Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-8333 State: PUBLISHED Published: 2025-07-30T21:02:05.135Z Last Updated: 2025-07-31T14:34:36.704Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Online Farm System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Online Farm System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /categoryvalue.php. The manipulation of the argument Value leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
it has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318283 - https://vuldb.com/?ctiid.318283 - https://vuldb.com/?submit.624004 - https://github.com/wllovemy/cve/issues/8 - https://code-projects.org/
CVE ID: CVE-2025-8334 State: PUBLISHED Published: 2025-07-30T21:32:05.858Z Last Updated: 2025-07-31T14:34:31.103Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Online Recruitment Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Campcodes Online Recruitment Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/ajax.php?action=delete_recruitment_status. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst No
The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318284 - https://vuldb.com/?ctiid.318284 - https://vuldb.com/?submit.624073 - https://github.com/CVE-Hunter-Leo/CVE/issues/1 - https://www.campcodes.com/
CVE ID: CVE-2025-8335 State: PUBLISHED Published: 2025-07-30T22:02:06.806Z Last Updated: 2025-07-31T14:34:25.859Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Simple Car Rental System Problem Types: CWE-352, CWE-862 Description: A vulnerability classified as problematic has been found in code-projects Simple Car Rental System 1.0. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318285 - https://vuldb.com/?ct
d. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318285 - https://vuldb.com/?ctiid.318285 - https://vuldb.com/?submit.624107 - https://github.com/i-Corner/cve/issues/12 - https://code-projects.org/
CVE ID: CVE-2025-8336 State: PUBLISHED Published: 2025-07-30T22:32:06.708Z Last Updated: 2025-07-31T14:34:19.331Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Online Recruitment Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in Campcodes Online Recruitment Management System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=save_user. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Refere
The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318286 - https://vuldb.com/?ctiid.318286 - https://vuldb.com/?submit.624118 - https://github.com/CVE-Hunter-Leo/CVE/issues/2 - https://www.campcodes.com/
CVE ID: CVE-2025-8337 State: PUBLISHED Published: 2025-07-30T23:02:05.760Z Last Updated: 2025-07-31T14:34:13.718Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Simple Car Rental System Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, has been found in code-projects Simple Car Rental System 1.0. This issue affects some unknown processing of the file /admin/add_vehicles.php. The manipulation of the argument car_name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichm
d remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318287 - https://vuldb.com/?ctiid.318287 - https://vuldb.com/?submit.624187 - https://github.com/i-Corner/cve/issues/13 - https://code-projects.org/
CVE ID: CVE-2025-8338 State: PUBLISHED Published: 2025-07-30T23:32:05.567Z Last Updated: 2025-07-31T14:34:08.111Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: projectworlds Products: Online Admission System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in projectworlds Online Admission System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /adminac.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.
disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318290 - https://vuldb.com/?ctiid.318290 - https://vuldb.com/?submit.624646 - https://github.com/Sunhaobin318/CVE/issues/1
CVE ID: CVE-2025-8339 State: PUBLISHED Published: 2025-07-31T00:02:05.582Z Last Updated: 2025-07-31T14:34:02.281Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Intern Membership Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Intern Membership Management System 1.0. It has been classified as critical. This affects an unknown part of the file /student_login.php. The manipulation of the argument user_name/password leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP
the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318291 - https://vuldb.com/?ctiid.318291 - https://vuldb.com/?submit.624673 - https://github.com/shenxianyuguitian/intern-mms-vuln/blob/main/README.md - https://code-projects.org/
CVE ID: CVE-2025-8340 State: PUBLISHED Published: 2025-07-31T00:32:06.003Z Last Updated: 2025-07-31T14:33:56.314Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Intern Membership Management System Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in code-projects Intern Membership Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file fill_details.php of the component Error Message Handler. The manipulation of the argument email leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additi
te scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318292 - https://vuldb.com/?ctiid.318292 - https://vuldb.com/?submit.624681 - https://github.com/shenxianyuguitian/intern-mms-vuln-XSS/blob/main/README.md - https://code-projects.org/
CVE ID: CVE-2025-8341 State: PUBLISHED Published: 2025-08-04T08:34:50.669Z Last Updated: 2025-08-04T16:13:49.206Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: Grafana Products: grafana-infinity-datasource Problem Types: CWE-918 Description: Grafana is an open-source platform for monitoring and observability. The Infinity datasource plugin, maintained by Grafana Labs, allows visualizing data from JSON, CSV, XML, GraphQL, and HTML endpoints. If the plugin was configured to allow only certain URLs, an attacker could bypass this restriction using a specially crafted URL. This vulnerability is fixed in version 3.4.1. Additional Analyst Notes: - CISA ADP Vulnrich
