Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-31335 State: PUBLISHED Published: 2025-03-28T00:00:00.000Z Last Updated: 2025-03-28T14:31:11.464Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: Shibboleth Products: OpenSAML C++ library Problem Types: CWE-347 Description: The OpenSAML C++ library before 3.3.1 allows forging of signed SAML messages via parameter manipulation (when using SAML bindings that rely on non-XML signatures). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://shibboleth.net/community/advisories/secadv_20250313.txt - https://git.shibboleth.net/view/?p=cpp-opensaml.git;a=commit;h=22a610b322e2178abd03e97cdbc8fb50b45efaee - https://shibboleth.atlassi
shibboleth.net/view/?p=cpp-opensaml.git;a=commit;h=22a610b322e2178abd03e97cdbc8fb50b45efaee - https://shibboleth.atlassian.net/browse/CPPOST-126 - https://lists.debian.org/debian-security-announce/2025/msg00041.html
CVE ID: CVE-2025-31338 State: PUBLISHED Published: 2025-04-17T02:01:45.543Z Last Updated: 2025-04-17T19:14:07.278Z Vendors: SUNNET Technology Co., Ltd. Products: Wisdom Master Pro Problem Types: CWE-862 Description: A missing authorization vulnerability in the retrieve teacher Information function of Wisdom Master Pro versions 5.0 through 5.2 allows remote attackers to obtain partial user data by accessing the API functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://zuso.ai/advisory/za-2025-01
CVE ID: CVE-2025-31339 State: PUBLISHED Published: 2025-04-17T02:00:47.551Z Last Updated: 2025-04-17T19:14:40.416Z Vendors: SUNNET Technology Co., Ltd. Products: Wisdom Master Pro Problem Types: CWE-434 Description: An unrestricted upload of file with dangerous type vulnerability in the course management function of Wisdom Master Pro versions 5.0 through 5.2 allows remote authenticated users to craft a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://zuso.ai/advisory/za-2025-02
CVE ID: CVE-2025-31340 State: PUBLISHED Published: 2025-04-17T01:59:56.772Z Last Updated: 2025-04-17T19:15:25.941Z Vendors: SUNNET Technology Co., Ltd. Products: Wisdom Master Pro Problem Types: CWE-98 Description: A improper control of filename for include/require statement in PHP program vulnerability in the retrieve course Information function of Wisdom Master Pro versions 5.0 through 5.2 allows remote attackers to perform arbitrary system commands by running a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://zuso.ai/advisory/za-2025-03
CVE ID: CVE-2025-31342 State: PUBLISHED Published: 2025-10-20T07:56:46.352Z Last Updated: 2025-10-20T13:41:48.653Z Vendors: Galaxy Software Services Corporation Products: Vitals ESP Problem Types: CWE-434 Description: An unrestricted upload of file with dangerous type vulnerability in the upload file function of Galaxy Software Services Corporation Vitals ESP Forum Module through 1.3 version allows remote authenticated users to execute arbitrary system commands via a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://zuso.ai/advisory
CVE ID: CVE-2025-31343 State: PUBLISHED Published: 2025-04-16T17:37:36.060Z Last Updated: 2025-04-16T18:01:16.379Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Siemens Products: TeleControl Server Basic Problem Types: CWE-89 Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateTcmSettings' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack re
te to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25920) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE ID: CVE-2025-31344 State: PUBLISHED Published: 2025-04-14T07:49:36.597Z Last Updated: 2025-04-14T13:39:00.299Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: openEuler Products: giflib Problem Types: CWE-122 Description: Heap-based Buffer Overflow vulnerability in openEuler giflib on Linux. This vulnerability is associated with program files gif2rgb.C. This issue affects giflib: through 5.2.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1292 - https://gitee.com/src-openeuler/giflib/pulls/54
CVE ID: CVE-2025-31349 State: PUBLISHED Published: 2025-04-16T17:37:37.460Z Last Updated: 2025-04-16T18:00:39.407Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Siemens Products: TeleControl Server Basic Problem Types: CWE-89 Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateSmtpSettings' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack r
