Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
rms this vulnerability but classifies it as a "low severity issue due to the default service user being used as it would either require someone to intentionally change the service to a highly privileged account or an attacker would need an admin level account". It is planned to fix this issue in the next major release v5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332362 - https://vuldb.com/?ctiid.332362 - https://vuldb.com/?submit.683894 - https://github.com/lakshayyverma/CVE-Discovery/blob/main/Sonarr.md
CVE ID: CVE-2025-13132 State: PUBLISHED Published: 2025-11-21T17:55:52.758Z Last Updated: 2025-11-21T18:08:38.229Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N) Vendors: The Browser Company of New York Products: Dia Problem Types: CWE-1021 Description: This vulnerability allowed a site to enter fullscreen, after a user click, without a full-screen notification (toast) appearing. Without this notification, users could potentially be misled about what site they were on if a malicious site renders a fake UI (like a fake address bar.) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.diabrowser.com/security/bulletins#CVE-2025-13132
CVE ID: CVE-2025-13133 State: PUBLISHED Published: 2025-11-18T09:27:37.077Z Last Updated: 2025-11-18T21:32:02.192Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L) Vendors: vaniivan Products: Simple User Import Export Problem Types: CWE-1236 Description: The Simple User Import Export plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.1.7 via the 'Import/export users' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnera
SV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/39ec49b4-f0f3-4ec7-b11b-ce808c025577?source=cve - https://it.wordpress.org/plugins/a3-user-importer/
CVE ID: CVE-2025-13134 State: PUBLISHED Published: 2025-11-21T07:31:52.018Z Last Updated: 2025-11-24T18:04:53.144Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: powerblogservice Products: AuthorSure Problem Types: CWE-352 Description: The AuthorSure plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3. This is due to missing or incorrect nonce validation on the 'authorsure' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Add
a a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/81070529-b269-44b0-8f21-b08add63a099?source=cve - https://drive.google.com/file/d/1ZVmQSyjgRxNVGef7Zkzdws8kLraxOt59/view?pli=1
CVE ID: CVE-2025-13135 State: PUBLISHED Published: 2025-11-21T07:31:56.742Z Last Updated: 2025-11-21T14:56:28.693Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: integrationshotelrunner Products: HotelRunner Booking Widget Problem Types: CWE-79 Description: The HotelRunner Booking Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hotelrunner' shortcode in all versions up to, and including, 5.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages tha
sible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/df2854c4-5d57-4c39-a28f-41dab36a086e?source=cve - https://wordpress.org/plugins/hotelrunner/#developers
CVE ID: CVE-2025-13136 State: PUBLISHED Published: 2025-11-22T08:30:29.035Z Last Updated: 2025-11-24T19:34:16.526Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: westerndeal Products: GSheetConnector For Ninja Forms Problem Types: CWE-862 Description: The GSheetConnector For Ninja Forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'njform-google-sheet-config ' page in all versions up to, and including, 2.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve information about the system. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
vel access and above, to retrieve information about the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5770cb94-8603-44d9-8cda-925175851b51?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3399046%40gsheetconnector-ninja-forms&new=3399046%40gsheetconnector-ninja-forms&sfp_email=&sfph_mail=
CVE ID: CVE-2025-13138 State: PUBLISHED Published: 2025-11-21T09:26:59.920Z Last Updated: 2025-11-21T14:55:25.719Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: listingthemes Products: WP Directory Kit Problem Types: CWE-89 Description: The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'columns_search' parameter of the select_2_ajax() function in all versions up to, and including, 1.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that ca
s makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0cad8c48-5c96-484c-acda-b33d8d8d10d3?source=cve - https://plugins.trac.wordpress.org/browser/wpdirectorykit/tags/1.4.3/application/controllers/Wdk_frontendajax.php#L546 - https://wordpress.org/plugins/wpdirectorykit/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3396348%40wpdirectorykit&new=3396348%40wpdirectorykit&sfp_email=&sfph_mail=
CVE ID: CVE-2025-13141 State: PUBLISHED Published: 2025-11-21T08:28:13.807Z Last Updated: 2025-11-21T14:55:42.643Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: devitemsllc Products: HT Mega – Absolute Addons For Elementor Problem Types: CWE-79 Description: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Gutenberg blocks in all versions up to, and including, 3.0.0 due to insufficient input validation on user-supplied HTML tag names. This is due to the lack of a tag name whitelist allowing dangerous tags like 'script', 'iframe', and 'object' to be injected even though tag_escape(
tag name whitelist allowing dangerous tags like 'script', 'iframe', and 'object' to be injected even though tag_escape() is used for sanitization. While some blocks use esc_html() for content, this can be bypassed using JavaScript encoding techniques (unquoted strings, backticks, String.fromCharCode()). This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8bf04325-e313-4a68-89a0-b560bdef5a14?source=cve - https://plugins.trac.wordp
rdfence.com/threat-intel/vulnerabilities/id/8bf04325-e313-4a68-89a0-b560bdef5a14?source=cve - https://plugins.trac.wordpress.org/changeset/3398480/
CVE ID: CVE-2025-13142 State: PUBLISHED Published: 2025-11-21T07:31:50.691Z Last Updated: 2025-11-24T18:06:36.988Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: farvehandleren Products: Custom Post Type Problem Types: CWE-352 Description: The Custom Post Type plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation on the custom post type deletion functionality. This makes it possible for unauthenticated attackers to delete custom post types via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Addition
orged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/48fefbd5-d872-4f47-8696-d73fbc9133ed?source=cve - https://plugins.trac.wordpress.org/browser/custom-post-type/tags/1.0/cupta-dmin.php#L29
CVE ID: CVE-2025-13145 State: PUBLISHED Published: 2025-11-19T05:45:13.217Z Last Updated: 2025-11-19T20:27:18.817Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: smackcoders Products: WP Import – Ultimate CSV XML Importer for WordPress Problem Types: CWE-502 Description: The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.33.1. This is due to deserialization of untrusted data supplied via CSV file imports in the import_single_post_as_csv function within SingleImportExport.php. This makes it possible for authenticated attackers, with administrator-level acces
nction within SingleImportExport.php. This makes it possible for authenticated attackers, with administrator-level access or higher, to inject a PHP object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5e441699-4c78-4277-8ac1-f33b810e78cb?source=cve - https://plugins.trac.wordpress.org/browser/wp-ultimate-csv-importer/trunk/SingleImportExport.php#L116 - https://plugins.trac.wordpress.org/changeset/3397842/wp-ultimate-csv-importer
porter/trunk/SingleImportExport.php#L116 - https://plugins.trac.wordpress.org/changeset/3397842/wp-ultimate-csv-importer/trunk/SingleImportExport.php
CVE ID: CVE-2025-13147 State: PUBLISHED Published: 2025-11-19T20:45:48.418Z Last Updated: 2025-11-19T20:50:10.151Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Progress Products: MOVEit Transfer Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in Progress MOVEit Transfer.This issue affects MOVEit Transfer: before 2024.1.8, from 2025.0.0 before 2025.0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.progress.com/bundle/moveit-transfer-release-notes-2024/page/Fixed-Issues-in-2024.1.8.html - https://docs.progress.com/bundle/moveit-transfer-release-notes-2025/page/Fixed-Issues-in-2025.0.4.htm
in-2024.1.8.html - https://docs.progress.com/bundle/moveit-transfer-release-notes-2025/page/Fixed-Issues-in-2025.0.4.html - https://docs.progress.com/bundle/moveit-transfer-release-notes-2025_1/page/Fixed-Issues-in-2025.1.html
CVE ID: CVE-2025-13149 State: PUBLISHED Published: 2025-11-21T08:28:13.060Z Last Updated: 2025-11-21T14:55:48.208Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: publishpress Products: Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories Problem Types: CWE-862 Description: The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the "saveFutureActionData" function in all versions up to, and including, 4.9.1. This makes it possible for authen
