Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
pting server operations. Version 1.0.0 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Death1Clown/VoidBot_open-source/security/advisories/GHSA-6rr8-9c8q-m5rv - https://discordjs.guide/popular-topics/permissions.html
CVE ID: CVE-2025-53944 State: PUBLISHED Published: 2025-07-30T14:28:36.168Z Last Updated: 2025-07-30T14:47:36.847Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Significant-Gravitas Products: AutoGPT Problem Types: CWE-285 Description: AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents. In v0.6.15 and below, the external API's get_graph_execution_results endpoint has an authorization bypass vulnerability. While it correctly validates user access to the graph_id, it fails to verify ownership of the graph_exec_id parameter, allowing authenticated users to access any execution results by providing arb
ownership of the graph_exec_id parameter, allowing authenticated users to access any execution results by providing arbitrary execution IDs. The internal API implements proper validation for both parameters. This is fixed in v0.6.16. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-x77j-qg2x-fgg6 - https://github.com/Significant-Gravitas/AutoGPT/commit/309114a727baa2063357810d444e9a119f8dd7f6 - https://github.com/Significant-Gravitas/AutoGPT/releases/tag/autogpt-platform-beta-v0.6.16
CVE ID: CVE-2025-53945 State: PUBLISHED Published: 2025-07-18T15:35:17.325Z Last Updated: 2025-07-22T15:03:42.966Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L) Vendors: chainguard-dev Products: apko Problem Types: CWE-276 Description: apko allows users to build and publish OCI container images built from apk packages. Starting in version 0.27.0 and prior to version 0.29.5, critical files were inadvertently set to 0666, which could likely be abused for root escalation. Version 0.29.5 contains a fix for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/chainguard-dev/apko/security/advisories/GHSA-x6ph-r535-3vjw - https://gith
ulnrichment: References: - https://github.com/chainguard-dev/apko/security/advisories/GHSA-x6ph-r535-3vjw - https://github.com/chainguard-dev/apko/commit/04f37e2d50d5a502e155788561fb7d40de705bd9 - https://github.com/chainguard-dev/apko/commit/aedb0772d6bf6e74d8f17690946dbc791d0f6af3 - https://github.com/chainguard-dev/apko/releases/tag/v0.27.0 - https://github.com/chainguard-dev/apko/releases/tag/v0.29.5
CVE ID: CVE-2025-53946 State: PUBLISHED Published: 2025-07-17T14:02:50.919Z Last Updated: 2025-07-17T14:21:31.683Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-89 Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.4.5 in the `id_funcionario` parameter of the `/html/saude/profile_paciente.php` endpoint. This vulnerability allows attacker to manipulate SQL queries and access sensitive database information, such as table names and sensitive data. Version 3.4.5 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:
d sensitive data. Version 3.4.5 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-532r-mgxv-g7jm
CVE ID: CVE-2025-53947 State: PUBLISHED Published: 2025-09-18T21:10:03.344Z Last Updated: 2025-09-19T12:10:31.664Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: Cognex Products: In-Sight 2000 series, In-Sight 7000 series, In-Sight 8000 series, In-Sight 9000 series, In-Sight Explorer Problem Types: CWE-276 Description: A local attacker with low privileges on the Windows system where the software is installed can exploit this vulnerability to corrupt sensitive data. A data folder is created with very weak privileges, allowing any user logged into the Windows system to modify its content. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
into the Windows system to modify its content. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-06
CVE ID: CVE-2025-53948 State: PUBLISHED Published: 2025-08-18T21:16:03.614Z Last Updated: 2025-08-19T19:24:23.617Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Santesoft Products: Sante PACS Server Problem Types: CWE-415 Description: The Sante PACS Server allows a remote attacker to crash the main thread by sending a crafted HL7 message, causing a denial-of-service condition. The application would require a manual restart and no authentication is required. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-224-01
CVE ID: CVE-2025-53950 State: PUBLISHED Published: 2025-10-16T14:00:05.329Z Last Updated: 2025-10-16T14:22:55.551Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N/E:F/RL:O/RC:C) Vendors: Fortinet Products: FortiDLP Problem Types: CWE-359 Description: An Exposure of Private Personal Information ('Privacy Violation') vulnerability [CWE-359] in Fortinet FortiDLP Agent's Outlookproxy plugin for MacOS and Windows 11.5.1 and 11.4.2 through 11.4.6 and 11.3.2 through 11.3.4 and 11.2.0 through 11.2.3 and 11.1.1. through 11.1.2 and 11.0.1 and 10.5.1 and 10.4.0, and 10.3.1 may allow an authenticated administrator to collect current user's email information. Additional Analyst No
, and 10.3.1 may allow an authenticated administrator to collect current user's email information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-25-639
CVE ID: CVE-2025-53951 State: PUBLISHED Published: 2025-10-16T13:58:21.749Z Last Updated: 2025-10-16T14:37:00.457Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C) Vendors: Fortinet Products: FortiDLP Problem Types: CWE-22 Description: An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiDLP Agent's Outlookproxy plugin for Windows 11.5.1 and 11.4.2 through 11.4.6 and 11.3.2 through 11.3.4 and 11.2.0 through 11.2.3 and 11.1.1 through 11.1.2 and 11.0.1 and 10.5.1 and 10.4.0, and 10.3.1 may allow an authenticated attacker to escalate their privilege to LocalService via sending a crafted re
4.0, and 10.3.1 may allow an authenticated attacker to escalate their privilege to LocalService via sending a crafted request to a local listening port. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-25-628
CVE ID: CVE-2025-53952 State: REJECTED Published: N/A Last Updated: 2025-07-16T02:55:07.675Z Description: No description available.
