Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-4145 State: PUBLISHED Published: 2025-05-01T00:00:11.908Z Last Updated: 2025-05-01T15:33:34.471Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Netgear Products: EX6200 Problem Types: CWE-120, CWE-119 Description: A vulnerability, which was classified as critical, has been found in Netgear EX6200 1.0.3.94. This issue affects the function sub_3D0BC. The manipulation of the argument host leads to buffer overflow. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306677 - https://vuldb.com/?ctiid.306677 - htt
alyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306677 - https://vuldb.com/?ctiid.306677 - https://vuldb.com/?submit.560799 - https://github.com/jylsec/vuldb/blob/main/Netgear/netgear_ex6200/Buffer_overflow-sub_3D0BC-gui_region/README.md - https://www.netgear.com/
CVE ID: CVE-2025-4146 State: PUBLISHED Published: 2025-05-01T01:00:06.502Z Last Updated: 2025-05-01T15:33:16.913Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Netgear Products: EX6200 Problem Types: CWE-120, CWE-119 Description: A vulnerability, which was classified as critical, was found in Netgear EX6200 1.0.3.94. Affected is the function sub_41940. The manipulation of the argument host leads to buffer overflow. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306678 - https://vuldb.com/?ctiid.306678 - https:/
t Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306678 - https://vuldb.com/?ctiid.306678 - https://vuldb.com/?submit.560800 - https://github.com/jylsec/vuldb/blob/main/Netgear/netgear_ex6200/Buffer_overflow-sub_41940-smb_host_name/README.md - https://www.netgear.com/
CVE ID: CVE-2025-4147 State: PUBLISHED Published: 2025-05-01T02:00:05.280Z Last Updated: 2025-05-01T13:24:48.364Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Netgear Products: EX6200 Problem Types: CWE-120, CWE-119 Description: A vulnerability has been found in Netgear EX6200 1.0.3.94 and classified as critical. Affected by this vulnerability is the function sub_47F7C. The manipulation of the argument host leads to buffer overflow. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306679 - https://vuldb.com/?ctiid.306679
nal Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306679 - https://vuldb.com/?ctiid.306679 - https://vuldb.com/?submit.560801 - https://github.com/jylsec/vuldb/blob/main/Netgear/netgear_ex6200/Buffer_overflow-sub_47F7C-media_name/README.md - https://www.netgear.com/
CVE ID: CVE-2025-4148 State: PUBLISHED Published: 2025-05-01T03:00:06.131Z Last Updated: 2025-05-01T13:23:35.982Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Netgear Products: EX6200 Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in Netgear EX6200 1.0.3.94 and classified as critical. Affected by this issue is the function sub_503FC. The manipulation of the argument host leads to buffer overflow. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306680 - https://vuldb.com/?ctiid.306680 - https://vu
otes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306680 - https://vuldb.com/?ctiid.306680 - https://vuldb.com/?submit.560802 - https://github.com/jylsec/vuldb/blob/main/Netgear/netgear_ex6200/Buffer_overflow-sub_503FC-gui_region/README.md - https://www.netgear.com/
CVE ID: CVE-2025-4149 State: PUBLISHED Published: 2025-05-01T04:00:07.726Z Last Updated: 2025-05-01T13:20:45.811Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Netgear Products: EX6200 Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in Netgear EX6200 1.0.3.94. It has been classified as critical. This affects the function sub_54014. The manipulation of the argument host leads to buffer overflow. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306681 - https://vuldb.com/?ctiid.306681 - htt
alyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306681 - https://vuldb.com/?ctiid.306681 - https://vuldb.com/?submit.560803 - https://github.com/jylsec/vuldb/blob/main/Netgear/netgear_ex6200/Buffer_overflow-sub_54014-gui_region/README.md - https://www.netgear.com/
CVE ID: CVE-2025-4150 State: PUBLISHED Published: 2025-05-01T04:31:03.865Z Last Updated: 2025-05-01T18:09:31.756Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Netgear Products: EX6200 Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in Netgear EX6200 1.0.3.94. It has been declared as critical. This vulnerability affects the function sub_54340. The manipulation of the argument host leads to buffer overflow. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306682 - https://vuldb.com/?ctiid.306682 - h
Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306682 - https://vuldb.com/?ctiid.306682 - https://vuldb.com/?submit.560804 - https://github.com/jylsec/vuldb/blob/main/Netgear/netgear_ex6200/Buffer_overflow-sub_54340-gui_region/README.md - https://www.netgear.com/
CVE ID: CVE-2025-4151 State: PUBLISHED Published: 2025-05-01T05:31:05.149Z Last Updated: 2025-05-01T18:05:05.238Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Curfew e-Pass Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Curfew e-Pass Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/pass-bwdates-reports-details.php. The manipulation of the argument fromdate leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Anal
he exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306683 - https://vuldb.com/?ctiid.306683 - https://vuldb.com/?submit.560806 - https://github.com/faithhard/cve/issues/1 - https://phpgurukul.com/
CVE ID: CVE-2025-4152 State: PUBLISHED Published: 2025-05-01T06:00:07.380Z Last Updated: 2025-05-01T14:43:26.627Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Online Birth Certificate System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in PHPGurukul Online Birth Certificate System 1.0. Affected is an unknown function of the file /admin/bwdates-reports-details.php. The manipulation of the argument fromdate leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes:
has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306684 - https://vuldb.com/?ctiid.306684 - https://vuldb.com/?submit.560808 - https://github.com/faithhard/cve/issues/2 - https://phpgurukul.com/
CVE ID: CVE-2025-4153 State: PUBLISHED Published: 2025-05-01T06:31:05.593Z Last Updated: 2025-05-01T14:42:21.055Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Park Ticketing Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in PHPGurukul Park Ticketing Management System 2.0. Affected by this vulnerability is an unknown functionality of the file /profile.php. The manipulation of the argument adminname leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vul
en disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306685 - https://vuldb.com/?ctiid.306685 - https://vuldb.com/?submit.560809 - https://github.com/y77-88/myCVE/issues/2 - https://phpgurukul.com/
CVE ID: CVE-2025-4154 State: PUBLISHED Published: 2025-05-01T07:00:08.647Z Last Updated: 2025-05-01T16:07:25.948Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: PHPGurukul Products: Pre-School Enrollment System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in PHPGurukul Pre-School Enrollment System 1.0. Affected by this issue is some unknown functionality of the file /admin/enrollment-details.php. The manipulation of the argument Status leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
he exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306686 - https://vuldb.com/?ctiid.306686 - https://vuldb.com/?submit.560833 - https://github.com/Iandweb/CVE/issues/6 - https://phpgurukul.com/
CVE ID: CVE-2025-4155 State: PUBLISHED Published: 2025-05-01T07:31:05.003Z Last Updated: 2025-05-01T15:59:31.003Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: PHPGurukul Products: Boat Booking System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in PHPGurukul Boat Booking System 1.0. This affects an unknown part of the file /admin/edit-boat.php. The manipulation of the argument bid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306687 - https://vul
may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306687 - https://vuldb.com/?ctiid.306687 - https://vuldb.com/?submit.560853 - https://github.com/Iandweb/CVE/issues/7 - https://phpgurukul.com/
CVE ID: CVE-2025-4156 State: PUBLISHED Published: 2025-05-01T08:00:06.385Z Last Updated: 2025-05-01T15:47:22.756Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: PHPGurukul Products: Boat Booking System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in PHPGurukul Boat Booking System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/change-image.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306688 - https://vul
may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306688 - https://vuldb.com/?ctiid.306688 - https://vuldb.com/?submit.560856 - https://github.com/Iandweb/CVE/issues/8 - https://phpgurukul.com/
CVE ID: CVE-2025-4157 State: PUBLISHED Published: 2025-05-01T08:31:05.331Z Last Updated: 2025-05-01T15:43:38.542Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: PHPGurukul Products: Boat Booking System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Boat Booking System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/booking-details.php. The manipulation of the argument Status leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306689 - https:
and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306689 - https://vuldb.com/?ctiid.306689 - https://vuldb.com/?submit.560863 - https://github.com/Iandweb/CVE/issues/9 - https://phpgurukul.com/
CVE ID: CVE-2025-4158 State: PUBLISHED Published: 2025-05-01T09:00:06.578Z Last Updated: 2025-05-01T15:40:44.868Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PCMan Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in PCMan FTP Server up to 2.0.7. It has been classified as critical. Affected is an unknown function of the component PROMPT Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306690 - https://vuldb.com/?ctiid.306690 - http
lyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306690 - https://vuldb.com/?ctiid.306690 - https://vuldb.com/?submit.561028 - https://fitoxs.com/exploit/exploit-e4d909c290d0fb1ca068ffaddf22cbd0.txt
CVE ID: CVE-2025-4159 State: PUBLISHED Published: 2025-05-01T09:31:03.580Z Last Updated: 2025-05-01T15:27:55.487Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PCMan Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in PCMan FTP Server up to 2.0.7. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component GLOB Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306691 - https://vuldb.com/?ctiid
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306691 - https://vuldb.com/?ctiid.306691 - https://vuldb.com/?submit.561029 - https://fitoxs.com/exploit/exploit-5d41402abc4b2a76b9719d911017c592.txt
CVE ID: CVE-2025-4160 State: PUBLISHED Published: 2025-05-01T10:00:05.338Z Last Updated: 2025-05-01T14:31:37.583Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PCMan Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in PCMan FTP Server up to 2.0.7. It has been rated as critical. Affected by this issue is some unknown functionality of the component LS Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306692 - https://vuldb.com/?ctiid.306692 - h
Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306692 - https://vuldb.com/?ctiid.306692 - https://vuldb.com/?submit.561030 - https://fitoxs.com/exploit/exploit-098f6bcd4621d373cade4e832627b4f6.txt
CVE ID: CVE-2025-4161 State: PUBLISHED Published: 2025-05-01T10:31:03.817Z Last Updated: 2025-05-01T14:12:16.214Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PCMan Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability classified as critical has been found in PCMan FTP Server up to 2.0.7. This affects an unknown part of the component VERBOSE Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306693 - https://vuldb.com/?ctiid.306693 - https://vuld
es: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306693 - https://vuldb.com/?ctiid.306693 - https://vuldb.com/?submit.561033 - https://fitoxs.com/exploit/exploit-45c48cce2e2d7fbdea1afc51c7c6ad26.txt
CVE ID: CVE-2025-4162 State: PUBLISHED Published: 2025-05-01T11:00:07.984Z Last Updated: 2025-05-01T14:00:36.651Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PCMan Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability classified as critical was found in PCMan FTP Server up to 2.0.7. This vulnerability affects unknown code of the component ASCII Command Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306694 - https://vuldb.com/?ctiid.306694 - https://vuldb.com/
CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306694 - https://vuldb.com/?ctiid.306694 - https://vuldb.com/?submit.561034 - https://fitoxs.com/exploit/exploit-03c7c0ace395d80182db07ae2c30f034.txt
CVE ID: CVE-2025-4163 State: PUBLISHED Published: 2025-05-01T11:31:05.375Z Last Updated: 2025-05-01T13:31:46.176Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: PHPGurukul Products: Land Record System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in PHPGurukul Land Record System 1.0. This issue affects some unknown processing of the file /admin/aboutus.php. The manipulation of the argument pagetitle leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: R
public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306695 - https://vuldb.com/?ctiid.306695 - https://vuldb.com/?submit.560883 - https://github.com/Iandweb/CVE/issues/10 - https://phpgurukul.com/
CVE ID: CVE-2025-4164 State: PUBLISHED Published: 2025-05-01T12:00:08.150Z Last Updated: 2025-05-01T13:21:51.451Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Employee Record Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in PHPGurukul Employee Record Management System 1.3. Affected is an unknown function of the file changepassword.php. The manipulation of the argument currentpassword leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
t has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306696 - https://vuldb.com/?ctiid.306696 - https://vuldb.com/?submit.561140 - https://github.com/ideal-valli/myCVE/issues/2 - https://phpgurukul.com/
CVE ID: CVE-2025-4166 State: PUBLISHED Published: 2025-05-02T14:57:58.710Z Last Updated: 2025-05-08T13:01:48.440Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: HashiCorp Products: Vault, Vault Enterprise Problem Types: CWE-209 Description: Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault REST API. This vulnerability, identified as CVE-2025-4166, is fixed in Vault Community 1.19.3 and Vault Enterprise 1.19.3, 1.18.9, 1.17.16, 1.16.20. Additional Analyst Notes: - CISA ADP
d in Vault Community 1.19.3 and Vault Enterprise 1.19.3, 1.18.9, 1.17.16, 1.16.20. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin
CVE ID: CVE-2025-4168 State: PUBLISHED Published: 2025-05-03T01:43:06.141Z Last Updated: 2025-05-05T14:58:09.080Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: codework Products: Subpage List Problem Types: CWE-80 Description: The Subpage List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'subpages' shortcode in all versions up to, and including, 1.3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an inje
utor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/aca48ddf-4256-4a55-bff5-1718110147dd?source=cve - https://plugins.trac.wordpress.org/browser/subpage-view/trunk/inc/class-subpage-list-shortcode.php#L25
CVE ID: CVE-2025-4169 State: PUBLISHED Published: 2025-05-16T02:21:42.706Z Last Updated: 2025-05-16T15:44:47.776Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: urkekg Products: Posts per Cat Problem Types: CWE-79 Description: The Posts per Cat [Unmaintained plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ppc' shortcode in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesse
h contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7eb60874-85c1-40a9-b19d-131c2c2d49ba?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3292123%40posts-per-cat&new=3292123%40posts-per-cat&sfp_email=&sfph_mail=
CVE ID: CVE-2025-4170 State: PUBLISHED Published: 2025-05-03T01:43:05.396Z Last Updated: 2025-05-05T14:58:28.298Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: xavinnydek Products: Xavin&#039;s Review Ratings Problem Types: CWE-79 Description: The Xavin&#039;s Review Ratings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xrr' shortcode in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whene
ted attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6c057a98-4a8d-408a-b6a4-3c322bfa0cdf?source=cve - https://plugins.trac.wordpress.org/browser/xavins-review-ratings/trunk/xavins-review-ratings.php#L293