Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-2611 State: PUBLISHED Published: 2025-08-05T15:00:32.531Z Last Updated: 2025-11-04T22:19:15.078Z Vendors: ICT Innovations Products: ICTBroadcast Problem Types: CWE-78 Description: The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that get executed on the server. This results in unauthenticated remote code execution in the session handling. Versions 7.4 and below are known to be vulnerable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rapid7/metasploit-framework/pull/20446 - https://www.vulncheck.com/blog/ictbroadcast-kev - https://www
ttps://github.com/rapid7/metasploit-framework/pull/20446 - https://www.vulncheck.com/blog/ictbroadcast-kev - https://www.vulncheck.com/advisories/ictbroadcast-unauthenticated-session-cookie-rce
CVE ID: CVE-2025-2613 State: PUBLISHED Published: 2025-04-18T01:44:10.917Z Last Updated: 2025-04-18T12:01:23.964Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: mehrazmorshed Products: Login Manager – Design Login Page, View Login Activity, Limit Login Attempts Problem Types: CWE-79 Description: The Login Manager – Design Login Page, View Login Activity, Limit Login Attempts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom logo and background URLs in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level perm
nput sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d2ea5e34-9303-43c8-8579-80ef02e1d9c4?source=cve - https://plugins.trac.wordpress.org/browser/customized-login/trunk/customized-login.php#L199
CVE ID: CVE-2025-2614 State: PUBLISHED Published: 2025-08-13T17:27:00.485Z Last Updated: 2025-08-13T18:31:35.236Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-770 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 11.6 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed an authenticated user to cause a denial of service condition by creating specially crafted content that consumes excessive server resources when processed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/526349 - https://
al Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/526349 - https://hackerone.com/reports/3015894
CVE ID: CVE-2025-2615 State: PUBLISHED Published: 2025-11-15T08:04:44.743Z Last Updated: 2025-11-17T20:16:30.455Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-201 Description: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.7 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2, that could have allowed a blocked user to access sensitive information by establishing GraphQL subscriptions through WebSocket connections. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://about.gitlab.com/releases/2025/11/12/patch-release-gitlab-18-5-2-released/ - https://gitlab.
ment: References: - https://about.gitlab.com/releases/2025/11/12/patch-release-gitlab-18-5-2-released/ - https://gitlab.com/gitlab-org/gitlab/-/issues/526360 - https://hackerone.com/reports/3049150
CVE ID: CVE-2025-2616 State: PUBLISHED Published: 2025-03-22T10:00:12.314Z Last Updated: 2025-04-01T16:24:54.625Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: yangyouwang 杨有旺 Products: crud 简约后台管理系统 Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic has been found in yangyouwang 杨有旺 crud 简约后台管理系统 1.0.0. Affected is an unknown function of the component Role Management Page. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300618 - https://vuldb.com/?cti
. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300618 - https://vuldb.com/?ctiid.300618 - https://vuldb.com/?submit.518962 - https://gitee.com/yangyouwang/crud/issues/IBSPOX
CVE ID: CVE-2025-2617 State: PUBLISHED Published: 2025-03-22T12:31:08.682Z Last Updated: 2025-03-24T13:52:11.677Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: yangyouwang 杨有旺 Products: crud 简约后台管理系统 Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic was found in yangyouwang 杨有旺 crud 简约后台管理系统 1.0.0. Affected by this vulnerability is an unknown functionality of the component Department Page. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300619 - https://vuldb.
be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300619 - https://vuldb.com/?ctiid.300619 - https://gitee.com/yangyouwang/crud/issues/IBSPOX
CVE ID: CVE-2025-2618 State: PUBLISHED Published: 2025-03-22T13:31:05.548Z Last Updated: 2025-03-24T17:35:20.659Z Severity: N/A (CVSS 10 AV:N/AC:L/Au:N/C:C/I:C/A:C) Vendors: D-Link Products: DAP-1620 Problem Types: CWE-122, CWE-119 Description: A vulnerability, which was classified as critical, has been found in D-Link DAP-1620 1.03. Affected by this issue is the function set_ws_action of the file /dws/api/ of the component Path Handler. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analy
d may be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300620 - https://vuldb.com/?ctiid.300620 - https://vuldb.com/?submit.518963 - https://witty-maiasaura-083.notion.site/D-link-DAP-1620-set_ws_action-Vulnerability-1afb2f2a6361804e86dcde1e78ea2a8e - https://www.dlink.com/
CVE ID: CVE-2025-2619 State: PUBLISHED Published: 2025-03-22T14:00:08.311Z Last Updated: 2025-03-24T17:32:29.501Z Severity: N/A (CVSS 10 AV:N/AC:L/Au:N/C:C/I:C/A:C) Vendors: D-Link Products: DAP-1620 Problem Types: CWE-121, CWE-119 Description: A vulnerability, which was classified as critical, was found in D-Link DAP-1620 1.03. This affects the function check_dws_cookie of the file /storage of the component Cookie Handler. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst
may be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300621 - https://vuldb.com/?ctiid.300621 - https://vuldb.com/?submit.518968 - https://witty-maiasaura-083.notion.site/D-link-DAP-1620-check_dws_cookie-Vulnerability-1b4b2f2a6361805ca74fdf4949385ade - https://www.dlink.com/
CVE ID: CVE-2025-2620 State: PUBLISHED Published: 2025-03-22T14:31:05.372Z Last Updated: 2025-03-24T17:31:40.840Z Severity: N/A (CVSS 10 AV:N/AC:L/Au:N/C:C/I:C/A:C) Vendors: D-Link Products: DAP-1620 Problem Types: CWE-121, CWE-119 Description: A vulnerability has been found in D-Link DAP-1620 1.03 and classified as critical. This vulnerability affects the function mod_graph_auth_uri_handler of the file /storage of the component Authentication Handler. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300622 - https://vuldb.com/?ctiid.300622 - https://vuldb.com/?submit.518969 - https://witty-maiasaura-083.notion.site/D-link-DAP-1620-mod_graph_auth_uri_handler-Vulnerability-1afb2f2a6361809ea7f2dc4df3b85f1f - https://www.dlink.com/
CVE ID: CVE-2025-2621 State: PUBLISHED Published: 2025-03-22T16:31:05.113Z Last Updated: 2025-03-24T13:03:44.046Z Severity: N/A (CVSS 10 AV:N/AC:L/Au:N/C:C/I:C/A:C) Vendors: D-Link Products: DAP-1620 Problem Types: CWE-121, CWE-119 Description: A vulnerability was found in D-Link DAP-1620 1.03 and classified as critical. This issue affects the function check_dws_cookie of the file /storage. The manipulation of the argument uid leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnr
ability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300623 - https://vuldb.com/?ctiid.300623 - https://vuldb.com/?submit.518980 - https://witty-maiasaura-083.notion.site/D-link-DAP-1620-check_dws_uid-Vulnerability-1b4b2f2a63618025b049f6e62a1835c0 - https://www.dlink.com/
CVE ID: CVE-2025-2622 State: PUBLISHED Published: 2025-03-22T17:00:17.206Z Last Updated: 2025-03-24T19:19:27.968Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: aizuda Products: snail-job Problem Types: CWE-502, CWE-20 Description: A vulnerability was found in aizuda snail-job 1.4.0. It has been classified as critical. Affected is the function getRuntime of the file /snail-job/workflow/check-node-expression of the component Workflow-Task Management Module. The manipulation of the argument nodeExpression leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnri
tack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300624 - https://vuldb.com/?ctiid.300624 - https://vuldb.com/?submit.518999 - https://gitee.com/aizuda/snail-job/issues/IBSQ24 - https://gitee.com/aizuda/snail-job/issues/IBSQ24#note_38500450_link
CVE ID: CVE-2025-2623 State: PUBLISHED Published: 2025-03-22T17:31:04.000Z Last Updated: 2025-03-24T14:28:04.765Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: westboy Products: CicadasCMS Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in westboy CicadasCMS 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /system/cms/content/save. The manipulation of the argument title/content/laiyuan leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/
losed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300625 - https://vuldb.com/?ctiid.300625 - https://vuldb.com/?submit.519294 - https://github.com/IceFoxH/VULN/issues/10
CVE ID: CVE-2025-2624 State: PUBLISHED Published: 2025-03-22T19:00:13.076Z Last Updated: 2025-03-24T12:55:42.108Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: westboy Products: CicadasCMS Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in westboy CicadasCMS 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /system/cms/content/save. The manipulation of the argument content/fujian/laiyuan leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300626 - htt
lic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300626 - https://vuldb.com/?ctiid.300626 - https://vuldb.com/?submit.519295 - https://github.com/IceFoxH/VULN/issues/11
CVE ID: CVE-2025-2625 State: PUBLISHED Published: 2025-03-22T20:00:07.218Z Last Updated: 2025-03-24T12:54:31.793Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: westboy Products: CicadasCMS Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in westboy CicadasCMS 1.0. This affects an unknown part of the file /system/cms/content/page. The manipulation of the argument orderField/orderDirection leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300627 - https://vuldb.co
e used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300627 - https://vuldb.com/?ctiid.300627 - https://vuldb.com/?submit.519296 - https://github.com/IceFoxH/VULN/issues/12
CVE ID: CVE-2025-2626 State: PUBLISHED Published: 2025-03-22T20:31:04.525Z Last Updated: 2025-03-24T12:53:41.810Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Kortex Lite Advocate Office Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in SourceCodester Kortex Lite Advocate Office Management System 1.0. This vulnerability affects unknown code of the file edit_case.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - h
oit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300628 - https://vuldb.com/?ctiid.300628 - https://vuldb.com/?submit.519307 - https://github.com/Hefei-Coffee/cve/issues/16 - https://www.sourcecodester.com/
CVE ID: CVE-2025-2627 State: PUBLISHED Published: 2025-03-22T21:00:07.866Z Last Updated: 2025-03-24T14:26:14.522Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: PHPGurukul Products: Art Gallery Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in PHPGurukul Art Gallery Management System 1.0. This issue affects some unknown processing of the file /admin/contactus.php. The manipulation of the argument pagetitle leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:/
s been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300629 - https://vuldb.com/?ctiid.300629 - https://vuldb.com/?submit.519335 - https://github.com/liuhao2638/cve/issues/1 - https://phpgurukul.com/
CVE ID: CVE-2025-2628 State: PUBLISHED Published: 2025-03-22T21:31:05.794Z Last Updated: 2025-03-24T14:00:22.519Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: PHPGurukul Products: Art Gallery Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in PHPGurukul Art Gallery Management System 1.1. Affected is an unknown function of the file /art-enquiry.php. The manipulation of the argument eid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300
o the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300630 - https://vuldb.com/?ctiid.300630 - https://vuldb.com/?submit.519615 - https://github.com/ydnd/cve/issues/3 - https://phpgurukul.com/
CVE ID: CVE-2025-2629 State: PUBLISHED Published: 2025-04-09T18:45:35.434Z Last Updated: 2025-04-09T18:58:49.944Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: NI Products: LabVIEW Problem Types: CWE-427 Description: There is a DLL hijacking vulnerability due to an uncontrolled search path that exists in NI LabVIEW when loading NI Error Reporting. This vulnerability may result in arbitrary code execution. Successful exploitation requires an attacker to insert a malicious DLL into the uncontrolled search path. This vulnerability affects NI LabVIEW 2025 Q1 and prior versions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ni.com/e
abVIEW 2025 Q1 and prior versions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/dll-hijacking-vulnerability-in-ni-labview-when-loading-ni-error-reporting.html
CVE ID: CVE-2025-2630 State: PUBLISHED Published: 2025-04-09T18:50:05.849Z Last Updated: 2025-04-09T18:57:44.369Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: NI Products: LabVIEW Problem Types: CWE-427 Description: There is a DLL hijacking vulnerability due to an uncontrolled search path that exists in NI LabVIEW. This vulnerability may result in arbitrary code execution. Successful exploitation requires an attacker to insert a malicious DLL into the uncontrolled search path. This vulnerability affects NI LabVIEW 2025 Q1 and prior versions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ni.com/en/support/security/available-cri
s. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/dll-hijacking-vulnerability-in-ni-labview.html
CVE ID: CVE-2025-2631 State: PUBLISHED Published: 2025-04-09T19:10:22.077Z Last Updated: 2025-04-09T19:32:46.740Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: NI Products: LabVIEW Problem Types: CWE-787 Description: Out of bounds write vulnerability due to improper bounds checking in NI LabVIEW in InitCPUInformation() that may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2025 Q1 and prior versions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ni.com/en/support/security/available-cri
s. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-bounds-write-vulnerabilities-in-ni-labview.html
CVE ID: CVE-2025-2632 State: PUBLISHED Published: 2025-04-09T19:14:00.977Z Last Updated: 2025-04-09T19:32:06.295Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: NI Products: LabVIEW Problem Types: CWE-787 Description: Out of bounds write vulnerability due to improper bounds checking in NI LabVIEW reading CPU info from cache that may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2025 Q1 and prior versions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ni.com/en/support/security/available
sions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-bounds-write-vulnerabilities-in-ni-labview.html
CVE ID: CVE-2025-2633 State: PUBLISHED Published: 2025-07-23T15:49:06.836Z Last Updated: 2025-07-23T17:23:55.255Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: NI Products: LabVIEW Problem Types: CWE-1285 Description: Out of bounds read vulnerability due to improper bounds checking in NI LabVIEW in lvre!UDecStrToNum that may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2025 Q1 and prior versions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ni.com/en/support/security/available-critic
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-bounds-read-vulnerabilities-in-ni-labview.html
CVE ID: CVE-2025-2634 State: PUBLISHED Published: 2025-07-23T15:53:25.130Z Last Updated: 2025-07-23T20:10:00.301Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: NI Products: LabVIEW Problem Types: CWE-1285 Description: Out of bounds read vulnerability due to improper bounds checking in NI LabVIEW in fontmgr may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2025 Q1 and prior versions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ni.com/en/support/security/available-critical-and-security
yst Notes: - CISA ADP Vulnrichment: References: - https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-bounds-read-vulnerabilities-in-ni-labview.html
CVE ID: CVE-2025-2635 State: PUBLISHED Published: 2025-03-25T09:22:03.045Z Last Updated: 2025-03-31T16:28:23.673Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: codeverve Products: Digital License Manager Problem Types: CWE-79 Description: The Digital License Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg() function without appropriate escaping on the URL in all versions up to, and including, 1.7.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link
scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a266e003-3a0a-4832-a88b-60c2a26b387c?source=cve - https://plugins.trac.wordpress.org/browser/digital-license-manager/trunk/includes/ListTables/Activations.php#L476 - https://wordpress.org/plugins/digital-license-manager/#developers - https://plugins.trac.wordpress.org/changeset/3260900/