Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-11949 State: PUBLISHED Published: 2025-10-21T06:49:56.119Z Last Updated: 2025-10-21T14:08:23.554Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Digiwin Products: EasyFlow .NET, EasyFlow AiNet Problem Types: CWE-306 Description: EasyFlow .NET and EasyFlow AiNet, developed by Digiwin, has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to obtain database administrator credentials via a specific functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10454-35844-1.html - https://www.twcert.org.tw/en/cp-139-10455-5b9ac-2.html
CVE ID: CVE-2025-11952 State: PUBLISHED Published: 2025-10-22T08:22:56.536Z Last Updated: 2025-10-23T09:04:39.602Z Vendors: Oct8ne Products: Chatbot Problem Types: CWE-79 Description: Stored Cross-site Scripting (XSS) in Oct8ne Chatbot v2.3. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by injecting a malicious payload through the creation of a transcript that is sent by email. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user, through /Records/SendSummaryMail. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/noti
dSummaryMail. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-oct8ne-chatbot
CVE ID: CVE-2025-11953 State: PUBLISHED Published: 2025-11-03T16:35:07.168Z Last Updated: 2025-11-11T17:06:16.919Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Problem Types: CWE-78 Description: The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Progra
rbitrary shell commands with fully controlled arguments. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability - https://github.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f68846a2ef20df547
CVE ID: CVE-2025-11955 State: PUBLISHED Published: 2025-10-27T11:30:24.102Z Last Updated: 2025-10-27T13:19:15.842Z Vendors: TheGreenBow Products: TheGreenBow VPN Client Windows Enterprise Problem Types: CWE-299 Description: Incorrect validation of OCSP certificates vulnerability in TheGreenBow VPN, versions 7.5 and 7.6. During the IKEv2 authentication step, the OCSP-enabled VPN client establishes the tunnel even if it does not receive an OCSP response or if the OCSP response signature is invalid. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/incorrect-validation-ocsp-certificates-thegreenbow-vpn-client-windows - https://ww
ncibe.es/en/incibe-cert/notices/aviso/incorrect-validation-ocsp-certificates-thegreenbow-vpn-client-windows - https://www.thegreenbow.com/en/support/security-alerts/
CVE ID: CVE-2025-11956 State: PUBLISHED Published: 2025-11-06T14:51:51.292Z Last Updated: 2025-11-06T15:07:43.302Z Severity: HIGH (CVSS 8.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L) Vendors: Proliz Software Ltd. Co. Products: OBS (Student Affairs Information System) Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Proliz Software Ltd. Co. OBS (Student Affairs Information System) allows Stored XSS.This issue affects OBS (Student Affairs Information System): before 25.0401. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0379
CVE ID: CVE-2025-11957 State: PUBLISHED Published: 2025-10-22T17:09:15.684Z Last Updated: 2025-10-22T17:44:03.157Z Vendors: Devolutions Products: Server Problem Types: CWE-639 Description: Improper authorization in the temporary access workflow of Devolutions Server 2025.2.12.0 and earlier allows an authenticated basic user to self-approve or approve the temporary access requests of other users and gain unauthorized access to vaults and entries via crafted API requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2025-0015/
CVE ID: CVE-2025-11958 State: PUBLISHED Published: 2025-10-22T17:08:29.440Z Last Updated: 2025-10-22T17:45:45.443Z Vendors: Devolutions Products: Server Problem Types: CWE-20 Description: An improper input validation in the Security Dashboard ignored-tasks API of Devolutions Server 2025.2.15.0 and earlier allows an authenticated user to cause a denial of service to the Security Dashboard via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2025-0015/
CVE ID: CVE-2025-11959 State: PUBLISHED Published: 2025-11-11T14:11:50.111Z Last Updated: 2025-11-12T20:03:06.612Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Premierturk Information Technologies Inc. Products: Excavation Management Information System Problem Types: CWE-552, CWE-359 Description: Files or Directories Accessible to External Parties, Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Premierturk Information Technologies Inc. Excavation Management Information System allows Footprinting, Functionality Misuse.This issue affects Excavation Management Information System: before v.10.2025.01. Additional Analyst Notes
