Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
Visualization V2406 (All versions < V2406.0008), Teamcenter Visualization V2412 (All versions < V2412.0004), Tecnomatix Plant Simulation V2404 (All versions < V2404.0013). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-542540.html - https://cert-portal.siemens.com/productcert/html/ssa-486186.html
CVE ID: CVE-2025-32455 State: PUBLISHED Published: 2025-06-08T21:02:58.816Z Last Updated: 2025-06-09T18:38:09.297Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: ON Semiconductor Products: Quantenna Wi-Fi chipset Problem Types: CWE-88 Description: The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the run_cmd argument), that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the
VSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://takeonme.org/cves/cve-2025-3460 - https://community.onsemi.com/s/article/QCS-Quantenna-Wi-Fi-product-support-and-security-best-practices
CVE ID: CVE-2025-32456 State: PUBLISHED Published: 2025-06-08T21:03:12.814Z Last Updated: 2025-06-10T13:24:14.742Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: ON Semiconductor Products: Quantenna Wi-Fi chipset Problem Types: CWE-88 Description: The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the put_file_to_qtn argument), that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). This issue affects Quantenna Wi-Fi chipset through version 8.0.0.2
S 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://takeonme.org/cves/cve-2025-3460 - https://community.onsemi.com/s/article/QCS-Quantenna-Wi-Fi-product-support-and-security-best-practices
CVE ID: CVE-2025-32457 State: PUBLISHED Published: 2025-06-08T21:03:24.532Z Last Updated: 2025-06-10T13:23:32.884Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: ON Semiconductor Products: Quantenna Wi-Fi chipset Problem Types: CWE-88 Description: The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the get_file_from_qtn argument), that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). This issue affects Quantenna Wi-Fi chipset through version 8.0.0
VSS 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://takeonme.org/cves/cve-2025-3460 - https://community.onsemi.com/s/article/QCS-Quantenna-Wi-Fi-product-support-and-security-best-practices
CVE ID: CVE-2025-32458 State: PUBLISHED Published: 2025-06-08T21:04:12.492Z Last Updated: 2025-06-10T13:23:10.764Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: ON Semiconductor Products: Quantenna Wi-Fi chipset Problem Types: CWE-88 Description: The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the get_syslog_from_qtn argument), that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). This issue affects Quantenna Wi-Fi chipset through version 8.0
CVSS 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://takeonme.org/cves/cve-2025-3460 - https://community.onsemi.com/s/article/QCS-Quantenna-Wi-Fi-product-support-and-security-best-practices
CVE ID: CVE-2025-32459 State: PUBLISHED Published: 2025-06-08T21:04:25.317Z Last Updated: 2025-06-10T13:22:40.590Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: ON Semiconductor Products: Quantenna Wi-Fi chipset Problem Types: CWE-88 Description: The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the sync_time argument), that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of t
(CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://takeonme.org/cves/cve-2025-3460 - https://community.onsemi.com/s/article/QCS-Quantenna-Wi-Fi-product-support-and-security-best-practices
CVE ID: CVE-2025-32460 State: PUBLISHED Published: 2025-04-09T00:00:00.000Z Last Updated: 2025-04-09T19:27:10.698Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: GraphicsMagick Products: GraphicsMagick Problem Types: CWE-125 Description: GraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in coders/jxl.c, related to an ImportViewPixelArea call. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/8e56520435df50f618a03f2721a39a70a515f1cb - https://tracker.debian.org/news/1636753/accepted-graphicsmagick-14really1345hg17696-1-source-into-unstable/ - https://i
https://tracker.debian.org/news/1636753/accepted-graphicsmagick-14really1345hg17696-1-source-into-unstable/ - https://issues.oss-fuzz.com/issues/406320404
