Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-3708 State: PUBLISHED Published: 2025-05-02T02:55:32.493Z Last Updated: 2025-05-02T16:24:42.504Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Le-yan Products: Le-show Problem Types: CWE-89 Description: Le-show medical practice management system from Le-yan has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10085-69e16-1.html - https://www.twcert.org.tw/en/cp-139-10086-dbfd0-2.html
CVE ID: CVE-2025-3709 State: PUBLISHED Published: 2025-05-02T03:13:32.971Z Last Updated: 2025-05-02T15:02:34.546Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Flowring Technology Products: Agentflow Problem Types: CWE-307 Description: Agentflow from Flowring Technology has an Account Lockout Bypass vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to perform password brute force attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10091-12462-1.html - https://www.twcert.org.tw/en/cp-139-10090-112f7-2.html
CVE ID: CVE-2025-3710 State: PUBLISHED Published: 2025-05-09T03:53:55.759Z Last Updated: 2025-05-28T06:46:01.895Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ATEN Products: CL5708IM Problem Types: CWE-121 Description: The LCD KVM over IP Switch CL5708IM has a Stack-based Buffer Overflow vulnerability in firmware versions prior to v2.2.215, allowing unauthenticated remote attackers to exploit this vulnerability to execute arbitrary code on the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10095-a0f57-1.html - https://www.twcert.org.tw/en/cp-139-10103-32121-2.html
CVE ID: CVE-2025-3711 State: PUBLISHED Published: 2025-05-09T03:56:50.320Z Last Updated: 2025-05-28T09:48:57.781Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ATEN Products: CL5708IM Problem Types: CWE-121 Description: The LCD KVM over IP Switch CL5708IM has a Stack-based Buffer Overflow vulnerability in firmware versions prior to v2.2.215, allowing unauthenticated remote attackers to exploit this vulnerability to execute arbitrary code on the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10096-60a81-1.html - https://www.twcert.org.tw/en/cp-139-10104-63bf4-2.html
CVE ID: CVE-2025-3712 State: PUBLISHED Published: 2025-05-09T04:00:11.812Z Last Updated: 2025-05-28T06:46:43.775Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ATEN Products: CL5708IM Problem Types: CWE-122 Description: The LCD KVM over IP Switch CL5708IM has a Heap-based Buffer Overflow vulnerability in firmware versions prior to v2.2.215, allowing unauthenticated remote attackers to exploit this vulnerability to perform a denial-of-service attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10097-326fa-1.html - https://www.twcert.org.tw/en/cp-139-10105-1e8b5-2.html
CVE ID: CVE-2025-3713 State: PUBLISHED Published: 2025-05-09T04:03:13.030Z Last Updated: 2025-05-28T09:49:17.255Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ATEN Products: CL5708IM Problem Types: CWE-122 Description: The LCD KVM over IP Switch CL5708IM has a Heap-based Buffer Overflow vulnerability in firmware versions prior to v2.2.215, allowing unauthenticated remote attackers to exploit this vulnerability to perform a denial-of-service attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10098-1a66d-1.html - https://www.twcert.org.tw/en/cp-139-10106-9080f-2.html
CVE ID: CVE-2025-3714 State: PUBLISHED Published: 2025-05-09T04:08:57.461Z Last Updated: 2025-05-28T06:48:30.232Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ATEN Products: CL5708IM Problem Types: CWE-121 Description: The LCD KVM over IP Switch CL5708IM has a Stack-based Buffer Overflow vulnerability in firmware versions prior to v2.2.215, allowing unauthenticated remote attackers to exploit this vulnerability to execute arbitrary code on the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10099-0ad69-1.html - https://www.twcert.org.tw/en/cp-139-10107-26b24-2.html
CVE ID: CVE-2025-3715 State: PUBLISHED Published: 2025-05-18T05:22:39.619Z Last Updated: 2025-05-19T14:24:56.083Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: boldthemes Products: Bold Page Builder Problem Types: CWE-79 Description: The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-text parameter in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Anal
e, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a2452dd7-2bb9-4a0c-81db-6699a9b049ae?source=cve - https://plugins.trac.wordpress.org/browser/bold-page-builder/tags/5.3.5/content_elements_misc/js/content_elements.js - https://plugins.trac.wordpress.org/changeset/3292512/
CVE ID: CVE-2025-3717 State: PUBLISHED Published: 2025-11-11T20:17:48.364Z Last Updated: 2025-11-12T21:46:15.867Z Vendors: Grafana Labs Products: Grafana Snowflake Datasource Plugin Problem Types: CWE-653 Description: When using the Grafana Snowflake Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it could result in the wrong user identifier being used, and information for which the viewer is not authorized being returned. This issue affects Grafana Snowflake Datasource Plugin: from 1.5.0 before 1.14.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
e Datasource Plugin: from 1.5.0 before 1.14.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://grafana.com/security/security-advisories/cve-2025-3717/
CVE ID: CVE-2025-3718 State: PUBLISHED Published: 2025-10-07T12:33:18.231Z Last Updated: 2025-10-07T13:21:49.093Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:H) Vendors: Nozomi Networks Products: Guardian, CMC Problem Types: CWE-22 Description: A client-side path traversal vulnerability was discovered in the web management interface front-end due to missing validation of an input parameter. An authenticated user with limited privileges can craft a malicious URL which, if visited by an authenticated victim, leads to a Cross-Site Scripting (XSS) attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.nozominetworks.com/NN-2025:4-01
CVE ID: CVE-2025-3719 State: PUBLISHED Published: 2025-10-07T12:34:46.613Z Last Updated: 2025-10-07T13:19:30.875Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Nozomi Networks Products: Guardian, CMC Problem Types: CWE-863 Description: An access control vulnerability was discovered in the CLI functionality due to a specific access restriction not being properly enforced for users with limited privileges. An authenticated user with limited privileges can issue administrative CLI commands, altering the device configuration, and/or affecting its availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.nozominetworks.com/NN
ts availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.nozominetworks.com/NN-2025:5-01
CVE ID: CVE-2025-3722 State: PUBLISHED Published: 2025-06-26T11:08:53.374Z Last Updated: 2025-06-26T12:59:09.547Z Vendors: Trellix Products: System Information Reporter Problem Types: CWE-22 Description: A path traversal vulnerability in System Information Reporter (SIR) 1.0.3 and prior allowed an authenticated high privileged user to issue malicious ePO post requests to System Information Reporter, leading to creation of files anywhere on the filesystem and possibly overwriting existing files and exposing sensitive information disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://thrive.trellix.com/s/article/000014635
CVE ID: CVE-2025-3723 State: PUBLISHED Published: 2025-04-16T19:31:03.798Z Last Updated: 2025-04-16T20:12:38.343Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PCMan Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in PCMan FTP Server 2.0.7 and classified as critical. This issue affects some unknown processing of the component MDTM Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305069 - https://vuldb.com/?ctiid.305069 - https://vuldb.com/
CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305069 - https://vuldb.com/?ctiid.305069 - https://vuldb.com/?submit.552796 - https://fitoxs.com/exploit/exploit-d41d8cd98f00b204e9800998ecf8427e.txt
CVE ID: CVE-2025-3724 State: PUBLISHED Published: 2025-04-16T19:31:04.955Z Last Updated: 2025-04-16T20:10:57.717Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PCMan Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in PCMan FTP Server 2.0.7. It has been classified as critical. Affected is an unknown function of the component DIR Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305070 - https://vuldb.com/?ctiid.305070 - https://vuldb
s: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305070 - https://vuldb.com/?ctiid.305070 - https://vuldb.com/?submit.552808 - https://fitoxs.com/exploit/exploit-21232f297a57a5a743894a0e4a801fc3.txt
CVE ID: CVE-2025-3725 State: PUBLISHED Published: 2025-04-16T20:00:11.031Z Last Updated: 2025-04-17T13:22:08.071Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PCMan Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in PCMan FTP Server 2.0.7. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component MIC Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305071 - https://vuldb.com/?ctiid.305071
nal Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305071 - https://vuldb.com/?ctiid.305071 - https://vuldb.com/?submit.552814 - https://fitoxs.com/exploit/exploit-827ccb0eea8a706c4c34a16891f84e7b.txt
CVE ID: CVE-2025-3726 State: PUBLISHED Published: 2025-04-16T20:00:12.331Z Last Updated: 2025-04-17T13:21:11.792Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PCMan Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in PCMan FTP Server 2.0.7. It has been rated as critical. Affected by this issue is some unknown functionality of the component CD Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305072 - https://vuldb.com/?ctiid.305072 - https:/
t Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305072 - https://vuldb.com/?ctiid.305072 - https://vuldb.com/?submit.552815 - https://fitoxs.com/exploit/exploit-900150983cd24fb0d6963f7d28e17f72.txt
CVE ID: CVE-2025-3727 State: PUBLISHED Published: 2025-04-16T20:31:03.989Z Last Updated: 2025-04-17T14:14:27.689Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PCMan Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7. This affects an unknown part of the component STATUS Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305073 - https://vuldb.com/?ctiid.305073 - https://vuldb.com/?
ISA ADP Vulnrichment: References: - https://vuldb.com/?id.305073 - https://vuldb.com/?ctiid.305073 - https://vuldb.com/?submit.552816 - https://fitoxs.com/exploit/exploit-5ebe2294ecd0e0f08eab7690d2a6ee69.txt
CVE ID: CVE-2025-3728 State: PUBLISHED Published: 2025-04-16T20:31:06.268Z Last Updated: 2025-04-16T20:45:11.592Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Simple Hotel Booking System Problem Types: CWE-120, CWE-119 Description: A vulnerability classified as critical was found in SourceCodester Simple Hotel Booking System 1.0. This vulnerability affects the function Login. The manipulation of the argument uname leads to buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuld
n disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305074 - https://vuldb.com/?ctiid.305074 - https://vuldb.com/?submit.553627 - https://github.com/eeeee-vul/CVE/issues/3 - https://www.sourcecodester.com/
CVE ID: CVE-2025-3729 State: PUBLISHED Published: 2025-04-16T21:00:13.318Z Last Updated: 2025-04-17T13:56:13.859Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Web-based Pharmacy Product Management System Problem Types: CWE-78, CWE-77 Description: A vulnerability, which was classified as critical, has been found in SourceCodester Web-based Pharmacy Product Management System 1.0. This issue affects some unknown processing of the file backup.php of the component Database Backup Handler. The manipulation of the argument txtdbname leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be us
o os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305075 - https://vuldb.com/?ctiid.305075 - https://vuldb.com/?submit.553631 - https://github.com/yaklang/IRifyScanResult/blob/main/Web-based%20Pharmacy%20Product%20Management%20System/rce_in_backup.md - https://www.sourcecodester.com/
CVE ID: CVE-2025-3730 State: PUBLISHED Published: 2025-04-16T21:00:17.836Z Last Updated: 2025-05-22T21:39:19.138Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: PyTorch Problem Types: CWE-404 Description: A vulnerability, which was classified as problematic, was found in PyTorch 2.6.0. Affected is the function torch.nn.functional.ctc_loss of the file aten/src/ATen/native/LossCTC.cpp. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The name of the patch is 46fc5d8e360127361211cb
The real existence of this vulnerability is still doubted at the moment. The name of the patch is 46fc5d8e360127361211cb237d5f9eef0223e567. It is recommended to apply a patch to fix this issue. The security policy of the project warns to use unknown models which might establish malicious effects. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305076 - https://vuldb.com/?ctiid.305076 - https://vuldb.com/?submit.553645 - https://github.com/pytorch/pytorch/issues/150835 - https://github.com/pytorch/pytorch/pull/150981 - https://github.com/pytorch/pytorch/issues/150835#issue-2979082232 - https://github.com/timocafe/tewart-pytorch/commit/46fc5d8e36012736121
m/pytorch/pytorch/issues/150835#issue-2979082232 - https://github.com/timocafe/tewart-pytorch/commit/46fc5d8e360127361211cb237d5f9eef0223e567
CVE ID: CVE-2025-3733 State: PUBLISHED Published: 2025-04-16T16:30:59.761Z Last Updated: 2025-04-16T20:17:04.797Z Vendors: Drupal Products: baguetteBox.js Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal baguetteBox.Js allows Cross-Site Scripting (XSS).This issue affects baguetteBox.Js: from 0.0.0 before 2.0.4, from 3.0.0 before 3.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-034
CVE ID: CVE-2025-3734 State: PUBLISHED Published: 2025-04-16T16:31:19.029Z Last Updated: 2025-04-16T17:15:48.584Z Vendors: Drupal Products: Stage File Proxy Problem Types: CWE-770 Description: Allocation of Resources Without Limits or Throttling vulnerability in Drupal Stage File Proxy allows Flooding.This issue affects Stage File Proxy: from 0.0.0 before 3.1.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-035
CVE ID: CVE-2025-3735 State: PUBLISHED Published: 2025-04-16T16:31:34.331Z Last Updated: 2025-04-17T19:40:31.402Z Vendors: Drupal Products: Panelizer (obsolete) Description: Vulnerability in Drupal Panelizer (obsolete).This issue affects Panelizer (obsolete): *.*. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-036
CVE ID: CVE-2025-3736 State: PUBLISHED Published: 2025-04-16T16:32:08.593Z Last Updated: 2025-04-17T19:40:22.032Z Vendors: Drupal Products: Simple GTM Description: Vulnerability in Drupal Simple GTM.This issue affects Simple GTM: *.*. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-037
CVE ID: CVE-2025-3737 State: PUBLISHED Published: 2025-04-16T16:32:22.119Z Last Updated: 2025-04-17T19:40:13.391Z Vendors: Drupal Products: Google Maps: Store Locator Description: Vulnerability in Drupal Google Maps: Store Locator.This issue affects Google Maps: Store Locator: *.*. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-038
CVE ID: CVE-2025-3738 State: PUBLISHED Published: 2025-04-16T16:32:31.214Z Last Updated: 2025-04-17T19:40:04.588Z Vendors: Drupal Products: Google Optimize Description: Vulnerability in Drupal Google Optimize.This issue affects Google Optimize: *.*. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-039
CVE ID: CVE-2025-3739 State: PUBLISHED Published: 2025-04-16T16:32:44.307Z Last Updated: 2025-04-16T16:58:23.121Z Vendors: Drupal Products: Drupal 8 Google Optimize Hide Page Description: Vulnerability in Drupal Drupal 8 Google Optimize Hide Page.This issue affects Drupal 8 Google Optimize Hide Page: *.*. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-040
CVE ID: CVE-2025-3740 State: PUBLISHED Published: 2025-07-18T04:23:00.426Z Last Updated: 2025-07-18T13:48:44.003Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: dasinfomedia Products: School Management System for Wordpress Problem Types: CWE-22 Description: The School Management System for Wordpress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 93.1.0 via the 'page' parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access c
rbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. The Local File Inclusion exploit can be chained to include various dashboard view files in the plugin. One such chain can be leveraged to update the password of Super Administrator accounts in Multisite environments making privilege escalation possible. The vendor has updated the version numbers beginning with `1.93.1 (02-07-2025)` for the patched version. This version comes after version 93.1.0. Additional Analyst Notes: - CISA ADP Vulnr
2-07-2025)` for the patched version. This version comes after version 93.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3604aece-5e76-4e8e-9caf-f518d6001277?source=cve - https://codecanyon.net/item/school-management-system-for-wordpress/11470032#item-description__update-history
CVE ID: CVE-2025-3742 State: PUBLISHED Published: 2025-05-15T06:00:02.551Z Last Updated: 2025-05-15T15:56:29.512Z Vendors: Unknown Products: Responsive Lightbox & Gallery Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Responsive Lightbox & Gallery WordPress plugin before 2.5.1 does not validate and escape some of its attributes before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5b8f487b-63a5-4d2a-9b61-ed4d97f18320/
CVE ID: CVE-2025-3743 State: PUBLISHED Published: 2025-04-25T06:45:29.320Z Last Updated: 2025-04-25T14:29:52.863Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: wpswings Products: Upsell Funnel Builder for WooCommerce Problem Types: CWE-472 Description: The Upsell Funnel Builder for WooCommerce plugin for WordPress is vulnerable to order manipulation in all versions up to, and including, 3.0.0. This is due to the plugin allowing the additional product ID and discount field to be manipulated prior to processing via the 'add_offer_in_cart' function. This makes it possible for unauthenticated attackers to arbitrarily update the product associated with any orde
unction. This makes it possible for unauthenticated attackers to arbitrarily update the product associated with any order bump, and arbitrarily update the discount applied to any order bump item, when adding it to the cart. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b0e1546b-c8cc-4d57-9909-153209e3a9c6?source=cve - https://plugins.trac.wordpress.org/browser/upsell-order-bump-offer-for-woocommerce/tags/3.0.0/public/class-upsell-order-bump-offer-for-woocommerce-public.php#L1773 - https://plugins.trac.wordpress.org/browser/upsell-order-bump-offer-for-woocommerce/tags/3.0.0/public/class-upsell-order-bump-offer-for-wo
rac.wordpress.org/browser/upsell-order-bump-offer-for-woocommerce/tags/3.0.0/public/class-upsell-order-bump-offer-for-woocommerce-public.php#L1818 - https://plugins.trac.wordpress.org/browser/upsell-order-bump-offer-for-woocommerce/tags/3.0.0/public/class-upsell-order-bump-offer-for-woocommerce-public.php#L1829 - https://plugins.trac.wordpress.org/browser/upsell-order-bump-offer-for-woocommerce/tags/3.0.0/public/class-upsell-order-bump-offer-for-woocommerce-public.php#L1771 - https://plugins.trac.wordpress.org/changeset/3279944/