Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-11207 State: PUBLISHED Published: 2025-11-06T22:08:53.752Z Last Updated: 2025-11-12T20:58:56.904Z Vendors: Google Products: Chrome Problem Types: CWE-1300 Description: Side-channel information leakage in Storage in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_30.html - https://issues.chromium.org/issues/428189824
CVE ID: CVE-2025-11208 State: PUBLISHED Published: 2025-11-06T22:08:54.038Z Last Updated: 2025-11-07T14:04:08.574Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Media in Google Chrome prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_30.html - https://issues.chromium.org/issues/397878997
CVE ID: CVE-2025-11209 State: PUBLISHED Published: 2025-11-06T22:08:54.364Z Last Updated: 2025-11-12T21:08:27.529Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Omnibox in Google Chrome on Android prior to 141.0.7390.54 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_30.html - https://issues.chromium.org/issues/438226517
CVE ID: CVE-2025-11210 State: PUBLISHED Published: 2025-11-06T22:08:54.752Z Last Updated: 2025-11-07T13:28:35.994Z Vendors: Google Products: Chrome Problem Types: CWE-1300 Description: Side-channel information leakage in Tab in Google Chrome prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_30.html - https://issues.chromium.org/issues/440523110
CVE ID: CVE-2025-11211 State: PUBLISHED Published: 2025-11-06T22:08:55.517Z Last Updated: 2025-11-12T21:06:55.989Z Vendors: Google Products: Chrome Problem Types: CWE-125 Description: Out of bounds read in Media in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_30.html - https://issues.chromium.org/issues/441917796
CVE ID: CVE-2025-11212 State: PUBLISHED Published: 2025-11-06T22:08:55.792Z Last Updated: 2025-11-07T15:01:19.055Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Media in Google Chrome on Windows prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform domain spoofing via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_30.html - https://issues.chromium.org/issues/420734141
CVE ID: CVE-2025-11213 State: PUBLISHED Published: 2025-11-06T22:08:56.274Z Last Updated: 2025-11-07T15:00:24.639Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Omnibox in Google Chrome on Android prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform domain spoofing via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_30.html - https://issues.chromium.org/issues/443408317
CVE ID: CVE-2025-11215 State: PUBLISHED Published: 2025-11-06T22:08:56.565Z Last Updated: 2025-11-07T14:53:43.680Z Vendors: Google Products: Chrome Problem Types: CWE-193 Description: Off by one error in V8 in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_30.html - https://issues.chromium.org/issues/439758498
CVE ID: CVE-2025-11216 State: PUBLISHED Published: 2025-11-06T22:08:56.861Z Last Updated: 2025-11-07T13:44:04.956Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Storage in Google Chrome on Mac prior to 141.0.7390.54 allowed a remote attacker to perform domain spoofing via a crafted video file. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_30.html - https://issues.chromium.org/issues/419721056
CVE ID: CVE-2025-11219 State: PUBLISHED Published: 2025-11-06T22:08:57.161Z Last Updated: 2025-11-07T13:37:19.731Z Vendors: Google Products: Chrome Problem Types: CWE-416 Description: Use after free in V8 in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_30.html - https://issues.chromium.org/issues/439772737
CVE ID: CVE-2025-11221 State: PUBLISHED Published: 2025-10-02T05:15:16.178Z Last Updated: 2025-10-02T15:53:53.791Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: GTONE Products: ChangeFlow Problem Types: CWE-22, CWE-434 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Unrestricted Upload of File with Dangerous Type vulnerability in GTONE ChangeFlow allows Path Traversal, Accessing Functionality Not Properly Constrained by ACLs.This issue affects ChangeFlow: from All versions through v9.0.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://www.gtone.co.kr/kr/application-lifecycle-management.p
ional Analyst Notes: - CISA ADP Vulnrichment: References: - http://www.gtone.co.kr/kr/application-lifecycle-management.php
CVE ID: CVE-2025-11223 State: PUBLISHED Published: 2025-10-03T08:02:18.567Z Last Updated: 2025-10-03T15:54:47.530Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Panasonic Products: AutoDownloader Problem Types: CWE-427 Description: Installer of Panasonic AutoDownloader version 1.2.8 contains an issue with the DLL search path, which may lead to loading a crafted DLL file in the same directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://content.connect.panasonic.com/jp-ja/fai/file/66248
CVE ID: CVE-2025-11226 State: PUBLISHED Published: 2025-10-01T07:26:12.567Z Last Updated: 2025-10-31T14:32:05.822Z Vendors: QOS.CH Sarl Products: Logback-core Problem Types: CWE-20 Description: ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.18 in Java applications, allows an attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution. A successful attack requires the presence of Janino library and Spring Framework to be present on the user's class path. In addition, the attacker must have write access to a configuration file. Al
ork to be present on the user's class path. In addition, the attacker must have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://logback.qos.ch/news.html#1.5.19 - https://logback.qos.ch/news.html#1.3.16
CVE ID: CVE-2025-11227 State: PUBLISHED Published: 2025-10-04T02:24:35.306Z Last Updated: 2025-10-06T14:18:28.992Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: givewp Products: GiveWP – Donation Plugin and Fundraising Platform Problem Types: CWE-285 Description: The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.10.0 via the 'registerGetForm', 'registerGetForms', 'registerGetCampaign' and 'registerGetCampaigns' functions due to a missing capability check. This makes it possible for unauthenticated attackers to extract data from private and draft donation
capability check. This makes it possible for unauthenticated attackers to extract data from private and draft donation forms, as well as archived campaigns. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/54db1807-69ff-445c-9e02-9abce9fd3940?source=cve - https://plugins.trac.wordpress.org/browser/give/tags/4.9.0/src/DonationForms/Routes/DonationFormsEntityRoute.php#L82 - https://plugins.trac.wordpress.org/browser/give/tags/4.9.0/src/API/REST/V3/Routes/Campaigns/RegisterCampaignRoutes.php#L91 - https://plugins.trac.wordpress.org/browser/give/tags/4.9.0/src/API/REST/V3/Routes/Campaigns/RegisterCampaignRoutes.php#L60 -
://plugins.trac.wordpress.org/browser/give/tags/4.9.0/src/API/REST/V3/Routes/Campaigns/RegisterCampaignRoutes.php#L60 - https://plugins.trac.wordpress.org/browser/give/tags/4.9.0/src/DonationForms/Routes/DonationFormsEntityRoute.php#L52 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3371948%40give&new=3371948%40give&sfp_email=&sfph_mail=
CVE ID: CVE-2025-11228 State: PUBLISHED Published: 2025-10-04T02:24:37.546Z Last Updated: 2025-10-06T14:16:26.035Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: givewp Products: GiveWP – Donation Plugin and Fundraising Platform Problem Types: CWE-862 Description: The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `registerAssociateFormsWithCampaign` function in all versions up to, and including, 4.10.0. This makes it possible for unauthenticated attackers to associate any donation forms with any campaign. Additional Analyst Notes: - CISA ADP
e for unauthenticated attackers to associate any donation forms with any campaign. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ddf9a043-5eb6-46fd-88c2-0f5a04f73fc9?source=cve - https://plugins.trac.wordpress.org/browser/give/tags/4.9.0/src/DonationForms/Routes/DonationFormsEntityRoute.php#L131 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3371948%40give&new=3371948%40give&sfp_email=&sfph_mail=
CVE ID: CVE-2025-11230 State: PUBLISHED Published: 2025-11-19T09:28:39.750Z Last Updated: 2025-11-19T17:09:15.642Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: HAProxy Technologies Products: HAProxy Community Edition Problem Types: CWE-407 Description: Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.haproxy.com/blog/october-2025-cve-2025-11230-haproxy-mjson-library-denial-of-service-vulnerability
CVE ID: CVE-2025-11232 State: PUBLISHED Published: 2025-10-29T18:02:39.421Z Last Updated: 2025-11-04T21:09:09.184Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: Kea Problem Types: CWE-823 Description: To trigger the issue, three configuration parameters must have specific settings: "hostname-char-set" must be left at the default setting, which is "[^A-Za-z0-9.-]"; "hostname-char-replacement" must be empty (the default); and "ddns-qualifying-suffix" must *NOT* be empty (the default is empty). DDNS updates do not need to be enabled for this issue to manifest. A client that sends certain option content would then cause kea-dhcp4 to exit unexpected
led for this issue to manifest. A client that sends certain option content would then cause kea-dhcp4 to exit unexpectedly. This issue affects Kea versions 3.0.1 through 3.0.1 and 3.1.1 through 3.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://kb.isc.org/docs/cve-2025-11232
