Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-52036 State: PUBLISHED Published: 2025-08-26T00:00:00.000Z Last Updated: 2025-08-26T15:26:10.222Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability has been found in NotesCMS and classified as medium. Affected by this vulnerability is the page /index.php?route=categories. The manipulation of the title of the service descriptions leads to a stored XSS vulnerability. The issue was confirmed to be present in the source code as of commit 7d821a0f028b0778b245b99ab3d3bff1ac10e2d3 (dated 2024-05-08), and was fixed in commit 95322c5121dbd7070f3bd54f2848079654a0a8ea (dated 2025-03-31). The attack can be launched remotely. CWE Definition of the Vulnerability:
70f3bd54f2848079654a0a8ea (dated 2025-03-31). The attack can be launched remotely. CWE Definition of the Vulnerability: CWE-79. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/PrivateAccount/NotesCMS/issues/1 - https://gist.github.com/yA0-Z/aeea5af372fec0085c6a4a7bb9c6bc8e
CVE ID: CVE-2025-52037 State: PUBLISHED Published: 2025-08-26T00:00:00.000Z Last Updated: 2025-08-26T15:25:01.777Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability has been found in NotesCMS and classified as medium. Affected by this vulnerability is the page /index.php?route=sites. The manipulation of the title of the service descriptions leads to a stored XSS vulnerability. The issue was confirmed to be present in the source code as of commit 7d821a0f028b0778b245b99ab3d3bff1ac10e2d3 (dated 2024-05-08), and was fixed in commit 95322c5121dbd7070f3bd54f2848079654a0a8ea (dated 2025-03-31). The attack can be launched remotely. CWE Definition of the Vulnerability: CWE-7
d54f2848079654a0a8ea (dated 2025-03-31). The attack can be launched remotely. CWE Definition of the Vulnerability: CWE-79. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/PrivateAccount/NotesCMS/issues/3 - https://gist.github.com/yA0-Z/eb6cd89398abff716c70866fa873dbde
CVE ID: CVE-2025-52039 State: PUBLISHED Published: 2025-10-01T00:00:00.000Z Last Updated: 2025-10-01T14:48:38.885Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Frappe ERPNext 15.57.5, the function get_material_requests_based_on_supplier() at erpnext/stock/doctype/material_request/material_request.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the txt parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Vietsunshine-Electronic-Solution-JSC/Vulnerability-Disclosures/blob/main/2025/Frappe%20Framework%20-%20Multiple%20SQL%20Injection.md - https://github.
on-JSC/Vulnerability-Disclosures/blob/main/2025/Frappe%20Framework%20-%20Multiple%20SQL%20Injection.md - https://github.com/frappe/erpnext/pull/49192/commits/de919568b4f7a86c8d418c0c3fd88e1f3101696c
CVE ID: CVE-2025-52040 State: PUBLISHED Published: 2025-10-01T00:00:00.000Z Last Updated: 2025-10-01T14:51:04.013Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Frappe ERPNext 15.57.5, the function get_blanket_orders() at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker can extract all information from databases by injecting a SQL query into the blanket_order_type parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Vietsunshine-Electronic-Solution-JSC/Vulnerability-Disclosures/blob/main/2025/Frappe%20Framework%20-%20Multiple%20SQL%20Injection.md - https://github.com/frappe/erpnext/pull/49192/com
blob/main/2025/Frappe%20Framework%20-%20Multiple%20SQL%20Injection.md - https://github.com/frappe/erpnext/pull/49192/commits/1db135262d9474411ef54e3367d24bb169d2503e
CVE ID: CVE-2025-52041 State: PUBLISHED Published: 2025-10-01T00:00:00.000Z Last Updated: 2025-10-01T14:45:19.831Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Frappe ERPNext 15.57.5, the function get_stock_balance_for() at erpnext/stock/doctype/stock_reconciliation/stock_reconciliation.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the inventory_dimensions_dict parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Vietsunshine-Electronic-Solution-JSC/Vulnerability-Disclosures/blob/main/2025/Frappe%20Framework%20-%20Multiple%20SQL%20Injection.md - htt
ronic-Solution-JSC/Vulnerability-Disclosures/blob/main/2025/Frappe%20Framework%20-%20Multiple%20SQL%20Injection.md - https://github.com/frappe/erpnext/pull/49192/commits/eb22794f14351c2ff5731548c48bef0b91765c86