nality Misuse.This issue affects Excavation Management Information System: before v.10.2025.01. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0388
CVE ID: CVE-2025-11960 State: PUBLISHED Published: 2025-11-11T11:48:45.828Z Last Updated: 2025-11-14T19:25:40.919Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Aryom Software High Technology Systems Inc. Products: KVKNET Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Aryom Software High Technology Systems Inc. KVKNET allows Reflected XSS.This issue affects KVKNET: before 2.1.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0386
CVE ID: CVE-2025-11962 State: PUBLISHED Published: 2025-11-12T09:14:06.478Z Last Updated: 2025-11-12T16:01:08.440Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: DivvyDrive Information Technologies Inc. Products: Digital Corporate Warehouse Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in DivvyDrive Information Technologies Inc. Digital Corporate Warehouse allows Stored XSS.This issue affects Digital Corporate Warehouse: before v.4.8.2.22. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0393
CVE ID: CVE-2025-11963 State: PUBLISHED Published: 2025-11-19T14:03:10.502Z Last Updated: 2025-11-19T16:48:41.988Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Saysis Computer Systems Trade Ltd. Co. Products: StarCities Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saysis Computer Systems Trade Ltd. Co. StarCities allows Reflected XSS.This issue affects StarCities: before 1.1.61. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0403
CVE ID: CVE-2025-11965 State: PUBLISHED Published: 2025-10-22T14:50:07.602Z Last Updated: 2025-10-22T15:56:08.021Z Vendors: Eclipse Foundation Products: Vert.x Problem Types: CWE-552 Description: In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], a StaticHandler configuration for restricting access to hidden files fails to restrict access to hidden directories, allowing unauthorized users to retrieve files within them (e.g. '.git/config'). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/304
CVE ID: CVE-2025-11966 State: PUBLISHED Published: 2025-10-22T14:44:24.145Z Last Updated: 2025-10-22T15:26:41.527Z Vendors: Eclipse Foundation Products: Vert.x Problem Types: CWE-79, CWE-80 Description: In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], when "directory listing" is enabled, file and directory names are inserted into generated HTML without proper escaping in the href, title, and link attributes. An attacker who can create or rename files or directories within a served path can craft filenames containing malicious script or HTML content, leading to stored cross-site scripting (XSS) that executes in the context of users viewing the affected directory listing. Additio
stored cross-site scripting (XSS) that executes in the context of users viewing the affected directory listing. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/303
CVE ID: CVE-2025-11967 State: PUBLISHED Published: 2025-11-08T09:28:11.511Z Last Updated: 2025-11-10T14:13:37.397Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: getwpfunnels Products: Mail Mint – Newsletters, Email Marketing, Automation, WooCommerce Emails, Post Notification, and more Problem Types: CWE-434 Description: The Mail Mint plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the process_contact_attribute_import function in all versions up to, and including, 1.18.10. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected
sible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cf902756-21f3-483b-a5d8-a9b4226bde22?source=cve - https://plugins.trac.wordpress.org/changeset/3389643/mail-mint/tags/1.18.11/app/API/Actions/Admin/Contact/ContactImportAction.php
CVE ID: CVE-2025-11971 State: PUBLISHED Published: 2025-10-27T00:05:34.305Z Last Updated: 2025-10-28T15:00:45.588Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-863 Description: GitLab has remediated an issue in GitLab EE affecting all versions from 10.6 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an authenticated attacker to trigger unauthorized pipeline executions by manipulating commits. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://about.gitlab.com/releases/2025/10/22/patch-release-gitlab-18-5-1-released/ - https://gitlab.com/gitlab-org/gitlab/-/
s://about.gitlab.com/releases/2025/10/22/patch-release-gitlab-18-5-1-released/ - https://gitlab.com/gitlab-org/gitlab/-/issues/566587
CVE ID: CVE-2025-11972 State: PUBLISHED Published: 2025-11-08T03:27:48.135Z Last Updated: 2025-11-10T14:14:59.105Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: stevejburge Products: Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI Problem Types: CWE-89 Description: The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to SQL Injection via the 'post_types' parameter in all versions up to, and including, 3.40.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Editor-
ck of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7e36f3a0-2215-4c1c-99c4-9405ad7b913b?source=cve - https://github.com/TaxoPress/TaxoPress/commit/fd35042973439719b4304b336663e46f13f1533a
CVE ID: CVE-2025-11973 State: PUBLISHED Published: 2025-11-21T08:28:12.074Z Last Updated: 2025-11-24T18:00:55.249Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: zhengdon Products: 简数采集器 Problem Types: CWE-73 Description: The 简数采集器 plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.6.3 via the __kds_flag functionality that imports featured images. This makes it possible for authenticated attackers, with Adminstrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.w
which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/66dc2ca2-c61c-4c73-aa2a-0017299cbca5?source=cve - https://wordpress.org/plugins/keydatas/
CVE ID: CVE-2025-11974 State: PUBLISHED Published: 2025-10-27T00:05:24.332Z Last Updated: 2025-10-28T14:59:56.029Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-770 Description: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an unauthenticated attacker to create a denial of service condition by uploading large files to specific API endpoints. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://about.gitlab.com/releases/2025/10/22/patch-release-gitlab-18-5-1-released/ - https://git
richment: References: - https://about.gitlab.com/releases/2025/10/22/patch-release-gitlab-18-5-1-released/ - https://gitlab.com/gitlab-org/gitlab/-/issues/571761
CVE ID: CVE-2025-11975 State: PUBLISHED Published: 2025-10-31T02:26:03.735Z Last Updated: 2025-10-31T16:35:36.186Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: fusewp Products: FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) Problem Types: CWE-862 Description: The FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_changes() function in all versions up to, and including, 1.1.23.0. This makes it possible for
ability check on the save_changes() function in all versions up to, and including, 1.1.23.0. This makes it possible for unauthenticated attackers to add and edit sync rules. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6c68e8a1-926f-497f-b9f2-b0a67cd09adf?source=cve - https://plugins.trac.wordpress.org/changeset/3383939/fusewp/trunk/src/core/src/Admin/SettingsPage/SyncPage.php
CVE ID: CVE-2025-11976 State: PUBLISHED Published: 2025-10-25T06:49:25.381Z Last Updated: 2025-10-27T15:32:59.968Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: fusewp Products: FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) Problem Types: CWE-352 Description: The FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.23.0. This is due to missing or incorrect nonce validation on the save_changes function. This makes it po
including, 1.1.23.0. This is due to missing or incorrect nonce validation on the save_changes function. This makes it possible for unauthenticated attackers to add or edit sync rules via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e5957d6b-40e5-44c4-9a1b-e9c49e175162?source=cve - https://plugins.trac.wordpress.org/changeset/3383939/fusewp/trunk/src/core/src/Admin/SettingsPage/SyncPage.php
CVE ID: CVE-2025-11979 State: PUBLISHED Published: 2025-10-20T17:47:57.947Z Last Updated: 2025-10-20T20:21:27.265Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: MongoDB Inc. Products: Server Problem Types: CWE-416 Description: An authorized user may crash the MongoDB server by causing buffer over-read. This can be done by issuing a DDL operation while queries are being issued, under some conditions. This issue affects MongoDB Server v7.0 versions prior to 7.0.25, MongoDB Server v8.0 versions prior to 8.0.15, and MongoDB Server version 8.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jira.mongodb.org/browse/SERVER-105873
