Release_Notes_for_2.15_06.03.2025.pdf
CVE ID: CVE-2025-22368 State: PUBLISHED Published: 2025-03-11T13:40:22.216Z Last Updated: 2025-04-01T04:47:45.140Z Vendors: Mennekes Products: Smart / Premium charging stations Problem Types: CWE-78, CWE-250, OWASP-A03 Description: The authenticated SCU firmware command of the firmware for Mennekes Smart / Premium Chargingpoints can be abused for command execution because OS commands are improperly neutralized when certain fields are passed to the underlying OS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://csirt.divd.nl/CVE-2025-22368 - https://csirt.divd.nl/DIVD-2025-00003 - https://www.mennekes.nl/fileadmin/MEN-Deutschland/emobility/04_software/06_smart_premium/
sirt.divd.nl/DIVD-2025-00003 - https://www.mennekes.nl/fileadmin/MEN-Deutschland/emobility/04_software/06_smart_premium/Release_Notes_for_2.15_06.03.2025.pdf
CVE ID: CVE-2025-22369 State: PUBLISHED Published: 2025-03-11T13:40:24.403Z Last Updated: 2025-04-01T04:47:47.988Z Vendors: Mennekes Products: Smart / Premium charging stations Problem Types: CWE-552 Description: The ReadFile endpoint of the firmware for Mennekes Smart / Premium Chargingpoints can be abused to read arbitrary files from the underlying OS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://csirt.divd.nl/CVE-2025-22369 - https://csirt.divd.nl/DIVD-2025-00003 - https://www.mennekes.nl/fileadmin/MEN-Deutschland/emobility/04_software/06_smart_premium/Release_Notes_for_2.15_06.03.2025.pdf
CVE ID: CVE-2025-22370 State: PUBLISHED Published: 2025-03-11T13:40:22.946Z Last Updated: 2025-04-01T04:47:46.281Z Vendors: Mennekes Products: Smart / Premium charging stations Problem Types: CWE-89, OWASP-A03 Description: Many fields for the web configuration interface of the firmware for Mennekes Smart / Premium Chargingpoints can be abused to execute arbitrary SQL commands because the values are insufficiently neutralized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://csirt.divd.nl/CVE-2025-22370 - https://csirt.divd.nl/DIVD-2025-00003 - https://www.mennekes.nl/fileadmin/MEN-Deutschland/emobility/04_software/06_smart_premium/Release_Notes_for_2.15_06.03.2025.pdf
CVE ID: CVE-2025-22371 State: PUBLISHED Published: 2025-04-14T15:32:49.665Z Last Updated: 2025-04-21T11:43:09.671Z Vendors: SicommNet Products: BASEC Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SicommNet BASEC (SaaS Service) login page allows an unauthenticated remote attacker to Bypass Authentication and execute arbitrary SQL commands.This issue at least affects BASEC for the date of 14 Dec 2021 onwards. It is very likely that this vulnerability has been present in the solution before that. The issue was fixed by SicommNet around 11pm on 16 april 2025 (Eastern Time) Additional Analyst Notes: - CISA
ore that. The issue was fixed by SicommNet around 11pm on 16 april 2025 (Eastern Time) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://basec.sicomm.net/ - https://csirt.divd.nl/DIVD-2025-00001 - https://csirt.divd.nl/CVE-2025-22371
CVE ID: CVE-2025-22372 State: PUBLISHED Published: 2025-04-14T15:32:49.367Z Last Updated: 2025-04-15T10:38:53.145Z Vendors: SicommNet Products: BASEC Problem Types: CWE-522 Description: Insufficiently Protected Credentials vulnerability in SicommNet BASEC on SaaS allows Password Recovery. Passwords are either stored in plain text using reversible encryption, allowing an attacker with sufficient privileges to extract plain text passwords easily. This issue affects BASEC: from 14 Dec 2021. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://basec.sicomm.net/login/ - https://csirt.divd.nl/DIVD-2025-00001 - https://csirt.divd.nl/CVE-2025-22372
CVE ID: CVE-2025-22373 State: PUBLISHED Published: 2025-04-14T15:32:49.533Z Last Updated: 2025-04-15T10:38:54.463Z Vendors: SicommNet Products: BASEC Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SicommNet BASEC on SaaS allows Reflected XSS, XSS Through HTTP Query Strings, Rendering of Arbitrary HTML and alternation of CSS Styles This issue affects BASEC: from 14 Dec 2021. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://basec.sicomm.net/login/ - https://csirt.divd.nl/DIVD-2025-00001 - https://csirt.divd.nl/CVE-2025-22373
CVE ID: CVE-2025-22374 State: PUBLISHED Published: 2025-04-10T11:02:47.109Z Last Updated: 2025-04-10T13:08:07.721Z Vendors: Videx Inc. Products: CyberAudit-Web Problem Types: CWE-918 Description: A Server-Side Request Forgery (SSRF) vulnerability was discovered in the videx-legacy-ssl web service of Videx’s CyberAudit-Web, affecting versions prior to 1.1.3. This vulnerability has been patched in versions after 1.1.3. Leaving this vulnerability unpatched could lead to unauthorized access to the underlying infrastructure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://csirt.divd.nl/CVE-2025-22374 - https://csirt.divd.nl/DIVD-2024-00043/