ck on the "saveFutureActionData" function in all versions up to, and including, 4.9.1. This makes it possible for authenticated attackers, with author level access and above, to change the status of arbitrary posts and pages via the REST API endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/82ea0ebc-08aa-4ef5-b6b1-c7c13715ef6d?source=cve - https://github.com/publishpress/publishpress-future/commit/0cbefc1632c6f1fffc5fa0ca85e6b8a641d41c7f
CVE ID: CVE-2025-13156 State: PUBLISHED Published: 2025-11-21T08:28:15.190Z Last Updated: 2025-11-21T14:55:31.247Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: appsbd Products: Vitepos – Point of Sale (POS) for WooCommerce Problem Types: CWE-434 Description: The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the insert_media_attachment() function in all versions up to, and including, 3.3.0. This is due to the save_update_category_img() function accepting user-supplied file types without validation when processing category images. This makes it possible for aut
on accepting user-supplied file types without validation when processing category images. This makes it possible for authenticated attackers, with subscriber level access and above, to upload arbitrary files on the affected site's server which makes remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bd478bb7-f0d7-4a29-8236-96ad69b5ae67?source=cve - https://plugins.trac.wordpress.org/changeset/3398044
CVE ID: CVE-2025-13159 State: PUBLISHED Published: 2025-11-21T07:31:52.396Z Last Updated: 2025-11-24T18:04:24.452Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: flothemesplugins Products: Flo Forms – Easy Drag & Drop Form Builder Problem Types: CWE-79 Description: The Flo Forms – Easy Drag & Drop Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to, and including, 1.0.43. This is due to the plugin allowing SVG file uploads via an unauthenticated AJAX endpoint (`flo_form_submit`) without proper file content validation. This makes it possible for unauthenticated attackers to upload malicious
bmit`) without proper file content validation. This makes it possible for unauthenticated attackers to upload malicious SVG files containing JavaScript that executes when an administrator views the uploaded file in the WordPress admin interface, leading to potential full site compromise. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8c529017-2fb9-4665-97a6-3ec062908299?source=cve - https://plugins.trac.wordpress.org/browser/flo-forms/trunk/includes/class-flo-forms.php#L301 - https://plugins.trac.wordpress.org/browser/flo-forms/trunk/public/class-flo-forms-public.php#L502 - https://plugins.trac.wordpress.org/browser/
rdpress.org/browser/flo-forms/trunk/public/class-flo-forms-public.php#L502 - https://plugins.trac.wordpress.org/browser/flo-forms/trunk/admin/class-flo-forms-admin.php#L821
CVE ID: CVE-2025-13160 State: PUBLISHED Published: 2025-11-14T03:00:26.497Z Last Updated: 2025-11-14T15:50:07.132Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IQ Service International Products: IQ-Support Problem Types: CWE-497 Description: IQ-Support developed by IQ Service International has a Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to access specific APIs to obtain sensitive information from the internal network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/en/cp-139-10502-11c6d-2.html - https://www.twcert.org.tw/tw/cp-132-10501-a25a6-1.html
CVE ID: CVE-2025-13161 State: PUBLISHED Published: 2025-11-14T03:05:19.526Z Last Updated: 2025-11-14T15:22:57.150Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IQ Service International Products: IQ-Support Problem Types: CWE-23 Description: IQ-Support developed by IQ Service International has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/en/cp-139-10502-11c6d-2.html - https://www.twcert.org.tw/tw/cp-132-10501-a25a6-1.html
CVE ID: CVE-2025-13163 State: PUBLISHED Published: 2025-11-17T06:17:06.848Z Last Updated: 2025-11-17T16:21:36.951Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Digiwin Products: EasyFlow GP Problem Types: CWE-522 Description: EasyFlow GP developed by Digiwin has an Insufficiently Protected Credentials vulnerability, allowing privileged remote attackers to obtain plaintext database account credentials from the system frontend. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10503-a66fe-1.html - https://www.twcert.org.tw/en/cp-139-10504-23f4c-2.html
CVE ID: CVE-2025-13164 State: PUBLISHED Published: 2025-11-17T06:23:21.352Z Last Updated: 2025-11-17T16:19:24.139Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Digiwin Products: EasyFlow GP Problem Types: CWE-522 Description: EasyFlow GP developed by Digiwin has an Insufficiently Protected Credentials vulnerability, allowing privileged remote attackers to obtain plaintext credentials of AD and system mail from the system frontend. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10503-a66fe-1.html - https://www.twcert.org.tw/en/cp-139-10504-23f4c-2.html
