Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b46c3f25-6879-47b1-9026-4297fdd003b0?source=cve - https://plugins.trac.wordpress.org/browser/team-members/trunk/inc/tmm-save-metaboxes.php#L77 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3364663%40team-members%2Ftrunk&old=3116517%40team-members%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2025-8441 State: PUBLISHED Published: 2025-08-01T07:32:06.576Z Last Updated: 2025-08-01T12:54:21.499Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Online Medicine Guide Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in code-projects Online Medicine Guide 1.0. Affected is an unknown function of the file /pharsignup.php. The manipulation of the argument phuname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.
disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318468 - https://vuldb.com/?ctiid.318468 - https://vuldb.com/?submit.625677 - https://github.com/justconter/cve/issues/2 - https://code-projects.org/
CVE ID: CVE-2025-8442 State: PUBLISHED Published: 2025-08-01T08:02:05.359Z Last Updated: 2025-08-01T12:32:16.629Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Online Medicine Guide Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in code-projects Online Medicine Guide 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /cussignup.php. The manipulation of the argument uname leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
it has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318469 - https://vuldb.com/?ctiid.318469 - https://vuldb.com/?submit.625678 - https://github.com/justconter/cve/issues/1 - https://code-projects.org/
CVE ID: CVE-2025-8443 State: PUBLISHED Published: 2025-08-01T08:32:05.311Z Last Updated: 2025-08-01T12:23:43.439Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Online Medicine Guide Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Online Medicine Guide 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument uname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com
closed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318470 - https://vuldb.com/?ctiid.318470 - https://vuldb.com/?submit.625697 - https://github.com/LI1551/vul/issues/1 - https://code-projects.org/
CVE ID: CVE-2025-8445 State: PUBLISHED Published: 2025-09-11T07:24:53.269Z Last Updated: 2025-09-11T14:40:16.029Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: shaikhaezaz80 Products: Countdown Timer for Elementor Problem Types: CWE-79 Description: The Countdown Timer for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'countdown_label' Parameter in all versions up to, and including, 1.3.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesse
h Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4ddcb9e7-506d-408d-812b-b95610b636f1?source=cve - https://plugins.trac.wordpress.org/browser/countdown-timer-for-elementor/trunk/widgets/countdown-timer-widget.php#L513
CVE ID: CVE-2025-8446 State: PUBLISHED Published: 2025-09-16T11:17:09.118Z Last Updated: 2025-09-16T19:30:06.936Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: blazethemes Products: Blaze Demo Importer Problem Types: CWE-862 Description: The Blaze Demo Importer plugin for WordPress is vulnerable to unauthorized limited plugin install due to a missing capability check on the 'blaze_demo_importer_install_plugin' function in all versions up to, and including, 1.0.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate a limited number of specific plugins. The News Kit Elementor Addons plugin and
