Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-10670 State: PUBLISHED Published: 2025-09-18T14:02:09.815Z Last Updated: 2025-09-18T20:41:52.851Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: E-Logbook with Health Monitoring System for COVID-19 Problem Types: CWE-89, CWE-74 Description: A flaw has been found in itsourcecode E-Logbook with Health Monitoring System for COVID-19 1.0. This issue affects some unknown processing of the file /check_profile.php. Executing manipulation of the argument profile_id can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Additional Analyst Notes: - CISA ADP Vulnrich
aunch the attack remotely. The exploit has been published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.324791 - https://vuldb.com/?ctiid.324791 - https://vuldb.com/?submit.652396 - https://github.com/yihaofuweng/cve/issues/25 - https://itsourcecode.com/
CVE ID: CVE-2025-10671 State: PUBLISHED Published: 2025-09-18T14:32:05.630Z Last Updated: 2025-09-19T17:10:06.866Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: youth-is-as-pale-as-poetry Products: e-learning Problem Types: CWE-330, CWE-310 Description: A vulnerability has been found in youth-is-as-pale-as-poetry e-learning 1.0. Impacted is the function encryptSecret of the file e-learning-master\exam-api\src\main\java\com\yf\exam\ability\shiro\jwt\JwtUtils.java of the component JWT Token Handler. The manipulation leads to insufficiently random values. The attack can be initiated remotely. The complexity of an attack is rather high. The exploita
fficiently random values. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.324792 - https://vuldb.com/?ctiid.324792 - https://vuldb.com/?submit.653029 - https://github.com/SuJing-cy/CVE/blob/main/yfhl.md
CVE ID: CVE-2025-10672 State: PUBLISHED Published: 2025-09-18T14:32:08.163Z Last Updated: 2025-09-19T17:09:58.091Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R) Vendors: whuan132 Products: AIBattery Problem Types: CWE-306, CWE-287 Description: A vulnerability was found in whuan132 AIBattery up to 1.0.9. The affected element is an unknown function of the file AIBatteryHelper/XPC/BatteryXPCService.swift of the component com.collweb.AIBatteryHelper. The manipulation results in missing authentication. The attack requires a local approach. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.324793 - https://vuldb.com/?ctiid.324793 - https://vuldb.com/?submit.653159 - https://github.com/SwayZGl1tZyyy/n-days/blob/main/AIBattery-Charge-Limiter/README.md - https://github.com/SwayZGl1tZyyy/n-days/blob/main/AIBattery-Charge-Limiter/README.md#proof-of-concept
CVE ID: CVE-2025-10673 State: PUBLISHED Published: 2025-09-18T15:02:06.584Z Last Updated: 2025-09-19T17:09:38.103Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: Student Information Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was determined in itsourcecode Student Information Management System 1.0. The impacted element is an unknown function of the file /admin/modules/class/index.php. This manipulation of the argument classId causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References
e exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.324794 - https://vuldb.com/?ctiid.324794 - https://vuldb.com/?submit.653191 - https://github.com/windhxy/CVE-my/issues/1 - https://itsourcecode.com/
CVE ID: CVE-2025-10674 State: PUBLISHED Published: 2025-09-18T15:32:08.628Z Last Updated: 2025-09-19T17:09:10.864Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: fuyang_lipengjun Products: platform Problem Types: CWE-285, CWE-266 Description: A vulnerability was identified in fuyang_lipengjun platform 1.0. This affects the function AttributeCategoryController of the file /attributecategory/queryAll. Such manipulation leads to improper authorization. The attack may be launched remotely. The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.324795 - https://vul
ght be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.324795 - https://vuldb.com/?ctiid.324795 - https://vuldb.com/?submit.653342 - https://www.cnblogs.com/aibot/p/19063429
CVE ID: CVE-2025-10675 State: PUBLISHED Published: 2025-09-18T16:02:08.727Z Last Updated: 2025-09-22T17:22:48.230Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: fuyang_lipengjun Products: platform Problem Types: CWE-285, CWE-266 Description: A security flaw has been discovered in fuyang_lipengjun platform 1.0. This impacts the function AttributeController of the file /attribute/queryAll. Performing manipulation results in improper authorization. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.
