Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-59989 State: PUBLISHED Published: 2025-10-09T16:11:03.170Z Last Updated: 2025-10-09T19:48:11.763Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Juniper Networks Products: Junos Space Problem Types: CWE-79 Description: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Device Discovery page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. Additional Analyst Notes: -
s, including an administrator. This issue affects all versions of Junos Space before 24.1R4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA103140
CVE ID: CVE-2025-59990 State: PUBLISHED Published: 2025-10-09T16:11:42.999Z Last Updated: 2025-10-09T19:48:04.888Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Juniper Networks Products: Junos Space Problem Types: CWE-79 Description: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the template creation pages that, when visited by another user, enable the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. Additional Analyst Notes:
ns, including an administrator. This issue affects all versions of Junos Space before 24.1R4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA103140
CVE ID: CVE-2025-59991 State: PUBLISHED Published: 2025-10-09T16:12:18.687Z Last Updated: 2025-10-09T19:47:58.402Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Juniper Networks Products: Junos Space Problem Types: CWE-79 Description: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Device Management pages that, when visited by another user, enable the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. Additional Analyst Notes:
CVE ID: CVE-2025-59992 State: PUBLISHED Published: 2025-10-09T16:12:42.750Z Last Updated: 2025-10-09T19:47:53.093Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Juniper Networks Products: Junos Space Problem Types: CWE-79 Description: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Secure Console page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. Additional Analyst Notes: - C
including an administrator. This issue affects all versions of Junos Space before 24.1R4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA103140
CVE ID: CVE-2025-59993 State: PUBLISHED Published: 2025-10-09T16:13:18.696Z Last Updated: 2025-10-09T19:47:47.486Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Juniper Networks Products: Junos Space Problem Types: CWE-79 Description: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Space Node Setting fields that, when visited by another user, enable the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. Additional Analyst Notes
ions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA103140
CVE ID: CVE-2025-59994 State: PUBLISHED Published: 2025-10-09T16:13:42.534Z Last Updated: 2025-10-09T19:47:42.237Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Juniper Networks Products: Junos Space Problem Types: CWE-79 Description: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Quick Template page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. Additional Analyst Notes: - C
CVE ID: CVE-2025-59995 State: PUBLISHED Published: 2025-10-09T16:14:13.515Z Last Updated: 2025-10-09T19:47:36.800Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Juniper Networks Products: Junos Space Problem Types: CWE-79 Description: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Quick Template page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. Additional Analyst Notes: - C
CVE ID: CVE-2025-59996 State: PUBLISHED Published: 2025-10-09T16:14:35.544Z Last Updated: 2025-10-09T19:47:31.628Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Juniper Networks Products: Junos Space Problem Types: CWE-79 Description: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Configuration View page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. Additional Analyst Notes:
ons, including an administrator. This issue affects all versions of Junos Space before 24.1R4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA103140
CVE ID: CVE-2025-59997 State: PUBLISHED Published: 2025-10-09T16:15:11.774Z Last Updated: 2025-10-09T19:47:26.439Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Juniper Networks Products: Junos Space Problem Types: CWE-79 Description: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the CLI Configlets pages that, when visited by another user, enable the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. Additional Analyst Notes: - C
CVE ID: CVE-2025-59998 State: PUBLISHED Published: 2025-10-09T16:15:32.812Z Last Updated: 2025-10-09T19:47:20.307Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Juniper Networks Products: Junos Space Problem Types: CWE-79 Description: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Archive Log screen that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. Additional Analyst Notes: - CI
CVE ID: CVE-2025-59999 State: PUBLISHED Published: 2025-10-09T16:16:15.589Z Last Updated: 2025-10-09T19:47:15.174Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Juniper Networks Products: Junos Space Problem Types: CWE-79 Description: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the API Access Profiles page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4. Additional Analyst Notes
