Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-60225 State: PUBLISHED Published: 2025-10-22T14:32:45.876Z Last Updated: 2025-11-13T10:33:44.889Z Vendors: AncoraThemes Products: BugsPatrol Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in AncoraThemes BugsPatrol bugspatrol allows Object Injection.This issue affects BugsPatrol: from n/a through <= 1.5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/bugspatrol/vulnerability/wordpress-bugspatrol-theme-1-5-0-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-60226 State: PUBLISHED Published: 2025-10-22T14:32:46.090Z Last Updated: 2025-11-13T10:33:44.875Z Vendors: axiomthemes Products: White Rabbit Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in axiomthemes White Rabbit whiterabbit allows Object Injection.This issue affects White Rabbit: from n/a through <= 1.5.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/whiterabbit/vulnerability/wordpress-white-rabbit-theme-1-5-2-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-60227 State: PUBLISHED Published: 2025-10-22T14:32:46.277Z Last Updated: 2025-11-13T10:33:45.190Z Vendors: ThimPress Products: WP Pipes Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThimPress WP Pipes wp-pipes allows Path Traversal.This issue affects WP Pipes: from n/a through <= 1.4.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/wp-pipes/vulnerability/wordpress-wp-pipes-plugin-1-4-3-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE ID: CVE-2025-60228 State: PUBLISHED Published: 2025-10-22T14:32:46.487Z Last Updated: 2025-11-13T10:33:45.364Z Vendors: designthemes Products: Knowledge Base Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in designthemes Knowledge Base kbase allows Object Injection.This issue affects Knowledge Base: from n/a through <= 2.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/kbase/vulnerability/wordpress-knowledge-base-theme-2-9-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-60232 State: PUBLISHED Published: 2025-10-22T14:32:46.670Z Last Updated: 2025-11-13T10:33:46.548Z Vendors: quantumcloud Products: KBx Pro Ultimate Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in quantumcloud KBx Pro Ultimate knowledgebase-helpdesk-pro allows Object Injection.This issue affects KBx Pro Ultimate: from n/a through <= 8.0.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/knowledgebase-helpdesk-pro/vulnerability/wordpress-kbx-pro-ultimate-plugin-8-0-5-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-60234 State: PUBLISHED Published: 2025-10-22T14:32:46.860Z Last Updated: 2025-11-13T10:33:45.788Z Vendors: designthemes Products: Single Property Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in designthemes Single Property single-property allows Object Injection.This issue affects Single Property: from n/a through <= 2.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/single-property/vulnerability/wordpress-single-property-theme-2-8-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-60235 State: PUBLISHED Published: 2025-11-06T15:55:07.928Z Last Updated: 2025-11-17T16:10:41.325Z Vendors: Plugify Products: Helpdesk Support Ticket System for WooCommerce Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Plugify Helpdesk Support Ticket System for WooCommerce support-ticket-system-for-woocommerce allows Using Malicious Files.This issue affects Helpdesk Support Ticket System for WooCommerce: from n/a through <= 2.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/support-ticket-system-for-woocommerce/vulnerability/wordpress-helpdesk-suppo
dp.patchstack.com/database/Wordpress/Plugin/support-ticket-system-for-woocommerce/vulnerability/wordpress-helpdesk-support-ticket-system-for-woocommerce-plugin-2-0-7-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2025-60238 State: PUBLISHED Published: 2025-10-22T14:32:47.058Z Last Updated: 2025-11-13T10:33:46.548Z Vendors: universam Products: UNIVERSAM Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in universam UNIVERSAM universam-demo allows Object Injection.This issue affects UNIVERSAM: from n/a through <= 8.72.34. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/universam-demo/vulnerability/wordpress-universam-plugin-8-72-14-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-60239 State: PUBLISHED Published: 2025-11-06T15:55:09.493Z Last Updated: 2025-11-13T10:33:45.573Z Vendors: Codexpert, Inc Products: CoSchool LMS Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Codexpert, Inc CoSchool LMS coschool allows Blind SQL Injection.This issue affects CoSchool LMS: from n/a through <= 1.4.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/coschool/vulnerability/wordpress-coschool-lms-plugin-1-4-3-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-60240 State: PUBLISHED Published: 2025-11-06T15:55:10.324Z Last Updated: 2025-11-13T10:33:45.908Z Vendors: Alexander Products: AnyComment Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Alexander AnyComment anycomment allows PHP Local File Inclusion.This issue affects AnyComment: from n/a through <= 0.3.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/anycomment/vulnerability/wordpress-anycomment-plugin-0-3-6-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-60241 State: PUBLISHED Published: 2025-11-06T15:55:13.362Z Last Updated: 2025-11-13T10:33:46.547Z Vendors: Premmerce Products: Premmerce Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Premmerce Premmerce premmerce allows PHP Local File Inclusion.This issue affects Premmerce: from n/a through <= 1.3.19. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/premmerce/vulnerability/wordpress-premmerce-plugin-1-3-19-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-60242 State: PUBLISHED Published: 2025-11-06T15:55:14.917Z Last Updated: 2025-11-17T16:10:35.589Z Vendors: Anatoly Products: Download Counter Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Anatoly Download Counter download-counter allows Path Traversal.This issue affects Download Counter: from n/a through <= 1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/download-counter/vulnerability/wordpress-download-counter-plugin-1-4-arbitrary-file-download-vulnerability?_s_id=cve
CVE ID: CVE-2025-60243 State: PUBLISHED Published: 2025-11-06T15:55:15.782Z Last Updated: 2025-11-17T16:10:29.906Z Vendors: Holest Engineering Products: Selling Commander for WooCommerce Problem Types: CWE-266 Description: Incorrect Privilege Assignment vulnerability in Holest Engineering Selling Commander for WooCommerce selling-commander-connector allows Privilege Escalation.This issue affects Selling Commander for WooCommerce: from n/a through <= 1.2.46. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/selling-commander-connector/vulnerability/wordpress-selling-commander-for-woocommerce-plugin-1-2-46-privilege-escalation
selling-commander-connector/vulnerability/wordpress-selling-commander-for-woocommerce-plugin-1-2-46-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2025-60244 State: PUBLISHED Published: 2025-11-06T15:55:18.193Z Last Updated: 2025-11-17T16:10:24.511Z Vendors: RealMag777 Products: TableOn Problem Types: CWE-80 Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in RealMag777 TableOn posts-table-filterable allows Code Injection.This issue affects TableOn: from n/a through <= 1.0.4.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/posts-table-filterable/vulnerability/wordpress-tableon-plugin-1-0-4-2-content-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-60245 State: PUBLISHED Published: 2025-11-06T15:55:19.859Z Last Updated: 2025-11-17T16:10:18.146Z Vendors: WP User Manager Products: WP User Manager Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in WP User Manager WP User Manager wp-user-manager allows Object Injection.This issue affects WP User Manager: from n/a through <= 2.9.12. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/wp-user-manager/vulnerability/wordpress-wp-user-manager-plugin-2-9-12-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-60246 State: PUBLISHED Published: 2025-10-22T14:32:47.237Z Last Updated: 2025-11-13T10:33:45.628Z Vendors: weissmike Products: Simple Finance Calculator Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weissmike Simple Finance Calculator simple-finance-calculator allows Reflected XSS.This issue affects Simple Finance Calculator: from n/a through <= 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/simple-finance-calculator/vulnerability/wordpress-simple-finance-calculator-plugin-1-0-reflected-cross-site-scripting-xss
