Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-59524 State: PUBLISHED Published: 2025-09-24T18:12:55.990Z Last Updated: 2025-09-24T18:46:57.973Z Vendors: horilla-opensource Products: horilla Problem Types: CWE-79, CWE-434 Description: Horilla is a free and open source Human Resource Management System (HRMS). Prior to version 1.4.0, the file upload flow performs validation only in the browser and does not enforce server-side checks. An attacker can bypass the client-side validation (for example, with an intercepting proxy or by submitting a crafted request) to store an executable HTML document on the server. When an administrator or other privileged user views the uploaded file, the embedded script runs in their context a
ver. When an administrator or other privileged user views the uploaded file, the embedded script runs in their context and sends session cookies (or other credentials) to an attacker-controlled endpoint. The attacker then reuses those credentials to impersonate the admin. This issue has been patched in version 1.4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/horilla-opensource/horilla/security/advisories/GHSA-mff9-p8j9-9v5q - https://github.com/Mmo-kali/CVE/blob/main/CVE-2025-59524/2025-08-Horilla_Vulnerability_3.pdf - https://github.com/horilla-opensource/horilla/releases/tag/1.4.0
CVE ID: CVE-2025-59525 State: PUBLISHED Published: 2025-09-24T18:15:12.850Z Last Updated: 2025-10-15T16:06:11.174Z Vendors: horilla-opensource Products: horilla Problem Types: CWE-79, CWE-434 Description: Horilla is a free and open source Human Resource Management System (HRMS). Prior to version 1.4.0, improper sanitization across the application allows XSS via uploaded SVG (and via allowed <embed>), which can be chained to execute JavaScript whenever users view impacted content (e.g., announcements). This can result in admin account takeover. This issue has been patched in version 1.4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/horilla-opensource/h
version 1.4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/horilla-opensource/horilla/security/advisories/GHSA-rp5m-vpqr-vpvp - https://github.com/Mmo-kali/CVE/blob/main/CVE-2025-59525/2025-08-Horilla_Vulnerability_2.pdf - https://github.com/horilla-opensource/horilla/releases/tag/1.4.0
CVE ID: CVE-2025-59526 State: PUBLISHED Published: 2025-09-22T19:27:53.323Z Last Updated: 2025-09-22T19:45:47.069Z Vendors: eladnava Products: mailgen Problem Types: CWE-79 Description: mailgen is a Node.js package that generates responsive HTML e-mails for sending transactional mail. Prior to version 2.0.30, there is an HTML injection vulnerability in plaintext e-mails generated by Mailgen. Projects are affected if the Mailgen.generatePlaintext(email) method is used and given user-generated content. This vulnerability has been patched in version 2.0.30. A workaround involves stripping all HTML tags before passing any content into Mailgen.generatePlaintext(email). Additional Analyst Notes: -
es stripping all HTML tags before passing any content into Mailgen.generatePlaintext(email). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/eladnava/mailgen/security/advisories/GHSA-j2xj-h7w5-r7vp - https://github.com/eladnava/mailgen/commit/741a0190ddae0f408b22ae3b5f0f4c3f5cf4f11d
CVE ID: CVE-2025-59527 State: PUBLISHED Published: 2025-09-22T19:48:42.436Z Last Updated: 2025-09-22T20:25:56.571Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: FlowiseAI Products: Flowise Problem Types: CWE-918 Description: Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, a Server-Side Request Forgery (SSRF) vulnerability was discovered in the /api/v1/fetch-links endpoint of the Flowise application. This vulnerability allows an attacker to use the Flowise server as a proxy to access internal network web services and explore their link structures. This issue has been patched in version 3.0.6. Addition
internal network web services and explore their link structures. This issue has been patched in version 3.0.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-hr92-4q35-4j3m - https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/components/src/utils.ts#L474-L478 - https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/server/src/controllers/fetch-links/index.ts#L6-L24 - https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/server/src/services/fetch-links/index.ts#L8-L18 - https://github.com/FlowiseAI/
c655bcf8d2200ae827a1f5b9fec81d0/packages/server/src/services/fetch-links/index.ts#L8-L18 - https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.6
CVE ID: CVE-2025-59528 State: PUBLISHED Published: 2025-09-22T19:54:58.196Z Last Updated: 2025-09-22T20:24:09.883Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: FlowiseAI Products: Flowise Problem Types: CWE-94 Description: Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, Flowise is vulnerable to remote code execution. The CustomMCP node allows users to input configuration settings for connecting to an external MCP server. This node parses the user-provided mcpServerConfig string to build the MCP server configuration. However, during this process, it executes JavaScript code without any security va
to build the MCP server configuration. However, during this process, it executes JavaScript code without any security validation. Specifically, inside the convertToValidJSONString function, user input is directly passed to the Function() constructor, which evaluates and executes the input as JavaScript code. Since this runs with full Node.js runtime privileges, it can access dangerous modules such as child_process and fs. This issue has been patched in version 3.0.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-3gcm-f6qx-ff7p - https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/p
ty/advisories/GHSA-3gcm-f6qx-ff7p - https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/components/nodes/tools/MCP/CustomMCP/CustomMCP.ts#L132 - https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/components/nodes/tools/MCP/CustomMCP/CustomMCP.ts#L220 - https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/components/nodes/tools/MCP/CustomMCP/CustomMCP.ts#L262-L270 - https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/server/src/controllers/nodes/index.ts#L57-L78 - https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f
server/src/controllers/nodes/index.ts#L57-L78 - https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/server/src/routes/node-load-methods/index.ts#L5 - https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/server/src/services/nodes/index.ts#L91-L94 - https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.6
CVE ID: CVE-2025-59530 State: PUBLISHED Published: 2025-10-10T16:09:55.227Z Last Updated: 2025-10-10T16:31:47.457Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: quic-go Products: quic-go Problem Types: CWE-617, CWE-755 Description: quic-go is an implementation of the QUIC protocol in Go. In versions prior to 0.49.0, 0.54.1, and 0.55.0, a misbehaving or malicious server can cause a denial-of-service (DoS) attack on the quic-go client by triggering an assertion failure, leading to a process crash. This requires no authentication and can be exploited during the handshake phase. This was observed in the wild with certain server implementations. quic-go needs to
ploited during the handshake phase. This was observed in the wild with certain server implementations. quic-go needs to be able to handle misbehaving server implementations, including those that prematurely send a HANDSHAKE_DONE frame. Versions 0.49.0, 0.54.1, and 0.55.0 discard Initial keys when receiving a HANDSHAKE_DONE frame, thereby correctly handling premature HANDSHAKE_DONE frames. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/quic-go/quic-go/security/advisories/GHSA-47m2-4cr7-mhcw - https://github.com/quic-go/quic-go/pull/5354 - https://github.com/quic-go/quic-go/blob/v0.55.0/connection.go#L2682-L2685
CVE ID: CVE-2025-59531 State: PUBLISHED Published: 2025-10-01T20:49:35.428Z Last Updated: 2025-10-02T15:54:24.950Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: argoproj Products: argo-cd Problem Types: CWE-703 Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.7 and 3.0.18 are vulnerable to malicious API requests which can crash the API server and cause denial of service to legitimate clients. Without a configured webhook.bitbucketserver.secret, Argo CD's /api/webhook endpoint crashes when receiving a malformed Bitbucket Server paylo
ebhook.bitbucketserver.secret, Argo CD's /api/webhook endpoint crashes when receiving a malformed Bitbucket Server payload (non-array repository.links.clone field). A single unauthenticated request triggers CrashLoopBackOff, and targeting all replicas causes complete API outage. This issue is fixed in versions 2.14.20, 3.2.0-rc2, 3.1.8 and 3.0.19. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/argoproj/argo-cd/security/advisories/GHSA-f9gq-prrc-hrhc - https://github.com/argoproj/argo-cd/commit/5c466a4e39802e059e75c0008ae7b7b8e842538f
CVE ID: CVE-2025-59532 State: PUBLISHED Published: 2025-09-22T20:26:42.712Z Last Updated: 2025-09-23T20:19:23.374Z Vendors: openai Products: codex Problem Types: CWE-20 Description: Codex CLI is a coding agent from OpenAI that runs locally. In versions 0.2.0 to 0.38.0, due to a bug in the sandbox configuration logic, Codex CLI could treat a model-generated cwd as the sandbox’s writable root, including paths outside of the folder where the user started their session. This logic bypassed the intended workspace boundary and enables arbitrary file writes and command execution where the Codex process has permissions - this did not impact the network-disabled sandbox restriction. This issue has be
here the Codex process has permissions - this did not impact the network-disabled sandbox restriction. This issue has been patched in Codex CLI 0.39.0 that canonicalizes and validates that the boundary used for sandbox policy is based on where the user started the session, and not the one generated by the model. Users running 0.38.0 or earlier should update immediately via their package manager or by reinstalling the latest Codex CLI to ensure sandbox boundaries are enforced. If using the Codex IDE extension, users should immediately update to 0.4.12 for a fix of the sandbox issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/openai/codex/security/advis
x issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/openai/codex/security/advisories/GHSA-w5fx-fh39-j5rw - https://github.com/openai/codex/commit/8595237505a1e0faabc2af3db805b66ce3ae182d - https://github.com/openai/codex/releases/tag/rust-v0.39.0
CVE ID: CVE-2025-59534 State: PUBLISHED Published: 2025-09-23T18:25:06.128Z Last Updated: 2025-09-23T19:17:45.133Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: nasa Products: CryptoLib Problem Types: CWE-78 Description: CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.2, there is a command Injection vulnerability in initialize_kerberos_keytab_file_login(). The vulnerability exists because the code directly interpolates user-controlled input into a shell comm
ab_file_login(). The vulnerability exists because the code directly interpolates user-controlled input into a shell command and executes it via system() without any sanitization or validation. This issue has been patched in version 1.4.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nasa/CryptoLib/security/advisories/GHSA-jw5c-58hr-m3v3 - https://github.com/nasa/CryptoLib/commit/3ccb1b306026bb20a028fbfdcf18935f7345ed2f
CVE ID: CVE-2025-59535 State: PUBLISHED Published: 2025-09-22T20:59:03.801Z Last Updated: 2025-09-23T20:12:28.277Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: dnnsoftware Products: Dnn.Platform Problem Types: CWE-20, CWE-200, CWE-829 Description: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, arbitrary themes can be loaded through query parameters. If an installed theme had a vulnerability, even if it was not used on any page, this could be loaded on unsuspecting clients without knowledge of the site owner. This issue has been patched in version 10.1.0. Additional Ana
unsuspecting clients without knowledge of the site owner. This issue has been patched in version 10.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-wq2j-w9pm-7x2p - https://github.com/dnnsoftware/Dnn.Platform/commit/72f30f69fd2214d77f6c2577dfcca495a24caf5c - https://github.com/dnnsoftware/Dnn.Platform/blob/develop/DNN%20Platform/Library/UI/Skins/Skin.cs#L305
CVE ID: CVE-2025-59536 State: PUBLISHED Published: 2025-10-03T06:34:48.398Z Last Updated: 2025-10-03T13:26:23.309Z Vendors: anthropics Products: claude-code Problem Types: CWE-94 Description: Claude Code is an agentic coding tool. Versions before 1.0.111 were vulnerable to Code Injection due to a bug in the startup trust dialog implementation. Claude Code could be tricked to execute code contained in a project before the user accepted the startup trust dialog. Exploiting this requires a user to start Claude Code in an untrusted directory. Users on standard Claude Code auto-update will have received this fix automatically. Users performing manual updates are advised to update to the latest ve
update will have received this fix automatically. Users performing manual updates are advised to update to the latest version. This issue is fixed in version 1.0.111. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/anthropics/claude-code/security/advisories/GHSA-4fgq-fpq9-mr3g
CVE ID: CVE-2025-59537 State: PUBLISHED Published: 2025-10-01T21:01:36.519Z Last Updated: 2025-10-02T15:54:17.919Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: argoproj Products: argo-cd Problem Types: CWE-20, CWE-476 Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.7 and 3.0.18 are vulnerable to malicious API requests which can crash the API server and cause denial of service to legitimate clients. With the default configuration, no webhook.gogs.secret set, Argo CD’s /api/webhook endpoint will crash the entire argocd-server proces
lt configuration, no webhook.gogs.secret set, Argo CD’s /api/webhook endpoint will crash the entire argocd-server process when it receives a Gogs push event whose JSON field commits[].repo is not set or is null. This issue is fixed in versions 2.14.20, 3.2.0-rc2, 3.1.8 and 3.0.19. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/argoproj/argo-cd/security/advisories/GHSA-wp4p-9pxh-cgx2 - https://github.com/argoproj/argo-cd/commit/761fc27068d2d4cd24e1f784eb2a9033b5ee7f43
CVE ID: CVE-2025-59538 State: PUBLISHED Published: 2025-10-01T21:09:08.870Z Last Updated: 2025-10-02T15:54:11.490Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: argoproj Products: argo-cd Problem Types: CWE-248, CWE-703 Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. For versions 2.9.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.6 and 3.0.17, when the webhook.azuredevops.username and webhook.azuredevops.password are not set in the default configuration, the /api/webhook endpoint crashes the entire argocd-server process when it receives an Azure DevOps Push event whose JSON array resource.refUpdates is empty. T
ntire argocd-server process when it receives an Azure DevOps Push event whose JSON array resource.refUpdates is empty. The slice index [0] is accessed without a length check, causing an index-out-of-range panic. A single unauthenticated HTTP POST is enough to kill the process. This issue is resolved in versions 2.14.20, 3.2.0-rc2, 3.1.8 and 3.0.19. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/argoproj/argo-cd/security/advisories/GHSA-gpx4-37g2-c8pv - https://github.com/argoproj/argo-cd/commit/1a023f1ca7fe4ec942b4b6696804988d5a632baf
CVE ID: CVE-2025-59539 State: PUBLISHED Published: 2025-09-23T17:41:01.161Z Last Updated: 2025-09-23T18:37:32.639Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: dnnsoftware Products: Dnn.Platform Problem Types: CWE-79 Description: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, when embedding information in the Biography field, even if that field is not rich-text, users could inject javascript code that would run in the context of the website and to any other user that can view the profile including administrators and/or superusers. This issue has been patched in version
other user that can view the profile including administrators and/or superusers. This issue has been patched in version 10.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-7rcc-q6rq-jpcm
CVE ID: CVE-2025-59545 State: PUBLISHED Published: 2025-09-23T17:41:30.092Z Last Updated: 2025-09-23T18:37:27.029Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: dnnsoftware Products: Dnn.Platform Problem Types: CWE-79 Description: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, the Prompt module allows execution of commands that can return raw HTML. Malicious input, even if sanitized for display elsewhere, can be executed when processed through certain commands, leading to potential script execution (XSS). This issue has been patched in version 10.1.0. Additional Analy
n commands, leading to potential script execution (XSS). This issue has been patched in version 10.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-2qxc-mf4x-wr29
CVE ID: CVE-2025-59546 State: PUBLISHED Published: 2025-09-23T17:41:47.908Z Last Updated: 2025-09-23T18:37:20.856Z Severity: LOW (CVSS 2.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N) Vendors: dnnsoftware Products: Dnn.Platform Problem Types: CWE-79 Description: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, administrators and content editors can set html in module titles that could include javascript which could be used for XSS based attacks. This issue has been patched in version 10.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dnnsoftware/Dnn.Platform/securit
.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-gj8m-5492-q98h
CVE ID: CVE-2025-59547 State: PUBLISHED Published: 2025-09-23T17:56:47.161Z Last Updated: 2025-09-23T18:36:39.686Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: dnnsoftware Products: Dnn.Platform Problem Types: CWE-176 Description: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, the CKEditor file upload endpoint has insufficient sanitization for filenames allowing probing network endpoints. A specially crafted request can be made to upload a file with Unicode characters, which would be translated into a path that could expose resources in the internal network of the host
nicode characters, which would be translated into a path that could expose resources in the internal network of the hosted site. This issue has been patched in version 10.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-cgqj-mw4m-v7hp
CVE ID: CVE-2025-59548 State: PUBLISHED Published: 2025-09-23T17:58:55.146Z Last Updated: 2025-09-23T18:36:33.940Z Vendors: dnnsoftware Products: Dnn.Platform Problem Types: CWE-79 Description: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, specially crafted URLs to the FileBrowser are vulnerable to javascript injection, affecting any unsuspecting user clicking such link. This issue has been patched in version 10.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-5fj9-542v-w4rq
CVE ID: CVE-2025-59549 State: PUBLISHED Published: 2025-09-22T18:26:06.917Z Last Updated: 2025-09-23T17:49:20.293Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: fatcatapps Products: GetResponse Forms Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fatcatapps GetResponse Forms allows Stored XSS. This issue affects GetResponse Forms: from n/a through 2.6.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/getresponse/vulnerability/wordpress-getresponse-forms-plugin-2-6-0-cross-site-scripting-xss-vulnerabili
wordpress/plugin/getresponse/vulnerability/wordpress-getresponse-forms-plugin-2-6-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-59550 State: PUBLISHED Published: 2025-10-22T14:32:37.298Z Last Updated: 2025-11-13T10:33:44.143Z Vendors: designervily Products: Xcare Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in designervily Xcare xcare allows PHP Local File Inclusion.This issue affects Xcare: from n/a through < 6.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/xcare/vulnerability/wordpress-xcare-theme-6-5-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-59551 State: PUBLISHED Published: 2025-09-22T18:26:06.203Z Last Updated: 2025-09-23T17:49:28.733Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: WP Chill Products: Revive.so Problem Types: CWE-862 Description: Missing Authorization vulnerability in WP Chill Revive.so allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Revive.so: from n/a through 2.0.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/revive-so/vulnerability/wordpress-revive-so-plugin-2-0-6-broken-access-control-vulnerability?_s_id=cve