Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-66077 State: PUBLISHED Published: 2025-11-21T12:29:57.063Z Last Updated: 2025-11-21T21:47:20.694Z Vendors: wpWax Products: Legal Pages Problem Types: CWE-862 Description: Missing Authorization vulnerability in wpWax Legal Pages legal-pages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Legal Pages: from n/a through <= 1.4.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/legal-pages/vulnerability/wordpress-legal-pages-plugin-1-4-6-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-66079 State: PUBLISHED Published: 2025-11-21T12:29:57.227Z Last Updated: 2025-11-24T20:25:48.688Z Vendors: Jegstudio Products: Gutenverse Form Problem Types: CWE-862 Description: Missing Authorization vulnerability in Jegstudio Gutenverse Form gutenverse-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutenverse Form: from n/a through <= 2.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/gutenverse-form/vulnerability/wordpress-gutenverse-form-plugin-2-2-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-66081 State: PUBLISHED Published: 2025-11-21T12:29:57.410Z Last Updated: 2025-11-21T16:35:57.757Z Vendors: Jeff Starr Products: Head Meta Data Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr Head Meta Data head-meta-data allows Stored XSS.This issue affects Head Meta Data: from n/a through <= 20250327. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/head-meta-data/vulnerability/wordpress-head-meta-data-plugin-20250327-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-66082 State: PUBLISHED Published: 2025-11-21T12:29:57.578Z Last Updated: 2025-11-21T21:45:02.639Z Vendors: magepeopleteam Products: WpEvently Problem Types: CWE-862 Description: Missing Authorization vulnerability in magepeopleteam WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpEvently: from n/a through <= 5.0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/mage-eventpress/vulnerability/wordpress-wpevently-plugin-5-0-4-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-66083 State: PUBLISHED Published: 2025-11-21T12:29:57.750Z Last Updated: 2025-11-21T21:44:15.703Z Vendors: magepeopleteam Products: WpEvently Problem Types: CWE-862 Description: Missing Authorization vulnerability in magepeopleteam WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpEvently: from n/a through <= 5.0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/mage-eventpress/vulnerability/wordpress-wpevently-plugin-5-0-4-broken-access-control-vulnerability-2?_s_id=cve
CVE ID: CVE-2025-66084 State: PUBLISHED Published: 2025-11-21T12:29:57.920Z Last Updated: 2025-11-21T21:43:23.570Z Vendors: Shahjahan Jewel Products: FluentCommunity Problem Types: CWE-862 Description: Missing Authorization vulnerability in Shahjahan Jewel FluentCommunity fluent-community allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentCommunity: from n/a through <= 2.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/fluent-community/vulnerability/wordpress-fluentcommunity-plugin-2-0-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-66085 State: PUBLISHED Published: 2025-11-21T12:29:58.133Z Last Updated: 2025-11-21T21:41:06.240Z Vendors: tychesoftwares Products: Arconix Shortcodes Problem Types: CWE-862 Description: Missing Authorization vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Arconix Shortcodes: from n/a through <= 2.1.18. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/arconix-shortcodes/vulnerability/wordpress-arconix-shortcodes-plugin-2-1-18-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-66086 State: PUBLISHED Published: 2025-11-21T12:29:58.296Z Last Updated: 2025-11-21T21:39:21.844Z Vendors: Cozy Vision Products: SMS Alert Order Notifications Problem Types: CWE-862 Description: Missing Authorization vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMS Alert Order Notifications: from n/a through <= 3.8.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/sms-alert/vulnerability/wordpress-sms-alert-order-notifications-plugin-3-8-8-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-66087 State: PUBLISHED Published: 2025-11-21T12:29:58.540Z Last Updated: 2025-11-21T21:38:19.607Z Vendors: Property Hive Products: PropertyHive Problem Types: CWE-862 Description: Missing Authorization vulnerability in Property Hive PropertyHive propertyhive allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PropertyHive: from n/a through <= 2.1.12. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/propertyhive/vulnerability/wordpress-propertyhive-plugin-2-1-12-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-66089 State: PUBLISHED Published: 2025-11-21T12:29:58.741Z Last Updated: 2025-11-21T16:37:36.834Z Vendors: WebToffee Products: Product Feed for WooCommerce Problem Types: CWE-862 Description: Missing Authorization vulnerability in WebToffee Product Feed for WooCommerce webtoffee-product-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Feed for WooCommerce: from n/a through <= 2.3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/webtoffee-product-feed/vulnerability/wordpress-product-feed-for-woocommerce-plugin-2-3-1-broken-access-control-vulnerability
