Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
file-as-homepage/vulnerability/wordpress-bp-profile-as-homepage-plugin-1-1-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49454 State: PUBLISHED Published: 2025-06-10T12:44:32.257Z Last Updated: 2025-06-10T13:15:55.006Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: LoftOcean Products: TinySalt Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LoftOcean TinySalt allows PHP Local File Inclusion.This issue affects TinySalt: from n/a before 3.10.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/tinysalt/vulnerability/wordpress-tinysalt-3-10-0-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-49455 State: PUBLISHED Published: 2025-06-10T12:43:42.832Z Last Updated: 2025-06-10T13:36:25.036Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: LoftOcean Products: TinySalt Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in LoftOcean TinySalt allows Object Injection.This issue affects TinySalt: from n/a before 3.10.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/tinysalt/vulnerability/wordpress-tinysalt-3-10-0-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-49456 State: PUBLISHED Published: 2025-08-12T22:52:22.718Z Last Updated: 2025-08-13T13:24:11.169Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Zoom Communications Inc Products: Zoom Clients for Windows Problem Types: CWE-426 Description: Race condition in the installer for certain Zoom Clients for Windows may allow an unauthenticated user to impact application integrity via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-25029
CVE ID: CVE-2025-49457 State: PUBLISHED Published: 2025-08-12T22:54:20.362Z Last Updated: 2025-08-14T03:56:14.043Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Zoom Communications Inc Products: Zoom Clients for Windows Problem Types: CWE-426 Description: Untrusted search path in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-25030
CVE ID: CVE-2025-49458 State: PUBLISHED Published: 2025-09-09T21:25:52.133Z Last Updated: 2025-09-10T19:34:03.844Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Zoom Communications, Inc Products: Zoom Workplace Clients Problem Types: CWE-120 Description: Buffer overflow in certain Zoom Workplace Clients may allow an authenticated user to conduct a denial of service via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/ZSB-25031
CVE ID: CVE-2025-49459 State: PUBLISHED Published: 2025-09-09T21:29:33.168Z Last Updated: 2025-09-11T03:56:21.574Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Zoom Communications, Inc Products: Zoom Workplace for Windows on ARM Problem Types: CWE-862 Description: Missing authorization in the installer for Zoom Workplace for Windows on ARM before version 6.5.0 may allow an authenticated user to conduct an escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/ZSB-25032
CVE ID: CVE-2025-49460 State: PUBLISHED Published: 2025-09-09T21:38:40.910Z Last Updated: 2025-09-10T20:25:08.077Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: Zoom Communications, Inc Products: Zoom Workplace Clients Problem Types: CWE-400 Description: Uncontrolled resource consumption in certain Zoom Workplace Clients may allow an unauthenticated user to conduct a denial of service via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/ZSB-25033
CVE ID: CVE-2025-49461 State: PUBLISHED Published: 2025-09-09T21:42:05.838Z Last Updated: 2025-09-10T20:24:36.497Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: Zoom Communications, Inc Products: Zoom Workplace Clients Problem Types: CWE-79 Description: Cross-site scripting in certain Zoom Workplace Clients may allow an unauthenticated user to conduct a denial of service via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/ZSB-25034
CVE ID: CVE-2025-49462 State: PUBLISHED Published: 2025-07-10T16:24:14.645Z Last Updated: 2025-07-10T18:37:05.938Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: Zoom Communications Inc. Products: Zoom Clients Problem Types: CWE-352 Description: Cross-site scripting in certain Zoom Clients before version 6.4.5 may allow an authenticated user to conduct a disclosure of information via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://https://www.zoom.com/en/trust/security-bulletin/zsb-25025/
CVE ID: CVE-2025-49463 State: PUBLISHED Published: 2025-07-10T16:26:46.550Z Last Updated: 2025-07-10T18:03:16.956Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Zoom Communications Inc. Products: Zoom Clients for iOS Problem Types: CWE-691 Description: Insufficient control flow management in certain Zoom Clients for iOS before version 6.4.5 may allow an unauthenticated user to conduct a disclosure of information via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://https://www.zoom.com/en/trust/security-bulletin/zsb-25026/
