Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-2912 State: PUBLISHED Published: 2025-03-28T16:00:11.864Z Last Updated: 2025-07-24T09:43:42.913Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R) Vendors: n/a Products: HDF5 Problem Types: CWE-122, CWE-119 Description: A vulnerability was found in HDF5 up to 1.14.6. It has been declared as problematic. Affected by this vulnerability is the function H5O_msg_flush of the file src/H5Omessage.c. The manipulation of the argument oh leads to heap-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vu
een disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.301885 - https://vuldb.com/?ctiid.301885 - https://vuldb.com/?submit.519966 - https://github.com/HDFGroup/hdf5/issues/5370
CVE ID: CVE-2025-2913 State: PUBLISHED Published: 2025-03-28T16:31:04.298Z Last Updated: 2025-07-24T09:43:45.350Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R) Vendors: n/a Products: HDF5 Problem Types: CWE-416, CWE-119 Description: A vulnerability was found in HDF5 up to 1.14.6. It has been rated as critical. Affected by this issue is the function H5FL__blk_gc_list of the file src/H5FL.c. The manipulation of the argument H5FL_blk_head_t leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.301886
he public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.301886 - https://vuldb.com/?ctiid.301886 - https://vuldb.com/?submit.520404 - https://github.com/HDFGroup/hdf5/issues/5376
CVE ID: CVE-2025-2914 State: PUBLISHED Published: 2025-03-28T16:31:05.962Z Last Updated: 2025-07-24T09:43:47.499Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R) Vendors: n/a Products: HDF5 Problem Types: CWE-122, CWE-119 Description: A vulnerability classified as problematic has been found in HDF5 up to 1.14.6. This affects the function H5FS__sinfo_Srialize_Sct_cb of the file src/H5FScache.c. The manipulation of the argument sect leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.c
isclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.301887 - https://vuldb.com/?ctiid.301887 - https://vuldb.com/?submit.520880 - https://github.com/HDFGroup/hdf5/issues/5379
CVE ID: CVE-2025-2915 State: PUBLISHED Published: 2025-03-28T17:00:08.968Z Last Updated: 2025-07-24T09:43:40.199Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R) Vendors: n/a Products: HDF5 Problem Types: CWE-122, CWE-119 Description: A vulnerability classified as problematic was found in HDF5 up to 1.14.6. This vulnerability affects the function H5F__accum_free of the file src/H5Faccum.c. The manipulation of the argument overlap_size leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.301
o the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.301888 - https://vuldb.com/?ctiid.301888 - https://vuldb.com/?submit.520899 - https://github.com/HDFGroup/hdf5/issues/5380
CVE ID: CVE-2025-2916 State: PUBLISHED Published: 2025-03-28T17:00:10.892Z Last Updated: 2025-03-28T17:17:26.259Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Aishida Products: Call Center System Problem Types: CWE-77, CWE-74 Description: A vulnerability, which was classified as critical, has been found in Aishida Call Center System up to 20250314. This issue affects some unknown processing of the file /doscall/weixin/open/amr2mp3. The manipulation of the argument File leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any wa
closed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.301889 - https://vuldb.com/?ctiid.301889 - https://vuldb.com/?submit.520604 - https://github.com/ZOKEYE/CVE/blob/main/CVE_1.md
CVE ID: CVE-2025-2917 State: PUBLISHED Published: 2025-03-28T17:31:04.433Z Last Updated: 2025-03-28T17:43:16.861Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: ChestnutCMS Problem Types: CWE-22 Description: A vulnerability, which was classified as problematic, was found in ChestnutCMS up to 1.5.3. Affected is the function readFile of the file /dev-api/cms/file/read. The manipulation of the argument filePath leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.301890 - https://vu
may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.301890 - https://vuldb.com/?ctiid.301890 - https://vuldb.com/?submit.520933 - https://r0ot.notion.site/ChestnutCMS-1-5-3-Arbitrary-file-read-vulnerability-1ae27d744f7f8074a169ca849e8a1d31?pvs=4
CVE ID: CVE-2025-2918 State: PUBLISHED Published: 2025-06-10T11:22:52.173Z Last Updated: 2025-06-10T13:59:37.592Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ultimateblocks Products: Ultimate Blocks – WordPress Blocks Plugin Problem Types: CWE-79 Description: The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a us
ckers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/41b2a4cc-fb23-41eb-b1a4-d793ae924d9a?source=cve - https://plugins.trac.wordpress.org/browser/ultimate-blocks/tags/3.2.9/src/blocks/how-to/block.php#L335 - https://plugins.trac.wordpress.org/browser/ultimate-blocks/tags/3.2.9/src/blocks/content-filter/block.php#L14 - https://plugins.trac.wordpress.org/browser/ultimate-blocks/tags/3.2.9/src/blocks/tabbed-content/block.php#L136 - https://plugins.trac.wordpress.org/browser/ulti
er/ultimate-blocks/tags/3.2.9/src/blocks/tabbed-content/block.php#L136 - https://plugins.trac.wordpress.org/browser/ultimate-blocks/tags/3.2.9/src/blocks/content-toggle/block.php#L133
CVE ID: CVE-2025-2919 State: PUBLISHED Published: 2025-03-28T17:31:05.919Z Last Updated: 2025-03-28T17:42:25.648Z Severity: N/A (CVSS 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C) Vendors: Netis Products: WF-2404 Problem Types: CWE-1313, CWE-489 Description: A vulnerability was found in Netis WF-2404 1.1.124EN. It has been declared as critical. This vulnerability affects unknown code of the component UART. The manipulation leads to hardware allows activation of test or debug logic at runtime. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additiona
e public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.301894 - https://vuldb.com/?ctiid.301894 - https://vuldb.com/?submit.521036 - https://scoozi.substack.com/p/hacking-a-netis-wf-2404-router-with
CVE ID: CVE-2025-2920 State: PUBLISHED Published: 2025-03-28T18:00:10.769Z Last Updated: 2025-03-28T20:01:38.179Z Severity: LOW (CVSS 2 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Netis Products: WF-2404 Problem Types: CWE-328, CWE-327 Description: A vulnerability was found in Netis WF-2404 1.1.124EN. It has been rated as problematic. This issue affects some unknown processing of the file /еtc/passwd. The manipulation leads to use of weak hash. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early
is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.301895 - https://vuldb.com/?ctiid.301895 - https://vuldb.com/?submit.521037 - https://scoozi.substack.com/p/hacking-a-netis-wf-2404-router-cont
CVE ID: CVE-2025-2921 State: PUBLISHED Published: 2025-03-28T18:00:12.428Z Last Updated: 2025-03-28T19:59:20.003Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Netis Products: WF-2404 Problem Types: CWE-1393 Description: A vulnerability classified as critical has been found in Netis WF-2404 1.1.124EN. Affected is an unknown function of the file /etc/passwd. The manipulation with the input Realtek leads to use of default password. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was conta
ploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.301896 - https://vuldb.com/?ctiid.301896 - https://vuldb.com/?submit.521038 - https://scoozi.substack.com/p/hacking-a-netis-wf-2404-router-cont
CVE ID: CVE-2025-2922 State: PUBLISHED Published: 2025-03-28T19:00:06.491Z Last Updated: 2025-03-28T19:47:23.081Z Severity: LOW (CVSS 2 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Netis Products: WF-2404 Problem Types: CWE-312, CWE-310 Description: A vulnerability classified as problematic was found in Netis WF-2404 1.1.124EN. Affected by this vulnerability is an unknown functionality of the component BusyBox Shell. The manipulation leads to cleartext storage of sensitive information. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may
n attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.301897 - https://vuldb.com/?ctiid.301897 - https://vuldb.com/?submit.521039 - https://scoozi.substack.com/p/hacking-a-netis-wf-2404-router-with
CVE ID: CVE-2025-2923 State: PUBLISHED Published: 2025-03-28T19:00:08.623Z Last Updated: 2025-07-24T09:43:37.926Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R) Vendors: n/a Products: HDF5 Problem Types: CWE-122, CWE-119 Description: A vulnerability, which was classified as problematic, has been found in HDF5 up to 1.14.6. Affected by this issue is the function H5F_addr_encode_len of the file src/H5Fint.c. The manipulation of the argument pp leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com
closed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.301898 - https://vuldb.com/?ctiid.301898 - https://vuldb.com/?submit.521151 - https://github.com/HDFGroup/hdf5/issues/5381
CVE ID: CVE-2025-2924 State: PUBLISHED Published: 2025-03-28T19:31:04.699Z Last Updated: 2025-07-24T09:43:35.784Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R) Vendors: n/a Products: HDF5 Problem Types: CWE-122, CWE-119 Description: A vulnerability, which was classified as problematic, was found in HDF5 up to 1.14.6. This affects the function H5HL__fl_deserialize of the file src/H5HLcache.c. The manipulation of the argument free_block leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.301899 - https://vuldb.com/?ctiid.301899 - https://vuldb.com/?submit.521170 - https://github.com/HDFGroup/hdf5/issues/5382
CVE ID: CVE-2025-2925 State: PUBLISHED Published: 2025-03-28T20:00:11.000Z Last Updated: 2025-07-24T09:43:33.655Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R) Vendors: n/a Products: HDF5 Problem Types: CWE-415, CWE-119 Description: A vulnerability has been found in HDF5 up to 1.14.6 and classified as problematic. This vulnerability affects the function H5MM_realloc of the file src/H5MM.c. The manipulation of the argument mem leads to double free. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.301900 - https://v
d may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.301900 - https://vuldb.com/?ctiid.301900 - https://vuldb.com/?submit.521193 - https://github.com/HDFGroup/hdf5/issues/5383
CVE ID: CVE-2025-2926 State: PUBLISHED Published: 2025-03-28T20:00:13.574Z Last Updated: 2025-07-24T09:43:31.477Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R) Vendors: n/a Products: HDF5 Problem Types: CWE-476, CWE-404 Description: A vulnerability was found in HDF5 up to 1.14.6 and classified as problematic. This issue affects the function H5O__cache_chk_serialize of the file src/H5Ocache.c. The manipulation leads to null pointer dereference. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.301901 - https://vuldb.co
e used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.301901 - https://vuldb.com/?ctiid.301901 - https://vuldb.com/?submit.521246 - https://github.com/HDFGroup/hdf5/issues/5384
CVE ID: CVE-2025-2927 State: PUBLISHED Published: 2025-03-28T20:31:04.742Z Last Updated: 2025-03-31T14:32:44.518Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: ESAFENET Products: CDG Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in ESAFENET CDG 5.6.3.154.205. It has been classified as critical. Affected is an unknown function of the file /parameter/getFileTypeList.jsp. The manipulation of the argument typename leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CIS
ed. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.301902 - https://vuldb.com/?ctiid.301902 - https://vuldb.com/?submit.521263 - https://github.com/Rain1er/report/blob/main/CDG/Mg%3D%3D.md
CVE ID: CVE-2025-2928 State: PUBLISHED Published: 2025-07-29T17:44:23.252Z Last Updated: 2025-08-05T03:56:13.455Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Genetec Inc. Products: Genetec Security Center Problem Types: CWE-89 Description: SQL Injection affecting the Archiver role. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://techdocs.genetec.com/viewer/book-attachment/SZjl87Xb1QrEBmA7EPMZ0Q/wXhU660do0oVQGF89qoodA-SZjl87Xb1QrEBmA7EPMZ0Q - https://techdocs.genetec.com/viewer/book-attachment/EG5x3MPOu~J5abi1egkvRA/N2xk_nlluPjBSxRU11ZCVA-EG5x3MPOu~J5abi1egkvRA - https://techdocs.genetec.com/r/en-US/Security-Updates-for-Security-Cen
A/N2xk_nlluPjBSxRU11ZCVA-EG5x3MPOu~J5abi1egkvRA - https://techdocs.genetec.com/r/en-US/Security-Updates-for-Security-Center-5.11/Resolved-vulnerabilities-in-Security-Center-5.11.3.19 - https://techdocs.genetec.com/r/en-US/Security-Updates-for-Security-Center-5.12/Resolved-vulnerabilities-in-Security-Center-5.12.2.6 - https://techdocs.genetec.com/r/en-US/Security-Updates-for-Security-Center-5.13/Resolved-vulnerabilities-in-Security-Center-5.13.1.1
CVE ID: CVE-2025-2929 State: PUBLISHED Published: 2025-05-20T06:00:06.223Z Last Updated: 2025-05-20T14:01:23.521Z Vendors: Unknown Products: Order Delivery Date Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Order Delivery Date WordPress plugin before 12.4.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e9299d8f-900b-4487-b135-b82946825e61/
CVE ID: CVE-2025-2932 State: PUBLISHED Published: 2025-07-03T12:23:09.361Z Last Updated: 2025-07-03T13:14:49.440Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: jkdevstudio Products: JKDEVKIT Problem Types: CWE-22 Description: The JKDEVKIT plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'font_upload_handler' function in all versions up to, and including, 1.9.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). If Wo
the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). If WooCommerce is enabled, attackers will need Contributor-level access and above. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/68679ff9-48a8-4146-a37f-5f844dc86c92?source=cve - http://example.com/wp-content/plugins/jkdevkit/inc/modules/fonts_manager.php#L1710
CVE ID: CVE-2025-2933 State: PUBLISHED Published: 2025-04-05T01:44:45.847Z Last Updated: 2025-04-07T14:12:05.937Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: aweos Products: Email Notifications for Updates Problem Types: CWE-862 Description: The Email Notifications for Updates plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the awun_import_settings() function in all versions up to, and including, 1.1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be lev
ed attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d52e644b-a58f-4e09-9e53-e9cbef75e34f?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3265589%40wp-update-mail-notification&new=3265589%40wp-update-mail-notification
CVE ID: CVE-2025-2934 State: PUBLISHED Published: 2025-10-09T11:33:43.956Z Last Updated: 2025-10-09T13:48:56.561Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: CWE-770 Description: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 5.2 prior to 18.2.8, 18.3 prior to 18.3.4, and 18.4 prior to 18.4.2 that could have allowed an authenticated attacker to create a denial of service condition by configuring malicious webhook endpoints that send crafted HTTP responses. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://about.gitlab.com/releases/2025/10/08/patch-release-gitlab-18-
lyst Notes: - CISA ADP Vulnrichment: References: - https://about.gitlab.com/releases/2025/10/08/patch-release-gitlab-18-4-2-released/ - https://gitlab.com/gitlab-org/gitlab/-/issues/528979 - https://hackerone.com/reports/3058791
CVE ID: CVE-2025-2935 State: PUBLISHED Published: 2025-06-06T06:42:53.165Z Last Updated: 2025-06-06T16:08:45.282Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: mcitar Products: Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms Problem Types: CWE-352 Description: The Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2024.7. This is due to missing or incorrect nonce validation in the 'ss_option_maint.php' and 'ss_user_filter_list' files. This makes it possible for unauthenticated attackers to delete pending comments, and re-enable
user_filter_list' files. This makes it possible for unauthenticated attackers to delete pending comments, and re-enable a previously blocked user via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/aefb192a-ed42-44a9-bbd1-5906909a419c?source=cve - https://plugins.trac.wordpress.org/browser/stop-spammer-registrations-plugin/trunk/settings/ss_option_maint.php#L73 - https://plugins.trac.wordpress.org/browser/stop-spammer-registrations-plugin/trunk/settings/ss_user_filter_list.php#L239 - https://plugins.trac.
dpress.org/browser/stop-spammer-registrations-plugin/trunk/settings/ss_user_filter_list.php#L239 - https://plugins.trac.wordpress.org/browser/stop-spammer-registrations-plugin/trunk/settings/ss_user_filter_list.php#L447
CVE ID: CVE-2025-2937 State: PUBLISHED Published: 2025-08-13T17:26:55.506Z Last Updated: 2025-08-13T20:03:48.370Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-1333 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 13.2 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed authenticated users to create a denial of service condition by sending specially crafted markdown payloads to the Wiki feature. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/528995 - https://hackerone.com/reports/30588
P Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/528995 - https://hackerone.com/reports/3058879