offee-product-feed/vulnerability/wordpress-product-feed-for-woocommerce-plugin-2-3-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-66090 State: PUBLISHED Published: 2025-11-21T12:29:58.912Z Last Updated: 2025-11-21T16:34:51.490Z Vendors: sonalsinha21 Products: SKT Skill Bar Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Skill Bar skt-skill-bar allows DOM-Based XSS.This issue affects SKT Skill Bar: from n/a through <= 2.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/skt-skill-bar/vulnerability/wordpress-skt-skill-bar-plugin-2-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-66091 State: PUBLISHED Published: 2025-11-21T12:29:59.090Z Last Updated: 2025-11-21T17:42:18.484Z Vendors: Design Products: Stylish Cost Calculator Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Design Stylish Cost Calculator stylish-cost-calculator allows DOM-Based XSS.This issue affects Stylish Cost Calculator: from n/a through <= 8.1.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/stylish-cost-calculator/vulnerability/wordpress-stylish-cost-calculator-plugin-8-1-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-66092 State: PUBLISHED Published: 2025-11-21T12:29:59.275Z Last Updated: 2025-11-21T12:29:59.275Z Vendors: bqworks Products: Accordion Slider Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bqworks Accordion Slider accordion-slider allows Stored XSS.This issue affects Accordion Slider: from n/a through <= 1.9.13. References: - https://vdp.patchstack.com/database/Wordpress/Plugin/accordion-slider/vulnerability/wordpress-accordion-slider-plugin-1-9-13-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-66093 State: PUBLISHED Published: 2025-11-21T12:29:59.483Z Last Updated: 2025-11-21T12:29:59.483Z Vendors: hupe13 Products: Extensions for Leaflet Map Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hupe13 Extensions for Leaflet Map extensions-leaflet-map allows DOM-Based XSS.This issue affects Extensions for Leaflet Map: from n/a through <= 4.8. References: - https://vdp.patchstack.com/database/Wordpress/Plugin/extensions-leaflet-map/vulnerability/wordpress-extensions-for-leaflet-map-plugin-4-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-66095 State: PUBLISHED Published: 2025-11-21T12:29:59.655Z Last Updated: 2025-11-21T12:29:59.655Z Vendors: Iqonic Design Products: KiviCare Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows SQL Injection.This issue affects KiviCare: from n/a through <= 3.6.13. References: - https://vdp.patchstack.com/database/Wordpress/Plugin/kivicare-clinic-management-system/vulnerability/wordpress-kivicare-plugin-3-6-13-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-66096 State: PUBLISHED Published: 2025-11-21T12:29:59.819Z Last Updated: 2025-11-21T12:29:59.819Z Vendors: Imtiaz Rayhan Products: Table Block by Tableberg Problem Types: CWE-862 Description: Missing Authorization vulnerability in Imtiaz Rayhan Table Block by Tableberg tableberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Table Block by Tableberg: from n/a through <= 0.6.9. References: - https://vdp.patchstack.com/database/Wordpress/Plugin/tableberg/vulnerability/wordpress-table-block-by-tableberg-plugin-0-6-9-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-66097 State: PUBLISHED Published: 2025-11-21T12:29:59.986Z Last Updated: 2025-11-21T16:32:47.272Z Vendors: Igor Jerosimić Products: I Order Terms Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Igor Jerosimić I Order Terms i-order-terms allows Cross Site Request Forgery.This issue affects I Order Terms: from n/a through <= 1.5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/i-order-terms/vulnerability/wordpress-i-order-terms-plugin-1-5-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-66098 State: PUBLISHED Published: 2025-11-21T12:30:00.878Z Last Updated: 2025-11-21T16:31:19.594Z Vendors: Camille V Products: Travelers' Map Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Camille V Travelers' Map travelers-map allows Stored XSS.This issue affects Travelers' Map: from n/a through <= 2.3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/travelers-map/vulnerability/wordpress-travelers-map-plugin-2-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-66099 State: PUBLISHED Published: 2025-11-21T12:30:01.184Z Last Updated: 2025-11-21T16:30:03.519Z Vendors: ThemeAtelier Products: Chat Help Problem Types: CWE-862 Description: Missing Authorization vulnerability in ThemeAtelier Chat Help chat-help allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chat Help: from n/a through <= 3.