CVE ID: CVE-2025-49464 State: PUBLISHED Published: 2025-07-10T16:32:20.259Z Last Updated: 2025-07-10T18:01:56.630Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Zoom Communications Inc. Products: Zoom Clients for Windows Problem Types: CWE-120 Description: Classic buffer overflow in certain Zoom Clients for Windows may allow an authorised user to conduct a denial of service via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://https://www.zoom.com/en/trust/security-bulletin/zsb-25028/
CVE ID: CVE-2025-49466 State: PUBLISHED Published: 2025-06-05T00:00:00.000Z Last Updated: 2025-06-05T14:10:45.323Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: rjarry Products: aerc Problem Types: CWE-23 Description: aerc before 93bec0d allows directory traversal in commands/msgview/open.go because of direct path concatenation of the name of an attachment part, Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.sr.ht/~rjarry/aerc/commit/93bec0de8ed5ab3d6b1f01026fe2ef20fa154329 - https://git.sr.ht/~rjarry/aerc/commit/2bbe75fe0bc87ab4c1e16c5a18c6200224391629
CVE ID: CVE-2025-49467 State: PUBLISHED Published: 2025-06-12T15:18:32.804Z Last Updated: 2025-06-12T15:52:20.609Z Vendors: jevents.net / GWE Systems Ltd Products: JEvents component for Joomla Problem Types: CWE-89 Description: A SQL injection vulnerability in JEvents component before 3.6.88 and 3.6.82.1 for Joomla was discovered. The extension is vulnerable to SQL injection via publicly accessible actions to list events by date ranges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jevents.net/
CVE ID: CVE-2025-49468 State: PUBLISHED Published: 2025-06-13T09:48:20.282Z Last Updated: 2025-06-13T12:20:23.135Z Vendors: nobossextensions.com Products: No Boss Calendar component for Joomla Problem Types: CWE-89 Description: A SQL injection vulnerability in No Boss Calendar component before 5.0.7 for Joomla was discovered. The vulnerability allows remote authenticated users to execute arbitrary SQL commands via the id_module parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://nobossextensions.com/
CVE ID: CVE-2025-49480 State: PUBLISHED Published: 2025-07-01T11:13:19.134Z Last Updated: 2025-07-01T14:26:42.120Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: ASR Products: Falcon_Linux、Kestrel、Lapwing_Linux Problem Types: CWE-125 Description: Out-of-bounds access in ASR180x 、ASR190x in lte-telephony, This vulnerability is associated with program files apps/lzma/src/LzmaEnc.c. This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.asrmicro.com/en/goods/psirt?cid=40
CVE ID: CVE-2025-49481 State: PUBLISHED Published: 2025-07-01T11:20:24.105Z Last Updated: 2025-07-01T14:14:27.249Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) Vendors: ASR Products: Falcon_Linux、Kestrel、Lapwing_Linux Problem Types: CWE-404 Description: Improper Resource Shutdown or Release vulnerability in ASR180x 、ASR190x in router modules allows Resource Leak Exposure. This vulnerability is associated with program files router/phonebook/pbwork-queue.C. This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.asrmicro.com/en/goods/psirt?cid=40
CVE ID: CVE-2025-49482 State: PUBLISHED Published: 2025-07-01T11:28:04.483Z Last Updated: 2025-07-01T13:47:26.854Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) Vendors: ASR Products: Falcon_Linux、Kestrel、Lapwing_Linux Problem Types: CWE-404 Description: Improper Resource Shutdown or Release vulnerability in ASR180x 、ASR190x in tr069 modules allows Resource Leak Exposure. This vulnerability is associated with program files tr069/tr098.c. This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.asrmicro.com/en/goods/psirt?cid=40
CVE ID: CVE-2025-49483 State: PUBLISHED Published: 2025-07-01T11:31:32.804Z Last Updated: 2025-07-01T13:32:34.636Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) Vendors: ASR Products: Falcon_Linux、Kestrel、Lapwing_Linux Problem Types: CWE-404 Description: Improper Resource Shutdown or Release vulnerability in ASR180x 、ASR190x in tr069 modules allows Resource Leak Exposure. This vulnerability is associated with program files tr069/tr069_uci.c. This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.asrmicro.com/en/goods/psirt?cid=40
CVE ID: CVE-2025-49484 State: PUBLISHED Published: 2025-07-18T09:51:44.430Z Last Updated: 2025-09-30T04:36:47.498Z Vendors: joomsky.com Products: JS Jobs component for Joomla Problem Types: CWE-89 Description: A SQL injection vulnerability in the JS Jobs plugin versions 1.0.0-1.4.1 for Joomla allows low-privilege users to execute arbitrary SQL commands via the 'cvid' parameter in the employee application feature. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://joomsky.com/js-jobs-joomla/ - https://github.com/AdamWallwork/CVEs/tree/main/2025/CVE-2025-49484 - https://www.exploit-db.com/exploits/52373
CVE ID: CVE-2025-49485 State: PUBLISHED Published: 2025-07-18T09:51:01.943Z Last Updated: 2025-07-20T08:52:54.225Z Vendors: balbooa.com Products: Balbooa Forms component for Joomla Problem Types: CWE-89 Description: A SQL injection vulnerability in the Balbooa Forms plugin 1.0.0-2.3.1.1 for Joomla allows privileged users to execute arbitrary SQL commands via the 'id' parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://extensions.joomla.org/extension/forms/
CVE ID: CVE-2025-49486 State: PUBLISHED Published: 2025-07-18T09:50:54.958Z Last Updated: 2025-07-20T08:52:51.440Z Vendors: balbooa.com Products: Balbooa Gallery component for Joomla Problem Types: CWE-79 Description: A stored XSS vulnerability in the Balbooa Gallery plugin 1.0.0-2.4.0 for Joomla allows privileged users to store malicious scripts in gallery items. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://extensions.joomla.org/extension/gallery/
CVE ID: CVE-2025-49487 State: PUBLISHED Published: 2025-06-17T18:43:11.176Z Last Updated: 2025-06-17T19:52:40.992Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Trend Micro, Inc. Products: Trend Micro Worry-Free Business Security Services Problem Types: CWE-427 Description: An uncontrolled search path vulnerability in the Trend Micro Worry-Free Business Security Services (WFBSS) agent could have allowed an attacker with physical access to a machine to execute arbitrary code on affected installations. An attacker must have had physical access to the target system in order to exploit this vulnerability due to need to access a certain hardware component. Also
ess to the target system in order to exploit this vulnerability due to need to access a certain hardware component. Also note: this vulnerability only affected the SaaS client version of WFBSS only, meaning the on-premise version of Worry-Free Business Security was not affected, and this issue was addressed in a previous WFBSS monthly maintenance update. Therefore no other customer action is required to mitigate if the WFBSS agents are on the regular SaaS maintenance deployment schedule and this disclosure is for informational purposes only. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/en-US/solution/KA-0019936 - https://www.zerodayinitiativ
ADP Vulnrichment: References: - https://success.trendmicro.com/en-US/solution/KA-0019936 - https://www.zerodayinitiative.com/advisories/ZDI-25-360/
CVE ID: CVE-2025-49488 State: PUBLISHED Published: 2025-07-01T11:03:17.990Z Last Updated: 2025-07-01T14:29:14.837Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) Vendors: ASR Products: Falcon_Linux、Kestrel、Lapwing_Linux Problem Types: CWE-404 Description: Improper Resource Shutdown or Release vulnerability in ASR180x 、ASR190x in router components allows Resource Leak Exposure. This vulnerability is associated with program files router/phonebook/pb.c. This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.asrmicro.com/en/goods/psirt?cid=40
CVE ID: CVE-2025-49489 State: PUBLISHED Published: 2025-07-01T09:45:34.780Z Last Updated: 2025-07-01T13:11:47.916Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) Vendors: ASR Products: Falcon_Linux、Kestrel、Lapwing_Linux Problem Types: CWE-404 Description: Improper Resource Shutdown or Release vulnerability in ASR Falcon_Linux、Kestrel、Lapwing_Linux on Linux (con_mgr components) allows Resource Leak Exposure. This vulnerability is associated with program files con_mgr/dialer_task.C. This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.asrmicro.com/en/goods/psirt?cid=40
CVE ID: CVE-2025-49490 State: PUBLISHED Published: 2025-07-01T09:56:53.936Z Last Updated: 2025-07-01T13:10:46.709Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) Vendors: ASR Products: Falcon_Linux、Kestrel、Lapwing_Linux Problem Types: CWE-404 Description: Resource leak vulnerability in ASR180x in router allows Resource Leak Exposure. This vulnerability is associated with program files router/sms/sms.c. This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.asrmicro.com/en/goods/psirt?cid=40
CVE ID: CVE-2025-49491 State: PUBLISHED Published: 2025-07-01T10:36:37.613Z Last Updated: 2025-07-01T13:31:10.428Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) Vendors: ASR Products: Falcon_Linux、Kestrel、Lapwing_Linux Problem Types: CWE-404 Description: Improper Resource Shutdown or Release vulnerability in ASR Falcon_Linux、Kestrel、Lapwing_Linux on Linux (traffic_stat modules) allows Resource Leak Exposure. This vulnerability is associated with program files traffic_stat/traffic_service/traffic_service.C. This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.asrmicro.com/en
apwing_Linux: before v1536. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.asrmicro.com/en/goods/psirt?cid=40
CVE ID: CVE-2025-49492 State: PUBLISHED Published: 2025-07-01T10:52:32.715Z Last Updated: 2025-07-01T14:29:53.421Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: ASR Products: Falcon_Linux、Kestrel、Lapwing_Linux Problem Types: CWE-787 Description: Out-of-bounds write in ASR180x in lte-telephony, May cause a buffer underrun. This vulnerability is associated with program files apps/atcmd_server/src/dev_api.C. This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.asrmicro.com/en/goods/psirt?cid=40
CVE ID: CVE-2025-49493 State: PUBLISHED Published: 2025-06-30T00:00:00.000Z Last Updated: 2025-09-24T18:19:47.784Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: Akamai Products: CloudTest Problem Types: CWE-611 Description: Akamai CloudTest before 60 2025.06.02 (12988) allows file inclusion via XML External Entity (XXE) injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.akamai.com/products/cloudtest - https://techdocs.akamai.com/cloudtest/changelog/june-2-2025-enhancements-and-bug-fixes/
CVE ID: CVE-2025-49494 State: PUBLISHED Published: 2025-11-04T00:00:00.000Z Last Updated: 2025-11-05T20:08:30.860Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 2100, 1280, 2200, 1330, 1380, 1480, 9110, Modem 5123. Mishandling of an 5G NRMM packet leads to a Denial of Service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-49494/
CVE ID: CVE-2025-49507 State: PUBLISHED Published: 2025-06-10T12:42:12.069Z Last Updated: 2025-06-10T13:37:36.407Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: LoftOcean Products: CozyStay Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in LoftOcean CozyStay allows Object Injection.This issue affects CozyStay: from n/a before 1.7.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/cozystay/vulnerability/wordpress-cozystay-1-7-1-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-49508 State: PUBLISHED Published: 2025-06-17T15:01:41.424Z Last Updated: 2025-06-17T17:32:04.005Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: LoftOcean Products: CozyStay Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LoftOcean CozyStay allows PHP Local File Inclusion. This issue affects CozyStay: from n/a through n/a. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/cozystay/vulnerability/wordpress-cozystay-1-7-1-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-49509 State: PUBLISHED Published: 2025-06-10T12:40:49.442Z Last Updated: 2025-06-10T13:39:41.890Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Roland Beaussant Products: Audio Editor & Recorder Problem Types: CWE-862 Description: Missing Authorization vulnerability in Roland Beaussant Audio Editor & Recorder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Audio Editor & Recorder: from n/a through 2.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/audio-editor-recorder/vulnerability/wordpress-audio-editor-recorder-plugin-2-2-1-b
chstack.com/database/wordpress/plugin/audio-editor-recorder/vulnerability/wordpress-audio-editor-recorder-plugin-2-2-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-49510 State: PUBLISHED Published: 2025-06-10T12:36:35.258Z Last Updated: 2025-06-10T13:06:54.427Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: WPFactory Products: Min Max Step Quantity Limits Manager for WooCommerce Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in WPFactory Min Max Step Quantity Limits Manager for WooCommerce allows Cross Site Request Forgery.This issue affects Min Max Step Quantity Limits Manager for WooCommerce: from n/a through 5.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/product-quantity-for-woocommerce/vu
ISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/product-quantity-for-woocommerce/vulnerability/wordpress-min-max-step-quantity-limits-manager-for-woocommerce-plugin-5-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-49511 State: PUBLISHED Published: 2025-06-10T12:35:33.715Z Last Updated: 2025-06-10T13:47:28.265Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H) Vendors: uxper Products: Civi Framework Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in uxper Civi Framework allows Cross Site Request Forgery.This issue affects Civi Framework: from n/a through 2.1.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/civi-framework/vulnerability/wordpress-civi-framework-plugin-2-1-6-cross-site-request-forgery-csrf-to-user-deactivation-vulnerability?_s_id=cve
CVE ID: CVE-2025-49520 State: PUBLISHED Published: 2025-06-30T20:45:28.706Z Last Updated: 2025-11-13T16:36:36.659Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 Problem Types: CWE-88 Description: A flaw was found in Ansible Automation Platform’s EDA component where user-supplied Git URLs are passed unsanitized to the git ls-remote command. This vulnerability allows an authenticated attacker to inject arguments and execute arbitrary commands on the EDA worker. In Kubernetes/OpenShift environments, this can lead to service account token thef
arbitrary commands on the EDA worker. In Kubernetes/OpenShift environments, this can lead to service account token theft and cluster access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:9986 - https://access.redhat.com/security/cve/CVE-2025-49520 - https://bugzilla.redhat.com/show_bug.cgi?id=2370812
CVE ID: CVE-2025-49521 State: PUBLISHED Published: 2025-06-30T20:45:13.138Z Last Updated: 2025-11-13T16:36:45.785Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 Problem Types: CWE-94 Description: A flaw was found in the EDA component of the Ansible Automation Platform, where user-supplied Git branch or refspec values are evaluated as Jinja2 templates. This vulnerability allows authenticated users to inject expressions that execute commands or access sensitive files on the EDA worker. In OpenShift, it can lead to service account token theft