Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-4668 State: REJECTED Published: N/A Last Updated: 2025-05-13T21:06:34.937Z Description: No description available.
CVE ID: CVE-2025-4669 State: PUBLISHED Published: 2025-05-17T11:17:17.095Z Last Updated: 2025-05-19T14:54:47.112Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpdevelop Products: WP Booking Calendar Problem Types: CWE-79 Description: The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpbc shortcode in all versions up to, and including, 10.11.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user acces
ith contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f4e43d66-04f4-4adb-93da-75e02d1c714e?source=cve - https://wordpress.org/plugins/booking/#developers - https://plugins.trac.wordpress.org/browser/booking/trunk/core/lib/wpdev-booking-class.php#L445 - https://plugins.trac.wordpress.org/browser/booking/trunk/core/lib/wpdev-booking-class.php#L789 - https://plugins.trac.wordpress.org/browser/booking/trunk/core/lib/wpdev-booking-class.php#L248 - https://plugins.trac.wordpress.org/changes
c.wordpress.org/browser/booking/trunk/core/lib/wpdev-booking-class.php#L248 - https://plugins.trac.wordpress.org/changeset/3293836/
CVE ID: CVE-2025-4670 State: PUBLISHED Published: 2025-05-29T08:22:03.121Z Last Updated: 2025-05-29T14:05:08.480Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: smub Products: Easy Digital Downloads – eCommerce Payments and Subscriptions made easy Problem Types: CWE-79 Description: The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's edd_receipt shortcode in all versions up to, and including, 3.3.8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributo
ion and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/95c5bfc5-53b3-482f-856b-db6b6cac93a2?source=cve - https://wordpress.org/plugins/easy-digital-downloads/#developers - https://plugins.trac.wordpress.org/changeset/3301852/
CVE ID: CVE-2025-4671 State: PUBLISHED Published: 2025-06-03T11:22:25.867Z Last Updated: 2025-06-03T13:11:14.997Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: cozmoslabs Products: User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor Problem Types: CWE-79 Description: The Profile Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's user_meta and compare shortcodes in all versions up to, and including, 3.13.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and ab
ng on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/346c9785-0069-40ec-a255-fe2dae30f7a0?source=cve - https://wordpress.org/plugins/profile-builder/#developers - https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.13.8/admin/advanced-settings/includes/shortcodes/usermeta.php#L5 - https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.13.8/admin/advanced-settings/includes/sho
eta.php#L5 - https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.13.8/admin/advanced-settings/includes/shortcodes/compare.php#L5 - https://plugins.trac.wordpress.org/changeset/3304692/
CVE ID: CVE-2025-4672 State: PUBLISHED Published: 2025-05-31T06:40:55.986Z Last Updated: 2025-06-02T15:49:38.020Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: offsprout Products: Offsprout Page Builder Problem Types: CWE-285 Description: The Offsprout Page Builder plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization placed on the permission_callback() function in versions 2.2.1 to 2.15.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to read, create, update or delete any user meta, including flipping their own wp_capabilities to administrator and fully escalate their privileg
or delete any user meta, including flipping their own wp_capabilities to administrator and fully escalate their privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9269d18d-8d83-43ff-b777-ba8f58321e9e?source=cve - https://wordpress.org/plugins/offsprout-page-builder/#developers - https://plugins.trac.wordpress.org/browser/offsprout-page-builder/tags/2.15.2/api/class-offsprout-api-extensions.php#L5 - https://plugins.trac.wordpress.org/browser/offsprout-page-builder/tags/2.15.2/api/class-offsprout-api-extensions.php#L514
CVE ID: CVE-2025-4673 State: PUBLISHED Published: 2025-06-11T16:42:53.054Z Last Updated: 2025-06-11T17:59:48.033Z Vendors: Go standard library Products: net/http Problem Types: CWE-201: Insertion of Sensitive Information Into Sent Data Description: Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://go.dev/cl/679257 - https://go.dev/issue/73816 - https://groups.google.com/g/golang-announce/c/ufZ8WpEsA3A - https://pkg.go.dev/vuln/GO-2025-3751
