Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-4774 State: PUBLISHED Published: 2025-06-10T11:22:51.611Z Last Updated: 2025-06-10T14:03:26.754Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: leap13 Products: Premium Addons for Elementor Problem Types: CWE-79 Description: The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-countdown attribute of Countdown widget in all versions up to, and including, 4.11.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a use
kers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/024af9de-d4c7-43ec-a602-c45ded3ddad3?source=cve - https://plugins.trac.wordpress.org/browser/premium-addons-for-elementor/tags/4.11.6/assets/frontend/js/jquery-countdown.js#L97
CVE ID: CVE-2025-4775 State: PUBLISHED Published: 2025-06-17T01:44:10.890Z Last Updated: 2025-06-17T13:41:14.481Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: dcooney Products: WordPress Infinite Scroll – Ajax Load More Problem Types: CWE-79 Description: The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-button-label HTML attribute in all versions up to, and including, 7.4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will exec
uthenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/614bdce2-bd87-4516-b1a5-028ffc08b238?source=cve - https://plugins.trac.wordpress.org/browser/ajax-load-more/tags/7.3.1.2/build/frontend/ajax-load-more.min.js
CVE ID: CVE-2025-4777 State: PUBLISHED Published: 2025-05-16T13:00:07.306Z Last Updated: 2025-05-16T13:20:52.171Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: PHPGurukul Products: Park Ticketing Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Park Ticketing Management System 2.0. It has been classified as critical. This affects an unknown part of the file /view-foreigner-ticket.php. The manipulation of the argument viewid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:
as been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309075 - https://vuldb.com/?ctiid.309075 - https://vuldb.com/?submit.572155 - https://github.com/f1rstb100d/myCVE/issues/3 - https://phpgurukul.com/
CVE ID: CVE-2025-4778 State: PUBLISHED Published: 2025-05-16T13:31:05.539Z Last Updated: 2025-05-16T13:53:27.345Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: PHPGurukul Products: Park Ticketing Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Park Ticketing Management System 2.0. It has been declared as critical. This vulnerability affects unknown code of the file /normal-search.php. The manipulation of the argument searchdata leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vul
en disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309076 - https://vuldb.com/?ctiid.309076 - https://vuldb.com/?submit.572161 - https://github.com/f1rstb100d/myCVE/issues/4 - https://phpgurukul.com/
CVE ID: CVE-2025-4779 State: PUBLISHED Published: 2025-07-07T09:53:10.901Z Last Updated: 2025-07-07T17:24:24.732Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-79 Description: lunary-ai/lunary versions prior to 1.9.24 are vulnerable to stored cross-site scripting (XSS). An unauthenticated attacker can inject malicious JavaScript into the `v1/runs/ingest` endpoint by adding an empty `citations` field, triggering a code path where `dangerouslySetInnerHTML` is used to render attacker-controlled text. This vulnerability allows the execution of arbitrary JavaScript in the context of the user's browser, p
controlled text. This vulnerability allows the execution of arbitrary JavaScript in the context of the user's browser, potentially leading to session hijacking, data theft, or other malicious actions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/c603b64e-5171-4eed-8983-a7f656ce2c4d - https://github.com/lunary-ai/lunary/commit/18750294a76ff6c0f3f1b6af4ac1a23399836b16
CVE ID: CVE-2025-4780 State: PUBLISHED Published: 2025-05-16T14:00:07.183Z Last Updated: 2025-05-16T14:32:01.250Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: PHPGurukul Products: Park Ticketing Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Park Ticketing Management System 2.0. It has been rated as critical. This issue affects some unknown processing of the file /foreigner-search.php. The manipulation of the argument searchdata leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309077 - https://vuldb.com/?ctiid.309077 - https://vuldb.com/?submit.572163 - https://github.com/f1rstb100d/myCVE/issues/5 - https://phpgurukul.com/
CVE ID: CVE-2025-4781 State: PUBLISHED Published: 2025-05-16T14:31:05.898Z Last Updated: 2025-05-16T14:50:12.971Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: PHPGurukul Products: Park Ticketing Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in PHPGurukul Park Ticketing Management System 2.0. Affected is an unknown function of the file /forgot-password.php. The manipulation of the argument email/contactno leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vu
een disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309078 - https://vuldb.com/?ctiid.309078 - https://vuldb.com/?submit.572164 - https://github.com/f1rstb100d/myCVE/issues/6 - https://phpgurukul.com/
CVE ID: CVE-2025-4782 State: PUBLISHED Published: 2025-05-16T14:31:07.428Z Last Updated: 2025-05-16T14:49:38.568Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester, oretnom23 Products: Stock Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in SourceCodester/oretnom23 Stock Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /sms/admin/?page=receiving/view_receiving&id=1. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichme
remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309082 - https://vuldb.com/?ctiid.309082 - https://vuldb.com/?submit.572195 - https://github.com/th3w0lf-1337/Vulnerabilities/blob/main/SMS-PHP/SQLi/Receiving/info.md
CVE ID: CVE-2025-4783 State: PUBLISHED Published: 2025-05-26T23:22:38.466Z Last Updated: 2025-05-27T13:50:34.034Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: timstrifler Products: Exclusive Addons for Elementor Problem Types: CWE-79 Description: The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML attributes of the Countdown Timer Widget in all versions up to, and including, 2.7.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whe
cated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ec41956f-eefc-4c8b-ade1-2a3a0f3d86df?source=cve - https://plugins.trac.wordpress.org/browser/exclusive-addons-for-elementor/tags/2.7.9.1/assets/js/elements-js/countdown-timer.js
CVE ID: CVE-2025-4784 State: PUBLISHED Published: 2025-07-24T13:27:16.922Z Last Updated: 2025-07-24T14:01:07.957Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Moderec Products: Tourtella Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Moderec Tourtella allows SQL Injection.This issue affects Tourtella: before 26.05.2025. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0176
CVE ID: CVE-2025-4785 State: PUBLISHED Published: 2025-05-16T15:00:10.236Z Last Updated: 2025-05-16T16:27:13.108Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Daily Expense Tracker System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Daily Expense Tracker System 1.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file /user-profile.php. The manipulation of the argument fullname/contactnumber leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
ploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309086 - https://vuldb.com/?ctiid.309086 - https://vuldb.com/?submit.572264 - https://github.com/f1rstb100d/myCVE/issues/9 - https://github.com/f1rstb100d/myCVE/issues/10 - https://phpgurukul.com/
CVE ID: CVE-2025-4786 State: PUBLISHED Published: 2025-05-16T15:31:04.590Z Last Updated: 2025-05-16T16:26:34.942Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester, oretnom23 Products: Stock Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in SourceCodester/oretnom23 Stock Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/?page=return/view_return. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
e exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309095 - https://vuldb.com/?ctiid.309095 - https://vuldb.com/?submit.572297 - https://github.com/th3w0lf-1337/Vulnerabilities/blob/main/SMS-PHP/SQLi/Return-List/info.md
CVE ID: CVE-2025-4787 State: PUBLISHED Published: 2025-05-16T16:00:06.459Z Last Updated: 2025-05-16T16:18:10.938Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester, oretnom23 Products: Stock Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in SourceCodester/oretnom23 Stock Management System 1.0. Affected is an unknown function of the file /admin/?page=sales/view_sale. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309096 - https://vuldb.com/?ctiid.309096 - https://vuldb.com/?submit.572333 - https://github.com/th3w0lf-1337/Vulnerabilities/blob/main/SMS-PHP/SQLi/Sale-List/info.md
CVE ID: CVE-2025-4788 State: PUBLISHED Published: 2025-05-16T16:31:03.528Z Last Updated: 2025-05-16T18:10:34.048Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: FreeFloat Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability classified as critical was found in FreeFloat FTP Server 1.0. Affected by this vulnerability is an unknown functionality of the component DELETE Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309097 - https://vuldb.com/?ctiid.309097 -
l Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309097 - https://vuldb.com/?ctiid.309097 - https://vuldb.com/?submit.572476 - https://fitoxs.com/exploit/exploit-cd619c9271a231511f4fa2de1cf569b7040376a5cfe23dc6060884c32638254e.txt
CVE ID: CVE-2025-4789 State: PUBLISHED Published: 2025-05-16T16:31:04.699Z Last Updated: 2025-05-16T18:10:02.204Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: FreeFloat Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0. Affected by this issue is some unknown functionality of the component LCD Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309098 - https://vuldb.com/?ctiid.
dditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309098 - https://vuldb.com/?ctiid.309098 - https://vuldb.com/?submit.572478 - https://fitoxs.com/exploit/exploit-23d12ba21a827aadd1af628488c8d5308103beb3a2038981aa59a1a6ee3fc7dd.txt
CVE ID: CVE-2025-4790 State: PUBLISHED Published: 2025-05-16T17:00:08.557Z Last Updated: 2025-05-16T18:09:33.483Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: FreeFloat Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0. This affects an unknown part of the component GLOB Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309099 - https://vuldb.com/?ctiid.309099 - https://
Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309099 - https://vuldb.com/?ctiid.309099 - https://vuldb.com/?submit.572479 - https://fitoxs.com/exploit/exploit-3b4e822c5e445f2fe48f704745994fc63a9300dacddaaeb5290b1149dd2d7704.txt
CVE ID: CVE-2025-4791 State: PUBLISHED Published: 2025-05-16T17:00:10.063Z Last Updated: 2025-05-16T18:09:00.778Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: FreeFloat Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability has been found in FreeFloat FTP Server 1.0 and classified as critical. This vulnerability affects unknown code of the component HASH Command Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309100 - https://vuldb.com/?ctiid.309100 - https://vu
otes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309100 - https://vuldb.com/?ctiid.309100 - https://vuldb.com/?submit.572480 - https://fitoxs.com/exploit/exploit-bc230ff2f41a996bdab8ab4072a38e2e99aa486f2d7f50f8f9e983adb7dc4536.txt
CVE ID: CVE-2025-4792 State: PUBLISHED Published: 2025-05-16T17:31:03.717Z Last Updated: 2025-05-16T17:57:41.008Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: FreeFloat Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in FreeFloat FTP Server 1.0 and classified as critical. This issue affects some unknown processing of the component MDELETE Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309101 - https://vuldb.com/?ctiid.309101 - https://v
Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309101 - https://vuldb.com/?ctiid.309101 - https://vuldb.com/?submit.572481 - https://fitoxs.com/exploit/exploit-fb7e880a8c21bdec1f4d3953a2c57bcc582b95ffc83513c7d709f45c15d60504.txt
CVE ID: CVE-2025-4793 State: PUBLISHED Published: 2025-05-16T18:00:10.610Z Last Updated: 2025-05-16T18:57:07.525Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Online Course Registration Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Online Course Registration 3.1. It has been classified as critical. Affected is an unknown function of the file /edit-student-profile.php. The manipulation of the argument cgpa leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?i
sed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309102 - https://vuldb.com/?ctiid.309102 - https://vuldb.com/?submit.572507 - https://github.com/FLYFISH567/CVE/issues/7 - https://phpgurukul.com/
CVE ID: CVE-2025-4794 State: PUBLISHED Published: 2025-05-16T18:00:13.866Z Last Updated: 2025-05-16T18:20:35.674Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Online Course Registration Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Online Course Registration 3.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /news.php. The manipulation of the argument newstitle leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.c
isclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309103 - https://vuldb.com/?ctiid.309103 - https://vuldb.com/?submit.572508 - https://github.com/FLYFISH567/CVE/issues/8 - https://phpgurukul.com/
CVE ID: CVE-2025-4795 State: PUBLISHED Published: 2025-05-16T18:31:04.344Z Last Updated: 2025-05-16T18:51:29.440Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: gongfuxiang Products: schoolcms Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in gongfuxiang schoolcms 2.3.1. This affects the function SaveInfo of the file /index.php?m=Admin&c=article&a=SaveInfo. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309105 - https://vu
may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309105 - https://vuldb.com/?ctiid.309105 - https://vuldb.com/?submit.572601 - https://github.com/adminnerr/cve/issues/1 - https://github.com/adminnerr/cve/issues/1#issue-3044819789
CVE ID: CVE-2025-4796 State: PUBLISHED Published: 2025-08-08T18:26:26.586Z Last Updated: 2025-08-08T18:58:03.058Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: arraytics Products: Eventin – Event Manager, Events Calendar, Booking, Tickets and Registration Problem Types: CWE-639 Description: The Eventin plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.34. This is due to the plugin not properly validating a user's identity or capability prior to updating their details like email in the 'Eventin\Speaker\Api\SpeakerController::update_item' function. This makes it possible for unauthenticate
ke email in the 'Eventin\Speaker\Api\SpeakerController::update_item' function. This makes it possible for unauthenticated attackers with contributor-level and above permissions to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9e0d441d-1da5-45e7-8a14-ce178099c0cc?source=cve - https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.0.28/core/speaker/Api/SpeakerController.php#L419 - https://plugins.trac.wordpress.org/changeset/3336972/wp-event-solution/trunk/cor
peaker/Api/SpeakerController.php#L419 - https://plugins.trac.wordpress.org/changeset/3336972/wp-event-solution/trunk/core/speaker/Api/SpeakerController.php#file0
CVE ID: CVE-2025-4797 State: PUBLISHED Published: 2025-06-03T04:22:16.085Z Last Updated: 2025-06-03T14:50:25.735Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: uxper Products: Golo - City Travel Guide WordPress Theme Problem Types: CWE-288 Description: The Golo - City Travel Guide WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.7.0. This is due to the plugin not properly validating a user's identity prior to setting an authorization cookie. This makes it possible for unauthenticated attackers to log in as any user, including administrators, provided they know the user'
it possible for unauthenticated attackers to log in as any user, including administrators, provided they know the user's email address. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e7b56ec1-8735-4404-8069-219f5d8866d0?source=cve - https://themeforest.net/item/golo-directory-listing-travel-wordpress-theme/25397810
CVE ID: CVE-2025-4798 State: PUBLISHED Published: 2025-06-11T03:41:52.636Z Last Updated: 2025-06-11T13:24:30.120Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: gamerz Products: WP-DownloadManager Problem Types: CWE-200 Description: The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.68.10. This is due to a lack of restriction on the directory an administrator can select for storing downloads. This makes it possible for authenticated attackers, with Administrator-level access and above, to download and read any file on the server, including system and configuration files. Additional Analys