Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
st Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322325 - https://vuldb.com/?ctiid.322325 - https://vuldb.com/?submit.642503 - https://vuldb.com/?submit.642504 - https://vuldb.com/?submit.642523 - https://vuldb.com/?submit.642524 - https://github.com/zzb1388/cve/issues/67 - https://www.campcodes.com/
CVE ID: CVE-2025-9924 State: PUBLISHED Published: 2025-09-03T18:32:08.762Z Last Updated: 2025-09-03T18:50:29.407Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: projectworlds Products: Travel Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in projectworlds Travel Management System 1.0. This vulnerability affects unknown code of the file /enquiry.php. The manipulation of the argument t2 leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322326 - https:
and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322326 - https://vuldb.com/?ctiid.322326 - https://vuldb.com/?submit.642578 - https://github.com/JunGu-W/cve/issues/7
CVE ID: CVE-2025-9925 State: PUBLISHED Published: 2025-09-03T19:32:06.882Z Last Updated: 2025-09-03T20:13:03.083Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: projectworlds Products: Travel Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in projectworlds Travel Management System 1.0. This issue affects some unknown processing of the file /detail.php. The manipulation of the argument pid results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322327 - https://vuldb.com/?ctiid.3
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322327 - https://vuldb.com/?ctiid.322327 - https://vuldb.com/?submit.642579 - https://github.com/JunGu-W/cve/issues/8
CVE ID: CVE-2025-9926 State: PUBLISHED Published: 2025-09-03T20:02:06.607Z Last Updated: 2025-09-03T20:13:38.964Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: projectworlds Products: Travel Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was determined in projectworlds Travel Management System 1.0. Impacted is an unknown function of the file /viewsubcategory.php. This manipulation of the argument t1 causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322328 - http
nd may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322328 - https://vuldb.com/?ctiid.322328 - https://vuldb.com/?submit.642580 - https://github.com/JunGu-W/cve/issues/9
CVE ID: CVE-2025-9927 State: PUBLISHED Published: 2025-09-03T20:32:06.576Z Last Updated: 2025-09-03T20:47:29.849Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: projectworlds Products: Travel Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was identified in projectworlds Travel Management System 1.0. The affected element is an unknown function of the file /viewpackage.php. Such manipulation of the argument t1 leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322329 - https://vuld
ht be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322329 - https://vuldb.com/?ctiid.322329 - https://vuldb.com/?submit.642583 - https://github.com/JunGu-W/cve/issues/10
CVE ID: CVE-2025-9928 State: PUBLISHED Published: 2025-09-03T21:02:06.094Z Last Updated: 2025-09-04T15:57:21.106Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: projectworlds Products: Travel Management System Problem Types: CWE-89, CWE-74 Description: A security flaw has been discovered in projectworlds Travel Management System 1.0. The impacted element is an unknown function of the file /viewcategory.php. Performing manipulation of the argument t1 results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://v
released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322330 - https://vuldb.com/?ctiid.322330 - https://vuldb.com/?submit.642587 - https://github.com/JunGu-W/cve/issues/11
CVE ID: CVE-2025-9929 State: PUBLISHED Published: 2025-09-03T21:32:07.017Z Last Updated: 2025-09-04T15:42:27.346Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Responsive Blog Site Problem Types: CWE-79, CWE-94 Description: A weakness has been identified in code-projects Responsive Blog Site 1.0. This affects an unknown function of the file blogs_view.php. Executing manipulation of the argument product_code/gen_name/product_name/supplier can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichme
he exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322331 - https://vuldb.com/?ctiid.322331 - https://vuldb.com/?submit.642586 - https://github.com/chen2496088236/CVE/issues/5 - https://code-projects.org/
CVE ID: CVE-2025-9930 State: PUBLISHED Published: 2025-09-03T21:32:09.494Z Last Updated: 2025-09-04T19:58:49.699Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: 1000projects Products: Beauty Parlour Management System Problem Types: CWE-89, CWE-74 Description: A security vulnerability has been detected in 1000projects Beauty Parlour Management System 1.0. This impacts an unknown function of the file /admin/contact-us.php. The manipulation of the argument mobnumber leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.co
en disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322332 - https://vuldb.com/?ctiid.322332 - https://vuldb.com/?submit.642912 - https://github.com/Miker132/CVE-/issues/2
CVE ID: CVE-2025-9931 State: PUBLISHED Published: 2025-09-03T22:02:07.472Z Last Updated: 2025-09-04T19:59:48.284Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Jinher Products: OA Problem Types: CWE-79, CWE-94 Description: A vulnerability was detected in Jinher OA 1.0. Affected is an unknown function of the file /jc6/platform/sys/login!changePassWord.action of the component POST Request Handler. The manipulation of the argument Account results in cross site scripting. The attack can be launched remotely. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322333 - https://vuldb.com/?c
ed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322333 - https://vuldb.com/?ctiid.322333 - https://vuldb.com/?submit.642997 - https://github.com/1276486/CVE/issues/4
CVE ID: CVE-2025-9932 State: PUBLISHED Published: 2025-09-03T22:02:10.599Z Last Updated: 2025-09-04T20:00:21.390Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Beauty Parlour Management System Problem Types: CWE-89, CWE-74 Description: A flaw has been found in PHPGurukul Beauty Parlour Management System 1.1. Affected by this vulnerability is an unknown functionality of the file /admin/update-image.php. This manipulation of the argument lid causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322334
ublished and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322334 - https://vuldb.com/?ctiid.322334 - https://vuldb.com/?submit.643034 - https://github.com/xiaoxinkaishi/cve/issues/3 - https://phpgurukul.com/
CVE ID: CVE-2025-9933 State: PUBLISHED Published: 2025-09-03T22:32:08.159Z Last Updated: 2025-09-04T20:04:17.121Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Beauty Parlour Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in PHPGurukul Beauty Parlour Management System 1.1. Affected by this issue is some unknown functionality of the file /admin/view-appointment.php. Such manipulation of the argument viewid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322335 - https://vuldb.com/?ctiid.322335 - https://vuldb.com/?submit.643038 - https://github.com/xiaoxinkaishi/cve/issues/4 - https://phpgurukul.com/
CVE ID: CVE-2025-9934 State: PUBLISHED Published: 2025-09-03T22:32:13.436Z Last Updated: 2025-09-04T20:04:50.551Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: TOTOLINK Products: X5000R Problem Types: CWE-77, CWE-74 Description: A vulnerability was found in TOTOLINK X5000R 9.1.0cu.2415_B20250515. This affects the function sub_410C34 of the file /cgi-bin/cstecgi.cgi. Performing manipulation of the argument pid results in command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322336 - https://vuldb.com/?ctiid.3223
ional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322336 - https://vuldb.com/?ctiid.322336 - https://vuldb.com/?submit.643048 - https://github.com/Axelioc/CVE/blob/main/TOTOLINK/X5000R/sub_410C34/sub_410C34.md - https://github.com/Axelioc/CVE/blob/main/TOTOLINK/X5000R/sub_410C34/sub_410C34.md#poc - https://www.totolink.net/
CVE ID: CVE-2025-9935 State: PUBLISHED Published: 2025-09-03T23:02:09.840Z Last Updated: 2025-09-04T14:38:03.901Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: TOTOLINK Products: N600R Problem Types: CWE-77, CWE-74 Description: A vulnerability was determined in TOTOLINK N600R 4.3.0cu.7866_B20220506. This vulnerability affects the function sub_4159F8 of the file /web_cste/cgi-bin/cstecgi.cgi. Executing manipulation can lead to command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322337 - https://vuldb.com/?ctiid
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322337 - https://vuldb.com/?ctiid.322337 - https://vuldb.com/?submit.643088 - https://github.com/mono7s/TOTOLINK/blob/main/N600R/TOTOLINK%20N600R%20Unauthorized_Command_Injection.md - https://www.totolink.net/
CVE ID: CVE-2025-9936 State: PUBLISHED Published: 2025-09-03T23:02:13.499Z Last Updated: 2025-09-04T14:24:18.636Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: fuyang_lipengjun Products: platform Problem Types: CWE-285, CWE-266 Description: A vulnerability was identified in fuyang_lipengjun platform 1.0.0. This issue affects the function AdController of the file /ad/queryAll. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322338 - https://vuldb.com/?ct
d. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322338 - https://vuldb.com/?ctiid.322338 - https://vuldb.com/?submit.643388 - https://www.cnblogs.com/aibot/p/19063425
CVE ID: CVE-2025-9937 State: PUBLISHED Published: 2025-09-03T23:32:07.846Z Last Updated: 2025-09-04T14:20:12.906Z Severity: N/A (CVSS 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: elunez Products: eladmin Problem Types: CWE-285, CWE-266 Description: A security flaw has been discovered in elunez eladmin 1.1. Impacted is the function deleteFile of the component LocalStorageController. The manipulation results in improper authorization. The attack may be performed from remote. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322339 - https://vuldb.com/?ctiid.322339 - https://vuld
es: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322339 - https://vuldb.com/?ctiid.322339 - https://vuldb.com/?submit.643392 - https://www.cnblogs.com/aibot/p/19063329
CVE ID: CVE-2025-9938 State: PUBLISHED Published: 2025-09-03T23:32:10.606Z Last Updated: 2025-09-04T14:13:49.217Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: D-Link Products: DI-8400 Problem Types: CWE-121, CWE-119 Description: A weakness has been identified in D-Link DI-8400 16.07.26A1. The affected element is the function yyxz_dlink_asp of the file /yyxz.asp. This manipulation of the argument ID causes stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322340 - https://vuld
exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322340 - https://vuldb.com/?ctiid.322340 - https://vuldb.com/?submit.643446 - https://github.com/ZZ2266/.github.io/tree/main/Dlink/DI-8400/yyxz.asp - https://github.com/ZZ2266/.github.io/tree/main/Dlink/DI-8400/yyxz.asp#proof-of-concept-poc - https://www.dlink.com/
CVE ID: CVE-2025-9939 State: PUBLISHED Published: 2025-09-04T00:02:06.522Z Last Updated: 2025-09-04T14:05:04.268Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: CodeAstro Products: Real Estate Management System Problem Types: CWE-79, CWE-94 Description: A security vulnerability has been detected in CodeAstro Real Estate Management System 1.0. The impacted element is an unknown function of the file /propertyview.php. Such manipulation of the argument msg leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb
been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322341 - https://vuldb.com/?ctiid.322341 - https://vuldb.com/?submit.643540 - https://github.com/YZS17/CVE/blob/main/CodeAstro_Real_Estate_Management_System/admin_propertyview.php_xss.md - https://codeastro.com/
CVE ID: CVE-2025-9940 State: PUBLISHED Published: 2025-09-04T00:02:09.306Z Last Updated: 2025-09-04T14:03:31.467Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: CodeAstro Products: Real Estate Management System Problem Types: CWE-79, CWE-94 Description: A vulnerability was detected in CodeAstro Real Estate Management System 1.0. This affects an unknown function of the file /feature.php. Performing manipulation of the argument msg results in cross site scripting. The attack can be initiated remotely. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322342 - https://vuldb.com/?ctiid.3
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322342 - https://vuldb.com/?ctiid.322342 - https://vuldb.com/?submit.643541 - https://github.com/YZS17/CVE/blob/main/CodeAstro_Real_Estate_Management_System/feature.php_XSS.md - https://codeastro.com/
CVE ID: CVE-2025-9941 State: PUBLISHED Published: 2025-09-04T00:32:06.757Z Last Updated: 2025-09-04T18:58:24.887Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: CodeAstro Products: Real Estate Management System Problem Types: CWE-434, CWE-284 Description: A flaw has been found in CodeAstro Real Estate Management System 1.0. This impacts an unknown function of the file /register.php. Executing manipulation of the argument uimage can lead to unrestricted upload. The attack can be launched remotely. The exploit has been published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322343 - https://vuldb.com/?cti
. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322343 - https://vuldb.com/?ctiid.322343 - https://vuldb.com/?submit.643542 - https://github.com/YZS17/CVE/blob/main/CodeAstro_Real_Estate_Management_System/register.php_file_upload.md - https://codeastro.com/
CVE ID: CVE-2025-9942 State: PUBLISHED Published: 2025-09-04T00:32:09.375Z Last Updated: 2025-09-04T18:41:52.458Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: CodeAstro Products: Real Estate Management System Problem Types: CWE-434, CWE-284 Description: A vulnerability has been found in CodeAstro Real Estate Management System 1.0. Affected is an unknown function of the file /submitproperty.php. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322344 - https://vuldb.com/?ctiid.
dditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322344 - https://vuldb.com/?ctiid.322344 - https://vuldb.com/?submit.643543 - https://github.com/YZS17/CVE/blob/main/CodeAstro_Real_Estate_Management_System/submitproperty.php_file_upload.md - https://codeastro.com/
CVE ID: CVE-2025-9943 State: PUBLISHED Published: 2025-09-10T06:45:50.883Z Last Updated: 2025-11-04T22:06:49.754Z Vendors: Shibboleth Products: Service Provider Problem Types: CWE-89 Description: An SQL injection vulnerability has been identified in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Service Provider (SP) is configured to use an SQL database as storage service. An unauthenticated attacker can exploit this issue via blind SQL injection, allowing for the extraction of arbitrary data from the database, if the database connection is configured to use the ODBC plugin. The vulnerability arises from insufficient escaping of single quotes in the class SQL
configured to use the ODBC plugin. The vulnerability arises from insufficient escaping of single quotes in the class SQLString (file odbc-store.cpp, lines 253-271). This issue affects Shibboleth Service Provider through 3.5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://shibboleth.net/community/advisories/secadv_20250903.txt - https://r.sec-consult.com/shibboleth - https://shibboleth.net/downloads/service-provider/3.5.1/
CVE ID: CVE-2025-9944 State: PUBLISHED Published: 2025-09-27T06:47:15.568Z Last Updated: 2025-09-29T19:10:36.049Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: kelderic Products: Professional Contact Form Problem Types: CWE-352 Description: The Professional Contact Form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the watch_for_contact_form_submit function. This makes it possible for unauthenticated attackers to trigger test email sending via a forged request granted they can trick a site administrator into performing an action such as c
test email sending via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b8a82989-e7e7-484a-b619-3897d88872b9?source=cve - https://plugins.trac.wordpress.org/browser/professional-contact-form/tags/1.0.0/includes/mailer.php#L31
CVE ID: CVE-2025-9945 State: PUBLISHED Published: 2025-10-03T11:17:13.929Z Last Updated: 2025-10-03T14:57:35.436Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: aryadhiratara Products: Optimize More! – CSS Problem Types: CWE-352 Description: The Optimize More! – CSS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing or incorrect nonce validation on the reset_plugin function. This makes it possible for unauthenticated attackers to reset the plugin's optimization settings via a forged request granted they can trick a site administrator into performing an action such as clicking
on settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/64aadd20-a831-4550-b68d-827722a35c0f?source=cve - https://plugins.trac.wordpress.org/browser/optimize-more-css/trunk/includes/classes/Settings.php#L216
CVE ID: CVE-2025-9946 State: PUBLISHED Published: 2025-09-30T03:35:33.403Z Last Updated: 2025-09-30T13:15:29.780Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: lockerpress Products: LockerPress – WordPress Security Plugin Problem Types: CWE-352 Description: The LockerPress – WordPress Security Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing
tings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e9cf6b7f-d2b0-47f9-beec-8773f260c088?source=cve - https://plugins.trac.wordpress.org/browser/lockerpress-wordpress-security/trunk/core.php#L174 - https://plugins.trac.wordpress.org/browser/lockerpress-wordpress-security/trunk/views/login_url.php#L20
CVE ID: CVE-2025-9947 State: PUBLISHED Published: 2025-10-11T09:28:41.618Z Last Updated: 2025-10-14T18:44:56.669Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: kunalnagar Products: Custom 404 Pro Problem Types: CWE-89 Description: The Custom 404 Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ‘path’ parameter in all versions up to, and including, 3.12.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries t