Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
t malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/87efa10d-d359-4258-9db2-811d5ae75c60?source=cve - https://plugins.trac.wordpress.org/browser/linkedin-resume/tags/2.00/linkedinresume.php#L243 - https://plugins.trac.wordpress.org/browser/linkedin-resume/tags/2.00/linkedinresume.php#L245 - https://plugins.trac.wordpress.org/browser/linkedin-resume/tags/2.00/linkedinresume.php#L259
CVE ID: CVE-2025-12403 State: PUBLISHED Published: 2025-11-04T04:27:23.574Z Last Updated: 2025-11-04T14:58:40.263Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: revokee Products: Associados Amazon Plugin Problem Types: CWE-352 Description: The Associados Amazon Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.8. This is due to missing or incorrect nonce validation on the brzon_admin_panel() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action s
nject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f7968054-69f1-47f5-9a32-b124ee1133ce?source=cve - https://plugins.trac.wordpress.org/browser/brzon/tags/0.8/brzon.php#L568 - https://plugins.trac.wordpress.org/browser/brzon/tags/0.8/brzon.php#L569 - https://plugins.trac.wordpress.org/browser/brzon/tags/0.8/brzon.php#L589
CVE ID: CVE-2025-12404 State: PUBLISHED Published: 2025-11-18T08:27:32.530Z Last Updated: 2025-11-18T14:59:31.952Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: nikolayyordanov Products: Like-it Problem Types: CWE-352 Description: The Like-it plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is due to missing or incorrect nonce validation on the likeit_conf() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Addit
a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6ad1d9f5-c224-4d28-8d73-439b3c5ca24f?source=cve - https://plugins.trac.wordpress.org/browser/like-it/tags/2.2/like-it.php#L130 - https://plugins.trac.wordpress.org/browser/like-it/tags/2.2/like-it.php#L131 - https://plugins.trac.wordpress.org/browser/like-it/tags/2.2/tpl/config.php#L37
CVE ID: CVE-2025-12405 State: PUBLISHED Published: 2025-11-10T09:27:45.471Z Last Updated: 2025-11-10T12:50:57.865Z Vendors: Google Cloud Products: Looker Studio Problem Types: CWE-269 Description: An improper privilege management vulnerability was found in Looker Studio. It impacted all JDBC-based connectors. A Looker Studio user with report view access could make a copy of the report and execute arbitrary SQL that would run on the data source database due to the stored credentials attached to the report. This vulnerability was patched on 21 July 2025, and no customer action is needed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cloud.google.com/support/bulletins
n is needed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cloud.google.com/support/bulletins#gcp-2025-053 - https://www.tenable.com/security/research/tra-2025-29
CVE ID: CVE-2025-12406 State: PUBLISHED Published: 2025-11-18T08:27:37.486Z Last Updated: 2025-11-18T21:07:39.008Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: awensley Products: Project Honey Pot Spam Trap Problem Types: CWE-352 Description: The Project Honey Pot Spam Trap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the printAdminPage() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an ac
and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e774476d-3696-4489-b028-16c25f8db1ca?source=cve - https://plugins.trac.wordpress.org/browser/project-honey-pot-spam-trap/tags/1.0.1/project_honey_pot.php#L244 - https://plugins.trac.wordpress.org/browser/project-honey-pot-spam-trap/tags/1.0.1/project_honey_pot.php#L248 - https://plugins.trac.wordpress.org/browser/project-honey-pot-spam-trap/tags/1.0.1/project_honey_pot.php#L293
CVE ID: CVE-2025-12409 State: PUBLISHED Published: 2025-11-10T08:59:15.899Z Last Updated: 2025-11-10T15:16:16.715Z Vendors: Google Cloud Products: Looker Studio Problem Types: CWE-89 Description: A SQL injection vulnerability was discovered in Looker Studio that allowed for data exfiltration from BigQuery data sources. By creating a malicious report with native functions enabled, and having the victim access the report, an attacker could execute injected SQL queries with the victim's permissions in BigQuery. This vulnerability was patched on 07 July 2025, and no customer action is needed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cloud.google.com/support/bullet
