Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-58988 State: PUBLISHED Published: 2025-09-09T16:33:10.849Z Last Updated: 2025-09-10T17:31:08.910Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Joe Dolson Products: My Tickets Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joe Dolson My Tickets allows Stored XSS. This issue affects My Tickets: from n/a through 2.0.22. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/my-tickets/vulnerability/wordpress-my-tickets-plugin-2-0-22-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-58989 State: PUBLISHED Published: 2025-09-09T16:33:09.557Z Last Updated: 2025-09-10T17:32:37.942Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: silverplugins217 Products: Dynamic Text Field For Contact Form 7 Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in silverplugins217 Dynamic Text Field For Contact Form 7 allows Stored XSS. This issue affects Dynamic Text Field For Contact Form 7: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/dynamic-text-field-for-contact-fo
CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/dynamic-text-field-for-contact-form-7/vulnerability/wordpress-dynamic-text-field-for-contact-form-7-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-58990 State: PUBLISHED Published: 2025-09-09T16:33:07.863Z Last Updated: 2025-09-09T17:51:40.746Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: HasTech Products: ShopLentor Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasTech ShopLentor allows Stored XSS. This issue affects ShopLentor: from n/a through 3.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/woolentor-addons/vulnerability/wordpress-shoplentor-plugin-3-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-58991 State: PUBLISHED Published: 2025-09-09T16:33:08.560Z Last Updated: 2025-09-09T17:50:24.203Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Cristiano Zanca Products: WooCommerce Booking Bundle Hours Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Cristiano Zanca WooCommerce Booking Bundle Hours allows Stored XSS. This issue affects WooCommerce Booking Bundle Hours: from n/a through 0.7.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/woo-booking-bundle-hours/vulnerability/wordpress-woocommerce-booking-bundle-hours-plugin-0-7-4-cross
se/wordpress/plugin/woo-booking-bundle-hours/vulnerability/wordpress-woocommerce-booking-bundle-hours-plugin-0-7-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-58992 State: PUBLISHED Published: 2025-09-22T18:26:07.610Z Last Updated: 2025-09-23T17:49:14.218Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: impleCode Products: Product Catalog Simple Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode Product Catalog Simple allows Stored XSS. This issue affects Product Catalog Simple: from n/a through 1.8.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/post-type-x/vulnerability/wordpress-product-catalog-simple-plugin-1-8-2-cross-site-scripti
com/database/wordpress/plugin/post-type-x/vulnerability/wordpress-product-catalog-simple-plugin-1-8-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-58993 State: PUBLISHED Published: 2025-09-09T16:33:07.244Z Last Updated: 2025-09-09T18:29:05.885Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: Themeum Products: Tutor LMS Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS allows SQL Injection. This issue affects Tutor LMS: from n/a through 3.7.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/tutor/vulnerability/wordpress-tutor-lms-plugin-3-7-4-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-58994 State: PUBLISHED Published: 2025-11-06T15:54:32.378Z Last Updated: 2025-11-17T16:11:32.597Z Vendors: designervily Products: Greenify Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in designervily Greenify greenify allows PHP Local File Inclusion.This issue affects Greenify: from n/a through <= 2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/greenify/vulnerability/wordpress-greenify-theme-2-2-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-58995 State: PUBLISHED Published: 2025-11-06T15:54:33.654Z Last Updated: 2025-11-17T16:11:26.935Z Vendors: Creatives_Planet Products: Leblix Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Creatives_Planet Leblix leblix allows PHP Local File Inclusion.This issue affects Leblix: from n/a through <= 2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/leblix/vulnerability/wordpress-leblix-theme-2-4-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-58996 State: PUBLISHED Published: 2025-11-06T15:54:36.343Z Last Updated: 2025-11-17T16:11:21.131Z Vendors: Helmut Wandl Products: Advanced Settings Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Helmut Wandl Advanced Settings advanced-settings allows Upload a Web Shell to a Web Server.This issue affects Advanced Settings: from n/a through <= 3.