Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-2800 State: PUBLISHED Published: 2025-07-16T05:23:50.578Z Last Updated: 2025-07-18T14:47:41.285Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: wpeventmanager Products: WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce Problem Types: CWE-79 Description: The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘organizer_name' parameter in all versions up to, and including, 3.1.50 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w
cient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/87178c7c-343b-487a-9adb-7ff13aae81df?source=cve - https://plugins.trac.wordpress.org/changeset/3318605/
CVE ID: CVE-2025-2801 State: PUBLISHED Published: 2025-04-26T03:24:24.464Z Last Updated: 2025-04-28T21:55:44.894Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: dorinabc Products: Create custom forms for WordPress with a smart form plugin for smart businesses – Form builder for WordPress Problem Types: CWE-94 Description: The The Create custom forms for WordPress with a smart form plugin for smart businesses plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.2.4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This make
tware allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e45afda4-447a-4d95-90cb-9731b398a009?source=cve - https://plugins.trac.wordpress.org/browser/abcsubmit/tags/1.2.4/abcsubmit.php#L86 - https://plugins.trac.wordpress.org/browser/abcsubmit/tags/1.2.4/abcsubmit.php#L88 - https://wordpress.org/plugins/abcsubmit/#developers
CVE ID: CVE-2025-2802 State: PUBLISHED Published: 2025-05-06T04:24:13.420Z Last Updated: 2025-05-06T14:16:08.311Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: layoutboxx Products: LayoutBoxx Problem Types: CWE-94 Description: The LayoutBoxx plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 0.3.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/t
ecute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fc3fcb8f-f130-4008-8f11-d98efa30f1a8?source=cve - https://plugins.svn.wordpress.org/layoutboxx/trunk/layoutboxx.php - https://wordpress.org/plugins/layoutboxx/#developers
CVE ID: CVE-2025-2803 State: PUBLISHED Published: 2025-03-29T07:03:30.428Z Last Updated: 2025-03-31T13:19:04.690Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: davemacd Products: So-Called Air Quotes Problem Types: CWE-94 Description: The So-Called Air Quotes plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 0.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www
attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/83f2ceee-4422-4ed5-adc7-91bc022ae42d?source=cve - https://plugins.svn.wordpress.org/so-called-air-quotes/trunk/airquote.php - https://wordpress.org/plugins/so-called-air-quotes/#developers
CVE ID: CVE-2025-2804 State: PUBLISHED Published: 2025-03-28T05:23:44.516Z Last Updated: 2025-03-28T14:35:58.805Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: tagDiv Products: tagDiv Composer Problem Types: CWE-79 Description: The tagDiv Composer plugin for WordPress, used by the Newspaper theme, is vulnerable to Reflected Cross-Site Scripting via the 'account_id' and 'account_username' parameters in all versions up to, and including, 5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing
ed attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/41ef545a-7de1-406c-8686-57216e697a1b?source=cve - https://tagdiv.com/td_deploy/Newspaper/changed_files_12.6.9_12.7.html
CVE ID: CVE-2025-2805 State: PUBLISHED Published: 2025-04-10T07:02:40.354Z Last Updated: 2025-04-10T14:00:17.637Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: vikashsrivastava1111989 Products: ORDER POST Problem Types: CWE-94 Description: The ORDER POST plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wo
tackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d35ea739-5ee9-4779-87d5-3f13b11229cf?source=cve - https://plugins.svn.wordpress.org/order-post/trunk/wp_post_order.php - https://wordpress.org/plugins/order-post/#developers
CVE ID: CVE-2025-2806 State: PUBLISHED Published: 2025-05-08T11:23:40.588Z Last Updated: 2025-05-08T13:32:26.621Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: tagDiv Products: tagDiv Composer Problem Types: CWE-79 Description: The tagDiv Composer plugin for WordPress, used by the Newspaper theme, is vulnerable to Reflected Cross-Site Scripting via the ‘data’ parameter in all versions up to, and including, 5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on