ing a specially crafted URL. This vulnerability is fixed in version 3.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://grafana.com/security/security-advisories/cve-2025-8341/ - https://github.com/grafana/grafana-infinity-datasource/releases/tag/v3.4.1
CVE ID: CVE-2025-8342 State: PUBLISHED Published: 2025-08-15T02:24:22.094Z Last Updated: 2025-08-15T12:44:28.348Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: glboy Products: WooCommerce OTP Login With Phone Number, OTP Verification Problem Types: CWE-862 Description: The WooCommerce OTP Login With Phone Number, OTP Verification plugin for WordPress is vulnerable to authentication bypass due to insufficient empty value checking in the lwp_ajax_register function in all versions up to, and including, 1.8.47. This makes it possible for unauthenticated attackers to bypass OTP verification and gain administrative access to any user account with a configured phon
enticated attackers to bypass OTP verification and gain administrative access to any user account with a configured phone number by exploiting improper Firebase API error handling when the Firebase API key is not configured. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6e74582f-8e94-4cba-a3eb-0a823a5235ad?source=cve - https://plugins.trac.wordpress.org/browser/login-with-phone-number/tags/1.8.47/login-with-phonenumber.php#L4373 - https://plugins.trac.wordpress.org/browser/login-with-phone-number/tags/1.8.47/login-with-phonenumber.php#L4358 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponam
ags/1.8.47/login-with-phonenumber.php#L4358 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3338150%40login-with-phone-number&new=3338150%40login-with-phone-number&sfp_email=&sfph_mail=
CVE ID: CVE-2025-8343 State: PUBLISHED Published: 2025-07-31T01:02:06.447Z Last Updated: 2025-07-31T14:33:50.154Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: openviglet Products: shio Problem Types: CWE-22 Description: A vulnerability was found in openviglet shio up to 0.3.8. It has been rated as critical. This issue affects the function shStaticFilePreUpload of the file shio-app/src/main/java/com/viglet/shio/api/staticfile/ShStaticFileAPI.java. The manipulation of the argument fileName leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CIS
may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318293 - https://vuldb.com/?ctiid.318293 - https://vuldb.com/?submit.617679 - https://github.com/openviglet/shio/issues/1028 - https://github.com/openviglet/shio/issues/1028#issue-3239418750
CVE ID: CVE-2025-8344 State: PUBLISHED Published: 2025-07-31T01:32:05.152Z Last Updated: 2025-07-31T14:33:44.225Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: openviglet Products: shio Problem Types: CWE-434, CWE-284 Description: A vulnerability classified as critical has been found in openviglet shio up to 0.3.8. Affected is the function shStaticFileUpload of the file shio-app/src/main/java/com/viglet/shio/api/staticfile/ShStaticFileAPI.java. The manipulation of the argument filename leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP V
he attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318294 - https://vuldb.com/?ctiid.318294 - https://vuldb.com/?submit.617680 - https://github.com/openviglet/shio/issues/1029 - https://github.com/openviglet/shio/issues/1029#issue-3239422554
CVE ID: CVE-2025-8345 State: PUBLISHED Published: 2025-07-31T02:02:05.576Z Last Updated: 2025-07-31T14:33:38.468Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C) Vendors: Shanghai Lingdang Information Technology Products: Lingdang CRM Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.4.7. Affected by this vulnerability is the function delete_user of the file crm/WeiXinApp/yunzhijia/yunzhijiaApi.php. The manipulation of the argument function leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Up
to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 8.6.5.2 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318295 - https://vuldb.com/?ctiid.318295 - https://vuldb.com/?submit.617844 - https://github.com/jackyliu666/blob01/blob/main/README.md
CVE ID: CVE-2025-8346 State: PUBLISHED Published: 2025-07-31T02:32:05.188Z Last Updated: 2025-08-04T19:26:08.426Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Educar Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.10. Affected by this issue is some unknown functionality of the file /educar_aluno_lst.php. The manipulation of the argument ref_cod_matricula with the input "><img%20src=x%20onerror=alert(%27CVE-Hunters%27)> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The
s site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318296 - https://vuldb.com/?ctiid.318296 - https://vuldb.com/?submit.617706 - https://github.com/CVE-Hunters/CVE/blob/main/i-educar/CVE-2025-8346.md
CVE ID: CVE-2025-8347 State: PUBLISHED Published: 2025-07-31T03:02:05.808Z Last Updated: 2025-07-31T14:33:25.538Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Kehua Products: Charging Pile Cloud Platform Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in Kehua Charging Pile Cloud Platform 1.0. This affects an unknown part of the file /sys/task/findAllTask. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Anal
ic and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318297 - https://vuldb.com/?ctiid.318297 - https://vuldb.com/?submit.617567 - https://github.com/qiantx/cve/blob/main/CVE2.md
CVE ID: CVE-2025-8348 State: PUBLISHED Published: 2025-07-31T03:32:05.773Z Last Updated: 2025-07-31T14:33:19.305Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Kehua Products: Charging Pile Cloud Platform Problem Types: CWE-287 Description: A vulnerability has been found in Kehua Charging Pile Cloud Platform 1.0 and classified as critical. This vulnerability affects unknown code of the file /home. The manipulation leads to improper authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CI
sed. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318298 - https://vuldb.com/?ctiid.318298 - https://vuldb.com/?submit.617568 - https://github.com/qiantx/cve/blob/main/cve3.md
CVE ID: CVE-2025-8349 State: PUBLISHED Published: 2025-10-20T09:56:03.749Z Last Updated: 2025-10-20T18:57:41.235Z Vendors: Tawk Products: Live Chat Problem Types: CWE-79 Description: Cross-site Scripting (XSS) stored vulnerability in Tawk Live Chat. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by uploading a malicious PDF with JavaScript payload through the chatbot. The PDF is stored by the application and subsequently displayed without proper sanitisation when other users access it. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user. Additional Analyst Notes: - CIS
nsitive user data, such as session cookies, or to perform actions on behalf of the user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-xss-stored-tawk-live-chat
CVE ID: CVE-2025-8353 State: PUBLISHED Published: 2025-07-30T16:06:46.196Z Last Updated: 2025-07-30T16:17:38.655Z Vendors: Devolutions Products: Server Problem Types: CWE-446 Description: UI synchronization issue in the Just-in-Time (JIT) access request approval interface in Devolutions Server 2025.2.4.0 and earlier allows a remote authenticated attacker to gain unauthorized access to deleted JIT Groups via stale UI state during standard checkout request processing. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2025-0013/
CVE ID: CVE-2025-8354 State: PUBLISHED Published: 2025-09-23T13:20:03.452Z Last Updated: 2025-10-06T15:18:49.381Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: Revit, Revit LT Problem Types: CWE-843 Description: A maliciously crafted RFA file, when parsed through Autodesk Revit, can force a Type Confusion vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/trust/security-adv
: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0021
CVE ID: CVE-2025-8355 State: PUBLISHED Published: 2025-08-08T15:31:44.554Z Last Updated: 2025-08-08T16:02:42.866Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Xerox Products: FreeFlow Core Problem Types: CWE-611 Description: In Xerox FreeFlow Core version 8.0.4, improper handling of XML input allows injection of external entities. An attacker can craft malicious XML containing references to internal URLs, this results in a Server-Side Request Forgery (SSRF). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitydocs.business.xerox.com/wp-content/uploads/2025/08/Xerox-Security-Bulletin-025-013-for-Freeflow-Core-8.0.5.pdf
CVE ID: CVE-2025-8356 State: PUBLISHED Published: 2025-08-08T15:40:12.588Z Last Updated: 2025-08-19T03:55:28.372Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Xerox Products: FreeFlow Core Problem Types: CWE-22, CWE-94 Description: In Xerox FreeFlow Core version 8.0.4, an attacker can exploit a Path Traversal vulnerability to access unauthorized files on the server. This can lead to Remote Code Execution (RCE), allowing the attacker to run arbitrary commands on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitydocs.business.xerox.com/wp-content/uploads/2025/08/Xerox-Security-Bulletin-025-013-for-Freeflow-Core-8
- https://securitydocs.business.xerox.com/wp-content/uploads/2025/08/Xerox-Security-Bulletin-025-013-for-Freeflow-Core-8.0.5.pdf
CVE ID: CVE-2025-8357 State: PUBLISHED Published: 2025-08-19T04:26:02.471Z Last Updated: 2025-08-19T19:21:48.133Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: dglingren Products: Media Library Assistant Problem Types: CWE-862 Description: The Media Library Assistant plugin for WordPress is vulnerable to arbitrary file deletion in the /wp-content/uploads directory due to insufficient file path validation and user capability checking in the _process_mla_download_file function in all versions up to, and including, 3.27. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files on the server from the /wp
le for authenticated attackers, with Author-level access and above, to delete arbitrary files on the server from the /wp-content/uploads/ directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8726375f-de67-4c92-9cf8-1bfb7330f327?source=cve - https://plugins.trac.wordpress.org/browser/media-library-assistant/tags/3.26/includes/class-mla-main.php#L924 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3336915%40media-library-assistant&new=3336915%40media-library-assistant&sfp_email=&sfph_mail=
CVE ID: CVE-2025-8359 State: PUBLISHED Published: 2025-09-06T02:24:18.546Z Last Updated: 2025-09-08T20:14:53.899Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: scriptsbundle Products: AdForest Problem Types: CWE-288 Description: The AdForest theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 6.0.9. This is due to the plugin not properly verifying a user's identity prior to authenticating them. This makes it possible for unauthenticated attackers to log in as other users, including administrators, without access to a password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfen
tors, without access to a password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c080df50-1113-484b-80ed-09515982c585?source=cve - https://themeforest.net/item/adforest-classified-wordpress-theme/19481695
CVE ID: CVE-2025-8360 State: PUBLISHED Published: 2025-09-06T02:24:16.998Z Last Updated: 2025-09-08T14:05:27.528Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: choijun Products: LA-Studio Element Kit for Elementor Problem Types: CWE-79 Description: The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's widgets in all versions up to, and including, 1.5.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that