Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1627e235-7836-43dc-a3f6-7f79da6ab229?source=cve - https://plugins.trac.wordpress.org/browser/elementskit-lite/tags/3.4.8/modules/widget-builder/controls/control-type-url.php#L9 - https://plugins.trac.wordpress.org/browser/elementskit-lite/tags/3.4.8/modules/widget-builder/controls/widget-writer.php#L366
CVE ID: CVE-2025-3615 State: PUBLISHED Published: 2025-04-17T07:34:08.201Z Last Updated: 2025-04-17T16:02:37.044Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: techjewel Products: Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Problem Types: CWE-79 Description: The Fluent Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form-submission.js script in all versions up to, and including, 6.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that wi
e for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f31bd18e-57d4-4c87-8a7c-a168e7e70061?source=cve - https://plugins.trac.wordpress.org/browser/fluentform/tags/6.0.2/assets/js/form-submission.js - https://wordpress.org/plugins/fluentform/#developers - https://plugins.trac.wordpress.org/changeset/3274693/
CVE ID: CVE-2025-3616 State: PUBLISHED Published: 2025-04-22T04:21:32.528Z Last Updated: 2025-04-22T13:17:08.386Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: wpsoul Products: Greenshift – animation and page builder blocks Problem Types: CWE-434 Description: The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the gspb_make_proxy_api_request() function in versions 11.4 to 11.4.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution
ber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The arbitrary file upload was sufficiently patched in 11.4.5, but a capability check was added in 11.4.6 to properly prevent unauthorized limited file uploads. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0db4671e-1989-44a4-babe-ed699c7f3a52?source=cve - https://plugins.trac.wordpress.org/browser/greenshift-animation-and-page-builder-blocks/trunk/init.php#L3340 - https://plugins.trac.wordpress.org/changeset/3270279/greenshift-animation-and-page-builder-blocks/trunk/init.php - https://pl
://plugins.trac.wordpress.org/changeset/3270279/greenshift-animation-and-page-builder-blocks/trunk/init.php - https://plugins.trac.wordpress.org/changeset/3276168/greenshift-animation-and-page-builder-blocks/trunk/init.php - https://plugins.trac.wordpress.org/changeset/3273212/greenshift-animation-and-page-builder-blocks/trunk/init.php
CVE ID: CVE-2025-3617 State: PUBLISHED Published: 2025-04-15T17:17:25.324Z Last Updated: 2025-04-17T17:25:03.386Z Vendors: Rockwell Automation Products: ThinManager® Problem Types: 276 - Incorrect Default Permissions Description: A privilege escalation vulnerability exists in the Rockwell Automation ThinManager. When the software starts up, files are deleted in the temporary folder causing the Access Control Entry of the directory to inherit permissions from the parent directory. If exploited, a threat actor could inherit elevated privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1
A ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1727.html
CVE ID: CVE-2025-3618 State: PUBLISHED Published: 2025-04-15T17:19:53.368Z Last Updated: 2025-04-17T17:25:38.739Z Vendors: Rockwell Automation Products: ThinManager Problem Types: 119 - Improper Restriction of Operations within the Bounds of a Memory Buffer Description: A denial-of-service vulnerability exists in the Rockwell Automation ThinManager. The software fails to adequately verify the outcome of memory allocation while processing Type 18 messages. If exploited, a threat actor could cause a denial-of-service on the target software. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1727.
P Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1727.html
CVE ID: CVE-2025-3619 State: PUBLISHED Published: 2025-04-16T20:57:44.990Z Last Updated: 2025-04-17T13:39:53.422Z Vendors: Google Products: Chrome Problem Types: CWE-122 Description: Heap buffer overflow in Codecs in Google Chrome on Windows prior to 135.0.7049.95 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop_15.html - https://issues.chromium.org/issues/409619251
CVE ID: CVE-2025-3620 State: PUBLISHED Published: 2025-04-16T20:57:45.676Z Last Updated: 2025-04-17T13:37:30.337Z Vendors: Google Products: Chrome Problem Types: CWE-416 Description: Use after free in USB in Google Chrome prior to 135.0.7049.95 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop_15.html - https://issues.chromium.org/issues/405292639
CVE ID: CVE-2025-3621 State: PUBLISHED Published: 2025-07-15T07:22:49.897Z Last Updated: 2025-07-15T13:30:22.159Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L) Vendors: ProTNS Products: ActADUR Problem Types: CWE-77, CWE-798, CWE-287, CWE-1327 Description: Vulnerabilities* in ActADUR local server product, developed and maintained by ProTNS, allows Remote Code Inclusion on host systems. * vulnerabilities: * Improper Neutralization of Special Elements used in a Command ('Command Injection') * Use of Hard-coded Credentials * Improper Authentication * Binding to an Unrestricted IP Address The vulnerability has been rated as critical.This issue affects ActADUR: from v
* Binding to an Unrestricted IP Address The vulnerability has been rated as critical.This issue affects ActADUR: from v2.0.1.9 before v2.0.2.0., hence updating to version v2.0.2.0. or above is required. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.protns.com/53
CVE ID: CVE-2025-3622 State: PUBLISHED Published: 2025-04-15T05:31:14.464Z Last Updated: 2025-04-21T11:28:17.062Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Xorbits Products: Inference Problem Types: CWE-502, CWE-20 Description: A vulnerability, which was classified as critical, has been found in Xorbits Inference up to 1.4.1. This issue affects the function load of the file xinference/thirdparty/cosyvoice/cli/model.py. The manipulation leads to deserialization. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304679 - https://vuldb.com/?ctiid.304679 - https://vuldb.com/?submit.552245 - https://github.com/xorbitsai/
uldb.com/?id.304679 - https://vuldb.com/?ctiid.304679 - https://vuldb.com/?submit.552245 - https://github.com/xorbitsai/inference/issues/3190 - https://github.com/xorbitsai/inference/issues/3190#issuecomment-2783462266
CVE ID: CVE-2025-3623 State: PUBLISHED Published: 2025-05-14T02:23:17.305Z Last Updated: 2025-06-26T17:52:26.539Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: uncannyowl Products: Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin Problem Types: CWE-502 Description: The Uncanny Automator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.4.0.1 via deserialization of untrusted input in the automator_api_decode_message() function. This makes it possible for unauthenticated to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary fil
unauthenticated to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/00bcfd8f-9785-449a-a0ea-16e2583d684a?source=cve - https://wordpress.org/plugins/uncanny-automator/#developers - https://plugins.trac.wordpress.org/browser/uncanny-automator/trunk/src/core/lib/helpers/class-automator-recipe-helpers.php#L540 - https://plugins.trac.wordpress.org/changeset/3276577/uncanny-automator/trunk/src/core/lib/helpers/class-automator-recipe-helpers.php - https://automatorplugin.com/knowledge-base/uncanny-automator-changelog/#6-4-
elpers/class-automator-recipe-helpers.php - https://automatorplugin.com/knowledge-base/uncanny-automator-changelog/#6-4-0-2-2025-04-18
CVE ID: CVE-2025-3624 State: PUBLISHED Published: 2025-05-16T06:42:19.538Z Last Updated: 2025-05-16T15:31:49.610Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Hitachi Products: Hitachi Ops Center Analyzer Problem Types: CWE-862 Description: Missing Authorization vulnerability in Hitachi Ops Center Analyzer (Hitachi Ops Center Analyzer detail view component).This issue affects Hitachi Ops Center Analyzer: from 10.0.0-00 before 11.0.4-00. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2025-116/index.html
CVE ID: CVE-2025-3625 State: PUBLISHED Published: 2025-04-25T14:42:39.887Z Last Updated: 2025-04-25T16:01:25.670Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H) Problem Types: CWE-639 Description: A security vulnerability was discovered in Moodle that can allow hackers to gain access to sensitive information about students and prevent them from logging into their accounts, even after they had completed two-factor authentication (2FA). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-3625 - https://bugzilla.redhat.com/show_bug.cgi?id=2359690
CVE ID: CVE-2025-3626 State: PUBLISHED Published: 2025-07-07T09:19:21.718Z Last Updated: 2025-07-07T17:37:17.846Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Frauscher Products: FDS102 Problem Types: CWE-78 Description: A remote attacker with administrator account can gain full control of the device due to improper neutralization of special elements used in an OS Command ('OS Command Injection') while uploading a config file via webUI. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/en/advisories/VDE-2025-030
CVE ID: CVE-2025-3627 State: PUBLISHED Published: 2025-04-25T14:42:42.646Z Last Updated: 2025-04-25T16:01:15.301Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Problem Types: CWE-287 Description: A security vulnerability was discovered in Moodle that allows some users to access sensitive information about other students before they finish verifying their identities using two-factor authentication (2FA). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-3627 - https://bugzilla.redhat.com/show_bug.cgi?id=2359692
CVE ID: CVE-2025-3628 State: PUBLISHED Published: 2025-04-25T14:42:45.242Z Last Updated: 2025-04-25T16:01:05.623Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Problem Types: CWE-200 Description: A flaw has was found in Moodle where anonymous assignment submissions can be de-anonymized via search, revealing student identities. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-3628 - https://bugzilla.redhat.com/show_bug.cgi?id=2359706
CVE ID: CVE-2025-3629 State: PUBLISHED Published: 2025-06-21T12:45:57.805Z Last Updated: 2025-08-24T11:44:35.734Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: IBM Products: InfoSphere Information Server Problem Types: CWE-282 Description: IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 could allow an authenticated user to delete another user's comments due to improper ownership management. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7235496
CVE ID: CVE-2025-3630 State: PUBLISHED Published: 2025-07-08T14:51:24.983Z Last Updated: 2025-08-24T11:31:14.738Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: IBM Products: Sterling B2B Integrator, Sterling File Gateway Problem Types: CWE-79 Description: IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.6, 6.2.0.0 through 6.2.0.4, IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6, and 6.2.0.0 through 6.2.0.4 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted sessio
he Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7239095
CVE ID: CVE-2025-3631 State: PUBLISHED Published: 2025-07-11T18:37:38.769Z Last Updated: 2025-08-18T01:35:24.388Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: MQ, MQ Appliance Problem Types: CWE-416 Description: An IBM MQ 9.3 and 9.4 Client connecting to an MQ Queue Manager can cause a SIGSEGV in the AMQRMPPA channel process terminating it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7238310 - https://www.ibm.com/support/pages/node/7237025
CVE ID: CVE-2025-3632 State: PUBLISHED Published: 2025-05-12T16:21:53.084Z Last Updated: 2025-08-28T14:12:45.664Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: 4769 Developers Toolkit Problem Types: CWE-789 Description: IBM 4769 Developers Toolkit 7.0.0 through 7.5.52 could allow a remote attacker to cause a denial of service in the Hardware Security Module (HSM) due to improper memory allocation of an excessive size. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7233139
CVE ID: CVE-2025-3634 State: PUBLISHED Published: 2025-04-25T14:02:05.222Z Last Updated: 2025-04-25T14:42:48.989Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Problem Types: CWE-287 Description: A security vulnerability was discovered in Moodle that allows students to enroll themselves in courses without completing all the necessary safety checks. Specifically, users can sign up for courses prematurely, even if they haven't finished two-step verification processes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-3634 - https://bugzilla.redhat.com/show_bug.cgi?id=2359707
CVE ID: CVE-2025-3635 State: PUBLISHED Published: 2025-04-25T14:42:51.572Z Last Updated: 2025-04-25T16:00:54.948Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Problem Types: CWE-352 Description: A security vulnerability was discovered in Moodle that allows anyone to duplicate existing tours without needing to log in due to a lack of protection against cross-site request forgery (CSRF) attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-3635 - https://bugzilla.redhat.com/show_bug.cgi?id=2359709
CVE ID: CVE-2025-3636 State: PUBLISHED Published: 2025-04-25T14:42:54.270Z Last Updated: 2025-04-25T15:56:11.269Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Problem Types: CWE-639 Description: A flaw was found in Moodle. This vulnerability allows unauthorized users to access and view RSS feeds due to insufficient capability checks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-84499 - https://access.redhat.com/security/cve/CVE-2025-3636 - https://bugzilla.redhat.com/show_bug.cgi?id=2359726
CVE ID: CVE-2025-3637 State: PUBLISHED Published: 2025-04-25T14:42:56.775Z Last Updated: 2025-04-25T15:56:03.369Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Problem Types: CWE-598 Description: A security vulnerability was found in Moodle where confidential information that prevents cross-site request forgery (CSRF) attacks was shared publicly through the site's URL. This vulnerability occurred specifically on two types of pages within the mod_data module: edit and delete pages. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-65356 - https://access.redhat.com/security/cve/CVE-2025
//git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-65356 - https://access.redhat.com/security/cve/CVE-2025-3637 - https://bugzilla.redhat.com/show_bug.cgi?id=2359727
CVE ID: CVE-2025-3638 State: PUBLISHED Published: 2025-04-25T14:42:59.376Z Last Updated: 2025-04-28T16:53:21.925Z Problem Types: CWE-352 Description: A flaw was found in Moodle. The analysis request action in the Brickfield tool did not include the necessary token to prevent a Cross-site request forgery (CSRF) risk. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-3638 - https://bugzilla.redhat.com/show_bug.cgi?id=2359732 - https://moodle.org/mod/forum/discuss.php?d=467600
CVE ID: CVE-2025-3639 State: PUBLISHED Published: 2025-08-18T16:48:41.222Z Last Updated: 2025-08-18T19:51:51.759Z Vendors: Liferay Products: Portal, DXP Problem Types: CWE-288 Description: Liferay Portal 7.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 and 7.3 GA through update 36 allows unauthenticated users with valid credentials to bypass the login process by changing the POST method to GET, once the site has MFA enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-v
FA enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-3639
CVE ID: CVE-2025-3640 State: PUBLISHED Published: 2025-04-25T14:43:02.110Z Last Updated: 2025-04-28T16:47:19.391Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Problem Types: CWE-639 Description: A flaw was found in Moodle. Insufficient capability checks made it possible for a user enrolled in a course to access some details, such as the full name and profile image URL, of other users they did not have permission to access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-3640 - https://bugzilla.redhat.com/show_bug.cgi?id=2359734 - https://moodle.org/mod/forum/discuss.php?d=467601
CVE ID: CVE-2025-3641 State: PUBLISHED Published: 2025-04-25T14:43:04.861Z Last Updated: 2025-04-28T16:40:46.077Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Problem Types: CWE-94 Description: A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS Dropbox repository. By default, this was only available to teachers and managers on sites with the Dropbox repository enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-3641 - https://bugzilla.redhat.com/show_bug.cgi?id=2359735 - https://moodle.org/mod/forum/discuss.php?d=467602
CVE ID: CVE-2025-3642 State: PUBLISHED Published: 2025-04-25T14:43:07.535Z Last Updated: 2025-04-28T16:37:48.996Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Problem Types: CWE-94 Description: A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS EQUELLA repository. By default, this was only available to teachers and managers on sites with the EQUELLA repository enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-3642 - https://bugzilla.redhat.com/show_bug.cgi?id=2359738 - https://moodle.org/mod/forum/discuss.php?d=467603
CVE ID: CVE-2025-3643 State: PUBLISHED Published: 2025-04-25T14:43:10.125Z Last Updated: 2025-04-28T16:35:17.971Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Problem Types: CWE-79 Description: A flaw was found in Moodle. The return URL in the policy tool required additional sanitizing to prevent a reflected Cross-site scripting (XSS) risk. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-3643 - https://bugzilla.redhat.com/show_bug.cgi?id=2359742 - https://moodle.org/mod/forum/discuss.php?d=467604
CVE ID: CVE-2025-3644 State: PUBLISHED Published: 2025-04-25T14:43:12.816Z Last Updated: 2025-04-28T16:31:20.709Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Problem Types: CWE-863 Description: A flaw was found in Moodle. Additional checks were required to prevent users from deleting course sections they did not have permission to modify. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-3644 - https://bugzilla.redhat.com/show_bug.cgi?id=2359745 - https://moodle.org/mod/forum/discuss.php?d=467605
CVE ID: CVE-2025-3645 State: PUBLISHED Published: 2025-04-25T14:43:15.306Z Last Updated: 2025-04-28T16:28:39.820Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Problem Types: CWE-863 Description: A flaw was found in Moodle. Insufficient capability checks in a messaging web service allowed users to view other users' names and online statuses. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-3645 - https://bugzilla.redhat.com/show_bug.cgi?id=2359761 - https://moodle.org/mod/forum/discuss.php?d=467606
CVE ID: CVE-2025-3647 State: PUBLISHED Published: 2025-04-25T14:43:18.135Z Last Updated: 2025-04-28T16:25:41.757Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Problem Types: CWE-863 Description: A flaw was discovered in Moodle. Additional checks were required to ensure that users can only access cohort data they are authorized to retrieve. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-3647 - https://bugzilla.redhat.com/show_bug.cgi?id=2359762 - https://moodle.org/mod/forum/discuss.php?d=467607