CVE ID: CVE-2025-32461 State: PUBLISHED Published: 2025-04-09T00:00:00.000Z Last Updated: 2025-11-03T19:53:30.985Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Tiki Products: Tiki Problem Types: CWE-1336 Description: wikiplugin_includetpl in lib/wiki-plugins/wikiplugin_includetpl.php in Tiki before 28.3 mishandles input to an eval. The fixed versions are 21.12, 24.8, 27.2, and 28.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://tiki.org/article517 - https://tiki.org/article518 - https://gitlab.com/tikiwiki/tiki/-/commit/be8dc1aa220fbceb07a7a5dc36416243afccd358 - https://gitlab.com/tikiwiki/tiki/-/commi
://gitlab.com/tikiwiki/tiki/-/commit/be8dc1aa220fbceb07a7a5dc36416243afccd358 - https://gitlab.com/tikiwiki/tiki/-/commit/801ed912390c2aa6caf12b7b953e200f5d4bc0b1 - https://gitlab.com/tikiwiki/tiki/-/commit/406bea4f6c379a23903ecfd55e538d90fd669ab0 - https://gitlab.com/tikiwiki/tiki/-/commit/9ffb4ab21bd86837370666ecd6afd868f3d7877a - https://gitlab.com/tikiwiki/tiki/-/commit/f3f36c1ac702479209acfcaec5789d2fd1f996bc
CVE ID: CVE-2025-32462 State: PUBLISHED Published: 2025-06-30T00:00:00.000Z Last Updated: 2025-11-03T19:53:32.346Z Severity: LOW (CVSS 2.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N) Vendors: Sudo project Products: Sudo Problem Types: CWE-863 Description: Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.sudo.ws/security/advisories/ - https://www.sudo.ws/releases/changelog/ - https://www.stratascale.com/vulnerability-alert-CVE-2025-32462-sudo-host - https://www.
ww.sudo.ws/releases/changelog/ - https://www.stratascale.com/vulnerability-alert-CVE-2025-32462-sudo-host - https://www.openwall.com/lists/oss-security/2025/06/30/2 - https://ubuntu.com/security/notices/USN-7604-1 - https://www.secpod.com/blog/sudo-lpe-vulnerabilities-resolved-what-you-need-to-know-about-cve-2025-32462-and-cve-2025-32463/ - https://www.sudo.ws/security/advisories/host_any/ - https://lists.debian.org/debian-security-announce/2025/msg00118.html - https://explore.alas.aws.amazon.com/CVE-2025-32462.html - https://bugs.gentoo.org/show_bug.cgi?id=CVE-2025-32462 - https://security-tracker.debian.org/tracker/CVE-2025-32462 - https://www.suse.com/security/cve/CVE-2025-32462.html - ht
https://security-tracker.debian.org/tracker/CVE-2025-32462 - https://www.suse.com/security/cve/CVE-2025-32462.html - https://access.redhat.com/security/cve/cve-2025-32462
CVE ID: CVE-2025-32463 State: PUBLISHED Published: 2025-06-30T00:00:00.000Z Last Updated: 2025-10-21T22:45:23.356Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Sudo project Products: Sudo Problem Types: CWE-829 Description: Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sudo.ws/security/advisories/ - https://www.sudo.ws/releases/changelog/ - https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot - https://www.openwall.com/lists/oss-security/2025/06/30
.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot - https://www.openwall.com/lists/oss-security/2025/06/30/3 - https://access.redhat.com/security/cve/cve-2025-32463 - https://ubuntu.com/security/notices/USN-7604-1 - https://security-tracker.debian.org/tracker/CVE-2025-32463 - https://explore.alas.aws.amazon.com/CVE-2025-32463.html - https://bugs.gentoo.org/show_bug.cgi?id=CVE-2025-32463 - https://www.suse.com/support/update/announcement/2025/suse-su-202502177-1/ - https://www.suse.com/security/cve/CVE-2025-32463.html - https://www.secpod.com/blog/sudo-lpe-vulnerabilities-resolved-what-you-need-to-know-about-cve-2025-32462-and-cve-2025-32463/ - https://www.sudo.ws/security/advis
erabilities-resolved-what-you-need-to-know-about-cve-2025-32462-and-cve-2025-32463/ - https://www.sudo.ws/security/advisories/chroot_bug/ - https://www.vicarius.io/vsociety/posts/cve-2025-32463-detect-sudo-vulnerability - https://www.vicarius.io/vsociety/posts/cve-2025-32463-mitigate-sudo-vulnerability
CVE ID: CVE-2025-32464 State: PUBLISHED Published: 2025-04-09T00:00:00.000Z Last Updated: 2025-04-23T22:03:08.605Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: HAProxy Products: HAProxy Problem Types: CWE-1025 Description: HAProxy 2.2 through 3.1.6, in certain uncommon configurations, has a sample_conv_regsub heap-based buffer overflow because of mishandling of the replacement of multiple short patterns with a longer one. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/haproxy/haproxy/commit/3e3b9eebf871510aee36c3a3336faac2f38c9559
CVE ID: CVE-2025-32465 State: PUBLISHED Published: 2025-06-11T19:07:31.847Z Last Updated: 2025-06-12T15:17:45.440Z Vendors: rsjoomla.com Products: RSTickets! component for Joomla Problem Types: CWE-79 Description: A stored XSS vulnerability in RSTickets! component 1.9.12 - 3.3.0 for Joomla was discovered. It allows attackers to perform cross-site scripting (XSS) attacks via sending crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://rsjoomla.com/
CVE ID: CVE-2025-32466 State: PUBLISHED Published: 2025-06-11T19:07:34.823Z Last Updated: 2025-06-12T15:18:07.358Z Vendors: rsjoomla.com Products: RSMediaGallery component for Joomla Problem Types: CWE-89 Description: A SQL injection vulnerability in RSMediaGallery! component 1.7.4 - 2.1.7 for Joomla was discovered. The issue occurs within the dashboard component, where user-supplied input is not properly sanitized before being stored and rendered. An attacker can inject malicious JavaScript code into text fields or other input points, which is subsequently executed in the browser of any user who clicks on the crafted text in the dashboard. Additional Analyst Notes: - CISA ADP Vulnrichment:
browser of any user who clicks on the crafted text in the dashboard. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://rsjoomla.com/
CVE ID: CVE-2025-32468 State: PUBLISHED Published: 2025-08-25T14:17:45.750Z Last Updated: 2025-11-03T18:09:24.033Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: SAIL Image Decoding Library Products: SAIL Image Decoding Library Problem Types: CWE-680 Description: A memory corruption vulnerability exists in the BMPv3 Image Decoding functionality of the SAIL Image Decoding Library v0.9.8. When loading a specially crafted .bmp file, an integer overflow can be made to occur when calculating the stride for decoding. Afterwards, this will cause a heap-based buffer to overflow when decoding the image which can lead to remote code execution. An attacker will need to
heap-based buffer to overflow when decoding the image which can lead to remote code execution. An attacker will need to convince the library to read a file to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2216
CVE ID: CVE-2025-32469 State: PUBLISHED Published: 2025-05-13T09:38:46.000Z Last Updated: 2025-05-13T14:02:46.586Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Siemens Products: RUGGEDCOM ROX MX5000, RUGGEDCOM ROX MX5000RE, RUGGEDCOM ROX RX1400, RUGGEDCOM ROX RX1500, RUGGEDCOM ROX RX1501, RUGGEDCOM ROX RX1510, RUGGEDCOM ROX RX1511, RUGGEDCOM ROX RX1512, RUGGEDCOM ROX RX1524, RUGGEDCOM ROX RX1536, RUGGEDCOM ROX RX5000 Problem Types: CWE-602 Description: A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGEDCOM ROX RX1400 (All versions < V2.16.5), RUGGEDCOM ROX RX1500 (
, RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGEDCOM ROX RX1400 (All versions < V2.16.5), RUGGEDCOM ROX RX1500 (All versions < V2.16.5), RUGGEDCOM ROX RX1501 (All versions < V2.16.5), RUGGEDCOM ROX RX1510 (All versions < V2.16.5), RUGGEDCOM ROX RX1511 (All versions < V2.16.5), RUGGEDCOM ROX RX1512 (All versions < V2.16.5), RUGGEDCOM ROX RX1524 (All versions < V2.16.5), RUGGEDCOM ROX RX1536 (All versions < V2.16.5), RUGGEDCOM ROX RX5000 (All versions < V2.16.5). The 'ping' tool in the web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated remote attacker to execute arbitrary code with root pri
server side input sanitation. This could allow an authenticated remote attacker to execute arbitrary code with root privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-301229.html
CVE ID: CVE-2025-32470 State: PUBLISHED Published: 2025-04-28T09:07:02.830Z Last Updated: 2025-04-28T15:45:46.363Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: SICK AG Products: SICK FLX0-GPNT100, SICK FLX3-CPUC200 Problem Types: CWE-284 Description: A remote unauthenticated attacker may be able to change the IP adress of the device, and therefore affecting the availability of the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https:
BERSECURITY_BY_SICK_en_IM0084411.PDF - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0005.pdf - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0005.json
