Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-53539 State: PUBLISHED Published: 2025-07-07T19:16:02.559Z Last Updated: 2025-07-07T20:51:58.541Z Vendors: rennf93 Products: fastapi-guard Problem Types: CWE-1333 Description: FastAPI Guard is a security library for FastAPI that provides middleware to control IPs, log requests, and detect penetration attempts. fastapi-guard's penetration attempts detection uses regex to scan incoming requests. However, some of the regex patterns used in detection are extremely inefficient and can cause polynomial complexity backtracks when handling specially crafted inputs. This vulnerability is fixed in 3.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.c
This vulnerability is fixed in 3.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rennf93/fastapi-guard/security/advisories/GHSA-j47q-rc62-w448 - https://github.com/rennf93/fastapi-guard/commit/d9d50e8130b7b434cdc1b001b8cfd03a06729f7f
CVE ID: CVE-2025-53540 State: PUBLISHED Published: 2025-07-07T19:26:12.503Z Last Updated: 2025-07-07T20:53:06.570Z Vendors: espressif Products: arduino-esp32 Problem Types: CWE-352 Description: arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Several OTA update examples and the HTTPUpdateServer implementation are vulnerable to Cross-Site Request Forgery (CSRF). The update endpoints accept POST requests for firmware uploads without CSRF protection. This allows an attacker to upload and execute arbitrary firmware, resulting in remote code execution (RCE). This vulnerability is fixed in 3.2.1. Additional Analyst Notes: - CISA
mware, resulting in remote code execution (RCE). This vulnerability is fixed in 3.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/espressif/arduino-esp32/security/advisories/GHSA-9vfw-wx65-c872 - https://github.com/espressif/arduino-esp32/commit/f4fdecc60c465384e465a4b1d2bd1eac8f67912e
CVE ID: CVE-2025-53541 State: PUBLISHED Published: 2025-07-29T19:27:38.787Z Last Updated: 2025-07-29T19:33:08.778Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L) Vendors: Enalean Products: tuleap Problem Types: CWE-79 Description: Tuleap is an Open Source Suite created to facilitate management of software development and collaboration. In Tuleap Community Edition prior to version 16.9.99.1751892857 and Tuleap Enterprise Edition prior to 16.8-5 and 16.9-3, malicious users with some control over certain artifacts could insert malicious code when displaying the children of a parent artifact to force victims to execute the uncontrolled code. This is fixed in version Tul
laying the children of a parent artifact to force victims to execute the uncontrolled code. This is fixed in version Tuleap Community Edition prior to version 16.9.99.1751892857 and Tuleap Enterprise Edition prior to 16.8-5 and 16.9-3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Enalean/tuleap/security/advisories/GHSA-6r66-j76j-rwhw - https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=c1aec8247697d63dc4af791ecd6bd70d105ded08 - https://tuleap.net/plugins/tracker/?aid=43693 - http://github.com/Enalean/tuleap/commit/c1aec8247697d63dc4af791ecd6bd70d105ded08
CVE ID: CVE-2025-53542 State: PUBLISHED Published: 2025-07-10T18:20:21.446Z Last Updated: 2025-07-10T19:03:00.522Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: kubernetes-sigs Products: headlamp Problem Types: CWE-78, CWE-88 Description: Headlamp is an extensible Kubernetes web UI. A command injection vulnerability was discovered in the codeSign.js script used in the macOS packaging workflow of the Kubernetes Headlamp project. This issue arises due to the improper use of Node.js's execSync() function with unsanitized input derived from environment variables, which can be influenced by an attacker. The variables ${teamID}, ${entitlementsPath}, and ${config.a
ironment variables, which can be influenced by an attacker. The variables ${teamID}, ${entitlementsPath}, and ${config.app} are dynamically derived from the environment or application config and passed directly to the shell command without proper escaping or argument separation. This exposes the system to command injection if any of the values contain malicious input. This vulnerability is fixed in 0.31.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kubernetes-sigs/headlamp/security/advisories/GHSA-34rf-485x-g5h7 - https://github.com/kubernetes-sigs/headlamp/pull/3377 - https://github.com/kubernetes-sigs/headlamp/commit/5bc0a9dd87acdf1e04be14619acde687
kubernetes-sigs/headlamp/pull/3377 - https://github.com/kubernetes-sigs/headlamp/commit/5bc0a9dd87acdf1e04be14619acde687eefa35fb - https://advisory.zerodaysec.org/advisory/kubernetes-headlamp-code-signing
CVE ID: CVE-2025-53543 State: PUBLISHED Published: 2025-07-07T19:54:46.526Z Last Updated: 2025-07-07T20:54:44.844Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: kestra-io Products: kestra Problem Types: CWE-79 Description: Kestra is an event-driven orchestration platform. The error message in execution "Overview" tab is vulnerable to stored XSS due to improper handling of HTTP response received. This vulnerability is fixed in 0.22.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kestra-io/kestra/security/advisories/GHSA-qpj4-4r6r-wvf4
CVE ID: CVE-2025-53544 State: PUBLISHED Published: 2025-08-05T00:14:33.857Z Last Updated: 2025-08-05T13:55:55.320Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: TriliumNext Products: Trilium Problem Types: CWE-307 Description: Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases. In versions below 0.97.0, a brute-force protection bypass in the initial sync seed retrieval endpoint allows unauthenticated attackers to guess the login password without triggering rate limiting. Trilium is a single-user app without a username requirement, and brute-force protection bypass makes e
ng rate limiting. Trilium is a single-user app without a username requirement, and brute-force protection bypass makes exploitation much more feasible. Multiple features provided by Trilium (e.g. MFA, share notes, custom request handler) indicate that Trilium can be exposed to the internet. This is fixed in version 0.97.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TriliumNext/Trilium/security/advisories/GHSA-hw5p-ff75-327r - https://github.com/TriliumNext/Trilium/pull/6243/commits/04c8f8a1234e8c9f4a87da187180375227b21223 - https://github.com/TriliumNext/Trilium/releases/tag/v0.97.0
CVE ID: CVE-2025-53545 State: PUBLISHED Published: 2025-07-08T15:02:29.679Z Last Updated: 2025-07-08T20:40:03.224Z Vendors: frappe Products: press Problem Types: CWE-287 Description: Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). Users can circumvent 2FA login for users due to a lack of server side validation for the same. This vulnerability is fixed in commit ddb439f8eb1816010f2ef653a908648b71f9bba8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/frappe/press/security/advisories/GHSA-fwfh-vhjg-45q4 - https://github.com/frappe/press/commit/ddb439f8eb1816010f2ef653a908
appe/press/security/advisories/GHSA-fwfh-vhjg-45q4 - https://github.com/frappe/press/commit/ddb439f8eb1816010f2ef653a908648b71f9bba8
CVE ID: CVE-2025-53546 State: PUBLISHED Published: 2025-07-09T14:27:40.848Z Last Updated: 2025-07-09T16:00:30.688Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: RSSNext Products: Folo Problem Types: CWE-829 Description: Folo organizes feeds content into one timeline. Using pull_request_target on .github/workflows/auto-fix-lint-format-commit.yml can be exploited by attackers, since untrusted code can be executed having full access to secrets (from the base repo). By exploiting the vulnerability is possible to exfiltrate GITHUB_TOKEN which has high privileges. GITHUB_TOKEN can be used to completely overtake the repo since the token has content write privil
h has high privileges. GITHUB_TOKEN can be used to completely overtake the repo since the token has content write privileges. This vulnerability is fixed in commit 585c6a591440cd39f92374230ac5d65d7dd23d6a. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/RSSNext/Folo/security/advisories/GHSA-h87r-5w74-qfm4 - https://github.com/RSSNext/Folo/commit/585c6a591440cd39f92374230ac5d65d7dd23d6a
CVE ID: CVE-2025-53547 State: PUBLISHED Published: 2025-07-08T21:39:59.075Z Last Updated: 2025-10-24T03:55:19.650Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:H) Vendors: helm Products: helm Problem Types: CWE-94 Description: Helm is a package manager for Charts for Kubernetes. Prior to 3.18.4, a specially crafted Chart.yaml file along with a specially linked Chart.lock file can lead to local code execution when dependencies are updated. Fields in a Chart.yaml file, that are carried over to a Chart.lock file when dependencies are updated and this file is written, can be crafted in a way that can cause execution if that same content were in a file that is executed (e.g
e is written, can be crafted in a way that can cause execution if that same content were in a file that is executed (e.g., a bash.rc file or shell script). If the Chart.lock file is symlinked to one of these files updating dependencies will write the lock file content to the symlinked file. This can lead to unwanted execution. Helm warns of the symlinked file but did not stop execution due to symlinking. This issue has been resolved in Helm v3.18.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/helm/helm/security/advisories/GHSA-557j-xg8c-q2mm - https://github.com/helm/helm/commit/4b8e61093d8f579f1165cdc6bd4b43fa5455f571
CVE ID: CVE-2025-53548 State: PUBLISHED Published: 2025-07-09T17:12:10.483Z Last Updated: 2025-07-09T17:34:36.765Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: clerk Products: javascript Problem Types: CWE-345 Description: Clerk helps developers build user management. Applications that use the verifyWebhook() helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events. The issue was resolved in @clerk/backend 2.4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/clerk/javascript/security/advisories/GHSA-9mp4-77wg-rwx9
CVE ID: CVE-2025-53549 State: PUBLISHED Published: 2025-07-10T18:28:24.373Z Last Updated: 2025-07-10T19:02:23.365Z Vendors: matrix-org Products: matrix-rust-sdk Problem Types: CWE-89 Description: The Matrix Rust SDK is a collection of libraries that make it easier to build Matrix clients in Rust. An SQL injection vulnerability in the EventCache::find_event_with_relations method of matrix-sdk 0.11 and 0.12 allows malicious room members to execute arbitrary SQL commands in Matrix clients that directly pass relation types provided by those room members into this method, when used with the default sqlite-based store backend. Exploitation is unlikely, as no known clients currently use the API in
sed with the default sqlite-based store backend. Exploitation is unlikely, as no known clients currently use the API in this manner. This vulnerability is fixed in 0.13. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-275g-g844-73jh - https://github.com/matrix-org/matrix-rust-sdk/pull/4849
CVE ID: CVE-2025-53557 State: PUBLISHED Published: 2025-08-25T13:53:43.305Z Last Updated: 2025-11-03T18:13:15.912Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: The Biosig Project Products: libbiosig Problem Types: CWE-122 Description: A heap-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_
lyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2235
CVE ID: CVE-2025-53558 State: PUBLISHED Published: 2025-07-31T05:44:25.120Z Last Updated: 2025-07-31T17:53:03.721Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ZTE Japan. K.K. Products: ZXHN-F660T, ZXHN-F660A Problem Types: CWE-1391 Description: ZXHN-F660T and ZXHN-F660A provided by ZTE Japan K.K. use a common credential for all installations. With the knowledge of the credential, an attacker may log in to the affected devices. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jvn.jp/en/jp/JVN66546573/
CVE ID: CVE-2025-53559 State: PUBLISHED Published: 2025-08-20T08:03:14.840Z Last Updated: 2025-08-20T14:15:58.106Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: LambertGroup Products: Universal Video Player - Addon for WPBakery Page Builder Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Universal Video Player - Addon for WPBakery Page Builder allows Reflected XSS. This issue affects Universal Video Player - Addon for WPBakery Page Builder: from n/a through 3.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/databas
from n/a through 3.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/lbg-universal-video-player-addon-visual-composer/vulnerability/wordpress-universal-video-player-addon-for-wpbakery-page-builder-3-2-1-cross-site-scripting-xss-vulnerability-3?_s_id=cve
CVE ID: CVE-2025-53560 State: PUBLISHED Published: 2025-08-20T08:03:14.302Z Last Updated: 2025-08-20T15:39:07.209Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: rascals Products: Noisa Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in rascals Noisa allows Object Injection. This issue affects Noisa: from n/a through 2.6.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/noisa/vulnerability/wordpress-noisa-2-6-0-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-53561 State: PUBLISHED Published: 2025-08-20T08:03:13.729Z Last Updated: 2025-08-20T15:44:42.462Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: miniOrange Products: Prevent files / folders access Problem Types: CWE-35 Description: Path Traversal vulnerability in miniOrange Prevent files / folders access allows Path Traversal. This issue affects Prevent files / folders access: from n/a through 2.6.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/prevent-file-access/vulnerability/wordpress-prevent-files-folders-access-plugin-2-6-0-path-traversal-vulnerability?_s_id=cve
CVE ID: CVE-2025-53562 State: PUBLISHED Published: 2025-08-20T08:03:13.165Z Last Updated: 2025-08-20T14:09:34.667Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: LambertGroup Products: Universal Video Player - Addon for WPBakery Page Builder Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Universal Video Player - Addon for WPBakery Page Builder allows Reflected XSS. This issue affects Universal Video Player - Addon for WPBakery Page Builder: from n/a through 3.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/databas
from n/a through 3.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/lbg_universal_video_player_addon_visual_composer/vulnerability/wordpress-universal-video-player-addon-for-wpbakery-page-builder-3-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-53563 State: PUBLISHED Published: 2025-08-20T08:03:12.638Z Last Updated: 2025-08-20T14:10:14.385Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: LambertGroup Products: Youtube Vimeo Video Player and Slider Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Youtube Vimeo Video Player and Slider allows Reflected XSS. This issue affects Youtube Vimeo Video Player and Slider: from n/a through 3.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/video_player_youtube_vimeo/vulnerability
DP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/video_player_youtube_vimeo/vulnerability/wordpress-youtube-vimeo-video-player-and-slider-3-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-53564 State: PUBLISHED Published: 2025-08-20T08:03:12.063Z Last Updated: 2025-08-20T14:11:30.228Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: LambertGroup Products: HTML5 Radio Player - WPBakery Page Builder Addon Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup HTML5 Radio Player - WPBakery Page Builder Addon allows Reflected XSS. This issue affects HTML5 Radio Player - WPBakery Page Builder Addon: from n/a through 2.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/lbg_rad
dditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/lbg_radio_player_addon_visual_composer/vulnerability/wordpress-html5-radio-player-wpbakery-page-builder-addon-2-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-53565 State: PUBLISHED Published: 2025-08-20T08:03:11.564Z Last Updated: 2025-08-20T14:15:15.947Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: RadiusTheme Products: Widget for Google Reviews Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Widget for Google Reviews allows PHP Local File Inclusion. This issue affects Widget for Google Reviews: from n/a through 1.0.15. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/business-reviews-wp/vulnerability/wordpress-w
lnrichment: References: - https://patchstack.com/database/wordpress/plugin/business-reviews-wp/vulnerability/wordpress-widget-for-google-reviews-1-0-15-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-53566 State: PUBLISHED Published: 2025-07-04T08:42:00.471Z Last Updated: 2025-07-08T14:19:05.721Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: osama.esh Products: WP Visitor Statistics (Real Time Traffic) Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) allows Stored XSS. This issue affects WP Visitor Statistics (Real Time Traffic): from n/a through 7.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-stats-manager/vulnerability/word
ISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-stats-manager/vulnerability/wordpress-wp-visitor-statistics-real-time-traffic-plugin-7-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-53567 State: PUBLISHED Published: 2025-08-20T08:03:11.051Z Last Updated: 2025-08-20T14:24:02.049Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: nK Products: Ghost Kit Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in nK Ghost Kit allows PHP Local File Inclusion. This issue affects Ghost Kit: from n/a through 3.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ghostkit/vulnerability/wordpress-ghost-kit-3-4-1-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-53568 State: PUBLISHED Published: 2025-07-04T08:42:01.451Z Last Updated: 2025-07-08T14:18:48.224Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Tony Zeoli Products: Radio Station Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Tony Zeoli Radio Station allows Cross Site Request Forgery. This issue affects Radio Station: from n/a through 2.5.12. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/radio-station/vulnerability/wordpress-radio-station-plugin-2-5-12-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-53569 State: PUBLISHED Published: 2025-07-04T08:42:02.508Z Last Updated: 2025-07-08T14:18:31.779Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Trust Payments Products: Trust Payments Gateway for WooCommerce (JavaScript Library) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Trust Payments Trust Payments Gateway for WooCommerce (JavaScript Library) allows Cross Site Request Forgery. This issue affects Trust Payments Gateway for WooCommerce (JavaScript Library): from n/a through 1.3.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/tru
6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/trust-payments-gateway-3ds2/vulnerability/wordpress-trust-payments-gateway-for-woocommerce-javascript-library-plugin-1-3-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-53570 State: PUBLISHED Published: 2025-09-22T18:25:30.286Z Last Updated: 2025-09-23T13:46:07.450Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: DELUCKS Products: DELUCKS SEO Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DELUCKS DELUCKS SEO allows Stored XSS. This issue affects DELUCKS SEO: from n/a through 2.7.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/delucks-seo/vulnerability/wordpress-delucks-seo-plugin-2-7-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-53571 State: PUBLISHED Published: 2025-09-05T16:18:14.783Z Last Updated: 2025-09-05T18:12:36.570Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: VillaTheme Products: HAPPY Problem Types: CWE-862 Description: Missing Authorization vulnerability in VillaTheme HAPPY allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects HAPPY: from n/a through 1.0.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/happy-helpdesk-support-ticket-system/vulnerability/wordpress-happy-plugin-1-0-6-broken-access-control-vulnerability?_s_id=cve