Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-31494 State: PUBLISHED Published: 2025-04-14T23:21:10.070Z Last Updated: 2025-04-15T02:57:00.227Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: Significant-Gravitas Products: AutoGPT Problem Types: CWE-200, CWE-284 Description: AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. The AutoGPT Platform's WebSocket API transmitted node execution updates to subscribers based on the graph_id+graph_version. Additionally, there was no check prohibiting users from subscribing with another user's graph_id+graph_version. As a result, node execution updates from
prohibiting users from subscribing with another user's graph_id+graph_version. As a result, node execution updates from one user's graph execution could be received by another user within the same instance. This vulnerability does not occur between different instances or between users and non-users of the platform. Single-user instances are not affected. In private instances with a user white-list, the impact is limited by the fact that all potential unintended recipients of these node execution updates must have been admitted by the administrator. This vulnerability is fixed in 0.6.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Significant-Gravitas/Au
ed in 0.6.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-958f-37vw-jx8f - https://github.com/Significant-Gravitas/AutoGPT/pull/9660 - https://github.com/Significant-Gravitas/AutoGPT/releases/tag/autogpt-platform-beta-v0.6.1
CVE ID: CVE-2025-31496 State: PUBLISHED Published: 2025-04-07T20:34:46.624Z Last Updated: 2025-04-08T16:00:33.160Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: apollographql Products: apollo-rs Problem Types: CWE-770 Description: apollo-compiler is a query-based compiler for the GraphQL query language. Prior to 1.27.0, a vulnerability in Apollo Compiler allowed queries with deeply nested and reused named fragments to be prohibitively expensive to validate. Named fragments were being processed once per fragment spread in some cases during query validation, leading to exponential resource usage when deeply nested and reused fragments were involved. This could
uery validation, leading to exponential resource usage when deeply nested and reused fragments were involved. This could lead to excessive resource consumption and denial of service in applications. This vulnerability is fixed in 1.27.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/apollographql/apollo-rs/security/advisories/GHSA-7mpv-9xg6-5r79 - https://github.com/apollographql/apollo-rs/pull/952
CVE ID: CVE-2025-31497 State: PUBLISHED Published: 2025-04-15T20:00:17.738Z Last Updated: 2025-04-15T20:26:07.727Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: TEIC Products: TEIGarage Problem Types: CWE-611 Description: TEIGarage is a webservice and RESTful service to transform, convert and validate various formats, focussing on the TEI format. The Document Conversion Service contains a critical XML External Entity (XXE) Injection vulnerability in its document conversion functionality. The service processes XML files during the conversion process but fails to disable external entity processing, allowing an attacker to read arbitrary files from the server's
process but fails to disable external entity processing, allowing an attacker to read arbitrary files from the server's filesystem. This vulnerability could allow attackers to read sensitive files from the server's filesystem, potentially exposing configuration files, credentials, or other confidential information. Additionally, depending on the server configuration, this could potentially be used to perform server-side request forgery (SSRF) attacks by making the server connect to internal services. This issue is patched in version 1.2.4. A workaround for this vulnerability includes disabling external entity processing in the XML parser by setting the appropriate security features (e.g., X
ty includes disabling external entity processing in the XML parser by setting the appropriate security features (e.g., XMLConstants.FEATURE_SECURE_PROCESSING). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TEIC/TEIGarage/security/advisories/GHSA-w2hq-3cjc-2x55
CVE ID: CVE-2025-31498 State: PUBLISHED Published: 2025-04-08T13:53:11.232Z Last Updated: 2025-04-08T18:40:36.081Z Vendors: c-ares Products: c-ares Problem Types: CWE-416 Description: c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or possibly on TCP queries if the remote closed the connection immediately after a response. If there was an issue trying to put that new transaction on the wire, it would close the connection handle, but read_answers() was still expecting the connection handl
ansaction on the wire, it would close the connection handle, but read_answers() was still expecting the connection handle to be available to possibly dequeue other responses. In theory a remote attacker might be able to trigger this by flooding the target with ICMP UNREACHABLE packets if they also control the upstream nameserver and can return a result with one of those conditions, this has been untested. Otherwise only a local attacker might be able to change system behavior to make send()/write() return a failure condition. This vulnerability is fixed in 1.34.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/c-ares/c-ares/securi
l Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/c-ares/c-ares/security/advisories/GHSA-6hxc-62jh-p29v - https://github.com/c-ares/c-ares/pull/821 - https://github.com/c-ares/c-ares/commit/29d38719112639d8c0ba910254a3dd4f482ea2d1
CVE ID: CVE-2025-31499 State: PUBLISHED Published: 2025-04-15T20:36:24.078Z Last Updated: 2025-04-16T14:43:50.406Z Vendors: jellyfin Products: jellyfin Problem Types: CWE-88 Description: Jellyfin is an open source self hosted media server. Versions before 10.10.7 are vulnerable to argument injection in FFmpeg. This can be leveraged to possibly achieve remote code execution by anyone with credentials to a low-privileged user. This vulnerability was previously reported in CVE-2023-49096 and patched in version 10.8.13, but the patch can be bypassed. The original fix sanitizes some parameters to make injection impossible, but certain unsanitized parameters can still be used for argument injectio
some parameters to make injection impossible, but certain unsanitized parameters can still be used for argument injection. The same unauthenticated endpoints are vulnerable: /Videos/<itemId>/stream and /Videos/<itemId>/stream.<container>, likely alongside similar endpoints in AudioController. This argument injection can be exploited to achieve arbitrary file write, leading to possible remote code execution through the plugin system. While the unauthenticated endpoints are vulnerable, a valid itemId is required for exploitation and any authenticated attacker could easily retrieve a valid itemId to make the exploit work. This vulnerability is patched in version 10.10.7. Additional Analyst Note
rieve a valid itemId to make the exploit work. This vulnerability is patched in version 10.10.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/jellyfin/jellyfin/security/advisories/GHSA-2c3c-r7gp-q32m - https://github.com/jellyfin/jellyfin/commit/79f3ce53257c5291887cd52d8ac735b5252c9a97
CVE ID: CVE-2025-31500 State: PUBLISHED Published: 2025-05-28T00:00:00.000Z Last Updated: 2025-05-28T17:59:47.499Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: bestpractical Products: RT Problem Types: CWE-79 Description: Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an Asset name. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.bestpractical.com/release-notes/rt/index.html - https://docs.bestpractical.com/release-notes/rt/5.0.8
CVE ID: CVE-2025-31501 State: PUBLISHED Published: 2025-05-28T00:00:00.000Z Last Updated: 2025-05-28T17:59:29.685Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: bestpractical Products: RT Problem Types: CWE-79 Description: Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an RT permalink. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.bestpractical.com/release-notes/rt/index.html - https://docs.bestpractical.com/release-notes/rt/5.0.8
CVE ID: CVE-2025-31511 State: PUBLISHED Published: 2025-07-22T00:00:00.000Z Last Updated: 2025-08-18T14:39:05.151Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in AlertEnterprise Guardian 4.1.14.2.2.1. One can bypass manager approval by changing the user ID in a Request%20Building%20Access requestSubmit API call. The vendor has stated that the system is protected by updating to a version equal to or greater than one of the following build numbers: 4.1.12.2.1.19, 4.1.12.5.2.36, 4.1.13.0.60, 4.1.13.2.0.3.39, 4.1.13.2.0.3.41, 4.1.13.2.42, 4.1.13.2.25.44, 4.1.14.0.13, 4.1.14.0.43, 4.1.14.0.48, and 4.1.14.1.5.32. Additional Analyst Notes: - CISA ADP Vulnrichm
4.1.13.2.25.44, 4.1.14.0.13, 4.1.14.0.43, 4.1.14.0.48, and 4.1.14.1.5.32. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://alertenterprise.com/switch-to-guardian/ - https://x.com/pand0rausa/status/1947477020809826359 - https://alertenterprise.screenstepslive.com/a/1969949-alertenterprise-security-advisory-july-2025
CVE ID: CVE-2025-31512 State: PUBLISHED Published: 2025-07-22T00:00:00.000Z Last Updated: 2025-08-18T14:40:20.248Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in AlertEnterprise Guardian 4.1.14.2.2.1. One can bypass manager approval via isAddedByApprover in a Request%20Building%20Access requestSubmit API call. The vendor has stated that the system is protected by updating to a version equal to or greater than one of the following build numbers: 4.1.12.2.1.19, 4.1.12.5.2.36, 4.1.13.0.60, 4.1.13.2.0.3.39, 4.1.13.2.0.3.41, 4.1.13.2.42, 4.1.13.2.25.44, 4.1.14.0.13, 4.1.14.0.43, 4.1.14.0.48, and 4.1.14.1.5.32. Additional Analyst Notes: - CISA ADP Vulnrichmen
1.13.2.25.44, 4.1.14.0.13, 4.1.14.0.43, 4.1.14.0.48, and 4.1.14.1.5.32. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://alertenterprise.com/switch-to-guardian/ - https://x.com/pand0rausa/status/1947477020809826359 - https://alertenterprise.screenstepslive.com/a/1969949-alertenterprise-security-advisory-july-2025
CVE ID: CVE-2025-31513 State: PUBLISHED Published: 2025-07-22T00:00:00.000Z Last Updated: 2025-08-18T14:41:23.735Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in AlertEnterprise Guardian 4.1.14.2.2.1. One can elevate to administrator privileges via the IsAdminApprover parameter in a Request%20Building%20Access requestSubmit API call. The vendor has stated that the system is protected by updating to a version equal to or greater than one of the following build numbers: 4.1.12.2.1.19, 4.1.12.5.2.36, 4.1.13.0.60, 4.1.13.2.0.3.39, 4.1.13.2.0.3.41, 4.1.13.2.42, 4.1.13.2.25.44, 4.1.14.0.13, 4.1.14.0.43, 4.1.14.0.48, and 4.1.14.1.5.32. Additional Analyst Notes