CVE ID: CVE-2025-4674 State: PUBLISHED Published: 2025-07-29T21:19:08.519Z Last Updated: 2025-11-04T21:10:50.871Z Vendors: Go toolchain Products: cmd/go Problem Types: CWE-73: External Control of File Name or Path Description: The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Refe
e, i.e. via "go get", are not affected. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://go.dev/cl/686515 - https://go.dev/issue/74380 - https://groups.google.com/g/golang-announce/c/gTNJnDXmn34 - https://pkg.go.dev/vuln/GO-2025-3828
CVE ID: CVE-2025-4678 State: PUBLISHED Published: 2025-06-10T15:54:55.871Z Last Updated: 2025-06-10T18:10:45.319Z Vendors: Pandora FMS Products: Pandora ITSM Problem Types: CWE-77 Description: Improper Neutralization of Special Elements in the chromium_path variable may allow OS command injection. This issue affects Pandora ITSM 5.0.105. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE ID: CVE-2025-4679 State: PUBLISHED Published: 2025-05-16T08:36:37.066Z Last Updated: 2025-07-02T11:50:13.308Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Synology Products: Active Backup for Microsoft 365 Problem Types: CWE-522 Description: A vulnerability in Synology Active Backup for Microsoft 365 allows remote authenticated attackers to obtain sensitive information via unspecified vectors. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.synology.com/en-global/security/advisory/Synology_SA_25_06
CVE ID: CVE-2025-4680 State: PUBLISHED Published: 2025-06-10T08:41:44.594Z Last Updated: 2025-06-10T14:20:53.952Z Vendors: upKeeper Solutions Products: upKeeper Instant Privilege Access Problem Types: CWE-20 Description: Improper Input Validation vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects upKeeper Instant Privilege Access: before 1.4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.upkeeper.se/hc/en-us/articles/20159822847900-CVE-2025-4680-Improper-Input-Validation
CVE ID: CVE-2025-4681 State: PUBLISHED Published: 2025-06-10T08:44:14.160Z Last Updated: 2025-06-10T14:18:17.300Z Vendors: upKeeper Solutions Products: upKeeper Instant Privilege Access Problem Types: CWE-269 Description: Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Abuse.This issue affects upKeeper Instant Privilege Access: before 1.4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.upkeeper.se/hc/en-us/articles/20159882527772-CVE-2025-4681-Improper-Privilege-Management
CVE ID: CVE-2025-4682 State: PUBLISHED Published: 2025-05-27T01:48:48.934Z Last Updated: 2025-05-27T19:55:21.037Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpdevteam Products: Essential Blocks – AI-Powered Page Builder Gutenberg Blocks, Patterns & Templates Problem Types: CWE-79 Description: The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML attributes in Slider and Post Carousel widgets in all versions up to, and including, 5.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contribut
insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f88f065d-14ca-4547-9a41-f9177979a9ed?source=cve - https://plugins.trac.wordpress.org/browser/essential-blocks/tags/5.4.0/src/blocks/slider/src/frontend.js - https://plugins.trac.wordpress.org/browser/essential-blocks/tags/5.4.0/src/blocks/post-carousel/src/frontend.js - https://plugins.trac.wordpress.org/changeset/3296386/
CVE ID: CVE-2025-4683 State: PUBLISHED Published: 2025-05-27T01:48:48.377Z Last Updated: 2025-05-27T19:54:10.468Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: inspireui Products: MStore API – Create Native Android & iOS Apps On The Cloud Problem Types: CWE-862 Description: The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the create_blog function in all versions up to, and including, 4.17.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create new posts. Additional Analyst Notes: - CISA
authenticated attackers, with Subscriber-level access and above, to create new posts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b335bd15-7af7-4d8b-ad01-b1d9e76beb53?source=cve - https://plugins.trac.wordpress.org/browser/mstore-api/tags/4.17.5/controllers/helpers/blog-helper.php#L24 - https://plugins.trac.wordpress.org/browser/mstore-api/tags/4.17.5/controllers/helpers/blog-helper.php#L46 - https://plugins.trac.wordpress.org/changeset/3293669/