CVE ID: CVE-2025-22375 State: PUBLISHED Published: 2025-04-10T11:02:46.646Z Last Updated: 2025-04-10T13:18:18.627Z Vendors: Videx Inc. Products: CyberAudit-Web Problem Types: CWE-287 Description: An authentication bypass vulnerability was found in Videx's CyberAudit-Web. Through the exploitation of a logic flaw, an attacker could create a valid session without any credentials. This vulnerability has been patched in versions later than 9.5 and a patch has been made available to all instances of CyberAudit-Web, including the versions that are End of Maintenance (EOM). Anyone that requires support with the resolution of this issue can contact support@videx.com for assistance. Additional Analyst
that requires support with the resolution of this issue can contact support@videx.com for assistance. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://csirt.divd.nl/CVE-2025-22375 - https://csirt.divd.nl/DIVD-2024-00043/
CVE ID: CVE-2025-22376 State: PUBLISHED Published: 2025-01-03T00:00:00 Last Updated: 2025-01-21T17:49:18.077Z Vendors: n/a Products: n/a Problem Types: CWE-338 Description: In Net::OAuth::Client in the Net::OAuth package before 0.29 for Perl, the default nonce is a 32-bit integer generated from the built-in rand() function, which is not cryptographically strong. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://metacpan.org/release/RRWO/Net-OAuth-0.29/changes - https://metacpan.org/release/KGRENNAN/Net-OAuth-0.28/source/lib/Net/OAuth/Client.pm#L260
CVE ID: CVE-2025-22377 State: PUBLISHED Published: 2025-05-27T00:00:00.000Z Last Updated: 2025-05-29T18:24:53.542Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W920, W930, W1000, Modem 5123, Modem 5300, Modem 5400. A Heap-based Out-of-Bounds Write exists in the GPRS protocol implementation because of a mismatch between the actual length of the payload and the length declared within the payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/produc
l Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-22377/
CVE ID: CVE-2025-22381 State: PUBLISHED Published: 2025-10-16T00:00:00.000Z Last Updated: 2025-10-16T15:29:36.912Z Vendors: n/a Products: n/a Problem Types: n/a Description: Aggie 2.6.1 has a Host Header injection vulnerability in the forgot password functionality, allowing an attacker to reset a user's password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TID-Lab/aggie/tree/a9d5becaff3ea90720ea7213c80825e253b8a730 - https://github.com/bugdotexe/Vulnerability-Research/tree/main/CVE-2025-22381
CVE ID: CVE-2025-22383 State: PUBLISHED Published: 2025-01-04T00:00:00 Last Updated: 2025-01-06T15:06:03.946Z Vendors: n/a Products: n/a Problem Types: CWE-79 Description: An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity input validation issue exists in the Commerce B2B application, affecting the Contact Us functionality. This allows visitors to send e-mail messages that could contain unfiltered HTML markup in specific scenarios. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.optimizely.com/hc/en-us/articles/32694923652493-Configured-Commerce-Security-Advisory-COM-2024-03
CVE ID: CVE-2025-22384 State: PUBLISHED Published: 2025-01-04T00:00:00 Last Updated: 2025-01-06T17:02:30.455Z Vendors: n/a Products: n/a Problem Types: CWE-472 Description: An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue concerning business logic exists in the Commerce B2B application, which allows storefront visitors to purchase discontinued products in specific scenarios where requests are altered before reaching the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.optimizely.com/hc/en-us/articles/32694560473741-Configured-Commerce-Security-Advisory-COM-2024-02
CVE ID: CVE-2025-22385 State: PUBLISHED Published: 2025-01-04T00:00:00 Last Updated: 2025-01-06T15:13:34.352Z Vendors: n/a Products: n/a Problem Types: CWE-862 Description: An issue was discovered in Optimizely Configured Commerce before 5.2.2408. For newly created accounts, the Commerce B2B application does not require email confirmation. This medium-severity issue allows the mass creation of accounts. This could affect database storage; also, non-requested storefront accounts can be created on behalf of visitors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.optimizely.com/hc/en-us/articles/32695419706637-Configured-Commerce-Security-Advisory-COM-2024-05
CVE ID: CVE-2025-22386 State: PUBLISHED Published: 2025-01-04T00:00:00 Last Updated: 2025-01-06T15:18:53.183Z Vendors: n/a Products: n/a Problem Types: CWE-613 Description: An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity session issue exists in the Commerce B2B application, affecting the longevity of active sessions in the storefront. This allows session tokens tied to logged-out sessions to still be active and usable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.optimizely.com/hc/en-us/articles/32695284701069-Configured-Commerce-Security-Advisory-COM-2024-04
CVE ID: CVE-2025-22387 State: PUBLISHED Published: 2025-01-04T00:00:00 Last Updated: 2025-01-06T17:01:10.261Z Vendors: n/a Products: n/a Problem Types: CWE-598 Description: An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue exists in requests for resources where the session token is submitted as a URL parameter. This exposes information about the authenticated session, which can be leveraged for session hijacking. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.optimizely.com/hc/en-us/articles/32695551034893-Configured-Commerce-Security-Advisory-COM-2024-06