ccess and above, to install and activate a limited number of specific plugins. The News Kit Elementor Addons plugin and a BlazeThemes theme must be installed and activated in order to exploit the vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a91bd1cf-ac63-4d65-b9fc-3fa2507cc27e?source=cve - https://plugins.trac.wordpress.org/browser/blaze-demo-importer/trunk/blaze-demo-importer.php#L91 - https://plugins.trac.wordpress.org/changeset/3361179/
CVE ID: CVE-2025-8447 State: PUBLISHED Published: 2025-08-26T01:42:37.424Z Last Updated: 2025-08-26T18:34:59.232Z Vendors: GitHub Products: Enterprise Server Problem Types: CWE-639 Description: An improper access control vulnerability was identified in GitHub Enterprise Server that allowed users with access to any repository to retrieve limited code content from another repository by creating a diff between the repositories. To exploit this vulnerability, an attacker needed to know the name of a private repository along with its branches, tags, or commit SHAs that they could use to trigger compare/diff functionality and retrieve limited code without proper authorization. This vulnerability a
d use to trigger compare/diff functionality and retrieve limited code without proper authorization. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.18, and was fixed in versions 3.14.17, 3.15.12, 3.16.8 and 3.17.5. This vulnerability was reported via the GitHub Bug Bounty program. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.17 - https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.12 - https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.8 - https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.5
CVE ID: CVE-2025-8448 State: PUBLISHED Published: 2025-08-20T13:58:53.818Z Last Updated: 2025-09-09T20:55:43.384Z Vendors: Schneider Eelctric, Schneider Electric Products: EcoStruxure Building Operation Enterprise Server, EcoStruxure Enterprise Server, EcoStruxure Building Operation Workstation Problem Types: CWE-200 Description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause unauthorized access to sensitive credential data when an attacker is able to capture local SMB traffic between a valid user within the BMS network and the vulnerable products. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schn
work and the vulnerable products. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-224-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-224-04.pdf
CVE ID: CVE-2025-8449 State: PUBLISHED Published: 2025-08-20T13:55:34.397Z Last Updated: 2025-09-09T20:50:55.766Z Vendors: Schnieder Electric, Schneider Electric, Schneider Eelctric Products: EcoStruxure Building Operation Enterprise Server, EcoStruxure Enterprise Server, EcoStruxure Building Operation Workstation Problem Types: CWE-400 Description: CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service when an authenticated user sends a specially crafted request to a specific endpoint from within the BMS network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-224
lyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-224-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-224-04.pdf
CVE ID: CVE-2025-8450 State: PUBLISHED Published: 2025-08-19T18:01:14.137Z Last Updated: 2025-08-29T20:09:24.656Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: Fortra Products: FileCatalyst Problem Types: CWE-434, CWE-306 Description: Improper Access Control issue in the Workflow component of Fortra's FileCatalyst allows unauthenticated users to upload arbitrary files via the order forms page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.fortra.com/security/advisories/product-security/fi-2025-010
CVE ID: CVE-2025-8451 State: PUBLISHED Published: 2025-08-15T06:40:41.711Z Last Updated: 2025-08-15T12:09:25.764Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpdevteam Products: Essential Addons for Elementor – Popular Elementor Templates & Widgets Problem Types: CWE-79 Description: The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘data-gallery-items’ parameter in all versions up to, and including, 6.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access an
t sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4917652a-1c83-4570-98c5-1a34e637814e?source=cve - https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/assets/front-end/js/view/filterable-gallery.js - https://plugins.trac.wordpress.org/changeset/3344071/
CVE ID: CVE-2025-8452 State: PUBLISHED Published: 2025-08-12T15:23:00.577Z Last Updated: 2025-10-08T13:39:35.427Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Brother Industries, Ltd, Toshiba Tec, Konica Minolta, Inc. Products: DCP-L8410CDW, MFC-L8610CDW, MFC-L8690CDW, MFC-L8900CDW, MFC-L9570CDW, MFC-L9577CDW, MFC-L8610CDW(for Japan), MFC-L9570CDW(for Japan), HL-L5218DN, HL-L5228DW, DCP-L5510DN, DCP-L5512DN, DCP-L5518DN, DCP-L5510DW, DCP-L5610DN, DCP-L5660DN, DCP-L5662DN, MFC-L5710DN, MFC-L5715DN, MFC-L5718DN, MFC-L5710DW, MFC-L5715DW, MFC-L5717DW, MFC-L5728DW, MFC-L5912DW, MFC-L5915DW, MFC-L6710DW, MFC-L6720DW, MFC-L6810DW, MFC-L6910DN, MFC-L6915DN, MFC-
FC-L5717DW, MFC-L5728DW, MFC-L5912DW, MFC-L5915DW, MFC-L6710DW, MFC-L6720DW, MFC-L6810DW, MFC-L6910DN, MFC-L6915DN, MFC-L6915DN CSP, MFC-L6912DW, MFC-L6915DW, MFC-EX910, MFC-EX915DW, MFC-L6820DW, MFC-L9610CDN, MFC-L9630CDN, MFC-L9635CDN, MFC-L9670CDN, NFC-EX670, MFC-EX670W, DCP-L3555CDW, DCP-L3560CDW, DCP-L3568CDW, MFC-L3720CDW, MFC-L3740CDW, MFC-L3740CDWE, MFC-L3755CDW, MFC-L3760CDW, MFC-L3765CDW, MFC-L3768CDW, MFC-L3780CDW, MFC-L8340CDW, MFC-L8390CDW, MFC-L8395CDW, HL-L3300CDW, DCP-L3515CDW, DCP-L3520CDW, DCP-L3520CDWE, DCP-L3528CDW, DCP-L2600D, DCP-B7600DB, DCP-B7600D, DCP-L2627DWE, DCP-B7620DWB, DCP-B7620DW, DCP-L2627DW, DCP-B7640DWB, DCP-L2627DWXL, DCP-B7640DW, DCP-L2605DW, HL-L2464DW,
CP-L2627DWE, DCP-B7620DWB, DCP-B7620DW, DCP-L2627DW, DCP-B7640DWB, DCP-L2627DWXL, DCP-B7640DW, DCP-L2605DW, HL-L2464DW, DCP-L2622DW, DCP-L2625DW, DCP-L2620DW, HL-L2475DW, HL-L2465DW, DCP-L2640DN, DCP-L2647DW, DCP-L2640DW, MFC-L2802DN, MFC-L2827DW, MFC-L2806DW, MFC-L2805DW, MFC-L2802DW, MFC-L2800DW, MFC-L2765DW, MFC-L2760DW, MFC-B7800DN, MFC-B7811DW, MFC-B7810DWB, MFC-B7810DW, MFC-L2835DW, MFC-L2827DWXL, DCP-B7548W, DCP-B7558W, DCP-B7578DW, DCP-L2508DW, DCP-L2518DW, DCP-B7608W, DCP-B7628DW, DCP-B7638DN, DCP-B7648DW, DCP-L2628DW, DCP-L2548DW, DCP-L2648DW, DCP-L2600DW, FAX-L2800DW, DCP-L2680DW, DCP-L2660DW, HL-L2480DW, DCP-L2665DW, MFC-L2817DW, MFC-L2807DW, MFC-L2820DWXL, MFC-L2820DW, MFC-L2861
00DW, DCP-L2680DW, DCP-L2660DW, HL-L2480DW, DCP-L2665DW, MFC-L2817DW, MFC-L2807DW, MFC-L2820DWXL, MFC-L2820DW, MFC-L2861DW, MFC-L2862DW, MFC-L2860DW, MFC-L2885DW, MFC-L2880DWXL, MFC-L2886DW, MFC-L2860DWE, MFC-L2880DW, MFC-L2900DW, MFC-L2900DWXL, DCP-B7658DW, DCP-B7650DW, MFC-L2920DW, MFC-L2922DW, MFC-L2960DW, MFC-L2980DW, DCP-L1630W, DCP-L1632W, DCP-L1638W, DCP-L1848W, HL-L2395DW, MFC-L2730DW, MFC-L2732DW, MFC-L2750DW, MFC-L2750DWXL, MFC-L2751DW, MFC-L2770DW, MFC-L2771DW, MFC-L2730DWR, MFC-L2750DWR, DCP-7195DW, MFC-7895DW, MFC-L2730DN, HL-L2390DW, DCP-L2530DW, DCP-L2531DW, DCP-L2532DW, DCP-L2535DW, DCP-L2537DW, DCP-B7520DW, DCP-L2550DN, DCP-L2550DW, DCP-L2551DN, DCP-L2551DW, DCP-L2552DN, DCP
DCP-L2532DW, DCP-L2535DW, DCP-L2537DW, DCP-B7520DW, DCP-L2550DN, DCP-L2550DW, DCP-L2551DN, DCP-L2551DW, DCP-L2552DN, DCP-B7535DW, MFC-L2690DW, MFC-L2710DN, MFC-L2712DN, MFC-L2710DW, MFC-L2712DW, MFC-L2713DW, MFC-L2715DW, MFC-L2716DW, MFC-L2717DW, MFC-B7715DW, DCP-L2530DWR, DCP-L2550DNR, MFC-L2710DNR, MFC-L2710DWR, FAX-L2710DN, DCP-7190DN, DCP-B7530DN, DCP-L2550DW(TWN), MFC-7890DN, MFC-B7720DN, MFC-L2715DW(for Tiwan, Koria), DCP-7090DW, DCP-7190DW, DCP-L3510CDW, DCP-L3517CDW, HL-L3290CDW, DCP-L3551CDW, DCP-L3550CDW, DCP-9030CDN, MFC-L3710CDW, MFC-L3730CDN, MFC-9150CDN, MFC-L3735CDN, MFC-L3745CDW, MFC-L3750CDW, MFC-9350CDW, MFC-L3770CDW, MFC-L6970DW, MFC-L6950DW, MFC-L6902DW, MFC-L6900DW, MFC-
3735CDN, MFC-L3745CDW, MFC-L3750CDW, MFC-9350CDW, MFC-L3770CDW, MFC-L6970DW, MFC-L6950DW, MFC-L6902DW, MFC-L6900DW, MFC-L6800DW, MFC-L6750DW, MFC-L6702DW, MFC-L6700DW, MFC-L5902DW, MFC-L5900DW, MFC-L5850DW, MFC-L5802DW, MFC-L5800DW, MFC-8540DN, MFC-L5755DW, MFC-L5750DW, MFC-8530DN, MFC-L5700DN, MFC-L5702DW, MFC-L5700DW, DCP-L6600DW, DCP-L5652DN, DCP-L5650DN, DCP-L5602DN, DCP-L5600DN, DCP-L5502DN, DCP-L5500DN, MFC-L6900DWG, DCP-T830DW, DCP-T835DW, MFC-T930DW, MFC-T935DW, DCP-T530DW, DCP-T535DW, DCP-T536DW, DCP-T730DW, DCP-T735DW, DCP-T435W, DCP-T430W, DCP-T436W, DCP-T439W, MFC-J5340DW, MFC-J5345DW, MFC-J2340DW, MFC-J5340DWE, MFC-J5740DW, MFC-J6540DW, MFC-J6740DW, MFC-J3540DW, MFC-J7100CDW, MF
FC-J5340DW, MFC-J5345DW, MFC-J2340DW, MFC-J5340DWE, MFC-J5740DW, MFC-J6540DW, MFC-J6740DW, MFC-J3540DW, MFC-J7100CDW, MFC-J6540DWE, MFC-J6940DW, MFC-J3940DW, MFC-J7300CDW, MFC-J5855DW, MFC-J5855DW XL, MFC-J5800CDW, MFC-J5955DW, MFC-J6555DW, MFC-J6555DW XL, MFC-J6955DW, MFC-J6957DW, MFC-J7500CDW, MFC-J7600CDW, MFC-J6959DW, MFC-J7700CDW, DCP-T520W, DCP-T525W, DCP-T720DW, DCP-T725DW, DCP-T820DW, DCP-T825DW, MFC-T920DW, MFC-T925DW, DCP-T220, DCP-T225, DCP-T226, DCP-T420W, DCP-T425W, DCP-T426W, DCP-T428W, DCP-C421W, MFC-J1205W(XL), MFC-J1215W, DCP-J1200W(XL), DCP-J1200N, DCP-J1200WE, MFC-J4335DW(XL), MFC-J4340DW(XL), MFC-J4345DW XL, MFC-4340DWE, MFC-J4535DW(XL), MFC-J4540DW(XL), MFC-J4440DW, DCP-
00WE, MFC-J4335DW(XL), MFC-J4340DW(XL), MFC-J4345DW XL, MFC-4340DWE, MFC-J4535DW(XL), MFC-J4540DW(XL), MFC-J4440DW, DCP-J4140N, MFC-J4440N, MFC-J4540N, MFC-J4940DN, MFC-J1010DW, MFC-J1012DW, DCP-J1050DW, MFC-J1170DW, DCP-J1140DW, DCP-J526N, DCP-J914N, MFC-J926N-WB, MFC-J904N, MFC-J739DN, MFC-J739DWN, MFC-J939DN, MFC-J939DWN, DCP-J1800N, DCP-J1700DW, DCP-J1800DW, MFC-J1800DW, DCP-J1203N, DCP-C1210N, DCP-J4143N, MFC-J4443N, DCP-J4543N, DCP-J528N, DCP-J915N, DCP-J928N-WB, MFC-J905N, MFC-J815DW XL, MFC-J805DW, MFC-J805DW XL, DCP-J1100DW, MFC-J995DW, MFC-J995DW XL, MFC-J1300DW, DCP-J988N, MFC-J1500N, MFC-J1605DN, MFC-J5845DW(XL), MFC-J5945DW, MFC-J6945DW, MFC-J6947DW, HL-J6000DW, HL-J6100DW, MFC-
DCP-J988N, MFC-J1500N, MFC-J1605DN, MFC-J5845DW(XL), MFC-J5945DW, MFC-J6945DW, MFC-J6947DW, HL-J6000DW, HL-J6100DW, MFC-J6997CDW, MFC-J6999CDW, HL-J6000CDW, MFC-T4500DW, MFC-J5330DW, MFC-J5335DW, MFC-J2330DW, MFC-J5730DW, MFC-J5830DW, MFC-J5930DW, MFC-J2730DW, MFC-J6530DW, MFC-J6730DW, MFC-J3530DW, MFC-J6930DW, MFC-J6935DW, MFC-J3930DW, MFC-J6535DW, MFC-J6580CDW, MFC-J6980CDW, MFC-J6995CDW, MFC-J5630CDW, MFC-J6583CDW, MFC-J6983CDW, DCP-T510W, DCP-T510W(for China), DCP-T710W, DCP-T710W(for China), MFC-T810W, MFC-T810W(for China), MFC-T910DW, DCP-J572DW, MFC-J491DW, MFC-J497DW, DCP-J772DW, DCP-J774DW, MFC-J890DW, MFC-J895DW, MFC-J690DW, DCP-J572N, DCP-J577N, DCP-J582N, DCP-J972N, DCP-J973N-W/B
W, DCP-J772DW, DCP-J774DW, MFC-J890DW, MFC-J895DW, MFC-J690DW, DCP-J572N, DCP-J577N, DCP-J582N, DCP-J972N, DCP-J973N-W/B, DCP-J978N-W/B, DCP-J981N, DCP-J982N-W/B, MFC-J893N, MFC-J898N, NFC-J903N, MFC-J738DN, MFC-J738DWN, MFC-J998DN, MFC-J998DWN, DCP-J587N, DCP-J987N-W, DCP-J987N-B, DS/MDS-940DW, ADS-3300W, ADS-4500W, ADS-2700We, ADS-4300N, ADS-4700W, ADS-4900W, ADS-1350W, ADS-1800W, e-STUDIO301DN, e-STUDIO302DNF, bizhub 5020i, bizhub 5000i, bizhub 4020i, bizhub 4000i Problem Types: CWE-538 Description: By using the "uscan" protocol provided by the eSCL specification, an attacker can discover the serial number of multi-function printers that implement the Brother-provided firmware. This seria
acker can discover the serial number of multi-function printers that implement the Brother-provided firmware. This serial number can, in turn, can be leveraged by the flaw described by CVE-2024-51978 to calculate the default administrator password. This flaw is similar to CVE-2024-51977, with the only difference being the protocol by which an attacker can use to learn the remote device's serial number. The eSCL/uscan vector is typically only exposed on the local network. Any discovery service that implements the eSCL specification can be used to exploit this vulnerability, and one such implementation is the runZero Explorer. Changing the default administrator password will render this vulner
and one such implementation is the runZero Explorer. Changing the default administrator password will render this vulnerability virtually worthless, since the calculated default administrator password would no longer be the correct password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.brother.com/g/b/faqend.aspx?c=us&lang=en&prod=group2&faqid=faq00100851_000 - https://www.rapid7.com/blog/post/multiple-brother-devices-multiple-vulnerabilities-fixed/ - https://help.runzero.com/docs/installing-an-explorer/ - https://takeonme.org/gcves/GCVE-1337-2025-00000000000000000000000000000000000000000000000001011111011111010111111001000000000000000000000000000000000000
1337-2025-00000000000000000000000000000000000000000000000001011111011111010111111001000000000000000000000000000000000000000000000000000000001 - https://www.cve.org/CVERecord?id=CVE-2024-51977
CVE ID: CVE-2025-8453 State: PUBLISHED Published: 2025-08-20T12:52:50.191Z Last Updated: 2025-08-20T15:11:28.414Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: Saitel DR RTU, Saitel DP RTU Problem Types: CWE-269 Description: CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation and arbitrary code execution when a privileged engineer user with console access modifies a configuration file used by a root-level daemon to execute custom scripts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-224-01&p_enDocT
- CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-224-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-224-01.pdf
CVE ID: CVE-2025-8454 State: PUBLISHED Published: 2025-08-01T05:41:09.361Z Last Updated: 2025-08-01T13:47:20.337Z Vendors: Debian Products: devscripts Description: It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the life of a Debian Package maintainer easier), skips OpenPGP verification if the upstream source is already downloaded from a previous run even if the verification failed back then. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugs.debian.org/1109251
CVE ID: CVE-2025-8459 State: PUBLISHED Published: 2025-10-14T17:11:30.565Z Last Updated: 2025-10-15T13:13:21.944Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Centreon Products: Infra Monitoring Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Monitoring recurrent downtime scheduler modules) allows Stored XSS.This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/centreon/centreon/rel
fore 23.10.28. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/centreon/centreon/releases - https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-8459-centreon-web-all-versions-high-severity-5117
CVE ID: CVE-2025-8462 State: PUBLISHED Published: 2025-08-12T02:24:45.938Z Last Updated: 2025-08-13T20:19:25.568Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: risetheme Products: RT Easy Builder – Advanced addons for Elementor Problem Types: CWE-79 Description: The RT Easy Builder – Advanced addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the social URL parameter in all versions up to, and including, 2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute
nticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0bb02fd7-1090-4139-ae0e-977fdec5da7f?source=cve - https://wordpress.org/plugins/rt-easy-builder-advanced-addons-for-elementor/
CVE ID: CVE-2025-8463 State: PUBLISHED Published: 2025-09-17T12:47:44.540Z Last Updated: 2025-09-30T13:21:11.180Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: SecHard Information Technologies Products: SecHard Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in SecHard Information Technologies SecHard allows Forceful Browsing.This issue affects SecHard: before 3.6.2-20250805. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0271
CVE ID: CVE-2025-8464 State: PUBLISHED Published: 2025-08-16T07:25:28.619Z Last Updated: 2025-08-18T17:51:17.240Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: glenwpcoder Products: Drag and Drop Multiple File Upload for Contact Form 7 Problem Types: CWE-23 Description: The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.9.0 via the wpcf7_guest_user_id cookie. This makes it possible for unauthenticated attackers to upload and delete files outside of the originally intended directory. The impact of this vulnerability is limited, as file types are valida