CVE ID: CVE-2025-11980 State: PUBLISHED Published: 2025-11-08T09:28:09.878Z Last Updated: 2025-11-10T14:13:59.718Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: kybernetikservices Products: Quick Featured Images Problem Types: CWE-89 Description: The Quick Featured Images plugin for WordPress is vulnerable to SQL Injection via the 'delete_orphaned' function in all versions up to, and including, 13.7.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already exi
sible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database, granted they can convince an author-level user or higher to add a malicious custom field value. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/590720a3-1881-4a5d-b004-ad92d386afe6?source=cve - https://plugins.trac.wordpress.org/browser/quick-featured-images/tags/13.7.3/admin/class-Quick_Featured_Images_Tools.php#L817 - https://plugins.trac.wordpress.org/browser/quick-featured-images/tags/13.7.3/admin/class-Quick_Featu
es_Tools.php#L817 - https://plugins.trac.wordpress.org/browser/quick-featured-images/tags/13.7.3/admin/class-Quick_Featured_Images_Tools.php#L785 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3388701%40quick-featured-images&new=3388701%40quick-featured-images&sfp_email=&sfph_mail=
CVE ID: CVE-2025-11981 State: PUBLISHED Published: 2025-11-14T11:20:17.855Z Last Updated: 2025-11-14T13:23:24.870Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: jdsofttech Products: School Management System – WPSchoolPress Problem Types: CWE-89 Description: The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'SCodes' parameter in all versions up to, and including, 2.2.23 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional
ery. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/04bc4a20-0136-4fb4-9489-07140b2b86aa?source=cve - https://plugins.trac.wordpress.org/browser/wpschoolpress/tags/2.2.9/lib/wpsp-ajaxworks.php#L1872 - https://plugins.trac.wordpress.org/browser/wpschoolpress/tags/2.2.9/lib/wpsp-ajaxworks.php#L1844 - https://plugins.trac.wordpress.org/changeset/3389346#file62
CVE ID: CVE-2025-11983 State: PUBLISHED Published: 2025-11-01T05:40:23.063Z Last Updated: 2025-11-03T13:31:15.868Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: scossar Products: WP Discourse Problem Types: CWE-200 Description: The WP Discourse plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.5.9. This is due to the plugin unconditionally sending Discourse API credentials (Api-Key and Api-Username headers) to any host specified in a post's discourse_permalink custom field during comment synchronization. This makes it possible for authenticated attackers, with author-level access and above, to exfiltrate sen
nchronization. This makes it possible for authenticated attackers, with author-level access and above, to exfiltrate sensitive Discourse API credentials to attacker-controlled servers, as well as query internal services and potentially perform further attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6b1524f3-1c59-49a1-bbe3-94dcfd232b1d?source=cve - https://plugins.trac.wordpress.org/browser/wp-discourse/tags/2.5.9/lib/discourse-comment.php#L211 - https://plugins.trac.wordpress.org/browser/wp-discourse/tags/2.5.9/lib/discourse-comment.php#L218 - https://plugins.trac.wordpress.org/browser/wp-discourse/tags/2.5.9
discourse/tags/2.5.9/lib/discourse-comment.php#L218 - https://plugins.trac.wordpress.org/browser/wp-discourse/tags/2.5.9/lib/plugin-utilities.php#L486 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3384149%40wp-discourse&new=3384149%40wp-discourse&sfp_email=&sfph_mail=
CVE ID: CVE-2025-11985 State: PUBLISHED Published: 2025-11-21T07:31:58.426Z Last Updated: 2025-11-21T14:56:06.360Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: nootheme Products: Realty Portal Problem Types: CWE-862 Description: The Realty Portal plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'rp_save_property_settings' function in versions 0.1 to 0.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registra
above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e8263908-95b3-4b72-a9de-a982618eba2c?source=cve - https://plugins.trac.wordpress.org/browser/realty-portal/tags/0.1/includes/property/process/ajax-save-property-setting.php#L189 - https://plugins.trac.wordpress.org/browser/realty-portal/tags/0.1/includes/property/process/ajax-save-property-setting.php#L198 - https://plugins.trac.word
browser/realty-portal/tags/0.1/includes/property/process/ajax-save-property-setting.php#L198 - https://plugins.trac.wordpress.org/browser/realty-portal/tags/0.1/includes/functions/enqueue.php#L224 - https://cwe.mitre.org/data/definitions/862.html - https://developer.wordpress.org/reference/functions/current_user_can/