CVE ID: CVE-2025-11233 State: PUBLISHED Published: 2025-10-01T16:49:50.139Z Last Updated: 2025-10-01T17:35:23.572Z Vendors: Rust Project Products: std Problem Types: CWE-22 Description: Starting from Rust 1.87.0 and before Rust 1.89.0, the tier 3 Cygwin target (`x86_64-pc-cygwin`) didn't correctly handle path separators, causing the standard library's Path API to ignore path components separated by backslashes. Due to this, programs compiled for Cygwin that validate paths could misbehave, potentially allowing path traversal attacks or malicious filesystem operations. Rust 1.89.0 fixes the issue by handling both Win32 and Unix style paths in the standard library for the Cygwin target. While w
.89.0 fixes the issue by handling both Win32 and Unix style paths in the standard library for the Cygwin target. While we assess the severity of this vulnerability as "medium", please note that the tier 3 Cygwin compilation target is only available when building it from source: no pre-built binaries are distributed by the Rust project, and it cannot be installed through Rustup. Unless you manually compiled the `x86_64-pc-cygwin` target you are not affected by this vulnerability. Users of the tier 1 MinGW target (`x86_64-pc-windows-gnu`) are also explicitly not affected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rust-lang/rust/pull/141864 - https://gr
itional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rust-lang/rust/pull/141864 - https://groups.google.com/g/rustlang-security-announcements/c/oT9zCvLLYkw
CVE ID: CVE-2025-11234 State: PUBLISHED Published: 2025-10-03T10:30:34.427Z Last Updated: 2025-11-12T10:12:24.915Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 Problem Types: CWE-416 Description: A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious
he callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-11234 - https://bugzilla.redhat.com/show_bug.cgi?id=2401209
CVE ID: CVE-2025-11237 State: PUBLISHED Published: 2025-11-11T06:00:04.427Z Last Updated: 2025-11-12T21:25:16.821Z Vendors: Unknown Products: Make Email Customizer for WooCommerce Problem Types: CWE-862 Missing Authorization Description: The Make Email Customizer for WooCommerce WordPress plugin through 1.0.6 lacks proper authorization checks and option validation in its AJAX actions, allowing any authenticated user, such as a Subscriber, to update arbitrary WordPress options. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/88b46752-051b-4468-9e2b-cc81a9ce1075/
CVE ID: CVE-2025-11238 State: PUBLISHED Published: 2025-10-25T05:31:18.111Z Last Updated: 2025-10-27T15:46:22.939Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: prasunsen Products: Watu Quiz Problem Types: CWE-79 Description: The Watu Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTTP Referer header in versions less than, or equal to, 3.4.4 due to insufficient input sanitization and output escaping when the "Save source URL" option is enabled. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an user accesses an injected page. Additional Analyst Notes: - C
bitrary web scripts in pages that will execute whenever an user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/168e7eac-21ad-43ca-93d1-73c38e12bc29?source=cve - https://plugins.trac.wordpress.org/changeset/3373855/watu
CVE ID: CVE-2025-11239 State: PUBLISHED Published: 2025-10-02T12:23:18.456Z Last Updated: 2025-10-02T15:52:20.336Z Vendors: KNIME Products: KNIME Business Hub Problem Types: CWE-863 Description: Potentially sensitive information in jobs on KNIME Business Hub prior to 1.16.0 were visible to all members of the user's team. Starting with KNIME Business Hub 1.16.0 only metadata of jobs is shown to team members. Only the creator of a job can see all information including in- and output data (if present). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.knime.com/security/advisories
CVE ID: CVE-2025-11240 State: PUBLISHED Published: 2025-10-02T12:30:33.769Z Last Updated: 2025-10-02T15:52:13.041Z Vendors: KNIME Products: KNIME Business Hub Problem Types: CWE-601 Description: An open redirect vulnerability existed in KNIME Business Hub prior to version 1.16.0. An unauthenticated remote attacker could craft a link to a legitimate KNIME Business Hub installation which, when opened by the user, redirects the user to a page of the attackers choice. This might open the possibility for fishing or other similar attacks. The problem has been fixed in KNIME Business Hub 1.16.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.knime.com/security/advisori