CVE ID: CVE-2025-5000 State: PUBLISHED Published: 2025-05-20T21:00:12.784Z Last Updated: 2025-05-21T14:00:13.853Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Linksys Products: FGW3000-AH, FGW3000-HK Problem Types: CWE-77, CWE-74 Description: A vulnerability was found in Linksys FGW3000-AH and FGW3000-HK up to 1.0.17.000000. It has been classified as critical. This affects the function control_panel_sw of the file /cgi-bin/sysconf.cgi of the component HTTP POST Request Handler. The manipulation of the argument filename leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contac
ble to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309651 - https://vuldb.com/?ctiid.309651 - https://vuldb.com/?submit.565992 - https://github.com/CH13hh/tmp_store_cc/blob/main/FGW3000/2.md - https://www.linksys.com/
CVE ID: CVE-2025-5001 State: PUBLISHED Published: 2025-05-20T21:31:05.594Z Last Updated: 2025-05-21T13:57:09.419Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: GNU Products: PSPP Problem Types: CWE-190, CWE-189 Description: A vulnerability was found in GNU PSPP 82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb. It has been declared as problematic. This vulnerability affects the function calloc of the file pspp-convert.c. The manipulation of the argument -l leads to integer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vul
en disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309652 - https://vuldb.com/?ctiid.309652 - https://vuldb.com/?submit.569966 - https://savannah.gnu.org/bugs/index.php?67069 - https://drive.google.com/file/d/12IIt8eR591Z8O1ABOCkT_jdXSWaBxMZx/view?usp=drive_link - https://www.gnu.org/
CVE ID: CVE-2025-5002 State: PUBLISHED Published: 2025-05-20T22:00:11.948Z Last Updated: 2025-05-21T14:14:35.465Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Client Database Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in SourceCodester Client Database Management System 1.0. This affects an unknown part of the file /user_proposal_update_order.php. The manipulation of the argument order_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
y. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309657 - https://vuldb.com/?ctiid.309657 - https://vuldb.com/?submit.580192 - https://github.com/laifeng-boy/cve/issues/5 - https://www.sourcecodester.com/
CVE ID: CVE-2025-5003 State: PUBLISHED Published: 2025-05-20T22:00:13.596Z Last Updated: 2025-05-21T14:13:26.436Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: projectworlds Products: Online Time Table Generator Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in projectworlds Online Time Table Generator 1.0 and classified as critical. This vulnerability affects unknown code of the file /semester_ajax.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309
o the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309658 - https://vuldb.com/?ctiid.309658 - https://vuldb.com/?submit.580195 - https://github.com/huangyi234/CVE/issues/4
CVE ID: CVE-2025-5004 State: PUBLISHED Published: 2025-05-20T22:31:04.152Z Last Updated: 2025-05-21T14:11:50.255Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: projectworlds Products: Online Time Table Generator Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in projectworlds Online Time Table Generator 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/add_course.php. The manipulation of the argument c/subname leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com
closed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309659 - https://vuldb.com/?ctiid.309659 - https://vuldb.com/?submit.580201 - https://github.com/huangyi234/CVE/issues/8
CVE ID: CVE-2025-5005 State: PUBLISHED Published: 2025-09-09T16:32:06.053Z Last Updated: 2025-09-09T18:39:56.328Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Shanghai Lingdang Information Technology Products: Lingdang CRM Problem Types: CWE-918 Description: A vulnerability was detected in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.5.4. This affects an unknown function of the file crm/WeiXinApp/dingtalk/index_event.php. The manipulation of the argument corpurl results in server-side request forgery. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did
unched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323233 - https://vuldb.com/?ctiid.323233 - https://vuldb.com/?submit.636882 - https://github.com/jackyliu666/dingtalk
CVE ID: CVE-2025-5006 State: PUBLISHED Published: 2025-05-20T22:31:06.484Z Last Updated: 2025-05-21T14:08:28.785Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Campcodes Products: Online Shopping Portal Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Campcodes Online Shopping Portal 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/category.php. The manipulation of the argument Category leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309660 - h
ublic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309660 - https://vuldb.com/?ctiid.309660 - https://vuldb.com/?submit.580248 - https://github.com/Zhaozhizhi/CVE/issues/3 - https://www.campcodes.com/
CVE ID: CVE-2025-5007 State: PUBLISHED Published: 2025-05-20T23:00:10.483Z Last Updated: 2025-05-21T22:46:58.711Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: n/a Products: Part-DB Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in Part-DB up to 1.17.0. It has been declared as problematic. Affected by this vulnerability is the function handleUpload of the file src/Services/Attachments/AttachmentSubmitHandler.php of the component Profile Picture Feature. The manipulation of the argument attachment leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.17.1 is ab
an be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.17.1 is able to address this issue. The identifier of the patch is 2c4f44e808500db19c391159b30cb6142896d415. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309661 - https://vuldb.com/?ctiid.309661 - https://vuldb.com/?submit.580323 - https://github.com/Part-DB/Part-DB-server/releases/tag/v1.17.1 - https://github.com/b1d0ws/CVEs/blob/main/CVE-2025-XXXX.md - https://github.com/Part-DB/Part-DB-server/commit/2c4f44e808500db19c391159b30cb6142896d415
CVE ID: CVE-2025-5008 State: PUBLISHED Published: 2025-05-20T23:00:12.480Z Last Updated: 2025-05-21T22:45:55.825Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: projectworlds Products: Online Time Table Generator Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in projectworlds Online Time Table Generator 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/add_teacher.php. The manipulation of the argument e leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA
en disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309662 - https://vuldb.com/?ctiid.309662 - https://vuldb.com/?submit.580412 - https://github.com/hhhanxx/attack/issues/18
CVE ID: CVE-2025-5009 State: PUBLISHED Published: 2025-10-08T15:31:22.903Z Last Updated: 2025-10-08T15:56:00.236Z Vendors: Google Products: Gemini Problem Types: CWE-359 Description: In Gemini iOS, when a user shared a snippet of a conversation, it would share the entire conversation via a sharable public link that contained the entire conversation history and not just the snippet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://medium.com/@warisjeet31/google-gemini-ios-vulnerability-public-link-sharing-silently-leaks-entire-conversations-e1f80cbea25c
CVE ID: CVE-2025-5010 State: PUBLISHED Published: 2025-05-20T23:31:04.726Z Last Updated: 2025-05-21T22:15:32.503Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: moonlightL Products: hexo-boot Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic has been found in moonlightL hexo-boot 4.3.0. This affects an unknown part of the file /admin/home/index.html of the component Blog Backend. The manipulation of the argument Description leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com
closed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309663 - https://vuldb.com/?ctiid.309663 - https://vuldb.com/?submit.580567 - https://github.com/trengh222/hexo-boot-xss1.0/blob/yhtt/README.md
CVE ID: CVE-2025-5011 State: PUBLISHED Published: 2025-05-21T00:00:09.678Z Last Updated: 2025-05-21T22:14:50.422Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: moonlightL Products: hexo-boot Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic was found in moonlightL hexo-boot 4.3.0. This vulnerability affects unknown code of the file /admin/home/index.html of the component Dynamic List Page. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309664 - https://vuldb
y be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309664 - https://vuldb.com/?ctiid.309664 - https://vuldb.com/?submit.580588 - https://github.com/trengh222/hexo-boot-xss2.0
CVE ID: CVE-2025-5012 State: PUBLISHED Published: 2025-06-12T05:23:39.401Z Last Updated: 2025-06-12T13:07:54.135Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: AmentoTech Products: Workreap Problem Types: CWE-434 Description: The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'workreap_temp_upload_to_media' function in all versions up to, and including, 3.3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code
th Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/185371b1-5c72-424d-a5b8-42c67aa9380c?source=cve - https://themeforest.net/item/workreap-freelance-marketplace-wordpress-theme/23712454#item-description__release-3-3-3-06-june-2025
CVE ID: CVE-2025-5013 State: PUBLISHED Published: 2025-05-21T00:31:23.395Z Last Updated: 2025-05-21T22:13:41.928Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: n/a Products: HkCms Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, was found in HkCms up to 2.3.2.240702. This affects an unknown part of the file /index.php/search/index.html of the component Search. The manipulation of the argument keyword leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309729
e public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309729 - https://vuldb.com/?ctiid.309729 - https://gitee.com/Hk_Cms/HkCms/issues/IBZ2G7
CVE ID: CVE-2025-5014 State: PUBLISHED Published: 2025-07-02T03:47:25.367Z Last Updated: 2025-07-02T13:15:00.600Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Chimp Group Products: Home Villas | Real Estate WordPress Theme Problem Types: CWE-22 Description: The Home Villas | Real Estate WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'wp_rem_cs_widget_file_delete' function in all versions up to, and including, 2.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code
s, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/afd4f2ca-9c27-4de0-ac82-3cd107b6a092?source=cve - http://localhost:1337/wp-content/themes/homevillas-real-estate/include/backend/cs-widgets/import/cs-class-widget-data.php#L384