Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-1307 State: PUBLISHED Published: 2025-03-04T04:26:09.463Z Last Updated: 2025-03-11T16:09:02.539Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: spicethemes Products: Newscrunch Problem Types: CWE-862 Description: The Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the newscrunch_install_and_activate_plugin() function in all versions up to, and including, 1.8.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes:
d arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b55567e9-24e6-4738-b7f7-b95b541e6067?source=cve - https://themes.trac.wordpress.org/browser/newscrunch/1.8.3/functions.php#L486 - https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=261789%40newscrunch&new=261789%40newscrunch&sfp_email=&sfph_mail=
CVE ID: CVE-2025-1308 State: PUBLISHED Published: 2025-05-19T21:18:33.263Z Last Updated: 2025-05-20T14:19:51.463Z Vendors: Pure Storage Products: PX Backup Problem Types: CWE-116 Description: A vulnerability exists in PX Backup whereby sensitive information may be logged under specific conditions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.purestorage.com/Pure_Security
CVE ID: CVE-2025-1309 State: PUBLISHED Published: 2025-03-07T07:22:23.721Z Last Updated: 2025-03-07T15:36:22.038Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: admintwentytwenty Products: UiPress lite | Effortless custom dashboards, admin themes and pages Problem Types: CWE-862 Description: The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the uip_save_form_as_option() function in all versions up to, and including, 3.5.04. This makes it possible for authenticated attackers, with Subscriber-le
ion in all versions up to, and including, 3.5.04. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6754ba34-0dc7-40a5-9548-a5f77db0df53?source=cve - https://plugins.trac.wordpress.org/browser/uipress-lite/tags/3.5.00/admin/core/ajax-functions.php#L625 - https://plugins.trac.wordpress.org/changeset/3
org/browser/uipress-lite/tags/3.5.00/admin/core/ajax-functions.php#L625 - https://plugins.trac.wordpress.org/changeset/3249865/
CVE ID: CVE-2025-1310 State: PUBLISHED Published: 2025-03-26T09:21:40.858Z Last Updated: 2025-03-26T13:50:35.414Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: blueglassch Products: Job Postings Problem Types: CWE-22 Description: The Jobs for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.7.11 via the 'job_postings_get_file' parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.
, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/408312d3-9a9e-4b6b-9991-aee6b77745b2?source=cve - https://plugins.trac.wordpress.org/browser/job-postings/tags/2.7.11/include/class-job-get-uploaded-file.php#L91 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3257145%40job-postings&new=3257145%40job-postings&sfp_email=&sfph_mail=
CVE ID: CVE-2025-1311 State: PUBLISHED Published: 2025-03-22T06:41:12.043Z Last Updated: 2025-03-24T13:18:47.793Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: wclovers Products: WooCommerce Multivendor Marketplace – REST API Problem Types: CWE-89 Description: The WooCommerce Multivendor Marketplace – REST API plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in the update_delivery_status() function in all versions up to, and including, 1.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-le
sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6ff5cda2-edcd-4fa5-9c8e-427a43802ed1?source=cve - https://wordpress.org/plugins/wcfm-marketplace-rest-api/ - https://plugins.trac.wordpress.org/browser/wcfm-marketplace-rest-api/trunk/includes/api/class-api-deliveries-controller.php#L303
CVE ID: CVE-2025-1312 State: PUBLISHED Published: 2025-03-26T11:22:10.695Z Last Updated: 2025-03-26T13:25:23.763Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ultimateblocks Products: Ultimate Blocks – WordPress Blocks Plugin Problem Types: CWE-79 Description: The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buttonTextColor’ parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execut
henticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ac422162-be05-4420-9877-d6d41b83e881?source=cve - https://plugins.trac.wordpress.org/browser/ultimate-blocks/trunk/src/blocks/call-to-action/block.php#L32 - https://plugins.trac.wordpress.org/changeset/3260377/
CVE ID: CVE-2025-1313 State: PUBLISHED Published: 2025-07-12T05:30:11.949Z Last Updated: 2025-07-14T15:49:38.210Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: scriptsbundle Products: Nokri – Job Board WordPress Theme Problem Types: CWE-288 Description: The Nokri - Job Board WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email address. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary user's email addre
it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/507c2abd-47d3-4a28-a9b7-a1ad9b026e7d?source=cve - https://themeforest.net/item/nokri-job-board-wordpress-theme/22677241
CVE ID: CVE-2025-1314 State: PUBLISHED Published: 2025-03-20T05:22:34.298Z Last Updated: 2025-03-20T17:59:19.592Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: smub Products: Custom Twitter Feeds – A Tweets Widget or X Feed Widget Problem Types: CWE-352 Description: The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.5. This is due to missing or incorrect nonce validation on the ctf_clear_cache_admin() function. This makes it possible for unauthenticated attackers to reset the plugin's cache via a forged request granted they can trick a site a
possible for unauthenticated attackers to reset the plugin's cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/28d47605-ecb8-42cc-901a-3cf07b946877?source=cve - https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/trunk/custom-twitter-feed.php#L833 - https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/trunk/custom-twitter-feed.php#L810 - https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/trunk/custom-twitter-feed.php#L1014 - https://wordpress.org/plugins/custom
ac.wordpress.org/browser/custom-twitter-feeds/trunk/custom-twitter-feed.php#L1014 - https://wordpress.org/plugins/custom-twitter-feeds/#developers - https://plugins.trac.wordpress.org/changeset/3254840/
CVE ID: CVE-2025-1315 State: PUBLISHED Published: 2025-03-07T08:21:27.759Z Last Updated: 2025-03-07T15:05:16.471Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: sfwebservice Products: InWave Jobs Problem Types: CWE-288 Description: The InWave Jobs plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 3.5.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account. Additional Analyst Not
ry user's passwords, including administrators, and leverage that to gain access to their account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e49c7b2a-5241-4762-b7c9-c33b1ac4a668?source=cve - https://themeforest.net/item/injob-job-board-wordpress-theme/20322987
CVE ID: CVE-2025-1316 State: PUBLISHED Published: 2025-03-04T23:36:59.724Z Last Updated: 2025-10-21T22:55:25.794Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Edimax Products: IC-7100 IP Camera Problem Types: CWE-78 Description: Edimax IC-7100 does not properly neutralize requests. An attacker can create specially crafted requests to achieve remote code execution on the device Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-08
CVE ID: CVE-2025-1317 State: REJECTED Published: N/A Last Updated: 2025-07-05T22:16:37.582Z Description: No description available.
CVE ID: CVE-2025-1318 State: REJECTED Published: N/A Last Updated: 2025-07-05T22:16:37.438Z Description: No description available.
CVE ID: CVE-2025-1319 State: PUBLISHED Published: 2025-02-28T12:44:05.371Z Last Updated: 2025-02-28T23:06:50.379Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: elemntor Products: Site Mailer – SMTP Replacement, Email API Deliverability & Email Log Problem Types: CWE-79 Description: The Site Mailer – SMTP Replacement, Email API Deliverability & Email Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses a
ible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c9fe3574-f338-474c-af78-f843501d422c?source=cve - https://wordpress.org/plugins/site-mailer/#developers - https://plugins.trac.wordpress.org/changeset/3247059/
CVE ID: CVE-2025-1320 State: PUBLISHED Published: 2025-03-25T07:04:55.211Z Last Updated: 2025-03-31T17:43:17.220Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: winkm89 Products: teachPress Problem Types: CWE-352 Description: The teachPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.0.9. This is due to missing or incorrect nonce validation on the import.php page. This makes it possible for unauthenticated attackers to delete imports via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichme
site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b677ad8b-4f01-4147-bcf6-ae769046be48?source=cve - https://wordpress.org/plugins/teachpress/
CVE ID: CVE-2025-1321 State: PUBLISHED Published: 2025-03-04T03:37:59.795Z Last Updated: 2025-03-04T15:34:36.309Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: winkm89 Products: teachPress Problem Types: CWE-89 Description: The teachPress plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tpsearch' shortcode in all versions up to, and including, 9.0.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queri
ticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cb453fe3-ba89-437c-b3fb-9ec207eaa9f0?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3246754%40teachpress&new=3246754%40teachpress&sfp_email=&sfph_mail=#file6
CVE ID: CVE-2025-1322 State: PUBLISHED Published: 2025-03-08T09:22:54.989Z Last Updated: 2025-03-11T16:07:44.076Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: wppost Products: WP-Recall – Registration, Profile, Commerce & More Problem Types: CWE-200 Description: The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 16.26.10 via the 'feed' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to view data from password protected, private, or draft posts that they should not have access t
authenticated attackers to view data from password protected, private, or draft posts that they should not have access to. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c667be65-e6d3-40e1-aeec-384d309fde3d?source=cve - https://plugins.trac.wordpress.org/changeset/3250094/wp-recall/trunk/add-on/rcl-chat/core.php
CVE ID: CVE-2025-1323 State: PUBLISHED Published: 2025-03-08T09:22:54.624Z Last Updated: 2025-03-11T16:07:50.093Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: wppost Products: WP-Recall – Registration, Profile, Commerce & More Problem Types: CWE-89 Description: The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to SQL Injection via the 'databeat' parameter in all versions up to, and including, 16.26.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already
e existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ae5b4d81-c2f1-4d0d-b7b0-5556bf0451f5?source=cve - https://plugins.trac.wordpress.org/changeset/3250094/wp-recall/trunk/add-on/rcl-chat/core.php
CVE ID: CVE-2025-1324 State: PUBLISHED Published: 2025-03-08T09:22:53.285Z Last Updated: 2025-03-11T16:08:08.226Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wppost Products: WP-Recall – Registration, Profile, Commerce & More Problem Types: CWE-79 Description: The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'public-form' shortcode in all versions up to, and including, 16.26.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a
ied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3e0be093-d61a-4634-ba9b-91dd7328e8cd?source=cve - https://plugins.trac.wordpress.org/changeset/3250094/wp-recall/trunk/add-on/publicpost/shortcodes.php
CVE ID: CVE-2025-1325 State: PUBLISHED Published: 2025-03-08T09:22:54.259Z Last Updated: 2025-03-11T16:07:55.620Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: wppost Products: WP-Recall – Registration, Profile, Commerce & More Problem Types: CWE-862 Description: The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to arbitrary shortcode execution due to a missing capability check on the 'rcl_preview_post' AJAX endpoint in all versions up to, and including, 16.26.10. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes. Additional Analyst Notes: - CI
cated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ad3b9040-05ed-452d-9b3f-26d1a93c62ba?source=cve - https://plugins.trac.wordpress.org/changeset/3250094/wp-recall/trunk/add-on/publicpost/functions-ajax.php
CVE ID: CVE-2025-1326 State: PUBLISHED Published: 2025-05-02T03:21:20.744Z Last Updated: 2025-05-02T16:18:28.821Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Fave Themes Products: Homey Problem Types: CWE-862 Description: The Homey theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the homey_reservation_del() function in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary reservations and posts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/
ions and posts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c0ef3ae7-b3c0-4f54-a95d-9f8cf9497d8f?source=cve - https://themeforest.net/item/homey-booking-wordpress-theme/23338013
CVE ID: CVE-2025-1327 State: PUBLISHED Published: 2025-05-02T03:21:18.862Z Last Updated: 2025-05-02T14:54:05.808Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Fave Themes Products: Homey Problem Types: CWE-639 Description: The Homey theme for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.4 via the 'homey_delete_user_account' action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete other user's accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threa
other user's accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/38aa649c-e9d3-458b-b567-e2e751aaca00?source=cve - https://themeforest.net/item/homey-booking-wordpress-theme/23338013
CVE ID: CVE-2025-1328 State: PUBLISHED Published: 2025-02-20T09:21:40.591Z Last Updated: 2025-02-20T14:21:26.306Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: mrlegend1235 Products: Typed JS: A typewriter style animation Problem Types: CWE-79 Description: The Typed JS: A typewriter style animation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘typespeed’ parameter in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a u
ackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fdb15198-68dc-4612-abcc-6b02843f1629?source=cve - https://wordpress.org/plugins/mrlegend-typedjs/#developers - https://plugins.trac.wordpress.org/browser/mrlegend-typedjs/trunk/public/class-typed-js-public.php#L128
CVE ID: CVE-2025-1329 State: PUBLISHED Published: 2025-05-08T21:53:48.475Z Last Updated: 2025-08-28T14:18:29.768Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: CICS TX Standard, CICS TX Advanced Problem Types: CWE-787 Description: IBM CICS TX Standard 11.1 and IBM CICS TX Advanced 10.1 and 11.1 could allow a local user to execute arbitrary code on the system due to failure to handle DNS return requests by the gethostbyaddr function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7232923 - https://www.ibm.com/support/pages/node/7232924
CVE ID: CVE-2025-1330 State: PUBLISHED Published: 2025-05-08T21:54:42.271Z Last Updated: 2025-08-28T14:19:02.544Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: CICS TX Standard, CICS TX Advanced Problem Types: CWE-787 Description: IBM CICS TX Standard 11.1 and IBM CICS TX Advanced 10.1 and 11.1 could allow a local user to execute arbitrary code on the system due to failure to handle DNS return requests by the gethostbyname function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7232923 - https://www.ibm.com/support/pages/node/7232924
CVE ID: CVE-2025-1331 State: PUBLISHED Published: 2025-05-08T21:55:41.116Z Last Updated: 2025-08-28T14:19:41.668Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: CICS TX Standard, CICS TX Advanced Problem Types: CWE-242 Description: IBM CICS TX Standard 11.1 and IBM CICS TX Advanced 10.1 and 11.1 could allow a local user to execute arbitrary code on the system due to the use of unsafe use of the gets function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7232923 - https://www.ibm.com/support/pages/node/7232924