CVE ID: CVE-2025-52042 State: PUBLISHED Published: 2025-10-01T00:00:00.000Z Last Updated: 2025-10-01T14:39:51.283Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at erpnext/buying/doctype/request_for_quotation/request_for_quotation.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting SQL query via the txt parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Vietsunshine-Electronic-Solution-JSC/Vulnerability-Disclosures/blob/main/2025/Frappe%20Framework%20-%20Multiple%20SQL%20Injection.md - https://github.com/
SC/Vulnerability-Disclosures/blob/main/2025/Frappe%20Framework%20-%20Multiple%20SQL%20Injection.md - https://github.com/frappe/erpnext/pull/49192/commits/7f2a52ff71a1fd5d4a9034cf217094c0be9f341a
CVE ID: CVE-2025-52043 State: PUBLISHED Published: 2025-09-30T00:00:00.000Z Last Updated: 2025-09-30T19:42:37.445Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Frappe ERPNext v15.57.5, the function import_coa() at erpnext/accounts/doctype/chart_of_accounts_importer/chart_of_accounts_importer.py is vulnerable to SQL injection, which allows an attacker to extract all information from databases by injecting a SQL query into the company parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Vietsunshine-Electronic-Solution-JSC/Vulnerability-Disclosures/blob/main/2025/Frappe%20Framework%20-%20Multiple%20SQL%20Injection.md - https://github.c
n-JSC/Vulnerability-Disclosures/blob/main/2025/Frappe%20Framework%20-%20Multiple%20SQL%20Injection.md - https://github.com/frappe/erpnext/pull/49192/commits/7fa4ed6139dfb737995fe297e40f4f5440c748c3
CVE ID: CVE-2025-52044 State: PUBLISHED Published: 2025-09-16T00:00:00.000Z Last Updated: 2025-09-17T13:43:03.696Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Frappe ERPNext v15.57.5, the function get_stock_balance() at erpnext/stock/utils.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting SQL query into inventory_dimensions_dict parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Vietsunshine-Electronic-Solution-JSC/Vulnerability-Disclosures/blob/main/2025/Frappe%20Framework%20-%20Multiple%20SQL%20Injection.md - https://github.com/frappe/erpnext/pull/49192/commits/eb2
n/2025/Frappe%20Framework%20-%20Multiple%20SQL%20Injection.md - https://github.com/frappe/erpnext/pull/49192/commits/eb22794f14351c2ff5731548c48bef0b91765c86
CVE ID: CVE-2025-52046 State: PUBLISHED Published: 2025-07-17T00:00:00.000Z Last Updated: 2025-09-15T15:03:24.239Z Vendors: n/a Products: n/a Problem Types: n/a Description: Totolink A3300R V17.0.0cu.596_B20250515 was found to contain a command injection vulnerability in the sub_4197C0 function via the mac and desc parameters. This vulnerability allows unauthenticated attackers to execute arbitrary commands via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.notion.so/setWiFiAclRules-A3300R-2108aff2dc8b80348d94e7fd1378d475?source=copy_link - https://github.com/w0rkd4tt/Totolink/blob/main/CVE-2025-52046/CVE-2025-52046.md
CVE ID: CVE-2025-52047 State: PUBLISHED Published: 2025-09-30T00:00:00.000Z Last Updated: 2025-09-30T19:43:47.741Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Frappe ErpNext v15.57.5, the function get_income_account() at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the filters.disabled parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Vietsunshine-Electronic-Solution-JSC/Vulnerability-Disclosures/blob/main/2025/Frappe%20Framework%20-%20Multiple%20SQL%20Injection.md - https://github.com/frappe/erpnext/pull/49192/commi
ob/main/2025/Frappe%20Framework%20-%20Multiple%20SQL%20Injection.md - https://github.com/frappe/erpnext/pull/49192/commits/6320f7290f93a5278ffdfaa790af70427c20a1c8
CVE ID: CVE-2025-52048 State: PUBLISHED Published: 2025-09-15T00:00:00.000Z Last Updated: 2025-09-15T19:13:03.103Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Frappe 15.x.x before 15.72.0 and 14.x.x before 14.96.10, in the function add_tag() at `frappe/desk/doctype/tag/tag.py` is vulnerable to SQL Injection, which allows an attacker to extract information from databases by injecting a SQL query into the `dt` parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/frappe/frappe/security/advisories/GHSA-mggw-6xqj-rphj - https://github.com/Vietsunshine-Electronic-Solution-JSC/Vulnerability-Disclosures/blob/main/2025/Frappe%20Framework%20-
https://github.com/Vietsunshine-Electronic-Solution-JSC/Vulnerability-Disclosures/blob/main/2025/Frappe%20Framework%20-%20Multiple%20SQL%20Injection.md