CVE ID: CVE-2025-13165 State: PUBLISHED Published: 2025-11-17T06:46:02.907Z Last Updated: 2025-11-17T16:17:19.345Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Digiwin Products: EasyFlow GP Problem Types: CWE-770 Description: EasyFlow GP developed by Digiwin has a Denial of service vulnerability, allowing unauthenticated remote attackers to send specific requests that result in denial of web service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10503-a66fe-1.html - https://www.twcert.org.tw/en/cp-139-10504-23f4c-2.html
CVE ID: CVE-2025-13168 State: PUBLISHED Published: 2025-11-14T15:02:06.824Z Last Updated: 2025-11-14T16:49:03.659Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C) Vendors: ury-erp Products: ury Problem Types: CWE-89, CWE-74 Description: A weakness has been identified in ury-erp ury up to 0.2.0. This affects the function overrided_past_order_list of the file ury/ury/api/pos_extend.py. This manipulation of the argument search_term causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited. Upgrading to version 0.2.1 is able to mitigate this issue. Patch name: 063384e0dddfd191847cd2d6524c342c
ld be exploited. Upgrading to version 0.2.1 is able to mitigate this issue. Patch name: 063384e0dddfd191847cd2d6524c342cc380b058. It is suggested to upgrade the affected component. The vendor replied and reacted very professional. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332456 - https://vuldb.com/?ctiid.332456 - https://vuldb.com/?submit.683984 - https://github.com/ictrun/ury-vulns/blob/main/README.md - https://github.com/ictrun/ury-vulns/blob/main/README.md#verification-steps - https://github.com/ury-erp/ury/commit/063384e0dddfd191847cd2d6524c342cc380b058 - https://github.com/ury-erp/ury/releases/tag/v0.2.1
CVE ID: CVE-2025-13169 State: PUBLISHED Published: 2025-11-14T15:32:07.714Z Last Updated: 2025-11-14T16:48:51.672Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Simple Online Hotel Reservation System Problem Types: CWE-89, CWE-74 Description: A security vulnerability has been detected in code-projects Simple Online Hotel Reservation System 1.0. This vulnerability affects unknown code of the file /add_query_reserve.php. Such manipulation of the argument room_id leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
y. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332457 - https://vuldb.com/?ctiid.332457 - https://vuldb.com/?submit.684616 - https://github.com/hanshi-798/CVE/blob/main/tmp72/report.md - https://code-projects.org/
CVE ID: CVE-2025-13170 State: PUBLISHED Published: 2025-11-14T16:02:05.326Z Last Updated: 2025-11-14T16:24:19.569Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Simple Online Hotel Reservation System Problem Types: CWE-89, CWE-74 Description: A vulnerability was detected in code-projects Simple Online Hotel Reservation System 1.0. This issue affects some unknown processing of the file /admin/edit_account.php. Performing manipulation of the argument admin_id results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References
d out remotely. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332458 - https://vuldb.com/?ctiid.332458 - https://vuldb.com/?submit.684617 - https://github.com/pfdlyy/CVE/issues/1 - https://code-projects.org/
CVE ID: CVE-2025-13171 State: PUBLISHED Published: 2025-11-14T17:32:05.675Z Last Updated: 2025-11-14T18:27:22.178Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: n/a Products: ZZCMS Problem Types: CWE-89, CWE-74 Description: A vulnerability was identified in ZZCMS 2023. This impacts an unknown function of the file /admin/wangkan_list.php. Such manipulation of the argument keyword leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332463 - https://vuldb.com/?ctiid.332463 - https://vuldb.com/?submit.684765 - https:
References: - https://vuldb.com/?id.332463 - https://vuldb.com/?ctiid.332463 - https://vuldb.com/?submit.684765 - https://github.com/En0t5/vul/blob/main/zzcms/zzcms-sql-inject2.md - https://github.com/En0t5/vul/blob/main/zzcms/zzcms-sql-inject2.md#poc
CVE ID: CVE-2025-13172 State: PUBLISHED Published: 2025-11-14T18:02:06.388Z Last Updated: 2025-11-17T20:40:10.365Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: CodeAstro Products: Gym Management System Problem Types: CWE-89, CWE-74 Description: A security flaw has been discovered in CodeAstro Gym Management System 1.0. Affected is an unknown function of the file /admin/view-member-report.php. Performing manipulation of the argument ID results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332464 - h