Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
supplied input. This makes it possible for unauthenticated attackers to execute arbitrary PHP code on the server via a forged request granted they can guess or brute-force the numeric key. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3eb3533c-e33c-41db-b9cf-e9d71a0a5588?source=cve - https://plugins.trac.wordpress.org/browser/intelligent-importer/tags/5.1.4/megaimporter.php#L57 - https://plugins.trac.wordpress.org/browser/intelligent-importer/tags/5.1.4/communication.php#L20 - https://plugins.trac.wordpress.org/browser/intelligent-importer/tags/5.1.4/communication.php#L244 - https://plugins.trac.wordpress.org/browse
wordpress.org/browser/intelligent-importer/tags/5.1.4/communication.php#L244 - https://plugins.trac.wordpress.org/browser/intelligent-importer/tags/5.1.4/communication.php#L272 - https://plugins.trac.wordpress.org/browser/intelligent-importer/tags/5.1.4/communication.php#L300
CVE ID: CVE-2025-8418 State: PUBLISHED Published: 2025-08-12T06:42:42.438Z Last Updated: 2025-08-12T16:05:41.590Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: bplugins Products: B Slider- Gutenberg Slider Block for WP Problem Types: CWE-862 Description: The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Arbitrary Plugin Installation in all versions up to, and including, 1.1.30. This is due to missing capability checks on the activated_plugin function. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins on the server which can make remote code execution possib
ubscriber-level access and above, to install arbitrary plugins on the server which can make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/deffd646-5117-4086-bf4b-8a17ffdaad8b?source=cve - https://plugins.trac.wordpress.org/browser/b-slider/tags/1.1.28/adminMenu.php#L124 - https://plugins.trac.wordpress.org/changeset/3342079/b-slider/trunk/adminMenu.php
CVE ID: CVE-2025-8419 State: PUBLISHED Published: 2025-08-06T17:10:02.560Z Last Updated: 2025-11-20T21:00:06.387Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Red Hat Products: Red Hat build of Keycloak 26.0, Red Hat build of Keycloak 26.2 Problem Types: CWE-93 Description: A vulnerability was found in Keycloak-services. Special characters used during e-mail registration may perform SMTP Injection and unexpectedly send short unwanted e-mails. The email is limited to 64 characters (limited local part of the email), so the attack is limited to very shorts emails (subject and little data, the example is 60 chars). This flaw's only direct consequence is an un
d to very shorts emails (subject and little data, the example is 60 chars). This flaw's only direct consequence is an unsolicited email being sent from the Keycloak server. However, this action could be a precursor for more sophisticated attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:15336 - https://access.redhat.com/errata/RHSA-2025:15337 - https://access.redhat.com/errata/RHSA-2025:15338 - https://access.redhat.com/errata/RHSA-2025:15339 - https://access.redhat.com/security/cve/CVE-2025-8419 - https://bugzilla.redhat.com/show_bug.cgi?id=2385776
CVE ID: CVE-2025-8420 State: PUBLISHED Published: 2025-08-06T02:24:12.120Z Last Updated: 2025-08-06T13:36:32.676Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: emarket-design Products: Request a Quote Form Plugin – Price Quote Request Management Made Easy Problem Types: CWE-95 Description: The Request a Quote Form plugin for WordPress is vulnerable to Remote Code Execution in version less than, or equal to, 2.5.2 via the emd_form_builder_lite_pagenum function. This is due to the plugin not properly validating user input before using it as a function name. This makes it possible for unauthenticated attackers to execute code on the server, however, parameters
function name. This makes it possible for unauthenticated attackers to execute code on the server, however, parameters can not be passed to the functions called. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/601aa2b5-aeac-49bc-960d-4b4ff83e9229?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3338854%40request-a-quote&new=3338854%40request-a-quote&sfp_email=&sfph_mail=
CVE ID: CVE-2025-8421 State: PUBLISHED Published: 2025-11-12T19:17:59.562Z Last Updated: 2025-11-12T21:03:45.571Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H) Vendors: Lenovo Products: Dock Manager Problem Types: CWE-276 Description: An improper default permission vulnerability was reported in Lenovo Dock Manager that, under certain conditions during installation, could allow an authenticated local user to redirect log files with elevated privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-198729
CVE ID: CVE-2025-8422 State: PUBLISHED Published: 2025-09-11T07:24:52.172Z Last Updated: 2025-09-11T14:40:42.031Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: fassionstorage Products: Propovoice: All-in-One Client Management System Problem Types: CWE-73 Description: The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.7.6.7 via the send_email() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
s on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3ac72d7a-9540-435f-93cb-fdd4104b18f7?source=cve - https://plugins.trac.wordpress.org/browser/propovoice/trunk/includes/Api/Type/Email.php#L275
CVE ID: CVE-2025-8423 State: PUBLISHED Published: 2025-09-11T07:24:54.340Z Last Updated: 2025-09-11T14:39:52.532Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: mythemeshop Products: My WP Translate Problem Types: CWE-862 Description: The My WP Translate plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mtswpt_remove_plugin() and ajax_update_export_code() functions in all versions up to, and including, 1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read and delete arbitrary WordPress options which can cause a denial of service. Additional Anal
el access and above, to read and delete arbitrary WordPress options which can cause a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5bda56c3-56ad-40d7-b743-0b69512ec460?source=cve - https://plugins.trac.wordpress.org/browser/my-wp-translate/tags/1.1/admin/class-my-wp-translate-admin.php#L1138 - https://plugins.trac.wordpress.org/browser/my-wp-translate/tags/1.1/admin/class-my-wp-translate-admin.php#L1069 - https://plugins.trac.wordpress.org/browser/my-wp-translate/tags/1.1/admin/class-my-wp-translate-admin.php#L1130 - https://plugins.trac.wordpress.org/browser/my-wp-translate/tags/1.1/admin/class-
class-my-wp-translate-admin.php#L1130 - https://plugins.trac.wordpress.org/browser/my-wp-translate/tags/1.1/admin/class-my-wp-translate-admin.php#L1048
CVE ID: CVE-2025-8424 State: PUBLISHED Published: 2025-08-26T13:11:10.822Z Last Updated: 2025-08-27T14:08:11.099Z Vendors: NetScaler Products: ADC, Gateway Problem Types: CWE-1284 Description: Improper access control on the NetScaler Management Interface in NetScaler ADC and NetScaler Gateway when an attacker can get access to the appliance NSIP, Cluster Management IP or local GSLB Site IP or SNIP with Management Access Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938
CVE ID: CVE-2025-8425 State: PUBLISHED Published: 2025-09-11T07:25:02.207Z Last Updated: 2025-09-11T14:37:12.109Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: mythemeshop Products: My WP Translate Problem Types: CWE-862 Description: The My WP Translate plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the ajax_import_strings() function in all versions up to, and including, 1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default
-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ef46b08f-455a-4c61-81ac-10af19b16980?source=cve - https://plugins.trac.wordpress.org/browser/my-wp-translate/tags/1.1/admin/class-my-wp-translate-admin.php#L1116
CVE ID: CVE-2025-8426 State: PUBLISHED Published: 2025-07-31T17:57:54.748Z Last Updated: 2025-07-31T18:26:02.364Z Severity: CRITICAL (CVSS 9.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H) Vendors: Marvell Products: QConvergeConsole Problem Types: CWE-22 Description: Marvell QConvergeConsole compressConfigFiles Directory Traversal Information Disclosure and Denial-of-Service Vulnerability. This vulnerability allows remote attackers to disclose sensitive information or to create a denial-of-service condition on affected installations of Marvell QConvergeConsole. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the compressConf
on is not required to exploit this vulnerability. The specific flaw exists within the implementation of the compressConfigFiles method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose sensitive information or to create a denial-of-service condition on the system. Was ZDI-CAN-24915. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-733/
CVE ID: CVE-2025-8427 State: PUBLISHED Published: 2025-10-23T12:32:32.028Z Last Updated: 2025-10-23T13:40:34.247Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: The Beaver Builder Team Products: Beaver Builder Plugin (Starter Version) Problem Types: CWE-79 Description: The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘auto_play’ parameter in all versions up to, and including, 2.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execu
thenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/afec9b5b-da37-4e12-935e-9d3bb3ca01f0?source=cve - https://www.wpbeaverbuilder.com/change-logs/
CVE ID: CVE-2025-8428 State: PUBLISHED Published: 2025-10-14T14:22:03.098Z Last Updated: 2025-10-14T16:01:54.470Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: Centreon Products: Infra Monitoring Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (HTTP Loader widget modules) allows Stored XSS.This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/centreon/centreon/releases - https://the
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/centreon/centreon/releases - https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-8428-centreon-web-all-versions-medium-severity-5103
CVE ID: CVE-2025-8429 State: PUBLISHED Published: 2025-10-14T15:29:56.095Z Last Updated: 2025-10-15T13:14:03.171Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Centreon Products: Infra Monitoring Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (ACL Action access configuration modules) allows Stored XSS by users with elevated privileges. This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git
ore 24.04.18, from 23.10.0 before 23.10.28. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/centreon/centreon/releases - https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-8429-centreon-web-all-versions-medium-severity-5119
CVE ID: CVE-2025-8430 State: PUBLISHED Published: 2025-10-14T16:54:43.948Z Last Updated: 2025-10-15T13:13:42.544Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Centreon Products: Infra Monitoring Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Commands Connectors configuration modules) allows Stored XSS by users with elevated privileges. This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://g
efore 24.04.18, from 23.10.0 before 23.10.28. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/centreon/centreon/releases - https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-8430-centreon-web-all-versions-medium-severity-5118
CVE ID: CVE-2025-8431 State: PUBLISHED Published: 2025-08-01T01:32:06.690Z Last Updated: 2025-08-01T14:23:57.064Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Boat Booking System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in PHPGurukul Boat Booking System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/add-boat.php. The manipulation of the argument boatname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.
d to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318460 - https://vuldb.com/?ctiid.318460 - https://vuldb.com/?submit.625262 - https://github.com/shiqumeng/myCVE/issues/3 - https://phpgurukul.com/
CVE ID: CVE-2025-8432 State: PUBLISHED Published: 2025-10-27T10:08:33.662Z Last Updated: 2025-10-30T13:51:12.045Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: Centreon Products: Infra Monitoring Problem Types: CWE-276 Description: Incorrect Default Permissions vulnerability in Centreon Infra Monitoring (MBI modules) allows Embedding Scripts within Scripts by CentreonBI user account on the MBI server This issue affects Infra Monitoring: from 24.10.0 before 24.10.6, from 24.04.0 before 24.04.9, from 23.10.0 before 23.10.15. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/centreon/centreon/releases - https://thewatch.centreo
t Notes: - CISA ADP Vulnrichment: References: - https://github.com/centreon/centreon/releases - https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-8432-centreon-mbi-high-severity-5180
CVE ID: CVE-2025-8433 State: PUBLISHED Published: 2025-08-01T03:02:05.714Z Last Updated: 2025-08-01T19:09:33.112Z Severity: N/A (CVSS 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Document Management System Problem Types: CWE-22 Description: A vulnerability was found in code-projects Document Management System 1.0 and classified as critical. This issue affects the function unlink of the file /dell.php. The manipulation of the argument ID leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318461 -
public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318461 - https://vuldb.com/?ctiid.318461 - https://vuldb.com/?submit.625532 - https://github.com/i-Corner/cve/issues/14 - https://code-projects.org/
CVE ID: CVE-2025-8434 State: PUBLISHED Published: 2025-08-01T04:02:05.474Z Last Updated: 2025-08-01T13:45:40.728Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Online Movie Streaming Problem Types: CWE-862, CWE-863 Description: A vulnerability was found in code-projects Online Movie Streaming 1.0. It has been classified as critical. Affected is an unknown function of the file /admin.php. The manipulation of the argument ID leads to missing authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vul
en disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318462 - https://vuldb.com/?ctiid.318462 - https://vuldb.com/?submit.625534 - https://github.com/i-Corner/cve/issues/15 - https://code-projects.org/
CVE ID: CVE-2025-8435 State: PUBLISHED Published: 2025-08-01T04:32:05.921Z Last Updated: 2025-08-01T13:54:01.915Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Online Movie Streaming Problem Types: CWE-862, CWE-863 Description: A vulnerability was found in code-projects Online Movie Streaming 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin-control.php. The manipulation of the argument ID leads to missing authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: R
tely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318463 - https://vuldb.com/?ctiid.318463 - https://github.com/i-Corner/cve/issues/15 - https://code-projects.org/
CVE ID: CVE-2025-8436 State: PUBLISHED Published: 2025-08-01T05:32:05.434Z Last Updated: 2025-08-01T13:50:54.916Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: projectworlds Products: Online Admission System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in projectworlds Online Admission System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /viewdoc.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vu
een disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318464 - https://vuldb.com/?ctiid.318464 - https://vuldb.com/?submit.625554 - https://github.com/Sunhaobin318/CVE/issues/2
CVE ID: CVE-2025-8437 State: PUBLISHED Published: 2025-08-01T06:02:05.273Z Last Updated: 2025-08-01T13:28:55.914Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Kitchen Treasure Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in code-projects Kitchen Treasure 1.0. This affects an unknown part of the file /userregistration.php. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318465
he public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318465 - https://vuldb.com/?ctiid.318465 - https://vuldb.com/?submit.625555 - https://github.com/wllovemy/cve/issues/16 - https://code-projects.org/
CVE ID: CVE-2025-8438 State: PUBLISHED Published: 2025-08-01T06:32:05.721Z Last Updated: 2025-08-01T13:23:23.527Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Wazifa System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in code-projects Wazifa System 1.0. This vulnerability affects unknown code of the file /controllers/postpublish.php. The manipulation of the argument post leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318466 - h
ublic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318466 - https://vuldb.com/?ctiid.318466 - https://vuldb.com/?submit.625556 - https://github.com/wllovemy/cve/issues/15 - https://code-projects.org/
CVE ID: CVE-2025-8439 State: PUBLISHED Published: 2025-08-01T07:02:05.913Z Last Updated: 2025-08-01T13:00:33.979Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Wazifa System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in code-projects Wazifa System 1.0. This issue affects some unknown processing of the file /controllers/updatesettings.php. The manipulation of the argument Password leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https
has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318467 - https://vuldb.com/?ctiid.318467 - https://vuldb.com/?submit.625557 - https://github.com/wllovemy/cve/issues/14 - https://code-projects.org/
CVE ID: CVE-2025-8440 State: PUBLISHED Published: 2025-09-27T01:46:23.544Z Last Updated: 2025-09-29T13:57:06.859Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: spwebguy Products: Team Members Problem Types: CWE-79 Description: The Team Members plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the first and last name fields in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst N