Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-6549 State: PUBLISHED Published: 2025-07-11T15:11:04.939Z Last Updated: 2025-07-11T15:38:56.764Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Juniper Networks Products: Junos OS Problem Types: CWE-863 Description: An Incorrect Authorization vulnerability in the web server of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to reach the Juniper Web Device Manager (J-Web). When Juniper Secure connect (JSC) is enabled on specific interfaces, or multiple interfaces are configured for J-Web, the J-Web UI is reachable over more than the intended interfaces. This issue affects Junos OS: * all versions bef
J-Web, the J-Web UI is reachable over more than the intended interfaces. This issue affects Junos OS: * all versions before 21.4R3-S9, * 22.2 versions before 22.2R3-S5, * 22.4 versions before 22.4R3-S5, * 23.2 versions before 23.2R2-S3, * 23.4 versions before 23.4R2-S5, * 24.2 versions before 24.2R2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA100098
CVE ID: CVE-2025-6550 State: PUBLISHED Published: 2025-06-27T07:22:22.424Z Last Updated: 2025-07-08T21:56:30.347Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: webangon Products: The Pack Elementor addon Problem Types: CWE-79 Description: The The Pack Elementor addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slider_options’ parameter in all versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected pa
vel access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4af2f136-5806-4d5e-a72d-486c4839a695?source=cve - https://plugins.trac.wordpress.org/browser/the-pack-addon/trunk/includes/widgets/element/testimonial_1/one.php#L46 - https://plugins.trac.wordpress.org/browser/the-pack-addon/trunk/includes/widgets/element/carousel_parallax/view.php#L25 - https://plugins.trac.wordpress.org/browser/the-pack-addon/trunk/includes/widgets/element/imgbox_1/view.php#L31 - https://plugins.trac.wordpress.org/browser/the-pack
he-pack-addon/trunk/includes/widgets/element/imgbox_1/view.php#L31 - https://plugins.trac.wordpress.org/browser/the-pack-addon/trunk/includes/widgets/element/imgbox_4/view.php#L57 - https://plugins.trac.wordpress.org/browser/the-pack-addon/trunk/includes/widgets/element/sliderparallax/view.php#L37 - https://plugins.trac.wordpress.org/browser/the-pack-addon/trunk/includes/widgets/element/testimonial_5/one.php#L33 - https://plugins.trac.wordpress.org/changeset/3320280/ - https://plugins.trac.wordpress.org/changeset/3321887/
CVE ID: CVE-2025-6551 State: PUBLISHED Published: 2025-06-24T01:31:08.210Z Last Updated: 2025-06-24T13:28:33.434Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: java-aodeng Products: Hope-Boot Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in java-aodeng Hope-Boot 1.0.0 and classified as problematic. This issue affects the function Login of the file /src/main/java/com/hope/controller/WebController.java. The manipulation of the argument errorMsg leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not res
t has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313691 - https://vuldb.com/?ctiid.313691 - https://vuldb.com/?submit.596615 - https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250613-01/report.md - https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250613-01/report.md#steps-to-reproduce
CVE ID: CVE-2025-6552 State: PUBLISHED Published: 2025-06-24T02:00:15.980Z Last Updated: 2025-06-24T16:55:31.508Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: java-aodeng Products: Hope-Boot Problem Types: CWE-601 Description: A vulnerability was found in java-aodeng Hope-Boot 1.0.0. It has been classified as problematic. Affected is the function doLogin of the file /src/main/java/com/hope/controller/WebController.java of the component Login. The manipulation of the argument redirect_url leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this d
tack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313692 - https://vuldb.com/?ctiid.313692 - https://vuldb.com/?submit.596681 - https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250613-02.md - https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250613-02.md#steps-to-reproduce
CVE ID: CVE-2025-6553 State: PUBLISHED Published: 2025-10-11T08:29:15.689Z Last Updated: 2025-10-14T14:11:42.076Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ovatheme Products: Ovatheme Events Manager Problem Types: CWE-434 Description: The Ovatheme Events Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the process_checkout() function in all versions up to, and including, 1.8.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
e's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/808392a9-dbac-4896-8677-6ddc1213d80d?source=cve - https://themeforest.net/item/em4u-event-management-multipurpose-wordpress-theme/20846579 - https://themeforest.net/item/em4u-event-management-multipurpose-wordpress-theme/20846579#item-description__change_log
CVE ID: CVE-2025-6554 State: PUBLISHED Published: 2025-06-30T21:14:14.799Z Last Updated: 2025-10-21T22:45:23.208Z Vendors: Google Products: Chrome Problem Types: CWE-843 Description: Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_30.html - https://issues.chromium.org/issues/427663123
CVE ID: CVE-2025-6555 State: PUBLISHED Published: 2025-06-24T20:03:31.170Z Last Updated: 2025-06-26T13:29:37.123Z Vendors: Google Products: Chrome Problem Types: CWE-416 Description: Use after free in Animation in Google Chrome prior to 138.0.7204.49 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_24.html - https://issues.chromium.org/issues/407328533
CVE ID: CVE-2025-6556 State: PUBLISHED Published: 2025-06-24T20:03:31.450Z Last Updated: 2025-06-26T13:32:09.229Z Vendors: Google Products: Chrome Problem Types: Insufficient policy enforcement Description: Insufficient policy enforcement in Loader in Google Chrome prior to 138.0.7204.49 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_24.html - https://issues.chromium.org/issues/40062462
CVE ID: CVE-2025-6557 State: PUBLISHED Published: 2025-06-24T20:03:31.837Z Last Updated: 2025-06-26T13:31:49.762Z Vendors: Google Products: Chrome Problem Types: Insufficient data validation Description: Insufficient data validation in DevTools in Google Chrome on Windows prior to 138.0.7204.49 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_24.html - https://issues.chromium.org/issues/406631048
CVE ID: CVE-2025-6558 State: PUBLISHED Published: 2025-07-15T18:12:36.848Z Last Updated: 2025-11-04T21:14:50.202Z Vendors: Google Products: Chrome Problem Types: CWE-20 Description: Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_15.html - https://issues.chromium.org/issues/427162086
CVE ID: CVE-2025-6559 State: PUBLISHED Published: 2025-06-24T01:47:25.776Z Last Updated: 2025-06-24T15:32:51.258Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Sapido Products: BR071n, BR261c, BR270n, BR476n, BRC70n, BRC70x, BRC76n, BRD70n, BRE70n, BRE71n, BRF61c, BRF71n Problem Types: CWE-78 Description: Multiple wireless router models from Sapido have an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server. The affected models are out of support; replacing the device is recommended. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.
eplacing the device is recommended. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10196-898d3-1.html - https://www.twcert.org.tw/en/cp-139-10195-69da1-2.html
CVE ID: CVE-2025-6560 State: PUBLISHED Published: 2025-06-24T02:01:22.300Z Last Updated: 2025-06-24T16:48:18.117Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Sapido Products: BR071n, BR261c, BR270n, BR476n, BRC70n, BRC70x, BRC76n, BRD70n, BRE70n, BRE71n, BRF61c, BRF71n Problem Types: CWE-256 Description: Multiple wireless router models from Sapido have an Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to directly access a system configuration file and obtain plaintext administrator credentials. The affected models are out of support; replacing the device is recommended. Additional Analyst Notes: - CISA ADP Vu
ls. The affected models are out of support; replacing the device is recommended. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10197-524ea-1.html - https://www.twcert.org.tw/en/cp-139-10198-55217-2.html
CVE ID: CVE-2025-6561 State: PUBLISHED Published: 2025-06-26T11:45:17.211Z Last Updated: 2025-06-26T12:57:22.413Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hunt Electronic Products: HBF-09KD, HBF-16NK Problem Types: CWE-497, CWE-256 Description: Certain hybrid DVR models ((HBF-09KD and HBF-16NK)) from Hunt Electronic have an Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to directly access a system configuration file and obtain plaintext administrator credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10199-9c5c6-1.html - https://www.twcert.org.
- CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10199-9c5c6-1.html - https://www.twcert.org.tw/en/cp-139-10200-6b567-2.html
CVE ID: CVE-2025-6562 State: PUBLISHED Published: 2025-06-26T12:12:16.899Z Last Updated: 2025-06-26T12:56:36.888Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Hunt Electronic Products: Hybrid DVR Problem Types: CWE-78 Description: Certain hybrid DVR models (HBF-09KD and HBF-16NK) from Hunt Electronic have an OS Command Injection vulnerability, allowing remote attackers with regular privileges to inject arbitrary OS commands and execute them on the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10201-044e9-1.html - https://www.twcert.org.tw/en/cp-139-10202-f957b-2.html
CVE ID: CVE-2025-6563 State: PUBLISHED Published: 2025-07-03T11:18:26.211Z Last Updated: 2025-07-03T13:17:13.946Z Vendors: MikroTik Products: RouterOS Problem Types: CWE-20 Description: A cross-site scripting vulnerability is present in the hotspot of MikroTik's RouterOS on versions below 7.19.2. An attacker can inject the `javascript` protocol in the `dst` parameter. When the victim browses to the malicious URL and logs in, the XSS executes. The POST request used to login, can also be converted to a GET request, allowing an attacker to send a specifically crafted URL that automatically logs in the victim (into the attacker's account) and triggers the payload. Additional Analyst Notes: - CIS
automatically logs in the victim (into the attacker's account) and triggers the payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.toreon.com/how-a-ski-trip-led-to-a-cve-in-a-wi-fi-hotspot/
CVE ID: CVE-2025-6565 State: PUBLISHED Published: 2025-06-24T13:00:12.914Z Last Updated: 2025-06-25T12:41:43.852Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Netgear Products: WNCE3001 Problem Types: CWE-121, CWE-119 Description: A vulnerability was found in Netgear WNCE3001 1.0.0.50. It has been classified as critical. This affects the function http_d of the component HTTP POST Request Handler. The manipulation of the argument Host leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com
closed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313737 - https://vuldb.com/?ctiid.313737 - https://vuldb.com/?submit.590030 - https://github.com/xiaobor123/vul-finds/tree/main/vul-find-wnce3001-netgear - https://github.com/xiaobor123/vul-finds/tree/main/vul-find-wnce3001-netgear#poc - https://www.netgear.com/
CVE ID: CVE-2025-6566 State: PUBLISHED Published: 2025-06-24T13:00:16.903Z Last Updated: 2025-06-24T15:36:02.368Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R) Vendors: oatpp Products: Oat++ Problem Types: CWE-121, CWE-119 Description: A vulnerability was found in oatpp Oat++ up to 1.3.1. It has been declared as critical. This vulnerability affects the function deserializeArray of the file src/oatpp/json/Deserializer.cpp. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb
disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313738 - https://vuldb.com/?ctiid.313738 - https://vuldb.com/?submit.597453 - https://github.com/oatpp/oatpp/issues/1037 - https://github.com/user-attachments/files/19579448/oatpp_crash.txt
CVE ID: CVE-2025-6567 State: PUBLISHED Published: 2025-06-24T14:31:05.496Z Last Updated: 2025-06-24T14:46:53.501Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Online Recruitment Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Campcodes Online Recruitment Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file Recruitment/admin/view_application.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vul
itiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313739 - https://vuldb.com/?ctiid.313739 - https://vuldb.com/?submit.601339 - https://github.com/Sp1d3rL1/CVE/issues/3 - https://www.campcodes.com/
CVE ID: CVE-2025-6568 State: PUBLISHED Published: 2025-06-24T14:31:08.340Z Last Updated: 2025-06-24T14:44:37.719Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: TOTOLINK Products: EX1200T Problem Types: CWE-120, CWE-119 Description: A vulnerability classified as critical has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. Affected is an unknown function of the file /boafrm/formIpv6Setup of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment:
otely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313740 - https://vuldb.com/?ctiid.313740 - https://vuldb.com/?submit.601344 - https://github.com/d2pq/cve/blob/main/616/23.md - https://github.com/d2pq/cve/blob/main/616/23.md#poc - https://www.totolink.net/
CVE ID: CVE-2025-6569 State: PUBLISHED Published: 2025-06-24T15:00:16.237Z Last Updated: 2025-06-24T15:36:34.445Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: School Fees Payment System Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic was found in code-projects School Fees Payment System 1.0. Affected by this vulnerability is an unknown functionality of the file /student.php. The manipulation of the argument sname/contact/about/emailid/transcation_remark leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst
. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313741 - https://vuldb.com/?ctiid.313741 - https://vuldb.com/?submit.601612 - https://github.com/tuooo/CVE/issues/18 - https://code-projects.org/
CVE ID: CVE-2025-6570 State: PUBLISHED Published: 2025-06-24T15:31:06.365Z Last Updated: 2025-06-25T13:41:30.933Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Hospital Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in PHPGurukul Hospital Management System 4.0. Affected by this issue is some unknown functionality of the file /doctor/search.php. The manipulation of the argument searchdata leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: R
tely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313742 - https://vuldb.com/?ctiid.313742 - https://vuldb.com/?submit.601698 - https://github.com/Ant1sec-ops/HMS4.0-Avdisories/blob/main/Union-based-sqli-on-doctor-search/exploit.md - https://phpgurukul.com/
CVE ID: CVE-2025-6571 State: PUBLISHED Published: 2025-11-11T07:03:19.709Z Last Updated: 2025-11-12T04:57:46.573Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L) Vendors: Axis Communications AB Products: AXIS OS Problem Types: CWE-522 Description: A 3rd-party component exposed its password in process arguments, allowing for low-privileged users to access it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axis.com/dam/public/1f/f8/f0/cve-2025-6571pdf-en-US-504216.pdf
CVE ID: CVE-2025-6572 State: PUBLISHED Published: 2025-08-08T06:00:04.313Z Last Updated: 2025-08-08T18:06:09.215Z Vendors: Unknown Products: OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.2.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
ove to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/58c7a8ac-1acd-45b7-abe5-5635fbb5d4c1/
CVE ID: CVE-2025-6573 State: PUBLISHED Published: 2025-08-08T23:19:14.324Z Last Updated: 2025-08-11T19:35:41.201Z Vendors: Imagination Technologies Products: Graphics DDK Problem Types: CWE-280 Description: Kernel software installed and running inside an untrusted/rich execution environment (REE) could leak information from the trusted execution environment (TEE). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE ID: CVE-2025-6574 State: PUBLISHED Published: 2025-11-01T06:40:36.491Z Last Updated: 2025-11-03T13:30:52.307Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: aonetheme Products: Service Finder Bookings Problem Types: CWE-639 Description: The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and excluding, 6.1. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for authenticated attackers, with subscriber-level access and above, to change arbitrary user's email addresses, including administrators, a
tackers, with subscriber-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/264cb002-bf40-4cc2-9c21-cda9bb24f494?source=cve - https://themeforest.net/item/service-finder-service-and-business-listing-wordpress-theme/15208793
CVE ID: CVE-2025-6575 State: PUBLISHED Published: 2025-09-16T11:48:49.423Z Last Updated: 2025-09-16T19:30:57.096Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Dolusoft Products: Omaspot Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dolusoft Omaspot allows Reflected XSS.This issue affects Omaspot: before 12.09.2025. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0254