Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-11138 State: PUBLISHED Published: 2025-09-29T03:02:06.068Z Last Updated: 2025-09-29T12:14:36.956Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: mirweiye Products: wenkucms Problem Types: CWE-78, CWE-77 Description: A vulnerability was found in mirweiye wenkucms up to 3.4. This impacts the function createPathOne of the file app/common/common.php. The manipulation results in os command injection. The attack may be launched remotely. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.326215 - https://vuldb.com/?ctiid.326215 - https://vuldb.com/?submit.657055
chment: References: - https://vuldb.com/?id.326215 - https://vuldb.com/?ctiid.326215 - https://vuldb.com/?submit.657055 - https://github.com/electroN1chahaha/wenkucms-RCE/issues/1
CVE ID: CVE-2025-11139 State: PUBLISHED Published: 2025-09-29T03:32:06.460Z Last Updated: 2025-09-29T11:49:30.691Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Bjskzy Products: Zhiyou ERP Problem Types: CWE-22 Description: A vulnerability was determined in Bjskzy Zhiyou ERP up to 11.0. Affected is the function uploadStudioFile of the component com.artery.form.services.FormStudioUpdater. This manipulation of the argument filepath causes path traversal. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analys
may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.326216 - https://vuldb.com/?ctiid.326216 - https://vuldb.com/?submit.658077 - https://github.com/FightingLzn9/vul/blob/main/%E6%97%B6%E7%A9%BA%E6%99%BA%E5%8F%8Berp-2.md
CVE ID: CVE-2025-11140 State: PUBLISHED Published: 2025-09-29T04:02:05.086Z Last Updated: 2025-09-29T11:48:35.140Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Bjskzy Products: Zhiyou ERP Problem Types: CWE-611, CWE-610 Description: A vulnerability was identified in Bjskzy Zhiyou ERP up to 11.0. Affected by this vulnerability is the function openForm of the component com.artery.richclient.RichClientService. Such manipulation of the argument contentString leads to xml external entity reference. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in a
t is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.326217 - https://vuldb.com/?ctiid.326217 - https://vuldb.com/?submit.658090 - https://github.com/FightingLzn9/vul/blob/main/%E6%97%B6%E7%A9%BA%E6%99%BA%E5%8F%8Berp-3.md
CVE ID: CVE-2025-11141 State: PUBLISHED Published: 2025-09-29T04:32:05.924Z Last Updated: 2025-09-29T11:46:53.555Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Ruijie Products: NBR2100G-E Problem Types: CWE-78, CWE-77 Description: A security flaw has been discovered in Ruijie NBR2100G-E up to 20250919. Affected by this issue is the function listAction of the file /itbox_pi/branch_passw.php?a=list. Performing manipulation of the argument city results in os command injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited. Other parameters might be affected as well. The vendor was contacted e
been released to the public and may be exploited. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.326218 - https://vuldb.com/?ctiid.326218 - https://vuldb.com/?submit.658695 - https://github.com/DavCloudz/cve/issues/2
CVE ID: CVE-2025-11145 State: PUBLISHED Published: 2025-10-24T14:25:37.498Z Last Updated: 2025-10-28T14:05:07.301Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: CBK Soft Software Hardware Electronic Computer Systems Industry and Trade Inc. Products: enVision Problem Types: CWE-203, CWE-200, CWE-359 Description: Observable Discrepancy, Exposure of Sensitive Information to an Unauthorized Actor, Exposure of Private Personal Information to an Unauthorized Actor vulnerability in CBK Soft Software Hardware Electronic Computer Systems Industry and Trade Inc. EnVision allows Account Footprinting.This issue affects enVision: before 250566. Additional Analyst Notes:
d Trade Inc. EnVision allows Account Footprinting.This issue affects enVision: before 250566. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0361
CVE ID: CVE-2025-11146 State: PUBLISHED Published: 2025-09-29T09:26:35.157Z Last Updated: 2025-09-29T11:18:24.650Z Vendors: Apt-Cacher-NG Products: Apt-Cacher-NG Problem Types: CWE-79 Description: Reflected Cross-site scripting (XSS) in Apt-Cacher-NG v3.2.1. The vulnerability allows an attacker to execute malicious scripts (XSS) in the web management application. The vulnerability is caused by improper handling of GET inputs included in the URL in “/acng-report.html”. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-apt-cacher-ng
CVE ID: CVE-2025-11147 State: PUBLISHED Published: 2025-09-29T09:26:48.244Z Last Updated: 2025-09-29T11:11:50.085Z Vendors: Apt-Cacher-NG Products: Apt-Cacher-NG Problem Types: CWE-79 Description: Reflected cross-site scripting (XSS) in Apt-Cacher-NG v3.2.1. The vulnerability allows malicious scripts (XSS) to be executed in “/html/<filename>.html”. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-apt-cacher-ng
CVE ID: CVE-2025-11148 State: PUBLISHED Published: 2025-09-30T05:00:06.332Z Last Updated: 2025-09-30T19:06:21.373Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: check-branches Problem Types: CWE-78 Description: All versions of the package check-branches are vulnerable to Command Injection check-branches is a command-line tool that is interacted with locally, or via CI, to confirm no conflicts exist in git branches. However, the library follows these conventions which can be abused: 1. It trusts branch names as they are (plain text) 2. It spawns git commands by concatenating user input Since a branch name is potentially a user input - as use
ain text) 2. It spawns git commands by concatenating user input Since a branch name is potentially a user input - as users can create branches remotely via pull requests, or simply due to privileged access to a repository - it can effectively be abused to run any command. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-CHECKBRANCHES-2766494 - https://gist.github.com/lirantal/054b4ad039a86c418f2c84e3e884d6ec
CVE ID: CVE-2025-11149 State: PUBLISHED Published: 2025-09-30T05:00:07.700Z Last Updated: 2025-09-30T19:07:09.035Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:R) Vendors: n/a Products: node-static, @nubosoftware/node-static Problem Types: CWE-400 Description: This affects all versions of the package node-static; all versions of the package @nubosoftware/node-static. The package fails to catch an exception when user input includes null bytes. This allows attackers to access http://host/%00 and crash the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-NODESTATIC-1297183 - https://security.snyk.
- CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-NODESTATIC-1297183 - https://security.snyk.io/vuln/SNYK-JS-NUBOSOFTWARENODESTATIC-3330728 - https://github.com/cloudhead/node-static/commit/78879dc665f0f7137063794b6e0b6203a81c7f67
CVE ID: CVE-2025-11150 State: REJECTED Published: 2025-09-29T10:52:37.779Z Last Updated: 2025-09-29T18:19:26.384Z Description: No description available.
CVE ID: CVE-2025-11151 State: PUBLISHED Published: 2025-10-21T13:15:39.524Z Last Updated: 2025-10-21T14:08:10.192Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Beyaz Bilgisayar Software Design Industry and Trade Ltd. Co. Products: CityPLus Problem Types: CWE-200, CWE-497 Description: Exposure of Sensitive Information to an Unauthorized Actor, Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Beyaz Bilgisayar Software Design Industry and Trade Ltd. Co. CityPLus allows Detect Unpublicized Web Pages.This issue affects CityPLus: before V24.29500.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https
his issue affects CityPLus: before V24.29500.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0351
CVE ID: CVE-2025-11152 State: PUBLISHED Published: 2025-09-30T12:49:05.895Z Last Updated: 2025-10-30T16:11:58.908Z Vendors: Mozilla Products: Firefox Description: Sandbox escape due to integer overflow in the Graphics: Canvas2D component. This vulnerability affects Firefox < 143.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1987246 - https://www.mozilla.org/security/advisories/mfsa2025-80/
CVE ID: CVE-2025-11153 State: PUBLISHED Published: 2025-09-30T12:49:06.524Z Last Updated: 2025-10-30T16:12:03.540Z Vendors: Mozilla Products: Firefox Description: JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 143.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1987481 - https://www.mozilla.org/security/advisories/mfsa2025-80/
CVE ID: CVE-2025-11154 State: PUBLISHED Published: 2025-10-27T06:00:01.632Z Last Updated: 2025-10-27T15:11:51.813Z Vendors: Unknown Products: IDonate Problem Types: CWE-862 Missing Authorization, CWE-352 Cross-Site Request Forgery (CSRF) Description: The IDonate WordPress plugin before 2.1.13 does not have authorisation and CSRF when deleting users via an action handler, allowing unauthenticated attackers to delete arbitrary users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/fdb9e076-4c65-4fd1-b1f6-23c23a11bdb7/
CVE ID: CVE-2025-11155 State: PUBLISHED Published: 2025-09-29T15:14:39.779Z Last Updated: 2025-11-03T12:02:51.688Z Vendors: SATO Products: S86-ex 203dpi Problem Types: CWE-261 Description: The credentials required to access the device's web server are sent in base64 within the HTTP headers. Since base64 is not considered a strong cipher, an attacker could intercept the web request handling the login and obtain the credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.s21sec.com/cvelist/
CVE ID: CVE-2025-11160 State: PUBLISHED Published: 2025-10-15T06:43:56.953Z Last Updated: 2025-10-15T15:27:46.878Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpbakery Products: WPBakery Page Builder Problem Types: CWE-80 Description: The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS module in all versions up to, and including, 8.6.1. This is due to insufficient input sanitization and output escaping of user-supplied JavaScript code in the Custom JS module. This makes it possible for authenticated attackers with contributor-level access or higher to inject arbitrary web scripts in pages that wil
le for authenticated attackers with contributor-level access or higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page via the WPBakery Page Builder Custom JS module granted they have access to the WPBakery editor for post types. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4c42cc4e-34e7-4f14-b850-7ba5dd2ae099?source=cve - https://kb.wpbakery.com/docs/preface/release-notes/
CVE ID: CVE-2025-11161 State: PUBLISHED Published: 2025-10-15T06:43:56.365Z Last Updated: 2025-10-15T16:13:10.184Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpbakery Products: WPBakery Page Builder Problem Types: CWE-80 Description: The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the vc_custom_heading shortcode in all versions up to, and including, 8.6.1. This is due to insufficient restriction of allowed HTML tags and improper sanitization of user-supplied attributes in the font_container parameter. This makes it possible for authenticated attackers with contributor-level access or higher to inject arbit
er parameter. This makes it possible for authenticated attackers with contributor-level access or higher to inject arbitrary web scripts in posts that will execute whenever a user accesses an injected page via the vc_custom_heading shortcode with malicious tag and text attributes granted they have access to use WPBakery shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2772cade-c625-437a-b57b-ce8a2e3393bf?source=cve - http://kb.wpbakery.com/docs/preface/release-notes/
CVE ID: CVE-2025-11162 State: PUBLISHED Published: 2025-11-05T04:36:58.130Z Last Updated: 2025-11-05T18:47:49.874Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: brainstormforce Products: Spectra Gutenberg Blocks – Website Builder for the Block Editor Problem Types: CWE-79 Description: The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom CSS in all versions up to, and including, 2.19.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web sc
This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2f077817-704f-4595-bfb1-80234dd23f8d?source=cve - https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/tags/2.19.14/classes/class-uagb-loader.php#L522 - https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/tags/2.19.14/classes/class-uagb-post-assets.php#L1418
CVE ID: CVE-2025-11163 State: PUBLISHED Published: 2025-09-30T05:28:53.152Z Last Updated: 2025-09-30T15:41:18.658Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: wpmudev Products: SmartCrawl SEO checker, analyzer & optimizer Problem Types: CWE-284 Description: The SmartCrawl SEO checker, analyzer & optimizer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_submodule() function in all versions up to, and including, 3.14.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's setttings. Additional Analyst Notes: - CISA ADP Vulnr
rs, with Subscriber-level access and above, to update the plugin's setttings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8a63a9b3-c056-45f3-952c-9aee997d1d27?source=cve - https://plugins.trac.wordpress.org/browser/smartcrawl-seo/tags/3.14.2/includes/core/controllers/class-submodule-controller.php#L123 - https://plugins.trac.wordpress.org/changeset/3366486/smartcrawl-seo/trunk/includes/core/controllers/class-submodule-controller.php
CVE ID: CVE-2025-11166 State: PUBLISHED Published: 2025-10-09T01:48:48.168Z Last Updated: 2025-10-09T18:10:57.000Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: wpgmaps Products: WP Go Maps (formerly WP Google Maps) Problem Types: CWE-352 Description: The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to, and including, 9.0.46. This is due to the plugin exposing state-changing REST actions through an AJAX bridge without proper CSRF token validation, and having destructive logic reachable via GET requests with no permission_callback. This makes it possible for unauthenticated a
g destructive logic reachable via GET requests with no permission_callback. This makes it possible for unauthenticated attackers to force logged-in administrators to create, update, or delete markers and geometry features via CSRF attacks, and allows anonymous users to trigger mass deletion of markers via unsafe GET requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/840ba5b2-838a-455a-b39d-865f89c05249?source=cve - https://plugins.trac.wordpress.org/browser/wp-google-maps/trunk/includes/class.rest-api.php#L45 - https://plugins.trac.wordpress.org/browser/wp-google-maps/trunk/includes/class.rest-api.php#L287 - ht
rest-api.php#L45 - https://plugins.trac.wordpress.org/browser/wp-google-maps/trunk/includes/class.rest-api.php#L287 - https://plugins.trac.wordpress.org/browser/wp-google-maps/trunk/includes/class.rest-api.php#L850 - https://research.cleantalk.org/cve-2025-11166 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3370954%40wp-google-maps%2Ftrunk&old=3317391%40wp-google-maps%2Ftrunk&sfp_email=&sfph_mail=#file1
CVE ID: CVE-2025-11167 State: PUBLISHED Published: 2025-10-11T08:29:17.346Z Last Updated: 2025-10-14T14:11:07.569Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) Vendors: creativemindssolutions Products: CM Registration – Tailored tool for seamless login and invitation-based registrations Problem Types: CWE-601 Description: The CM Registration – Tailored tool for seamless login and invitation-based registrations plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 2.5.6. This is due to insufficient validation on the redirect url supplied via the 'redirect_url' parameter. This makes it possible for unauthenticated attackers to red
the redirect url supplied via the 'redirect_url' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c10286fe-2fdf-4946-b7bb-a2b16f93abb0?source=cve - https://plugins.trac.wordpress.org/changeset/3374121/cm-invitation-codes/trunk/controller/LoginController.php?old=3310298&old_path=cm-invitation-codes%2Ftags%2F2.5.5%2Fcontroller%2FLoginController.php
CVE ID: CVE-2025-11168 State: PUBLISHED Published: 2025-11-11T03:30:33.945Z Last Updated: 2025-11-12T20:08:54.182Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: mvirik Products: Mementor Core Problem Types: CWE-269 Description: The Mementor Core plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.2.5. This is due to plugin not properly handling the user switch back function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges by accessing an administrator account through the switch back functionality. Additional Analyst Notes: - CISA ADP Vulnric
y accessing an administrator account through the switch back functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2460e7c4-76dc-4bc3-bc06-b52df64f5353?source=cve - http://plugins.trac.wordpress.org/browser/mementor-core/trunk/inc/functions.php#L1033 - https://wordpress.org/plugins/mementor-core/
CVE ID: CVE-2025-11170 State: PUBLISHED Published: 2025-11-11T03:30:44.250Z Last Updated: 2025-11-14T15:31:03.261Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: kddiwebcommunications Products: WP移行専用プラグイン for CPI Problem Types: CWE-434 Description: The WP移行専用プラグイン for CPI plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the Cpiwm_Import_Controller::import function in all versions up to, and including, 1.0.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnri
on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8a96d6d5-a5e3-4648-902b-f9d1f8e57e5c?source=cve - https://wordpress.org/plugins/cpi-wp-migration/
CVE ID: CVE-2025-11171 State: PUBLISHED Published: 2025-10-08T05:24:49.497Z Last Updated: 2025-10-08T16:16:23.576Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: ays-pro Products: Chartify – WordPress Chart Plugin Problem Types: CWE-306 Description: The Chartify – WordPress Chart Plugin for WordPress is vulnerable to Missing Authentication for Critical Function in all versions up to, and including, 3.5.9. This is due to the plugin registering an unauthenticated AJAX action that dispatches to admin-class methods based on a request parameter, without any nonce or capability checks. This makes it possible for unauthenticated attackers to execute administrative
, without any nonce or capability checks. This makes it possible for unauthenticated attackers to execute administrative functions via the wp-admin/admin-ajax.php endpoint granted they can identify callable method names. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/aa3e030b-8ef1-4dbc-940d-6c2ab2683620?source=cve - https://plugins.trac.wordpress.org/browser/chart-builder/tags/3.5.8/includes/class-chart-builder.php#L247 - https://plugins.trac.wordpress.org/browser/chart-builder/tags/3.5.8/admin/class-chart-builder-admin.php#L675 - https://plugins.trac.wordpress.org/browser/chart-builder/tags/3.5.8/admin/class-chart-b
s-chart-builder-admin.php#L675 - https://plugins.trac.wordpress.org/browser/chart-builder/tags/3.5.8/admin/class-chart-builder-admin.php#L1625 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3372188%40chart-builder%2Ftags%2F3.6.0&new=3372188%40chart-builder%2Ftags%2F3.6.0
CVE ID: CVE-2025-11172 State: PUBLISHED Published: 2025-10-24T08:24:03.767Z Last Updated: 2025-10-24T14:36:26.966Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: plagiarismchecker Products: Check Plagiarism Problem Types: CWE-862 Description: The Check Plagiarism plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the chk_plag_mine_plugin_wpse10500_admin_action() function in all versions up to, and including, 2.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the API key. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://ww
vel access and above, to update the API key. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ade64c1d-65e6-4424-b2da-dc63b49f08aa?source=cve - https://plugins.trac.wordpress.org/browser/check-plagiarism/trunk/index.php#L760