CVE ID: CVE-2025-4684 State: PUBLISHED Published: 2025-08-01T11:18:54.969Z Last Updated: 2025-08-01T13:44:19.688Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: blockspare Products: BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site Imports, No Coding Needed Problem Types: CWE-79 Description: The BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site Imports, No Coding Needed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML attributes of I
Imports, No Coding Needed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML attributes of Image Carousel and Image Slider widgets in all versions up to, and including, 3.2.13.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0f4f8b84-3f65-430b-b749-6afae8d53153?source=cve - https://plugins.trac.wordpress.org/browser/blockspare/trunk/dist/b
/id/0f4f8b84-3f65-430b-b749-6afae8d53153?source=cve - https://plugins.trac.wordpress.org/browser/blockspare/trunk/dist/blocks.js
CVE ID: CVE-2025-4685 State: PUBLISHED Published: 2025-07-21T07:23:24.354Z Last Updated: 2025-07-21T15:17:44.800Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: gutentor Products: Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor Problem Types: CWE-79 Description: The Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML data attributes of multiple widgets, in all versions up to, and including, 3.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to in
and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0e9ec6af-fa51-4e14-abf6-450c1ca6f8d5?source=cve - https://plugins.trac.wordpress.org/changeset/3320485/
CVE ID: CVE-2025-4687 State: PUBLISHED Published: 2025-05-29T08:59:21.859Z Last Updated: 2025-05-29T13:57:56.267Z Vendors: Teltonika Networks Products: RMS Description: In Teltonika Networks Remote Management System (RMS), it is possible to perform account pre-hijacking by misusing the invite functionality. If a victim has a pending invite and registers to the platform directly, they are added to the attackers company without their knowledge. The victims account and their company can then be managed by the attacker.This issue affects RMS: before 5.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jowin922.medium.com/cve-2025-4687-pre-account-takeover-through-invite-
s: - CISA ADP Vulnrichment: References: - https://jowin922.medium.com/cve-2025-4687-pre-account-takeover-through-invite-on-teletonika-rms-website-972335378829
CVE ID: CVE-2025-4688 State: PUBLISHED Published: 2025-09-16T08:38:13.299Z Last Updated: 2025-09-16T19:24:44.948Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: BGS Interactive Products: SINAV.LINK Exam Result Module Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BGS Interactive SINAV.LINK Exam Result Module allows SQL Injection.This issue affects SINAV.LINK Exam Result Module: before 1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0252
CVE ID: CVE-2025-4689 State: PUBLISHED Published: 2025-07-02T03:47:21.403Z Last Updated: 2025-07-02T13:19:13.445Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: scripteo Products: Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager Problem Types: CWE-98 Description: The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion which leads to Remote Code Execution in all versions up to, and including, 4.89. This is due to the presence of a SQL Injection vulnerability and Local File Inclusion vulnerability that can be chained with an image upload. This makes it possible for unauthenticat
nd Local File Inclusion vulnerability that can be chained with an image upload. This makes it possible for unauthenticated attackers to execute code on the server upload image files on the server than can be fetched via a SQL injection vulnerability, and ultimately executed as PHP code through the local file inclusion vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/038ddfcd-093b-4234-a0b8-a3bf9a3d329f?source=cve - https://codecanyon.net/item/ads-pro-plugin-multipurpose-wordpress-advertising-manager/10275010
CVE ID: CVE-2025-4690 State: PUBLISHED Published: 2025-08-19T13:19:27.919Z Last Updated: 2025-08-19T13:35:50.828Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: Google Products: AngularJS Problem Types: CWE-1333 Description: A regular expression used by AngularJS' linky https://docs.angularjs.org/api/ngSanitize/filter/linky filter to detect URLs in input text is vulnerable to super-linear runtime due to backtracking. With a large carefully-crafted input, this can cause a Regular expression Denial of Service (ReDoS) https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS attack on the application. This issue affects all versions
mmunity/attacks/Regular_expression_Denial_of_Service_-_ReDoS attack on the application. This issue affects all versions of AngularJS. Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status . Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.herodevs.com/vulnerability-directory/cve-2025-4690 - https://codepen.io/herodevs/pen/RNNEPzP/751b91eab7730dff277523f3d50e4b77
CVE ID: CVE-2025-4691 State: PUBLISHED Published: 2025-05-31T11:18:54.731Z Last Updated: 2025-06-02T15:48:20.006Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: syntactics Products: Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking Problem Types: CWE-639 Description: The Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.21 via the 'view_request_details' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view the details of any booking re
ion on a user controlled key. This makes it possible for unauthenticated attackers to view the details of any booking request. The vulnerability was partially patched in versions 1.3.18 and 1.3.21. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3c9953b3-dd09-4c80-be11-4daf3bbac720?source=cve - https://plugins.trac.wordpress.org/browser/easync-booking/tags/1.3.17/easync.php#L4859 - https://plugins.trac.wordpress.org/changeset/3243634/ - https://plugins.trac.wordpress.org/changeset/3293607/ - https://plugins.trac.wordpress.org/changeset/3300408/
CVE ID: CVE-2025-4692 State: PUBLISHED Published: 2025-05-22T23:12:39.168Z Last Updated: 2025-05-23T13:32:36.357Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L) Vendors: ABUP Products: ABUP IoT Cloud Platform Problem Types: CWE-266 Description: Actors can use a maliciously crafted JavaScript object notation (JSON) web token (JWT) to perform privilege escalation by submitting the malicious JWT to a vulnerable method exposed on the cloud platform. If the exploit is successful, the user can escalate privileges to access any device managed by the ABUP Cloud Update Platform. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events
Cloud Update Platform. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-01
CVE ID: CVE-2025-4694 State: REJECTED Published: N/A Last Updated: 2025-07-05T22:16:40.081Z Description: No description available.
CVE ID: CVE-2025-4695 State: PUBLISHED Published: 2025-05-15T12:31:05.940Z Last Updated: 2025-05-30T09:09:47.612Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: PHPGurukul, Campcodes Products: Cyber Cafe Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul/Campcodes Cyber Cafe Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /add-users.php. The manipulation of the argument uadd leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:
as been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.308994 - https://vuldb.com/?ctiid.308994 - https://vuldb.com/?submit.567673 - https://github.com/Iandweb/CVE/issues/14
CVE ID: CVE-2025-4696 State: PUBLISHED Published: 2025-05-15T13:00:08.625Z Last Updated: 2025-06-03T12:41:33.739Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: PHPGurukul, Campcodes Products: Cyber Cafe Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul/Campcodes Cyber Cafe Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /search.php. The manipulation of the argument searchdata leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: R
tely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.308995 - https://vuldb.com/?ctiid.308995 - https://vuldb.com/?submit.567683 - https://vuldb.com/?submit.586589 - https://github.com/Iandweb/CVE/issues/15
CVE ID: CVE-2025-4697 State: PUBLISHED Published: 2025-05-15T13:00:11.709Z Last Updated: 2025-05-15T14:23:47.775Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Directory Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Directory Management System 2.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/edit-directory.php. The manipulation of the argument editid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://v
been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.308996 - https://vuldb.com/?ctiid.308996 - https://vuldb.com/?submit.567694 - https://github.com/lwecho/myCVE/issues/2 - https://phpgurukul.com/