tion is needed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cloud.google.com/support/bulletins#gcp-2025-053 - https://www.tenable.com/security/research/tra-2025-27
CVE ID: CVE-2025-12410 State: PUBLISHED Published: 2025-11-04T04:27:15.805Z Last Updated: 2025-11-04T21:01:21.541Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: samhoamt Products: SH Contextual Help Problem Types: CWE-352 Description: The SH Contextual Help plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due to missing or incorrect nonce validation in the sh_contextual_help_dashboard_widget() function. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into
lugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/364d6bd8-cdb8-4c99-b610-ba9a3125909e?source=cve - https://plugins.trac.wordpress.org/browser/sh-contextual-help/tags/3.2.1/functions.php#L400 - https://plugins.trac.wordpress.org/browser/sh-contextual-help/tags/3.2.1/functions.php#L402 - https://plugins.trac.wordpress.org/browser/sh-contextual-help/tags/3.2.1/functions.php#L417
CVE ID: CVE-2025-12411 State: PUBLISHED Published: 2025-11-18T08:27:30.246Z Last Updated: 2025-11-18T16:35:18.769Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: premmerce Products: Premmerce Wholesale Pricing for WooCommerce Problem Types: CWE-89 Description: The Premmerce Wholesale Pricing for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'ID' parameter in versions up to, and including, 1.1.10. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber level access and above, to manipulate SQL q
L query. This makes it possible for authenticated attackers, with subscriber level access and above, to manipulate SQL queries that can be used to extract sensitive information from the database and modify price type display names in the database via the admin-post.php "premmerce_update_price_type" action, causing cosmetic corruption of the admin interface. The 'price_type' parameter of the "premmerce_delete_price_type" is also vulnerable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1e4e27e0-bbb0-498a-b425-9e9d60dfed0f?source=cve - https://plugins.trac.wordpress.org/browser/premmerce-woocommerce-wholesale-pricing/
-498a-b425-9e9d60dfed0f?source=cve - https://plugins.trac.wordpress.org/browser/premmerce-woocommerce-wholesale-pricing/tags/1.1.10/src/Models/Model.php#L171 - https://plugins.trac.wordpress.org/browser/premmerce-woocommerce-wholesale-pricing/tags/1.1.10/src/Admin/Admin.php#L83
CVE ID: CVE-2025-12412 State: PUBLISHED Published: 2025-11-04T04:27:12.930Z Last Updated: 2025-11-04T20:53:26.807Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: josereyev Products: Top Bar Notification Problem Types: CWE-352 Description: The Top Bar Notification plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12. This is due to missing or incorrect nonce validation on th tbn_ajax_add() function. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action
inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0856f3bf-da17-44bb-aa30-26f9fb6e22b1?source=cve - https://plugins.trac.wordpress.org/browser/top-bar-notification/tags/1.12/Notification.php#L102 - https://plugins.trac.wordpress.org/browser/top-bar-notification/tags/1.12/Notification.php#L75
CVE ID: CVE-2025-12413 State: PUBLISHED Published: 2025-11-04T04:27:14.981Z Last Updated: 2025-11-04T21:00:10.133Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: socialmedialtd Products: WPCF7 Stop words Problem Types: CWE-352 Description: The Social Media WPCF7 Stop Words plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.3. This is due to missing or incorrect nonce validation on the smWpCfSwOptions() function. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into perfo
's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/27857a17-8cf0-40b3-894f-8dd7cf5108dd?source=cve - https://plugins.trac.wordpress.org/browser/wpcf7-stop-words/tags/1.1.3/social-media-wpcf7-stop-words.php#L45
CVE ID: CVE-2025-12414 State: PUBLISHED Published: 2025-11-20T10:32:52.463Z Last Updated: 2025-11-20T14:36:38.420Z Vendors: Google Cloud Products: Looker Problem Types: CWE-290 Description: An attacker could take over a Looker account in a Looker instance configured with OIDC authentication, due to email address string normalization.Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for Looker-hosted. Self-hosted instances must be upgraded as soon as possible. This vulnerability has been patched in all supported versions of Self-hosted. The versions below have all been updated to protect from this vulnerability. You can download these versions at
