Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
o the public and may be used. Upgrading to version 2.89 and 2.90 is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early about these issues and acted very professional. Version 2.89 is fixing this issue for new customers and 2.90 is going to fix it for existing customers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300170 - https://vuldb.com/?ctiid.300170 - https://vuldb.com/?submit.513393 - https://github.com/geo-chen/Audi/blob/main/README.md#finding-4-execute-remote-commands
CVE ID: CVE-2025-2558 State: PUBLISHED Published: 2025-04-24T06:00:07.297Z Last Updated: 2025-04-24T14:39:00.705Z Vendors: Unknown Products: the-wound Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The-wound WordPress theme through 0.0.1 does not validate some parameters before using them to generate paths passed to include function/s, allowing unauthenticated users to perform LFI attacks and download arbitrary file from the server Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/6a8e1c89-a01d-4347-91fc-ba454784b153/
CVE ID: CVE-2025-2559 State: PUBLISHED Published: 2025-03-25T08:20:57.666Z Last Updated: 2025-11-20T21:01:16.476Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Build of Keycloak, Red Hat build of Keycloak 26.0, Red Hat Single Sign-On 7 Problem Types: CWE-770 Description: A flaw was found in Keycloak. When the configuration uses JWT tokens for authentication, the tokens are cached until expiration. If a client uses JWT tokens with an excessively long expiration time, for example, 24 or 48 hours, the cache can grow indefinitely, leading to an OutOfMemoryError. This issue could result in a denial of service condition, preventing legi
indefinitely, leading to an OutOfMemoryError. This issue could result in a denial of service condition, preventing legitimate users from accessing the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:4335 - https://access.redhat.com/errata/RHSA-2025:4336 - https://access.redhat.com/security/cve/CVE-2025-2559 - https://bugzilla.redhat.com/show_bug.cgi?id=2353868
CVE ID: CVE-2025-2560 State: PUBLISHED Published: 2025-05-19T06:00:05.453Z Last Updated: 2025-05-19T13:48:23.454Z Vendors: Unknown Products: Ninja Forms Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2adaa55a-4a6d-40ca-ae19-fcb82420894a/
CVE ID: CVE-2025-2561 State: PUBLISHED Published: 2025-05-19T06:00:05.777Z Last Updated: 2025-05-19T13:44:53.252Z Vendors: Unknown Products: Ninja Forms Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/4a2074a3-a479-4473-92fb-04397f20dd86/
CVE ID: CVE-2025-2562 State: PUBLISHED Published: 2025-03-26T17:24:37.280Z Last Updated: 2025-03-26T18:18:25.425Z Vendors: Devolutions Products: Remote Desktop Manager Problem Types: CWE-778 Description: Insufficient logging in the autotyping feature in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use a stored password without generating a corresponding log event, via the use of the autotyping functionality. This issue affects Remote Desktop Manager versions from 2025.1.24 through 2025.1.25, and all versions up to 2024.3.29. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2025-0005/
CVE ID: CVE-2025-2563 State: PUBLISHED Published: 2025-04-14T06:00:09.509Z Last Updated: 2025-08-27T12:00:20.215Z Vendors: Unknown Products: User Registration & Membership Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The User Registration & Membership WordPress plugin before 4.1.2 does not prevent users to set their account role when the Membership Addon is enabled, leading to a privilege escalation issue and allowing unauthenticated users to gain admin privileges Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2c0f62a1-9510-4f90-a297-17634e6c8b75/
CVE ID: CVE-2025-2564 State: PUBLISHED Published: 2025-04-16T16:12:14.742Z Last Updated: 2025-04-17T19:41:45.158Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-863 Description: Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to properly enforce the 'Allow users to view/update archived channels' System Console setting, which allows authenticated users to view members and member information of archived channels even when this setting is disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-2565 State: PUBLISHED Published: 2025-03-20T16:10:06.826Z Last Updated: 2025-03-27T18:39:55.953Z Vendors: Liferay Products: Portal, DXP Problem Types: CWE-201 Description: The data exposure vulnerability in Liferay Portal 7.4.0 through 7.4.3.126, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92 allows an unauthorized user to obtain entry data from forms. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2025-2565