ess Hub 1.16.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.knime.com/security/advisories
CVE ID: CVE-2025-11241 State: PUBLISHED Published: 2025-10-03T01:56:44.222Z Last Updated: 2025-10-03T15:50:01.453Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: n/a Products: Yoast SEO Premium Problem Types: CWE-80 Description: The Yoast SEO Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions 25.7 to 25.9 due to a flawed regex used to remove an attribute in post content, which can be abused to inject arbitrary HTML attributes, including JavaScript event handlers. This vulnerability allows a user with Contributor access or higher to create a post containing a malicious JavaScript payload. Additional Analyst Notes: - CISA AD
ributor access or higher to create a post containing a malicious JavaScript payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a6e3645d-ed1b-4c51-a463-c2691cb7168d?source=cve - https://developer.yoast.com/changelog/yoast-seo-premium/26.0/ - https://sec.stealthcopter.com/regexss/
CVE ID: CVE-2025-11243 State: PUBLISHED Published: 2025-11-19T06:50:08.973Z Last Updated: 2025-11-21T17:13:21.290Z Vendors: Shelly Products: Pro 4PM Problem Types: CWE-770 Description: Allocation of Resources Without Limits or Throttling vulnerability in Shelly Pro 4PM (before v1.6) allows Excessive Allocation via network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-11243 - https://www.nozominetworks.com/blog/shelly-pro-4pm-vulnerabilities - https://www.cisa.gov/news-events/ics-advisories/icsa-25-322-02
CVE ID: CVE-2025-11244 State: PUBLISHED Published: 2025-10-25T05:31:20.356Z Last Updated: 2025-10-27T15:49:58.830Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: saadiqbal Products: Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content Problem Types: CWE-285 Description: The Password Protected plugin for WordPress is vulnerable to authorization bypass via IP address spoofing in all versions up to, and including, 2.7.11. This is due to the plugin trusting client-controlled HTTP headers (such as X-Forwarded-For, HTTP_CLIENT_IP, and similar headers) to determine user IP addresses in the `pp_get_ip_address()` function when the "Use t
TTP_CLIENT_IP, and similar headers) to determine user IP addresses in the `pp_get_ip_address()` function when the "Use transients" feature is enabled. This makes it possible for attackers to bypass authorization by spoofing these headers with the IP address of a legitimately authenticated user, granted the "Use transients" option is enabled (non-default configuration) and the site is not behind a CDN or reverse proxy that overwrites these headers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/30b4371d-54a2-4111-ad2c-b38b6b31884d?source=cve - https://plugins.trac.wordpress.org/browser/password-protected/tags/2.7.11/i
71d-54a2-4111-ad2c-b38b6b31884d?source=cve - https://plugins.trac.wordpress.org/browser/password-protected/tags/2.7.11/includes/transient-functions.php#L33 - https://research.cleantalk.org/cve-2025-11244/
CVE ID: CVE-2025-11248 State: PUBLISHED Published: 2025-10-27T12:56:35.389Z Last Updated: 2025-10-27T15:07:22.584Z Severity: LOW (CVSS 3.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: Zohocorp Products: ManageEngine Endpoint Central Problem Types: CWE-532 Description: ZohoCorp ManageEngine Endpoint Central versions prior to 11.4.2528.05 are vulnerable to a sensitive information logging issue. An authenticated user with access to the logs could potentially obtain the sensitive agent token. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/desktop-central/CVE-2025-11248.html
CVE ID: CVE-2025-11253 State: PUBLISHED Published: 2025-10-24T08:32:38.880Z Last Updated: 2025-10-24T13:19:52.609Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Aksis Technology Inc. Products: Netty ERP Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aksis Technology Inc. Netty ERP allows SQL Injection.This issue affects Netty ERP: before V.1.1000. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0359
CVE ID: CVE-2025-11254 State: PUBLISHED Published: 2025-10-11T08:29:16.424Z Last Updated: 2025-10-14T14:11:30.733Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: contest-gallery Products: Contest Gallery – Upload, Vote & Sell with PayPal and Stripe Problem Types: CWE-1236 Description: The Contest Gallery – Upload, Vote & Sell with PayPal and Stripe plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 27.0.3 via gallery submissions. This makes it possible for unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local