imple-finance-calculator/vulnerability/wordpress-simple-finance-calculator-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-60247 State: PUBLISHED Published: 2025-11-06T15:55:20.539Z Last Updated: 2025-11-13T10:33:46.500Z Vendors: Bux Products: Bux Woocommerce Problem Types: CWE-862 Description: Missing Authorization vulnerability in Bux Bux Woocommerce bux-woocommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Bux Woocommerce: from n/a through <= 1.2.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/bux-woocommerce/vulnerability/wordpress-bux-woocommerce-plugin-1-2-3-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-60248 State: PUBLISHED Published: 2025-11-06T15:55:21.142Z Last Updated: 2025-11-13T10:33:45.845Z Vendors: WPClever Products: WPC Product Options for WooCommerce Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WPClever WPC Product Options for WooCommerce wpc-product-options allows PHP Local File Inclusion.This issue affects WPC Product Options for WooCommerce: from n/a through <= 1.8.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/wpc-product-options/vulnerability/wordpress-wpc-product-options-for
https://vdp.patchstack.com/database/Wordpress/Plugin/wpc-product-options/vulnerability/wordpress-wpc-product-options-for-woocommerce-plugin-1-8-6-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-60249 State: PUBLISHED Published: 2025-09-25T00:00:00.000Z Last Updated: 2025-09-26T17:44:06.988Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: CIRCL Products: vulnerability-lookup Problem Types: CWE-79 Description: vulnerability-lookup 2.16.0 allows XSS in bundle.py, comment.py, and user.py, by a user on a vulnerability-lookup instance who can add bundles, comments, or sightings. A cross-site scripting (XSS) vulnerability was discovered in the handling of user-supplied input in the Bundles, Comments, and Sightings components. Untrusted data was not properly sanitized before being rendered in templates and tables, which could allow attacke
ents. Untrusted data was not properly sanitized before being rendered in templates and tables, which could allow attackers to inject arbitrary JavaScript into the application. The issue was due to unsafe use of innerHTML and insufficient validation of dynamic URLs and model fields. This vulnerability has been fixed by escaping untrusted data, replacing innerHTML assignments with safer DOM methods, encoding URLs with encodeURIComponent, and improving input validation in the affected models. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vulnerability-lookup/vulnerability-lookup/commit/afa12347f1461d9481eba75ac19897e80a9c7434
CVE ID: CVE-2025-60250 State: PUBLISHED Published: 2025-09-26T00:00:00.000Z Last Updated: 2025-09-26T19:18:16.378Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: Unitree Products: Go2, G1, H1, B2 Problem Types: CWE-321 Description: Unitree Go2, G1, H1, and B2 devices through 2025-09-20 decrypt BLE packet data by using the df98b715d5c6ed2b25817b6f2554124a key and the 2841ae97419c2973296a0d4bdfe19a4f IV. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://spectrum.ieee.org/unitree-robot-exploit - https://github.com/Bin4ry/UniPwn - https://news.ycombinator.com/item?id=45381590
CVE ID: CVE-2025-60251 State: PUBLISHED Published: 2025-09-26T00:00:00.000Z Last Updated: 2025-09-26T14:49:50.498Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Unitree Products: Go2, G1, H1, B2 Problem Types: CWE-306 Description: Unitree Go2, G1, H1, and B2 devices through 2025-09-20 accept any handshake secret with the unitree substring. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://spectrum.ieee.org/unitree-robot-exploit - https://github.com/Bin4ry/UniPwn - https://news.ycombinator.com/item?id=45381590
CVE ID: CVE-2025-60265 State: PUBLISHED Published: 2025-10-09T00:00:00.000Z Last Updated: 2025-10-09T19:12:58.275Z Vendors: n/a Products: n/a Problem Types: n/a Description: In xckk v9.6, there is a SQL injection vulnerability in which the orderBy parameter in user/list is not securely filtered, resulting in a SQL injection vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/bestfeng/xckk - https://github.com/int-ux/report/issues/1
CVE ID: CVE-2025-60266 State: PUBLISHED Published: 2025-10-09T00:00:00.000Z Last Updated: 2025-10-09T19:13:55.353Z Vendors: n/a Products: n/a Problem Types: n/a Description: In xckk v9.6, there is a SQL injection vulnerability in which the orderBy parameter in address/list is not securely filtered, resulting in a SQL injection vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/bestfeng/xckk - https://github.com/int-ux/report/issues/2
CVE ID: CVE-2025-60267 State: PUBLISHED Published: 2025-10-09T00:00:00.000Z Last Updated: 2025-10-09T19:14:46.336Z Vendors: n/a Products: n/a Problem Types: n/a Description: In xckk v9.6, there is a SQL injection vulnerability in which the cond parameter in notice/list is not securely filtered, resulting in a SQL injection vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/bestfeng/xckk - https://github.com/int-ux/report/issues/3
CVE ID: CVE-2025-60268 State: PUBLISHED Published: 2025-10-10T00:00:00.000Z Last Updated: 2025-10-10T18:55:13.791Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability exists in JeeWMS 20250820, which is caused by the lack of file checking in the saveFiles function in /jeewms/cgUploadController.do. An attacker with normal privileges was able to upload a malicious file that would lead to remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/erzhongxmu/JEEWMS - https://github.com/int-ux/report/issues/4
CVE ID: CVE-2025-60269 State: PUBLISHED Published: 2025-10-10T00:00:00.000Z Last Updated: 2025-10-10T18:12:00.681Z Vendors: n/a Products: n/a Problem Types: n/a Description: JEEWMS 20250820 is vulnerable to SQL Injection in the exportXls function located in the src/main/java/org/jeecgframework/web/cgreport/controller/excel/CgExportExcelController.java file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/erzhongxmu/JEEWMS - https://github.com/int-ux/report/issues/5
CVE ID: CVE-2025-60279 State: PUBLISHED Published: 2025-10-17T00:00:00.000Z Last Updated: 2025-10-17T15:36:06.545Z Vendors: n/a Products: n/a Problem Types: n/a Description: A server-side request forgery (SSRF) vulnerability in Illia Cloud illia-Builder before v4.8.5 allows authenticated users to send arbitrary requests to internal services via the API. An attacker can leverage this to enumerate open ports based on response discrepancies and interact with internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://owasp.org/www-community/attacks/Server_Side_Request_Forgery - https://github.com/lukehebe/Vulnerability-Disclosures/blob/main/CVE-2025-60279.pdf
CVE ID: CVE-2025-60280 State: PUBLISHED Published: 2025-10-21T00:00:00.000Z Last Updated: 2025-10-21T16:03:02.875Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Scripting (XSS) vulnerability in Bang Resto v1.0 could allow an attacker to inject malicious JavaScript code into the application's web pages. This vulnerability exists due to insufficient input sanitization or output encoding, allowing attacker-controlled input to be rendered directly in the browser. When exploited, an attacker can steal session cookies, redirect users to malicious sites, perform actions on behalf of the user, or deface the website. This can lead to user data compromise, loss of user trust, a
rform actions on behalf of the user, or deface the website. This can lead to user data compromise, loss of user trust, and a broader attack surface for more advanced exploitation techniques. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vwrap.live/stored-xss-in-bangresto - https://github.com/debug-security/CVE/tree/main/CVE-2025-60280
CVE ID: CVE-2025-60291 State: PUBLISHED Published: 2025-10-27T00:00:00.000Z Last Updated: 2025-10-27T15:57:06.701Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in eTimeTrackLite Web thru 12.0 (20250704). There is a permission control flaw that allows unauthorized attackers to access specific routes and modify database connection configurations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.esslsecurity.com/ - https://github.com/M00nBack/CVE_Request/blob/main/eSSL%20Security/eTimeTrackLite.md
CVE ID: CVE-2025-60298 State: PUBLISHED Published: 2025-10-08T00:00:00.000Z Last Updated: 2025-10-08T14:54:01.058Z Vendors: n/a Products: n/a Problem Types: n/a Description: Novel-Plus up to 5.2.4 was discovered to contain a Stored Cross-Site Scripting (XSS) vulnerability via the /author/updateIndexName endpoint. This vulnerability allows authenticated attackers to inject malicious JavaScript code through the indexName parameter, which gets stored in the database and executed when other users view the affected book chapter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/201206030/novel-plus - https://notes.sjtu.edu.cn/s/FB0dX82qf
CVE ID: CVE-2025-60299 State: PUBLISHED Published: 2025-10-08T00:00:00.000Z Last Updated: 2025-10-08T20:42:15.303Z Vendors: n/a Products: n/a Problem Types: n/a Description: Novel-Plus with 5.2.0 was discovered to contain a Stored Cross-Site Scripting (XSS) vulnerability via the /book/addCommentReply endpoint. An authenticated user can inject malicious JavaScript through the replyContent parameter when replying to a book comment. The payload is stored in the database and is executed in other users’ browsers when they view the affected comment thread. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/201206030/novel-plus - https://notes.sjtu.edu.cn/s/OtnFaGbI
s: - CISA ADP Vulnrichment: References: - https://github.com/201206030/novel-plus - https://notes.sjtu.edu.cn/s/OtnFaGbI4
CVE ID: CVE-2025-60302 State: PUBLISHED Published: 2025-10-09T00:00:00.000Z Last Updated: 2025-10-09T16:22:18.761Z Vendors: n/a Products: n/a Problem Types: n/a Description: code-projects Client Details System 1.0 is vulnerable to Cross Site Scripting (XSS). When adding customer information, the client details system fills in malicious JavaScript code in the username field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://code-projects.com - https://github.com/Chen1-Boop/CVE/blob/main/CVE-2025-60302.md
CVE ID: CVE-2025-60304 State: PUBLISHED Published: 2025-10-09T00:00:00.000Z Last Updated: 2025-10-09T19:11:59.463Z Vendors: n/a Products: n/a Problem Types: n/a Description: code-projects Simple Scheduling System 1.0 is vulnerable to Cross Site Scripting (XSS) via the Subject Description field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://code-projects.com - https://github.com/Chen1-Boop/CVE/blob/main/CVE-2025-60304.md
CVE ID: CVE-2025-60305 State: PUBLISHED Published: 2025-10-10T00:00:00.000Z Last Updated: 2025-10-15T17:26:29.868Z Vendors: n/a Products: n/a Problem Types: n/a Description: SourceCodester Online Student Clearance System 1.0 is vulnerable to Incorrect Access Control. The application contains a logic flaw which allows low privilege users can forge high privileged sessions and perform sensitive operations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://sourcecodester.com - https://github.com/Chen1-Boop/CVE/blob/main/CVE-2025-60305.md
CVE ID: CVE-2025-60306 State: PUBLISHED Published: 2025-10-10T00:00:00.000Z Last Updated: 2025-10-10T18:00:59.052Z Vendors: n/a Products: n/a Problem Types: n/a Description: code-projects Simple Car Rental System 1.0 has a permission bypass issue where low privilege users can forge high privilege sessions and perform sensitive operations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://code-projects.com - https://github.com/Chen1-Boop/CVE/blob/main/CVE-2025-60306.md
CVE ID: CVE-2025-60307 State: PUBLISHED Published: 2025-10-10T00:00:00.000Z Last Updated: 2025-10-15T17:24:49.941Z Vendors: n/a Products: n/a Problem Types: n/a Description: code-projects Computer Laboratory System 1.0 has a SQL injection vulnerability, where entering a universal password in the Password field on the login page can bypass login attempts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://code-projects.com - https://github.com/Chen1-Boop/CVE/blob/main/CVE-2025-60307.md
CVE ID: CVE-2025-60308 State: PUBLISHED Published: 2025-10-10T00:00:00.000Z Last Updated: 2025-10-10T17:47:27.209Z Vendors: n/a Products: n/a Problem Types: n/a Description: code-projects Simple Online Hotel Reservation System 1.0 has a Cross Site Scripting (XSS) vulnerability in the Add Room function of the online hotel reservation system. Malicious JavaScript code is entered in the Description field, which can leak the administrator's cookie information when browsing this room information Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://code-projects.com - https://github.com/Chen1-Boop/CVE/blob/main/CVE-2025-60308.md