Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-8719 State: PUBLISHED Published: 2025-08-16T08:27:06.935Z Last Updated: 2025-08-18T17:47:02.058Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: reubenthiessen Products: Translate This gTranslate Shortcode Problem Types: CWE-79 Description: The Translate This gTranslate Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘base_lang’ parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user ac
, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a7f1a21c-2de0-4f41-b61e-7c4742900762?source=cve - https://plugins.svn.wordpress.org/translate-this-google-translate-web-element-shortcode/trunk/translate_this_plugin.php - https://wordpress.org/plugins/translate-this-google-translate-web-element-shortcode/#developers
CVE ID: CVE-2025-8720 State: PUBLISHED Published: 2025-08-15T08:25:40.186Z Last Updated: 2025-08-15T16:11:28.906Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: morehawes Products: Plugin README Parser Problem Types: CWE-79 Description: The Plugin README Parser plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘target’ parameter in all versions up to, and including, 1.3.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional
above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/aad6151a-6897-4d0c-9dfb-0f424c683111?source=cve - https://plugins.svn.wordpress.org/wp-readme-parser/tags/1.3.15/includes/generate-output.php - https://wordpress.org/plugins/wp-readme-parser/#developers
CVE ID: CVE-2025-8721 State: PUBLISHED Published: 2025-09-11T07:24:49.077Z Last Updated: 2025-09-11T14:41:45.197Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: miriamgoldman Products: Workable Api Problem Types: CWE-79 Description: The Workable Api plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's workable_jobs shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses
contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/01cf3196-1817-4506-8f70-ca54cc5e09f9?source=cve - https://plugins.svn.wordpress.org/wrapper-for-workable-api/tags/1.0.4/workable-api.php - https://wordpress.org/plugins/wrapper-for-workable-api/#developers
CVE ID: CVE-2025-8722 State: PUBLISHED Published: 2025-09-06T03:22:34.608Z Last Updated: 2025-09-08T20:16:34.316Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: pt-guy Products: Content Views – Post Grid & Filter, Recent Posts, Category Posts … (Shortcode, Blocks, and Elementor Widgets) Problem Types: CWE-79 Description: The Content Views plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Grid and List widgets in all versions up to, and including, 4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and abo
g on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/12443e0c-2a03-4f62-bf89-cf0497f44a26?source=cve - https://plugins.trac.wordpress.org/browser/content-views-query-and-display-post-page/trunk/elementor/render.php#L30 - https://wordpress.org/plugins/content-views-query-and-display-post-page/#developers - https://plugins.trac.wordpress.org/changeset/3350005/
CVE ID: CVE-2025-8723 State: PUBLISHED Published: 2025-08-19T07:26:26.487Z Last Updated: 2025-08-19T13:19:05.368Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: mecanik Products: Cloudflare Image Resizing – Optimize & Accelerate Your Images Problem Types: CWE-94 Description: The Cloudflare Image Resizing plugin for WordPress is vulnerable to Remote Code Execution due to missing authentication and insufficient sanitization within its hook_rest_pre_dispatch() method in all versions up to, and including, 1.5.6. This makes it possible for unauthenticated attackers to inject arbitrary PHP into the codebase, achieving remote code execution. Additional Analyst N
authenticated attackers to inject arbitrary PHP into the codebase, achieving remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0f3b3c1a-1d45-4e2f-854a-171fe759257b?source=cve - https://wordpress.org/plugins/cf-image-resizing/#developers - https://plugins.trac.wordpress.org/changeset/3337593/ - https://plugins.trac.wordpress.org/changeset/3341917/
CVE ID: CVE-2025-8726 State: PUBLISHED Published: 2025-10-04T02:24:35.924Z Last Updated: 2025-10-06T14:18:39.543Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: opajaap Products: WP Photo Album Plus Problem Types: CWE-79 Description: The WP Photo Album Plus plugin for WordPress is vulnerable to Cross-Site Scripting in all versions up to, and including, 9.0.11.006 due to insufficient input sanitization and output escaping in the wppa_user_upload function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in the photo album descriptions that execute in a victim's browser. Additional Ana
bove, to inject arbitrary web scripts in the photo album descriptions that execute in a victim's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/575b11a3-9fa4-4ee0-8f19-7d53e6c1785f?source=cve - https://plugins.trac.wordpress.org/browser/wp-photo-album-plus/tags/9.0.09.003/wppa-functions.php#L4977 - https://plugins.trac.wordpress.org/changeset/3349261/wp-photo-album-plus
CVE ID: CVE-2025-8727 State: PUBLISHED Published: 2025-11-18T07:52:09.494Z Last Updated: 2025-11-19T16:49:01.793Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: SMCI Products: X13SEDW-F Problem Types: CWE-121 Description: There is a vulnerability in the Supermicro BMC web function at Supermicro MBD-X13SEDW-F. After logging into the BMC Web server, an attacker can use a specially crafted payload to trigger the Stack buffer overflow vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.supermicro.com/zh_tw/support/security_BMC_IPMI_Nov_2025
CVE ID: CVE-2025-8729 State: PUBLISHED Published: 2025-08-08T13:32:06.603Z Last Updated: 2025-08-08T13:54:25.540Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C) Vendors: MigoXLab Products: LMeterX Problem Types: CWE-22 Description: A vulnerability has been found in MigoXLab LMeterX 1.2.0 and classified as critical. Affected by this vulnerability is the function process_cert_files of the file backend/service/upload_service.py. The manipulation of the argument task_id leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is f1b00597e293d09452aabd4fa57f3185207350e8. It is reco
losed to the public and may be used. The identifier of the patch is f1b00597e293d09452aabd4fa57f3185207350e8. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319225 - https://vuldb.com/?ctiid.319225 - https://vuldb.com/?submit.621741 - https://github.com/MigoXLab/LMeterX/issues/10 - https://github.com/MigoXLab/LMeterX/issues/10#issuecomment-3136380379 - https://github.com/MigoXLab/LMeterX/issues/10#issue-3255375024 - https://github.com/MigoXLab/LMeterX/commit/f1b00597e293d09452aabd4fa57f3185207350e8
CVE ID: CVE-2025-8730 State: PUBLISHED Published: 2025-08-08T14:32:05.215Z Last Updated: 2025-08-08T14:51:56.546Z Severity: N/A (CVSS 10 AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Belkin Products: F9K1009, F9K1010 Problem Types: CWE-798, CWE-259 Description: A vulnerability was found in Belkin F9K1009 and F9K1010 2.00.04/2.00.09 and classified as critical. Affected by this issue is some unknown functionality of the component Web Interface. The manipulation leads to hard-coded credentials. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional
public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319226 - https://vuldb.com/?ctiid.319226 - https://vuldb.com/?submit.621747 - https://vuldb.com/?submit.621748 - https://vuldb.com/?submit.621760 - https://github.com/Nicholas-wei/bug-discovery/blob/main/belkin/F9K1009_WW_2.00.09/belkin%20F9K1009_WW_2.00.09_hardcoded_credential.pdf - https://github.com/Nicholas-wei/bug-discovery/blob/main/belkin/F9K1010_WW_2.00.04/belkin_F9K1010_WW_2.00.04_hardcoded_credential.pdf
CVE ID: CVE-2025-8731 State: PUBLISHED Published: 2025-08-08T15:32:05.773Z Last Updated: 2025-08-13T08:18:21.779Z Severity: N/A (CVSS 10 AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: TRENDnet Products: TI-G160i, TI-PG102i, TPL-430AP Problem Types: CWE-1392 Description: A vulnerability was identified in TRENDnet TI-G160i, TI-PG102i and TPL-430AP up to 20250724. This affects an unknown part of the component SSH Service. The manipulation leads to use of default credentials. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor explains: "For produc
d may be used. The real existence of this vulnerability is still doubted at the moment. The vendor explains: "For product TI-PG102i and TI-G160i, by default, the product's remote management options are all disabled. The root account is for troubleshooting purpose and the password is encrypted. However, we will remove the root account from the next firmware release. For product TPL-430AP, the initial setup process requires user to set the password for the management GUI. Once that was done, the default password will be invalid." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319227 - https://vuldb.com/?ctiid.319227 - https://vuldb.com/?submit.621749 - h
ent: References: - https://vuldb.com/?id.319227 - https://vuldb.com/?ctiid.319227 - https://vuldb.com/?submit.621749 - https://github.com/Nicholas-wei/bug-discovery/blob/main/trendnet/TPL-430AP_FW1.0.1/trendnet_several_vulns.pdf
CVE ID: CVE-2025-8732 State: PUBLISHED Published: 2025-08-08T16:32:06.990Z Last Updated: 2025-08-08T17:12:15.735Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C) Vendors: n/a Products: libxml2 Problem Types: CWE-674, CWE-404 Description: A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatalog of the component xmlcatalog. The manipulation leads to uncontrolled recursion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains
c and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains, that "[t]he issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. I also doubt that anyone is still using SGML catalogs at all." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319228 - https://vuldb.com/?ctiid.319228 - https://vuldb.com/?submit.622285 - https://gitlab.gnome.org/GNOME/libxml2/-/issues/958 - https://gitlab.gnome.org/GNOME/libxml2/-/issues/958#note_2505853 - https://drive.google.com/file/d/1woIeYVcSQB_NwfEhaVnX6MedpWJ_nqWl/view?usp=drive_link
CVE ID: CVE-2025-8733 State: REJECTED Published: 2025-08-08T17:32:06.798Z Last Updated: 2025-11-03T23:19:26.799Z Description: No description available.