CVE ID: CVE-2025-2566 State: PUBLISHED Published: 2025-06-24T18:27:21.479Z Last Updated: 2025-06-24T18:47:46.713Z Vendors: Kaleris Products: Navis N4 Problem Types: CWE-502 Description: Kaleris NAVIS N4 ULC (Ultra Light Client) contains an unsafe Java deserialization vulnerability. An unauthenticated attacker can make specially crafted requests to execute arbitrary code on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-175-01
CVE ID: CVE-2025-2567 State: PUBLISHED Published: 2025-04-15T19:59:32.609Z Last Updated: 2025-04-15T20:09:58.788Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Lantronix Products: Xport Problem Types: CWE-306 Description: An attacker could modify or disable settings, disrupt fuel monitoring and supply chain operations, leading to disabling of ATG monitoring. This would result in potential safety hazards in fuel storage and transportation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-05
CVE ID: CVE-2025-2568 State: PUBLISHED Published: 2025-04-08T11:11:30.860Z Last Updated: 2025-04-08T13:01:03.193Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: themehunk Products: Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce Problem Types: CWE-862 Description: The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the 'vayu_blocks_get_toggle_switch_values_callback' and 'vayu_blocks_save_toggle_switch_callback' function in versions 1.0.4 to 1.2.1. This makes it possible for unauthenticated attackers to read plugin opti
_callback' function in versions 1.0.4 to 1.2.1. This makes it possible for unauthenticated attackers to read plugin options and update any option with a key name ending in '_value'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/27ca93a1-3dfc-4bbd-834a-1c04d9e22ebf?source=cve - https://plugins.trac.wordpress.org/browser/vayu-blocks/trunk/inc/function.php#L126 - https://plugins.trac.wordpress.org/browser/vayu-blocks/trunk/inc/function.php#L133 - https://plugins.trac.wordpress.org/browser/vayu-blocks/trunk/inc/function.php#L139 - https://plugins.trac.wordpress.org/browser/vayu-blocks/trunk/inc/function.php#L182 - https
trunk/inc/function.php#L139 - https://plugins.trac.wordpress.org/browser/vayu-blocks/trunk/inc/function.php#L182 - https://plugins.trac.wordpress.org/changeset/3263702/
CVE ID: CVE-2025-2570 State: PUBLISHED Published: 2025-05-15T15:27:50.280Z Last Updated: 2025-05-15T15:47:16.151Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-863 Description: Mattermost versions 10.5.x <= 10.5.3, 9.11.x <= 9.11.11 fail to check `RestrictSystemAdmin` setting if user doesn't have access to `ExperimentalSettings` which allows a System Manager to access `ExperimentSettings` when `RestrictSystemAdmin` is true via System Console. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-2571 State: PUBLISHED Published: 2025-05-30T14:22:08.913Z Last Updated: 2025-05-30T14:44:40.129Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-303 Description: Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to clear Google OAuth credentials when converting user accounts to bot accounts, allowing attackers to gain unauthorized access to bot accounts via the Google OAuth signup flow. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-2572 State: PUBLISHED Published: 2025-04-14T16:06:45.424Z Last Updated: 2025-04-14T18:07:07.373Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Progress Software Corporation Products: WhatsUp Gold Problem Types: CWE-287 Description: In WhatsUp Gold versions released before 2024.0.3, a database manipulation vulnerability allows an unauthenticated attacker to modify the contents of WhatsUp.dbo.WrlsMacAddressGroup. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.progress.com/network-monitoring - https://docs.progress.com/bundle/whatsupgold-release-notes-24-0/page/WhatsUp-Gold-2024.0-Release-Notes.html
CVE ID: CVE-2025-2573 State: PUBLISHED Published: 2025-03-26T02:23:48.765Z Last Updated: 2025-03-26T18:46:04.454Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: zia420 Products: Amazing service box Addons For WPBakery Page Builder (formerly Visual Composer) Problem Types: CWE-79 Description: The Amazing service box Addons For WPBakery Page Builder (formerly Visual Composer) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject
n and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a4f6ce4d-6ca5-4a62-ae84-9dd190fc0392?source=cve - https://plugins.trac.wordpress.org/browser/amazing-service-box-visual-composer-addons/trunk/asb_addon.php#L114 - https://plugins.trac.wordpress.org/browser/amazing-service-box-visual-composer-addons/trunk/asb_addon.php#L45 - https://wordpress.org/plugins/amazing-service-box-visual-composer-addons/#developers
CVE ID: CVE-2025-2574 State: PUBLISHED Published: 2025-03-20T21:07:46.499Z Last Updated: 2025-10-06T22:32:59.827Z Vendors: Xpdf Products: Xpdf Problem Types: CWE-190 Description: Out-of-bounds array write in Xpdf 4.05 and earlier, due to incorrect integer overflow checking in the PostScript function interpreter code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.xpdfreader.com/security-bug/CVE-2025-2574.html
CVE ID: CVE-2025-2575 State: PUBLISHED Published: 2025-04-11T11:11:57.129Z Last Updated: 2025-04-11T13:22:37.709Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpzita Products: Z Companion Problem Types: CWE-79 Description: The Z Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Note: This requires Royal Shop theme to be inst
cripts in pages that will execute whenever a user accesses the SVG file. Note: This requires Royal Shop theme to be installed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e0f7bba4-76c3-4904-bd96-2074147b33f5?source=cve - https://plugins.trac.wordpress.org/browser/z-companion/trunk/import/importer/wxr-importer.php#L149 - https://plugins.trac.wordpress.org/browser/z-companion/trunk/import/importer/wxr-importer.php#L63 - https://plugins.trac.wordpress.org/browser/z-companion/trunk/import/inc/importer.php#L148 - https://plugins.trac.wordpress.org/browser/z-companion/trunk/import/inc/importer.php#L62 - https://wordpres
r.php#L148 - https://plugins.trac.wordpress.org/browser/z-companion/trunk/import/inc/importer.php#L62 - https://wordpress.org/plugins/z-companion/#developers - https://plugins.trac.wordpress.org/changeset/3270130/
CVE ID: CVE-2025-2576 State: PUBLISHED Published: 2025-03-26T02:23:48.216Z Last Updated: 2025-03-26T14:43:03.100Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themerox Products: Ayyash Studio — The kick-start kit Problem Types: CWE-79 Description: The Ayyash Studio — The kick-start kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
evel access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/634fa1ed-ad6b-4875-b6f9-f20add39dc80?source=cve - https://plugins.trac.wordpress.org/browser/ayyash-studio/tags/1.0.3/includes/Importer/Wxr/StudioImporter.php#L351 - https://plugins.trac.wordpress.org/browser/ayyash-studio/tags/1.0.3/includes/Importer/Wxr/StudioImporter.php#L37 - https://wordpress.org/plugins/ayyash-studio/#developers
CVE ID: CVE-2025-2577 State: PUBLISHED Published: 2025-03-22T11:18:39.536Z Last Updated: 2025-04-01T16:23:45.444Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bitspecter Products: Bitspecter Suite Problem Types: CWE-79 Description: The Bitspecter Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA
rbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1e0f35be-fbd1-4063-a1c8-a8e4398d8f0a?source=cve - https://plugins.svn.wordpress.org/bitspecter-suite/trunk/includes/Hardening/BitspecterSuiteHardening.php - https://wordpress.org/plugins/bitspecter-suite/#developers - https://plugins.trac.wordpress.org/changeset/3259470/
CVE ID: CVE-2025-2578 State: PUBLISHED Published: 2025-03-28T07:33:04.467Z Last Updated: 2025-03-28T14:35:39.786Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: ameliabooking Products: Booking for Appointments and Events Calendar &#8211; Amelia Problem Types: CWE-200 Description: The Booking for Appointments and Events Calendar &#8211; Amelia plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2.19 via the 'wpAmeliaApiCall' function. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not usef
ieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6806e07b-96bf-43ad-a3ac-2105e7449e3c?source=cve - https://plugins.trac.wordpress.org/browser/ameliabooking/trunk/ameliabooking.php#L172 - https://plugins.trac.wordpress.org/browser/ameliabooking/trunk/src/Application/Commands/Entities/GetEntitiesCommandHandler.php#L127 - https://plugins.trac.wordpress.org/changeset/3261318/
CVE ID: CVE-2025-2579 State: PUBLISHED Published: 2025-04-24T08:23:50.232Z Last Updated: 2025-04-24T13:54:32.582Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bplugins Products: Lottie Player- Great Lottie Player Solution Problem Types: CWE-79 Description: The Lottie Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File uploads in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the uploaded file. Additional
above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the uploaded file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b85b314d-a155-4cec-95c9-0db4b9d8e59b?source=cve - https://plugins.trac.wordpress.org/browser/embed-lottie-player/tags/1.1.8/plugin.php#L82 - https://plugins.trac.wordpress.org/browser/embed-lottie-player/tags/1.1.8/plugin.php#L130 - https://wordpress.org/plugins/embed-lottie-player/#developers
CVE ID: CVE-2025-2580 State: PUBLISHED Published: 2025-04-25T05:25:06.373Z Last Updated: 2025-04-25T19:01:14.207Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bitpressadmin Products: Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder Problem Types: CWE-79 Description: The Contact Form by Bit Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.18.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitr
utput escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1f3b5d85-a8b0-43ac-b593-a61e20b9a4ca?source=cve - https://wordpress.org/plugins/bit-form/#developers - https://plugins.trac.wordpress.org/changeset/3271396/
CVE ID: CVE-2025-2581 State: PUBLISHED Published: 2025-03-21T05:00:22.250Z Last Updated: 2025-11-03T19:45:09.550Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:N/A:P) Vendors: n/a Products: xmedcon Problem Types: CWE-191, CWE-189 Description: A vulnerability has been found in xmedcon 0.25.0 and classified as problematic. Affected by this vulnerability is the function malloc of the component DICOM File Handler. The manipulation leads to integer underflow. The attack can be launched remotely. Upgrading to version 0.25.1 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https
the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.300541 - https://vuldb.com/?ctiid.300541 - https://vuldb.com/?submit.522216 - https://xmedcon.sourceforge.io/Main/New
CVE ID: CVE-2025-2582 State: PUBLISHED Published: 2025-03-21T06:31:04.195Z Last Updated: 2025-04-21T12:41:42.523Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SimpleMachines Products: SMF Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in SimpleMachines SMF 2.1.4 and classified as problematic. Affected by this issue is some unknown functionality of the file ManageAttachments.php. The manipulation of the argument Notice leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor does not declare this issue
e used. The real existence of this vulnerability is still doubted at the moment. The vendor does not declare this issue a security vulnerability due to authentication requirements before being able to access any feature in the software that allows file modification. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300542 - https://vuldb.com/?ctiid.300542 - https://vuldb.com/?submit.511999 - https://github.com/Fewword/Poc/blob/main/smf/smf-poc3.md - https://github.com/Fewword/Poc/blob/main/smf/smf-poc4.md
CVE ID: CVE-2025-2583 State: PUBLISHED Published: 2025-03-21T06:31:06.127Z Last Updated: 2025-04-21T12:41:44.675Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SimpleMachines Products: SMF Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in SimpleMachines SMF 2.1.4. It has been classified as problematic. This affects an unknown part of the file ManageNews.php. The manipulation of the argument subject/message leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor does not declare this issue a
used. The real existence of this vulnerability is still doubted at the moment. The vendor does not declare this issue a security vulnerability due to authentication requirements before being able to access any feature in the software that allows file modification. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300543 - https://vuldb.com/?ctiid.300543 - https://vuldb.com/?submit.512001 - https://github.com/Fewword/Poc/blob/main/smf/smf-poc5.md - https://github.com/Fewword/Poc/blob/main/smf/smf-poc6.md