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/advanced-settings/vulnerability/wordpress-advanced-settings-plugin-3-1-1-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2025-58997 State: PUBLISHED Published: 2025-09-09T16:33:06.682Z Last Updated: 2025-09-09T18:43:53.910Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Frenify Products: Mow Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Frenify Mow allows Code Injection. This issue affects Mow: from n/a through 4.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/mow/vulnerability/wordpress-mow-theme-4-10-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-58998 State: PUBLISHED Published: 2025-11-06T15:54:37.699Z Last Updated: 2025-11-17T16:11:15.346Z Vendors: Cristián Lávaque Products: s2Member Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Cristián Lávaque s2Member s2member allows Object Injection.This issue affects s2Member: from n/a through <= 250701. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/s2member/vulnerability/wordpress-s2member-plugin-250701-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-59002 State: PUBLISHED Published: 2025-09-26T08:31:09.406Z Last Updated: 2025-09-29T16:40:57.613Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: SeaTheme Products: BM Content Builder Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in SeaTheme BM Content Builder allows Path Traversal. This issue affects BM Content Builder: from n/a through n/a. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/bm-builder/vulnerability/wordpress-bm-content-builder-plugin-3-16-3-3-arbitrary-file-deletion-vulnerability?_s
ss/plugin/bm-builder/vulnerability/wordpress-bm-content-builder-plugin-3-16-3-3-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE ID: CVE-2025-59004 State: PUBLISHED Published: 2025-10-22T14:32:36.724Z Last Updated: 2025-11-13T10:33:43.141Z Vendors: pco_58 Products: WC Return products Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pco_58 WC Return products wc-return-product allows Reflected XSS.This issue affects WC Return products: from n/a through <= 1.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/wc-return-product/vulnerability/wordpress-wc-return-products-plugin-1-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-59005 State: PUBLISHED Published: 2025-09-09T16:25:21.548Z Last Updated: 2025-09-09T18:42:23.159Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: frenify Products: Categorify Problem Types: CWE-862 Description: Missing Authorization vulnerability in frenify Categorify allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Categorify: from n/a through 1.0.7.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/categorify/vulnerability/wordpress-categorify-plugin-1-0-7-5-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-59006 State: PUBLISHED Published: 2025-10-22T14:32:36.907Z Last Updated: 2025-11-13T10:33:42.953Z Vendors: themebon Products: Easy Woocommerce Customizer Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themebon Easy Woocommerce Customizer easy-woocommerce-customizer allows Reflected XSS.This issue affects Easy Woocommerce Customizer: from n/a through <= 1.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/easy-woocommerce-customizer/vulnerability/wordpress-easy-woocommerce-customizer-plugin-1-0-2-reflected-cross-site
Plugin/easy-woocommerce-customizer/vulnerability/wordpress-easy-woocommerce-customizer-plugin-1-0-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-59007 State: PUBLISHED Published: 2025-10-22T14:32:37.108Z Last Updated: 2025-11-13T10:33:43.033Z Vendors: themesflat Products: TF Woo Product Grid Addon For Elementor Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in themesflat TF Woo Product Grid Addon For Elementor tf-woo-product-grid allows Object Injection.This issue affects TF Woo Product Grid Addon For Elementor: from n/a through <= 1.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/tf-woo-product-grid/vulnerability/wordpress-tf-woo-product-grid-addon-for-elementor-plugin-1-0-1-deserialization-of-untrusted-da
roduct-grid/vulnerability/wordpress-tf-woo-product-grid-addon-for-elementor-plugin-1-0-1-deserialization-of-untrusted-data-vulnerability?_s_id=cve
CVE ID: CVE-2025-59008 State: PUBLISHED Published: 2025-09-09T16:25:20.873Z Last Updated: 2025-09-09T18:42:28.691Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: PressTigers Products: ZIP Code Based Content Protection Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PressTigers ZIP Code Based Content Protection allows SQL Injection. This issue affects ZIP Code Based Content Protection: from n/a through 1.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/zip-code-based-content-protection/vulnerability/word
ent: References: - https://patchstack.com/database/wordpress/plugin/zip-code-based-content-protection/vulnerability/wordpress-zip-code-based-content-protection-plugin-1-0-0-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-59010 State: PUBLISHED Published: 2025-09-26T08:31:08.621Z Last Updated: 2025-09-30T15:42:54.069Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Maciej Bis Products: Permalink Manager Lite Problem Types: CWE-201 Description: Insertion of Sensitive Information Into Sent Data vulnerability in Maciej Bis Permalink Manager Lite allows Retrieve Embedded Sensitive Data. This issue affects Permalink Manager Lite: from n/a through 2.5.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/permalink-manager/vulnerability/wordpress-permalink-manager-lite-plugin-2-5-1-3-sensitive-data-expos
se/wordpress/plugin/permalink-manager/vulnerability/wordpress-permalink-manager-lite-plugin-2-5-1-3-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2025-59011 State: PUBLISHED Published: 2025-09-26T08:31:07.930Z Last Updated: 2025-09-30T15:43:13.815Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: shinetheme Products: Traveler Problem Types: CWE-862 Description: Missing Authorization vulnerability in shinetheme Traveler allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Traveler: from n/a through n/a. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/traveler/vulnerability/wordpress-traveler-theme-3-2-3-arbitrary-content-deletion-vulnerability?_s_id=cve
CVE ID: CVE-2025-59012 State: PUBLISHED Published: 2025-09-26T08:31:10.301Z Last Updated: 2025-09-29T16:39:25.371Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: shinetheme Products: Traveler Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shinetheme Traveler allows Reflected XSS. This issue affects Traveler: from n/a through n/a. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/traveler/vulnerability/wordpress-traveler-theme-3-2-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-59013 State: PUBLISHED Published: 2025-09-09T09:00:23.176Z Last Updated: 2025-09-09T19:31:56.794Z Vendors: TYPO3 Products: TYPO3 CMS Problem Types: CWE-601 Description: An open‑redirect vulnerability in GeneralUtility::sanitizeLocalUrl of TYPO3 CMS 9.0.0–9.5.54, 10.0.0–10.4.53, 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 allows an attacker to redirect users to arbitrary external sites, enabling phishing attacks by supplying a manipulated, sanitized URL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://typo3.org/security/advisory/typo3-core-sa-2025-017
CVE ID: CVE-2025-59014 State: PUBLISHED Published: 2025-09-09T09:00:38.664Z Last Updated: 2025-09-09T19:31:32.972Z Vendors: TYPO3 Products: TYPO3 CMS Problem Types: CWE-248 Description: An uncaught exception in the Bookmark Toolbar of TYPO3 CMS versions 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 lets administrator‑level backend users trigger a denial‑of‑service condition in the backend user interface by saving manipulated data in the bookmark toolbar. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://typo3.org/security/advisory/typo3-core-sa-2025-018
CVE ID: CVE-2025-59015 State: PUBLISHED Published: 2025-09-09T09:00:48.801Z Last Updated: 2025-09-09T19:31:09.254Z Vendors: TYPO3 Products: TYPO3 CMS Problem Types: CWE-331 Description: A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0–12.4.36 and 13.0.0–13.4.17 reduces entropy, allowing attackers to carry out brute‑force attacks more quickly. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://typo3.org/security/advisory/typo3-core-sa-2025-019
CVE ID: CVE-2025-59016 State: PUBLISHED Published: 2025-09-09T09:00:55.985Z Last Updated: 2025-09-09T19:30:37.493Z Vendors: TYPO3 Products: TYPO3 CMS Problem Types: CWE-209 Description: Error messages containing sensitive information in the File Abstraction Layer in TYPO3 CMS versions 9.0.0-9.5.54, 10.0.0-10.4.53, 11.0.0-11.5.47, 12.0.0-12.4.36, and 13.0.0-13.4.17 allow backend users to disclose full file paths via failed low-level file-system operations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://typo3.org/security/advisory/typo3-core-sa-2025-020
CVE ID: CVE-2025-59017 State: PUBLISHED Published: 2025-09-09T09:01:03.951Z Last Updated: 2025-09-09T19:30:15.708Z Vendors: TYPO3 Products: TYPO3 CMS Problem Types: CWE-862 Description: Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://typo3.org/security/advisory/typo3-core-sa-2025-021
CVE ID: CVE-2025-59018 State: PUBLISHED Published: 2025-09-09T09:01:10.275Z Last Updated: 2025-09-11T20:35:36.245Z Vendors: TYPO3 Products: TYPO3 CMS Problem Types: CWE-200 Description: Missing authorization checks in the Workspace Module of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke the corresponding AJAX backend route to disclose sensitive information without having access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://typo3.org/security/advisory/typo3-core-sa-2025-022
CVE ID: CVE-2025-59019 State: PUBLISHED Published: 2025-09-09T09:01:17.787Z Last Updated: 2025-09-11T20:44:40.074Z Vendors: TYPO3 Products: TYPO3 CMS Problem Types: CWE-200 Description: Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from arbitrary database tables stored within the users' web mounts without having access to them. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://typo3.org/security/advisory/typo3-core-sa-2025-023
CVE ID: CVE-2025-59033 State: PUBLISHED Published: 2025-09-08T00:00:00.000Z Last Updated: 2025-11-17T15:57:52.240Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Microsoft Products: Windows Problem Types: CWE-420 Description: The Microsoft vulnerable driver block list is implemented as Windows Defender Application Control (WDAC) policy. Entries that specify only the to-be-signed (TBS) part of the code signer certificate are properly blocked, but entries that specify the signing certificate's TBS hash along with a 'FileAttribRef' qualifier (such as file name or version) may not be blocked, whether hypervisor-protected code integrity (HVCI) is enabled or not. N
uch as file name or version) may not be blocked, whether hypervisor-protected code integrity (HVCI) is enabled or not. NOTE: The vendor disputes this CVE ID assignment and states that the driver blocklist is intended for use with HVCI. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules - https://learn.microsoft.com/en-us/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity - https://x.com/JonnyJohnson_/status/1895103112924307727
CVE ID: CVE-2025-59034 State: PUBLISHED Published: 2025-09-10T16:01:09.960Z Last Updated: 2025-09-11T14:42:53.468Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: indico Products: indico Problem Types: CWE-639 Description: Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, a legacy API to retrieve user details could be misused to retrieve profile details of other users without having admin permissions due to a broken access check. Users should to update to Indico 3.3.8 as soon as possible. As a workaround, it is possible to restrict access to the affected API (e.g. in the w
Indico 3.3.8 as soon as possible. As a workaround, it is possible to restrict access to the affected API (e.g. in the webserver config). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/indico/indico/security/advisories/GHSA-4269-mcfh-cp7q - https://github.com/indico/indico/releases/tag/v3.3.8
CVE ID: CVE-2025-59035 State: PUBLISHED Published: 2025-09-10T16:03:36.573Z Last Updated: 2025-09-11T14:42:48.282Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: indico Products: indico Problem Types: CWE-79 Description: Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, there is a Cross-Site-Scripting vulnerability when rendering LaTeX math code in contribution or abstract descriptions. Users should to update to Indico 3.3.8 as soon as possible. As a workaround, only let trustworthy users create content on Indico. Note that a conference doing a Call for Abstracts actively
karound, only let trustworthy users create content on Indico. Note that a conference doing a Call for Abstracts actively invites external speakers (who the organizers may not know and thus cannot fully trust) to submit content, hence the need to update to a a fixed version ASAP in particular when using such workflows. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/indico/indico/security/advisories/GHSA-7cf7-9wrr-vrf4 - https://github.com/indico/indico/releases/tag/v3.3.8
CVE ID: CVE-2025-59036 State: PUBLISHED Published: 2025-09-09T22:06:47.800Z Last Updated: 2025-09-10T19:30:55.968Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: opsmill Products: infrahub Problem Types: CWE-298 Description: Infrahub offers a central hub to manage data, templates, and playbooks. Prior to versiond 1.3.9 and 1.4.5, a bug in the authentication logic will cause API tokens that were deleted and/or expired to be considered valid. This means that any API token that is associated with an active user account can authenticate successfully. This issue is fixed in versions 1.3.9 and 1.4.5. As a workaround, users can delete or deactivate the account ass
sfully. This issue is fixed in versions 1.3.9 and 1.4.5. As a workaround, users can delete or deactivate the account associated with a deleted API token to prevent that token from authenticating. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/opsmill/infrahub/security/advisories/GHSA-v2p7-4pv4-3wwh
CVE ID: CVE-2025-59037 State: PUBLISHED Published: 2025-09-09T20:26:57.986Z Last Updated: 2025-09-10T14:28:58.864Z Vendors: duckdb Products: duckdb-node Problem Types: CWE-506 Description: DuckDB is an analytical in-process SQL database management system. On 08 September 2025, the DuckDB distribution for Node.js on npm was compromised with malware (along with several other packages). An attacker published new versions of four of DuckDB's packages that included malicious code to interfere with cryptocoin transactions* According to the npm statistics, nobody has downloaded these packages before they were deprecated. The packages and versions `@duckdb/node-api@1.3.3`, `@duckdb/node-bindings@1.3