Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-9677 State: PUBLISHED Published: 2025-08-29T21:02:07.682Z Last Updated: 2025-09-02T15:20:21.483Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: Modo Products: Legend of the Phoenix Problem Types: CWE-926 Description: A security flaw has been discovered in Modo Legend of the Phoenix up to 1.0.5. The affected element is an unknown function of the file AndroidManifest.xml of the component com.duige.hzw.multilingual. The manipulation results in improper export of android application components. The attack needs to be approached locally. The exploit has been released to the public and may be exploited. The vendor was contacted earl
o be approached locally. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321889 - https://vuldb.com/?ctiid.321889 - https://vuldb.com/?submit.638078 - https://github.com/KMov-g/androidapps/blob/main/com.duige.hzw.multilingual.md - https://github.com/KMov-g/androidapps/blob/main/com.duige.hzw.multilingual.md#steps-to-reproduce
CVE ID: CVE-2025-9678 State: PUBLISHED Published: 2025-08-29T21:32:07.312Z Last Updated: 2025-09-02T15:20:15.680Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Online Loan Management System Problem Types: CWE-89, CWE-74 Description: A weakness has been identified in Campcodes Online Loan Management System 1.0. The impacted element is an unknown function of the file /ajax.php?action=delete_borrower. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
en made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321890 - https://vuldb.com/?ctiid.321890 - https://vuldb.com/?submit.638489 - https://github.com/1276486/CVE/issues/3 - https://www.campcodes.com/
CVE ID: CVE-2025-9679 State: PUBLISHED Published: 2025-08-30T04:32:06.957Z Last Updated: 2025-09-02T15:20:08.844Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: Student Information System Problem Types: CWE-89, CWE-74 Description: A security vulnerability has been detected in itsourcecode Student Information System 1.0. This affects an unknown function of the file /course_edit1.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321891 -
ublicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321891 - https://vuldb.com/?ctiid.321891 - https://vuldb.com/?submit.638518 - https://github.com/chesser12312310/CVE/issues/2 - https://itsourcecode.com/
CVE ID: CVE-2025-9680 State: PUBLISHED Published: 2025-08-30T07:02:06.380Z Last Updated: 2025-09-02T15:19:26.116Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:C) Vendors: n/a Products: O2OA Problem Types: CWE-79, CWE-94 Description: A vulnerability was detected in O2OA up to 10.0-410. This impacts an unknown function of the file /x_portal_assemble_designer/jaxrs/page of the component Personal Profile Page. Performing manipulation results in cross site scripting. The attack can be initiated remotely. The exploit is now public and may be used. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version." Additiona
plied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321892 - https://vuldb.com/?ctiid.321892 - https://vuldb.com/?submit.637237 - https://github.com/o2oa/o2oa/issues/176 - https://github.com/o2oa/o2oa/issues/176#issuecomment-3212880887 - https://github.com/o2oa/o2oa/issues/176#issue-3332941622
CVE ID: CVE-2025-9681 State: PUBLISHED Published: 2025-08-30T08:32:07.530Z Last Updated: 2025-09-02T15:19:20.828Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:C) Vendors: n/a Products: O2OA Problem Types: CWE-79, CWE-94 Description: A flaw has been found in O2OA up to 10.0-410. Affected is an unknown function of the file /x_program_center/jaxrs/agent of the component Personal Profile Page. Executing manipulation can lead to cross site scripting. The attack can be launched remotely. The exploit has been published and may be used. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version." Additional Analyst Not
GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321893 - https://vuldb.com/?ctiid.321893 - https://vuldb.com/?submit.637238 - https://vuldb.com/?submit.637239 - https://github.com/o2oa/o2oa/issues/177 - https://github.com/o2oa/o2oa/issues/177#issuecomment-3212880754 - https://github.com/o2oa/o2oa/issues/178
CVE ID: CVE-2025-9682 State: PUBLISHED Published: 2025-08-30T09:32:07.151Z Last Updated: 2025-09-02T15:19:15.715Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:C) Vendors: n/a Products: O2OA Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in O2OA up to 10.0-410. Affected by this vulnerability is an unknown functionality of the file /x_cms_assemble_control/jaxrs/design/appdict of the component Personal Profile Page. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue
to the public and may be used. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321894 - https://vuldb.com/?ctiid.321894 - https://vuldb.com/?submit.637240 - https://github.com/o2oa/o2oa/issues/179 - https://github.com/o2oa/o2oa/issues/179#issuecomment-3212879970 - https://github.com/o2oa/o2oa/issues/179#issue-3332951521
CVE ID: CVE-2025-9683 State: PUBLISHED Published: 2025-08-30T10:02:06.398Z Last Updated: 2025-09-02T15:19:09.875Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:C) Vendors: n/a Products: O2OA Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in O2OA up to 10.0-410. Affected by this issue is some unknown functionality of the file /x_cms_assemble_control/jaxrs/form of the component Personal Profile Page. The manipulation results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new versi
The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321895 - https://vuldb.com/?ctiid.321895 - https://vuldb.com/?submit.637241 - https://github.com/o2oa/o2oa/issues/180 - https://github.com/o2oa/o2oa/issues/180#issuecomment-3212879749 - https://github.com/o2oa/o2oa/issues/180#issue-3332965662
CVE ID: CVE-2025-9684 State: PUBLISHED Published: 2025-08-30T10:32:06.028Z Last Updated: 2025-09-02T15:19:03.786Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Educar Problem Types: CWE-89, CWE-74 Description: A vulnerability was determined in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/FormulaMedia/edit of the component Formula de Cálculo de Média Page. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/
licly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321896 - https://vuldb.com/?ctiid.321896 - https://vuldb.com/?submit.638574 - https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-9684.md - https://github.com/marcelomulder/CVE/blob/main/i-educar/SQL%20Injection%20(Blind%20Time-Based)%20Vulnerability%20in%20%60id%60%20Parameter%20on%20%60.module.FormulaMedia.edit%60%20Endpoint.md
CVE ID: CVE-2025-9685 State: PUBLISHED Published: 2025-08-30T11:02:06.212Z Last Updated: 2025-09-02T15:18:57.067Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Educar Problem Types: CWE-89, CWE-74 Description: A vulnerability was identified in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /module/AreaConhecimento/view of the component Listagem de áreas de conhecimento Page. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb
is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321897 - https://vuldb.com/?ctiid.321897 - https://vuldb.com/?submit.638576 - https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-9685.md - https://github.com/marcelomulder/CVE/blob/main/i-educar/SQL%20Injection%20(Blind%20Time-Based)%20Vulnerability%20in%20%60id%60%20Parameter%20on%20%60.module.AreaConhecimento.view%60%20Endpoint.md
CVE ID: CVE-2025-9686 State: PUBLISHED Published: 2025-08-30T11:32:06.172Z Last Updated: 2025-09-02T15:18:50.384Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Educar Problem Types: CWE-89, CWE-74 Description: A security flaw has been discovered in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /module/AreaConhecimento/edit of the component Listagem de áreas de conhecimento Page. Performing manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA AD
ried out remotely. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321898 - https://vuldb.com/?ctiid.321898 - https://vuldb.com/?submit.638577 - https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-9686.md - https://github.com/marcelomulder/CVE/blob/main/i-educar/SQL%20Injection%20(Blind%20Time-Based)%20Vulnerability%20in%20%60id%60%20Parameter%20on%20%60.module.AreaConhecimento.edit%60%20Endpoint.md
CVE ID: CVE-2025-9687 State: PUBLISHED Published: 2025-08-30T12:02:06.608Z Last Updated: 2025-09-02T15:18:43.370Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Educar Problem Types: CWE-285, CWE-266 Description: A weakness has been identified in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/HistoricoEscolar/processamentoApi. Executing manipulation can lead to improper authorization. The attack may be performed from a remote location. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321899
c and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321899 - https://vuldb.com/?ctiid.321899 - https://vuldb.com/?submit.638582 - https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-9687.md - https://github.com/marcelomulder/CVE/blob/main/i-educar/Broken%20Object%20Level%20Authorization%20(BOLA)%20allows%20enumeration%20of%20students%20via%20.module.HistoricoEscolar.processamentoApi.md
CVE ID: CVE-2025-9688 State: PUBLISHED Published: 2025-08-30T12:32:07.104Z Last Updated: 2025-09-02T15:18:00.561Z Severity: N/A (CVSS 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C) Vendors: n/a Products: Mupen64Plus Problem Types: CWE-190, CWE-189 Description: A security vulnerability has been detected in Mupen64Plus up to 2.6.0. The affected element is the function write_is_viewer of the file src/device/cart/is_viewer.c. The manipulation leads to integer overflow. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitability is described as difficult. The exploit has been disclosed publicly and may be used. The identifier of the patch
tability is described as difficult. The exploit has been disclosed publicly and may be used. The identifier of the patch is 3984137fc0c44110f1ef876adb008885b05a6e18. To fix this issue, it is recommended to deploy a patch. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321900 - https://vuldb.com/?ctiid.321900 - https://vuldb.com/?submit.638592 - https://github.com/Giles-one/mupen64plusEscape/tree/main/BUG10 - https://github.com/mupen64plus/mupen64plus-core/commit/3984137fc0c44110f1ef876adb008885b05a6e18
CVE ID: CVE-2025-9689 State: PUBLISHED Published: 2025-08-30T13:02:07.064Z Last Updated: 2025-09-02T15:17:55.556Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Advanced School Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was detected in SourceCodester Advanced School Management System 1.0. The impacted element is an unknown function of the file /index.php/stock/item_select. The manipulation of the argument q results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/
ploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321901 - https://vuldb.com/?ctiid.321901 - https://vuldb.com/?submit.638609 - https://github.com/1ithos/CVE/issues/1 - https://www.sourcecodester.com/
CVE ID: CVE-2025-9690 State: PUBLISHED Published: 2025-08-30T13:32:07.015Z Last Updated: 2025-09-02T15:17:50.378Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Advanced School Management System Problem Types: CWE-89, CWE-74 Description: A flaw has been found in SourceCodester Advanced School Management System 1.0. This affects an unknown function of the file /index.php/stock/vendordetails. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321902 - https://
nd may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321902 - https://vuldb.com/?ctiid.321902 - https://github.com/1ithos/CVE/issues/1 - https://www.sourcecodester.com/
CVE ID: CVE-2025-9691 State: PUBLISHED Published: 2025-08-30T14:02:06.639Z Last Updated: 2025-09-02T15:17:44.727Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Online Shopping System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in Campcodes Online Shopping System 1.0. This impacts an unknown function of the file /login.php. Such manipulation of the argument Password leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321903 - https://vuldb.com/?ctiid.32190
onal Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321903 - https://vuldb.com/?ctiid.321903 - https://vuldb.com/?submit.638843 - https://github.com/lrjbsyh/CVE_Hunter/issues/6 - https://github.com/lrjbsyh/CVE_Hunter/issues/6#issue-3339330450 - https://www.campcodes.com/
CVE ID: CVE-2025-9692 State: PUBLISHED Published: 2025-08-30T14:32:07.087Z Last Updated: 2025-09-02T15:17:39.033Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Online Shopping System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Campcodes Online Shopping System 1.0. Affected is an unknown function of the file /product.php. Performing manipulation of the argument p results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321904 - https://vuldb.com/?ctiid.321904 - https://
Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321904 - https://vuldb.com/?ctiid.321904 - https://vuldb.com/?submit.638853 - https://github.com/lrjbsyh/CVE_Hunter/issues/7 - https://github.com/lrjbsyh/CVE_Hunter/issues/7#issue-3339422613 - https://www.campcodes.com/
CVE ID: CVE-2025-9693 State: PUBLISHED Published: 2025-09-11T07:25:00.225Z Last Updated: 2025-09-11T14:37:42.327Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: khaledsaikat Products: User Meta – User Profile Builder and User management plugin Problem Types: CWE-22 Description: The User Meta – User Profile Builder and User management plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the postInsertUserProcess function in all versions up to, and including, 3.1.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which c
le for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d482f3a1-4a5a-4382-88b1-fd3b91605694?source=cve - https://plugins.trac.wordpress.org/browser/user-meta/tags/3.1.2/models/classes/UserInsert.php#L642
CVE ID: CVE-2025-9694 State: PUBLISHED Published: 2025-08-30T15:02:07.687Z Last Updated: 2025-09-02T15:17:33.501Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Advanced Online Voting System Problem Types: CWE-89, CWE-74 Description: A vulnerability was determined in Campcodes Advanced Online Voting System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/login.php. Executing manipulation of the argument Username can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
s been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321905 - https://vuldb.com/?ctiid.321905 - https://vuldb.com/?submit.638947 - https://github.com/zhaodaojie/cve/issues/7 - https://www.campcodes.com/
CVE ID: CVE-2025-9695 State: PUBLISHED Published: 2025-08-30T15:32:06.939Z Last Updated: 2025-09-02T15:17:25.863Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: GalleryVault Products: Gallery Vault App Problem Types: CWE-926 Description: A vulnerability was identified in GalleryVault Gallery Vault App up to 4.5.2 on Android. Affected by this issue is some unknown functionality of the file AndroidManifest.xml of the component com.thinkyeah.galleryvault. The manipulation leads to improper export of android application components. The attack can only be performed from a local environment. The exploit is publicly available and might be used. Addit
s. The attack can only be performed from a local environment. The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321906 - https://vuldb.com/?ctiid.321906 - https://vuldb.com/?submit.639039 - https://github.com/KMov-g/androidapps/blob/main/com.thinkyeah.galleryvault.md - https://github.com/KMov-g/androidapps/blob/main/com.thinkyeah.galleryvault.md#steps-to-reproduce
CVE ID: CVE-2025-9696 State: PUBLISHED Published: 2025-09-02T16:34:35.362Z Last Updated: 2025-09-02T17:39:59.231Z Vendors: SunPower Products: PVS6 Problem Types: CWE-798 Description: The SunPower PVS6's BluetoothLE interface is vulnerable due to its use of hardcoded encryption parameters and publicly accessible protocol details. An attacker within Bluetooth range could exploit this vulnerability to gain full access to the device's servicing interface. This access allows the attacker to perform actions such as firmware replacement, disabling power production, modifying grid settings, creating SSH tunnels, altering firewall settings, and manipulating connected devices. Additional Analyst Notes
settings, creating SSH tunnels, altering firewall settings, and manipulating connected devices. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-245-03
CVE ID: CVE-2025-9697 State: PUBLISHED Published: 2025-10-02T06:00:05.550Z Last Updated: 2025-10-02T15:53:15.409Z Vendors: Unknown Products: Ajax WooSearch Problem Types: CWE-89 SQL Injection Description: The Ajax WooSearch WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/38939152-e54e-4f8f-996b-592de195570d/
CVE ID: CVE-2025-9698 State: PUBLISHED Published: 2025-10-13T06:00:07.225Z Last Updated: 2025-10-14T20:25:25.025Z Vendors: Unknown Products: The Plus Addons for Elementor Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Plus Addons for Elementor WordPress plugin before 6.3.16 does not sanitize SVG file contents, which could allow users with minimum role access as Author to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a9539def-d92b-4117-b36a-17015c578d89/
CVE ID: CVE-2025-9699 State: PUBLISHED Published: 2025-08-30T16:32:06.890Z Last Updated: 2025-09-02T15:17:20.516Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Online Polling System Code Problem Types: CWE-89, CWE-74 Description: A vulnerability was detected in SourceCodester Online Polling System Code 1.0. This vulnerability affects unknown code of the file /admin/checklogin.php. The manipulation of the argument myusername results in sql injection. The attack may be performed from a remote location. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321919
ow public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321919 - https://vuldb.com/?ctiid.321919 - https://vuldb.com/?submit.639171 - https://github.com/ganzhi-qcy/cve/issues/16 - https://www.sourcecodester.com/