CVE ID: CVE-2025-8734 State: REJECTED Published: 2025-08-08T18:02:07.827Z Last Updated: 2025-11-03T23:19:28.363Z Description: No description available.
CVE ID: CVE-2025-8735 State: PUBLISHED Published: 2025-08-08T18:32:06.777Z Last Updated: 2025-10-28T00:43:32.142Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R) Vendors: GNU Products: cflow Problem Types: CWE-476, CWE-404 Description: A vulnerability classified as problematic was found in GNU cflow up to 1.8. Affected by this vulnerability is the function yylex of the file c.c of the component Lexer. The manipulation leads to null pointer dereference. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.c
d may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.319231 - https://vuldb.com/?ctiid.319231 - https://vuldb.com/?submit.622328 - https://lists.gnu.org/archive/html/bug-cflow/2025-07/msg00000.html - https://drive.google.com/file/d/1Q_rDQSEl3cBu6SUbfqr9pV9cHgvKcXFI/view?usp=drive_link - https://www.gnu.org/
CVE ID: CVE-2025-8736 State: PUBLISHED Published: 2025-08-08T19:02:06.444Z Last Updated: 2025-08-08T19:15:48.325Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: GNU Products: cflow Problem Types: CWE-120, CWE-119 Description: A vulnerability, which was classified as critical, has been found in GNU cflow up to 1.8. Affected by this issue is the function yylex of the file c.c of the component Lexer. The manipulation leads to buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319232 -
public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319232 - https://vuldb.com/?ctiid.319232 - https://vuldb.com/?submit.622329 - https://lists.gnu.org/archive/html/bug-cflow/2025-07/msg00001.html - https://drive.google.com/file/d/17lkJ5bSiQZoXLTg3bK-rGBt3kahN9Xse/view?usp=drive_link - https://www.gnu.org/
CVE ID: CVE-2025-8737 State: PUBLISHED Published: 2025-08-08T19:32:05.170Z Last Updated: 2025-08-08T19:49:33.165Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: zlt2000 Products: microservices-platform Problem Types: CWE-601 Description: A vulnerability, which was classified as problematic, was found in zlt2000 microservices-platform up to 6.0.0. This affects the function onLogoutSuccess of the file src/main/java/com/central/oauth/handler/OauthLogoutSuccessHandler.java. The manipulation of the argument redirect_url leads to open redirect. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Anal
possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319233 - https://vuldb.com/?ctiid.319233 - https://vuldb.com/?submit.623477 - https://github.com/zlt2000/microservices-platform/issues/78 - https://github.com/zlt2000/microservices-platform/issues/78#issue-3264847333
CVE ID: CVE-2025-8738 State: PUBLISHED Published: 2025-08-08T20:02:05.143Z Last Updated: 2025-08-08T20:10:02.279Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:R) Vendors: zlt2000 Products: microservices-platform Problem Types: CWE-200, CWE-284 Description: A vulnerability has been found in zlt2000 microservices-platform up to 6.0.0 and classified as problematic. This vulnerability affects unknown code of the file /actuator of the component Spring Actuator Interface. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vul
itiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319234 - https://vuldb.com/?ctiid.319234 - https://vuldb.com/?submit.623478 - https://github.com/zlt2000/microservices-platform/issues/79 - https://github.com/zlt2000/microservices-platform/issues/79#issue-3264850271
CVE ID: CVE-2025-8739 State: PUBLISHED Published: 2025-08-08T20:32:05.403Z Last Updated: 2025-08-12T14:22:56.587Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: zhenfeng13 Products: My-Blog Problem Types: CWE-352, CWE-862 Description: A vulnerability was found in zhenfeng13 My-Blog up to 1.0.0 and classified as problematic. This issue affects some unknown processing of the file /admin/tags/save. The manipulation of the argument tagName leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319235