ry web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/52bd9946-dccc-427a-9abd-0b7153e7484f?source=cve - http://localhost:1337/wp-content/plugins/td-composer/legacy/common/wp_booster/td_ajax.php#L2034 - https://tagdiv.com/td_deploy/Newspaper/changed_files_12.6.9_12.7.html
CVE ID: CVE-2025-2807 State: PUBLISHED Published: 2025-04-08T09:21:18.881Z Last Updated: 2025-04-08T13:09:19.386Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: stylemix Products: Motors – Car Dealership & Classified Listings Plugin Problem Types: CWE-862 Description: The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary plugin installations due to a missing capability check in the mvl_setup_wizard_install_plugin() function in all versions up to, and including, 1.4.64. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate arbitrary plugins on the a
for authenticated attackers, with Subscriber-level access and above, to install and activate arbitrary plugins on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/733f7666-468a-455c-a953-3d8946940f13?source=cve - https://plugins.trac.wordpress.org/changeset/3262748/motors-car-dealership-classified-listings/trunk/includes/admin/setup-wizard/includes/ajax_actions.php
CVE ID: CVE-2025-2808 State: PUBLISHED Published: 2025-04-08T09:21:19.488Z Last Updated: 2025-04-08T13:07:31.983Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: stylemix Products: Motors – Car Dealership & Classified Listings Plugin Problem Types: CWE-79 Description: The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Phone Number parameter in all versions up to, and including, 1.4.63 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that
ible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/90e420be-fe6e-4a35-9c06-f0d360c9f9bf?source=cve - https://plugins.trac.wordpress.org/changeset/3262748/motors-car-dealership-classified-listings/trunk/includes/actions.php
CVE ID: CVE-2025-2809 State: PUBLISHED Published: 2025-04-10T07:02:39.503Z Last Updated: 2025-04-10T13:38:36.557Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: azurecurve Products: azurecurve Shortcodes in Comments Problem Types: CWE-94 Description: The azurecurve Shortcodes in Comments plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichm
t possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/22cc6da1-fd22-4b2a-90ab-24086879f0f6?source=cve - https://wordpress.org/plugins/azurecurve-shortcodes-in-comments/#developers - https://plugins.trac.wordpress.org/browser/azurecurve-shortcodes-in-comments/trunk/azurecurve-shortcodes-in-comments.php#L35
CVE ID: CVE-2025-2810 State: PUBLISHED Published: 2025-08-05T08:06:24.606Z Last Updated: 2025-08-05T13:14:31.685Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Draeger Products: Draeger ICMHelper Problem Types: CWE-321 Description: A low privileged local attacker can abuse the affected service by using a hardcoded cryptographic key. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/en/advisories/VDE-2025-028
CVE ID: CVE-2025-2811 State: PUBLISHED Published: 2025-04-26T07:00:05.770Z Last Updated: 2025-04-28T18:09:59.404Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GL.iNet Products: GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7, GL-E750, GL-E750V2 Mudi, GL-MT300N-V2 Mango, GL-MT1300 Beryl, GL-MT2500 Brume 2, GL-MT3000 Beryl AX, GL-MT6000 Flint 2, GL-SFT1200 Opal, GL-X300B Collie, GL-X750 Spitz, GL-X3000 Spitz AX, GL-XE300 Puli, GL-XE3000 Puli AX Problem Types: CWE-1333, CWE-400 Description: A vulnerability was found in
0 Spitz AX, GL-XE300 Puli, GL-XE3000 Puli AX Problem Types: CWE-1333, CWE-400 Description: A vulnerability was found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7, GL-E750, GL-E750V2 Mudi, GL-MT300N-V2 Mango, GL-MT1300 Beryl, GL-MT2500 Brume 2, GL-MT3000 Beryl AX, GL-MT6000 Flint 2, GL-SFT1200 Opal, GL-X300B Collie, GL-X750 Spitz, GL-X3000 Spitz AX, GL-XE300 Puli and GL-XE3000 Puli AX 4.x. It has been declared as problematic. This vulnerability affects unknown code of the component API. The manipulation leads to inefficient regular expressi
