Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-7499 State: PUBLISHED Published: 2025-08-16T07:25:29.205Z Last Updated: 2025-08-18T17:50:29.014Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: wpdevteam Products: BetterDocs – Advanced AI-Driven Documentation, FAQ & Knowledge Base Tool for Elementor & Gutenberg with Encyclopedia, AI Support, Instant Answers Problem Types: CWE-862 Description: The BetterDocs – Advanced AI-Driven Documentation, FAQ & Knowledge Base Tool for Elementor & Gutenberg with Encyclopedia, AI Support, Instant Answers plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_response function in all versions up to a
le to unauthorized access of data due to a missing capability check on the get_response function in all versions up to and including 4.1.1. This makes it possible for unauthenticated attackers to retrieve passwords for password-protected documents as well as the metadata of private and draft documents. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5231b741-4d02-45b5-b2aa-0d9d3536a416?source=cve - https://plugins.trac.wordpress.org/browser/betterdocs/tags/4.1.0/includes/REST/DocCategories.php#L82 - https://plugins.trac.wordpress.org/changeset/3338384/
CVE ID: CVE-2025-7500 State: PUBLISHED Published: 2025-08-02T11:23:55.689Z Last Updated: 2025-08-04T15:16:28.971Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: oceanwp Products: Ocean Social Sharing Problem Types: CWE-79 Description: The Ocean Social Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via social icon titles in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analys
to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7683e708-b7cb-444e-9069-f33e4ef3ac76?source=cve - https://plugins.trac.wordpress.org/browser/ocean-social-sharing/tags/2.2.1/template/social-share.php#L84 - https://plugins.trac.wordpress.org/browser/ocean-social-sharing/tags/2.2.1/template/social-share.php#L100 - https://plugins.trac.wordpress.org/browser/ocean-social-sharing/tags/2.2.1/template/social-share.php#L176 - https://plugins.trac.wordpress.org/browser/ocean-social-sharing/tags/2.2.1/template/social-share.php#
l-share.php#L176 - https://plugins.trac.wordpress.org/browser/ocean-social-sharing/tags/2.2.1/template/social-share.php#L262 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3331993%40ocean-social-sharing&new=3331993%40ocean-social-sharing&sfp_email=&sfph_mail=
CVE ID: CVE-2025-7501 State: PUBLISHED Published: 2025-07-26T06:43:20.897Z Last Updated: 2025-07-28T15:52:38.848Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wonderplugin Products: Wonder Slider, Wonder Slider Lite Problem Types: CWE-79 Description: The Wonder Slider Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image title and description DOM in all versions up to, and including, 14.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an inje
utor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/320bc1c7-a874-4dc2-92b0-fb5620872ff9?source=cve - https://plugins.trac.wordpress.org/browser/wonderplugin-slider-lite/trunk/engine/wonderpluginslider.js - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3330038%40wonderplugin-slider-lite&new=3330038%40wonderplugin-slider-lite&sfp_email=&sfph_mail=
CVE ID: CVE-2025-7502 State: PUBLISHED Published: 2025-08-06T01:45:13.932Z Last Updated: 2025-08-06T15:31:36.491Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpbakery Products: WPBakery Page Builder Problem Types: CWE-79 Description: The WPBakery Page Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several shortcodes in all versions up to, and including, 8.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user a
s, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d7c80143-c328-4cd1-95db-67de2edc058c?source=cve - https://kb.wpbakery.com/docs/preface/release-notes/
CVE ID: CVE-2025-7503 State: PUBLISHED Published: 2025-07-11T18:53:24.618Z Last Updated: 2025-07-11T19:17:15.281Z Vendors: Shenzhen Liandian Communication Technology LTD Products: V380 IP Camera / AppFHE1_V1.0.6.0 Problem Types: CWE-798 Description: An OEM IP camera manufactured by Shenzhen Liandian Communication Technology LTD exposes a Telnet service (port 23) with undocumented, default credentials. The Telnet service is enabled by default and is not disclosed or configurable via the device’s web interface or user manual. An attacker with network access can authenticate using default credentials and gain root-level shell access to the device. The affected firmware version is AppFHE1_V1.0.6
sing default credentials and gain root-level shell access to the device. The affected firmware version is AppFHE1_V1.0.6.0 (Kernel: KerFHE1_PTZ_WIFI_V3.1.1, Hardware: HwFHE1_WF6_PTZ_WIFI_20201218). No official fix or firmware update is available, and the vendor could not be contacted. This vulnerability allows for remote code execution and privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/AounShAh/Research-on-v380-cctv-ip-camera
CVE ID: CVE-2025-7504 State: PUBLISHED Published: 2025-07-12T08:23:42.188Z Last Updated: 2025-07-14T20:12:14.186Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: akirk Products: Friends Problem Types: CWE-502 Description: The Friends plugin for WordPress is vulnerable to PHP Object Injection in version 3.5.1 via deserialization of untrusted input of the query_vars parameter This makes it possible for authenticated attackers, with subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on th
e, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. This requires access to the sites SALT_NONCE and and SALT_KEY to exploit. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cf91d75e-cef4-4154-aa16-6ca96db9c5bb?source=cve - https://github.com/akirk/friends/pull/537 - https://wordpress.org/plugins/friends/