he public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319235 - https://vuldb.com/?ctiid.319235 - https://vuldb.com/?submit.623479 - https://github.com/ZHENFENG13/My-Blog/issues/145
CVE ID: CVE-2025-8740 State: PUBLISHED Published: 2025-08-08T21:02:06.233Z Last Updated: 2025-08-12T14:24:41.773Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: zhenfeng13 Products: My-Blog Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in zhenfeng13 My-Blog up to 1.0.0. It has been classified as problematic. Affected is an unknown function of the file /admin/categories/save of the component Category Handler. The manipulation of the argument categoryName leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichmen
remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319236 - https://vuldb.com/?ctiid.319236 - https://vuldb.com/?submit.623480 - https://github.com/ZHENFENG13/My-Blog/issues/146 - https://github.com/ZHENFENG13/My-Blog/issues/146#issue-3265304545
CVE ID: CVE-2025-8741 State: PUBLISHED Published: 2025-08-08T21:32:05.880Z Last Updated: 2025-08-12T14:25:35.871Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: macrozheng Products: mall Problem Types: CWE-319, CWE-310 Description: A vulnerability was found in macrozheng mall up to 1.0.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/login. The manipulation leads to cleartext transmission of sensitive information. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public
xity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319237 - https://vuldb.com/?ctiid.319237 - https://vuldb.com/?submit.623318 - https://github.com/N1n3b9S/cve/issues/10 - https://github.com/N1n3b9S/cve/issues/10#issue-3262475757
CVE ID: CVE-2025-8742 State: PUBLISHED Published: 2025-08-08T22:02:05.587Z Last Updated: 2025-08-12T14:26:18.671Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R) Vendors: macrozheng Products: mall Problem Types: CWE-307, CWE-799 Description: A vulnerability was found in macrozheng mall 1.0.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Admin Login. The manipulation leads to improper restriction of excessive authentication attempts. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The vendor was contacted early about this di
ity of an attack is rather high. The exploitation is known to be difficult. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319238 - https://vuldb.com/?ctiid.319238 - https://vuldb.com/?submit.623319 - https://github.com/N1n3b9S/cve/issues/12
CVE ID: CVE-2025-8743 State: PUBLISHED Published: 2025-08-08T23:02:06.249Z Last Updated: 2025-08-12T13:40:16.964Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: n/a Products: Scada-LTS Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic has been found in Scada-LTS up to 2.7.8.1. This affects an unknown part of the file /data_source_edit.shtm of the component Virtual Data Source Property Handler. The manipulation of the argument Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
he exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319239 - https://vuldb.com/?ctiid.319239 - https://vuldb.com/?submit.623428 - https://github.com/marcelomulder/CVE/blob/main/Scada-LTS/CVE-2025-8743.md - https://github.com/marcelomulder/CVE/blob/main/Scada-LTS/Cross-Site_Scripting_(XSS)_Stored_endpoint_data_source_edit.shtm_parameter_name.md#poc
CVE ID: CVE-2025-8744 State: PUBLISHED Published: 2025-08-08T23:32:05.337Z Last Updated: 2025-08-12T13:39:45.066Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:W/RC:C) Vendors: CesiumLab Products: Web Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in CesiumLab Web up to 4.0. This vulnerability affects unknown code of the file /lodmodels/. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
cted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319240 - https://vuldb.com/?ctiid.319240 - https://vuldb.com/?submit.616911