CVE ID: CVE-2025-32471 State: PUBLISHED Published: 2025-04-28T09:11:20.143Z Last Updated: 2025-04-28T15:40:34.748Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SICK AG Products: SICK FLX3-CPUC200 Problem Types: CWE-1391 Description: The device’s passwords have not been adequately salted, making them vulnerable to password extraction attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www
w.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0005.pdf - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0005.json
CVE ID: CVE-2025-32472 State: PUBLISHED Published: 2025-04-28T12:04:55.012Z Last Updated: 2025-04-28T16:30:57.990Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: SICK AG Products: SICK multiScan1XX, SICK picoScan1XX Problem Types: CWE-400 Description: The multiScan and picoScan are vulnerable to a denial-of-service (DoS) attack. A remote attacker can exploit this vulnerability by conducting a Slowloris-type attack, causing the web page to become unresponsive. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF - https://w
/psirt - https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0006.pdf - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0006.json
CVE ID: CVE-2025-32475 State: PUBLISHED Published: 2025-04-16T17:37:44.778Z Last Updated: 2025-04-17T14:20:45.886Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Siemens Products: TeleControl Server Basic Problem Types: CWE-89 Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateProject' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requir
o the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25912) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE ID: CVE-2025-32476 State: PUBLISHED Published: 2025-04-09T16:09:57.023Z Last Updated: 2025-04-09T17:57:52.256Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: blueinstyle Products: Advanced Tag Lists Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in blueinstyle Advanced Tag Lists allows Stored XSS. This issue affects Advanced Tag Lists: from n/a through 1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/advanced-tag-list/vulnerability/wordpress-advanced-tag-lists-plugin-1-2-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-32477 State: PUBLISHED Published: 2025-04-09T16:09:56.433Z Last Updated: 2025-04-09T17:58:04.729Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Jordi Salord Products: WP-Easy Menu Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Jordi Salord WP-Easy Menu allows Stored XSS. This issue affects WP-Easy Menu: from n/a through 0.41. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-easy-menu/vulnerability/wordpress-wp-easy-menu-plugin-0-41-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-32478 State: PUBLISHED Published: 2025-04-09T16:09:55.796Z Last Updated: 2025-04-09T17:58:16.285Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Mario Aguiar Products: WP SexyLightBox Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Mario Aguiar WP SexyLightBox allows Stored XSS. This issue affects WP SexyLightBox: from n/a through 0.5.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-sexylightbox/vulnerability/wordpress-wp-sexylightbox-plugin-0-5-3-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-32479 State: PUBLISHED Published: 2025-04-09T16:09:55.138Z Last Updated: 2025-04-09T17:58:28.317Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: ab-tools Products: Flags Widget Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in ab-tools Flags Widget allows Stored XSS. This issue affects Flags Widget: from n/a through 1.0.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/flags-widget/vulnerability/wordpress-flags-widget-plugin-1-0-7-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-32480 State: PUBLISHED Published: 2025-04-09T16:09:54.496Z Last Updated: 2025-04-09T17:58:40.289Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: dalziel Products: Windows Live Writer Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in dalziel Windows Live Writer allows Stored XSS. This issue affects Windows Live Writer: from n/a through 0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/windows-live-writer/vulnerability/wordpress-windows-live-writer-plugin-0-1-csrf-to-stored-xss-vulnerability?_s_id=cve