CVE ID: CVE-2025-52049 State: PUBLISHED Published: 2025-09-30T00:00:00.000Z Last Updated: 2025-09-30T19:37:58.497Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Frappe ErpNext v15.57.5, the function get_timesheet_detail_rate() at erpnext/projects/doctype/timesheet/timesheet.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting SQL query into the timelog parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Vietsunshine-Electronic-Solution-JSC/Vulnerability-Disclosures/blob/main/2025/Frappe%20Framework%20-%20Multiple%20SQL%20Injection.md - https://github.com/frappe/erpnext/pul
isclosures/blob/main/2025/Frappe%20Framework%20-%20Multiple%20SQL%20Injection.md - https://github.com/frappe/erpnext/pull/49192/commits/e563ed0c75fd20135a6ad288e957e75eac7d3b8d
CVE ID: CVE-2025-52050 State: PUBLISHED Published: 2025-09-30T00:00:00.000Z Last Updated: 2025-09-30T19:41:37.443Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Frappe ERPNext 15.57.5, the function get_loyalty_program_details_with_points() at erpnext/accounts/doctype/loyalty_program/loyalty_program.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the expiry_date parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Vietsunshine-Electronic-Solution-JSC/Vulnerability-Disclosures/blob/main/2025/Frappe%20Framework%20-%20Multiple%20SQL%20Injection.md - https:
ic-Solution-JSC/Vulnerability-Disclosures/blob/main/2025/Frappe%20Framework%20-%20Multiple%20SQL%20Injection.md - https://github.com/frappe/erpnext/pull/49192/commits/8696ba2f5d9e99c799d4aef577f72f2fae5678e7
CVE ID: CVE-2025-52053 State: PUBLISHED Published: 2025-09-15T00:00:00.000Z Last Updated: 2025-09-15T15:19:03.042Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection vulnerability in the sub_417D74 function via the file_name parameter. This vulnerability allows unauthenticated attackers to execute arbitrary commands via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://totolink.net - https://github.com/w0rkd4tt/Totolink/blob/main/CVE-2025-52053/CVE-2025-52053.md
CVE ID: CVE-2025-52054 State: PUBLISHED Published: 2025-08-28T00:00:00.000Z Last Updated: 2025-08-28T20:02:23.116Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Tenda AC8 v4.0 AC1200 Dual-band Gigabit Wireless Router AC8v4.0 Firmware 16.03.33.05. The root password of the device is calculated with a static string and the last two octets of the MAC address of the device. This allows an unauthenticated attacker to authenticate with network services on the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.virtualhackinglabs.com/advisories/cve-2025-52054-tenda-ac8-calculated-root-password/
CVE ID: CVE-2025-52074 State: PUBLISHED Published: 2025-09-12T00:00:00.000Z Last Updated: 2025-09-12T17:09:13.360Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPGURUKUL Online Shopping Portal 2.1 is vulnerable to Cross Site Scripting (XSS) due to lack of input sanitization in the quantity parameter when adding a product to the cart. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/NullMinds/CVE-Hunting/blob/main/Online%20Shopping%20Portal/Stored%20XSS%20in%20Quantity%20Parameter.pdf
CVE ID: CVE-2025-52078 State: PUBLISHED Published: 2025-08-05T00:00:00.000Z Last Updated: 2025-08-05T20:10:41.452Z Vendors: n/a Products: n/a Problem Types: n/a Description: File upload vulnerability in Writebot AI Content Generator SaaS React Template thru 4.0.0, allowing remote attackers to gain escalated privileges via a crafted POST request to the /file-upload endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://writebot.com - https://themeforest.net/item/writebot-ai-content-generator-saas-react-template/53331158?s_rank=9 - https://github.com/Yucaerin/Writebot
CVE ID: CVE-2025-52079 State: PUBLISHED Published: 2025-10-21T00:00:00.000Z Last Updated: 2025-10-22T15:13:25.667Z Vendors: n/a Products: n/a Problem Types: n/a Description: The administrator password setting of the D-Link DIR-820L 1.06B02 is has Improper Access Control and is vulnerable to Unverified Password Change via crafted POST request to /get_set.ccp. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/namberino/cve/tree/main/CVE-2025-52079
CVE ID: CVE-2025-52080 State: PUBLISHED Published: 2025-07-15T00:00:00.000Z Last Updated: 2025-07-15T20:43:51.536Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Netgear XR300 V1.0.3.38_10.3.30, a stack-based buffer overflow vulnerability exists in the HTTPD service through the usb_device.cgi endpoint. The vulnerability occurs when processing POST requests containing the share_name parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/lafdrew/IOT/blob/main/Netgear%20XR300/share_name%20of%20usb_device.cgi/buffer%20overflow%20in%20share_neme%20of%20usb_device.cgi.md
CVE ID: CVE-2025-52081 State: PUBLISHED Published: 2025-07-15T00:00:00.000Z Last Updated: 2025-07-15T20:42:20.014Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Netgear XR300 V1.0.3.38_10.3.30, a stack-based buffer overflow vulnerability exists in the HTTPD service through the usb_device.cgi endpoint. The vulnerability occurs when processing POST requests containing the usb_folder parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/lafdrew/IOT/blob/main/Netgear%20XR300/usb_folder%20of%20usb_device.cgi/buffer%20overflow%20in%20usb_folder%20of%20usb_device.cgi.md
CVE ID: CVE-2025-52082 State: PUBLISHED Published: 2025-07-15T00:00:00.000Z Last Updated: 2025-07-15T20:43:08.268Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Netgear XR300 V1.0.3.38_10.3.30, a stack-based buffer overflow exists in the HTTPD service through the usb_device.cgi endpoint. The vulnerability occurs when processing POST requests containing the read_access parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/lafdrew/IOT/blob/main/Netgear%20XR300/read_access%20of%20usb_device.cgi/buffer%20overflow%20in%20read_access%20of%20usb_device.cgi.md
CVE ID: CVE-2025-52085 State: PUBLISHED Published: 2025-08-22T00:00:00.000Z Last Updated: 2025-08-26T14:07:31.385Z Vendors: n/a Products: n/a Problem Types: n/a Description: An SQL injection vulnerability in Yoosee application v6.32.4 allows authenticated users to inject arbitrary SQL queries via a request to a backend API endpoint. Successful exploitation enables extraction of sensitive database information, including but not limited to, the database server banner and version, current database user and schema, the current DBMS user privileges, and arbitrary data from any table. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://yoosee.app - https://medium.com/@pundhapa
able. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://yoosee.app - https://medium.com/@pundhapat/sqli-in-the-cloud-root-on-the-board-a-beginners-journey-into-iot-hacking-06efb2539a21
CVE ID: CVE-2025-52089 State: PUBLISHED Published: 2025-07-11T00:00:00.000Z Last Updated: 2025-07-19T01:47:59.764Z Vendors: n/a Products: n/a Problem Types: n/a Description: A hidden remote support feature protected by a static secret in TOTOLINK N300RB firmware version 8.54 allows an authenticated attacker to execute arbitrary OS commands with root privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://0x09.dev/posts/toto_decouvre_une_interface_de_debug/
CVE ID: CVE-2025-52094 State: PUBLISHED Published: 2025-08-22T00:00:00.000Z Last Updated: 2025-08-26T14:08:50.894Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure Permissions vulnerability in PDQ Smart Deploy V.3.0.2040 allows a local attacker to execute arbtirary code via the \HKLM\SYSTEM\Setup\SmartDeploy component Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.pdq.com/ - https://www.pdq.com/products/smartdeploy/ - https://specterops.io/blog/2025/08/12/hklmsystemsetupsmartdeploy-the-static-keys-to-abusing-pdq-smartdeploy/
CVE ID: CVE-2025-52095 State: PUBLISHED Published: 2025-08-22T00:00:00.000Z Last Updated: 2025-08-26T14:09:11.186Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in PDQ Smart Deploy V.3.0.2040 allows an attacker to escalate privileges via the Credential encryption routines in SDCommon.dll Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.pdq.com/ - https://www.pdq.com/products/smartdeploy/ - https://specterops.io/blog/2025/08/12/hklmsystemsetupsmartdeploy-the-static-keys-to-abusing-pdq-smartdeploy/
CVE ID: CVE-2025-52099 State: PUBLISHED Published: 2025-10-24T00:00:00.000Z Last Updated: 2025-10-24T20:58:22.440Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer Overflow vulnerability in SQLite SQLite3 v.3.50.0 allows a remote attacker to cause a denial of service via the setupLookaside function Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://sqlite3.com - https://github.com/SCREAMBBY/CVE-2025-52099
CVE ID: CVE-2025-52101 State: PUBLISHED Published: 2025-07-01T00:00:00.000Z Last Updated: 2025-07-02T18:12:37.760Z Vendors: n/a Products: n/a Problem Types: n/a Description: linjiashop <=0.9 is vulnerable to Incorrect Access Control. When using the default-generated JWT authentication, attackers can bypass the authentication and retrieve the encrypted "password" and "salt". The password can then be obtained through brute-force cracking. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/microapp/linjiashop - https://gist.github.com/NSW111/33824ceb4d1b920671124f77abfe27e8
CVE ID: CVE-2025-52122 State: PUBLISHED Published: 2025-08-27T00:00:00.000Z Last Updated: 2025-08-27T14:40:07.245Z Vendors: n/a Products: n/a Problem Types: n/a Description: Freeform 5.0.0 to before 5.10.16, a plugin for CraftCMS, contains an Server-side template injection (SSTI) vulnerability, resulting in arbitrary code injection for all users that have access to editing a form (submission title). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TimTrademark/CVE-CraftCMS-Freeform - https://github.com/TimTrademark/CVE-2025-52122
CVE ID: CVE-2025-52130 State: PUBLISHED Published: 2025-08-25T00:00:00.000Z Last Updated: 2025-08-26T15:29:58.501Z Vendors: n/a Products: n/a Problem Types: n/a Description: File upload vulnerability in WebErpMesv2 1.17 in the app/Http/Controllers/FactoryController.php controller. This flaw allows an authenticated attacker to upload arbitrary files, including PHP scripts, which can be accessed via direct GET requests, potentially resulting in remote code execution (RCE) on the web server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SMEWebify/WebErpMesv2 - https://medium.com/@The_Hiker/wrong-variable-name-leads-to-rce-cve-2025-52130-8ff59a7d245c
CVE ID: CVE-2025-52131 State: PUBLISHED Published: 2025-08-03T00:00:00.000Z Last Updated: 2025-08-07T16:05:51.598Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: xwiki-contrib Products: Mocca Calendar Problem Types: CWE-79 Description: The Mocca Calendar application before 2.15 for XWiki allows XSS via the background or text color field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwikisas/application-mocca-calendar/security/advisories/GHSA-jvq4-j2qw-q7x2 - https://github.com/xwikisas/application-mocca-calendar - https://extensions.xwiki.org/xwiki/bin/view/Extension/MoccaCalendar - https://github.com/xwiki-contrib/app
ca-calendar - https://extensions.xwiki.org/xwiki/bin/view/Extension/MoccaCalendar - https://github.com/xwiki-contrib/application-mocca-calendar
CVE ID: CVE-2025-52132 State: PUBLISHED Published: 2025-08-03T00:00:00.000Z Last Updated: 2025-08-04T19:05:43.087Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: xwiki-contrib Products: Mocca Calendar Problem Types: CWE-79 Description: The Mocca Calendar application before 2.15 for XWiki allows XSS via a title to the view event page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwikisas/application-mocca-calendar - https://github.com/xwikisas/application-mocca-calendar/security/advisories/GHSA-fjv4-pgh9-jfgc - https://extensions.xwiki.org/xwiki/bin/view/Extension/MoccaCalendar - https://github.com/xwiki-contrib/applica
h9-jfgc - https://extensions.xwiki.org/xwiki/bin/view/Extension/MoccaCalendar - https://github.com/xwiki-contrib/application-mocca-calendar
CVE ID: CVE-2025-52133 State: PUBLISHED Published: 2025-08-03T00:00:00.000Z Last Updated: 2025-08-04T19:02:06.379Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: xwiki-contrib Products: Mocca Calendar Problem Types: CWE-79 Description: The Mocca Calendar application before 2.15 for XWiki allows XSS via a title upon calendar import. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwikisas/application-mocca-calendar - https://github.com/xwikisas/application-mocca-calendar/security/advisories/GHSA-mc3x-h7p6-334p - https://extensions.xwiki.org/xwiki/bin/view/Extension/MoccaCalendar - https://github.com/xwiki-contrib/applicati
-334p - https://extensions.xwiki.org/xwiki/bin/view/Extension/MoccaCalendar - https://github.com/xwiki-contrib/application-mocca-calendar
CVE ID: CVE-2025-52136 State: PUBLISHED Published: 2025-08-10T00:00:00.000Z Last Updated: 2025-08-12T14:27:35.318Z Severity: LOW (CVSS 3 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:N) Vendors: EMQX Products: EMQX Problem Types: CWE-754 Description: In EMQX before 5.8.6, administrators can install arbitrary novel plugins via the Dashboard web interface. NOTE: the Supplier's position is that this is the intended behavior; however, 5.8.6 adds a defense-in-depth feature in which a plugin's acceptability (for later Dashboard installation) is set by the "emqx ctl plugins allow" CLI command. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ricardojoserf/emqx-RCE -