-hosted. The versions below have all been updated to protect from this vulnerability. You can download these versions at the Looker download page https://download.looker.com/ : * 24.12.100+ * 24.18.193+ * 25.0.69+ * 25.6.57+ * 25.8.39+ * 25.10.22+ * 25.12.0+ Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cloud.google.com/support/bulletins#GCP-2025-067
CVE ID: CVE-2025-12415 State: PUBLISHED Published: 2025-11-04T04:27:19.056Z Last Updated: 2025-11-04T15:53:00.650Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: sugiartha Products: MapMap Problem Types: CWE-352 Description: The MapMap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the admin_shortcode_submit, admin_configuration_submit, and admin_shortcode_delete functions. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site ad
s to update the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7c0ed22d-6102-47d6-9afb-fed8515ea74c?source=cve - https://plugins.trac.wordpress.org/browser/mapmap/tags/1.1/mapmap.php#L418 - https://plugins.trac.wordpress.org/browser/mapmap/tags/1.1/mapmap.php#L397 - https://plugins.trac.wordpress.org/browser/mapmap/tags/1.1/mapmap.php#L447
CVE ID: CVE-2025-12416 State: PUBLISHED Published: 2025-11-04T04:27:13.744Z Last Updated: 2025-11-04T20:56:39.593Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: mahype Products: Pagerank tools Problem Types: CWE-352 Description: The Pagerank Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Site Request Forgery in all versions up to, and including, 1.1.5. This is due to missing nonce validation on the pr_save_settings() function and insufficient input sanitization. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into perform
attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The injected scripts will execute whenever a user accesses the plugin's settings page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/177900d6-c52e-4ac4-a74d-412e453f9d05?source=cve - https://plugins.trac.wordpress.org/browser/pagerank-tools/tags/1.1.5/functions.inc.php#L176 - https://plugins.trac.wordpress.org/browser/pagerank-tools/tags/1.1.5/functions.inc.php#L192
CVE ID: CVE-2025-12418 State: PUBLISHED Published: 2025-11-07T21:27:04.650Z Last Updated: 2025-11-13T14:26:11.510Z Vendors: Revenera Products: InstallShield Problem Types: CWE-59 Description: Potential Denial of Service issue in all supported versions of Revenera InstallShield version 2025 R1, 2024 R2, 2023 R2, and prior. When e.g., a local administrator performs an uninstall, a symlink may get followed on removal of a user writeable configuration directory and induce a Denial of Service as a result. The issue is resolved through the hotfixes InstallShield2025R1-CVE-2025-12418-SecurityPatch, InstallShield2024R2-CVE-2025-12418-SecurityPatch, and InstallShield2023R2-CVE-2025-12418-SecurityPatc
418-SecurityPatch, InstallShield2024R2-CVE-2025-12418-SecurityPatch, and InstallShield2023R2-CVE-2025-12418-SecurityPatch. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.revenera.com/s/article/CVE-2025-12418-Potential-Unintended-File-Deletion-Issue-Caused-by-InstallShield-Suite-Uninstallation-Process
CVE ID: CVE-2025-12422 State: PUBLISHED Published: 2025-10-28T18:09:39.841Z Last Updated: 2025-10-28T19:09:39.496Z Vendors: Azure Access Technology Products: BLU-IC2, BLU-IC4 Problem Types: CWE-22 Description: Vulnerable Upgrade Feature (Arbitrary File Write) may lead to obtaining super user permissions on board.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://azure-access.com/security-advisories
CVE ID: CVE-2025-12423 State: PUBLISHED Published: 2025-10-28T18:14:57.727Z Last Updated: 2025-10-28T19:09:14.374Z Vendors: Azure Access Technology Products: BLU-IC2, BLU-IC4 Problem Types: CWE-248 Description: Protocol manipulation might lead to denial of service.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://azure-access.com/security-advisories
CVE ID: CVE-2025-12424 State: PUBLISHED Published: 2025-10-28T18:18:47.127Z Last Updated: 2025-10-28T19:10:07.120Z Vendors: Azure Access Technology Products: BLU-IC2, BLU-IC4 Problem Types: CWE-269 Description: Privilege Escalation through SUID-bit Binary.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://azure-access.com/security-advisories
CVE ID: CVE-2025-12425 State: PUBLISHED Published: 2025-10-28T18:21:48.593Z Last Updated: 2025-10-28T19:08:08.029Z Vendors: Azure Access Technology Products: BLU-IC2, BLU-IC4 Problem Types: CWE-269 Description: Local Privilege Escalation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://azure-access.com/security-advisories
CVE ID: CVE-2025-12426 State: PUBLISHED Published: 2025-11-19T04:28:19.408Z Last Updated: 2025-11-19T20:11:52.850Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: ays-pro Products: Quiz Maker Problem Types: CWE-200 Description: The Quiz Maker plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.7.0.80. This is due to the plugin exposing quiz answers through the ays_quiz_check_answer AJAX action without proper authorization checks. The endpoint only validates a nonce, but that same nonce is publicly available to all site visitors via the quiz_maker_ajax_public localized script data. This makes it possibl
e is publicly available to all site visitors via the quiz_maker_ajax_public localized script data. This makes it possible for unauthenticated attackers to extract sensitive data including quiz answers for any quiz question. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bc524e3e-9b7c-47ae-ab44-c327b287b81a?source=cve - https://plugins.trac.wordpress.org/browser/quiz-maker/tags/6.7.0.69/public/class-quiz-maker-public.php#L8490 - https://plugins.trac.wordpress.org/browser/quiz-maker/tags/6.7.0.69/includes/class-quiz-maker.php#L393 - https://plugins.trac.wordpress.org/browser/quiz-maker/tags/6.7.0.69/public/class-quiz-m
udes/class-quiz-maker.php#L393 - https://plugins.trac.wordpress.org/browser/quiz-maker/tags/6.7.0.69/public/class-quiz-maker-public.php#L179
CVE ID: CVE-2025-12427 State: PUBLISHED Published: 2025-11-19T03:29:39.992Z Last Updated: 2025-11-19T20:09:20.500Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: yithemes Products: YITH WooCommerce Wishlist Problem Types: CWE-639 Description: The YITH WooCommerce Wishlist plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.10.0 via the REST API endpoint and AJAX handler due to missing validation on user-controlled keys. This makes it possible for unauthenticated attackers to discover any user's wishlist token ID, and subsequently rename the victim's wishlist without authorization (integrity impact).
er any user's wishlist token ID, and subsequently rename the victim's wishlist without authorization (integrity impact). This can be exploited to target multi-user stores for defacement, social engineering attacks, mass tampering, and profiling at scale. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ffdb95ac-6b22-44a9-bd5c-b802a2d908d7?source=cve - https://plugins.trac.wordpress.org/browser/yith-woocommerce-wishlist/tags/4.10.0/includes/rest-api/controllers/v1/class-yith-wcwl-rest-v1-lists-controller.php#L56 - https://plugins.trac.wordpress.org/browser/yith-woocommerce-wishlist/tags/4.10.0/includes/rest-api/controll
er.php#L56 - https://plugins.trac.wordpress.org/browser/yith-woocommerce-wishlist/tags/4.10.0/includes/rest-api/controllers/v1/class-yith-wcwl-rest-v1-lists-controller.php#L97 - https://plugins.trac.wordpress.org/browser/yith-woocommerce-wishlist/tags/4.10.0/includes/class-yith-wcwl-ajax-handler.php#L38 - https://plugins.trac.wordpress.org/browser/yith-woocommerce-wishlist/tags/4.10.0/includes/class-yith-wcwl-ajax-handler.php#L265 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3394933%40yith-woocommerce-wishlist%2Ftrunk&old=3379519%40yith-woocommerce-wishlist%2Ftrunk&sfp_email=&sfph_mail=#file0
CVE ID: CVE-2025-12428 State: PUBLISHED Published: 2025-11-10T20:00:12.016Z Last Updated: 2025-11-12T17:09:41.356Z Vendors: Google Products: Chrome Problem Types: CWE-843 Description: Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html - https://issues.chromium.org/issues/447613211
CVE ID: CVE-2025-12429 State: PUBLISHED Published: 2025-11-10T20:00:13.470Z Last Updated: 2025-11-11T04:55:45.318Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html - https://issues.chromium.org/issues/450618029
CVE ID: CVE-2025-12430 State: PUBLISHED Published: 2025-11-10T20:00:14.053Z Last Updated: 2025-11-12T21:05:59.207Z Vendors: Google Products: Chrome Problem Types: Object lifecycle issue Description: Object lifecycle issue in Media in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html - https://issues.chromium.org/issues/442860743
CVE ID: CVE-2025-12431 State: PUBLISHED Published: 2025-11-10T20:00:14.631Z Last Updated: 2025-11-12T21:04:49.597Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html - https://issues.chromium.org/issues/436887350