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/chat-help/vulnerability/wordpress-chat-help-plugin-3-1-3-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-66101 State: PUBLISHED Published: 2025-11-21T12:30:01.600Z Last Updated: 2025-11-21T15:39:28.695Z Vendors: Sabuj Kundu Products: CBX Bookmark & Favorite Problem Types: CWE-862 Description: Missing Authorization vulnerability in Sabuj Kundu CBX Bookmark & Favorite cbxwpbookmark allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CBX Bookmark & Favorite: from n/a through <= 2.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/cbxwpbookmark/vulnerability/wordpress-cbx-bookmark-favorite-plugin-2-0-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-66106 State: PUBLISHED Published: 2025-11-21T12:30:03.619Z Last Updated: 2025-11-21T12:30:03.619Z Vendors: Essential Plugin Products: Featured Post Creative Problem Types: CWE-862 Description: Missing Authorization vulnerability in Essential Plugin Featured Post Creative featured-post-creative allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Featured Post Creative: from n/a through <= 1.5.5. References: - https://vdp.patchstack.com/database/Wordpress/Plugin/featured-post-creative/vulnerability/wordpress-featured-post-creative-plugin-1-5-5-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-66107 State: PUBLISHED Published: 2025-11-21T12:30:04.428Z Last Updated: 2025-11-21T12:30:04.428Z Vendors: Scott Paterson Products: Subscriptions & Memberships for PayPal Problem Types: CWE-862 Description: Missing Authorization vulnerability in Scott Paterson Subscriptions & Memberships for PayPal subscriptions-memberships-for-paypal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Subscriptions & Memberships for PayPal: from n/a through <= 1.1.7. References: - https://vdp.patchstack.com/database/Wordpress/Plugin/subscriptions-memberships-for-paypal/vulnerability/wordpress-subscriptions-memberships-for-paypal-plugin-1-1-7-broken-acc
ubscriptions-memberships-for-paypal/vulnerability/wordpress-subscriptions-memberships-for-paypal-plugin-1-1-7-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-66108 State: PUBLISHED Published: 2025-11-21T12:30:04.685Z Last Updated: 2025-11-21T12:30:04.685Z Vendors: Merlot Digital (by TNC) Products: TNC Toolbox: Web Performance Problem Types: CWE-862 Description: Missing Authorization vulnerability in Merlot Digital (by TNC) TNC Toolbox: Web Performance tnc-toolbox allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TNC Toolbox: Web Performance: from n/a through <= 2.0.4. References: - https://vdp.patchstack.com/database/Wordpress/Plugin/tnc-toolbox/vulnerability/wordpress-tnc-toolbox-web-performance-plugin-2-0-4-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-66109 State: PUBLISHED Published: 2025-11-21T12:30:04.941Z Last Updated: 2025-11-21T12:30:04.941Z Vendors: octolize Products: Cart Weight for WooCommerce Problem Types: CWE-862 Description: Missing Authorization vulnerability in octolize Cart Weight for WooCommerce woo-cart-weight allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cart Weight for WooCommerce: from n/a through <= 1.9.11. References: - https://vdp.patchstack.com/database/Wordpress/Plugin/woo-cart-weight/vulnerability/wordpress-cart-weight-for-woocommerce-plugin-1-9-11-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-66110 State: PUBLISHED Published: 2025-11-21T12:30:05.216Z Last Updated: 2025-11-21T12:30:05.216Z Vendors: bPlugins Products: Tiktok Feed Problem Types: CWE-862 Description: Missing Authorization vulnerability in bPlugins Tiktok Feed b-tiktok-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tiktok Feed: from n/a through <= 1.0.22. References: - https://vdp.patchstack.com/database/Wordpress/Plugin/b-tiktok-feed/vulnerability/wordpress-tiktok-feed-plugin-1-0-22-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-66111 State: PUBLISHED Published: 2025-11-21T12:30:05.445Z Last Updated: 2025-11-21T12:30:05.445Z Vendors: Nelio Software Products: Nelio Popups Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nelio Software Nelio Popups nelio-popups allows Stored XSS.This issue affects Nelio Popups: from n/a through <= 1.3.0. References: - https://vdp.patchstack.com/database/Wordpress/Plugin/nelio-popups/vulnerability/wordpress-nelio-popups-plugin-1-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-66112 State: PUBLISHED Published: 2025-11-21T12:30:05.704Z Last Updated: 2025-11-21T17:39:06.162Z Vendors: WebToffee Products: Accessibility Toolkit by WebYes Problem Types: CWE-862 Description: Missing Authorization vulnerability in WebToffee Accessibility Toolkit by WebYes accessibility-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility Toolkit by WebYes: from n/a through <= 2.0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/accessibility-plus/vulnerability/wordpress-accessibility-toolkit-by-webyes-plugin-2-0-4-broken-access-control-vulnerabi
