Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
s issue affects some unknown processing of the component Download Interface. The manipulation leads to improper authorization. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306287 - https://vuldb.com/?ctiid.306287 - https://www.gl-inet.com/security-updates/security-advisories-vulnerabilities-and-cves-apr-24-2025/
CVE ID: CVE-2025-2851 State: PUBLISHED Published: 2025-04-26T08:00:08.117Z Last Updated: 2025-04-28T18:09:44.918Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: GL.iNet Products: GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7, GL-E750, GL-E750V2 Mudi, GL-MT300N-V2 Mango, GL-MT1300 Beryl, GL-MT2500 Brume 2, GL-MT3000 Beryl AX, GL-MT6000 Flint 2, GL-SFT1200 Opal, GL-X300B Collie, GL-X750 Spitz, GL-X3000 Spitz AX, GL-XE300 Puli, GL-XE3000 Puli AX Problem Types: CWE-120, CWE-119 Description: A vulnerability classified as crit
itz AX, GL-XE300 Puli, GL-XE3000 Puli AX Problem Types: CWE-120, CWE-119 Description: A vulnerability classified as critical has been found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7, GL-E750, GL-E750V2 Mudi, GL-MT300N-V2 Mango, GL-MT1300 Beryl, GL-MT2500 Brume 2, GL-MT3000 Beryl AX, GL-MT6000 Flint 2, GL-SFT1200 Opal, GL-X300B Collie, GL-X750 Spitz, GL-X3000 Spitz AX, GL-XE300 Puli and GL-XE3000 Puli AX 4.x. Affected is an unknown function of the file plugins.so of the component RPC Handler. The manipulation leads to buffer overflow. It
s an unknown function of the file plugins.so of the component RPC Handler. The manipulation leads to buffer overflow. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306288 - https://vuldb.com/?ctiid.306288 - https://www.gl-inet.com/security-updates/security-advisories-vulnerabilities-and-cves-apr-24-2025/
CVE ID: CVE-2025-2852 State: PUBLISHED Published: 2025-03-27T14:00:13.496Z Last Updated: 2025-03-27T14:19:14.731Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: SourceCodester Products: Food Ordering Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in SourceCodester Food Ordering Management System up to 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/menus/view_menu.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichmen
remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.301495 - https://vuldb.com/?ctiid.301495 - https://vuldb.com/?submit.522402 - https://hackmd.io/@gnol719/rJqOPiInye - https://www.sourcecodester.com/
CVE ID: CVE-2025-2853 State: PUBLISHED Published: 2025-05-22T13:30:48.335Z Last Updated: 2025-05-22T14:50:36.079Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-770 Description: An issue has been discovered in GitLab CE/EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A lack of proper validation in GitLab could allow an authenticated user to cause a denial of service condition. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/527218 - https://hackerone.com/reports/3015673
CVE ID: CVE-2025-2854 State: PUBLISHED Published: 2025-03-27T14:31:04.730Z Last Updated: 2025-03-28T12:46:27.885Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Payroll Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in code-projects Payroll Management System 1.0. Affected by this vulnerability is an unknown functionality of the file update_employee.php. The manipulation of the argument emp_type leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA A
disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.301501 - https://vuldb.com/?ctiid.301501 - https://vuldb.com/?submit.522479 - https://github.com/hak0neP/cve/blob/main/sql-fizz.md - https://code-projects.org/
CVE ID: CVE-2025-2855 State: PUBLISHED Published: 2025-03-27T15:31:04.560Z Last Updated: 2025-03-27T16:10:05.956Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: elunez Products: eladmin Problem Types: CWE-502, CWE-20 Description: A vulnerability, which was classified as problematic, has been found in elunez eladmin up to 2.7. Affected by this issue is the function checkFile of the file /api/deploy/upload. The manipulation of the argument servers leads to deserialization. The attack may be launched remotely. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.301502 - https://vuldb.com/?ctiid.301502 - https://vuldb.com/?submit.522504 - https://
ferences: - https://vuldb.com/?id.301502 - https://vuldb.com/?ctiid.301502 - https://vuldb.com/?submit.522504 - https://github.com/elunez/eladmin/issues/873
CVE ID: CVE-2025-2856 State: REJECTED Published: N/A Last Updated: 2025-07-05T22:16:39.076Z Description: No description available.
CVE ID: CVE-2025-2857 State: PUBLISHED Published: 2025-03-27T13:27:57.377Z Last Updated: 2025-10-31T13:23:45.890Z Vendors: Mozilla Products: Firefox, Firefox ESR Problem Types: Incorrect handle could lead to sandbox escapes Description: Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compromised child process could cause the parent process to return an unintentionally powerful handle, leading to a sandbox escape. The original vulnerability was being exploited in the wild. *This only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 136.0.4, Firefox ES
ts Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 136.0.4, Firefox ESR < 128.8.1, and Firefox ESR < 115.21.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1956398 - https://issues.chromium.org/issues/405143032 - https://www.cve.org/CVERecord?id=CVE-2025-2783 - https://www.mozilla.org/security/advisories/mfsa2025-19/
CVE ID: CVE-2025-2858 State: PUBLISHED Published: 2025-03-28T13:08:23.567Z Last Updated: 2025-03-28T13:38:38.910Z Vendors: Arteche Products: saTECH BCU Problem Types: CWE-269 Description: Privilege escalation vulnerability in the saTECH BCU firmware version 2.1.3. An attacker with access to the CLI of the device could make use of the nice command to bypass all restrictions and elevate privileges as a superuser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-arteches-satech-bcu
CVE ID: CVE-2025-2859 State: PUBLISHED Published: 2025-03-28T13:09:58.324Z Last Updated: 2025-04-04T12:46:30.162Z Vendors: Arteche Products: saTECH BCU Problem Types: CWE-287 Description: An attacker with network access, could capture traffic and obtain user cookies, allowing the attacker to steal the active user session and make changes to the device via web, depending on the privileges obtained by the user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-arteches-satech-bcu
CVE ID: CVE-2025-2860 State: PUBLISHED Published: 2025-03-28T13:10:44.182Z Last Updated: 2025-03-28T13:37:58.540Z Vendors: Arteche Products: saTECH BCU Problem Types: CWE-200 Description: SaTECH BCU in its firmware version 2.1.3, allows an authenticated attacker to access information about the credentials that users have within the web (.xml file). In order to exploit this vulnerability, the attacker must know the path, regardless of the user's privileges on the website. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-arteches-satech-bcu
CVE ID: CVE-2025-2861 State: PUBLISHED Published: 2025-03-28T13:11:29.282Z Last Updated: 2025-04-03T12:58:35.556Z Vendors: Arteche Products: saTECH BCU Problem Types: CWE-319 Description: SaTECH BCU in its firmware version 2.1.3 uses the HTTP protocol. The use of the HTTP protocol for web browsing has the problem that information is exchanged in unencrypted text. Since sensitive data such as credentials are exchanged, an attacker could obtain them and log in legitimately. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-arteches-satech-bcu
CVE ID: CVE-2025-2862 State: PUBLISHED Published: 2025-03-28T13:15:08.022Z Last Updated: 2025-03-28T13:34:42.132Z Vendors: Arteche Products: saTECH BCU Problem Types: CWE-261 Description: SaTECH BCU, in its firmware version 2.1.3, performs weak password encryption. This allows an attacker with access to the device's system or website to obtain the credentials, as the storage methods used are not strong enough in terms of encryption. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-arteches-satech-bcu
CVE ID: CVE-2025-2863 State: PUBLISHED Published: 2025-03-28T13:22:38.259Z Last Updated: 2025-03-28T14:33:15.200Z Vendors: Arteche Products: saTECH BCU Problem Types: CWE-352 Description: Cross-site request forgery (CSRF) vulnerability in the web application of saTECH BCU firmware version 2.1.3, which could allow an unauthenticated local attacker to exploit active administrator sessions and perform malicious actions. The malicious actions that can be executed by the attacker depend on the logged-in user, and may include rebooting the device or modifying roles and permissions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-s
s. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-arteches-satech-bcu
CVE ID: CVE-2025-2864 State: PUBLISHED Published: 2025-03-28T13:23:41.194Z Last Updated: 2025-03-28T14:32:45.839Z Vendors: Arteche Products: saTECH BCU Problem Types: CWE-79 Description: SaTECH BCU in its firmware version 2.1.3 allows an attacker to inject malicious code into the legitimate website owning the affected device, once the cookie is set. This attack only impacts the victim's browser (reflected XSS). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-arteches-satech-bcu
CVE ID: CVE-2025-2865 State: PUBLISHED Published: 2025-03-28T13:24:47.015Z Last Updated: 2025-03-28T14:32:18.569Z Vendors: Arteche Products: saTECH BCU Problem Types: CWE-942 Description: SaTECH BCU, in its firmware version 2.1.3, could allow XSS attacks and other malicious resources to be stored on the web server. An attacker with some knowledge of the web application could send a malicious request to the victim users. Through this request, the victims would interpret the code (resources) stored on another malicious website owned by the attacker. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-a
- CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-arteches-satech-bcu
CVE ID: CVE-2025-2866 State: PUBLISHED Published: 2025-04-27T19:04:52.226Z Last Updated: 2025-11-03T19:46:42.576Z Vendors: The Document Foundation Products: LibreOffice Problem Types: CWE-347 Description: Improper Verification of Cryptographic Signature vulnerability in LibreOffice allows PDF Signature Spoofing by Improper Validation. In the affected versions of LibreOffice a flaw in the verification code for adbe.pkcs7.sha1 signatures could cause invalid signatures to be accepted as valid This issue affects LibreOffice: from 24.8 before < 24.8.6, from 25.2 before < 25.2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.libreoffice.org/a
Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.libreoffice.org/about-us/security/advisories/cve-2025-2866
CVE ID: CVE-2025-2867 State: PUBLISHED Published: 2025-03-27T14:02:18.359Z Last Updated: 2025-03-27T14:18:32.168Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-94 Description: An issue has been discovered in the GitLab Duo with Amazon Q affecting all versions from 17.8 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. A specifically crafted issue could manipulate AI-assisted development features to potentially expose sensitive project data to unauthorized users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/512509
CVE ID: CVE-2025-2868 State: PUBLISHED Published: 2025-03-28T10:48:36.929Z Last Updated: 2025-03-28T14:16:51.615Z Vendors: Clinic Queuing System Products: Clinic Queuing System Problem Types: CWE-79 Description: Reflected Cross-Site Scripting (XSS) vulnerability in version 1.0 of the Clinic Queuing System. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the page parameter in /index.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-clinic-queuing-system
CVE ID: CVE-2025-2869 State: PUBLISHED Published: 2025-03-28T10:49:09.243Z Last Updated: 2025-03-28T14:07:29.923Z Vendors: Clinic Queuing System Products: Clinic Queuing System Problem Types: CWE-79 Description: Reflected Cross-Site Scripting (XSS) vulnerability in version 1.0 of the Clinic Queuing System. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the id parameter in /manage_user.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-clinic-queuing-system
CVE ID: CVE-2025-2870 State: PUBLISHED Published: 2025-03-28T10:49:28.966Z Last Updated: 2025-03-28T15:35:34.017Z Vendors: Clinic Queuing System Products: Clinic Queuing System Problem Types: CWE-79 Description: Reflected Cross-Site Scripting (XSS) vulnerability in version 1.0 of the Clinic Queuing System. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the page parameter in /patient_side.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-clinic-queuing-system
CVE ID: CVE-2025-2871 State: PUBLISHED Published: 2025-04-12T03:21:34.380Z Last Updated: 2025-04-14T16:29:58.621Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: quadlayers Products: WordPress Mega Menu – QuadMenu Problem Types: CWE-352 Description: The WordPress Mega Menu – QuadMenu plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.0. This is due to missing or incorrect nonce validation on the ajax_dismiss_notice() function. This makes it possible for unauthenticated attackers to update any user meta to a value of one, including wp_capabilities which could result in a privilege deescalation of an admi
ate any user meta to a value of one, including wp_capabilities which could result in a privilege deescalation of an administrator, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1ba7b675-54d6-4f0e-b60f-1c7fa6ff24ea?source=cve - https://plugins.trac.wordpress.org/browser/quadmenu/tags/3.2.0/lib/class-admin.php#L105 - https://plugins.trac.wordpress.org/changeset/3270825/quadmenu/tags/3.2.1/lib/class-admin.php
CVE ID: CVE-2025-2872 State: REJECTED Published: N/A Last Updated: 2025-05-27T18:14:48.888Z Description: No description available.
CVE ID: CVE-2025-2873 State: REJECTED Published: N/A Last Updated: 2025-04-10T07:47:17.015Z Description: No description available.
CVE ID: CVE-2025-2874 State: PUBLISHED Published: 2025-04-03T07:21:22.448Z Last Updated: 2025-04-03T19:10:35.580Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: specialk Products: User Submitted Posts – Enable Users to Submit Posts from the Front End Problem Types: CWE-79 Description: The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 20240319 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject ar
caping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8b212a1a-0e2b-4327-93b5-398bd7a36b5c?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3263067%40user-submitted-posts&new=3263067%40user-submitted-posts&sfp_email=&sfph_mail=
CVE ID: CVE-2025-2875 State: PUBLISHED Published: 2025-05-14T08:46:19.416Z Last Updated: 2025-05-14T13:38:32.786Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Schneider Electric Products: Modicon Controllers M241 / M251, Modicon Controllers M258 / LMC058 Problem Types: CWE-610 Description: CWE-610: Externally Controlled Reference to a Resource in Another Sphere vulnerability exists that could cause a loss of confidentiality when an unauthenticated attacker manipulates controller’s webserver URL to access resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-133-01&p_enDo
: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-133-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-133-01.pdf
CVE ID: CVE-2025-2876 State: PUBLISHED Published: 2025-04-08T11:11:31.603Z Last Updated: 2025-04-08T12:59:23.581Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: melapress Products: MelaPress Login Security Premium, MelaPress Login Security Problem Types: CWE-862 Description: The MelaPress Login Security and MelaPress Login Security Premium plugins for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'monitor_admin_actions' function in version 2.1.0. This makes it possible for unauthenticated attackers to delete any user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/th
ackers to delete any user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/559cbc69-85b6-4bad-9bb2-26d64195ba7e?source=cve - https://plugins.trac.wordpress.org/browser/melapress-login-security/trunk/app/modules/temporary-logins/class-temporary-logins.php#L71 - https://melapress.com/wordpress-login-security/releases/ - https://plugins.trac.wordpress.org/changeset/3267748/
CVE ID: CVE-2025-2877 State: PUBLISHED Published: 2025-03-28T14:05:18.308Z Last Updated: 2025-11-20T07:27:35.627Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: Red Hat Ansible Automation Platform 2.4 for RHEL 8, Red Hat Ansible Automation Platform 2.4 for RHEL 9, Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 Problem Types: CWE-1295 Description: A flaw was found in the Ansible Automation Platform's Event-Driven Ansible. In configurations where verbosity is set to "debug", inventory passwords are exposed in plain text when starting a rulebook activation. This issue exists for any "deb
ebug", inventory passwords are exposed in plain text when starting a rulebook activation. This issue exists for any "debug" action in a rulebook and also affects Event Streams. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:3636 - https://access.redhat.com/errata/RHSA-2025:3637 - https://access.redhat.com/security/cve/CVE-2025-2877 - https://bugzilla.redhat.com/show_bug.cgi?id=2355540
CVE ID: CVE-2025-2878 State: PUBLISHED Published: 2025-03-27T23:00:10.802Z Last Updated: 2025-03-28T14:45:48.743Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: Kentico Products: CMS Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in Kentico CMS up to 13.0.178. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /CMSInstall/install.aspx of the component Additional Database Installation Wizard. The manipulation of the argument new database leads to cross site scripting. The attack can be launched remotely. Upgrading to version 13.0.179 is able to address this issue. It is recommended to upgrade the affe
be launched remotely. Upgrading to version 13.0.179 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.301813 - https://vuldb.com/?ctiid.301813 - https://vuldb.com/?submit.503058 - https://devnet.kentico.com/download/hotfixes
CVE ID: CVE-2025-2880 State: PUBLISHED Published: 2025-05-02T01:43:36.177Z Last Updated: 2025-05-02T17:33:00.492Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: yame Products: Yame | Link In Bio Problem Types: CWE-200 Description: The Yame | Link In Bio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.9.0 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c45aea72-2c9d-484d-8904-a1985df4b57c?source=cve - https://plugins.svn.wordpress.org/yame-linkinbio/trunk/vendor/phpfastcache/phpfastcache/examples/phpinfo.php - https://wordpress.org/plugins/yame-linkinbio/#developers