Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ble for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6d5f3b7e-b36f-47a5-9e24-2e9bc17f6cc7?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3351161%40lastudio-element-kit&new=3351161%40lastudio-element-kit&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3352347%40lastudio-element-kit&new=3352347%40lastudio-element-kit&sfp_email=&sfph_mail=
CVE ID: CVE-2025-8361 State: PUBLISHED Published: 2025-08-15T16:26:46.012Z Last Updated: 2025-08-15T18:01:18.736Z Vendors: Drupal Products: Config Pages Problem Types: CWE-962 Description: Missing Authorization vulnerability in Drupal Config Pages allows Forceful Browsing.This issue affects Config Pages: from 0.0.0 before 2.18.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-093
CVE ID: CVE-2025-8362 State: PUBLISHED Published: 2025-08-15T16:27:05.226Z Last Updated: 2025-08-15T16:48:56.484Z Vendors: Drupal Products: GoogleTag Manager Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal GoogleTag Manager allows Cross-Site Scripting (XSS).This issue affects GoogleTag Manager: from 0.0.0 before 1.10.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-094
CVE ID: CVE-2025-8364 State: PUBLISHED Published: 2025-08-19T20:52:46.969Z Last Updated: 2025-08-20T15:17:55.116Z Vendors: Mozilla Products: Firefox Problem Types: Address bar spoofing using an blob URI on Firefox for Android Description: A crafted URL using a blob: URI could have hidden the true origin of the page, resulting in a potential spoofing attack. *Note: This issue only affected Android operating systems. Other operating systems are unaffected.* This vulnerability affects Firefox < 141. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1909609 - https://bugzilla.mozilla.org/show_bug.cgi?id=1969937 - https://www.mozilla.org
lla.mozilla.org/show_bug.cgi?id=1909609 - https://bugzilla.mozilla.org/show_bug.cgi?id=1969937 - https://www.mozilla.org/security/advisories/mfsa2025-56/
CVE ID: CVE-2025-8365 State: PUBLISHED Published: 2025-07-31T04:02:05.574Z Last Updated: 2025-07-31T13:26:12.004Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Educar Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in Portabilis i-Educar 2.10. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file atendidos_cad.php. The manipulation of the argument nome/nome_social/email leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not res
t has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318337 - https://vuldb.com/?ctiid.318337 - https://vuldb.com/?submit.618583 - https://github.com/CVE-Hunters/CVE/blob/main/i-educar/Stored%20Cross-Site%20Scripting%20XSS%20in%20atendidos_cad.php%20via%20nome%2C%20nome_social%2C%20and%20email%20Parameters.md
CVE ID: CVE-2025-8366 State: PUBLISHED Published: 2025-07-31T04:32:05.446Z Last Updated: 2025-07-31T17:58:45.802Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Educar Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in Portabilis i-Educar 2.9. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /intranet/educar_servidor_lst.php. The manipulation of the argument nome/matricula_servidor leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did
exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318338 - https://vuldb.com/?ctiid.318338 - https://vuldb.com/?submit.618667 - https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-8366.md - https://github.com/marcelomulder/CVE/blob/main/i-educar/Reflected%20XSS%20educar_servidor_lst.php%20parameters%20nome%20and%20matricula_servidor.md
CVE ID: CVE-2025-8367 State: PUBLISHED Published: 2025-07-31T05:02:06.235Z Last Updated: 2025-07-31T17:56:58.840Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Educar Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic has been found in Portabilis i-Educar 2.9. This affects an unknown part of the file /intranet/funcionario_vinculo_lst.php. The manipulation of the argument nome leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additio
the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318339 - https://vuldb.com/?ctiid.318339 - https://vuldb.com/?submit.618668 - https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-8367.md - https://github.com/marcelomulder/CVE/blob/main/i-educar/Reflected%20XSS%20funcionario_vinculo_lst.php%20parameter%20nome.md
CVE ID: CVE-2025-8368 State: PUBLISHED Published: 2025-07-31T05:32:05.192Z Last Updated: 2025-07-31T17:55:27.749Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Educar Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic was found in Portabilis i-Educar 2.9. This vulnerability affects unknown code of the file /intranet/pesquisa_pessoa_lst.php. The manipulation of the argument campo_busca/cpf leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Addi
to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318340 - https://vuldb.com/?ctiid.318340 - https://vuldb.com/?submit.618669 - https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-8368.md - https://github.com/marcelomulder/CVE/blob/main/i-educar/Reflected%20XSS%20intranet.pesquisa_pessoa_lst.php_parameters_campo_busca_and_cpf.md
CVE ID: CVE-2025-8369 State: PUBLISHED Published: 2025-07-31T06:02:06.065Z Last Updated: 2025-07-31T17:51:19.332Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Educar Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.9. This issue affects some unknown processing of the file /intranet/educar_avaliacao_desempenho_lst.php. The manipulation of the argument titulo_avaliacao leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but
. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318341 - https://vuldb.com/?ctiid.318341 - https://vuldb.com/?submit.618675 - https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-8369.md - https://github.com/marcelomulder/CVE/blob/main/i-educar/Reflected%20XXS%20educar_avaliacao_desempenho_lst.md
CVE ID: CVE-2025-8370 State: PUBLISHED Published: 2025-07-31T06:32:05.832Z Last Updated: 2025-07-31T17:44:41.791Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Educar Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, was found in Portabilis i-Educar 2.9. Affected is an unknown function of the file /intranet/educar_escolaridade_lst.php. The manipulation of the argument descricao leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any
disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318342 - https://vuldb.com/?ctiid.318342 - https://vuldb.com/?submit.618676 - https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-8370.md - https://github.com/marcelomulder/CVE/blob/main/i-educar/Reflected%20XXS%20educar_escolaridade_lst.md
CVE ID: CVE-2025-8371 State: PUBLISHED Published: 2025-07-31T07:02:06.240Z Last Updated: 2025-07-31T17:40:22.839Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Exam Form Submission Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in code-projects Exam Form Submission 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/update_s5.php. The manipulation of the argument credits leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References
exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318343 - https://vuldb.com/?ctiid.318343 - https://vuldb.com/?submit.622557 - https://github.com/mynlxx/CVE-ZhuChengQing/issues/1 - https://code-projects.org/
CVE ID: CVE-2025-8372 State: PUBLISHED Published: 2025-07-31T07:32:05.877Z Last Updated: 2025-07-31T13:23:07.346Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Exam Form Submission Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Exam Form Submission 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/update_s7.php. The manipulation of the argument credits leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:/
s been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318344 - https://vuldb.com/?ctiid.318344 - https://vuldb.com/?submit.622556 - https://github.com/mynlxx/CVE-ZhuChengQing/issues/2 - https://code-projects.org/
CVE ID: CVE-2025-8373 State: PUBLISHED Published: 2025-07-31T08:02:06.129Z Last Updated: 2025-07-31T13:21:58.546Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Vehicle Management Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Vehicle Management 1.0. It has been classified as critical. This affects an unknown part of the file /print.php. The manipulation of the argument sno leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318345
e public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318345 - https://vuldb.com/?ctiid.318345 - https://vuldb.com/?submit.624005 - https://github.com/wllovemy/cve/issues/7 - https://code-projects.org/
CVE ID: CVE-2025-8374 State: PUBLISHED Published: 2025-07-31T08:32:05.218Z Last Updated: 2025-07-31T13:18:36.122Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Vehicle Management Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Vehicle Management 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /addcompany.php. The manipulation of the argument company leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id
ed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318346 - https://vuldb.com/?ctiid.318346 - https://vuldb.com/?submit.624006 - https://github.com/wllovemy/cve/issues/6 - https://code-projects.org/
CVE ID: CVE-2025-8375 State: PUBLISHED Published: 2025-07-31T09:02:19.506Z Last Updated: 2025-07-31T14:33:13.207Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Vehicle Management Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Vehicle Management 1.0. It has been rated as critical. This issue affects some unknown processing of the file /addvehicle.php. The manipulation of the argument vehicle leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id
ed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318347 - https://vuldb.com/?ctiid.318347 - https://vuldb.com/?submit.624007 - https://github.com/wllovemy/cve/issues/5 - https://code-projects.org/
CVE ID: CVE-2025-8376 State: PUBLISHED Published: 2025-07-31T09:32:05.153Z Last Updated: 2025-07-31T13:27:09.027Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Vehicle Management Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in code-projects Vehicle Management 1.0. Affected is an unknown function of the file /updatebal.php. The manipulation of the argument company leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318348
he public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318348 - https://vuldb.com/?ctiid.318348 - https://vuldb.com/?submit.624008 - https://github.com/wllovemy/cve/issues/4 - https://code-projects.org/
CVE ID: CVE-2025-8378 State: PUBLISHED Published: 2025-07-31T10:02:06.851Z Last Updated: 2025-07-31T13:20:32.711Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Online Hotel Reservation System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Campcodes Online Hotel Reservation System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/index.php of the component Login. The manipulation of the argument username/password leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes:
attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318356 - https://vuldb.com/?ctiid.318356 - https://vuldb.com/?submit.624801 - https://github.com/XiaoJiesecqwq/sql/issues/1 - https://www.campcodes.com/
CVE ID: CVE-2025-8379 State: PUBLISHED Published: 2025-07-31T10:32:05.716Z Last Updated: 2025-07-31T13:15:57.352Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Online Hotel Reservation System Problem Types: CWE-434, CWE-284 Description: A vulnerability classified as critical has been found in Campcodes Online Hotel Reservation System 1.0. This affects an unknown part of the file /admin/edit_room.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
ploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318357 - https://vuldb.com/?ctiid.318357 - https://vuldb.com/?submit.624817 - https://github.com/XiaoJiesecqwq/sql/issues/2 - https://www.campcodes.com/
CVE ID: CVE-2025-8380 State: PUBLISHED Published: 2025-07-31T11:02:07.133Z Last Updated: 2025-07-31T13:14:46.518Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Online Hotel Reservation System Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic was found in Campcodes Online Hotel Reservation System 1.0. This vulnerability affects unknown code of the file /admin/add_query_account.php. The manipulation of the argument Name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References
exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318358 - https://vuldb.com/?ctiid.318358 - https://vuldb.com/?submit.624842 - https://github.com/XiaoJiesecqwq/sql/issues/3 - https://www.campcodes.com/
CVE ID: CVE-2025-8381 State: PUBLISHED Published: 2025-07-31T11:32:05.927Z Last Updated: 2025-07-31T13:33:20.829Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Online Hotel Reservation System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in Campcodes Online Hotel Reservation System 1.0. This issue affects some unknown processing of the file /add_reserve.php. The manipulation of the argument room_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318359 - https://vuldb.com/?ctiid.318359 - https://vuldb.com/?submit.624843 - https://github.com/XiaoJiesecqwq/sql/issues/4 - https://www.campcodes.com/
CVE ID: CVE-2025-8382 State: PUBLISHED Published: 2025-07-31T12:02:06.350Z Last Updated: 2025-08-04T05:17:02.790Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Online Hotel Reservation System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in Campcodes Online Hotel Reservation System 1.0. Affected is an unknown function of the file /admin/edit_room.php. The manipulation of the argument room_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318360 - https://vuldb.com/?ctiid.318360 - https://vuldb.com/?submit.624852 - https://github.com/XiaoJiesecqwq/sql/issues/5 - https://www.campcodes.com/
CVE ID: CVE-2025-8383 State: PUBLISHED Published: 2025-10-31T08:25:55.580Z Last Updated: 2025-10-31T17:51:16.878Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: averta Products: Popup and Slider Builder by Depicter – Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel Problem Types: CWE-352 Description: The Depicter plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions less than, or equal to, 4.0.4. This is due to missing or incorrect nonce validation on the depicter-document-rules-store function. This makes it possible for unauthenticated attackers to modify document rules via a
cter-document-rules-store function. This makes it possible for unauthenticated attackers to modify document rules via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c54e5cd9-cc51-4367-afe0-11a6abfc0437?source=cve - https://drive.google.com/file/d/1Fph3k-uyN6tX4hHeupjdYsZWZe3gYjqo/view?usp=sharing - https://plugins.trac.wordpress.org/browser/depicter/trunk/app/routes/ajax.php#L473 - https://plugins.trac.wordpress.org/changeset/3384613/
CVE ID: CVE-2025-8385 State: PUBLISHED Published: 2025-10-31T07:26:40.967Z Last Updated: 2025-10-31T07:26:40.967Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: PX-lab Products: Zombify Problem Types: CWE-22 Description: The Zombify plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.7.5. This is due to insufficient input validation in the zf_get_file_by_url function. This makes it possible for authenticated attackers, with subscriber-level access and above, to read arbitrary files on the server, including sensitive system files like /etc/passwd, via a forged request. It's worth noting that successfully exploiting th
cluding sensitive system files like /etc/passwd, via a forged request. It's worth noting that successfully exploiting this vulnerability relies on a race condition as the file generated will be deleted immediately. References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ef9010e3-f060-4bef-b62b-4a648f5e5577?source=cve - https://themeforest.net/item/boombox-viral-buzz-wordpress-theme/16596434
CVE ID: CVE-2025-8386 State: PUBLISHED Published: 2025-11-14T23:57:04.396Z Last Updated: 2025-11-17T16:56:00.107Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L) Vendors: AVEVA Products: Application Server Problem Types: CWE-80 Description: The vulnerability, if exploited, could allow an authenticated miscreant (with privilege of "aaConfigTools") to tamper with App Objects' help files and persist a cross-site scripting (XSS) injection that when executed by a victim user, can result in horizontal or vertical escalation of privileges. The vulnerability can only be exploited during config-time operations within the IDE component of Application Server. Run-time component
y can only be exploited during config-time operations within the IDE component of Application Server. Run-time components and operations are not affected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin-AVEVA-2025-005.pdf - https://www.cisa.gov/news-events/ics-advisories/icsa-25-317-02 - https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-317-02.json