ite to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25919) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE ID: CVE-2025-31350 State: PUBLISHED Published: 2025-04-16T17:37:38.885Z Last Updated: 2025-04-16T17:59:54.324Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Siemens Products: TeleControl Server Basic Problem Types: CWE-89 Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateBufferingSettings' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful att
nd write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25918) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE ID: CVE-2025-31351 State: PUBLISHED Published: 2025-04-16T17:37:40.308Z Last Updated: 2025-04-16T17:59:04.245Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Siemens Products: TeleControl Server Basic Problem Types: CWE-89 Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'CreateProject' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requir
o the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25917) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE ID: CVE-2025-31352 State: PUBLISHED Published: 2025-04-16T17:37:41.903Z Last Updated: 2025-04-17T14:21:01.036Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Siemens Products: TeleControl Server Basic Problem Types: CWE-89 Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateGateways' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requi
to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25915) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE ID: CVE-2025-31353 State: PUBLISHED Published: 2025-04-16T17:37:43.360Z Last Updated: 2025-04-17T14:20:55.144Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Siemens Products: TeleControl Server Basic Problem Types: CWE-89 Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateOpcSettings' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack re
te to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25916) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE ID: CVE-2025-31354 State: PUBLISHED Published: 2025-04-11T15:30:24.676Z Last Updated: 2025-04-11T16:13:34.583Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Subnet Solutions Products: PowerSYSTEM Center 2020 Problem Types: CWE-125 Description: Subnet Solutions PowerSYSTEM Center's SMTPS notification service can be affected by importing an EC certificate with crafted F2m parameters, which can lead to excessive CPU consumption during the evaluation of the curve parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-100-08
CVE ID: CVE-2025-31355 State: PUBLISHED Published: 2025-08-20T13:09:10.028Z Last Updated: 2025-11-03T19:53:10.109Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Tenda Products: AC6 V5.0 Problem Types: CWE-494 Description: A firmware update vulnerability exists in the Firmware Signature Validation functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted malicious file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2161
CVE ID: CVE-2025-31357 State: PUBLISHED Published: 2025-04-15T20:21:34.076Z Last Updated: 2025-04-16T15:10:30.625Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Growatt Products: Cloud portal Problem Types: CWE-639 Description: An unauthenticated attacker can obtain a user's plant list by knowing the username. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04
CVE ID: CVE-2025-31359 State: PUBLISHED Published: 2025-06-03T09:43:25.931Z Last Updated: 2025-06-03T13:27:26.786Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Parallels Products: Parallels Desktop for Mac Problem Types: CWE-22 Description: A directory traversal vulnerability exists in the PVMP package unpacking functionality of Parallels Desktop for Mac version 20.2.2 (55879). This vulnerability can be exploited by an attacker to write to arbitrary files, potentially leading to privilege escalation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2160
CVE ID: CVE-2025-31360 State: PUBLISHED Published: 2025-04-15T21:48:21.025Z Last Updated: 2025-04-16T15:07:51.202Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Growatt Products: Cloud portal Problem Types: CWE-639 Description: Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04
CVE ID: CVE-2025-31361 State: PUBLISHED Published: 2025-11-17T22:54:06.711Z Last Updated: 2025-11-19T04:55:27.179Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L) Vendors: Broadcom, Dell Products: BCM5820X, ControlVault3, ControlVault3 Plus Problem Types: CWE-908 Description: A privilege escalation vulnerability exists in the ControlVault WBDI Driver WBIO_USH_ADD_RECORD functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.47. A specially crafted WinBioControlUnit call can lead to privilege escalation. An attacker can issue an api call to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA
attacker can issue an api call to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000326061/dsa-2025-228 - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2174
CVE ID: CVE-2025-31362 State: PUBLISHED Published: 2025-04-11T09:38:43.242Z Last Updated: 2025-04-11T14:36:44.148Z Severity: LOW (CVSS 3.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: OPEN, Inc. Products: BizRobo! Problem Types: CWE-321 Description: Use of hard-coded cryptographic key issue exists in BizRobo! all versions. Credentials inside robot files may be obtained if the encryption key is available. The vendor provides the workaround information and recommends to apply it to the deployment environment. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://knowledge.bizrobo.com/hc/ja/articles/39951710517145 - https://knowledge.bizrobo.com/hc/ja/articles/39952
nces: - https://knowledge.bizrobo.com/hc/ja/articles/39951710517145 - https://knowledge.bizrobo.com/hc/ja/articles/39952052043289 - https://knowledge.bizrobo.com/hc/ja/articles/39953373809305 - https://knowledge.bizrobo.com/hc/ja/articles/360029772271 - https://jvn.jp/en/jp/JVN30641875/
CVE ID: CVE-2025-31363 State: PUBLISHED Published: 2025-04-16T09:14:15.992Z Last Updated: 2025-04-16T14:33:01.674Z Severity: LOW (CVSS 3 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-1426 Description: Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.9 fail to restrict domains the LLM can request to contact upstream which allows an authenticated user to exfiltrate data from an arbitrary server accessible to the victim via performing a prompt injection in the AI plugin's Jira tool. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-31365 State: PUBLISHED Published: 2025-10-14T15:23:43.265Z Last Updated: 2025-10-16T03:56:20.545Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiClientMac Problem Types: CWE-94 Description: An Improper Control of Generation of Code ('Code Injection') vulnerability [CWE-94] in FortiClientMac 7.4.0 through 7.4.3, 7.2.1 through 7.2.8 may allow an unauthenticated attacker to execute arbitrary code on the victim's host via tricking the user into visiting a malicious website. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-25-037
CVE ID: CVE-2025-31366 State: PUBLISHED Published: 2025-10-14T15:22:57.657Z Last Updated: 2025-10-14T17:36:12.336Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiOS, FortiProxy Problem Types: CWE-79 Description: An Improper Neutralization of Input During Web Page Generation vulnerability [CWE-79] in FortiOS 7.6.0 through 7.6.3, 7.4.0 through 7.4.7, 7.2 all versions, 7.0 all versions, 6.4 all versions; FortiProxy 7.6.0 through 7.6.3, 7.4.0 through 7.4.9, 7.2 all versions, 7.0 all versions; FortiSASE 25.3.a may allow an unauthenticated attacker to perform a reflected cross site scripting (XSS) via crafted HTTP requests. A
3.a may allow an unauthenticated attacker to perform a reflected cross site scripting (XSS) via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-542
CVE ID: CVE-2025-31367 State: REJECTED Published: N/A Last Updated: 2025-03-29T03:55:09.413Z Description: No description available.
CVE ID: CVE-2025-31368 State: REJECTED Published: N/A Last Updated: 2025-03-29T03:55:08.848Z Description: No description available.
CVE ID: CVE-2025-31369 State: REJECTED Published: N/A Last Updated: 2025-03-29T03:55:08.155Z Description: No description available.
CVE ID: CVE-2025-31370 State: REJECTED Published: N/A Last Updated: 2025-03-29T03:55:07.572Z Description: No description available.
CVE ID: CVE-2025-31371 State: REJECTED Published: N/A Last Updated: 2025-03-29T03:55:07.030Z Description: No description available.
CVE ID: CVE-2025-31372 State: REJECTED Published: N/A Last Updated: 2025-03-29T03:55:06.470Z Description: No description available.
CVE ID: CVE-2025-31373 State: REJECTED Published: N/A Last Updated: 2025-03-29T03:55:05.872Z Description: No description available.
CVE ID: CVE-2025-31374 State: REJECTED Published: N/A Last Updated: 2025-03-29T03:55:05.097Z Description: No description available.
CVE ID: CVE-2025-31375 State: PUBLISHED Published: 2025-04-09T16:10:09.380Z Last Updated: 2025-04-09T17:49:52.245Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: bhoogterp Products: Scheduled Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in bhoogterp Scheduled allows Stored XSS. This issue affects Scheduled: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/scheduled/vulnerability/wordpress-scheduled-plugin-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-31376 State: PUBLISHED Published: 2025-03-31T09:53:13.959Z Last Updated: 2025-03-31T12:41:58.666Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Mayeenul Islam Products: NanoSupport Problem Types: CWE-862 Description: Missing Authorization vulnerability in Mayeenul Islam NanoSupport allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NanoSupport: from n/a through 0.6.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/nanosupport/vulnerability/wordpress-nanosupport-plugin-0-6-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-31377 State: PUBLISHED Published: 2025-04-09T16:10:08.706Z Last Updated: 2025-04-09T17:50:03.976Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Asaquzzaman mishu Products: Woo Product Feed For Marketing Channels Problem Types: CWE-862 Description: Missing Authorization vulnerability in Asaquzzaman mishu Woo Product Feed For Marketing Channels allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Woo Product Feed For Marketing Channels: from n/a through 1.9.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/woocommerce-to-google-merchant-ce
CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/woocommerce-to-google-merchant-center/vulnerability/wordpress-woo-product-feed-for-marketing-channels-1-9-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-31378 State: PUBLISHED Published: 2025-04-11T08:42:50.304Z Last Updated: 2025-04-11T14:31:20.435Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: danbwb Products: Oppso Unit Converter Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in danbwb Oppso Unit Converter allows Reflected XSS. This issue affects Oppso Unit Converter: from n/a through 1.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/oppso-unit-converter/vulnerability/wordpress-oppso-unit-converter-plugin-1-1-1-reflected-cross-site-s
e/wordpress/plugin/oppso-unit-converter/vulnerability/wordpress-oppso-unit-converter-plugin-1-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-31379 State: PUBLISHED Published: 2025-04-11T08:42:50.580Z Last Updated: 2025-04-11T14:30:53.717Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: programphases Products: Insert HTML Here Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in programphases Insert HTML Here allows Reflected XSS. This issue affects Insert HTML Here: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/insert-html-here/vulnerability/wordpress-insert-html-here-plugin-1-0-reflected-cross-site-scripting-x
e/wordpress/plugin/insert-html-here/vulnerability/wordpress-insert-html-here-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-31380 State: PUBLISHED Published: 2025-04-17T15:47:50.544Z Last Updated: 2025-04-17T18:23:30.902Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: videowhisper Products: Paid Videochat Turnkey Site Problem Types: CWE-640 Description: Weak Password Recovery Mechanism for Forgotten Password vulnerability in videowhisper Paid Videochat Turnkey Site allows Password Recovery Exploitation. This issue affects Paid Videochat Turnkey Site: from n/a through 7.3.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ppv-live-webcams/vulnerability/wordpress-paid-videochat-turnkey-site-7-3-5
ps://patchstack.com/database/wordpress/plugin/ppv-live-webcams/vulnerability/wordpress-paid-videochat-turnkey-site-7-3-5-broken-authentication-vulnerability?_s_id=cve
CVE ID: CVE-2025-31381 State: PUBLISHED Published: 2025-04-04T13:44:44.022Z Last Updated: 2025-04-04T14:31:07.859Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Shiptrack Products: Booking Calendar and Notification Problem Types: CWE-862 Description: Missing Authorization vulnerability in shiptrack Booking Calendar and Notification allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking Calendar and Notification: from n/a through 4.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/booking-calendar-and-notification/vulnerability/wordpress-booking-
s: - https://patchstack.com/database/wordpress/plugin/booking-calendar-and-notification/vulnerability/wordpress-booking-calendar-and-notification-plugin-4-0-3-broken-authentication-vulnerability?_s_id=cve