/accessibility-plus/vulnerability/wordpress-accessibility-toolkit-by-webyes-plugin-2-0-4-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-66113 State: PUBLISHED Published: 2025-11-21T12:30:05.951Z Last Updated: 2025-11-24T17:57:42.090Z Vendors: ThemeAtelier Products: Better Chat Support for Messenger Problem Types: CWE-862 Description: Missing Authorization vulnerability in ThemeAtelier Better Chat Support for Messenger better-chat-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Chat Support for Messenger: from n/a through <= 1.2.18. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/better-chat-support/vulnerability/wordpress-better-chat-support-for-messenger-plugin-1-2-18-broken-access
rdpress/Plugin/better-chat-support/vulnerability/wordpress-better-chat-support-for-messenger-plugin-1-2-18-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-66114 State: PUBLISHED Published: 2025-11-21T12:30:06.230Z Last Updated: 2025-11-21T12:30:06.230Z Vendors: theme funda Products: Show Variations as Single Products Woocommerce Problem Types: CWE-862 Description: Missing Authorization vulnerability in theme funda Show Variations as Single Products Woocommerce woo-show-single-variations-shop-category allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Show Variations as Single Products Woocommerce: from n/a through <= 2.0. References: - https://vdp.patchstack.com/database/Wordpress/Plugin/woo-show-single-variations-shop-category/vulnerability/wordpress-show-variations-as-single-products-w
e/Wordpress/Plugin/woo-show-single-variations-shop-category/vulnerability/wordpress-show-variations-as-single-products-woocommerce-plugin-2-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-66115 State: PUBLISHED Published: 2025-11-21T12:30:06.442Z Last Updated: 2025-11-21T12:30:06.442Z Vendors: MatrixAddons Products: Easy Invoice Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in MatrixAddons Easy Invoice easy-invoice allows PHP Local File Inclusion.This issue affects Easy Invoice: from n/a through <= 2.1.4. References: - https://vdp.patchstack.com/database/Wordpress/Plugin/easy-invoice/vulnerability/wordpress-easy-invoice-plugin-2-1-4-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-66179 State: REJECTED Published: N/A Last Updated: 2025-11-25T03:55:09.205Z Description: No description available.
CVE ID: CVE-2025-66180 State: REJECTED Published: N/A Last Updated: 2025-11-25T03:55:08.680Z Description: No description available.
CVE ID: CVE-2025-66181 State: REJECTED Published: N/A Last Updated: 2025-11-25T03:55:08.198Z Description: No description available.
CVE ID: CVE-2025-66182 State: REJECTED Published: N/A Last Updated: 2025-11-25T03:55:07.698Z Description: No description available.
CVE ID: CVE-2025-66183 State: REJECTED Published: N/A Last Updated: 2025-11-25T03:55:07.226Z Description: No description available.
CVE ID: CVE-2025-66184 State: REJECTED Published: N/A Last Updated: 2025-11-25T03:55:06.696Z Description: No description available.
CVE ID: CVE-2025-66185 State: REJECTED Published: N/A Last Updated: 2025-11-25T03:55:06.198Z Description: No description available.
CVE ID: CVE-2025-66186 State: REJECTED Published: N/A Last Updated: 2025-11-25T03:55:05.690Z Description: No description available.
CVE ID: CVE-2025-66187 State: REJECTED Published: N/A Last Updated: 2025-11-25T03:55:04.961Z Description: No description available.
CVE ID: CVE-2025-6000 State: PUBLISHED Published: 2025-08-01T17:40:48.524Z Last Updated: 2025-08-01T18:12:02.883Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: HashiCorp Products: Vault, Vault Enterprise Problem Types: CWE-94 Description: A privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2025-14-privileged-vault
nal Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2025-14-privileged-vault-operator-may-execute-code-on-the-underlying-host/76033
CVE ID: CVE-2025-6001 State: PUBLISHED Published: 2025-06-11T16:26:25.896Z Last Updated: 2025-06-11T17:49:41.382Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L) Vendors: VirtueMart Products: VirtueMart Problem Types: CWE-352 Description: A Cross-Site Request Forgery (CSRF) vulnerability exists in the product image upload function of VirtueMart that bypasses the CSRF protection token. An attacker is able to craft a special CSRF request which will allow unrestricted file upload into the VirtueMart media manager. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://blog.blacklanternsecurity.com/p/doomla-zero-days
CVE ID: CVE-2025-6002 State: PUBLISHED Published: 2025-06-11T16:26:47.283Z Last Updated: 2025-06-11T17:29:01.082Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: VirtueMart Products: VirtueMart Problem Types: CWE-434 Description: An unrestricted file upload vulnerability exists in the Product Image section of the VirtueMart backend. Authenticated attackers can upload files with arbitrary extensions, including executable or malicious files, potentially leading to remote code execution or other security impacts depending on server configuration. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://blog.blacklanternsecurity.com/p/doomla-zero-d
. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://blog.blacklanternsecurity.com/p/doomla-zero-days