CVE ID: CVE-2025-53953 State: REJECTED Published: N/A Last Updated: 2025-07-16T02:55:07.211Z Description: No description available.
CVE ID: CVE-2025-53954 State: REJECTED Published: N/A Last Updated: 2025-07-16T02:55:06.732Z Description: No description available.
CVE ID: CVE-2025-53955 State: REJECTED Published: N/A Last Updated: 2025-07-16T02:55:06.258Z Description: No description available.
CVE ID: CVE-2025-53956 State: REJECTED Published: N/A Last Updated: 2025-07-16T02:55:05.823Z Description: No description available.
CVE ID: CVE-2025-53957 State: REJECTED Published: N/A Last Updated: 2025-07-16T02:55:05.391Z Description: No description available.
CVE ID: CVE-2025-53958 State: REJECTED Published: N/A Last Updated: 2025-07-16T02:55:04.884Z Description: No description available.
CVE ID: CVE-2025-53959 State: PUBLISHED Published: 2025-07-15T16:26:57.469Z Last Updated: 2025-07-15T17:21:45.428Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) Vendors: JetBrains Products: YouTrack Problem Types: CWE-862 Description: In JetBrains YouTrack before 2025.2.86069, 2024.3.85077, 2025.1.86199 email spoofing via an administrative API was possible Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-53964 State: PUBLISHED Published: 2025-07-17T00:00:00.000Z Last Updated: 2025-07-17T20:30:47.748Z Vendors: n/a Products: n/a Problem Types: n/a Description: GoldenDict 1.5.0 and 1.5.1 has an exposed dangerous method that allows reading and modifying files when a user adds a crafted dictionary and then searches for any term included in that dictionary. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/goldendict/goldendict/releases - https://github.com/tigr78/CVE-2025-53964
CVE ID: CVE-2025-53967 State: PUBLISHED Published: 2025-10-08T00:00:00.000Z Last Updated: 2025-10-08T17:18:20.747Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: Framelink Products: Figma MCP Server Problem Types: CWE-420 Description: Framelink Figma MCP Server before 0.6.3 allows an unauthenticated remote attacker to execute arbitrary operating system commands via a crafted HTTP POST request with shell metacharacters in input that is used by a fetchWithRetry curl command. The vulnerable endpoint fails to properly sanitize user-supplied input, enabling the attacker to inject malicious commands that are executed with the privileges of the MCP process. Exploitati
enabling the attacker to inject malicious commands that are executed with the privileges of the MCP process. Exploitation requires network access to the MCP interface. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/GLips/Figma-Context-MCP/blob/96b3852669c5eed65e4a6e20406c25504d9196f2/src/utils/fetch-with-retry.ts#L34 - https://www.imperva.com/blog/another-critical-rce-discovered-in-a-popular-mcp-server/ - https://github.com/GLips/Figma-Context-MCP/releases/tag/v0.6.3
CVE ID: CVE-2025-53969 State: PUBLISHED Published: 2025-09-18T21:30:45.520Z Last Updated: 2025-09-19T13:10:58.750Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Cognex Products: In-Sight 2000 series, In-Sight 7000 series, In-Sight 8000 series, In-Sight 9000 series, In-Sight Explorer Problem Types: CWE-602 Description: Cognex In-Sight Explorer and In-Sight Camera Firmware expose a service implementing a proprietary protocol on TCP port 1069 to allow the client-side software, such as the In-Sight Explorer tool, to perform management operations such as changing network settings or modifying users' access to the device. Additional Analyst Notes: - CISA ADP Vulnr
s such as changing network settings or modifying users' access to the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-06
CVE ID: CVE-2025-53970 State: PUBLISHED Published: 2025-08-28T08:28:07.400Z Last Updated: 2025-08-28T14:14:40.986Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: DOS Co., Ltd. Products: SS1, SS1 Cloud Problem Types: CWE-434 Description: SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier) allows a remote unauthenticated attacker to upload arbitrary files and execute OS commands with SYSTEM privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dos-osaka.co.jp/news/2025/08/250827.html - https://jvn.jp/en/jp/JVN99577552/