the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.324796 - https://vuldb.com/?ctiid.324796 - https://vuldb.com/?submit.653343 - https://www.cnblogs.com/aibot/p/19063430
CVE ID: CVE-2025-10676 State: PUBLISHED Published: 2025-09-18T16:02:13.034Z Last Updated: 2025-09-19T13:16:47.595Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: fuyang_lipengjun Products: platform Problem Types: CWE-285, CWE-266 Description: A weakness has been identified in fuyang_lipengjun platform 1.0. Affected is the function BrandController of the file /brand/queryAll. Executing manipulation can lead to improper authorization. The attack can be executed remotely. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.324797 - https:/
ld be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.324797 - https://vuldb.com/?ctiid.324797 - https://vuldb.com/?submit.653344 - https://www.cnblogs.com/aibot/p/19063431
CVE ID: CVE-2025-10678 State: PUBLISHED Published: 2025-10-20T15:41:31.149Z Last Updated: 2025-10-20T15:52:13.566Z Vendors: NetBird VPN Products: NetBird Problem Types: CWE-1392 Description: NetBird VPN when installed using vendor's provided script failed to remove or change default password of an admin account created by ZITADEL. This issue affects instances installed using vendor's provided script. This issue may affect instances created with Docker if the default password was not changed nor the user was removed. This issue has been fixed in version 0.57.0 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/10/CVE-2025-10678 - https://netbird.io/
CVE ID: CVE-2025-10680 State: PUBLISHED Published: 2025-10-24T10:06:51.056Z Last Updated: 2025-10-25T03:56:05.222Z Vendors: OpenVPN Products: OpenVPN Problem Types: CWE-78 Description: OpenVPN 2.7_alpha1 through 2.7_beta1 on POSIX based platforms allows a remote authenticated server to inject shell commands via DNS variables when --dns-updown is in use Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.openvpn.net/Security%20Announcements/CVE-2025-10680 - https://www.mail-archive.com/openvpn-announce@lists.sourceforge.net/msg00149.html
CVE ID: CVE-2025-10682 State: PUBLISHED Published: 2025-10-15T08:26:05.267Z Last Updated: 2025-10-15T13:16:04.019Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: tariffuxx Products: TARIFFUXX Problem Types: CWE-89 Description: The TARIFFUXX plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.4. This is due to insufficient neutralization of user-supplied input used directly in SQL queries. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject additional SQL into queries and extract sensitive information from the database via a crafted id attribute in the 'tariffuxx_configura
into queries and extract sensitive information from the database via a crafted id attribute in the 'tariffuxx_configurator' shortcode. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e897a83b-d746-427d-8c31-64d4eab5848e?source=cve - https://plugins.trac.wordpress.org/browser/tariffuxx/tags/1.4/classes/Tariffuxx_admin.php#L36 - https://plugins.trac.wordpress.org/browser/tariffuxx/tags/1.4/classes/Tariffuxx_twl.php#L164
CVE ID: CVE-2025-10683 State: PUBLISHED Published: 2025-11-06T02:31:05.341Z Last Updated: 2025-11-06T16:54:25.147Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: yudiz Products: Easy Email Subscription Problem Types: CWE-89 Description: The Easy Email Subscription plugin for WordPress is vulnerable to SQL Injection via the 'uid' parameter in all versions up to, and including, 1.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries th
attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c2353d9d-d5ae-4470-9c0f-119acecd6686?source=cve - https://plugins.trac.wordpress.org/changeset/3388578/email-subscription-with-secure-captcha
CVE ID: CVE-2025-10686 State: PUBLISHED Published: 2025-11-14T06:00:09.051Z Last Updated: 2025-11-14T15:08:08.868Z Vendors: Unknown Products: Creta Testimonial Showcase Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The Creta Testimonial Showcase WordPress plugin before 1.2.4 is vulnerable to Local File Inclusion. This makes it possible for authenticated attackers, with editor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/27d58c5a-ab87-41aa-a80
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/27d58c5a-ab87-41aa-a806-53fa96d4351c/
CVE ID: CVE-2025-10687 State: PUBLISHED Published: 2025-09-18T17:32:07.113Z Last Updated: 2025-09-18T20:31:53.823Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Responsive E-Learning System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in SourceCodester Responsive E-Learning System 1.0. This affects an unknown part of the file /admin/add_teacher.php. The manipulation of the argument Username results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.324811 - http
and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.324811 - https://vuldb.com/?ctiid.324811 - https://vuldb.com/?submit.653365 - https://github.com/kele28886/cve/issues/1 - https://www.sourcecodester.com/
CVE ID: CVE-2025-10688 State: PUBLISHED Published: 2025-09-18T19:32:07.313Z Last Updated: 2025-09-21T09:41:15.466Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Pet Grooming Management Software Problem Types: CWE-89, CWE-74 Description: A vulnerability was determined in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the file /admin/operation/paid.php. This manipulation of the argument inv_no/insta_amt causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
oit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.324812 - https://vuldb.com/?ctiid.324812 - https://vuldb.com/?submit.653437 - https://github.com/K1nakoo/cve/blob/main/21/report.md - https://www.sourcecodester.com/
CVE ID: CVE-2025-10689 State: PUBLISHED Published: 2025-09-18T20:32:06.032Z Last Updated: 2025-09-19T13:07:05.210Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: D-Link Products: DIR-645 Problem Types: CWE-77, CWE-74 Description: A vulnerability was identified in D-Link DIR-645 105B01. This issue affects the function soapcgi_main of the file /soap.cgi. Such manipulation of the argument service leads to command injection. The attack can be launched remotely. The exploit is publicly available and might be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
roducts that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.324813 - https://vuldb.com/?ctiid.324813 - https://vuldb.com/?submit.653689 - https://github.com/scanleale/IOT_sec/blob/main/DIR-645-soapcgi.pdf - https://www.dlink.com/
CVE ID: CVE-2025-10690 State: PUBLISHED Published: 2025-09-19T02:27:00.685Z Last Updated: 2025-09-19T13:09:32.889Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Bearsthemes Products: Goza - Nonprofit Charity WordPress Theme Problem Types: CWE-862 Description: The Goza - Nonprofit Charity WordPress Theme theme for WordPress is vulnerable to unauthorized arbitrary file uploads due to a missing capability check on the 'beplus_import_pack_install_plugin' function in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to upload zip files containing webshells disguised as plugins from remote locations to achieve remot
enticated attackers to upload zip files containing webshells disguised as plugins from remote locations to achieve remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/628bfa19-2ffa-426b-8b88-22a0c4d0ba92?source=cve - https://themeforest.net/item/goza-nonprofit-charity-wordpress-theme/23781575 - https://www.cve.org/CVERecord?id=CVE-2025-5394
CVE ID: CVE-2025-10691 State: PUBLISHED Published: 2025-11-06T03:27:01.882Z Last Updated: 2025-11-06T17:02:19.997Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: yudiz Products: Easy Email Subscription Problem Types: CWE-352 Description: The Easy Email Subscription plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3. This is due to missing or incorrect nonce validation on the show_editsub_page() function. This makes it possible for unauthenticated attackers to delete arbitrary subscribers via a forged request granted they can trick a site administrator into performing an action such as clicking on a lin
ers via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/53234e29-5213-4acd-abfe-5c4ea5dbf829?source=cve - https://plugins.trac.wordpress.org/changeset/3388578/email-subscription-with-secure-captcha
CVE ID: CVE-2025-10692 State: PUBLISHED Published: 2025-10-03T20:30:44.350Z Last Updated: 2025-10-03T20:44:15.175Z Vendors: OpenSupports Products: OpenSupports Problem Types: CWE-89 Description: The endpoint POST /api/staff/get-new-tickets concatenates the user-controlled parameter departmentId directly into the SQL WHERE clause without parameter binding. As a result, an authenticated staff user (level ≥ 1) can inject SQL to alter the filter logic, effectively bypassing department scoping and disclosing tickets beyond their intended access.This issue affects OpenSupports: 4.11.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/tito - https
.11.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/tito - https://github.com/opensupports/opensupports
CVE ID: CVE-2025-10693 State: PUBLISHED Published: 2025-10-31T19:20:16.031Z Last Updated: 2025-10-31T19:54:55.313Z Vendors: silabs.com Products: Silicon Labs Z-Wave SDK Problem Types: CWE-757 Description: When SmartStart Inclusion fails during the onboarding of a Z-Wave PIR sensor, the sensor will join the network as a non-secure device. This vulnerability exists in Silicon Labs' Z-Wave PIR Sensor Reference design delivered as part of SiSDK v2025.6.0 and v2025.6.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.silabs.com/068Vm00000WN3J0
CVE ID: CVE-2025-10694 State: PUBLISHED Published: 2025-10-25T05:31:22.739Z Last Updated: 2025-10-27T15:57:39.705Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: smub Products: User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds Problem Types: CWE-862 Description: The User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the `maybe_load_onboarding_wizard` function in all versions up to, and including, 1.8.0. This makes it possible for unauthenticated attackers to access the onboarding wizard p
ions up to, and including, 1.8.0. This makes it possible for unauthenticated attackers to access the onboarding wizard page and view configuration information including the administrator email address. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9026b417-4b35-4bec-9dc6-6797661dc7a8?source=cve - https://plugins.trac.wordpress.org/changeset/3378233/userfeedback-lite/trunk/includes/admin/class-userfeedback-onboarding-wizard.php?old=3354862&old_path=userfeedback-lite%2Ftrunk%2Fincludes%2Fadmin%2Fclass-userfeedback-onboarding-wizard.php
CVE ID: CVE-2025-10695 State: PUBLISHED Published: 2025-10-03T20:39:08.144Z Last Updated: 2025-10-06T14:22:14.098Z Vendors: OpenSupports Products: OpenSupports Problem Types: CWE-918 Description: Two unauthenticated diagnostic endpoints allow arbitrary backend-initiated network connections to an attacker‑supplied destination. Both endpoints are exposed with permission => 'any', enabling unauthenticated SSRF for internal network scanning and service interaction. This issue affects OpenSupports: 4.11.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/freer - https://github.com/opensupports/opensupports
CVE ID: CVE-2025-10696 State: PUBLISHED Published: 2025-10-03T20:35:41.279Z Last Updated: 2025-10-06T14:23:23.564Z Vendors: OpenSupports Products: OpenSupports Problem Types: CWE-863 Description: OpenSupports exposes an endpoint that allows the list of 'supervised users' for any account to be edited, but it does not validate whether the actor is the owner of that list. A Level 1 staff member can modify the supervision relationship of a third party (the target user), who can then view the tickets of the added 'supervised' users. This breaks the authorization model and filters the content of other users' tickets.This issue affects OpenSupports: 4.11.0. Additional Analyst Notes: - CISA ADP Vuln
s the content of other users' tickets.This issue affects OpenSupports: 4.11.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/stratovarius - https://github.com/opensupports/opensupports
CVE ID: CVE-2025-10699 State: PUBLISHED Published: 2025-10-15T14:25:54.914Z Last Updated: 2025-10-16T19:58:26.300Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Lenovo Products: LeCloud Client Problem Types: CWE-295 Description: A vulnerability was reported in the Lenovo LeCloud client application that, under certain conditions, could allow information disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://iknow.lenovo.com.cn/detail/432379 - https://lecloud.lenovo.com/index
CVE ID: CVE-2025-10700 State: PUBLISHED Published: 2025-10-16T02:25:10.146Z Last Updated: 2025-10-16T14:35:54.173Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: elemntor Products: Ally – Web Accessibility & Usability Problem Types: CWE-352 Description: The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.0. This is due to missing or incorrect nonce validation on the enable_unfiltered_files_upload function. This makes it possible for unauthenticated attackers to enable unfiltered file upload and add svg files to the upload list via a forged request granted they ca
ted attackers to enable unfiltered file upload and add svg files to the upload list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f9190d35-c9e7-4190-8e66-f6066fe66af8?source=cve - https://research.cleantalk.org/cve-2025-10700 - https://plugins.trac.wordpress.org/changeset/3378763/
CVE ID: CVE-2025-10701 State: PUBLISHED Published: 2025-10-24T08:23:58.143Z Last Updated: 2025-10-24T12:31:11.742Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: scottpaterson Products: Time Clock – A WordPress Employee & Volunteer Time Clock Plugin Problem Types: CWE-79 Description: The Time Clock – A WordPress Employee & Volunteer Time Clock Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 1.3.1. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with Time Clock user credentials to
ing on user supplied attributes. This makes it possible for authenticated attackers with Time Clock user credentials to inject arbitrary web scripts in pages that will execute whenever a user accesses an affected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3710f219-545f-421d-a654-f49169ff7808?source=cve - https://plugins.trac.wordpress.org/browser/time-clock/tags/1.3/includes/actions.php#L387 - https://plugins.trac.wordpress.org/browser/time-clock/tags/1.3/includes/admin/activity.php#L149 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3382912%40time-clock&new=3382912%40tim
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3382912%40time-clock&new=3382912%40time-clock&sfp_email=&sfph_mail=