Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-9981 State: PUBLISHED Published: 2025-10-23T09:37:44.450Z Last Updated: 2025-10-23T17:29:19.163Z Vendors: OpenSolution Products: QuickCMS Problem Types: CWE-79 Description: QuickCMS is vulnerable to multiple Stored XSS in slider editor functionality (sliders-form). Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed on every page. By default admin user is not able to add JavaScript into the website. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions we
of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/posts/2025/10/CVE-2025-9980 - https://opensolution.org/cms-system-quick-cms.html
CVE ID: CVE-2025-9982 State: PUBLISHED Published: 2025-11-14T13:22:16.515Z Last Updated: 2025-11-14T15:45:56.708Z Vendors: OpenSolution Products: QuickCMS Problem Types: CWE-256 Description: A vulnerability exists in QuickCMS version 6.8 where sensitive admin credentials are hardcoded in a configuration file and stored in plaintext. This flaw allows attackers with access to the source code or the server file system to retrieve authentication details, potentially leading to privilege escalation. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other
the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/posts/2025/11/CVE-2025-9982 - https://opensolution.org/cms-system-quick-cms.html
CVE ID: CVE-2025-9983 State: PUBLISHED Published: 2025-09-22T11:06:54.268Z Last Updated: 2025-09-22T11:42:40.921Z Vendors: GALAYOU Products: G2 Problem Types: CWE-306 Description: GALAYOU G2 cameras stream video output via RTSP streams. By default these streams are protected by randomly generated credentials. However these credentials are not required to access the stream. Changing these values does not change camera's behavior. The vendor did not respond in any way. Only version 11.100001.01.28 was tested, other versions might also be vulnerable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/09/CVE-2025-9983 - https://www.galayou-store.com/g2
CVE ID: CVE-2025-9984 State: PUBLISHED Published: 2025-09-26T04:25:16.647Z Last Updated: 2025-09-26T19:36:26.882Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: marceljm Products: Featured Image from URL (FIFU) Problem Types: CWE-862 Description: The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the fifu_api_debug_posts() function in all versions up to, and including, 5.2.7. This makes it possible for unauthenticated attackers to read private/password protected posts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/
rotected posts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9423858b-74be-4b34-961d-97765d8edcbf?source=cve - https://plugins.trac.wordpress.org/browser/featured-image-from-url/trunk/admin/debug.php?rev=3348285 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3362830%40featured-image-from-url&new=3362830%40featured-image-from-url&sfp_email=&sfph_mail=
CVE ID: CVE-2025-9985 State: PUBLISHED Published: 2025-09-26T04:25:17.076Z Last Updated: 2025-09-26T19:46:14.343Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: marceljm Products: Featured Image from URL (FIFU) Problem Types: CWE-532 Description: The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.7 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel
posed log files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/991d63da-ca6c-400e-beb7-b44cf629abc9?source=cve - https://plugins.trac.wordpress.org/browser/featured-image-from-url/trunk/admin/log.php?rev=3344903 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3362830%40featured-image-from-url&new=3362830%40featured-image-from-url&sfp_email=&sfph_mail=#file6
CVE ID: CVE-2025-9990 State: PUBLISHED Published: 2025-09-05T02:25:01.708Z Last Updated: 2025-09-05T15:59:11.935Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: smackcoders Products: WordPress Helpdesk Integration Problem Types: CWE-98 Description: The WordPress Helpdesk Integration plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.8.10 via the portal_type parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve cod
cution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/49a935cc-7b95-4abd-9a4d-c7e14c765863?source=cve - https://plugins.trac.wordpress.org/browser/wp-helpdesk-integration/trunk/index.php#L85 - https://plugins.svn.wordpress.org/wp-helpdesk-integration/trunk/index.php
CVE ID: CVE-2025-9991 State: PUBLISHED Published: 2025-09-30T03:35:31.476Z Last Updated: 2025-09-30T15:35:21.042Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: migli Products: Tiny Bootstrap Elements Light Problem Types: CWE-98 Description: The Tiny Bootstrap Elements Light plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.3.34 via the 'language' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code executi
any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c1010470-63d4-49c5-9811-0e86fbeb57d5?source=cve - https://plugins.trac.wordpress.org/browser/tiny-bootstrap-elements-light/trunk/assets/bootstrap-label.php#L14 - https://plugins.svn.wordpress.org/tiny-bootstrap-elements-light/trunk/assets/bootstrap-label.php
CVE ID: CVE-2025-9992 State: PUBLISHED Published: 2025-09-18T09:31:28.275Z Last Updated: 2025-09-18T14:03:20.742Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: nko Products: Ghost Kit – Page Builder Blocks, Motion Effects & Extensions Problem Types: CWE-79 Description: The Ghost Kit – Page Builder Blocks, Motion Effects & Extensions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JS field in all versions up to, and including, 3.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages t
ossible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a58bdc25-6171-47d5-bdcc-b4fe89b906f1?source=cve - https://plugins.trac.wordpress.org/changeset/3359701/ghostkit/trunk/gutenberg/plugins/custom-code/index.php?old=3037555&old_path=ghostkit%2Ftrunk%2Fgutenberg%2Fplugins%2Fcustom-code%2Findex.php
CVE ID: CVE-2025-9993 State: PUBLISHED Published: 2025-09-30T03:35:27.453Z Last Updated: 2025-09-30T15:25:50.986Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: d3rd4v1d Products: Bei Fen – WordPress Backup Plugin Problem Types: CWE-98 Description: The Bei Fen – WordPress Backup Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.2 via the 'task'. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sens
e server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. This only affects instances running PHP 7.1 or older. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/839c3b99-189d-4a74-b295-d44eb39d86c8?source=cve - https://plugins.trac.wordpress.org/browser/bei-fen/trunk/beifen.php#L185 - https://plugins.svn.wordpress.org/bei-fen/trunk/beifen.php
CVE ID: CVE-2025-9994 State: PUBLISHED Published: 2025-09-09T13:01:05.384Z Last Updated: 2025-11-03T18:14:27.694Z Vendors: Amped RF Products: BT-AP 111 Problem Types: CWE-306 Missing Authentication for Critical Function, CWE-287 Improper Authentication Description: The Amp’ed RF BT-AP 111 Bluetooth access point's HTTP admin interface does not have an authentication feature, allowing unauthorized access to anyone with network access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ampedrftech.com/guides/BT-AP111_UserManual.pdf
CVE ID: CVE-2025-9996 State: PUBLISHED Published: 2025-09-09T21:11:15.034Z Last Updated: 2025-09-10T20:26:45.764Z Vendors: Schneider Electric Products: Saitel DR RTU, Saitel DP RTU Problem Types: CWE-78 Description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause the execution of any shell command when executing a netstat command using BLMon Console in an SSH session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-252-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-252-02.pdf
CVE ID: CVE-2025-9997 State: PUBLISHED Published: 2025-09-09T21:12:35.969Z Last Updated: 2025-09-10T19:34:21.734Z Vendors: Schneider Electric Products: Saitel DR RTU, Saitel DP RTU Problem Types: CWE-78 Description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause command injection in BLMon that is executed in the operating system console when in a SSH session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-252-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-252-02.pdf
CVE ID: CVE-2025-9998 State: PUBLISHED Published: 2025-09-05T16:40:13.645Z Last Updated: 2025-10-31T16:47:45.883Z Vendors: arcinfo Products: PcVue Problem Types: CWE-754 Description: The sequence of packets received by a Networking server are not correctly checked. An attacker could exploit this vulnerability to send specially crafted messages to force the application to stop. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.pcvue.com/security/#SB2025-4
CVE ID: CVE-2025-9999 State: PUBLISHED Published: 2025-09-05T16:41:01.957Z Last Updated: 2025-10-31T16:47:55.704Z Vendors: arcinfo Products: PcVue Problem Types: CWE-940, CWE-1288 Description: Some payload elements of the messages sent between two stations in a networking architecture are not properly checked on the receiving station allowing an attacker to execute unauthorized commands in the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.pcvue.com/security/#SB2025-4
CVE ID: UNKNOWN CWE: N/A Published: N/A Last Modified: N/A Description: No description available.