4-4154-aa16-6ca96db9c5bb?source=cve - https://github.com/akirk/friends/pull/537 - https://wordpress.org/plugins/friends/ - https://drive.google.com/file/d/1K-_AcDk9BhUa0kSQ_M-UUnLgmnYJTA0l/view - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3306684%40friends&new=3306684%40friends&sfp_email=&sfph_mail=
CVE ID: CVE-2025-7505 State: PUBLISHED Published: 2025-07-12T22:32:07.315Z Last Updated: 2025-07-15T13:16:09.970Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: FH451 Problem Types: CWE-121, CWE-119 Description: A vulnerability classified as critical has been found in Tenda FH451 1.0.0.9. Affected is the function frmL7ProtForm of the file /goform/L7Prot of the component HTTP POST Request Handler. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https
has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316188 - https://vuldb.com/?ctiid.316188 - https://vuldb.com/?submit.611504 - https://github.com/zezhifu1/cve_report/blob/main/FH451/frmL7ProtForm.md - https://github.com/zezhifu1/cve_report/blob/main/FH451/frmL7ProtForm.md#payload - https://www.tenda.com.cn/
CVE ID: CVE-2025-7506 State: PUBLISHED Published: 2025-07-12T23:02:09.735Z Last Updated: 2025-07-15T13:15:13.320Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: FH451 Problem Types: CWE-121, CWE-119 Description: A vulnerability classified as critical was found in Tenda FH451 1.0.0.9. Affected by this vulnerability is the function fromNatlimit of the file /goform/Natlimit of the component HTTP POST Request Handler. The manipulation of the argument page leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References
exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316189 - https://vuldb.com/?ctiid.316189 - https://vuldb.com/?submit.611505 - https://github.com/zezhifu1/cve_report/blob/main/FH451/fromNatlimit.md - https://github.com/zezhifu1/cve_report/blob/main/FH451/fromNatlimit.md#payload - https://www.tenda.com.cn/
CVE ID: CVE-2025-7507 State: PUBLISHED Published: 2025-08-15T08:25:40.562Z Last Updated: 2025-08-15T16:09:44.837Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L) Vendors: elinkcontent Products: elink – Embed Content Problem Types: CWE-20 Description: The elink – Embed Content plugin for WordPress is vulnerable to Malicious Redirect in all versions up to, and including, 1.1.0. This is due to the plugin not restricting URLS that can be supplied through the elink shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to supply an HTML file that can be leverged to redirect users to a malicious domain. Additional Analyst No
ss and above, to supply an HTML file that can be leverged to redirect users to a malicious domain. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bda249f7-07a9-47ba-bba4-85abd8f8a207?source=cve - https://wordpress.org/plugins/elink-embed-content/
CVE ID: CVE-2025-7508 State: PUBLISHED Published: 2025-07-12T23:32:05.694Z Last Updated: 2025-07-14T16:23:16.775Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Modern Bag Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in code-projects Modern Bag 1.0. Affected by this issue is some unknown functionality of the file /admin/product-update.php. The manipulation of the argument idProduct leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:/
s been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316190 - https://vuldb.com/?ctiid.316190 - https://vuldb.com/?submit.611565 - https://github.com/chipower777/cve/issues/1 - https://code-projects.org/
CVE ID: CVE-2025-7509 State: PUBLISHED Published: 2025-07-13T00:02:05.664Z Last Updated: 2025-07-14T16:09:12.357Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Modern Bag Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in code-projects Modern Bag 1.0. This affects an unknown part of the file /admin/slide.php. The manipulation of the argument idSlide leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316191 - https
c and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316191 - https://vuldb.com/?ctiid.316191 - https://vuldb.com/?submit.611567 - https://github.com/chipower777/cve/issues/2 - https://code-projects.org/
CVE ID: CVE-2025-7510 State: PUBLISHED Published: 2025-07-13T00:32:05.721Z Last Updated: 2025-07-14T16:14:33.284Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Modern Bag Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in code-projects Modern Bag 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/productadd_back.php. The manipulation of the argument namepro leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316192
he public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316192 - https://vuldb.com/?ctiid.316192 - https://vuldb.com/?submit.611568 - https://github.com/chipower777/cve/issues/3 - https://code-projects.org/
CVE ID: CVE-2025-7511 State: PUBLISHED Published: 2025-07-13T01:32:05.659Z Last Updated: 2025-07-14T16:13:59.999Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Chat System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Chat System 1.0 and classified as critical. This issue affects some unknown processing of the file /user/update_account.php. The manipulation of the argument musername leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316193
he public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316193 - https://vuldb.com/?ctiid.316193 - https://vuldb.com/?submit.611668 - https://github.com/LamentXU123/cve/blob/main/sql_update_account.md - https://code-projects.org/