.0.3.41, 4.1.13.2.42, 4.1.13.2.25.44, 4.1.14.0.13, 4.1.14.0.43, 4.1.14.0.48, and 4.1.14.1.5.32. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://alertenterprise.com/switch-to-guardian/ - https://x.com/pand0rausa/status/1947477020809826359 - https://alertenterprise.screenstepslive.com/a/1969949-alertenterprise-security-advisory-july-2025
CVE ID: CVE-2025-31514 State: PUBLISHED Published: 2025-10-14T15:23:52.883Z Last Updated: 2025-10-14T17:35:41.081Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiProxy, FortiOS Problem Types: CWE-532 Description: An Insertion of Sensitive Information into Log File vulnerability [CWE-532] in FortiOS 7.6.0 through 7.6.3, 7.4 all versions, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow an attacker with at least read-only privileges to retrieve sensitive 2FA-related information via observing logs or via diagnose command. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortine
ogs or via diagnose command. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-452
CVE ID: CVE-2025-31515 State: REJECTED Published: N/A Last Updated: 2025-04-01T02:55:08.536Z Description: No description available.
CVE ID: CVE-2025-31516 State: REJECTED Published: N/A Last Updated: 2025-04-01T02:55:08.080Z Description: No description available.
CVE ID: CVE-2025-31517 State: REJECTED Published: N/A Last Updated: 2025-04-01T02:55:07.618Z Description: No description available.
CVE ID: CVE-2025-31518 State: REJECTED Published: N/A Last Updated: 2025-04-01T02:55:07.093Z Description: No description available.
CVE ID: CVE-2025-31519 State: REJECTED Published: N/A Last Updated: 2025-04-01T02:55:06.480Z Description: No description available.
CVE ID: CVE-2025-31520 State: REJECTED Published: N/A Last Updated: 2025-04-01T02:55:06.002Z Description: No description available.
CVE ID: CVE-2025-31521 State: REJECTED Published: N/A Last Updated: 2025-04-01T02:55:05.552Z Description: No description available.
CVE ID: CVE-2025-31522 State: REJECTED Published: N/A Last Updated: 2025-04-01T02:55:05.087Z Description: No description available.
CVE ID: CVE-2025-31523 State: REJECTED Published: N/A Last Updated: 2025-04-01T02:55:04.608Z Description: No description available.
CVE ID: CVE-2025-31524 State: PUBLISHED Published: 2025-04-10T08:09:41.061Z Last Updated: 2025-04-10T13:15:46.197Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: NotFound Products: WP User Profiles Problem Types: CWE-266 Description: Incorrect Privilege Assignment vulnerability in NotFound WP User Profiles allows Privilege Escalation. This issue affects WP User Profiles: from n/a through 2.6.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-users-profiles/vulnerability/wordpress-wp-user-profiles-plugin-2-6-2-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2025-31525 State: PUBLISHED Published: 2025-04-01T20:58:11.191Z Last Updated: 2025-04-02T13:41:48.594Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: WP Messiah Products: WP Mobile Bottom Menu Problem Types: CWE-862 Description: Missing Authorization vulnerability in WP Messiah WP Mobile Bottom Menu allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Mobile Bottom Menu: from n/a through 1.2.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/mobile-bottom-menu-for-wp/vulnerability/wordpress-wp-mobile-bottom-menu-plugin-1-2-9-broken-access-
ase/wordpress/plugin/mobile-bottom-menu-for-wp/vulnerability/wordpress-wp-mobile-bottom-menu-plugin-1-2-9-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-31526 State: PUBLISHED Published: 2025-03-31T12:55:06.216Z Last Updated: 2025-03-31T16:05:52.718Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: eleopard Products: Behance Portfolio Manager Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in eleopard Behance Portfolio Manager allows SQL Injection. This issue affects Behance Portfolio Manager: from n/a through 1.7.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/portfolio-manager-powered-by-behance/vulnerability/wordpress-behance-portfolio-man
chstack.com/database/wordpress/plugin/portfolio-manager-powered-by-behance/vulnerability/wordpress-behance-portfolio-manager-plugin-1-7-4-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-31527 State: PUBLISHED Published: 2025-03-31T12:55:06.768Z Last Updated: 2025-04-01T14:35:56.451Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Kishan Products: WP Link Preview Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in Kishan WP Link Preview allows Server Side Request Forgery. This issue affects WP Link Preview: from n/a through 1.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-link-preview/vulnerability/wordpress-wp-link-preview-plugin-1-4-1-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-31528 State: PUBLISHED Published: 2025-03-31T12:55:07.320Z Last Updated: 2025-03-31T15:50:03.699Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: wokamoto Products: StaticPress Problem Types: CWE-862 Description: Missing Authorization vulnerability in wokamoto StaticPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects StaticPress: from n/a through 0.4.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/staticpress/vulnerability/wordpress-staticpress-plugin-0-4-5-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-31529 State: PUBLISHED Published: 2025-03-31T12:55:07.854Z Last Updated: 2025-03-31T15:48:56.159Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Rashid Products: Slider Path for Elementor Problem Types: CWE-862 Description: Missing Authorization vulnerability in Rashid Slider Path for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Slider Path for Elementor: from n/a through 3.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/slider-path/vulnerability/wordpress-slider-path-for-elementor-plugin-3-0-0-broken-access-contro
atabase/wordpress/plugin/slider-path/vulnerability/wordpress-slider-path-for-elementor-plugin-3-0-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-31530 State: PUBLISHED Published: 2025-03-31T12:55:08.439Z Last Updated: 2025-03-31T15:44:58.275Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: smackcoders Products: Google SEO Pressor Snippet Problem Types: CWE-862 Description: Missing Authorization vulnerability in smackcoders Google SEO Pressor Snippet allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Google SEO Pressor Snippet: from n/a through 2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/google-seo-author-snippets/vulnerability/wordpress-google-seo-pressor-snippet-plugin
stack.com/database/wordpress/plugin/google-seo-author-snippets/vulnerability/wordpress-google-seo-pressor-snippet-plugin-2-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-31531 State: PUBLISHED Published: 2025-04-01T20:58:11.354Z Last Updated: 2025-04-02T13:41:24.391Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: click5 Products: History Log by click5 Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in click5 History Log by click5 allows SQL Injection. This issue affects History Log by click5: from n/a through 1.0.13. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/history-log-by-click5/vulnerability/wordpress-history-log-by-click5-plugin-1-0-13-sql-injecti
/database/wordpress/plugin/history-log-by-click5/vulnerability/wordpress-history-log-by-click5-plugin-1-0-13-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-31532 State: PUBLISHED Published: 2025-03-31T12:55:08.968Z Last Updated: 2025-03-31T15:33:08.683Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Team AtomChat Products: AtomChat Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Team AtomChat AtomChat allows Stored XSS. This issue affects AtomChat: from n/a through 1.1.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/atomchat/vulnerability/wordpress-atomchat-plugin-1-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-31533 State: PUBLISHED Published: 2025-03-31T12:55:09.488Z Last Updated: 2025-04-01T14:35:43.197Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Salesmate.io Products: Salesmate Add-On for Gravity Forms Problem Types: CWE-862 Description: Missing Authorization vulnerability in Salesmate.io Salesmate Add-On for Gravity Forms allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Salesmate Add-On for Gravity Forms: from n/a through 2.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/gf-salesmate-add-on/vulnerability/wordpress-salesmate-add-on-for
ces: - https://patchstack.com/database/wordpress/plugin/gf-salesmate-add-on/vulnerability/wordpress-salesmate-add-on-for-gravity-forms-plugin-2-0-3-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-31534 State: PUBLISHED Published: 2025-04-01T20:58:11.644Z Last Updated: 2025-04-02T13:40:43.316Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: shopperdotcom Products: Shopper Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shopperdotcom Shopper allows SQL Injection. This issue affects Shopper: from n/a through 3.2.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/shopper/vulnerability/wordpress-shopper-plugin-3-2-5-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-31535 State: PUBLISHED Published: 2025-03-31T12:55:10.041Z Last Updated: 2025-04-01T14:35:27.640Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: PressTigers Products: Simple Owl Carousel Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PressTigers Simple Owl Carousel allows DOM-Based XSS. This issue affects Simple Owl Carousel: from n/a through 1.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/simple-owl-carousel/vulnerability/wordpress-simple-owl-carousel-plugin-1-1-1-cross-site-scri
m/database/wordpress/plugin/simple-owl-carousel/vulnerability/wordpress-simple-owl-carousel-plugin-1-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-31536 State: PUBLISHED Published: 2025-04-03T13:27:10.409Z Last Updated: 2025-04-03T15:08:01.210Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: moshensky Products: CF7 Spreadsheets Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in moshensky CF7 Spreadsheets allows Reflected XSS. This issue affects CF7 Spreadsheets: from n/a through 2.3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/cf7-spreadsheets/vulnerability/wordpress-cf7-spreadsheets-plugin-2-3-2-reflected-cross-site-scripting-xss-v