CVE ID: CVE-2025-53971 State: PUBLISHED Published: 2025-08-21T07:31:01.870Z Last Updated: 2025-08-21T14:51:19.669Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-863 Description: Mattermost versions 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate authorization for team scheme role modifications which allows Team Admins to demote Team Members to Guests via the PUT /api/v4/teams/team-id/members/user-id/schemeRoles API endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-53982 State: PUBLISHED Published: 2025-07-16T10:36:10.369Z Last Updated: 2025-07-16T14:39:44.030Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Crocoblock Products: JetElements For Elementor Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor allows Stored XSS. This issue affects JetElements For Elementor: from n/a through 2.7.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/jet-elements/vulnerability/wordpress-jetelements-for-elementor-plugin-2-7-7-cro
patchstack.com/database/wordpress/plugin/jet-elements/vulnerability/wordpress-jetelements-for-elementor-plugin-2-7-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-53983 State: PUBLISHED Published: 2025-08-20T08:03:09.330Z Last Updated: 2025-08-20T14:33:53.171Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Crocoblock Products: JetElements For Elementor Problem Types: CWE-201 Description: Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetElements For Elementor allows Retrieve Embedded Sensitive Data. This issue affects JetElements For Elementor: from n/a through 2.7.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/jet-elements/vulnerability/wordpress-jetelements-for-elementor-2-7-7-sensitive-data-exposur
om/database/wordpress/plugin/jet-elements/vulnerability/wordpress-jetelements-for-elementor-2-7-7-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2025-53984 State: PUBLISHED Published: 2025-07-16T10:36:10.911Z Last Updated: 2025-07-16T14:39:39.128Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Crocoblock Products: JetTabs Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs allows Stored XSS. This issue affects JetTabs: from n/a through 2.2.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/jet-tabs/vulnerability/wordpress-jettabs-plugin-2-2-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-53985 State: PUBLISHED Published: 2025-08-20T08:03:08.749Z Last Updated: 2025-08-20T14:37:40.534Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Crocoblock Products: JetTabs Problem Types: CWE-201 Description: Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetTabs allows Retrieve Embedded Sensitive Data. This issue affects JetTabs: from n/a through 2.2.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/jet-tabs/vulnerability/wordpress-jettabs-2-2-9-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2025-53986 State: PUBLISHED Published: 2025-07-16T10:36:11.412Z Last Updated: 2025-07-16T14:39:34.319Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: ThemeIsle Products: Hestia Problem Types: CWE-862 Description: Missing Authorization vulnerability in ThemeIsle Hestia allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Hestia: from n/a through 3.2.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/hestia/vulnerability/wordpress-hestia-theme-3-2-10-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-53987 State: PUBLISHED Published: 2025-08-20T08:03:08.179Z Last Updated: 2025-08-20T14:39:45.653Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Crocoblock Products: JetMenu Problem Types: CWE-201 Description: Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetMenu allows Retrieve Embedded Sensitive Data. This issue affects JetMenu: from n/a through 2.4.11.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/jet-menu/vulnerability/wordpress-jetmenu-2-4-11-1-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2025-53988 State: PUBLISHED Published: 2025-08-20T08:03:07.609Z Last Updated: 2025-08-20T15:47:45.940Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Crocoblock Products: JetBlocks For Elementor Problem Types: CWE-201 Description: Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetBlocks For Elementor allows Retrieve Embedded Sensitive Data. This issue affects JetBlocks For Elementor: from n/a through 1.3.18. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/jet-blocks/vulnerability/wordpress-jetblocks-for-elementor-1-3-18-sensitive-data-exposure-vulner
tabase/wordpress/plugin/jet-blocks/vulnerability/wordpress-jetblocks-for-elementor-1-3-18-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2025-53989 State: PUBLISHED Published: 2025-07-16T10:36:36.693Z Last Updated: 2025-07-18T14:53:27.061Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Crocoblock Products: JetBlocks For Elementor Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor allows Stored XSS. This issue affects JetBlocks For Elementor: from n/a through 1.3.19. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/jet-blocks/vulnerability/wordpress-jetblocks-for-elementor-plugin-1-3-19-cross-site-