ic. This vulnerability affects unknown code of the component API. The manipulation leads to inefficient regular expression complexity. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306286 - https://vuldb.com/?ctiid.306286 - https://vuldb.com/?submit.524459 - https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Calling%20a%20special%20API%20that%20doesn't%20require%20login%20and%20passing%20in%20a%20special%20character%20parameter%20results%20in%20100%25%20CPU%20usage.md - https://www.gl-inet.com/security-updates/security-advisories-vulnerabilities-and-cves-apr-24-2025/
CVE ID: CVE-2025-2812 State: PUBLISHED Published: 2025-05-02T08:24:39.851Z Last Updated: 2025-05-28T18:05:49.919Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Mydata Informatics Products: Ticket Sales Automation Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mydata Informatics Ticket Sales Automation allows Blind SQL Injection.This issue affects Ticket Sales Automation: before 03.04.2025 (DD.MM.YYYY). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0099 - https://github.com/sahici/CVE-2025-2812/
CVE ID: CVE-2025-2813 State: PUBLISHED Published: 2025-07-31T10:08:24.026Z Last Updated: 2025-07-31T13:16:45.046Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Phoenix Contact Products: AXL F BK PN TPS, AXL F BK PN TPS XC, AXL F BK PN (discontinued), AXL F BK PN XC (discontinued), AXL F BK SAS (discontinued), AXL F BK ETH, AXL F BK ETH XC, AXL F BK EIP, AXL F BK EIP EF, AXL F BK EIP XC, IL PN BK-PAC, IL ETH BK-PAC, IL ETH BK DI8 DO4 2TX-PAC, IL EIP BK DI8 DO4 2TX-PAC Problem Types: CWE-770 Description: An unauthenticated remote attacker can cause a Denial of Service by sending a large number of requests to the http service on port 80. Additional Analyst Note
cause a Denial of Service by sending a large number of requests to the http service on port 80. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/en/advisories/VDE-2025-029/
CVE ID: CVE-2025-2814 State: PUBLISHED Published: 2025-04-12T23:41:48.511Z Last Updated: 2025-09-05T13:21:32.700Z Vendors: LDS Products: Crypt::CBC Problem Types: CWE-338, CWE-329, CWE-331 Description: Crypt::CBC versions between 1.21 and 3.05 for Perl may use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. This issue affects operating systems where "/dev/urandom'" is unavailable. In that case, Crypt::CBC will fallback to use the insecure rand() function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://perldoc.perl.org/functions/rand - https://metacpan.org/dist/Crypt-CBC/source/lib/Crypt/CBC.pm
ent: References: - https://perldoc.perl.org/functions/rand - https://metacpan.org/dist/Crypt-CBC/source/lib/Crypt/CBC.pm#L777 - https://security.metacpan.org/docs/guides/random-data-for-security.html - https://github.com/lstein/Lib-Crypt-CBC/commit/37111f7cd894bcec46156ba7f40a49c126ebf535.patch
CVE ID: CVE-2025-2815 State: PUBLISHED Published: 2025-03-28T11:13:13.313Z Last Updated: 2025-04-10T14:49:22.390Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: quyle91 Products: Administrator Z Problem Types: CWE-862 Description: The Administrator Z plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the adminz_import_backup() function in all versions up to, and including, 2025.03.24. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the defa
iber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/32725074-5c62-49e0-83f9-c6cb77fb77a4?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3262319%40administrator-z&new=3262319%40administrator-z&sfp_email=&sfph_mail=
CVE ID: CVE-2025-2816 State: PUBLISHED Published: 2025-05-01T02:23:03.486Z Last Updated: 2025-05-01T13:24:11.246Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: a3rev Products: Page View Count Problem Types: CWE-862 Description: The Page View Count plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the yellow_message_dontshow() function in versions 2.8.0 to 2.8.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to one on the WordPress site. This can be leveraged to update an option that would create
above, to update option values to one on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values to true such as registration. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e6fb9558-06e5-4297-93df-ee9a6971f0ec?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3282975%40page-views-count&new=3282975%40page-views-count&sfp_email=&sfph_mail=
CVE ID: CVE-2025-2817 State: PUBLISHED Published: 2025-04-29T13:13:33.783Z Last Updated: 2025-11-03T19:46:41.197Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Privilege escalation in Thunderbird Updater Description: Thunderbird's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By injecting code into the user-privileged process, an attacker could bypass intended access controls, allowing SYSTEM-level file operations on paths controlled by a non-privileged user and enabling privilege escalation. This vulnerability affects Firefox < 138, Firefox ESR < 128.10, Firefox ESR
eged user and enabling privilege escalation. This vulnerability affects Firefox < 138, Firefox ESR < 128.10, Firefox ESR < 115.23, Thunderbird < 138, and Thunderbird < 128.10. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1917536 - https://www.mozilla.org/security/advisories/mfsa2025-28/ - https://www.mozilla.org/security/advisories/mfsa2025-29/ - https://www.mozilla.org/security/advisories/mfsa2025-30/ - https://www.mozilla.org/security/advisories/mfsa2025-31/ - https://www.mozilla.org/security/advisories/mfsa2025-32/
CVE ID: CVE-2025-2818 State: PUBLISHED Published: 2025-07-17T19:17:51.443Z Last Updated: 2025-07-17T20:11:30.889Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Motorola Products: Smart Connect Android Application Problem Types: CWE-319 Description: A vulnerability was reported in version 1.0 of the Bluetooth Transmission Alliance protocol adopted by Motorola Smart Connect Android Application that could allow a nearby attacker within the Bluetooth interaction range to intercept files when transferred to a device not paired in Smart Connect. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://en-us.support.motorola.com/app/answers/detail/a_
dditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://en-us.support.motorola.com/app/answers/detail/a_id/186727 - https://support.lenovo.com/us/en/product_security/LEN-188742
CVE ID: CVE-2025-2819 State: PUBLISHED Published: 2025-03-26T14:49:38.291Z Last Updated: 2025-03-26T15:17:46.739Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L) Vendors: Bizerba SE & Co. KG Products: GT-SoftControl Problem Types: CWE-434 Description: There is a risk of unauthorized file uploads in GT-SoftControl and potential file overwrites due to insufficient validation in the file selection process. This could lead to data integrity issues and unauthorized access by an authenticated privileged user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.bizerba.com/downloads/global/information-security/2025/bizerba-sa-2025-0001.pdf
CVE ID: CVE-2025-2820 State: PUBLISHED Published: 2025-03-26T14:58:09.132Z Last Updated: 2025-03-26T15:17:18.797Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Bizerba SE & Co. KG Products: Product family GLx and CWx Problem Types: CWE-400 Description: An authenticated attacker can compromise the availability of the device via the network Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.bizerba.com/downloads/global/information-security/2025/bizerba-sa-2025-0002.pdf
CVE ID: CVE-2025-2821 State: PUBLISHED Published: 2025-05-07T01:43:06.640Z Last Updated: 2025-05-07T14:03:35.051Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: quadlayers Products: Search Exclude Problem Types: CWE-862 Description: The Search Exclude plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the get_rest_permission function in all versions up to, and including, 2.4.9. This makes it possible for unauthenticated attackers to modify plugin settings, excluding content from search results. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vul
rch results. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1f72a309-8ef8-4943-8e64-38bb7909397a?source=cve - https://plugins.trac.wordpress.org/browser/search-exclude/tags/2.4.6/lib/api/entities/settings/class-post.php#L42 - https://plugins.trac.wordpress.org/changeset/3284798/
CVE ID: CVE-2025-2824 State: PUBLISHED Published: 2025-08-01T17:46:30.472Z Last Updated: 2025-08-01T18:07:22.830Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N) Vendors: IBM Products: Operational Decision Manager Problem Types: CWE-601 Description: IBM Operational Decision Manager 8.11.0.1, 8.11.1.0, 8.12.0.1, 9.0.0.1, and 9.5.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain