Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
rt (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000156624
CVE ID: CVE-2025-61941 State: PUBLISHED Published: 2025-10-15T07:24:09.131Z Last Updated: 2025-10-15T16:03:22.387Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: BUFFALO INC. Products: WXR9300BE6P series Problem Types: CWE-22 Description: A path traversal issue exists in WXR9300BE6P series firmware versions prior to Ver.1.10. Arbitrary file may be altered by an administrative user who logs in to the affected product. Moreover, arbitrary OS command may be executed via some file alteration. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.buffalo.jp/news/detail/20251014-01.html - https://jvn.jp/en/vu/JVNVU96471278/
CVE ID: CVE-2025-61945 State: PUBLISHED Published: 2025-11-04T16:10:49.931Z Last Updated: 2025-11-05T14:34:04.566Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Radiometrics Products: VizAir Problem Types: CWE-306 Description: Radiometrics VizAir is vulnerable to any remote attacker via access to the admin panel of the VizAir system without authentication. Once inside, the attacker can modify critical weather parameters such as wind shear alerts, inversion depth, and CAPE values, which are essential for accurate weather forecasting and flight safety. This unauthorized access could result in the disabling of vital alerts, causing hazardous conditions for a
light safety. This unauthorized access could result in the disabling of vital alerts, causing hazardous conditions for aircraft, and manipulating runway assignments, which could result in mid-air conflicts or runway incursions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-308-04 - https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-308-04.json
CVE ID: CVE-2025-61949 State: PUBLISHED Published: 2025-11-21T06:17:53.887Z Last Updated: 2025-11-21T14:58:14.878Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: LogStare Inc. Products: LogStare Collector (for Windows), LogStare Collector (for Linux) Problem Types: CWE-79 Description: LogStare Collector contains a stored cross-site scripting vulnerability in UserManagement. If crafted user information is stored, an arbitrary script may be executed on the web browser of the user who logs in to the product's management page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.logstare.com/vulnerability/2025-001/ - https://jvn.jp/en/jp
st Notes: - CISA ADP Vulnrichment: References: - https://www.logstare.com/vulnerability/2025-001/ - https://jvn.jp/en/jp/JVN77560819/
CVE ID: CVE-2025-61951 State: PUBLISHED Published: 2025-10-15T13:55:50.364Z Last Updated: 2025-10-16T03:56:31.808Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP Problem Types: CWE-125 Description: Undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. This issue may occur when a Datagram Transport Layer Security (DTLS) 1.2 virtual server is enabled with a Server SSL profile that is configured with a certificate, key, and the SSL Sign Hash set to ANY, and the backend server is enabled with DTLS 1.2 and client authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not eva
LS 1.2 and client authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000151309
CVE ID: CVE-2025-61955 State: PUBLISHED Published: 2025-10-15T13:55:53.996Z Last Updated: 2025-10-16T03:56:22.823Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: F5 Products: F5OS - Appliance, F5OS - Chassis Problem Types: CWE-95 Description: A vulnerability exists in F5OS-A and F5OS-C systems that may allow an authenticated attacker with local access to escalate their privileges. A successful exploit may allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000156771
CVE ID: CVE-2025-61956 State: PUBLISHED Published: 2025-11-04T16:15:05.012Z Last Updated: 2025-11-04T16:26:27.186Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Radiometrics Products: VizAir Problem Types: CWE-306 Description: Radiometrics VizAir is vulnerable to a lack of authentication mechanisms for critical functions, such as admin access and API requests. Attackers can modify configurations without authentication, potentially manipulating active runway settings and misleading air traffic control (ATC) and pilots. Additionally, manipulated meteorological data could mislead forecasters and ATC, causing inaccurate flight planning. Additional Analyst Not
ulated meteorological data could mislead forecasters and ATC, causing inaccurate flight planning. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-308-04 - https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-308-04.json
CVE ID: CVE-2025-61958 State: PUBLISHED Published: 2025-10-15T13:55:53.096Z Last Updated: 2025-10-16T03:56:49.411Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: F5 Products: BIG-IP Problem Types: CWE-250 Description: A vulnerability exists in the iHealth command that may allow an authenticated attacker with at least a resource administrator role to bypass tmsh restrictions and gain access to a bash shell. For BIG-IP systems running in Appliance mode, a successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnri
rsions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000154647
CVE ID: CVE-2025-61959 State: PUBLISHED Published: 2025-10-29T21:54:51.533Z Last Updated: 2025-10-30T20:32:15.522Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Vertikal Systems Products: Hospital Manager Backend Services Problem Types: CWE-209 Description: Prior to September 19, 2025, the Hospital Manager Backend Services returned verbose ASP.NET error pages for invalid WebResource.axd requests, disclosing framework and ASP.NET version information, stack traces, internal paths, and the insecure configuration 'customErrors mode="Off"', which could have facilitated reconnaissance by unauthenticated attackers. Additional Analyst Notes: - CISA ADP Vulnrichmen
ich could have facilitated reconnaissance by unauthenticated attackers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-301-01 - https://www.vertikalsystems.com/en/products/pm/contact.php
CVE ID: CVE-2025-61960 State: PUBLISHED Published: 2025-10-15T13:55:54.357Z Last Updated: 2025-10-16T03:57:05.750Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP Problem Types: CWE-476 Description: When a per-request policy is configured on a BIG-IP APM portal access virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000156597
CVE ID: CVE-2025-61962 State: PUBLISHED Published: 2025-10-04T00:00:00.000Z Last Updated: 2025-11-04T21:14:11.806Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: fetchmail Products: fetchmail Problem Types: CWE-142 Description: In fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed context. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2025/10/03/2 - https://www.fetchmail.info/fetchmail-SA-2025-01.txt - https://gitlab.com/fetchmail/fetchmail/-/commit/4c3cebfa4e659fb778ca2cae0ccb3f69201609a8
CVE ID: CVE-2025-61974 State: PUBLISHED Published: 2025-10-15T13:55:55.076Z Last Updated: 2025-10-16T03:57:03.270Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP, BIG-IP Next SPK, BIG-IP Next CNF, BIG-IP Next for Kubernetes Problem Types: CWE-401 Description: When a client SSL profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000156733
CVE ID: CVE-2025-61977 State: PUBLISHED Published: 2025-10-23T21:51:56.523Z Last Updated: 2025-10-24T14:34:02.891Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: AutomationDirect Products: Productivity Suite, Productivity 3000 P3-622 CPU, Productivity 3000 P3-550E CPU, Productivity 3000 P3-530 CPU, Productivity 2000 P2-622 CPU, Productivity 2000 P2-550 CPU, Productivity 1000 P1-550 CPU, Productivity 1000 P1-540 CPU Problem Types: CWE-640 Description: A weak password recovery mechanism for forgotten password vulnerability was discovered in Productivity Suite software version v4.4.1.19. The vulnerability allows an attacker to decrypt an encrypted project by answe
uctivity Suite software version v4.4.1.19. The vulnerability allows an attacker to decrypt an encrypted project by answering just one recovery question. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-296-01 - https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-296-01.json - https://www.automationdirect.com/support/software-downloads - https://support.automationdirect.com/docs/securityconsiderations.pdf
CVE ID: CVE-2025-61984 State: PUBLISHED Published: 2025-10-06T00:00:00.000Z Last Updated: 2025-11-11T14:50:56.007Z Severity: LOW (CVSS 3.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: OpenBSD Products: OpenSSH Problem Types: CWE-159 Description: ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. (A configuration file that provides a complete literal username is not categorized as an untrusted source.) Additional Analyst Notes: - CISA ADP Vulnrichment: - C
lete literal username is not categorized as an untrusted source.) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2025/10/06/1 - https://marc.info/?l=openssh-unix-dev&m=175974522032149&w=2 - https://www.openssh.com/releasenotes.html#10.1p1
CVE ID: CVE-2025-61985 State: PUBLISHED Published: 2025-10-06T00:00:00.000Z Last Updated: 2025-10-06T18:34:24.777Z Severity: LOW (CVSS 3.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: OpenBSD Products: OpenSSH Problem Types: CWE-158 Description: ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.openwall.com/lists/oss-security/2025/10/06/1 - https://marc.info/?l=openssh-unix-dev&m=175974522032149&w=2 - https://www.openssh.com/releasenotes.html#10.1p1
CVE ID: CVE-2025-61990 State: PUBLISHED Published: 2025-10-15T15:19:52.979Z Last Updated: 2025-10-16T03:56:26.234Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP, BIG-IP Next SPK, BIG-IP Next CNF, BIG-IP Next for Kubernetes Problem Types: CWE-415 Description: When using a multi-bladed platform with more than one blade, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000156912
CVE ID: CVE-2025-61994 State: PUBLISHED Published: 2025-11-06T04:14:30.106Z Last Updated: 2025-11-06T14:09:38.630Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: GROWI, Inc. Products: GROWI Problem Types: CWE-79 Description: Cross-site scripting vulnerability exists in GROWI prior to v7.2.10. If a malicious user creates a page containing crafted contents, an arbitrary script may be executed on the web browser of a victim user who accesses the page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://growi.co.jp/news/39/ - https://jvn.jp/en/jp/JVN95942191/
CVE ID: CVE-2025-61996 State: PUBLISHED Published: 2025-10-07T23:13:31.625Z Last Updated: 2025-10-10T19:21:56.233Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: OPEXUS Products: FOIAXpress Problem Types: CWE-79 Description: OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content within the Annual Report Template. Injected content is executed in the context of other users when they generate an Annual Report. Successful exploitation allows the administrative user to perform actions on behalf of the target, including stealing session cookies, user credentials, or sensitive data. Additional Analyst Notes: - CISA A
the target, including stealing session cookies, user credentials, or sensitive data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.opexustech.com/docs/foiaxpress/11.13.0/FOIAXpress_Release_Notes_11.13.3.0.pdf - https://www.cve.org/CVERecord?id=CVE-2025-61996 - https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-280-01.json
CVE ID: CVE-2025-61997 State: PUBLISHED Published: 2025-10-07T23:13:54.801Z Last Updated: 2025-10-10T19:24:33.430Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: OPEXUS Products: FOIAXpress Problem Types: CWE-79 Description: OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content within the Annual Report Enterprise Banner image upload field. Injected content is executed in the context of other users when they generate an Annual Report. Successful exploitation allows the administrative user to perform actions on behalf of the target, including stealing session cookies, user credentials, or sensitive data. Additi
perform actions on behalf of the target, including stealing session cookies, user credentials, or sensitive data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.opexustech.com/docs/foiaxpress/11.13.0/FOIAXpress_Release_Notes_11.13.3.0.pdf - https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-280-01.json - https://www.cve.org/CVERecord?id=CVE-2025-61997
CVE ID: CVE-2025-61998 State: PUBLISHED Published: 2025-10-07T23:14:16.924Z Last Updated: 2025-10-10T19:39:28.197Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: OPEXUS Products: FOIAXpress Problem Types: CWE-79 Description: OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content as a URL within the Technical Support Hyperlink Manager. Injected content is executed in the context of other users when they click the malicious link. Successful exploitation allows the administrative user to perform actions on behalf of the target, including stealing session cookies, user credentials, or sensitive data. Additional An
actions on behalf of the target, including stealing session cookies, user credentials, or sensitive data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.opexustech.com/docs/foiaxpress/11.13.0/FOIAXpress_Release_Notes_11.13.3.0.pdf - https://www.cve.org/CVERecord?id=CVE-2025-61998 - https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-280-01.json
CVE ID: CVE-2025-61999 State: PUBLISHED Published: 2025-10-07T23:14:38.171Z Last Updated: 2025-10-10T19:38:46.491Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: OPEXUS Products: FOIAXpress Problem Types: CWE-79 Description: OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to upload JavaScript or other content embedded in an SVG image used as a logo. Injected content is executed in the context of other users when they view affected pages. Successful exploitation allows the administrative user to perform actions on behalf of the target, including stealing session cookies, user credentials, or sensitive data. Additional Analyst Notes: - CISA A
the target, including stealing session cookies, user credentials, or sensitive data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.opexustech.com/docs/foiaxpress/11.13.0/FOIAXpress_Release_Notes_11.13.3.0.pdf - https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-280-01.json - https://www.cve.org/CVERecord?id=CVE-2025-61999
CVE ID: CVE-2025-62005 State: PUBLISHED Published: 2025-10-22T14:32:47.453Z Last Updated: 2025-11-13T10:33:45.887Z Vendors: FantasticPlugins Products: SUMO Memberships for WooCommerce Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in FantasticPlugins SUMO Memberships for WooCommerce sumomemberships allows Cross Site Request Forgery.This issue affects SUMO Memberships for WooCommerce: from n/a through < 7.8.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/sumomemberships/vulnerability/wordpress-sumo-memberships-for-woocommerce-plugin-7-8-0-cross-site-request-forgery-csrf-vulnerability?
ips/vulnerability/wordpress-sumo-memberships-for-woocommerce-plugin-7-8-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-62006 State: PUBLISHED Published: 2025-10-22T14:32:47.684Z Last Updated: 2025-11-13T10:33:46.535Z Vendors: VeronaLabs Products: WP SMS Problem Types: CWE-862 Description: Missing Authorization vulnerability in VeronaLabs WP SMS wp-sms.This issue affects WP SMS: from n/a through <= 7.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/wp-sms/vulnerability/wordpress-wp-sms-plugin-7-0-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-62007 State: PUBLISHED Published: 2025-10-22T14:32:47.880Z Last Updated: 2025-11-13T10:33:46.451Z Vendors: bPlugins Products: Voice Feedback Problem Types: CWE-266 Description: Incorrect Privilege Assignment vulnerability in bPlugins Voice Feedback voice-feedback allows Privilege Escalation.This issue affects Voice Feedback: from n/a through <= 1.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/voice-feedback/vulnerability/wordpress-voice-feedback-plugin-1-0-3-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2025-62008 State: PUBLISHED Published: 2025-10-22T14:32:48.273Z Last Updated: 2025-11-13T10:33:46.507Z Vendors: acowebs Products: Product Table For WooCommerce Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in acowebs Product Table For WooCommerce product-table-for-woocommerce.This issue affects Product Table For WooCommerce: from n/a through <= 1.2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/product-table-for-woocommerce/vulnerability/wordpress-product-table-for-woocommerce-plugin-1-2-4-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-62009 State: PUBLISHED Published: 2025-10-22T14:32:48.527Z Last Updated: 2025-11-13T10:33:45.894Z Vendors: Dmitry V. (CEO of "UKR Solution") Products: UPC/EAN/GTIN Code Generator Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Dmitry V. (CEO of "UKR Solution") UPC/EAN/GTIN Code Generator upc-ean-barcode-generator allows Cross Site Request Forgery.This issue affects UPC/EAN/GTIN Code Generator: from n/a through <= 2.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/upc-ean-barcode-generator/vulnerability/wordpress-upc-ean-gtin-code-generator-plugin-2-0-2-cross-site-
/Wordpress/Plugin/upc-ean-barcode-generator/vulnerability/wordpress-upc-ean-gtin-code-generator-plugin-2-0-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-62010 State: PUBLISHED Published: 2025-11-06T15:55:21.866Z Last Updated: 2025-11-13T10:33:45.903Z Vendors: ApusTheme Products: Famita Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Famita famita allows PHP Local File Inclusion.This issue affects Famita: from n/a through <= 1.54. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/famita/vulnerability/wordpress-famita-theme-1-54-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-62011 State: PUBLISHED Published: 2025-11-06T15:55:22.593Z Last Updated: 2025-11-13T10:33:46.387Z Vendors: CodexThemes Products: TheGem Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem thegem.This issue affects TheGem: from n/a through <= 5.10.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/thegem/vulnerability/wordpress-thegem-theme-5-10-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-62012 State: PUBLISHED Published: 2025-11-06T15:55:23.261Z Last Updated: 2025-11-13T10:33:46.436Z Vendors: CodexThemes Products: TheGem (Elementor) Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem (Elementor) thegem-elementor.This issue affects TheGem (Elementor): from n/a through <= 5.10.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/thegem-elementor/vulnerability/wordpress-thegem-elementor-theme-5-10-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-62013 State: PUBLISHED Published: 2025-10-22T14:32:48.799Z Last Updated: 2025-11-13T10:33:45.881Z Vendors: POSIMYTH Products: UiChemy Problem Types: CWE-862 Description: Missing Authorization vulnerability in POSIMYTH UiChemy uichemy.This issue affects UiChemy: from n/a through <= 4.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/uichemy/vulnerability/wordpress-uichemy-plugin-4-0-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-62014 State: PUBLISHED Published: 2025-11-06T15:55:23.874Z Last Updated: 2025-11-13T10:33:46.495Z Vendors: ApusTheme Products: ITok Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme ITok itok.This issue affects ITok: from n/a through <= 1.1.42. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/itok/vulnerability/wordpress-itok-theme-1-1-42-local-file-inclusion-vulnerability?_s_id=cve