CVE ID: CVE-2025-7512 State: PUBLISHED Published: 2025-07-13T02:02:06.087Z Last Updated: 2025-07-14T16:13:26.404Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Modern Bag Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Modern Bag 1.0. It has been classified as critical. Affected is an unknown function of the file /contact-back.php. The manipulation of the argument contact-name leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316194
he public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316194 - https://vuldb.com/?ctiid.316194 - https://vuldb.com/?submit.612707 - https://github.com/haoyv147/cve/issues/3 - https://code-projects.org/
CVE ID: CVE-2025-7513 State: PUBLISHED Published: 2025-07-13T02:32:05.381Z Last Updated: 2025-07-14T16:12:58.351Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Modern Bag Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Modern Bag 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/slideupdate.php. The manipulation of the argument idSlide leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuld
n disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316195 - https://vuldb.com/?ctiid.316195 - https://vuldb.com/?submit.612708 - https://github.com/haoyv147/cve/issues/2 - https://code-projects.org/
CVE ID: CVE-2025-7514 State: PUBLISHED Published: 2025-07-13T03:02:05.557Z Last Updated: 2025-07-14T16:12:29.858Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Modern Bag Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Modern Bag 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/contact-list.php. The manipulation of the argument idStatus leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?
osed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316196 - https://vuldb.com/?ctiid.316196 - https://vuldb.com/?submit.612709 - https://github.com/haoyv147/cve/issues/1 - https://code-projects.org/
CVE ID: CVE-2025-7515 State: PUBLISHED Published: 2025-07-13T03:32:05.570Z Last Updated: 2025-07-14T16:08:39.620Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Online Appointment Booking System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in code-projects Online Appointment Booking System 1.0. This affects an unknown part of the file /ulocateus.php. The manipulation of the argument doctorname leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References
exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316197 - https://vuldb.com/?ctiid.316197 - https://vuldb.com/?submit.612925 - https://github.com/cccc88/cve/issues/3 - https://code-projects.org/
CVE ID: CVE-2025-7516 State: PUBLISHED Published: 2025-07-13T04:02:05.003Z Last Updated: 2025-07-14T16:08:05.360Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Online Appointment Booking System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in code-projects Online Appointment Booking System 1.0. This vulnerability affects unknown code of the file /cancelbookingpatient.php. The manipulation of the argument appointment leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Re
ely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316198 - https://vuldb.com/?ctiid.316198 - https://vuldb.com/?submit.612926 - https://github.com/cccc88/cve/issues/2 - https://code-projects.org/
CVE ID: CVE-2025-7517 State: PUBLISHED Published: 2025-07-13T04:32:05.213Z Last Updated: 2025-07-14T16:07:29.114Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Online Appointment Booking System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in code-projects Online Appointment Booking System 1.0. This issue affects some unknown processing of the file /getDay.php. The manipulation of the argument cidval leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: R
tely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316199 - https://vuldb.com/?ctiid.316199 - https://vuldb.com/?submit.612927 - https://github.com/cccc88/cve/issues/1 - https://code-projects.org/
CVE ID: CVE-2025-7518 State: PUBLISHED Published: 2025-07-12T09:24:28.763Z Last Updated: 2025-07-14T20:11:48.460Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: rsjoomla Products: RSFirewall! Problem Types: CWE-22 Description: The RSFirewall! plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.1.42 via the get_local_filename() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/thr
in sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fd7b0eef-3b8e-4272-bbd7-ad52088d0835?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3306173%40rsfirewall&new=3306173%40rsfirewall&sfp_email=&sfph_mail=
CVE ID: CVE-2025-7519 State: PUBLISHED Published: 2025-07-14T13:35:21.280Z Last Updated: 2025-11-20T20:59:31.810Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 Problem Types: CWE-787 Description: A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded. To exploit this flaw,
e can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded. To exploit this flaw, a high-privilege account is needed as it's required to place the malicious policy file properly. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-7519 - https://bugzilla.redhat.com/show_bug.cgi?id=2379675 - https://github.com/polkit-org/polkit/commit/107d3801361b9f9084f78710178e683391f1d245 - https://github.com/polkit-org/polkit/pull/570
CVE ID: CVE-2025-7520 State: PUBLISHED Published: 2025-07-13T05:02:06.399Z Last Updated: 2025-07-15T19:54:37.838Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Vehicle Parking Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in PHPGurukul Vehicle Parking Management System 1.13. This issue affects some unknown processing of the file /admin/manage-category.php. The manipulation of the argument del leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrich