Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-3488 State: PUBLISHED Published: 2025-05-02T05:22:33.778Z Last Updated: 2025-05-02T15:53:30.394Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: WPML Products: WPML Problem Types: CWE-79 Description: The WPML plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpml_language_switcher shortcode in versions 3.6.0 - 4.7.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Anal
e, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/92c1bd85-5f81-4bb6-b6af-6cda85b91b9e?source=cve - https://wpml.org/documentation/support/wpml-coding-api/shortcodes/ - https://wpml.org/category/changelog/
CVE ID: CVE-2025-3489 State: PUBLISHED Published: 2025-04-10T03:00:16.407Z Last Updated: 2025-04-10T15:52:44.358Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: Nababur Products: Simple-User-Management-System Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in Nababur Simple-User-Management-System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /register.php. The manipulation of the argument name/username leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted earl
been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304298 - https://vuldb.com/?ctiid.304298 - https://vuldb.com/?submit.545504 - https://www.websecurityinsights.my.id/2025/03/simple-user-management-system-v-10-name.html
CVE ID: CVE-2025-3491 State: PUBLISHED Published: 2025-04-26T05:34:23.629Z Last Updated: 2025-04-28T15:34:54.012Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: kiranpatil353 Products: Add custom page template Problem Types: CWE-94 Description: The Add custom page template plugin for WordPress is vulnerable to PHP Code Injection leading to Remote Code Execution in all versions up to, and including, 2.0.1 via the 'acpt_validate_setting' function. This is due to insufficient sanitization of the 'template_name' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server. Additional Analy
for authenticated attackers, with Administrator-level access and above, to execute code on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9c2d97c4-b166-4d1f-8042-d0362e650c62?source=cve - https://plugins.svn.wordpress.org/add-custom-page-template/trunk/index.php
CVE ID: CVE-2025-3493 State: REJECTED Published: N/A Last Updated: 2025-06-17T03:29:01.559Z Description: No description available.
CVE ID: CVE-2025-3494 State: REJECTED Published: N/A Last Updated: 2025-06-17T03:30:26.281Z Description: No description available.
CVE ID: CVE-2025-3495 State: PUBLISHED Published: 2025-04-16T03:10:05.952Z Last Updated: 2025-08-19T00:11:36.662Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: COMMGR Problem Types: CWE-338 Description: Delta Electronics COMMGR v1 and v2 uses insufficiently randomized values to generate session IDs (CWE-338). An attacker could easily brute force a session ID and load and execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00005_COMMGR%20-%20Insufficient%20Randomization%20Authentication%20Bypass_v1.pdf - https://www.cisa.gov/ne
lta-PCSA-2025-00005_COMMGR%20-%20Insufficient%20Randomization%20Authentication%20Bypass_v1.pdf - https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-07
CVE ID: CVE-2025-3496 State: PUBLISHED Published: 2025-05-12T08:01:57.671Z Last Updated: 2025-05-16T09:00:16.307Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Auma Riester Products: AC1.2, MEC 03.01, PROFOX, SGx/SVx, TIGRON, TIGRON SIL Problem Types: CWE-120 Description: An unauthenticated remote attacker can cause a buffer overflow which could lead to unexpected behaviour or DoS via Bluetooth or RS-232 interface. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2025-026
CVE ID: CVE-2025-3497 State: PUBLISHED Published: 2025-07-09T08:46:26.351Z Last Updated: 2025-07-09T13:29:28.274Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H) Vendors: Radiflow Products: iSAP Smart Collector Problem Types: CWE-1104 Description: The Linux distribution underlying the Radiflow iSAP Smart Collector (CentOS 7 - VSAP 1.20) is obsolete and reached end of life (EOL) on June 30, 2024. Thus, any unmitigated vulnerability could be exploited to affect this product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cvcn.gov.it/cvcn/cve/CVE-2025-3497
CVE ID: CVE-2025-3498 State: PUBLISHED Published: 2025-07-09T08:53:32.653Z Last Updated: 2025-07-09T13:20:55.438Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L) Vendors: Radiflow Products: iSAP Smart Collector Problem Types: CWE-306 Description: An unauthenticated user with management network access can get and modify the Radiflow iSAP Smart Collector (CentOS 7 - VSAP 1.20) configuration. The device has two web servers that expose unauthenticated REST APIs on the management network (TCP ports 8084 and 8086). An attacker can use these APIs to get access to all system settings, modify the configuration and execute some commands (e.g., system reboot). Additional Anal
access to all system settings, modify the configuration and execute some commands (e.g., system reboot). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cvcn.gov.it/cvcn/cve/CVE-2025-3498
CVE ID: CVE-2025-3499 State: PUBLISHED Published: 2025-07-09T08:57:26.893Z Last Updated: 2025-07-09T13:08:05.257Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Radiflow Products: iSAP Smart Collector Problem Types: CWE-78 Description: The device has two web servers that expose unauthenticated REST APIs on the management network (TCP ports 8084 and 8086). Exploiting OS command injection through these APIs, an attacker can send arbitrary commands that are executed with administrative permissions by the underlying operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cvcn.gov.it/cvcn/cve/CVE-2025-3499
CVE ID: CVE-2025-3501 State: PUBLISHED Published: 2025-04-29T20:45:29.507Z Last Updated: 2025-11-20T07:27:01.176Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Red Hat Products: Red Hat Build of Keycloak, Red Hat build of Keycloak 26, Red Hat build of Keycloak 26.0, Red Hat build of Keycloak 26.2, Red Hat Single Sign-On 7 Problem Types: CWE-297 Description: A flaw was found in Keycloak. By setting a verification policy to 'ALL', the trust store certificate verification is skipped, which is unintended. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:4335 - https://access.redhat.com/errata/RHSA-2025:4
lnrichment: References: - https://access.redhat.com/errata/RHSA-2025:4335 - https://access.redhat.com/errata/RHSA-2025:4336 - https://access.redhat.com/errata/RHSA-2025:8672 - https://access.redhat.com/errata/RHSA-2025:8690 - https://access.redhat.com/security/cve/CVE-2025-3501 - https://bugzilla.redhat.com/show_bug.cgi?id=2358834 - https://github.com/keycloak/keycloak/issues/39350 - https://github.com/keycloak/keycloak/pull/39366
CVE ID: CVE-2025-3502 State: PUBLISHED Published: 2025-05-01T06:00:04.009Z Last Updated: 2025-05-01T15:05:25.094Z Vendors: Unknown Products: WP Maps Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/dd436064-e611-4a4b-a873-67ed6029c46f/
CVE ID: CVE-2025-3503 State: PUBLISHED Published: 2025-05-01T06:00:04.224Z Last Updated: 2025-05-02T15:29:12.390Z Vendors: Unknown Products: WP Maps Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/83ddd432-309f-4ff5-974c-fdc9c67d1051/
CVE ID: CVE-2025-3504 State: PUBLISHED Published: 2025-05-01T06:00:04.597Z Last Updated: 2025-05-01T14:47:54.188Z Vendors: Unknown Products: WP Maps Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/252484a6-96f0-43f3-a7dc-d20cc89ba119/
CVE ID: CVE-2025-3506 State: PUBLISHED Published: 2025-05-08T11:24:24.682Z Last Updated: 2025-05-08T13:27:46.989Z Vendors: Checkmk GmbH Products: Checkmk Problem Types: CWE-497 Description: Files to be deployed with agents are accessible without authentication in Checkmk 2.1.0, Checkmk 2.2.0, Checkmk 2.3.0 and <Checkmk 2.4.0b6 allows attacker to access files that could contain secrets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://checkmk.com/werk/17348
CVE ID: CVE-2025-3508 State: PUBLISHED Published: 2025-07-25T15:58:36.045Z Last Updated: 2025-07-25T17:41:27.327Z Vendors: HP Inc. Products: Certain HP DesignJet products Problem Types: CWE-200 Description: Certain HP DesignJet products may be vulnerable to information disclosure though printer's web interface allowing unauthenticated users to view sensitive print job information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hp.com/us-en/document/ish_12798086-12798125-16/hpsbpi04039
CVE ID: CVE-2025-3509 State: PUBLISHED Published: 2025-04-17T22:50:18.437Z Last Updated: 2025-06-18T21:07:05.883Z Vendors: GitHub Products: Enterprise Server Problem Types: CWE-94 Description: A Remote Code Execution (RCE) vulnerability was identified in GitHub Enterprise Server that allowed attackers to execute arbitrary code by exploiting the pre-receive hook functionality, potentially leading to privilege escalation and system compromise. The vulnerability involves using dynamically allocated ports that become temporarily available, such as during a hot patch upgrade. This means the vulnerability is only exploitable during specific operational conditions, which limits the attack window. E
is means the vulnerability is only exploitable during specific operational conditions, which limits the attack window. Exploitation required either site administrator permissions to enable and configure pre-receive hooks or a user with permissions to modify repositories containing pre-receive hooks where this functionality was already enabled. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.18 and was fixed in versions 3.17.1, 3.16.4, 3.15.8, 3.14.13, 3.13.16. This vulnerability was reported via the GitHub Bug Bounty program. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3
st Notes: - CISA ADP Vulnrichment: References: - https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.16 - https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.13 - https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.8 - https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.4 - https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.1
CVE ID: CVE-2025-3510 State: PUBLISHED Published: 2025-05-02T03:21:18.095Z Last Updated: 2025-05-02T14:57:09.067Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: tagDiv Products: tagDiv Composer Problem Types: CWE-79 Description: The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in all versions up to, and including, 5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A
ccess and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2bd6b66d-f33e-4287-850b-a199de72f6ad?source=cve - https://tagdiv.com/newspaper-changelog/ - https://themeforest.net/item/newspaper/5489609 - https://tagdiv.com/tagdiv-composer-page-builder-basics/
CVE ID: CVE-2025-3511 State: PUBLISHED Published: 2025-04-25T05:14:43.758Z Last Updated: 2025-10-23T17:46:36.083Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Mitsubishi Electric Corporation Products: CC-Link IE TSN Remote I/O module NZ2GN2S1-32D, CC-Link IE TSN Remote I/O module NZ2GN2S1-32T, CC-Link IE TSN Remote I/O module NZ2GN2S1-32TE, CC-Link IE TSN Remote I/O module NZ2GN2S1-32DT, CC-Link IE TSN Remote I/O module NZ2GN2S1-32DTE, CC-Link IE TSN Remote I/O module NZ2GN2B1-32D, CC-Link IE TSN Remote I/O module NZ2GN2B1-32T, CC-Link IE TSN Remote I/O module NZ2GN2B1-32TE, CC-Link IE TSN Remote I/O module NZ2GN2B1-32DT, CC-Link IE TSN Remote I/O module NZ
TSN Remote I/O module NZ2GN2B1-32TE, CC-Link IE TSN Remote I/O module NZ2GN2B1-32DT, CC-Link IE TSN Remote I/O module NZ2GN2B1-32DTE, CC-Link IE TSN Remote I/O module NZ2GNCF1-32D, CC-Link IE TSN Remote I/O module NZ2GNCF1-32T, CC-Link IE TSN Remote I/O module NZ2GNCE3-32D, CC-Link IE TSN Remote I/O module NZ2GNCE3-32DT, CC-Link IE TSN Remote I/O module NZ2GN12A4-16D, CC-Link IE TSN Remote I/O module NZ2GN12A4-16DE, CC-Link IE TSN Remote I/O module NZ2GN12A2-16T, CC-Link IE TSN Remote I/O module NZ2GN12A2-16TE, CC-Link IE TSN Remote I/O module NZ2GN12A42-16DT, CC-Link IE TSN Remote I/O module NZ2GN12A42-16DTE, CC-Link IE TSN Remote I/O module NZ2GN2S1-16D, CC-Link IE TSN Remote I/O module NZ
N Remote I/O module NZ2GN12A42-16DTE, CC-Link IE TSN Remote I/O module NZ2GN2S1-16D, CC-Link IE TSN Remote I/O module NZ2GN2S1-16T, CC-Link IE TSN Remote I/O module NZ2GN2S1-16TE, CC-Link IE TSN Remote I/O module NZ2GN2B1-16D, CC-Link IE TSN Remote I/O module NZ2GN2B1-16T, CC-Link IE TSN Remote I/O module NZ2GN2B1-16TE, CC-Link IE TSN Analog-Digital Converter module NZ2GN2S-60AD4, CC-Link IE TSN Analog-Digital Converter module NZ2GN2B-60AD4, CC-Link IE TSN Digital-Analog Converter module NZ2GN2S-60DA4, CC-Link IE TSN Digital-Analog Converter module NZ2GN2B-60DA4, CC-Link IE TSN FPGA module NZ2GN2S-D41P01, CC-Link IE TSN FPGA module NZ2GN2S-D41D01, CC-Link IE TSN FPGA module NZ2GN2S-D41PD02,
TSN FPGA module NZ2GN2S-D41P01, CC-Link IE TSN FPGA module NZ2GN2S-D41D01, CC-Link IE TSN FPGA module NZ2GN2S-D41PD02, CC-Link IE TSN Remote Station Communication LSI CP620 with GbE-PHY NZ2GACP620-300, CC-Link IE TSN Remote Station Communication LSI CP620 with GbE-PHY NZ2GACP620-60, MELSEC iQ-R Series CC-Link IE TSN Master/Local Module RJ71GN11-T2, MELSEC iQ-R Series CC-Link IE TSN Master/Local Module RJ71GN11-EIP, MELSEC iQ-R Series CC-Link IE TSN Master/Local Module RJ71GN11-SX, MELSEC iQ-R Series Ethernet Interface Module RJ71EN71, CC-Link IE TSN Master/Local Station Communication LSI CP610 NZ2GACP610-60, CC-Link IE TSN Master/Local Station Communication LSI CP610 NZ2KT-NPETNG51 Problem
mmunication LSI CP610 NZ2GACP610-60, CC-Link IE TSN Master/Local Station Communication LSI CP610 NZ2KT-NPETNG51 Problem Types: CWE-1284 Description: Improper Validation of Specified Quantity in Input vulnerability in Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O module, CC-Link IE TSN Analog-Digital Converter module, CC-Link IE TSN Digital-Analog Converter module, CC-Link IE TSN FPGA module, CC-Link IE TSN Remote Station Communication LSI CP620 with GbE-PHY, MELSEC iQ-R Series CC-Link IE TSN Master/Local Module, MELSEC iQ-R Series Ethernet Interface Module, and CC-Link IE TSN Master/Local Station Communication LSI CP610 allows a remote unauthenticated attacker to cause a Denial o
CC-Link IE TSN Master/Local Station Communication LSI CP610 allows a remote unauthenticated attacker to cause a Denial of Service condition in the products by sending specially crafted UDP packets. A system reset of the product is required for recovery. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-001_en.pdf - https://jvn.jp/vu/JVNVU96620683/ - https://www.cisa.gov/news-events/ics-advisories/icsa-25-128-03
CVE ID: CVE-2025-3512 State: PUBLISHED Published: 2025-04-11T07:39:48.298Z Last Updated: 2025-04-25T18:03:41.850Z Vendors: The Qt Company Products: Qt Problem Types: CWE-122 Description: There is a Heap-based Buffer Overflow vulnerability in QTextMarkdownImporter. This requires an incorrectly formatted markdown file to be passed to QTextMarkdownImporter to trigger the overflow.This issue affects Qt from 6.8.0 to 6.8.4. Versions up to 6.6.0 are known to be unaffected, and the fix is in 6.8.4 and later. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://codereview.qt-project.org/c/qt/qtbase/+/635546
CVE ID: CVE-2025-3513 State: PUBLISHED Published: 2025-05-02T06:00:02.187Z Last Updated: 2025-05-02T15:46:27.620Z Vendors: Unknown Products: SureForms Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/dd7e0bb3-4a98-4f62-bd2e-f30b27d71226/
CVE ID: CVE-2025-3514 State: PUBLISHED Published: 2025-05-02T06:00:02.905Z Last Updated: 2025-05-02T14:43:02.402Z Vendors: Unknown Products: SureForms Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/fc3da503-a973-44d8-82d0-13539501f8c0/
CVE ID: CVE-2025-3515 State: PUBLISHED Published: 2025-06-17T09:21:39.083Z Last Updated: 2025-06-17T14:26:20.937Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: glenwpcoder Products: Drag and Drop Multiple File Upload for Contact Form 7 Problem Types: CWE-434 Description: The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 1.3.8.9. This makes it possible for unauthenticated attackers to bypass the plugin's blacklist and upload .phar or other dangerous file types on the affected site's server, which may make remote c
plugin's blacklist and upload .phar or other dangerous file types on the affected site's server, which may make remote code execution possible on the servers that are configured to handle .phar files as executable PHP scripts, particularly in default Apache+mod_php configurations where the file extension is not strictly validated before being passed to the PHP interpreter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e1298242-61d2-495e-bae7-96b5e12bd03d?source=cve - https://plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-contact-form-7/tags/1.3.8.8/inc/dnd-upload-cf7.php#L845 - https://plugins
org/browser/drag-and-drop-multiple-file-upload-contact-form-7/tags/1.3.8.8/inc/dnd-upload-cf7.php#L845 - https://plugins.trac.wordpress.org/changeset/3310153/
CVE ID: CVE-2025-3516 State: PUBLISHED Published: 2025-05-16T06:00:04.784Z Last Updated: 2025-05-16T17:10:23.868Z Vendors: Unknown Products: Simple Lightbox Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Simple Lightbox WordPress plugin before 2.9.4 does not validate and escape some of its attributes before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/336a78cd-297b-4f47-a007-e33eac7f1dad/
CVE ID: CVE-2025-3517 State: PUBLISHED Published: 2025-05-01T18:26:22.565Z Last Updated: 2025-05-02T12:21:00.974Z Vendors: Devolutions Products: Devolutions Server Problem Types: CWE-266 Description: Incorrect privilege assignment in PAM JIT elevation feature in Devolutions Server 2025.1.5.0 and earlier allows a PAM user to elevate a previously configured user configured in a PAM JIT account via failure to update the internal account’s SID when updating the username. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2025-0006/
CVE ID: CVE-2025-3518 State: PUBLISHED Published: 2025-04-22T08:49:56.073Z Last Updated: 2025-04-24T14:59:31.675Z Vendors: Unblu inc. Products: Unblu Spark Description: It technically possible for a user to upload a file to a conversation despite the file upload functionality being disabled. The file upload functionality can be enabled or disabled for specific use cases through configuration. In case the functionality is disabled for at least one use case, the system nevertheless allows files to be uploaded through direct API requests. During the upload file, interception and allowed file type rules are still applied correctly. If file sharing is generally enabled, this issue is not of conce
nd allowed file type rules are still applied correctly. If file sharing is generally enabled, this issue is not of concern. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.unblu.com/en/docs/latest/security-bulletins/#UBL-2025-002