stack.com/database/wordpress/plugin/jet-blocks/vulnerability/wordpress-jetblocks-for-elementor-plugin-1-3-19-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-53990 State: PUBLISHED Published: 2025-07-16T10:36:37.220Z Last Updated: 2025-07-18T14:53:48.316Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: jetmonsters Products: JetFormBuilder Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in jetmonsters JetFormBuilder allows Object Injection. This issue affects JetFormBuilder: from n/a through 3.5.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/jetformbuilder/vulnerability/wordpress-jetformbuilder-plugin-3-5-1-2-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-53991 State: PUBLISHED Published: 2025-07-16T10:36:37.678Z Last Updated: 2025-07-18T14:54:12.253Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Crocoblock Products: JetTricks Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTricks allows Stored XSS. This issue affects JetTricks: from n/a through 1.5.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/jet-tricks/vulnerability/wordpress-jettricks-plugin-1-5-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-53992 State: PUBLISHED Published: 2025-08-20T08:03:07.085Z Last Updated: 2025-08-20T15:49:05.535Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Crocoblock Products: JetTricks Problem Types: CWE-201 Description: Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetTricks allows Retrieve Embedded Sensitive Data. This issue affects JetTricks: from n/a through 1.5.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/jet-tricks/vulnerability/wordpress-jettricks-1-5-4-1-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2025-53993 State: PUBLISHED Published: 2025-08-20T08:03:06.499Z Last Updated: 2025-08-20T15:50:10.851Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Crocoblock Products: JetPopup Problem Types: CWE-201 Description: Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetPopup allows Retrieve Embedded Sensitive Data. This issue affects JetPopup: from n/a through 2.0.15. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/jet-popup/vulnerability/wordpress-jetpopup-2-0-15-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2025-53994 State: PUBLISHED Published: 2025-07-16T10:36:38.504Z Last Updated: 2025-07-16T19:49:18.889Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Crocoblock Products: JetPopup Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetPopup allows DOM-Based XSS. This issue affects JetPopup: from n/a through 2.0.15. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/jet-popup/vulnerability/wordpress-jetpopup-plugin-2-0-15-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-53995 State: PUBLISHED Published: 2025-07-16T10:36:38.974Z Last Updated: 2025-07-16T19:50:34.824Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Crocoblock Products: JetPopup Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetPopup allows Stored XSS. This issue affects JetPopup: from n/a through 2.0.15.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/jet-popup/vulnerability/wordpress-jetpopup-plugin-2-0-15-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-53996 State: PUBLISHED Published: 2025-07-16T10:36:39.427Z Last Updated: 2025-07-16T19:51:32.827Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Crocoblock Products: JetSearch Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSearch allows Stored XSS. This issue affects JetSearch: from n/a through 3.5.10.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/jet-search/vulnerability/wordpress-jetsearch-plugin-3-5-10-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-53997 State: PUBLISHED Published: 2025-07-16T10:36:39.895Z Last Updated: 2025-07-18T14:54:29.096Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: favethemes Products: Houzez Problem Types: CWE-862 Description: Missing Authorization vulnerability in favethemes Houzez allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Houzez: from n/a through 4.0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/houzez/vulnerability/wordpress-houzez-theme-4-0-4-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-53998 State: PUBLISHED Published: 2025-08-20T08:03:05.932Z Last Updated: 2025-08-20T15:52:38.292Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Crocoblock Products: JetWooBuilder Problem Types: CWE-201 Description: Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetWooBuilder allows Retrieve Embedded Sensitive Data. This issue affects JetWooBuilder: from n/a through 2.1.20. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/jet-woo-builder/vulnerability/wordpress-jetwoobuilder-2-1-20-sensitive-data-exposure-vulnerability?_s_id=cve