Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-4552 State: PUBLISHED Published: 2025-05-11T23:31:04.342Z Last Updated: 2025-05-12T15:05:41.241Z Severity: N/A (CVSS 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P) Vendors: n/a Products: ContiNew Admin Problem Types: CWE-620, CWE-640 Description: A vulnerability has been found in ContiNew Admin up to 3.6.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /dev-api/system/user/1/password. The manipulation leads to unverified password change. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analys
and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.308299 - https://vuldb.com/?ctiid.308299 - https://vuldb.com/?submit.567572 - https://github.com/uglory-gll/javasec/blob/main/continew-admin.md#21dev-apisystemuser1password-only-assigning-password-reset-permission-can-reset-the-super-administrator-password
CVE ID: CVE-2025-4553 State: PUBLISHED Published: 2025-05-12T00:00:10.529Z Last Updated: 2025-05-12T14:51:30.220Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Apartment Visitors Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/bwdates-reports-details.php. The manipulation of the argument fromdate/todate leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnr
nched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.308300 - https://vuldb.com/?ctiid.308300 - https://vuldb.com/?submit.567584 - https://github.com/y77-88/myCVE/issues/8 - https://phpgurukul.com/
CVE ID: CVE-2025-4554 State: PUBLISHED Published: 2025-05-12T00:31:05.802Z Last Updated: 2025-05-12T14:50:47.187Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Apartment Visitors Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/bwdates-passreports-details.php. The manipulation of the argument fromdate/todate leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnr
ttack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.308301 - https://vuldb.com/?ctiid.308301 - https://vuldb.com/?submit.567586 - https://github.com/y77-88/myCVE/issues/9 - https://phpgurukul.com/
CVE ID: CVE-2025-4555 State: PUBLISHED Published: 2025-05-12T02:02:15.570Z Last Updated: 2025-05-12T14:49:54.530Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ZONG YU Products: Okcat Parking Management Platform Problem Types: CWE-306 Description: The web management interface of Okcat Parking Management Platform from ZONG YU has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly access system functions. These functions include opening gates, viewing license plates and parking records, and restarting the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-1
rting the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10108-f77f5-1.html - https://www.twcert.org.tw/en/cp-139-10109-25719-2.html
CVE ID: CVE-2025-4556 State: PUBLISHED Published: 2025-05-12T02:11:56.864Z Last Updated: 2025-05-12T17:49:41.498Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ZONG YU Products: Okcat Parking Management Platform Problem Types: CWE-434 Description: The web management interface of Okcat Parking Management Platform from ZONG YU has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10110-114f0-1.html - https://www.twcert.org.tw/e
ISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10110-114f0-1.html - https://www.twcert.org.tw/en/cp-139-10111-b78e6-2.html
CVE ID: CVE-2025-4557 State: PUBLISHED Published: 2025-05-12T02:24:48.827Z Last Updated: 2025-05-12T17:47:46.065Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: ZONG YU Products: Parking Management System Problem Types: CWE-306 Description: The specific APIs of Parking Management System from ZONG YU has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access specific APIs and operate system functions. These functions include opening gates and restarting the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10112-5de7e-1.html - https://www.twcert.org.tw/en/cp-139
Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10112-5de7e-1.html - https://www.twcert.org.tw/en/cp-139-10113-58c29-2.html
CVE ID: CVE-2025-4558 State: PUBLISHED Published: 2025-05-12T03:08:50.733Z Last Updated: 2025-05-12T17:40:03.588Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: WormHole Tech Products: GPM Problem Types: CWE-620 Description: The GPM from WormHole Tech has an Unverified Password Change vulnerability, allowing unauthenticated remote attackers to change any user's password and use the modified password to log into the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10114-10b4b-1.html - https://www.twcert.org.tw/en/cp-139-10115-f5f14-2.html
CVE ID: CVE-2025-4559 State: PUBLISHED Published: 2025-05-12T06:03:08.950Z Last Updated: 2025-05-12T15:07:53.922Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Netvision Products: ISOinsight Problem Types: CWE-89 Description: The ISOinsight from Netvision has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10116-784e0-1.html - https://www.twcert.org.tw/en/cp-139-10117-57344-2.html
CVE ID: CVE-2025-4560 State: PUBLISHED Published: 2025-05-12T06:17:10.115Z Last Updated: 2025-05-12T14:37:31.814Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Netvision Products: ISOinsight Problem Types: CWE-306 Description: The ISOinsight from Netvision has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access certain system functions. These functions include viewing the administrator list, viewing and editing IP settings, and uploading files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10118-80a8c-1.html - https://www.twcert.org.tw/en/cp-139-10119-d9976-2.htm
rences: - https://www.twcert.org.tw/tw/cp-132-10118-80a8c-1.html - https://www.twcert.org.tw/en/cp-139-10119-d9976-2.html
CVE ID: CVE-2025-4561 State: PUBLISHED Published: 2025-05-12T06:44:29.959Z Last Updated: 2025-05-12T14:33:58.423Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Kinfor Products: KFOX Problem Types: CWE-434 Description: The KFOX from KingFor has an Arbitrary File Upload vulnerability, allowing remote attackers with regular privilege to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10120-269d9-1.html - https://www.twcert.org.tw/en/cp-139-10121-ddbfa-2.html
CVE ID: CVE-2025-4562 State: REJECTED Published: N/A Last Updated: 2025-05-22T22:15:57.929Z Description: No description available.
CVE ID: CVE-2025-4563 State: PUBLISHED Published: 2025-06-23T15:38:42.258Z Last Updated: 2025-06-23T15:58:05.106Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L) Vendors: Kubernetes Products: Kubernetes Problem Types: CWE-20 Description: A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. When the DynamicResourceAllocation feature gate is enabled, the controller properly validates resource claim statuses during pod status updates but fails to perform equivalent validation during pod creation. This allows a compromised node to create mirror pods that access unauthorized dynamic resour
dation during pod creation. This allows a compromised node to create mirror pods that access unauthorized dynamic resources, potentially leading to privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://groups.google.com/g/kubernetes-security-announce/c/Zv84LMRuvMQ - https://github.com/kubernetes/kubernetes/issues/132151
CVE ID: CVE-2025-4564 State: PUBLISHED Published: 2025-05-15T11:13:15.235Z Last Updated: 2025-05-15T13:31:08.758Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: facturaone Products: TicketBAI Facturas para WooCommerce Problem Types: CWE-22 Description: The TicketBAI Facturas para WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation via the 'delpdf' action in all versions up to, and including, 3.18. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Ad
on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2927aa13-b012-41eb-93bd-38a4e5fc5455?source=cve - https://plugins.trac.wordpress.org/browser/wp-ticketbai/trunk/wp-ticketbai.php#L240 - https://plugins.trac.wordpress.org/changeset/3292061/
CVE ID: CVE-2025-4565 State: PUBLISHED Published: 2025-06-16T14:50:40.906Z Last Updated: 2025-06-16T15:39:18.263Z Vendors: protocolbuffers Products: Python-Protobuf Problem Types: CWE-674 Description: Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =>6.31.1 or beyond commit 17838beda2943d08b8a9d4df5b68f5f04f26d901 Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
1 or beyond commit 17838beda2943d08b8a9d4df5b68f5f04f26d901 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/protocolbuffers/protobuf/commit/17838beda2943d08b8a9d4df5b68f5f04f26d901
CVE ID: CVE-2025-4566 State: PUBLISHED Published: 2025-07-29T04:23:45.848Z Last Updated: 2025-07-29T14:03:24.971Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: elemntor Products: Elementor Website Builder – More Than Just a Page Builder Problem Types: CWE-79 Description: The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-text DOM element attribute in Text Path widget in all versions up to, and including, 3.30.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inj
and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This attack affects only Chrome/Edge browsers Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/af29ec92-5b07-4f57-a25f-19f3a894a193?source=cve - https://plugins.trac.wordpress.org/browser/elementor/tags/3.28.4/assets/js/text-path.acb8842ac7e1cd1dfb44.bundle.js#L190 - https://plugins.trac.wordpress.org/browser/elementor/tags/3.28.4/assets/js/text-path.acb8842ac7e1cd1dfb44.bundle.js#L147 - https://plugins.tra
ordpress.org/browser/elementor/tags/3.28.4/assets/js/text-path.acb8842ac7e1cd1dfb44.bundle.js#L147 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3332337%40elementor&new=3332337%40elementor&sfp_email=&sfph_mail=
CVE ID: CVE-2025-4567 State: PUBLISHED Published: 2025-06-03T06:00:17.565Z Last Updated: 2025-06-03T15:24:55.420Z Vendors: Unknown Products: Post Slider and Post Carousel with Post Vertical Scrolling Widget Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Post Slider and Post Carousel with Post Vertical Scrolling Widget WordPress plugin before 3.2.10 does not validate and escape some of its Widget options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability
ite Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b8a50ae9-40c4-42f8-9342-2440d3bc12bb/
CVE ID: CVE-2025-4568 State: PUBLISHED Published: 2025-06-05T10:03:37.577Z Last Updated: 2025-06-05T15:02:21.474Z Vendors: Trol InterMedia Products: 2ClickPortal Problem Types: CWE-89 Description: Improper neutralization of input provided by an unauthorized user into changes__reference_id parameter in URL allows for boolean-based Blind SQL Injection attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/06/CVE-2025-4568 - https://2clickportal.pl/
CVE ID: CVE-2025-4569 State: PUBLISHED Published: 2025-07-21T07:51:35.221Z Last Updated: 2025-07-22T02:14:11.303Z Vendors: ASUS Products: MyASUS Problem Types: CWE-798 Description: An insecure sensitive key storage issue was found in MyASUS. potentially allowing unauthorized actor to obtain a token that could be used to communicate with certain services. Refer to the 'Security Update for for MyASUS' section on the ASUS Security Advisory for more information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.asus.com/content/security-advisory/
CVE ID: CVE-2025-4570 State: PUBLISHED Published: 2025-07-21T07:52:00.800Z Last Updated: 2025-07-22T02:15:20.471Z Vendors: ASUS Products: MyASUS Problem Types: CWE-798 Description: An insecure sensitive key storage issue was found in MyASUS. potentially allowing unauthorized actor to obtain a token that could be used to communicate with certain services. Refer to the 'Security Update for for MyASUS' section on the ASUS Security Advisory for more information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.asus.com/content/security-advisory/
CVE ID: CVE-2025-4571 State: PUBLISHED Published: 2025-06-19T06:44:48.532Z Last Updated: 2025-06-20T13:11:45.801Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: givewp Products: GiveWP – Donation Plugin and Fundraising Platform Problem Types: CWE-862 Description: The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized view and modification of data due to an insufficient capability check on the permissionsCheck functions in all versions up to, and including, 4.3.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to view or delete fundraising campaigns, view donors'
authenticated attackers, with Contributor-level access and above, to view or delete fundraising campaigns, view donors' data, modify campaign events, etc. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8f03b4ef-e877-430e-a440-3af0feca818c?source=cve - https://plugins.trac.wordpress.org/browser/give/tags/4.2.0/src/Campaigns/ListTable/Routes/DeleteCampaignListTable.php#L40 - https://plugins.trac.wordpress.org/browser/give/tags/4.2.0/src/EventTickets/Routes/UpdateEvent.php#L36 - https://plugins.trac.wordpress.org/browser/give/tags/4.2.0/src/Campaigns/ListTable/Routes/GetCampaignsListTable.php#L95 - https://plugins.trac.
rdpress.org/browser/give/tags/4.2.0/src/Campaigns/ListTable/Routes/GetCampaignsListTable.php#L95 - https://plugins.trac.wordpress.org/browser/give/tags/4.2.0/src/Donors/Endpoints/ListDonors.php#L31 - https://plugins.trac.wordpress.org/browser/give/tags/4.2.0/src/Donors/Endpoints/Endpoint.php#L57 - https://plugins.trac.wordpress.org/browser/give/tags/4.2.0/src/API/Endpoints/Logs/GetLogs.php#L40 - https://plugins.trac.wordpress.org/browser/give/tags/4.2.0/src/API/Endpoints/Logs/Endpoint.php#L26 - https://plugins.trac.wordpress.org/changeset/3305112/
CVE ID: CVE-2025-4573 State: PUBLISHED Published: 2025-06-11T10:22:24.103Z Last Updated: 2025-06-11T13:13:11.535Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-90 Description: Mattermost versions 10.7.x <= 10.7.1, 10.6.x <= 10.6.3, 10.5.x <= 10.5.4, 9.11.x <= 9.11.13 fail to properly validate LDAP group ID attributes, allowing an authenticated administrator with PermissionSysconsoleWriteUserManagementGroups permission to execute LDAP search filter injection via the PUT /api/v4/ldap/groups/{remote_id}/link API when objectGUID is configured as the Group ID Attribute. Additional Analyst Notes: - CISA ADP Vuln
/{remote_id}/link API when objectGUID is configured as the Group ID Attribute. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-4574 State: PUBLISHED Published: 2025-05-13T21:47:24.951Z Last Updated: 2025-11-20T20:49:08.419Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Red Hat Products: Red Hat Directory Server 11, Red Hat Directory Server 12, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4, Red Hat Satellite 6, Red Hat Trusted Artifact Signer, Red Hat Trusted Profile Analyzer Problem Types: CWE-415 Description: In crossbeam-channel rust crate, the internal `Channel` type's `Drop` method has a race condition which could, in some cir
crossbeam-channel rust crate, the internal `Channel` type's `Drop` method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-4574 - https://bugzilla.redhat.com/show_bug.cgi?id=2358890 - https://github.com/crossbeam-rs/crossbeam/pull/1187
CVE ID: CVE-2025-4575 State: PUBLISHED Published: 2025-05-22T13:36:49.694Z Last Updated: 2025-05-22T16:03:42.330Z Vendors: OpenSSL Products: OpenSSL Problem Types: CWE-295 Description: Issue summary: Use of -addreject option with the openssl x509 application adds a trusted use instead of a rejected use for a certificate. Impact summary: If a user intends to make a trusted certificate rejected for a particular use it will be instead marked as trusted for that use. A copy & paste error during minor refactoring of the code introduced this issue in the OpenSSL 3.5 version. If, for example, a trusted CA certificate should be trusted only for the purpose of authenticating TLS servers but not for C
for example, a trusted CA certificate should be trusted only for the purpose of authenticating TLS servers but not for CMS signature verification and the CMS signature verification is intended to be marked as rejected with the -addreject option, the resulting CA certificate will be trusted for CMS signature verification purpose instead. Only users which use the trusted certificate format who use the openssl x509 command line application to add rejected uses are affected by this issue. The issues affecting only the command line application are considered to be Low severity. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL 3.4, 3.3, 3.2, 3.1, 3.0, 1.1
The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL 3.4, 3.3, 3.2, 3.1, 3.0, 1.1.1 and 1.0.2 are also not affected by this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://openssl-library.org/news/secadv/20250522.txt - https://github.com/openssl/openssl/commit/e96d22446e633d117e6c9904cb15b4693e956eaa
CVE ID: CVE-2025-4576 State: PUBLISHED Published: 2025-08-08T15:42:34.497Z Last Updated: 2025-08-08T16:07:00.233Z Vendors: Liferay Products: Portal, DXP Problem Types: CWE-79 Description: A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.133, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the modules/apps/blogs/blogs-web/src/main/resources/META-INF/resources/blogs/entry_cover_image_caption.jsp Additional Analyst Notes: - CISA ADP Vulnrichm
src/main/resources/META-INF/resources/blogs/entry_cover_image_caption.jsp Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-4576
CVE ID: CVE-2025-4577 State: PUBLISHED Published: 2025-06-10T11:22:52.591Z Last Updated: 2025-06-10T13:53:31.392Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: smub Products: Smash Balloon Social Post Feed – Simple Social Feeds for WordPress Problem Types: CWE-79 Description: The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-color attribute in all versions up to, and including, 4.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web
g. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ec3de7e2-4a29-401f-af2c-0ce78d768eae?source=cve - https://plugins.trac.wordpress.org/browser/custom-facebook-feed/tags/4.3.0/assets/js/cff-scripts.js#L245 - https://plugins.trac.wordpress.org/browser/custom-facebook-feed/tags/4.3.0/assets/js/cff-scripts.js#L254
CVE ID: CVE-2025-4578 State: PUBLISHED Published: 2025-06-04T06:00:05.786Z Last Updated: 2025-06-04T13:22:41.426Z Vendors: Unknown Products: File Provider Problem Types: CWE-89 SQL Injection Description: The File Provider WordPress plugin through 1.2.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/3aa76b96-40b7-4bde-a39c-c1aa6f8278fc/